Both federal district courts in Missouri allow state common law claims based upon HIPAA violations.
In Kusgen v. Lake Regional Health System, No. 2:11-CV-4255-FJG (W.D.Mo. June 11, 2012) (Doc 20), Judge Gaitan of the Western District of Missouri dealt with defendant’s motion to dismiss plaintiff’s Missouri common law claim for wrongful termination for violation of public policy based upon HIPAA anti-retaliation regulation 160.316. Plaintiff alleged she was terminated for reporting unauthorized disclosure of confidential medical information, violating HIPAA’s anti-retaliation regulation–45 C.F.R. 160.316. Defendant argued HIPAA did not create a private cause of action for violations of the Act. Plaintiff countered that the claim was not a federal action made directly upon the HIPAA regulation itself, rather a Missouri common law claim for wrongful termination in violation of public policy.
Judge Gaitan acknowledged Missouri’s four exceptions to the at-will employment doctrine: (1) discharge due to a refusal to perform an illegal act; (2) discharge based on an employee’s act of reporting violations of law or public policy to superiors or public authorities; (3) discharge based on an employee’s participation in acts encouraged by public policy; (4) discharge because of an employee filed a workers’ compensation claim. The court then held plaintiff stated a claim under the second “whistleblowing” exception, denying defendant’s motion to dismiss that claim.
The Eastern District agrees with the Western District. The case of I.S. v. Washington University, No. 4:11CV235SNLJ (E.D.Mo. June 14, 2011), arose over unauthorized release of confidential medical information to plaintiff’s employer. Defendant remanded to federal court and moved to dismiss the count alleging a Missouri common law claim of negligence per se based on breach of confidentiality requirements imposed by HIPAA, contending that court was a thinly-disguised attempt to bring a private cause of action under the Act. Plaintiff, on the other hand, moved for remand to Missouri state court.
District Court Judge Limbaugh denied the motion to dismiss and remanded the case back to state court, despite exclusive reliance upon HIPAA in the negligence per se claim. Judge Limbaugh found that while there is no dispute that HIPAA does not create a private cause of action, HIPAA does not provide an exclusive federal remedy and does not preempt such a state common law action.
In his opinion, Judge Limbaugh cited with approval the Western District’s opinion in a similar case, K.V.S.V. v. Women’s Healthcare Network, 2007 WL 1655734 (W.D.Mo. June 6, 2007). Judge Limbaugh also relied upon the Supreme Court’s decision in Merrill Dow Pharmeceuticals v. Thompson, 478 U.S. 804 (1986), holding that a federal statute which does not provide a private cause of action may be a legitimate element of a state law claim.
Moreover, courts in other states hold likewise. In Rickman v. Premera Blue Cross, No. 91040-5 (Washington Sup. Ct. banc September 17, 2015), the court upheld plaintiff’s claim for a wrongful termination for violation of public policy based upon HIPAA’s anti-retaliation provision.
See too Byrne v. Avery Center for Obstretics and Gynecology, SC 18904 (Connecticut Sup. Ct. November 11, 2014) (citing TN, DEL, ME, MN, UT, and W.Va cases); McPadden v. Wal-Mart Stores East, L.P., No. 14-CV-475-SM (D.N.H. September 16, 2016) (upholding verdict for plaintiff on claims including state claims for HIPAA violations).
Courts in Indiana and New Jersey also allow state law claims based upon HIPAA violations:
INDIANA:
In Walgreen Co. v. Hinchy, No. 49A02-1311-CT-950 (Ind. Ct. App. January 15, 2015), the court of appeals upheld a $1.4 million jury verdict for professional negligence against a pharmacist and Walgreen’s as her employer for unauthorized disclosure of confidential medical information in violation of HIPAA.
NEW JERSEY:
New Jersey’s Appellate Division of the Superior Court affirmed the trial court’s denial of defendant’s motion to dismiss, granting plaintiff’s medical malpractice claim against a doctor for referring to plaintiff-patient’s HIV condition while a unknown third person was in the room, violating HIPAA’s prohibition against such unauthorized disclosure of Patient Health Information. Smith v. Datla, No. A-1339-16T3 (App. Div. July 12, 2017)
The Smith court cited with approval the 1991 case of Estate of Behringer v. The Medical Center at Princeton, 249 N.J. Super 597, 638, 641-42 (Law. Div. 1991), ruling the medical center committed medical malpractice under state law by failing to take reasonable measures as necessary to ensure confidentiality of a patient’s HIV positive test results.
As these courts have ruled, since HIPAA provides no private cause of action, it does not bar state common law claims for wrongful termination, negligence, medical malpractice, invasion of privacy, etc.
Kurt H. King, Missouri Attorney
81`6.781.6000
20 E. Franklin, Liberty, Clay County, Missouri 64068
Retaliation & Discrimination, Litigation, General Matters
The Law Office of Kurt H King 