[ Tuesday, October 28, 2008 ]
Kentucky: No HIPAA Private Cause of Action:
In Young v. Carran
, Ms. Young sued her baby-daddy's law firm for letting him have her psychiatric records. Apparently Young and the daddy Martin were in a child custody fight. Martin got the right for his lawyers to access Young's medical records, but he wasn't allowed to see them. Martin's lawyer got elected judge, another lawyer in the firm (Carran) took over the case. Martin decided he wanted to change law firms and asked for a partial return of his retainer and his case file. Carran gave Martin a box with the files, including the files that weren't supposed to be shown to Martin, and a check for his unused retainer. Martin didn't look at the files, just took the check, and put the files under the seat of his truck. Young stole the files from the truck before Martin could look at them.
Young then sued the law firm for intentional infliction of emotional distress, negligence, violation of privacy rights, violation of HIPAA, and breach of contract. The trial court granted summary judgment to the law firm on all counts, and Young appealed only the violation of HIPAA claim. Her argument was that a Kentucky statute codifying the "negligence per se" common law claim actually allowed a state law cause of action for a breach of HIPAA. HIPAA is a statutory standard of care, and breach of HIPAA by the law firm would be negligence per se.
The court didn't buy it. The Kentucky statute only applies to other Kentucky statutes, so it can't insert the HIPAA standards (which is federal law) as a required standard of care. The court doesn't mention that the HIPAA standards would not have applied to the law firm anyway, since it's not a covered entity.
Jeff [11:15 AM]
Blogger: HIPAA Blog - Edit your Template