A Chicago appellate court held that a school district was not liable for inadvertant disclosure of employee health information under HIPAA or common law duty. The district disclosed an insurance enrollment list that contained the names of 1,750 former employees, along with their addresses, Social Security numbers, marital status, medical and dental insurers and health insurance plan information, then acted responsibly to attempt to clear up the disclosure. The employees whose names were revealed filed a class action suit against the school district, arguing that the school district owed a HIPAA duty to safeguard their personal information. They also sued under state statute and common law duties. The court ruled in favor of the district and found no statutory duty to safeguard the employees’ personal information. Under HIPAA, health records held by a covered entity in its role as an employer are excluded from the safeguard rule. Cooney v. Chicago Public Schools (IllAppCt) at ¶100-519