HIPAA Violation? Sue Me

This is a true story that occurred recently in Indiana. Failing to collect payment for treatment, a medical group sent a patient to collections. In providing the unpaid bills to the collections attorney, practice staff failed to redact sensitive information. When the attorney filed the bills with the court as part of his collection action, the patient’s positive HIV status became public record.

The patient sued the practice and won. The jury awarded $1.25 million in damages.

As a case of wrongful disclosure this one seems pretty open-and-shut. But how exactly did the patient and his attorney proceed? Under which of the following did the patient bring action:

  • HIPAA privacy rule
  • HIPAA security rule
  • HITECH breach notification rule
  • Indiana Medical Malpractice Act

The patient sued the practice and won under the Indiana Medical Malpractice Act.

Why not HIPAA? Because he could not.

The case is a good reminder that although HIPAA sets a standard for an individual’s privacy rights it does not provide a private right of action, says Nicholas K. Lagina, an attorney with Krieg DeVault, based in Indiana.

When it comes to HIPAA violations, the patient is limited to filing complaints with appropriate governmental agencies, such as the Office for Civil Rights, he says. Other sources of law must form the basis of a lawsuit.

Common Law and the Theory of Negligence

Individuals facing what they believe to be a wrongful use or disclosure often fall back on traditional common law tort principles, according to Lagina.

“Typically claims are brought under some sort of claim of negligence, violation of privacy rights, or invasion of privacy,” he says. “You also see providers face allegations of negligent or intentional infliction of emotional distress, or even allegations of things such as defamation.”

Negligence is a tort concept available in every state, and it is broad enough to cover many types of actions.

In essence, negligence is the concept that someone had a duty to someone else, the duty was breached, and the breach resulted in an injury. “If you can show all those elements,” Lagina says, “you can fit all kinds of causes of actions underneath the theory of negligence.”

In some states, consumer protection laws and data breach laws also can provide a cause of action for privacy complaints such as wrongful disclosure.

Will Insurers Push Back?

The Indiana case is interesting for another reason, Lagina says. Cases like this may change professional liability insurance.

At the time of the interview, Lagina had not seen all of the case documents, but it appeared that the medical group’s insurance company would pay $250,000 of the $1.25 million award. This is the medical malpractice cap in Indiana for a case like this.

The remaining $1 million presumably would be paid by the Indiana Patient’s Compensation Fund.

“One of the things that will be interesting in the Indiana case as it progresses will be to see if the Indiana Patient’s Compensation Fund, which is the ultimate payer of excess damages, will try to argue that this is not malpractice,” Lagina says.

Lagina has no knowledge that it will, but generally he expects that if malpractice laws increasingly serve as the platform for rising privacy complaints, liability insurers will respond.

“I believe you’ll see in the future an interplay in the way courts are interpreting these kinds of allegations and what the insurance companies are doing in respect to insuring for those allegations,” he says.

“To the extent an insurer believes an act or a judgment is not covered under their policy, that is going to have some practical and pronounced effects on healthcare providers.”

Changes could come for individuals seeking damages, also. States considering malpractice reform have enacted or are considering multiple options: limiting damages, adding procedural requirements intended to discourage “frivolous” lawsuits, and shortening statutes of limitation.

A Share in the Damages

The HITECH modifications to HIPAA made no impact on an individual’s right of action. However, they do affect individuals in tangential ways.

HITECH grants state attorneys general the ability to bring civil action and seek damages on behalf of their residents for HIPAA violations.

A second provision provides individuals harmed by a wrongful disclosure under HIPAA a percentage of any recovery or settlement. The provision will be effective for any violation occurring after February 2009, but the Department of Health and Human Services has until 2012 to issue the regulation.

Once the regulation is in effect, Lagina foresees a spike in reported violations. The rule “has the potential to increase complaints, because individuals will have an actual monetary stake in the recovery,” he notes.

Editor’s note: An abbreviated version of this article appears in the March print issue.


  1. As a student of HIM these type of information enrich my knowledge, and makes me more eagle to take my classes very seriously, so thank you.

    Post a Reply
    • Interesting article and it shows the lack of interest and/or training of those involved in managing and protecting patient information. Unfortunately, this probably happens more than one thinks. I am glad to see more articles regarding this. The redacting could have saved time, money, reputations, and possible jobs.

      Post a Reply
    • I am involved in a workers compensation case in Florida. The judge in the case has issued a final order, in the order he explains in detail why he denied most of my case and goes into detail on my medical treatment and specific injuries, treating physicians etc etc.
      Additionally he slanders me by referring to me as a “Slick Litigant” he further states I am working the system and my answers were calculated. Which could not be further from the truth. Interestingly enough, I discovered that the Judges office disseminated all of this on there public web site.
      I requested in an email it be redacted and was told no, that because it’s a judges order it cannot be redacted, I also contacted HIPPA themselves and received a vague response (email) that HIPPA does not cover workers compensation period, with no further details provided. At this point I responded and requested further details, to date I have not received them.
      It is somewhat confusing that the judges office and HIPPA were posed basically the same questions and I received somewhat different responses. If it’s true that HIPPA at the federal level cannot cover a workers compensation case at the state level then perhaps this law/rule or at this point whatever seems to govern this bizarre reponse needs to be challenged in federal court.

