Suppose someone finds private health data about themselves online, identifying them by name and by specific family information. The person does not recall signing anything that gives anyone permission to share or publish this data. My questions are:

a) Is it legal for the website to publish this data?

b) If not, would the hosting site or publisher be in any way liable?

c) Is it common for people to accidentally sign sharing agreements about this sort of data without realizing it? If so, do these agreements stop the signer from being able to do anything about it later?

Edit in response to comments: This is in the US, California if it matters, but the person isn't necessarily a US citizen. Let's say the website is a legitimate hosting/sharing website focusing on presentation/slideshow content, and the data is in a particular slideshow that a user uploaded and shared on the site. We'll assume the slideshow is indexed and discoverable via search engines, etc, and is in the first page of results on a Google search for the person's name.

  • 1
    Jurisdiction? They vary significantly about what can be shared and with whom. Also, who's operating the website in this hypothetical? – Jean Luc Picard Jul 31 '17 at 22:17

You can see a synopsis of California privacy laws here. There is no liability for a website on which private information is found, unless the publisher assists the poster (perhaps by simple encouragement) to illegally obtain the information. One could hope to sue someone for publishing a private fact, but in California you would have to show that the defendant published private facts "with reckless disregard for the fact that reasonable men would find the invasion highly offensive", and for a passive info-hosting site you could not show that (to be reckless, you have to know and not care). We might assume, for example, that the poster illegally obtained the information by breaking into the subject's computer, but if the publisher has an arms-length relation to acquiring the information, they are protected. The poster could be liable, but not the website.

It is very common for people to sign medical "permission forms" without bothering to read (even see) what they are signing, especially with electro-signing (where staff are willing to print out a copy of the form for you, but few people bother). However, the HIPAA privacy rule significantly restricts the parties to whom such information may be disclosed, and they can't smuggle in a clause "and I authorize Dr. Zaius to share all of the private health info with whoever he wants". There is certainly no path whereby a doctor would post such information on a website, except if so requested by the patient.

There are also various ways in which permission is not required, for example 164.512 allows disclosure to comply with various laws including employer compliance with workplace-related accidents and illnesses. It is possible, under such a circumstance, that the health provider provided information to an employer pursuant to one of those clauses, and the breach comes on the employer's side. Action would then be taken against the employer (who has a duty to maintain confidentiality of the information). There does not seem to be any legal means to compel an uncooperative website to remove true personal information.

  • Thank you! So it sounds like action could potentially be taken against 1) The person who uploaded the information to the website and 2) The health provider or employer that wrongly allowed access to this information, assuming they can be identified? – Dan Staley Aug 1 '17 at 2:27
  • @DanStaley Probably #2, not necessarily #1 unless the person in #1 had a personal duty to keep the information private. Normally, U.S. law doesn't punish people who merely receive information that someone else wrongfully obtained without the recipient's involvement. Section 230 provides blanket protection, however, to website owners for user posted content. – ohwilleke Aug 1 '17 at 3:35
  • The only path that I can see for pursuing the uploader is via the tort that they committed to get the information, which assumes that it was obtained in a wrongful manner. – user6726 Aug 1 '17 at 14:28

Your Answer

