No. But that doesn’t someone isn’t going to get in trouble for this.

Photo Credit: Bob Haarmans  cc
Photo Credit: Bob Haarmans cc

First some background: Jason Pierre-Paul, member of the New York Giants, injured himself in a fireworks accident on Independence Day. We now know that he has gotten a finger amputated, thanks to Adam Schefter, an ESPN reporter who tweeted out a picture of the medical records the sports site had “obtained.” Twitter quickly became abuzz, and even got “HIPAA” trending with all the people warning ESPN of their doom for violating the Health Insurance Portability and Accountability Act.

The only problem with that is that ESPN didn’t violate HIPAA. The act doesn’t apply to media personnel who obtain medical records of others. So while it’s definitely shady business to blast out someone else’s medical records on your Twitter, as a reporter Schefter is safe here.

But even so, Schefter could still find himself scrutinized if there’s a legal investigation—which it’s looking like there will be. Even if, as some have posited, the collective bargaining agreement that NFL players sign dictates that players are to release their injury-relevant HIPAA information to the league, it’s hard to believe that would ok leaking such information (let alone whole medical records) to the press.

“This release is not the kind of release that would be covered by any sort of employment agreement; even if it ultimately had to go to the media, there’s likely a whole process involved. It’s not just you were lucky enough to get a handle and access to the medical records, this is preliminary information,” said Michael Kline, partner at Fox Rothschild’s Health Law Practice. “The media is not a direct or intended beneficiary of the collective bargaining agreement.”

And given that ESPN hasn’t stepped up verify the information came from a legitimate source, and the hospital where Pierre-Paul is being treated has already announced an “aggressive” investigation into the release of records, it looks like some sort of foul play went down.

“One thing to bear in mind is that just because you’re famous, doesn’t mean you lose your HIPAA rights. There’s not a “public figure exception” to HIPAA,” said Elizabeth Litten, partner at Fox Rothschild’s Health Law Practice and author on their blog HIPAA, HITECH & HIT. “Most hospitals tend to be very careful in trying to train employees about HIPAA, especially when a high-profile patient comes in the doors.”

But for now, it’s a bit early to speculate exactly what law, exactly, got broken. HIPAA applies to providers and other entities under the law, and if the leak came from a hospital employee or staff, it’s possible they could be held liable under the act.

But Kline says there could be other privacy laws at work here.

“Everybody always focuses on HIPAA—that’s the big one, it’s the federal law—but the state privacy laws can be even more restrictive,” said Kline, who also writes on the HIPAA, HITECH, and HIT blog. “And it shows how complicated this can become, now that you’re talking about how one state regulates privacy versus another. All these kinds of potential areas not enough to say what’s violated without understanding the circumstances, and what applicable laws there are.”

Unless someone comes out and says this is all a big misunderstanding soon, it’s unlikely that this story will go away. For hospital employees and healthcare providers this might be a good time to review proper protocol around HIPAA and other disclosures. And as this story evolves into talk of healthcare law, privacy rights, and where those intersect for sports players and other high-profile figures, expect to see more fireworks from this case.