The Connecticut Supreme Court has ruled that a patient may sue a healthcare provider for negligence and emotional distress caused by an alleged violation of the HIPAA privacy regulations. The courts opinion was released unofficially last week and published in the Connecticut Law Journal on November 11.
The defendant medical practice allegedly breached the confidentiality of the plaintiffs medical records by releasing information about her pregnancy without her authorization. The plaintiff had instructed the practice not to release the records of her prenatal care to the father of her baby. However, when the practice received a subpoena from the father in a paternity action, it sent a copy of the plaintiffs records to the court without giving her prior notice or requesting the courts guidance regarding its obligations under HIPAA.
The plaintiffs claims were brought under Connecticut common law. The lower court had ruled that the negligence claims were preempted by HIPAA, under which there is no private right of action, and dismissed them. However, the state Supreme Court reversed the trial courts decision, finding that a violation of HIPAA may be actionable under state law to the extent that it constitutes a violation of generally accepted standards of care.
The plaintiffs lawsuit also included claims for breach of contract and negligent misrepresentation. The trial court did not dismiss those claims, and they will now be considered by the trial court along with the negligence claims which have been remanded.
Despite the absence of a private right of action in HIPAA, courts in Missouri, North Carolina and West Virginia have previously permitted state law claims for improper disclosures of protected health information.