NCAA May Have Obtained Medical Information Protected By HIPAA in Its Investigation of Jim Calhoun and Connecticut

You can now add obtaining information that was given by a medical profession as a potential HIPAA violation to the list. Dennis Dodd of CBS has this report that federal law may have been violated by the medical provider to Nate Miles in the Jim Calhoun/Connecticut case. The NCAA determined that an extra benefit was paid for Miles’ foot surgery based on information from the doctor that performed the surgery, Dr. Chris McLaren.

To be clear, the NCAA itself is not liable for a HIPAA violation, because it did not provide the information. That would go on the medical provider. His attorneys deny that a HIPAA violation occurred. To release medical information to the NCAA, who has no subpoena power, though, there would have had to been a release or other legal way of compelling production.

"“I didn’t authorize anybody,” [Miles] said. “I never told anybody to share anything,” Miles said in a later interview. “I just couldn’t believe they did. I thought they couldn’t. I lost everything.”"

The NCAA previously told Jim Calhoun’s attorney that “a HIPAA release was not required by any entity that provided the staff with information.” If the NCAA acquired the information from a covered entity (and a doctor or medical facility would certainly qualify) who did not have authority to share personal medical information, then that assertion by the NCAA would be false. While the NCAA cannot be liable if there was a violation because they were not the provider of information, it is still a bad look if the NCAA is seeking out protected information and then representing that it was obtained consistent with Federal law.

[photo via USA Today Sports Images]