The Columbia Tribune is reporting a doctor's allegations that, after he left his hospital practice, his former employer passed his patient list to an external company to market services to them:

Doctor hears from patients who say university broke law :

"...That's why he decided to leave to start a private practice. King thought he was leaving on good terms with no hard feelings. Then he started hearing from his patients.

King was shocked when he found out what had happened. His former boss, Kevin Dellsperger, chairman of internal medicine, had given a list of about 800 of King's former patients, along with their phone numbers, to a home-health-care provider from Cape Girardeau. A woman from the company had been calling the patients, King says, trying to sell home health-care services, including a $3,000-a-month drug that he says many of the patients didn't need.

'She was making cold calls, asking people about their hepatitis C,' he says. 'Most of the people on the list have hepatitis C. Not all of them do. I got a call from one lady frantic over the phone call. "I don't have hepatitis C," she told me. "What's this all about?" Whoever was making the calls had no way of knowing if these people were sick, if they have cirrhosis, if they're still using. She's just making phone calls to get people on treatment. That is scary.'

It's also, King believes, a clear violation of the recently enacted federal privacy law, the Health Insurance Portability and Accountability Act, or HIPA [sic HIPAA]. The law severely restricts hospitals' and doctors' ability to share private information about patients, including names and phone numbers, without consent from the patient. There are specific rules that guide the use of information for marketing, unless the other medical party already has some relationship to the patient.

What complicates the privacy concern in this case is the nature of hepatitis C patients. Most, King says, are middle-age folks who contracted the disease from youthful indiscretions in the 1960s and '70s. Some got it from blood exposure or bad needles, possibly from drug use, others got it from bad blood transfusions before 1990 when procedures were improved....

Labels: health information, information breaches