M.A.K. v. Rush Presbyterian St. Luke’s Med. Ctr.,

M.A.K. v. Rush Presbyterian St. Luke’s Med. Ctr.,

No. 90527 (Ill. Dec. 20, 2001)

A patient brought this action against the medical center at which he was treated
for alcohol dependence alleging that the medical center breached the physician-patient
relationship and invaded his privacy by releasing his medical records to his
insurance carrier without first informing him of its intention to do so and
obtaining his approval. When obtaining insurance coverage, the patient had
previously consented to the release of his records. Reversing the appellate
court’s ruling in favor of the patient, the Illinois Supreme Court held that
the medical center complied with a regulation of the Department of Health and
Human Services that required written consent to a disclosure to include the “specific name
or general designation of the program or person permitted to make the disclosure.”
Accordingly, the consent signed by the patient stated: “I authorize any
physician, medical practitioner, hospital, clinic, health care facility, [or]
other medical or medically related facility . . . .” The court also noted
that the insurance company’s authorization form’s specific mention of alcohol
and drug treatment records should have put the patient on notice that such information
could be released according to the terms of his signed insurance consent form.
Lastly, the court held that, although the insurance company’s consent form was
silent as to whether the form covered records generated subsequent to his signing
of the form, the patient maintained the right to revoke his consent at any time
– but he did not do this.

The question for the future, of course, is what would the HIPAA privacy rule
say?