Doctor sending private information over whatsup for consultation If a doctor sends screen grabs, taken by his smartphone, of different patients' confidential health files to other doctors for quick consultation, does that potentially violate any law? Could that be considered professional misconduct (and thus imperil his license to practice medicine)?
Health care providers in the US may send protected patient records to other health care providers for the purposes of treatment, either of the patient whose information it was or of a different patient (for instance, a doctor could send a chart of a different patient with a similar issue). This can be done without patient authorization, except for two cases: if the patient has requested more restrictions on use of their information and the provider agreed to those restrictions, and with psychotherapy notes. Source: HHS. WhatsApp specifically does not appear to be compliant with HIPAA, which is the US medical privacy law. However, there are many similar systems that are compliant. The body of your question asks about taking a smartphone screenshot; with many secure messaging systems, this is perfectly acceptable, and the principle of a doctor consulting with another doctor about a patient is actually encouraged. HIPAA violations do not by themselves result in any action against a medical license, nor can anyone besides the US government file suit based on a violation (everyone else is limited to complaining to the US government). Private lawsuits and (especially) license consequences are determined by state law, and are state- and situation-dependent. A doctor who calls a press conference to announce that this patient of his has HIV is more likely to face sanctions than a doctor whose violation was just not using a secure enough messaging client. HIPAA violations like this are not that uncommon, and generally result in at most a fine against the practice.
It's almost certainly violating the company's rules, and yes, you can get into trouble for that (in the sense of an internal disciplinary matter). Whether it's a criminal hacking will depend on a) what you did; b) where you are ... but I wouldn't rule that possibility out.
Hardly ever While all doctors in private practice has a contract with each of their patients: For most practical purposes clinical negligence lawyers can forget about these. It is not that contractual duties do not exist – all private medicine and surgery is performed pursuant to such duties – but that they rarely add anything to the parallel duty owed in tort. The courts have been very reluctant to imply a duty in contract which goes beyond the duty imposed by the common law of negligence. While tort damages aim to restore the plaintiff to the position they were in before the tort and contractural damages aim to place them in the position they would have been in had there been no breach, for medical malpractice there is no practical difference.
This would be unauthorized access to a computer. The offence is found in Section 1 of the Computer Misuse Act 1990. Note that this is a criminal offence, approaching the police about it might be the best way of handling the situation (if you want to go that route, and also, I'm not a lawyer).
This is not a HIPAA violation. HIPAA requires that personal information not be revealed to people lacking a statutorily-defined interest, without the patient's consent. A password itself is not "personal information", though having it could lead to such information. An example of personal information would be the fact that you personally had a certain tooth filled (not that "somebody had a tooth filled"). Protected information can be revealed to certain people, such as the lab that they send samples to, or your insurance company. This is covered by what is known as "The Privacy Rule". There is a related rule, the Security Rule, which essentially says "you need to keep information safe". An example of a required security rule standard is that the provider must Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored HHS recommends degaussing, but other means of satisfying the rule exist (burning, dissolving in acid). Tossing in the trash would not satisfy the rule. Password management falls under the weaker category of "addressable", that is, a provider needs to think about how they will manage passwords, but there is no specific requirement regarding what you have to do (unlike the requirements of Data Backup, Written Contract. Incident Reporting or Media Disposal). Printing and distributing to customers your account and password would, on the other hand, be a reportable incident. Information about your name, the dental procedure done, and the cost of the procedure, is probably also on the paperwork that they give you, and that even more than your password is protected information. A provider is allowed, indeed required, to disclose protected information to the patient. The assumption is that once you have processed that information, you will destroy or protect the paperwork, as you see fit.
