The Connecticut Supreme Court has ruled that a patient may sue a healthcare provider for negligence and emotional distress caused by an alleged violation of the HIPAA privacy regulations. The court’sopinion was released unofficially last week and published in the Connecticut Law Journal on November 11. 

The defendant medical practice allegedly breached the confidentiality of the plaintiff’s medical records by releasing information about her pregnancy without her authorization. The plaintiff had instructed the practice not to release the records of her prenatal care to the father of her baby. However, when the practice received a subpoena from the father in a paternity action, it sent a copy of the plaintiff’s records to the court without giving her prior notice or requesting the court’s guidance regarding its obligations under HIPAA.  

The plaintiff’s claims were brought under Connecticut common law. The lower court had ruled that the negligence claims were preempted by HIPAA, under which there is no private right of action, and dismissed them. However, the state Supreme Court reversed the trial court’s decision, finding that a violation of HIPAA may be actionable under state law to the extent that it constitutes a violation of generally accepted standards of care.  

The plaintiff’s lawsuit also included claims for breach of contract and negligent misrepresentation. The trial court did not dismiss those claims, and they will now be considered by the trial court along with the negligence claims which have been remanded. 

Despite the absence of a private right of action in HIPAA, courts in Missouri, North Carolina and West Virginia have previously permitted state law claims for improper disclosures of protected health information.