Hard to Find HIPAA Questions and Answers

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

We receive all types of HIPAA questions from our members. Answers to such questions are not all that easy to identify. Anyway, we present answers to several of these below.

(Q) I have heard that HIPAA does not allow you to have a Business Associate relationship with a vendor overseas. Is that correct?

(A) On first blush, it would seem that one might be foreclosed from storing data on an overseas cloud server, as US authorities would have limited to no jurisdiction over the overseas entity. But, HHS clarifies otherwise. It’s cool.

Do the HIPAA Rules allow a covered entity or business associate to use a CSP that stores ePHI on servers outside of the United States?

Answer:

Yes, provided the covered entity (or business associate) enters into a business associate agreement (BAA) with the CSP and otherwise complies with the applicable requirements of the HIPAA Rules. However, while the HIPAA Rules do not include requirements specific to the protection of electronic protected health information (ePHI) processed or stored by a CSP or any other business associate outside of the United States, OCR notes that the risks to such ePHI may vary greatly depending on its geographic location. In particular, outsourcing storage or other services for ePHI overseas may increase the risks and vulnerabilities to the information or present special considerations with respect to the enforceability of privacy and security protections over the data.

(Q) Can I store protected health information (PHI) on my personal Google Drive account?

(A) Generally, no. If you are storing PHI on Google Drive, you will need to have a Business Associate Agreement with Google. And, yes, Google does provide such agreements for Google Apps for Business, Education, or Government accounts. These are paid accounts. You have to shell out checks to Google for the document. Meaning, you have to have a paid account.

Most personal Google accounts are free, and they do not come with Business Associate Agreements.

BTW, if you encrypt a document prior to uploading it to your personal Google account, you should not need a Business Associate Agreement. Why? Because you rendered the document secure before uploading it to the cloud. Meaning, the document is secure anywhere it finds itself.

(Q) I hear about HIPAA authorization. I also hear about HIPAA consent. Aren’t they the same thing?

(A) Well, they are not precisely the same thing.

Authorization is what you HAVE to secure from a patient before disclosing protected health information unless there’s a named exception to disclosure.

Consent is something you are allowed to obtain from a patient before disclosing protected health information for a use that requires no such authorization.

For example, you must obtain a patient’s prior authorization to send protected health information to their designated attorney. Before sending the records, you want to confirm the patient has signed the authorization. And send only the records identified by that authorization.

In contrast, the Privacy Rule permits a covered entity but does not require it, to voluntarily obtain patient consent for disclosures of protected health information related to treatment, payment, and healthcare operations. As an example, if a patient asks you verbally to submit an insurance form so you can get paid, in theory, you do not need their written authorization. That’s an exception. But, you are allowed to have processes in place to obtain their “consent.”

(Q) Can an individual revoke their authorization?

(A) Yes. Patients can revoke their authorization at any time. The revocation must be in writing. It is effective when the covered entity receives the written request.

The Privacy Rule requires that the Authorization must clearly state the individual’s right to revoke, and the process for revocation must either be set forth clearly on the Authorization itself, or if the covered entity creates the Authorization, and its Notice of Privacy Practices contains a clear description of the revocation process, the Authorization can refer to the Notice of Privacy Practices. Authorization forms created by or submitted through a third party should not imply that revocation is effective when the third party receives it since the revocation is not effective until a covered entity that had previously been authorized to make the disclosure receives it.

If a patient has given you authorization to post before-and-after photos on your website, and later they demand you take them down, just do it. It is their right to make that demand. Obviously, once protected information has been released into the internet ether, it may be impossible to “protect” that information down the road. You can only do what you can do.

(Q) If a vendor is storing electronic medical records and the subscription terminates, does that vendor have to maintain the records, give them to the provider, or something else?

(A) Here, the vendor is a Business Associate. The Dept of Health and Human Services posed the question and answer as follows:

Do the HIPAA Rules require a Cloud Service Provider (CSP) to maintain ePHI for some period of time beyond when it has finished providing services to a covered entity or business associate?

