At some point in their careers, most medical malpractice defense attorneys have defended a medical facility against a claim for negligence based on one patient being attacked by another. The negligence claim is premised on a failure to properly supervise and protect a patient from another who is known to have a propensity for violence. This scenario happens in psychiatric institutions, hospitals (psychiatric units or regular floors) and long-term care facilities.

Rarely is the assailant named as a defendant in addition to the facility, and almost never does the assailant, sued or not, consent to disclosure of his or her medical record. Therefore, the injured party/plaintiff must seek a court order to compel the facility to disclose the medical record of the other patient, despite the privacy rights afforded by HIPAA and state regulations.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, was enacted on August 21, 1996. Its purpose is to protect all “individually identifiable health information” held or transmitted by a covered entity or its business associate in any form or media, electronic, paper or oral. (New York’s privacy law is codified in CPLR §4504.)

“Individually identifiable health information” is information, including demographic data, (1) that relates to the individual’s past, present or future physical or mental health or condition and the provision of health care to the individual and (2) that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. Such information is not limited to a person’s name but also includes their address, birth date and Social Security Number.

In cases of patient-on-patient acts of violence, the identity of the assailant is almost always known by the victim. Their hospital rooms are usually in close proximity and they often interact prior to the attack. Similarly, in a long-term care setting, the patients or residents live together at the facility, most often on the same unit; hence, they know each other’s names and possibly addresses. It is therefore impossible to protect the identity of the alleged assailant by redacting their names in their medical record.

Plaintiffs’ attorneys have alternatively argued that the information sought about prior acts of violence is not “health care related information” but instead information about conduct. Indeed, a New York appellate court held in Moore v. St. John’s Episcopal Hospital, that the facility was obligated to disclose prior acts of violence committed by the patient (defendant) to establish knowledge by the facility. The court determined that such conduct was not medical information. InThompson v. Pibly Residential Programs, Inc., however, another appellate court similarly permitted disclosure and stated that no information about the resident’s medical diagnosis or treatment could be disclosed.

Conforming to these holdings still creates two significant challenges for plaintiffs in trying to prove their case. First, where the attack took place in a mental institution, on a psychiatric unit of a hospital or on a dementia unit in a long-term care facility, one’s propensity for violence is a symptom of the disease. Disclosure of prior acts of violence would necessarily disclose a medical diagnosis. For example, if one resident on a dementia unit of a nursing home struck another resident on that same unit, how could her health care information not be revealed?

The second and perhaps more difficult challenge plaintiffs face comes after disclosure is made of a person’s prior acts of violence. To prove the negligence case, plaintiff has to prove that the facility having knowledge of the propensity failed to take the necessary steps to protect others from injury.

Medical experts would have to opine about whether the correct diagnosis was made, whether appropriate medications were given and in the correct dosage, and whether the patient’s condition and efficacy of treatment were properly monitored. While the analysis would also require an examination of the level of supervision over that patient, this is only a small part of the assessment of the medical care.

Long-term care cases can be even more challenging insofar as the residents’ conditions deteriorate over time. Furthermore, while no one wants to, or can ever, blame the victim, perhaps the injured patient’s own diagnosis of dementia was a contributing factor to their injury.

Without the other patient’s medical record and the opinion of a medical expert about how the facility breached a duty to an injured patient, cases such as this should be unsustainable. Yet, at least in a nursing home context, they are becoming more and more common.