Patients Sue Florida Hospital Over ‘Humiliating’ Photo Posts

A Florida hospital is facing several lawsuits filed by patients who say staff members used their personal phones to take and post humiliating photos of them on social medial without their consent while they were asleep or medicated, and stripped semi-nude.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

The incidents center on four employees of Baptist Hospital in Jay, Florida, who were reportedly terminated from their jobs after an investigation by the hospital. So far, three patients affected by the incidents have filed lawsuits, but there could be more, said Zarzaur Law, the law firm representing the patients in the complaints.

“While plaintiff was in a private hospital room, sedated, asleep – or both – an employee of the defendants intentionally and without plaintiff’s knowledge or consent, stripped their clothing and then photographed plaintiff in a semi-nude or nude state,” allege each of the three complaints filed on Oct. 10 in Florida state court against Baptist Jay Hospital.

“There was no medical or nursing purpose for these photographs to be taken and/or published on social media. Defendants’ employees published and/or posted these photographs of plaintiff on social media platforms for ‘comic’ or entertainment purposes,” the complaint alleged.

The photographs were “private, sensitive and not open to public view as they lay in their private hospital room. The acts described were done willfully, maliciously and in reckless disregard of plaintiff’s privacy rights,” the complaints each allege.

Two of the plaintiffs claim the incidents occurred in February while they were patients at Baptist Jay Hospital, and the third plaintiff alleges that another incident happened in August.

The lawsuits allege invasion of privacy and negligence against Baptist Jay Hospital, among other claims.

The lawsuits, which each seek a jury trial and damages, say the hospital “was responsible for establishing non-medical and non-nursing policies and procedures that related to patient privacy concerns. These would include policies related to the use of personal cell phone cameras with patients without their consent and social media posting information about patients with or without their consent.”

Each of the lawsuits allege that in September, representatives of Baptist approached the plaintiff and admitted that one or more of the hospital’s employees had taken some “horrible” photographs of the patient and posted them to social media.

In each instance, Baptist representatives offered the plaintiff an undisclosed amount of money in exchange for a release of liability and non-disclosure agreement, the complaints each allege. All of the plaintiffs rejected the offers.

The patients’ photos were allegedly posted on Snapchat, which are generally deleted by default once viewed unless the Snapchat user sets to save the post for longer.

Nonetheless, the alleged incidents – no matter how long the photos were viewable – do pose several serious civil as well as regulatory concerns, including HIPAA violations, some legal experts said.

“The impermissible disclosure occurs when the photo is posted, regardless of how long it remains visible,” said one attorney who is not involved in the case but asked not to be named.

“Additionally, this would constitute a breach requiring notification under HIPAA’s Breach Notification Rule, as the protected health information was disclosed to unauthorized recipients – the workers’ Snapchat contacts – regardless of Snapchat’s disappearing feature.”

The sensitive nature of the PHI – alleged photos of incapacitated patients – further indicates a breach occurred, the attorney said.

“This is a rather blatant HIPAA violation, and the fact that multiple hospital workers engaged in this type of [alleged] activity suggests potential gaps in the company’s HIPAA compliance program,” the attorney said. “I would expect a fine by HHS OCR along with a corrective action plan.”

Indeed, the U.S. Department of Health and Human Services’ Office for Civil Rights has several times levied financial fines against healthcare organizations in other seemingly less egregious cases involving patient protected health information being disclosed on social media.

For example, HHS OCR earlier this month announced a $182,000 financial settlement and corrective action plan with Cadia Healthcare, a Delaware nursing home that posted photos and names of patients to social media as “Success Stories” for marketing purposes without the patients’ consent (see: Nursing Home Fined $182K for Posting Patient Photos Online).

And in 2019, HHS OCR agreed to a $10,000 settlement and corrective action plan with Elite Dental Associates of Dallas in a case that centered on a complaint received in 2016 that the dental practice disclosed a patient’s name and other PHI on social media site Yelp in response to several patient’s bad reviews (see: HHS Gives Dental Practice Posting PHI on Yelp a Bad Review).

HHS OCR also settled a second similar but separate case in 2022 with another dental practice – New Vision Dental – which agreed to pay a $23,000 fine and implement a corrective action plan after also responding to negative Yelp reviews with detailed information about patient visits and insurance (see: Dental Practice Hit With HIPAA Fine For Posting PHI on Yelp).

Besides those HIPAA violation cases involving social media postings, other claims have surfaced in recent months that spotlight the creepy privacy intrusions and spying that can happen in healthcare settings.

In one recent case, a hospital pharmacist allegedly spied on dozens of colleagues in their homes and in the workplace for over a decade. In a separate incident, a sleep clinic worker allegedly installed secret cameras disguised as smoke detectors in restrooms to record videos of staff and patients (see: Creepy Camera Hacks Expose IoT Security Risks in Healthcare).

Healthcare organizations need a strong culture of HIPAA compliance, including specific written policies and procedures related to the use of personal devices during work, and training related to the procedures is critical to help prevent the type of allegations cited in the lawsuits against Baptist, the attorney said.

“Hospitals could consider hard limits on the use of personal devices during work, or a prohibition on any photography and/or social media posting related to activities at work. Demonstrated disciplinary action against those violating the policy is important to instill a culture of compliance,” the attorney said.

Baptist Jay Hospital did not immediately respond to Information Security Media Group’s requests for comment on the lawsuits’ allegations and for details concerning the employees who were allegedly involved in the incidents.