Answer:

No, the HIPAA Rules generally do not require a business associate to maintain electronic protected health information (ePHI) beyond the time it provides services to a covered entity or business associate.  The Privacy Rule provides that a business associate agreement (BAA) must require a business associate to return or destroy all PHI at the termination of the BAA where feasible.  45 CFR  § 164.504(e)(2)(J). 

If such return or destruction is not feasible, the BAA must extend the privacy and security protections of the BAA to the ePHI and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.  For example, return or destruction would be considered ‘‘infeasible’’ if other law requires the business associate CSP to retain ePHI for a period of time beyond the termination of the business associate contract.

And there may be state laws about retaining medical records.  

OK, that’s all for today. What do you think?

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

Jeffrey Segal, MD, JD

Chief Executive Officer and Founder

Dr. Jeffrey Segal, Chief Executive Officer and Founder of Medical Justice, is a board-certified neurosurgeon. Dr. Segal is a Fellow of the American College of Surgeons; the American College of Legal Medicine; and the American Association of Neurological Surgeons. He is also a member of the North American Spine Society. In the process of conceiving, funding, developing, and growing Medical Justice, Dr. Segal has established himself as one of the country’s leading authorities on medical malpractice issues, counterclaims, and internet-based assaults on reputation.

Dr. Segal was a practicing neurosurgeon for approximately ten years, during which time he also played an active role as a participant on various state-sanctioned medical review panels designed to decrease the incidence of meritless medical malpractice cases.

Dr. Segal holds a M.D. from Baylor College of Medicine, where he also completed a neurosurgical residency. Dr. Segal served as a Spinal Surgery Fellow at The University of South Florida Medical School. He is a member of Phi Beta Kappa as well as the AOA Medical Honor Society. Dr. Segal received his B.A. from the University of Texas and graduated with a J.D. from Concord Law School with highest honors.

In 2000, he co-founded and served as CEO of DarPharma, Inc, a biotechnology company in Chapel Hill, NC, focused on the discovery and development of first-of-class pharmaceuticals for neuropsychiatric disorders.

Dr. Segal is also a partner at Byrd Adatto, a national business and health care law firm. Byrd Adatto was selected as a Best Law Firm in the 2023 edition of the “Best Law Firms” list by U.S. News – Best Lawyers. With over 50 combined years of experience in serving doctors, dentists, and other providers, Byrd Adatto has a national pedigree to address most legal issues that arise in the business and practice of medicine.

HIPAA and Abortions

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

 

Some updates to HIPAA may be around the corner.

Let’s start with the status quo.

The current Privacy Rule permits, but does not require, covered entities to disclose protected health information to law enforcement officials without the patient’s written authorization. In the wake of the Supreme Court Dobbs decision, the legality of abortion is now a province of state law. States may adopt permissive or restrictive laws regarding abortion.

Every state is different.

What happens if a patient lives in a state where access to abortion (after a particular gestation period) is illegal and travels to a different state where that abortion is legal? If law enforcement wants to investigate, what are healthcare providers obligated to do? Allowed to do?

Currently, the healthcare institution in the permissive state could disclose the patient’s abortion to law enforcement investigating in the restrictive state. This institution would not be obligated to disclose, but they could disclose without the patient’s signed authorization.

Why might an institution in a permissive state do that? Well, not every person in a permissive state believes as the state does. It might seem unusual that an institution would perform the abortion, and then turn that person’s records over to law enforcement in another state when they didn’t have to. But this should not seem strange. Do you believe that 100% of the people at your institution believe the same things and act the same way? They don’t.

Anyway, the Department of Health & Human Services was directed to update HIPAA via Notice of Proposed Rule Making. This Notice means that an updated Rule is being considered, and those interested may submit comments.

