I am involved with Department of Children and Families in Florida for a false allegation my child's father made. I have a pending domestic violence case against him among other things. DCF has released my personal health information to him in a case plan, stating who my doctor was, who my counsiler was, and my prescribed medication information, including the dosage and amount taken per day. Do I have a case against them for violating my civil rights to have protected PHI?

Yeah it sounds like you have a case but beating DCF in court can be next to impossible. Find a GOOD lawyer not a court appointed one. The court appointed ones seem to take DCF side.

DCF is NOT your medical provider. Therefore, it is unlikely they could be accused of violating HIPAA. The issue here is how they obtained the info. I suspect they obtained it by subpoena and that your ex subpoenaed them for the records.

If that's the situation, then you have no case.

I know they were really big on confidentiality when I had to deal with them.
I suppose the ex could have subpoenaed them but she really should look into it.

I know they were really big on confidentiality when I had to deal with them.
I suppose the ex could have subpoenaed them but she really should look into it.

My EX did not suponea them, they handed out the information, which my EX's attorney used in our domestic violence court case against me.

DCF is NOT your medical provider. Therefore, it is unlikely they could be accused of violating HIPAA. The issue here is how they obtained the info. I suspect they obtained it by subpoena and that your ex subpoenaed them for the records.

If that's the situation, then you have no case.

My EX did not suponea the information. DCF handed out the information on documents that were released to both of us. My address & employer is already confidential because of security reasons so they had no reason to give out this info. In the CBC Client Guide it says they have to use the minimual amount of info to address what is needed and that any time any of my info is released, I have to sign a release and be given oppurtunity to object. Which I wasn't given...

Yeah I didn't see any reason he would but the only way I can see him being allowed to have them legally. You really should check into your rigjts with a lawyer

How do you know? Have you asked why they gave his lawyer the info?

If they violated their own rules then sue them.

Scott correct me if I'm wrong here...

Were you or are you married? I THINK that a spouse may have the right to medical files. But I could be wrong. I just wanted to say something in case it was being over looked. Because you never said if you were or were not married to him

It seems they are separated if not divorced and Children's services have no reason or right to just give him any files on her.
It isn't their place or their business to be doing that.

yeah I didn't see any reason he would but the only way I can see him being allowed to have them legally. You really should check into your rigjts with a lawyer

I have a lawyer, but he is a criminal defense lawyer so this isn't his speciality

scott correct me if im wrong here...

were you or are you married? i THINK that a spouse may have the right to medical files. but i could be wrong. i just wanted to say something in case it was being over looked. because you never said if you were or were not married to him

Was never married. He's just the baby daddy.

How do you know? Have you asked why they gave his lawyer the info?

If they violated their own rules then sue them.

Yeah, that was the plan was to sue them for violating not only their own rules, a couple of FL state statues and then this breech of confidentiality..

The OP said it was given as part of a "case plan". I'm not sure what that exactly means. Were both parties given info on the other?

But either way this is NOT a HIPAA violation because DCF is not a medical provider. The OP's physician may have violated HIPAA if the info was given to DCF without permission or court order. But DCF did not violate HIPAA because they are not covered by HIPAA.

Now, if DCF violated their own rules and regulations in providing this info, then they may be held liable.

DCF does have their own confidentiality rules to abide by.
Case plan would not be any of the fathers business what her medical records concern.

Case plan is setting up the requirements they are to comply with such as parenting classes, domestic abuse classes, steps to take with disciplining kids and so forth.

Forgive me if I am wrong but I do believe it is a HIPAA violation to re-distribute medical records obtained from physicians/hospitals/etc. So, if DCF re-released protected health information your doctors sent them, you may have a case.

I will assume this is for a court case and all evidence has to be shared with both sides.

BUT is it evidence? Evidence of what?
Wouldn't it have to first be proven that her medical directly effects the custody case?

BUT is it evidence? Evidence of what??
Wouldn't it have to first be proven that her medical directly effects the custody case?

To prove that, medical records are in order.

She is referring to her medical records not the kids

Forgive me if I am wrong but I do believe it is a HIPAA violation to re-distribute medical records obtained from physicians/hospitals/etc. So, if DCF re-released protected health information your doctors sent them, you may have a case.

Can you cite anything to back that up? HIPAA applies to only "covered entitites. The only way DCF would qualify as a covered entity is if they paying for the coverage.

Can you cite anything to back that up? HIPAA applies to only "covered entitites. the only way DCF would qualify as a covered entity is if they paying for the coverage.


Not necessarily true.

DCF could fall under the clearinghouse rule "This includes entities that process nonstandard health information they receive from another entity into a standard (i.e., standard electronic format or data content), or vice versa." I'm certain they store their information via electronic record as that is pretty much mandated by now.

After doing a quick Google search it appears as though DCF must abide by HIPAA rules and their employees must complete mandatory training. However, it's Google and you can't believe everything you read.

Either way, divulged information of this nature is a violation of privacy be it on a Federal level or not. I would encourage OP to pursue this. It is a personal safety issue.

Whether they have to follow HIPAA they do have their own confidentiality rules and I do not see how they can justify giving the father the mothers personal medical records.

Is her medical records evidence? Evidence of what?
Wouldn't it have to first be proven that her medical directly effects the custody case.

She is not referring to her kids medical records but hers.

whether or not they have to follow HIPAA they do have their own confidentiality rules and I do not see how they can justify giving the father the mothers personal medical records.

is her medical records evidence? Evidence of what??
Wouldn't it have to first be proven that her medical directly effects the custody case.

She is not refering to her kids medical records but hers.

I agree with you.

I also got to thinking... you know how they always have you sign a multitude of paperwork, do you think OP signed something allowing disclosure unknowlingly? Did she provide them an authorization to obtain her medical records from her doctor or did she give it to them? Either way, under HIPAA or not, without written consent this information cannot be divuldged.

This is absolutely a violation of the mother's PHI and is a direct threat to her personal safety, given the nature of the relationship between her and her ex. I could urge to to pursue this.

I dpn't see why they would have her sign a release for the dad for any legal reason. For their own sneaky agenda they probably would.

No DCF would not fall under the Clearinghouse entity. A Clearinghouse entity is a service provided to care providers to convert records into electronic format. This entity covers medical transcribers. DCF does not fall into that category.

DCF was, apparently, given the info, either by subpoena or permission because it was necessary to develop a case plan because of the allegations made. Whether DCF overstepped their bounds and rules by providing the info to the other party is definitely under question. But it would be a very large stretch to consider this a HIPAA violation.