Kenna Says: In Health Care, HIPAA must be Sacred!

I want to tell you about someone I never met.

I know her name. I know details of her mental health treatment. I know things about her life that are deeply private — the kind of information that, in a clinical context, is protected by federal law under HIPAA.

I know these things because my therapist accidentally CC’d me on an email chain that contained her confidential information. Her full name. Her treatment details. Information that had no business being in my inbox.

It was a mistake. I believe that. People make mistakes with email. That is not the story.

The story is what happened next.

When I told my therapist about the error — when I flagged that I had received another patient’s confidential mental health information — she laughed.

Not a nervous laugh. Not an “oh god, let me fix this immediately” response. She laughed it off. Minimized it. Moved on.

That is a HIPAA violation. Patient confidentiality is federal law, not a courtesy. The accidental disclosure of another patient’s protected health information requires immediate corrective action — notification, documentation, a breach assessment. It does not get laughed off.

But more than the legal failure, I want to name the human one.

The person whose information landed in my inbox was homeless; I later found out who she was, and what happened in her life. She was vulnerable. She had almost no safety net. She did not have the language, the resources, or the platform to advocate for herself the way I have been able to advocate for myself. She did not have a voice in this.

She deserved one anyway.

In the months that followed, I watched — from a distance, through the limited information available to me — as this person’s life destabilized dramatically. I cannot prove what caused that. I will not claim I can. But I cannot stop thinking about it, and I wonder if there was correlation with my story.

I will never know.

My therapist once said something that has stayed with me, mostly because of the context, which I cannot reveal without revealing confidential information: that it “takes a long time to die like this.” She said it in a clinical context, describing a certain kind of slow psychological deterioration, and I knew who she was talking about.

I think about that woman. I think about whether anyone was watching out for her. I think about whether the system that was supposed to protect her was instead using her — her vulnerability, her instability, her voicelessness — as a buffer.

I think about the laugh.

To my former therapist: I still have those emails. All of them. That has not changed, and it will not change.