Covered Entities would be prohibited from disclosing Protected Health Information (PHI) when delivery of reproductive healthcare falls within at least one of three sets of circumstances:

(1) The reproductive care is provided outside the state where the investigation or proceeding is authorized and where such healthcare is lawfully provided (e.g., if a resident of one state traveled to another state to receive reproductive healthcare, such as an abortion, that is lawful in the state where such healthcare was provided).

(2) The reproductive care is protected, required, or authorized by federal law, regardless of the state in which such healthcare is provided (e.g., if reproductive healthcare, such as miscarriage management, is required under the Emergency Medical Treatment and Labor Act to stabilize the health of the pregnant person).

(3) The reproductive care is provided in the state in which the investigation or proceeding is authorized and the care provided is permitted by the law of that state (e.g., if a resident of a state received reproductive healthcare, such as a pregnancy test or treatment for an ectopic pregnancy, in the state where the individual resides, and that reproductive healthcare is lawful in that state).

By the way, “reproductive health care” is not limited solely to abortion. It is broadly defined to include (but not be limited to), prenatal care, abortion, miscarriage management, infertility treatment, contraception use, and treatment of reproductive-related conditions such as ovarian cancer.

It’s not a done deal yet. HHS suggests once the updated Rule is finalized (and the Notice of Proposed Rule Making has run its course), all affected covered entities would at least need to adopt or alter some existing policies and procedures, enhance the security of any IT system that contains PHI, retrain certain employees on the new requirements, and revise certain business associate agreements that may be affected by the Rule.

What do you think?

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

 

Jeffrey Segal, MD, JD

Chief Executive Officer and Founder

Dr. Jeffrey Segal, Chief Executive Officer and Founder of Medical Justice, is a board-certified neurosurgeon. Dr. Segal is a Fellow of the American College of Surgeons; the American College of Legal Medicine; and the American Association of Neurological Surgeons. He is also a member of the North American Spine Society. In the process of conceiving, funding, developing, and growing Medical Justice, Dr. Segal has established himself as one of the country’s leading authorities on medical malpractice issues, counterclaims, and internet-based assaults on reputation.

Dr. Segal was a practicing neurosurgeon for approximately ten years, during which time he also played an active role as a participant on various state-sanctioned medical review panels designed to decrease the incidence of meritless medical malpractice cases.

Dr. Segal holds a M.D. from Baylor College of Medicine, where he also completed a neurosurgical residency. Dr. Segal served as a Spinal Surgery Fellow at The University of South Florida Medical School. He is a member of Phi Beta Kappa as well as the AOA Medical Honor Society. Dr. Segal received his B.A. from the University of Texas and graduated with a J.D. from Concord Law School with highest honors.

In 2000, he co-founded and served as CEO of DarPharma, Inc, a biotechnology company in Chapel Hill, NC, focused on the discovery and development of first-of-class pharmaceuticals for neuropsychiatric disorders.

Dr. Segal is also a partner at Byrd Adatto, a national business and health care law firm. Byrd Adatto was selected as a Best Law Firm in the 2023 edition of the “Best Law Firms” list by U.S. News – Best Lawyers. With over 50 combined years of experience in serving doctors, dentists, and other providers, Byrd Adatto has a national pedigree to address most legal issues that arise in the business and practice of medicine.

State Privacy Law as Rationale Used to Reprimand Physician Over Media Attention in Rape Case

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. We also provide counsel specific to COVID-19. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

 

The US has been abuzz in activity since the Supreme Court overturned Roe versus Wade in its Dobbs versus Jackson Women’s Health Organization decision. What was previously legal in all states soon became illegal in some states.

What’s the law in Ohio?

