Connecticut Supreme Court Allows Patients to Sue Providers for HIPAA Violations

A recent ruling by the Connecticut Supreme Court allows patients, who have suffered losses or harm from the unauthorized disclosure of their protected health information, the right to bring legal action against providers for unauthorized disclosure of their medical records.

In this recent Connecticut case, Emily Byrne vs Avery Center for Obstetrics and Gynecology, the patient had exercised her rights under HIPAA to restrict the release of her medical information. Despite this restriction, the patient’s medical records were released to a third party when the patient had issued specific instructions not to disclose her medical information.

HIPAA violations are investigated by the Department of Health and Human Services, Office for Civil Rights. Financial penalties are issued to organizations that breach the regulations. HIPAA allows the federal government to issue penalties for violating patient confidentiality, but the federal law does not provide a private right of action for patients to collect damages caused by non-compliance or data breaches.

The patient’s negligence claim in this recent case was heard before the Connecticut Supreme Court on the grounds that the disclosure of her medical records constituted professional negligence by the OB/GYN medical center. They acted in a manner contrary to the HIPAA rules and subsequent amendments using HIPAA as the ‘standard of care’. As a result of their negligence, the patient suffered damages.
Negligence alone is not a sufficient cause to file a claim against a healthcare provider. There must be an established and proven failure to meet this standard of care and that the negligence caused loss or damage as a direct result. Without a loss or injury, there is no valid claim for damages.

The state of Connecticut now recognizes that there is a duty of confidentiality, the breach of which can lead to compensation for damages. Healthcare providers as well as their business associates will potentially be liable. Several other states, including New York, Massachusetts and Missouri, have similar rulings regarding a patient’s right to sue over confidentiality breaches.