Health Providers Beware: HIPAA Breaches May Give Rise To Negligence Actions

Electronic medical records provide a multitude of benefits for providers and patients by promoting efficient record access, cost savings and better patient care. So what's the down side?

Well, for starters, these records are ripe for hacking and inadvertent disclosures. As mentioned in a previous post, health care fraud has reached new heights by and through the theft of personal and medical information. Left in the wrong hands, the sensitive information contained in these computerized records could unleash a fraud firestorm.

Historically, medical providers have successfully defended against claims brought by plaintiffs whose information was hacked or otherwise improperly accessed by relying upon the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") which expressly provides that there is no private right of action under HIPAA. This success may be short lived as the number of hackers has increased and some courts, like Connecticut's Supreme Court, have indicated a willingness to allow plaintiffs to bring claims for negligence and privacy violations against providers under state law.

HIPAA Standard of Care

In Byrne v. Avery Ctr. For Obstetrics & Gynecology, 314 Conn. 433 (2013), a health center produced a patient's protected health information (PHI) in response to a subpoena without notifying the patient and without taking any steps to protect it from disclosure in violation of HIPAA's guidelines. The aggrieved patient filed an action against the provider for breach of contract, negligence, and negligent infliction of emotional distress.

While noting HIPAA's language...