On April 11, 2019, Ohio Governor Mike DeWine signed the Human Rights and Heartbeat Protection Act, which bans abortion in Ohio after any embryonic cardiac activity is detected. On June 24, 2022, after the Supreme Court of the United States overturned Roe v. Wade, judge Michael R. Barrett lifted a preliminary injunction that had blocked state officials from enforcing the law against certain abortion providers, allowing the Human Rights and Heartbeat Protection Act to take full effect. The law of Ohio imposes felony criminal liability on anyone who performs or aids or abets an abortion after embryonic cardiac activity can be detected.

At the time of this posting, these restrictions were being litigated creating uncertainty for both doctors and patients.

Ohio’s Attorney general explained there are three exemptions to the state’s heartbeat act.

      • Cases of ectopic pregnancy
      • Cases that would cause death of the mother
      • Cases that cause a serious risk of substantial, irreversible impairment to a major bodily function of the mother

Which brings us to the case of a ten-year-old girl.

An Ohio family learned their ten-year-old daughter was pregnant, allegedly by rape. The family took their daughter to Indiana, where abortion was legal. She saw Dr. Caitlin Bernard, an ob-gyn employed by Indiana University Health.

This turned into a media story.

Indiana’s Attorney General called for an investigation into Bernard.

The Republican Indiana attorney general claimed that Bernard had a history of failing to follow state reporting requirements for abortion providers.

Then Indiana health officials released a document indicating she had, in fact, reported providing a medication abortion for a 10-year-old rape victim in the days after the Dobbs decision allowed Ohio’s abortion ban to take effect.

Attorney General Todd Rokita ultimately filed a complaint with the state Medical Licensing Board, accusing her of failing to report the girl’s sexual assault to Indiana officials and of violating patient privacy laws with her public comments.

Early in the media uproar, it was alleged the rape was a fabrication. But on July 10, 2022, an Ohio man was charged in the rape.

Gerson Fuentes, 27, whose last known address was an apartment in Columbus, Ohio, was arrested after police say he admitted to raping the child on at least two occasions. He’s since been charged with rape and [was] being held on a $2 million bond.

An internal investigation at Indiana University Health concluded that Dr. Bernard had not violated any privacy laws.

On May 25th, The Indiana Medical Board held a hearing which lasted fifteen hours.

What happened?

A majority of board members found that she had violated privacy laws by speaking about the case and voted to fine her $3,000 in addition to the reprimand. Dr. Bernard was exonerated for other allegations Dr. Bernard failed to appropriately report the rape to authorities. And the Board decided against more onerous penalties, such as suspension or license revocation. The Board concluded Dr. Bernard was fit to practice.

Dr. Bernard argued she did not disclose protected health information. The public never learned the patient’s name. And supposedly the public still does not know the name of the patient. But members of the Board concluded the details Dr. Bernard did provide to the media qualified as identifying information – the patient’s age, her rape, her home state, and her abortion. And the name of the rapist was eventually unmasked.

This case does little to clarify what characterizes unauthorized disclosure of protected health information. Given how ubiquitous our mobile phones are and how GPS is turned on by default, there are probably some in tech companies or their vendors who can reconstruct your identity by your location – such as whether you’ve been in a doctor’s office. Does a physician have to turn their office into a Faraday cage to comply with HIPAA?

The simplest workaround to Dr. Bernard’s Board complaint would have been to obtain the parents’ authorization to disclose some details about the case, limited to the bare minimum.

I have no idea what Dr. Bernard’s legal fees were to defend this case. And almost no Board hearing lasts fifteen hours.

I doubt this will be the last Board case on such topics. What do you think?

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. We also provide counsel specific to COVID-19. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

 

Jeffrey Segal, MD, JD

Chief Executive Officer and Founder

Dr. Jeffrey Segal, Chief Executive Officer and Founder of Medical Justice, is a board-certified neurosurgeon. Dr. Segal is a Fellow of the American College of Surgeons; the American College of Legal Medicine; and the American Association of Neurological Surgeons. He is also a member of the North American Spine Society. In the process of conceiving, funding, developing, and growing Medical Justice, Dr. Segal has established himself as one of the country’s leading authorities on medical malpractice issues, counterclaims, and internet-based assaults on reputation.

