Courts across the country have routinely decided that HIPAA does not create or authorize a private right of action. [See Doe v. Board of Trs. of Univ. of Ill., 429 F. Supp.2d 930, 944 (N.D. Ill. 2006); Slue v. New York Univ. Med. Ctr., 409 F. Supp.2d 349, 373 (S.D.N.Y. 2006); See about 8th Cir. Case.] HIPAA contains a pre-emption provision titled “Effect on State Law,” which states in part, that it “shall supersede any contrary provision of State Law,” but also an exception that HIPAA shall not supersede a conflicting State Law provision if the provision of State Law, “…subject to section 264(c)(2) of the Health Insurance Portability and Accountability Act of 1996, relates to the privacy of individually identifiable health information.” 42 U.S.C. §132od-7 (1996). Recently, the Supreme Court of Appeals of West Virginia dealt with a claim brought by an individual against St. Mary’s Medical Center, Inc., claiming “negligence, outrageous conduct; intentional infliction of emotional distress, negligent infliction of emotional distress, negligent entrustment, breach of confidentiality, invasion of privacy, and punitive damages.” R.K. v. St. Mary’s Med. Ctr., Inc. – – – S.E.2d – – – -, 2012 WL 5834577 (W.Va.: Nov. 15, 2012). The Plaintiff did not assert a claim under HIPAA. The Supreme Court of Appeals of W. Va., overruling the lower court, found that R.K.’s state law claims for the wrongful disclosure of his medical and personal health information are not pre-empted by HIPAA…” (Id.) [See Health Law Express Express@hortyspringer.com (November 29, 2012)]. The case was remanded.
The outcome of this case and its application raises the issue of whether private actions of individuals for medical records privacy breaches can be successful. As electronic health records and medical records conversion continues, any health entity involved with healthcare records should pay special attention to this case and the line of cases like it. In my opinion, this result has the potential to limit the HIPAA pre-emption and to open the holders of healthcare records to new causes of action. This result opens a large potential legal issue for holders of healthcare records. You should watch the outcome of this case and make sure that, if you are a holder of healthcare records, you fully understand the ramifications of this case.