A basic principle is that a decision structure's system for security and protecting confidentially should be aligned with its moral duty. The presumption is that Eric Williams has a right to the privacy of his medical records. He, at least implicitly and somewhat voluntarily, relinquished some or all of this right to the physicians, nurses and administrators who were attending him. They had a need to know about him and his condition in order to perform the medical services he required. While a rather large group of people might have a legitimate decision structure need to know about Williams' condition, it probably numbers in the very low 100's rather than as many as

1700. In fact, Sieglar (1982) expressed concern that 25 or as many as 100 health professionals may have access to a patient's record during his or her hospital stay. In Williams' case, there were apparently quite a few information "free riders" and privacy interlopers.

Williams may not want Texas Department of Public Safety or other law enforcement officials to have access to his private medical records. Nevertheless, Parkland may be forced to have them released if they are properly subpoenaed by legitimate authorities. DPS is a controlling institution that, if it follows proper due process procedures, has a socially legitimate need to know.

As a celebrity Williams is also perched on another precariously fine line. On the one hand, he benefits from his popularity as a Dallas Cowboy football player and should expect exceptional media attention. The fact he is in the hospital is news. On the other hand, specifics about his medical condition are his own personal property and should not be released to unauthorized parties without his permission. The media may have over stepped its bounds if it requested Williams' records from Mary. Mary surely violated her implied, and probably overt, pledge to confidentially if she released the records to the media.

Taking all of this into account, Parkland's decision structure should be designed and implemented in such a way that the medical staff that needs to know gets the personal information about Williams they need to treat him. The system must accord this obligation their first and highest priority. This means that many people who might potentially need to know must be given access even though as events unfold they may not actually need to know. Parkland, however, was right to reject controlling institution requests, such as DPS'S, until the appropriate legal papers are presented. But, once due process requirements are met, the hospital must relinquish Williams' personal information to the authorities even if Williams or his representatives disagree. Societies, legitimate demands trump Williams claim to privacy. Finally, Parkland has a strong duty of confidentiality to prevent people who have no need to know, whether employees of Parkland or outsiders, from gaining access to Williams' medical records. Moreover, since Williams is the object of media attention Parkland has some, perhaps limited, duty to provide information about his condition to the outside world in the public interest.

It is difficult to discharge these duties perfectly, especially in rather large organizations operating under severe time constraints and for which failure of their primary mission - in this case saving Williams' life and treating his injuries. Modern computer based patient record systems are not up to the task, at least on a cost/effective basis. Picture yourself in the situation described in this case.

Imagine the state of affairs at Parkland early on the morning Williams arrived by ambulance. An emergency team met him at the door. All of these people have a need to know what ever is known about Williams' medical condition. A triage examination is conducted and the appropriate specialists are called in. They, too, have a need to know. Records must be prepared to admit him into the hospital. The people who manage this need to know. Yet, many of these people have a need to know different things about Williams. For this reason the decision structure that is Parkland Hospital is not a single monolithic decision structure. It is a cluster of various substructures.

Parkland as a whole may be thought of as a privacy capsule. This capsule encloses Parkland's decision structure for the entire system. The capsule's shell establishes a boundary between what is inside - that is, the legitimate second party identification - and, therefore, must be kept secret and confidential, and what is outside and, accordingly, may be made public or shared with other third party structures. This, however, must be considered a prima facie boundary. Legitimate institutions and people in the public, such as law enforcement officials from DPS, may, in the interests of society at large and with due process, penetrate the capsule, intercede the decision structure and secure personal information about Williams.

Within the main capsule there are numerous others. There are many specific decision structures that have particular needs that must be met in order to serve Williams as a patient or, perhaps, to perform duties which may trump Williams' right to privacy. Among these sub-decision structures are the following: attending physician, attending nurses, subspecialists, general internist, CEO, chief of staff, chief resident (Parkland is a teaching hospital), intensive care nurse, pharmacy, dietitian, security department, accounting department, research staff, and on-line computer database administrators. Each of these units has a need, perhaps even a right, to access some portion of Williams' records (that is, to see a "view" of the database). They may also have a need to know certain elements of information contained in Williams' entire record. Consequently, each of these sub-decision structures is a privacy capsule itself.

The hospitals challenge in fulfilling its duty to protect its patients' privacy is to implement a system which defines and preserves each of these capsules so that the requisite information can flow freely within it, the appropriate decisions made, and actions required by its role effectively performed, while not permitting any information to flow outside it unless there is legitimate authorization. Mary was a member of one sub-decision structure and, therefore, had a right to be in the vicinity; buy; she did not have a right to penetrate the capsule containing Williams' lab results.

In another deposition (Feb. 13, 1996) Kathleen, the director of medical records for about 15 years, described her responsibilities: "Well, legally, I'm the custodian of the medical record. Other responsibilities include managing my employees, of which there are 177, and protecting the confidentiality of the record and seeing that the record is provided for direct patient care."