Dr. Segal was a practicing neurosurgeon for approximately ten years, during which time he also played an active role as a participant on various state-sanctioned medical review panels designed to decrease the incidence of meritless medical malpractice cases.

Dr. Segal holds a M.D. from Baylor College of Medicine, where he also completed a neurosurgical residency. Dr. Segal served as a Spinal Surgery Fellow at The University of South Florida Medical School. He is a member of Phi Beta Kappa as well as the AOA Medical Honor Society. Dr. Segal received his B.A. from the University of Texas and graduated with a J.D. from Concord Law School with highest honors.

In 2000, he co-founded and served as CEO of DarPharma, Inc, a biotechnology company in Chapel Hill, NC, focused on the discovery and development of first-of-class pharmaceuticals for neuropsychiatric disorders.

Dr. Segal is also a partner at Byrd Adatto, a national business and health care law firm. Byrd Adatto was selected as a Best Law Firm in the 2023 edition of the “Best Law Firms” list by U.S. News – Best Lawyers. With over 50 combined years of experience in serving doctors, dentists, and other providers, Byrd Adatto has a national pedigree to address most legal issues that arise in the business and practice of medicine.

Getting PROPER Authorization to Use a Patient’s Photos on Your Web Site

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. We also provide counsel specific to COVID-19. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

Before and after photos are the lifeblood of an aesthetic surgeon’s marketing plan.

Nothing is as effective as a full library of high-quality before-and-after pictures. Particularly those showing substantive change. And a natural look.

These photos are considered “protected health information” governed by HIPAA and state privacy laws.

You need the patient’s authorization to post these photos. And such authorization needs to be more than one sentence that says something like “I give consent to Dr. Segal to use before-and-after photos for medical records, educational purposes, and marketing.”

To comply with HIPAA, several ingredients are needed:

What type of photos will be used? What body parts? Everything? Non-intimate body parts? Face, which is identifiable? Breasts, which are theoretically not identifiable? What if the patient’s breasts have unique tattoos or freckling patterns? (Yes, those have served as legal arguments by plaintiff’s attorneys noting their clients were “outed” even though the surgeon promised no one would learn the identity). So, be specific. The more specific the description of the photos, the better defense you will have should the authorization be questioned.

Next, the document needs a time frame for when the authorization will be in force. It can be “forever.” But it needs to be spelled out.

For example:

“Dr. Segal need not approach me again for authorization to use these photos, videos, and/or digital images unless the usage differs from that listed above and this authorization will remain in place indefinitely unless I ask Dr. Segal to terminate use of these photos, videos and/or digital images, in writing and communicated to Dr. Segal.”

Next, there is a statement that HIPAA requires for authorizations:

Note that once photos, videos, and/or digital images are used for any of the authorized purposes above, that information may no longer be protected by HIPAA.

Duh.

Once something is on the Internet, it will likely stay on the Internet somewhere forever.

Next, one cannot make signing such an authorization conditional on treatment:

“Providing authorization is entirely voluntary and will not affect our commitment to treatment by our practice.”

Patients are free to revoke their authorization at any time, for any reason, or no reason at all. They just need to communicate that, typically in writing, to the practice. Once a patient asks to take their photos down, just do it. Informing patients of their right to revoke their authorization was addressed above:

“…this authorization will remain in place indefinitely unless I ask Dr. Segal to terminate use of these photos, videos, and/or digital images, in writing and communicated to Dr. Segal.”

Finally, patients should sign off on where their pictures will be used.

        •  Medical purposes related to case
        •  Scientific purposes, including seminars and medical articles
        •  Digital or printed materials for patients to view in the office(s)
        •  Digital or printed materials to be included in our practice’s newsletter to be sent to current or prospective patients
        •  Digital images to be included in our practice website
        •  Digital images to be uploaded to the broader Internet to be viewed by the public

The more specific the authorization, the more defensible the authorization, assuming the patient later expresses shock and dismay that you did precisely what they agreed to.

