The Health Insurance Portability and Accountability Act (HIPAA) requires health care providers and other businesses to protect the confidentiality of certain patient information. Last month in an unpublished decision, the Sixth Circuit Court of Appeals upheld the termination of an employee who removed HIPAA-protected information from the workplace in an attempt to aid a former coworker’s age discrimination claim against the employer.

Aldrich v. Rural Health Servs. Consortium, Inc. involved an administrative employee who was upset when the company’s CFO was terminated. The former CFO sued claiming age discrimination, and the plaintiff alleged that the company was destroying records relevant to his lawsuit. She began forwarding emails to her personal account, including emails that included discussion of specific patient treatment. The employer discovered these actions, and demanded that the plaintiff destroy all records sent to her personal account. She refused and was terminated.  The plaintiff filed suit, alleging retaliation under ADEA.

The Sixth Circuit affirmed dismissal of the claim on summary judgment. The court concluded that the plaintiff never engaged in any protected activity under ADEA. She was not a participant in her friend’s age discrimination suit because she was never subpoenaed for any information, and had never received a request from his lawyers to assist with the litigation. In addition, the employer was entitled to insist on destruction of the documents forwarded to her personal email account because they contained protected patient information under HIPAA. Under the circumstances, the plaintiff’s retention of this information was “patently unreasonable.”

Employers outside of the health care industry may need to exercise more caution before terminating an employee for taking information used to support another employee’s discrimination claim against the company. Instead of automatically firing the employee, the employer should investigate the circumstances to determine the context in which the information was obtained, its relevance to the underlying legal claim, and whether it contains proprietary and confidential business information subject to legitimate non-disclosure expectations.