TORTS/FAMILY LAW: No private cause of action for inadvertant HIPAA disclosure in child custody litigation: YOUNG V. CARRAN (COA 10/24/2008)

Mom sought to maintain a private cause of action against Dad’s law firm for violation of HIPAA for the inadvertent disclosure of her medical and psychiatric records to Dad in child custody litigation. TC granted summary judgment. Mom appealed.

Mom signed release as to her medical records, but expressly did not agree to release of records to Dad. After Dad’s firm received the records, Dad ultimately chose to seek other counsel and picked up his file from the firm. He left the package, containing the unreviewed medical records, in his vehicle. Mom removed the package before he reviewed them. Mom subsequently filed suit against Dad’s former law firm, claiming violation of HIPAA amongst other claims. Dad’s former law firm moved for summary judgment. TC granted the motion, holding that HIPAA does not create a private cause of action for violations such as those alleged by Mom; and furthermore, that KRS 446.070 is limited in applicability to state statutes and does not apply to federal laws such as HIPAA or the laws of other states. Mom appealed. 

CA held that HIPAA does not create a state-based private cause of action for violations of its provisions. KRS 446.070 provides an avenue by which a damaged party may sue for a violation of a statutory standard of care if the statute in question provides no inclusive civil remedy and if the party is within the class of persons the statute is intended to protect. However, Mom could not avail herself of this statute because it does not apply to any statutes but Kentucky state statutes. TC affirmed.