One additional process issue. I do not believe it is smart practice to have the patient agree to post their before-and-after pictures at the patient intake. At that early stage, you have not developed a substantive doctor-patient relationship. The patient likely just signed a gazillion documents. They could later argue they didn’t know what they were signing. Plus, there are plenty of patients who would freak out if they knew you planned to post their before and after pictures online without any discussion.

In sum, authorization to use before and after photos need to be a formal document. Having a well-crafted authorization form protects you. You want to have it in place before there’s a problem. As they say about parachutes. If you don’t have a parachute when you need it, you’ll never need one again.

What do you think? And let us know if you are interested in receiving a copy of our model Photo Authorization Template.

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. We also provide counsel specific to COVID-19. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

Jeffrey Segal, MD, JD

Chief Executive Officer and Founder

Dr. Jeffrey Segal, Chief Executive Officer and Founder of Medical Justice, is a board-certified neurosurgeon. Dr. Segal is a Fellow of the American College of Surgeons; the American College of Legal Medicine; and the American Association of Neurological Surgeons. He is also a member of the North American Spine Society. In the process of conceiving, funding, developing, and growing Medical Justice, Dr. Segal has established himself as one of the country’s leading authorities on medical malpractice issues, counterclaims, and internet-based assaults on reputation. Dr. Segal was a practicing neurosurgeon for approximately ten years, during which time he also played an active role as a participant on various state-sanctioned medical review panels designed to decrease the incidence of meritless medical malpractice cases. Dr. Segal holds a M.D. from Baylor College of Medicine, where he also completed a neurosurgical residency. Dr. Segal served as a Spinal Surgery Fellow at The University of South Florida Medical School. He is a member of Phi Beta Kappa as well as the AOA Medical Honor Society. Dr. Segal received his B.A. from the University of Texas and graduated with a J.D. from Concord Law School with highest honors. In 2000, he co-founded and served as CEO of DarPharma, Inc, a biotechnology company in Chapel Hill, NC, focused on the discovery and development of first-of-class pharmaceuticals for neuropsychiatric disorders. Dr. Segal is also a partner at Byrd Adatto, a national business and health care law firm. Byrd Adatto was selected as a Best Law Firm in the 2023 edition of the “Best Law Firms” list by U.S. News – Best Lawyers. With over 50 combined years of experience in serving doctors, dentists, and other providers, Byrd Adatto has a national pedigree to address most legal issues that arise in the business and practice of medicine.

Terminating the Doctor-Patient Relationship When You Treat Both Husband and Wife

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. We also provide counsel specific to COVID-19. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

Sometimes, the doctor-patient relationship sours. It’s more than someone just having a bad day. The magic is gone. It’s time to part ways.

We’ve discussed how to do that before.

What happens when you take care of a family, for example, a husband and wife? How is that managed?

We’ll address the simplest scenario first.

Here, both husband and wife are difficult. They are both yelling, screaming, cursing, and being disrespectful to staff. Each spouse’s behavior is indistinguishable from the other. Here, they both would get termination letters. As I said, that’s the easy case.

Now the more challenging situation.

Here, the husband is being rude, disruptive, and disrespectful. The wife is pleasant and friendly. She complies with the treatment plan and is appreciative. It seems unfair to punish the wife for the sins of her husband. Nonetheless, they may be a “package deal.” Meaning that taking care of the wife may still force you to interact with the husband, even if he is no longer a patient.

If you are inclined to give the wife a chance and see how it goes, the following language illustrates how to potentially proceed.

