Chapter 6: When HIPAA Causes More than Fines
Only the Department of Health and Human Services can issue penalties against entities that violate HIPAA laws. It's generally been ruled that individuals who were affected can't sue over those same violations. However, a recent ruling in Connecticut has opened the door for private actions following a HIPAA violation, albeit in an indirect manner. Similar rulings in West Virginia, Missouri, and North Carolina may indicate the trend is taking hold.
Though only the HHS can fine entities for HIPAA violations, some states are ruling that the parties whose private medical information was exposed can sue for damages.
HIPAA Lawsuits: The Connecticut Case that Set a Precedent
The most recent ruling comes from the case Byrne v. Avery Center for Obstetrics and Gynecology, P.C. According to Inside Counsel , the case involves Emily Byrne whose private health information was shared with her former significant other without her permission. The Avery Center for Obstetrics and Gynecology was served a subpoena after the significant other filed a paternity suit, but it failed to get Byrne's approval to release the information and it didn't attempt to fight the subpoena. Byrne then filed a lawsuit, claiming the Avery Center acted negligently by sharing her private health records without her consent.
In the initial trial, the lower court ruled that HIPAA preempted the negligence suit. But the case went on to the Connecticut Supreme Court, which ruled that…
- HIPAA may inform the applicable standard of care in certain circumstances.
- Violation of that standard was cause for a negligence claim.
The case was sent back to lower court and will return to trial as a negligence case. For more information, read about the case in Westfair Online .
What Does the HIPAA Case Mean for Nurses?
Because of the Connecticut ruling, HIPAA violations could mean more than just a fine for nurses. A HIPAA violation could be considered a breach in the standard of care and be grounds for a malpractice claim, too. This would mean that in addition to being fined for HIPAA violations, a nurse could also be sued if they accidentally expose protected health information.
However, the ruling is still new, so the likelihood of facing a HIPAA lawsuit depends on state law and future cases. Stay current on any HIPAA rulings in your state to better understand your risk.
Next: Chapter 7: HIPAA Risks from Your Business Associates