What To Do If You Suspect Your Medical/health Record Confidentiality Has Been Breached STAFF PICK

Nick Passe

Written by

Litigation Lawyer - La Crosse, WI

Contributor Level 15

Posted almost 4 years ago. Applies to Wisconsin, 1 helpful vote



Uh oh - how did that person know that private information about my health?

Health care providers - clinics, hospitals and other entities - are run by people. Yes there are computers and other technologies that make the office work more efficiently and allow you to receive better care than our grandparents could have ever hoped to receive, but ultimately it is people who care for us. It is also people who type up notes and vacuum the floors. These people have curiosities and interests in the lives of others. Sometimes, these curiosities lead health care workers to inappropriately access the medical / health care records of individuals they are not treating. Sometimes, individuals with access to health care records go even further and pass protected health information along to others.


They can't do that, right?

The Wisconsin State Legislature has put a big emphasis importance of maintaining health care confidentiality in the Wisconsin Statutes. Patients need to be able to trust in the privacy of their records for very important reasons. First, the health of the public as a whole is hurt when people decline to reveal potentially embarrassing information to medical professionals, particularly in the case of transmissible illnesses like swine flu or sexually transmitted diseases. Second, individuals are unlikely to seek timely care for their conditions if they fear the conditions might be made public by irresponsible health care workers, leading to worsening of individuals' medical conditions and the secondary problems that go with them lost work, pain and suffering, harm to relationships, etc.) Except under very limited (and statutorily enumerated) circumstances, no one should be accessing or disclosing the contents of your health records to anyone else without your permission.


What penalties are available?

The value of a claim by someone for a violation of statutes protecting the privacy of medical records is heavily fact-specific. A person who negligently accessed or disclosed medical records is liable for up to $1,000 per incident in exemplary damages plus actual damages suffered by the victim and actual attorney's fees. A person who intentionally accessed or disclosed confidential health information covered by the relevant statutes is liable for up to $25,000 in exemplary damages per incident plus actual damages suffered by the victim, plus actual attorney's fees. By creating large penalties and offering actual attorney's fees to plaintiffs who can prove their cases, the Wisconsin Legislature has signaled its commitment to keeping confidential health information private. Attorneys are given the economic incentive to prosecute these cases even if actual damages suffered by victims are relatively small. The hope is the large penalties and fees available will deter bad behavior.


How do I know for sure who accessed my health care records?

Most medical records these days are electronic, not paper. 20 years ago a nosy neighbor working at the hospital might pick up a paper file and browse your medical records with a reasonable degree of certainty she could do so anonymously. Today, the nosy neighbor working at the hospital who wants to read your records today may very well leave electronic "fingerprints" on your file showing they accessed the file. It is generally easy to determine if someone accessed your records for a legitimate care-related purpose or not. An attorney who has dealt with medical record privacy cases in the past should be able to help you request a list of who has accessed your medical records and when, especially if that attorney believes he/she will represent you in any medical record privacy litigation.


Okay - I've determined someone accessed my records without justification. Now what?

If you have not already done so, it is in your interest to see an attorney at this point. Wisconsin Statutes allow for the recovery of attorney's fees so if you can show an attorney you have a case, you should be able to get representation on a contingency fee basis (no up front cost to you with the attorney getting paid out of the proceeds if your case is successful). The attorney will want to determine as much information as possible about your case before taking any action. You might have the urge to talk to friends and family about the situation or even try to tell everyone you know about what the other person did. You should try to resist this urge for the time being. You can always tell people in the future but you can not "untell" them. Often cases are resolved quietly and the person who wrongly accessed your records might be willing and able to offer you more favorable terms for settling your case if you have not told others about his/her wrongdoing.


What is my attorney going to do?

Once your attorney has all the information he/she is able to get, the attorney will probably want to send correspondence to the wrongdoer explaining the attorney is representing you and making a demand for terms to settle your case before litigation is filed. This "demand letter" typically does a good job of getting a person's attention. The wrongdoer may contact your attorney directly or may hire an attorney and have that attorney speak to your attorney. The wrongdoer may want to avoid involving his/her employer. Involving the employer may or may not be helpful to your position. The statutes provide for a "safe harbor" if the employer acted in good faith with respect to keeping records private. You should talk about this issue with your attorney. Remember, your feelings may be hurt but if you want to recover money from the wrongdoer, the wrongdoer needs to have a way of paying you so making the case unnecessarily public might not be in your interest. Again, discuss this issue.


What happens next?

If you are able to reach a settlement you can live with given your unique circumstances, congratulations. If you are unable to resolve the issue through negotiations, you will need to litigate the case and prove that the wrongdoer violated the relevant Wisconsin law. You should discuss the upsides and downsides of conducting litigation with your attorney. Proving your case in court would likely result in a certain degree of publicity for you, the wrongdoer and the wrongdoer's employer. This may be a cathartic but it also may be embarrassing. Litigation could require you to spend significant amounts of time preparing the case and answering questions.



I wish you well and hope this guide has helped you get a good basic understanding of Wisconsin's medical records privacy laws. I would appreciate any positive feedback you could offer on my profile and I would be happy to offer a free office or phone consultation about your case if you have not already retained an attorney. This guide is not intended to be legal advice and no attorney/client privilege is created by the reading or use of this guide. As indicated in the guide, highly recommend retaining an attorney to help you with any Wisconsin health record / medical record privacy issues you may have.

Additional Resources

Wisconsin Statutes Chapter 146 - see 146.81 and thereafter in particular

Wisconsin Privacy Laws

Wisconsin Health Information Privacy - Dept. of ATCP Office of Privacy Protection

Wisconsin Medical Records - State Law Library Link

Rate this guide

Can't find what you're looking for? Ask a Lawyer

Get free answers from experienced attorneys.


Ask now

26,284 answers this week

3,005 attorneys answering