What to do When Misappropriation of Information by an Employee Includes Patient Information
July 17, 2025
By: Colin A. Walker
What to do When Misappropriation of Information by an Employee Includes Patient Information
Misappropriation of trade secrets and other confidential and/or proprietary company information has become all too common. Often the employee misappropriates such information in preparation for starting a competing business or accepting a position with a competitor. If so, the employer may have a number of claims against the employee—and sometimes the competing business—and strong remedies. Claims could include breach of the duty of loyalty, misappropriation of trade secrets, breach of contracts such as non-disclosure agreements, intellectual property agreements, or non-compete agreements, and conversion. Remedies may include temporary restraining orders and preliminary injunctions, replevin orders, monetary damages, attorneys’ fees, and punitive damages, just to list a few. Some of these remedies involve expedited procedures which could result in hearings and orders within a few weeks or even sooner in extreme cases.
However, these cases are expensive, time consuming, and stressful. Some employers cannot afford litigation of this sort, and others choose not to spend the time and resources to pursue them if they think the employee’s actions are not likely to harm them. Other employers pursue litigation aggressively. When highly confidential third-party information, such as patient information, is involved, however, the employer may have little choice but to pursue litigation aggressively.
If the employer obtains healthcare information as part of its business, it will almost certainly be subject to HIPAA. Medical practices and other healthcare providers, known as “covered entities,” will be covered by HIPAA. But others, who are not healthcare providers, but who provide services to them, may also be covered by HIPAA. These parties are known as “business associates.”
If an employee of a covered entity or a business associate misappropriates information for any reason, including starting a competing business or accepting employment with a competing business, the information could include patient information. This may well be unintentional or incidental. The employee may want other information that is useful in a competing business such as business plans, financial information, pricing information, and customer information. This information, though probably protected by the law, is not necessarily covered by HIPAA. However, in the course of misappropriating this information, the employee may also obtain information covered by HIPAA. For example, if the employee copies the employers’ customer contact information, such as phone numbers, email addresses, etc., the files containing this information may also contain patient information such as diagnosis, healthcare procedures, etc. In that case, by taking the information, the employee may have caused a HIPAA “breach.” It doesn’t matter if the employee took the patient information unintentionally; it would still be a breach.
An employer who is a covered entity or a business associate has a number of important duties in the event of a HIPAA breach. Following a breach, covered entities must provide notification of the breach to affected individuals, the Secretary of Health and Human Services, and, under some circumstances, to the media. In addition, business associates must notify covered entities if a breach occurs by the business associate. See: HIPPA for Professionals. The individual notices must be sent by mail or by email if the individuals have agreed to receive such notices by email. Covered entities are required to provide notices to the media serving the affected state or jurisdiction if 500 or more residents of were affected. Covered entities must also notify the Secretary of Health and Human Services. The notices must be provided without unreasonable delay and in no case later than 60 days after a breach. If fewer than 500 individuals are affected the covered entity may notify the Secretary annually.
However, these notices are only required if there is a “breach.” An impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of the following factors:
- The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;
- The unauthorized person who used the protected health information or to whom the disclosure was made;
- Whether the protected health information was actually acquired or viewed; and
- The extent to which the risk to the protected health information has been mitigated.
In the case of misappropriation by an employee, these requirements can often be met, if the employee cooperates. If the employee agrees to return the information and to sign an affidavit confirming that the information was returned, copies were not retained, and copies were not transmitted to third parties, the above requirements might be satisfied. Employees who are represented by competent legal counsel, or who otherwise understand the requirements of HIPAA, might be willing, or even eager, to cooperate. And, employees who have taken such information may have no motive to disclose it because in most cases, they are trying to do business with patients, not trying to misuse their confidential healthcare information, unlike a person who is trying to use such information to commit identity theft.
On a related point, many states have laws with protect personal identifiable information (“PII”), which protects information other than healthcare information, such as social security numbers, phone numbers, email addresses, etc. See, e.g. here.
If the employee refuses to cooperate, the employer may have little choice but to commence litigation, and to pursue it aggressively until the information is secured. HIPAA has severe penalties and robust enforcement mechanisms, and the consequences of failing to remedy a breach can be severe. Thus, even where the employer will have difficulty paying for litigation or believes that the risks do not justify the costs of litigation, where HIPAA-protected information is involved, the employer may have to pursue litigation. Of course, employers who are covered entities or business associates who think an employee may have caused a breach, should immediately confer with competent legal counsel who can advise it on these difficult issues and, if necessary, pursue litigation against an employee who has misappropriated such information.