A hospital in northeast Kansas divulged intimate private details of a woman’s sexual assault evaluation and treatment to her rapist, according to a lawsuit filed Wednesday in federal court.
And months later, after a “barrage” of harassment, the woman was raped again by the same man, according to the suit.
The woman filed the lawsuit against Atchison Hospital and the X‐ray technician accused of disclosing the patient’s information to her attacker.
The technician was fired by the hospital but was rehired at Saint Luke’s Cushing Hospital in Leavenworth County not long after, according to the petition.
The woman, who lives nearby in Missouri, trusted the hospital with information about the May 2017 assault, which included the name of her assailant, her attorneys said. She was adamant her health information not be released to third parties, according to her lawsuit.
The petition accused the hospital of not having adequate protocols in place to protect patient information. Atchison Hospital has not filed a response in court and attempts to reach a representative of the hospital Thursday were not immediately successful.
The Star generally does not name victims of sexual assault without their permission.
After the woman was assaulted, hospital staff administered a rape kit examination, according to the suit. Information collected during her evaluation was protected under the Health Insurance Portability and Accountability Act, her attorneys said.
The privately-owned hospital betrayed its patient when the technician called the woman’s alleged assailant and told him the woman accused him of sexual violence, according to the lawsuit.
The employee also disclosed other private information, something the patient did not consent to, the lawsuit said. The technician denied she disclosed the information.
After getting the confidential information, the woman’s assailant “relentlessly” harassed and threatened her through texts and phone calls, according to the lawsuit. He sent her graphic language and pornographic content, the woman’s lawyers said.
The patient was also harassed by hospital staff, according to the lawsuit.
Nearly four months after the privacy breach, the technician was terminated, according to the lawsuit. But she was hired to work at Saint Luke’s Cushing Hospital after the Atchison hospital provided a positive reference or failed to communicate facts about her employment, the woman’s attorneys said.
A hospital official sent the patient a letter “expressing deep regret” and apologizing for the breach, according to the lawsuit. In its letter, the hospital said the employee did not appear to be a member of the woman’s “immediate health care team.”
The letter said the hospital “immediately took action,” launching an investigation that included interviewing the employee who released the information, as well as several other employees, to determine how the breach occurred.
According to the hospital, the investigation showed that the employee did not access the information from an electronic medical record at the hospital but rather by viewing information in the hospital’s Health Information Department. The hospital said it did not think the breach included any financial information.
The hospital said that, in addition to firing the employee, it “further evaluated” its security and privacy policies and made some changes. It also said it required additional education for staff.
“We are confident that our investigative process and remedial steps will help to minimize the risk that this type of incident may occur again the future,” the letter said.
The letter was signed by then-CEO John Jacobson, who is retiring from the hospital effective July 1, according to the St. Joseph News-Press Now media outlet. Jacobson reportedly announced the retirement last summer.
The woman’s claims included invasion of privacy, negligence, breach of fiduciary duty and punitive damages. She argued she was entitled to more than $75,000 in damages for each count.