Doe v. Southeastern Pennsylvania Transportation Authority (SEPTA), 72 F.3d 1133 (3d Cir. 1995)

In this opinion, the Third Circuit holds that individuals have a constitutionally protected right to privacy in their medical records, including prescription drug records, and in their HIV status. The court holds that a separate disclosure is made every time a new person is told about an employee’s HIV-status, regardless of the working relationship of the people to which disclosure was made. The opinion contains useful language on the stigma and harassment from non-consensual disclosure of HIV status in particular. In determining whether there has been a violation of the right to privacy in the disclosure of information, the court puts forth seven factors to weigh: (1) the type of record requested; (2) the information it does or might contain; (3) the potential for harm in any subsequent nonconsensual disclosure; (4) the injury from disclosure to the relationship in which the record was generated; (5) the adequacy of safeguards to prevent unauthorized disclosure; (6) the degree of need for access; (7) whether there is an express statutory mandate, articulated in public policy, or other recognizable public interest favoring access.

Weighing these factors, the court set aside a verdict on behalf of Doe, an HIV-positive SEPTA employee whose privacy right was infringed when his employers reviewed his prescription drug records, which included his name, in the course of determining whether their prescription plan was functioning properly. The court held that the infringement was outweighed by the employer’s legitimate need to monitor the prescription plan. There are several flaws in the majority’s holding, as noted in Judge Lewis’s dissent. For example, as Judge Lewis notes, the court weighs the employer’s interest in disclosure of the list of medications employees were using, instead of focusing on the undisputed fact that the corresponding names of the employees served no legitimate interest to the employer; the court does not adequately consider whether the employer should have had safeguards in place to prevent disclosure of employee names or to handle the information more carefully when it received it; and the court gives improperly weighs whether Doe suffered any actual discrimination as a result of the disclosure, which is a question of damages rather than whether a constitutional violation occurred.