      Post a Reply
  2. These articles are a great up-to-date resource to me for researching pertinent topics! Thanks.

    Post a Reply
  3. I had a similar incident (sent me to collections- got the paperwork with my meds listed on it) My doctor indicated the type of medication he prescribed and the dosage. This would be an example of a violation correct? Suggestions on next steps?

    Post a Reply
  4. I’m in school for HIT and this site is a great resource.

    Post a Reply
  5. i was discharged from work. i tried to apply with another company and my hippa laws were violated by the other company, thus i didn’t get hired because of that. what can i do?

    Post a Reply
  6. I am a registered nurse who went into a medical detox facility. I was very concerned about my privacy but was assured by the intake nurse that EVERYTHING was private!! It was a hospital inpatient facility. She advised me that they were on a separate system compared to the rest of the hospital and those records..reason for the visit was blocked by everyone unless u worked on that unit..Approx a month later I went to see my cardiologist and he stated he pulled up my hospital record and there it was a description of why I was inpatient at the hospital “opioid detox”. I was completely humiliated and felt my hippa rights were violated. since I work in the medical field this will severely affect everything that I have spent my life building. I wouldn’t have gone there if this would have been attached to my regular medical record. what recourse do I have? This is such a violation!!! I went to great length to protect my situation. pls help. I will face serious repercussions over this.

    Post a Reply
  7. In January 2012 I had STD tests done at the local hospital. The clerk who checked me in told my husband what tests I had done. He confronted me to ask the reason for the tests. This woman was previously his fiance, and he has now moved out and moved in with her. Do I have any recourse? I contacted the hospital administration anonymously (without the details that would give away who the clerk was), and they urged me to file a complaint, and I have not.

    Post a Reply
  8. My son’s pediatrician released information to cps about dates and tiimes of appoinments, and about missed checkups. do i have a case?

    Post a Reply
  9. I am a lawyer who represents persons whose HIPPA rights have been violated. Several people who have left comments here have a cause of action for a violation of their privacy. A doctor I know had surgery on his knee and another doctor felt he should not be seeing patients in the hospital while he was taking pain killers. He sought out the other doctors records and used them in an open meeting to try and have action taken against the other doctor. I find that the worst violators of HIPPA are medical professional’s who cannot resist the temptation to look up other medical health professionals. The show the least respect for each other it seems. I saw a similar case where a health professional looked up the aids history of a co worker who was being seen by another doctor for his condition. No reason, just curious when he saw him go to see the doctor who treats aids patients.

    Post a Reply
    • I actually have a question.i witnessed today and elderly woman who was brought in by ambulance have her clothes taken off right out in the open of the ER 10 feet away from me.they only held up a sheet.then they put a gown on her.am I wrong to believe they should have done this in a more private way such as an examination room or behind some kid of curtain.i felt so bad she was not even aware of this.if it was me and I found out they did this in this manor I would be greatly upset.

      Post a Reply
  10. My employer send a form to my health care provider requesting information about me without my consent and the health care provider returned the form fill and my employer sent them to me via e-mail and attach a letter to my supervisor all this without any consent from me. is this a violation of my rights?

    Post a Reply
  11. I was wondering what/who you would sue if I had a hippa violation of: A person at a facility that I was going to could not get a hold of me or my wife, so that person decided to call my place of work, she talked to the secretary and told her that I was going to kill myself and she was trying to find where I was at. The secretary then transferred the call to my Director and she told her the same thing (that I was going to kill myself). My director called my wife and asked if everything was okay because she got that call that I was going to kill myself. That made me take extra time off of work because of emotional distress and there were hippa investigaters that were pursuing the problem. My Dr. told me (where the hippa violator works) that if I wanted to sue, that I would most definatly win)
    There are a lot of other things that go along with this, but isn’t it wrong to call anybody besides my emergency contact, especially not calling my place of work (a hospital)
    Thank you

    Post a Reply
  12. My employer released information about me in front of a group of coworkers at a meeting I was not present for. Do I have a case?

    Post a Reply
  13. Can my employer be held responsible for one of their manager’s invading my privacy in front of an office meeting.

    Post a Reply
  14. I went to treatment for alcohol abuse and I have been sober for nearly a year now. My husband and I just went through a divorce and he found my treatment assignments and step work in a binder I had hidden under my bed and presented them in court these same documents were part of my treatment plan and chart and even had the treatment facilities name on the top of some papers. Later these documents were mailed out anonymously to people on my witness list. These documents were used in court and only lawyers should have had copies to keep for safe keeping in their offices during this time. I have also been using a soberlink device that is HIPPA protected to prove my sobriety, these documents were printed out and a publicized to others, Is there any form of legal action I can take? The people I suspect both work at the hospital where I live and definitely know Hippa rules and regulations. Please Help!