“As you know, we have cared for you since XXX. You still have the following steps that are recommended in your treatment care plan (X, Y, Z…). We can continue on that road with you. Or you can receive similar treatment with another practice. We do have one stipulation, though. Your husband has spoken for you on multiple occasions. Several times, he has been abusive and disrespectful to our staff. If you are to continue being treated by us, your husband cannot participate in any of our communications. We recognize that may be challenging for you. And if this is not workable, you can receive follow-up care with another practice. If so, please let us know to whom we can send your records. Once you sign an authorization form (see enclosed) to do so, we would instruct our office to send the records to the practice of your choice as soon as possible. As we opened, we are happy continuing caring for you. But you will have to speak for yourself. Please let us know how you want to proceed.”

I used “rude husband – nice wife” just as an example to illustrate. Men and women are equal opportunity offenders. There are plenty of examples of “nice husband – rude wife.”

Finally, are there any HIPAA considerations?

Maybe.

In the example above, I’m assuming both husband and wife are aware of each other’s relationship with the practice. And they may even have signed HIPAA authorizations to allow the practice to speak with the other family member. In the example above, the letters do not disclose any protected health information – or acknowledge that the other family member is even a patient.

What if either spouse is unaware the other is seeing the same physician? You want to fire one spouse as a patient and not the other. In that case, keep it simple. Just send a termination letter to the challenging spouse.

Still, even when you hope you can hang on to the one spouse as a patient, it will be challenging. Most families will make a unified decision and just move on.

What do you think?

Medical Justice provides free consultations to doctors facing medico-legal obstacles. We have solutions for doctor-patient conflicts, unwarranted demands for refunds, online defamation (patient review mischief), meritless litigation, and a gazillion other issues. We also provide counsel specific to COVID-19. If you are navigating a medico-legal obstacle, visit our booking page to schedule a free consultation – or use the tool shared below.

"Can Medical Justice solve my problem?" Click here to review recent consultations...

We’ve been protecting doctors from medico-legal threats since 2001. We’ve seen it all. Here’s a sample of typical recent consultation discussions…

  • Former employee stole patient list. Now a competitor…
  • Patient suing doctor in small claims court…
  • Just received board complaint…
  • Allegations of sexual harassment by employee…
  • Patient filed police complaint doctor inappropriately touched her…
  • DEA showed up to my office…
  • Patient “extorting” me. “Pay me or I’ll slam you online.”
  • My carrier wants me to settle. My case is fully defensible…
  • My patient is demanding an unwarranted refund…
  • How do I safely terminate doctor-patient relationship?
  • How to avoid reporting to Data Bank…
  • I want my day in court. But don’t want to risk my nest egg…
  • Hospital wants to fire me…
  • Sham peer review inappropriately limiting privileges…
  • Can I safely use stem cells in my practice?
  • Patient’s results are not what was expected…
  • Just received request for medical records from an attorney…
  • Just received notice of intent to sue…
  • Just received summons for meritless case…
  • Safely responding to negative online reviews…

We challenge you to supply us with a medico-legal obstacle we haven’t seen before. Know you are in good hands. Schedule your consultation below – or click here to visit our booking page.

Jeffrey Segal, MD, JD

Chief Executive Officer and Founder

Dr. Jeffrey Segal, Chief Executive Officer and Founder of Medical Justice, is a board-certified neurosurgeon. Dr. Segal is a Fellow of the American College of Surgeons; the American College of Legal Medicine; and the American Association of Neurological Surgeons. He is also a member of the North American Spine Society. In the process of conceiving, funding, developing, and growing Medical Justice, Dr. Segal has established himself as one of the country’s leading authorities on medical malpractice issues, counterclaims, and internet-based assaults on reputation.

Dr. Segal was a practicing neurosurgeon for approximately ten years, during which time he also played an active role as a participant on various state-sanctioned medical review panels designed to decrease the incidence of meritless medical malpractice cases.

Dr. Segal holds a M.D. from Baylor College of Medicine, where he also completed a neurosurgical residency. Dr. Segal served as a Spinal Surgery Fellow at The University of South Florida Medical School. He is a member of Phi Beta Kappa as well as the AOA Medical Honor Society. Dr. Segal received his B.A. from the University of Texas and graduated with a J.D. from Concord Law School with highest honors.

