[ Friday, April 14, 2006 ]
Interesting developments in New Jersey: I think I blogged on this case earlier, but back toward the end of last year, a New Jersey hospital sued a law firm to recover medical records the law firm had on one of the hospital's patients. The hospital did not know how the law firm got the records, since there wasn't a proper release or authorization, and the law firm refused to say how they got them. The hospital sued for return of the records under HIPAA, and the court denied on the basis that the hospital did not have standing to sue, noting the clear language that there's no private cause of action under HIPAA. The hospital asked for a rehearing to argue instead that the case is about the hospital protecting its own business records, rather than trying to enforce HIPAA, so that the case would be analogous to a company suing another company to get its stolen trade secrets back. It the trade secrets were obtained by the other company by legal means, then the losing company would have no grounds for complaint, but they would have a cause of action if there was a bad act that caused the disclosure. By the same token, the court here notes that the hospital that lost the records has at least some interest in getting them back, and the public policy for allowing a hospital to head down that path is even greater than the public policy that allows a company to chase down its own stolen trade secrets.
On rehearing, the court agreed
, and while noting that there's not currently a common law cause of action for this particular type of issue, perhaps there ought to be one. The matter itself might be moot, but the court wanted to clear its earlier blanket refusal to allow a hospital to challenge and perhaps reverse an improper disclosure of records.
Hat tip: Alan Goldberg
Jeff [9:53 AM]
Blogger: HIPAA Blog - Edit your Template