Pursuant to the Health Information Technology  for  Economic  and  Clinical  Health Act (“HITECH”), state attorney generals (“AGs”) have the power to bring civil actions to enforce HIPAA on behalf of their state citizens. To date, few AGs have brought such actions. AGs that have initiated suits have alleged a variety of state law claims in addition to HIPAA. Most, but not all, AG actions have been brought against “covered entities” (medical providers, hospitals etc.) under HIPAA.

It does not appear that enforcing HIPAA is a priority for most AGs, due to the low number of actions brought under the statute. Connecticut, Vermont, Minnesota, and Indiana have each brought one action. Massachusetts is the only state that has brought more than one action.1

Click here to view the table.