In 2000, he co-founded and served as CEO of DarPharma, Inc, a biotechnology company in Chapel Hill, NC, focused on the discovery and development of first-of-class pharmaceuticals for neuropsychiatric disorders.

Dr. Segal is also a partner at Byrd Adatto, a national business and health care law firm. Byrd Adatto was selected as a Best Law Firm in the 2021 edition of the “Best Law Firms” list by U.S. News – Best Lawyers. With over 50 combined years of experience in serving doctors, dentists, and other providers, Byrd Adatto has a national pedigree to address most legal issues that arise in the business and practice of medicine.

Lawyers Have Their Own “HIPAA” Issues – The Story of a Prostitute


Do not conclude I am equating an attorney to a prostitute. I’m not. Jerene Dildene started working as an escort when a divorce and cutback in work hours (teaching Spanish in area pubic school) created financial hardship. Initially she searched Craigslist for part time work. She became a bikini model. On one modeling job, the client apparently asked her if she would exchange sex for money. She did and then created a prostitution website offering sex for $300/hr.

“I had a lot of doctors, lawyers, professors, retirees, single people who didn’t have time to date. I liked it. It was very empowering. I had control over my life and I had options.”

Attorney Sean Saxon worked for years in Denver handling pharmaceutical and medical device litigation.

Saxon, a married man, became Dildene’s client in 2013. They soon became romantically involved.

Saxon did not appreciate Dildene’s continuing her current career. Dildene broke off the relationship. Saxon continued stalking her. He threatened to “expose” her career to her family members.

Saxon eventually followed through on his threats. He sent a letter to Dildine’s mother, father, brother and other relatives describing her life as a prostitute, including revealing sexual photos and online reviews. He sent the same packet to her classmates and a teacher at an aesthetician school.

Dildine considered suicide.

She eventually filed a civil lawsuit and bar complaint.

Saxon defended himself, arguing he had a First Amendment right to free speech.

A Denver court disagreed. They awarded $1.7 M to Dildene.

Saxon wrote:

“I am deeply sorry I became involved with Jerene Dildine, most of all because I betrayed my family. I profoundly regret much of the language I used in my communications when I exposed Ms. Dildine as a prostitute to people who know her. All the material I sent was true and was taken from Ms. Dildine’s own marketing materials that she placed on the internet and sent to her clients to promote her business. I am appealing the jury’s decision. I do not believe that Ms. Dildine should be allowed to recover damages because of embarrassment over having her illegal conduct exposed.”

The State Supreme Court suspended Saxon’s law license for three years. His former law firm fired him.

Dildene was never a legal client of Saxon. So, he had no professional obligation to maintain confidentiality. But, the Bar noted:

“Through this conduct, Saxon violated Colo. RPC 8.4(b) (a lawyer shall not commit a criminal act that reflects adversely on the lawyer’s honesty, trustworthiness, or fitness as a lawyer in other respects) and Colo. RPC 8.4(h) (a lawyer shall not engage in any conduct that directly, intentionally, and wrongfully harms others and that adversely reflects on the lawyer’s fitness to practice law). Saxon later violated a protective order that the same woman had obtained,

leading to his conviction of a class-two misdemeanor. This conduct transgressed Colo. RPC 3.4(c) (a lawyer shall not knowingly disobey an obligation under the rules of a tribunal).”

Licensing boards have broad discretion to adjudicate whether a professional meets its criteria for, well, professionalism. This is true in the legal word. It’s true in the medical world. And professionalism is never explicitly defined.

What do you think?


Feeling the pressure? Learn how we can protect you…

We know your time is valuable. Spend a few minutes with us and discover how membership protects what’s important to good medical practice – and does away with what’s detrimental…

Browse Our Protection Programs BETA 1