Officials at a Tampa, Fla., medical facility might have violated federal law protecting patients' privacy rights by speaking to NCAA investigators about a former Connecticut basketball recruit, two health care attorneys told CBSSports.com.
By discussing Nate Miles' foot surgery and payment details, officials at the Tampa Bay Bone and Joint Center violated the Health Insurance Portability and Accountability Act of 1996 (HIPAA), according to the attorneys. The NCAA deemed that Miles' foot surgery in 2008 was an extra benefit paid for by Josh Nochimson, a former UConn student manager and booster who ultimately became an agent. In its public infractions report dated February 2011, the NCAA infractions committee referred to contact being made with “the doctor who performed the procedure on [Miles].”
That orthopedic surgeon, Chris MacLaren, is mentioned in the infractions report along with Joseph McCandrew, an administrator at the center. MacLaren's attorney told CBSSports.com that no HIPAA violations occurred.
The Tampa Bay Bone and Joint Center did not respond to a request for comment.
While NCAA investigators apparently did not violate federal law, they were able to extract information to assist in the case that led to major penalties against UConn and former coach Jim Calhoun. Health care attorneys Frankie Forbes of Kansas City and Jill Jensen of Omaha offered their opinions after examination of documents in the UConn case obtained by CBSSports.com.
“If the physicians agreed to the [NCAA] interview and the subject matter was their patient and [they] did not have authorization from the patient, that would be a problem,” Forbes said. “If the subject matter at all was the patient, and the patient didn't authorize it, that's an issue. … That's a violation of the HIPAA privacy right.”
“It [violation] would be mainly on the side of the doctors and the surgery center for sure,” Jensen said. “I don't see liability for the NCAA.”
Calhoun's attorney, in correspondence with the NCAA two-and-a-half years ago, pointed out that: “third parties,” -- in this case the NCAA -- “who without authorization induce medical providers to disclose confidential medical information,” could be liable. He cited a 14-year-old case, Biddle v. Warren General Hospital, in making that contention.
An NCAA spokesman said the association would have no comment. This latest information comes less than a month after the NCAA's release of its external review of enforcement procedures in the Miami case.
HIPAA sets a national standard for accessing medical records. For there to be HIPAA penalties, a complaint would have to be filed with the Office of Civil Rights, the attorneys said. The likely result would be a fine or admonishment.
In the UConn case concluded two years ago, the NCAA cited the “extraordinary steps” taken by the school to recruit Miles. As a result, Calhoun was suspended for three games. There also was recruiting limitations placed on UConn basketball. The program comes off its three-year probation on Feb. 21.
MacLaren is currently employed by Westchase Sports Medicine Orthopaedics in Tampa. He did not respond directly to a CBSSports.com request for comment.
“It is our position that Dr. MacLaren did not violate any HIPAA violations,” Tampa-based attorney Frank Miranda said via voice mail, on behalf of his client.
To comply with HIPAA, the center's officials would have needed permission from Miles to discuss his medical condition. Calhoun's attorney, Scott Tompsett, contacted the NCAA several times in 2010 to determine if the enforcement staff had done so. The NCAA, via email to Tompsett on August 31, 2010 stated the NCAA had obtained “certain medical records” and that “a HIPAA release was not required.”
Miles told CBSSports.com he authorized neither the Tampa Bone and Joint Center nor the NCAA to discuss his medical condition.
“I didn't authorize anybody,” he said.
“I never told anybody to share anything,” Miles said in a later interview. “I just couldn't believe they did. I thought they couldn't. I lost everything.”
Tompsett also wrote the NCAA: “It appears that Miles never authorized his medical providers to provide his confidential medical information to the enforcement staff. Nonetheless, Miles' medical information was provided to the enforcement staff."
Nochimson was found by the NCAA to have provided Miles with impermissible benefits, including the money for Miles' surgery. Miles was expelled from UConn in 2008 without playing for the Huskies. He recently left the American Basketball League's Heartland Eagles and is back in his hometown of Toledo, Ohio.
The HIPAA violation would have occurred after he left UConn. As a private citizen Miles was subject to the same HIPAA protections as the general population even though information was obtained in an NCAA case.
“The [NCAA] interview [with the center] is much more troubling than just a telephone call saying ‘I heard so-and-so was having foot surgery," Forbes said.
MacLaren confirmed to the NCAA the price of Miles' procedure, according to public NCAA documents. McCandrew told the NCAA that Miles' “account ledger” showed $175 for an office visit and a surgeon's fee of $1,980.
“That's real clear if there is no authorization and no process to compel him [Miles] to release that information that would be a violation of HIPAA,” Jensen said. “The specific reference to the ‘account ledger', anything that identifies an account ledger is going to be considered protected health information.”
Tompsett got a letter from the infractions committee liaison in September 2010 saying an “advisory opinion” on how to proceed regarding HIPAA concerns would not be provided by the NCAA. NCAA liaison Shep Cooper wrote, that the committee suggested a careful review of state and federal law by Tompsett “in order to advise your client.”