On Tuesday, November 4, 2014, the Connecticut Supreme Court announced its decision to overturn a trial court’s determination that a plaintiff could not bring state common law claims for negligence and negligent infliction of emotional distress when the underlying conduct at issue involved alleged violations of HIPAA.  As reported in Emily Byrne v. Avery Center for Obstetrics and Gynecology, P.C., the plaintiff Emily Byrne had ended a relationship with an individual who subsequently filed paternity actions against her and subpoenaed her medical records from the defendant OB/GYN medical practice.  When the defendant furnished Ms. Byrne’s medical records pursuant to the subpoena, Ms. Byrne sued the medical practice, bringing state common law negligence claims and arguing that the appropriate standard of care was defined by HIPAA requirements that, according to Ms. Byrne, the defendant had violated.  Citing to the established law that there is no private right of action under HIPAA, the trial court dismissed the state law claims tied to the alleged HIPAA violations, stating that the plaintiff’s labeling of her claims as state common law claims did not change their essential nature as HIPAA claims.  The trial court also held that allowing state common claims for HIPAA violations, for which there was no private right of action under HIPAA, would be contrary to HIPAA and therefore was preempted by HIPAA.

The Connecticut Supreme Court reversed the holding of the trial court.  The Supreme Court first held that a state common law cause of action allowing an individual to protect medical record privacy would not preclude, conflict with or complicate health care providers’ ability to comply with HIPAA and its implementing regulations.  Therefore, according to the court, such a cause of action, if recognized under state law, would not be preempted by HIPAA.   In addition, following the reasoning articulated in a number of other state court decisions, the Connecticut Supreme Court held that to the extent it has become the common practice for Connecticut health care providers to follow the procedures required under HIPAA in rendering services to their patients, HIPAA and its implementing regulations may be utilized to inform the standard of care applicable to claims arising from allegations of negligence in the disclosure of patients’ medical records pursuant to a subpoena.  The Connecticut Supreme Court did not address the issue of whether such an action in fact would lie under the Connecticut common law but remanded the case to the trial court for further proceedings consistent with the Supreme Court’s holding.  The decision of the Connecticut Supreme Court will be officially published on November 11, 2014, but a pre-publication copy is available here.

Reporter, Robert M. Keenan, III, Atlanta, +1 404 572 3591, rkeenan@kslaw.com.