Svetlana (Lana) Ros, Chair of the Health Care Practice at Pashman Stein Walder Hayden, Quoted in a Relias Media Article Regarding Individual's Right to Sue for HIPAA Violation
Svetlana (Lana) Ros, chair of the Health Care practice at Pashman Stein Walder Hayden, was quoted in a Relias Media article, “Court Rules No Private Right of Action for HIPAA, But Questions Remain.” The article discusses the implications of a new ruling from the U.S. Court of Appeals for the 4th Circuit, Payne V. Taslimi (998 F.3d 648), which ruled the plaintiff could not sue as an individual for a HIPAA violation, but created uncertainty regarding a potential cause of action based on a violation of privacy under the 14th Amendment.
HIPAA does not expressly allow for a private cause of action, but rather the enforcement is handled by the Health and Human Services Office for Civil Rights (OCR), notes Svetlana (Lana) Ros, JD, partner with Pashman Stein Walder Hayden in Hackensack, NJ. Violating HIPAA comes with a hefty price tag, including a significant financial penalty to the government, and usually a requirement for a compliance program and its implementation.
Over the years, OCR has not deterred individuals from filing suit against physicians, hospitals, and other covered entities in hopes of receiving a financial payout, Ros says. The Payne case is the most recent example. In its Payne decision, the court did not address whether there was a HIPAA violation; regardless, such a violation occurrence does not automatically give the individual the right to sue, Ros explains.
“This is a positive decision for the healthcare community because it is another case that reaffirms that HIPAA does not create a private right to sue. However, the ruling on the issue of the 14th Amendment is very specific because the court only looked at the issue of privacy of a prisoner,” Ros says.
In Payne, the court ruled there was no violation of the 14th Amendment because the prisoner lacked a reasonable expectation of privacy in his HIV status while incarcerated in a prison medical center. However, regarding covered entities living in fear of lawsuits brought by individuals, Ros does not believe they are in the clear.
“While this is a good holding for covered entities — because the court reaffirmed the position that HIPAA does not provide a private cause of action — many states have their own privacy laws, which provide for private causes of action,” Ros explains. “Additionally, the finding of no expectation of privacy granted by the Constitution in this case was very limiting, as it applied to inmates. The majority of the population is not incarcerated and, thus, enjoy a much greater expectation of privacy.”
Most lawsuits brought for violation of an individual’s HIPAA privacy rights also include claims of either state and/or federal privacy rights, Ros notes. She anticipates that plaintiff’s counsel will try to argue a viable cause of action under the 14th Amendment where there has been a disclosure of protected health information and no compelling government interest.
“Thus, it is important for covered entities to ensure that they are vigilant in staying current with HIPAA and state privacy laws and ensuring compliance,” Ros says. “It is also a good idea to consider obtaining and maintaining liability insurance in case the covered entity is sued by an individual or investigated by a government agency for a potential claim of violating HIPAA.”
To view the full article, please click here.