Jason Pierre-Paul Lost His Finger. Did ESPN Violate HIPAA By Reporting It?

Jason Pierre-Paul, the star defensive end for the NFL’s New York Giants, had one of his fingers amputated on Wednesday, ESPN reported.

Specifically, doctors removed Pierre-Paul’s right index finger, which was injured in a fireworks accident on Saturday, according to a photo of a medical record posted by ESPN’s Adam Schefter.

Pierre-Paul’s injury and surgery, which remain shrouded in mystery, have become one of the biggest stories of the NFL offseason — and one of the most high-profile patient data breaches in years.

The news of JPP’s injury first broke on Sunday when a hospital worker reportedly told his friend, who then posted the news to Twitter. Rumors circulated online for several hours before ESPN and other outlets were able to confirm that Pierre-Paul had indeed mangled his hand.

(Although ESPN’s Schefter played down the injury at the time, saying that the damage to Pierre-Paul’s hand was not as serious as originally feared. It now seems likely that Schefter was misled.)

Pierre-Paul suffered immediate professional damage, even before the extent of the injury was known. The Giants pulled a long-term $60 million contract offer — “Given the timing of the event and the apparent judgment displayed, the Giants do not believe a long-term offer is in the best interest of those involved at this point,” NFL.com dryly reported —and team officials flew to Florida to attempt to meet with Pierre-Paul, who’s currently unsigned.

However, Pierre-Paul avoided the Giants officials — a decision that appears more understandable in retrospect, if he was undergoing surgery.

There’s a lot that’s still unknown in this case. Neither Pierre-Paul’s representatives nor the Giants have issued a statement. It’s possible that he’ll need more surgery. And there are many questions over what the injury means for JPP’s career and the Giants’ season.

But one fact is indisputable: Pierre-Paul’s entire hospital stay has been riddled with leaks and privacy breaches.

Notably, if Schefter posted Pierre-Paul’s medical records without JPP’s consent, that means at least one person violated the Health Insurance Portability and Accountability Act, better known as HIPAA.

The law is intended to protect patient privacy and penalize providers for sharing information without a patient’s consent. News media aren’t held to HIPAA, so ESPN is probably safe; instead, the government prosecutes health care workers and organizations that leak information.

While individual HIPAA fines can be relatively small, at $50,000 per person and event, they can quickly add up.

“[O]ffenses committed with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000, and imprisonment for up to ten years,” the American Medical Association warns.

UCLA Health System was forced to pay nearly $1 million in fines after a series of leaks and snoops in 2008 and 2009 involving celebrities like Britney Spears and Tom Cruise. At least one UCLA employee who violated HIPAA ended up receiving jail time.

Pierre-Paul also may be able to file a lawsuit against the hospital, via a HIPAA negligence claim, arguing that the leaks have damaged his career.

Besides the Giants’ original decision to pull the $60 million contract offer, a team official on Wednesday said they were surprised to learn that Pierre-Paul had amputated his finger — and only found out thanks to ESPN’s report.

—
Follow @ddiamond

Also see:

Also on Forbes:

NFL Team Values 2014

Source: Forbes