Unauthorized Disclosure: Judicial Violation of Mental Health Privacy
Brandon Sharp managed a gas company in East Texas. Healthy, in his thirties, Sharp rarely saw a doctor. And yet he owed thousands of dollars in medical bills. Sharp was the target of medical identity theft, which victimizes tens of thousands of people each year. Thieves steal patient information, including names, Social Security numbers, addresses, and medical histories, and then submit fraudulent insurance claims for surgery and prescriptions. Victims, like Sharp, face more than inconvenience: sometimes police arrest them instead of the thief for insurance fraud, or their information is conflated with the thief’s, leading to misdiagnosis. Contrary to popular opinion, the most common mode of theft is not computer hacking or breaking and entering but unauthorized disclosure by providers.
Section 33.13 of New York’s Mental Hygiene Law aims to prevent unauthorized disclosure. It prohibits providers from releasing patient information, specifically mental health records, absent an exception. A mental health record includes “all pertinent documents relating to the patient” about legal status, examination, care, and treatment. However, New York state courts routinely violate Section 33.13. Claimants often sue New York when a patient in a state hospital injures them. In these cases, New York courts have ordered hospitals to disclose “nonmedical” information from the patients’ mental health record, in violation of Section 33.13.
Following Section 33.13’s passage in 1985, the New York Court of Claims decided Villano v. State (1985). In lawsuits against New York, Villano and its progeny determine when a court can order a provider to disclose mental health information. In Villano (1985), a patient allegedly assaulted the claimant in a state hospital. The claimant requested the patient’s “record as well as any incident reports involving attacks.” The court ordered the hospital to release “nonmedical data,” including “reports of similar violent behavior,” found in the patient’s mental health record. But the court treated differently the “medical” information found in the patient’s record. It only ordered the release of this information after finding that “the interests of justice significantly outweigh[ed] the need for confidentiality.” The New York Supreme Court Appellate Division, Second Department followed suit in Exelbert v. State (1988). Like in Villano, a claimant sued the state for alleged assault by a patient. The court inferred that the lower court appropriately ordered the release of the patient’s nonmedical data without conducting an interests of justice analysis. Recent cases, Szmania v. State (2011), Johnson v. County of Nassau (2012), and Bellamy v. State of New York (2016), affirmed Villano and Exelbert.
But Villano and its progeny violate Section 33.13. First, New York courts can not subdivide a record into medical and nonmedical information. Section 33.13 treats a mental health record as a collective, because it includes “any information” and “all pertinent documents relating to a patient” (emphasis added). According to Section 33.13, courts can order a provider to release patient information by finding “that the interests of justice significantly outweigh the need for confidentiality.” Absent from this analysis is any lesser standard for releasing nonmedical information.
Second, even if a court could subdivide a record, Section 33.13 still extends to the allegedly nonmedical information disclosed in Villano and its progeny. Nonmedical information, including that “relating to any prior assaults or similar violent behavior,” is data concerning “an identifiable patient” and his “admission . . . care, and treatment.” Otherwise, a facility would not need to maintain this information. The facility maintains it, because a record must “include all pertinent documents relating to a patient.”
Third, the only applicable exception that allows a court to order this release is by finding “that the interests of justice significantly outweigh the need for confidentiality.” Yet, courts only apply this analysis to medical data after it categorizes information as medical or nonmedical and discloses the nonmedical data.
Finally, Villano and its progeny cite pre-1985 decisions that form distinguishing medical from nonmedical information. In Mayer v. Albany Medical Center Hospital (1971), a patient at a state hospital allegedly assaulted the claimant who then sought the patient’s record. The court found that the claimant was “entitled to all nonmedical data pertaining to prior assaults or attempted assaults by the patient, including the time and place and surrounding circumstances, together with the date the information came within the knowledge of [the] defendant [as well as] the length and number of times the patient was confined to the defendant’s institution.” Later decisions, including Homere v. State (1973), Katz v. State (1973), Moore v. St. John’s Episcopal Hospital (1982), and Brier v. State (1983), reaffirmed Mayer.
But New York courts apply this pre-Section 33.13 “narrow line of cases” without analyzing whether Section 33.13 permits the medical-nonmedical distinction. In other words, the courts simply apply pre-1985 caselaw without examining how Section 33.13 affects it. This pre-Section 33.13 caselaw is shaky legal ground. It began in 1971 with Mayer, where the court rationalized the medical-nonmedical distinction using policy without citing a statute or caselaw. Even pre-Section 33.13, the line of reasoning is unclear.
Instead of its current reading, New York courts must narrowly read Section 33.13. First, they should narrowly apply Section 33.13’s exceptions. Rather than creating an exception without textual basis, they should only order a provider to release patient information when a textual exception applies. Second, New York courts should extend Section 33.13 to all information in a patient’s record. Rather than distinguish medical from nonmedical information, the courts should analyze Section 33.13’s effect on existing caselaw. They should then treat patient information as a collective. Third, in cases like those summarized above, courts should only order information to be released when “the interests of justice significantly outweigh the need for confidentiality.” Rather than creating an exception without textual basis that violates privacy, New York courts should only disclose information from mental health records when the facts meet Section 33.13’s standard. Otherwise, courts risk aiding medical identify thieves, like Sharp’s, who take advantage of already all-too-common unauthorized disclosure.
About the Author: Ryan Maloney is a rising third year at Cornell Law School. He is the Vice Chancellor for External Competitions for the Moot Court Board and a member of the Cornell Law Student Association. In 2013, he earned a bachelor’s degree in History from the University of Virginia.
Suggested Citation: Ryan Maloney, Unauthorized Disclosure: Judicial Violation of Mental Health Privacy, Cornell J.L. & Pub. Pol’y, The Issue Spotter, (May 11, 2020), https://live-journal-of-law-and-public-policy.pantheonsite.io/unauthorized-disclosure-judicial-violations-of-mental-health-privacy/.