Connecticut Supreme Court Allows Negligence Cause of Action for Medical Records Disclosure

In a case that tested the limits of HIPAA preemption the Connecticut Supreme Court has found that the privacy law does not preempt causes of action under state law including negligence and intentional infliction of emotional harm. Importantly, the case does not establish a private cause of action under HIPAA, a principle that is well established in existing law. In Byrne v. Avery Center for Obstetrics & Gynecology, the Connecticut Supreme Court considered whether the defendant facility breached its duty of confidentiality in the course of complying with a subpoena. The plaintiff, who was a patient of the facility, had instructed it not to release her medical records to a man with whom she had a relationship. He later sued for paternity and the facility released medical records in response to a subpoena. The court concluded that if Connecticut law provided a remedy for breach of confidentiality in responding to a subpoena, then HIPAA does not preempt or disallow the case from going forward on  negligence or negligent infliction of emotional harm.

This case underscores the importance identifying material in a patient’s record that has been limited from disclosure and a careful review of the subpoena and patient’s authorization before releasing documents. Legal review may be necessary where the patient has placed limitations on the release of records.