North Carolina appeals court allows new use of HIPAA in lawsuit

The patient sued the physician for negligence to get around a federal ruling against direct HIPAA privacy lawsuits.

By Amy Lynn Sorrel, AMNews staff. March 12, 2007.

A North Carolina appeals court ruling suggests an alternate route patients may take to sue physicians for HIPAA violations, in spite of a 2006 federal decision that essentially closed the door on lawsuits brought directly under the privacy statute, experts warn.

The plaintiff in the case, Heather D. Acosta, was an employee and a patient at a psychiatric clinic, according to court records. She sued the clinic's owner, David R. Faber II, MD, in May 2005 for giving his medical records access password to an office manager. That person later disclosed Acosta's confidential information to a third party without her consent.

But rather than filing suit against Dr. Faber directly under HIPAA, Acosta sued him for negligence for giving the password to unauthorized personnel. The lawsuit accuses Dr. Faber of breaching his duty under the privacy regulations established under HIPAA and the rules adopted at the hospital system where the medical records are stored. Acosta alleges that he should have known that his negligence would cause her emotional distress.

A trial court dismissed the lawsuit, saying HIPAA did not create a private right of action. But the North Carolina Court of Appeals in December 2006 reversed that ruling. The appeals court said the patient was not making her claim under HIPAA; rather, she was using the privacy statute to establish the standard of care that Dr. Faber should have followed.

"Plaintiff cites to HIPAA as evidence of the appropriate standard of care, a necessary element of negligence," the opinion states. "Since plaintiff made no HIPAA claim, HIPAA is inapplicable beyond providing evidence of the duty of care owed by Dr. Faber with regards to the privacy of plaintiff's medical records." The court allowed the lawsuit to go forward. No trial date has been set.