Circuit clarifies constitutional medical privacy rights

This snafu erupted at the Rensselaer County Jail, where the password for limited-access health records was inadvertently made available so that inmates and jail employees suffered a privacy breach. These victims brought suit in federal court, but the judge dismissed the case because they lacked a constitutionally-protected privacy interest in their medical records since their medical conditions were neither serious nor stigmatizing, and they were therefore not exposed to discrimination and intolerance. The Court of Appeals reverses.

The case is Hancock v. County of Rensselaer, issued on February 9. The Constitution does not mention anything about privacy, but the Supreme Court says you have a zone of privacy "in avoiding disclosure of personal matters," including "information about one's body." This includes medical records. When reviewing legislative action in cases like this, courts apply intermediate scrutiny in determining if the statute is substantially related to an important government interest. In reviewing executive action like what happened in this case, courts as when the actions were arbitrary or shocked the conscience.

But since the plaintiffs did not consent to the access of their medical records, the Second Circuit is presented with a new kind of privacy case, requiring a new constitutional test. As the plaintiffs are not prisoners but jail employees, the Court applies the shocks-the-conscience test, bearing in mind that people have a fundamental interest in their medical privacy. While the district court sided with the County in holding that plaintiffs' medical conditions were not serious or stigmatizing, that reasoning derives from a Second Circuit ruling, Matson v. Board of Education, 631 F.3d 57 (2d Cir. 2011), which ruled against a music teacher, who had a weak medical privacy interest because her non-stigmatizing condition was revealed in a report about her alleged abuse of the sick leave policy. The Circuit now clarifies its medical privacy jurisprudence.

An interest in medical privacy derives not just from a desire to keep one's medical conditions to oneself but also from the collectively enjoyed benefit of being able to expect confidentiality from those we depend on to care for the most intimate aspects of our lives. A slow drip of exceptions would erode that protection beyond recognition. As such, the interest in preserving the integrity of the doctor-patient relationship deserves its own consideration independent of the idiosyncrasies of the privacy invasion. The baseline individual interest in privacy is thus substantially greater than whatever the least abashed individual would allow.

The Court holds that the greater the plaintiff's privacy interest in protecting his medical information, the more compelling the governmental interest must be in exposing the information. "But even the weakest privacy interests cannot be overridden by totally arbitrary or outright malicious governmental action." Moreover,

How to judge the government action depends on context. Government actors with specific duties of confidentiality or care unreasonably invade privacy even if they do so as a result of "deliberate indifference." On the other hand, a government actor in the midst of a pressing emergency might not be liable for even deliberate invasions. See id. Public disclosure (or threatened public disclosure) of medical information is a greater breach of privacy than one unauthorized government employee viewing the information, so greater care should be expected to prevent the former.

The district court must reconsider this case under the clarified rules set forth by the Court of Appeals in  this case. It also has to consider whether defendants are entitled to qualified immunity. Was the law at the time of the privacy breach clearly-established? That's for the district court to resolve.