Update on Litigation under the HIPAA Privacy Rule

A federal appellate court in Acara v. Banks, No. 06-30356 (5th Cir. Nov. 13, 2006) recently concluded that the HIPAA Privacy Rule does not include what the courts call “a private right of action.” In other words, individuals involved in violations of the HIPAA Privacy Rule cannot sue providers themselves. Only the U.S. Department of Health and Human Services may bring legal action to enforce the HIPAA Privacy Rule.

In this case, Ms. Margaret Acara filed suit against Dr. Bradley Banks. Ms. Acara claimed that Dr. Banks disclosed medical information about her during a deposition without her consent. The sole basis for her claim was the HIPAA Privacy Rule.

In considering her lawsuit, the Court first stated that whether or not HIPAA allows individuals to sue providers themselves is a question of interpretation of HIPAA that generally provides for confidentiality of medical records. The Court went on to say that private rights of action to enforce federal law must be created by Congress. The Court also noted that the HIPAA Privacy Rule does not include any express provisions that create a right for individuals themselves. The Court considered whether the HIPAA Privacy Rule implies any right for individuals to sue for themselves.

The Court decided that HIPAA does not contain any express language conferring rights upon individuals. Instead, HIPAA focuses on persons who have access to protected health information and who conduct certain electronic health care transactions.

Because HIPAA specifically delegates enforcement to the U.S. Department of Health and Human Services, said the Court, there is a strong indication that Congress intended to preclude private enforcement.

The Court then acknowledged that no other federal appellate court has specifically addressed this issue. Every federal district or lower court that has considered the same question, however, has concluded that the statute does not allow individuals to sue under it. The Court noted that Acara provided no authority to support her assertion that a private right of action exists under HIPAA. The Court thought Acara’s policy arguments were unpersuasive. Consequently, the Court concluded that:

“We hold there is no private right of action under HIPAA…”

This appellate court decision is important for providers because it supports the decisions of several lower courts that reached the same conclusion. Although the U.S. Supreme Court has not ruled on this issue, it appears unlikely that it will do so in view of the agreement among lower courts that individuals cannot sue under the HIPAA Privacy Rule.

The practical result is that providers need not worry about lawsuits from patients related to violations of the HIPAA Privacy Rule. At this point, the only action that courts will allow is enforcement action by the Office of Civil Rights of the U.S. Department of Health and Human Services. This result is certainly a welcome relief to providers who will not have to expend precious time, money and resources to defend against multiple lawsuits from patients. Although providers are “off the hook” to patients, compliance is essential to satisfy legal and ethical obligations and to avoid enforcement action.

Top - Back to Article Archive