Would a conspiracy to break patient confidentiality be a crime?
<p>Inspired by <a href="https://workplace.stackexchange.com/questions/81827/is-it-safe-to-discuss-work-grievances-with-a-company-psychiatrist/81878#81878">this question</a> on The Workplace, I wonder if a company that hired a doctor to spy on patient/employees would be committing a crime in the US.  And would the doctor be committing a crime by doing so?</p>

<p>Details:</p>

<p>Patient/employee means a patient of the doctor and employee of the company.</p>

<p>By "spy" I mean the company says, "Employee: this doctor is our health provider, go to him for all your health care needs, with a small or even zero co-pay;" and, "Doctor, we will send our employees to you, and you will in turn provide all records of their visits to us, while telling our employees (your patients) that the records would never be shared with us."</p>

<p>Without the patient's permission, the doctor cannot legally share the patient's health information with the patient's employer.</p>

<p><a href="https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html" rel="nofollow noreferrer">Your Rights Under HIPAA</a>:</p>

<blockquote>
  <p>[...] without your authorization, your provider generally cannot [...] give your information to your employer</p>
</blockquote>

<p>Remedies for confidentiality violations include civil actions, administrative fines, and criminal charges. (<a href="http://www.thehealthlawfirm.com/resources/health-law-articles-and-documents/Remedies-for-Violation-of-HIPAA-Privacy-Rights-and-Medical-Confidentiality.html" rel="nofollow noreferrer">Remedies for Violation of HIPAA Privacy Rights and Medical Confidentiality</a>, <a href="https://www.ama-assn.org/practice-management/hipaa-violations-enforcement" rel="nofollow noreferrer">HIPAA Violations and Enforcement</a>, <a href="https://www.atlantic.net/blog/what-is-the-penalty-for-a-hipaa-violation/" rel="nofollow noreferrer">What is the Penalty for a HIPAA Violation</a>) Individual states also have confidentiality laws that are violated by the hypothetical in the question.</p>

united-states privacy medical