We cannot dispense personalized legal advice: that is what your attorney is for. However, I agree with your analysis that this is most likely covered by fair use, and indeed it is not obvious that you have taken anything that is protected. There is no creativity behind a number such as entries in the &quot;I did N pushups&quot; column. The arrangement of data into a web page passes the smidgen of creativity test, but &quot;210&quot; is not a creative number. The terms of service of a website cannot negate your right to use the website however you want in a non-infringing way. If your use is &quot;fair use&quot;, then they can't tell you that you can't use it. In case it turns out that &quot;fair use&quot; fails, the matter would hinge on what exactly the TOS says. They may have granted you permission to make use of their &quot;information&quot;. So there are three positive avenues for you to consider: not protected, fair use, and permitted. A practical difficulty is that a university lawyer is only interested in the interests of the university, and they are as likely to say &quot;don't do that&quot; or &quot;get permission&quot; as they are to say &quot;that is fair use&quot;. You can hire a lawyer who is paid to care about your interest, though there is never a guarantee that the lawyer's advice is correct. I think it is likely that the lawyer will tell you to not say anything until legally forced to, given the apparent rebuff of your request for special permission.
Mere ideas are not, as others have said, protected by copyright. However, the police officer in such a situation may have a duty of confidentiality, particularly if s/he is informed that the contents of the phone are confidential. For example the &quot;Officer's Code of Conduct&quot; of Canton Ohio, says: Whatever a Police Officer sees, hears or learns of that is of a confidential nature will be kept a secret unless the performance of duty or legal provision requires otherwise. Members of the public have a right to security and privacy, and information obtained about them must not be improperly divulged. Many police departments have similar codes of conduct or policies. Such a policy might apply in the circumstances described in the question. In this page on &quot;Confidential information&quot; posted by the TaylorWessing law firm, it is said that: There are three circumstances in which the disclosure of information gives rise to an obligation of confidence: An obligation imposed by contract – for example, non-disclosure agreements. An obligation implied because of the circumstances of disclosure – this is determined on the basis of whether a reasonable man standing in the shoes of the recipient of the information would have realised that the information was being given to him in confidence. An obligation implied because of the special relationship between the parties concerned – for example, employer/employee relationships. The best way of ensuring that confidential information is recognised and treated as such is by contract. If no express requirement for confidentiality is imposed, the manner in which the discloser treats the information can be held as indicative of its level of confidentially. Talking about information in public places, for example, would cause the recipient to assume it was not confidential in nature. An action for breach of confidence is based on the conscience of the recipient who must have agreed or known that the information is confidential. Thus an action for breach of confidence can be brought against the original recipient of the information and any subsequent recipient who becomes aware of the fact that the information is confidential. An action for breach of confidence may be brought against a person who has used or disclosed, or threatened to use or disclose, confidential information without permission. A police officer engaged in a search of confidential documents, whether found on a phone, on a computer, or in a filing cabinet, is in a &quot;special relationship&quot; with the sub ject of the search, and the &quot;circumstances of disclosure&quot; are unusual. Use of such information for private, personal gain unrelated to any police function might be held to violate an implied duty of confidentiality, particularly if the officer is informed of the confidential nature of the documents. If the documents contain or constitute trade secrets, unauthorized use will give grounds for a lawsuit. This would not apply to proper use within a police investigation or criminal case, but it would apply to private use or disclosure by the officer. in &quot;Release of personal information to police: your privacy rights&quot; from the Government of Ontario it is said that: Ontario public sector organizations, such as provincial ministries and agencies, municipalities, schools, and transit systems, are required by law to protect your personal information and to follow certain rules when collecting, using, and disclosing your personal information. This document is primarily about when other governnment agencies can release personal information to law enforcement, but it might be taken to imply a similar obligation to respect privacy being imposed on law enforcement officers. In this page and other linked pages the UK metropolitian police indicate that they are subject to the Data Protection Act 2018 This is closely related to the GDPR. This restricts processing of personal data to lawful purposes. In the absence of the consent of the person searched, I doubt that use of information for personal gain having no connection with a police investigation would constitute a lawful purpose. I have not found an authoritative source, nor a court case, in which the situation described in the question, nor any closely similar situation, is addressed or decided.
Of course it is illegal. You are attempting to access somebody's data without their knowledge and certainly without their consent. In the U.K. it is a crime under the Computer Misuse Act 1990, the Police and Justice Act 2006 and the Serious Crimes Act 2015. The clue here should be in the term Serious Crimes. The Human Rights Act, and indeed the ECHR, should never come into it unless it was state sponsored or corporate spying. And even then certain states have given themselves Orwellian totalitarian authority to do as they please.