    Post a Reply
  15. I was dismissed from the hospital after an overnight observation, two weeks after knee replacement surgery. The dismissal paper told me to a)come to physical therapy as usual two days later b)RECOMMENDED I not drive.

    A month later I received a letter from the Department of Transportation telling me to surrender my license indefinitely, because of an ‘unsatisfactory medical report’.

    I went to the driver’s license station & got a copy of the letter they’d received from the attending physician. It reported that I had a ‘CHRONIC’ leg condition’, my name and SS number. I’d also mentioned in the hospital that I had a headache from squinting at the TV, because I’d forgot my reading glasses, so I also had ‘chronic eye problems.’

    My physical therapist told me the stress had set back my therapy by at least 1 1/2 weeks at that time. I cannot attend my followup appointments with my surgeon, and cannot continue my rehabilitation due to loss of transportation. I was supposed to continue therapy on my own using the equipment at their facility for another month. If I drive anyway I am subject to prosecution for driving under suspension.

    I am extreme low-income & cannot get an answer from an attorney. Can you advise me?

    Post a Reply
  16. I have an open CPS case and during a family team meeting the guardian ad litem disclosed in front of the whole meeting that I was sexually abused as a kid. I don’t know if this is a hipaa violation or what it would be called? But I felt revictimized , and very upset that he said this in front of the child’s aunt who is definitely going to spread this around the small town I live in. Can I sue this guy?

    Post a Reply
  17. I recently visited the hospitals er and to make a long story short I was giving a giwn and was tokd to undress and I did. Well after I done so I looked up and it was a camera in the room and I was told it was not on. Well it was I was on the moniter at the nurses station and I have pictures of me being on this monitor. I feel like I have been very violated by every means and I need help please.

    Post a Reply
  18. My brother went to a local Walgreens pharmacy and asked for a print out of his prescriptions. Along with his list they also included mine my nephews my cousins and a sister inlaws list of prescriptions. I realize you cannot sue under current hipaa laws is there anything else to provide a cause of action, I live in Wisconsin.

    Post a Reply
  19. An employee, health unit coordinator, looked at my medical records,those were out her assigned unit. She looked at them 4 different times. What are my chances to win a HIPAA case against the clinic?

    Post a Reply
  20. If I cannot sue the clinic under HIPAA, is there any other way I can sue the clinic? I live in Minnesota. Can I sue the employee?

    Post a Reply
  21. Supervisor at work told co worker about my medical information that I did not want others to know and she told a delivery driver also………what I s possible in this case.


    Post a Reply
  22. And I work for the florida department of corrections in the pharmacy……my supervisor is a pharmacist…and we go through training every year about hippa.

    thanks again

    Post a Reply
  23. My sister and I have been seeing the same pt for years for different things recently my younger cousin started seeing her for some back pain 3x a week , I had no ideas of the visits until my cousins mom and I had lunch and she was telling me how the pt talked about my sister and I all the time about our injuries and how my sister got better faster than I because I am overweight , how in genral My sister is the good one I am the bad one ect, ect, my sister and I both want to take action aginst her can we sue her ?

    Post a Reply
  24. I need a lawyer in plano tx that will take my case I think this is the word on a contingency fee several dr as well as 2 hospital have violated my hippa rights.it has gone to far and I’m in desperate need of help.the have ruined me emotionally.spiritually and financially I never gave them permission to disclose my personal information to anyone they did also they discussed my medical issues with family.friends when I told them repeatedly they did not have my permision also spoke about my condition to anyone he wanted did not care about hippa or forget about medical ethics. I want him to pay for what he has done to me.I can,t get the medical care that I need because of what he has said and done.please someone help me my mama is Paulette my number is 469 728 4706 I would really appreciate your help asap

    Post a Reply
  25. I’m victim to the same kind of case. I have been battling with this case for one year now. My HIV status was made public by a hospital receptionist. She intentionally accessed my records in an effort to hurt me. She did not like the fact of me dating her son, who was HIV negative. I am always upfront with people I date, and he knew. She in return thought the world should know. This is just a jist of the situation. I went into a deep depression. My world came crashing down around me. I started to loose everything I worked so hard for one by one. I was a truck driver, making $800 a week. I moved me and my boyfriend into this beautiful 3 story townhouse. Everything was wonderful, and most of all I was extremely happy and proud. I eventually started on depression and anxiety medication. This effected my job. I could no longer drive while in this state of mind. I couldn’t take the meds while driving because they made me dizzy and tired. I lost my job! My boyfriend was getting brained washed by his mom and felt sorry for her because she had lost her job because of what she did to me. Then he left! That was my second income! After he left I got more and more behind on bills and rent. I eventually got evicted from our home and was forced to move in with my mom. Since then I have not been myself. I’m sad most days and life has begun to feel pointless. I worked so hard to get my CDLs (Commercial Driver license) to have it taking from me quicker that I got it. Currently my life is on hold, and have no desire to get out of bed and do anything with my life. My life was taking abruptly from me. I know this can’t be the end but my lawyer is expected this to carry on for at least another two years. So now I sit here in my bed, wondering what I do next.

    I need advise and motivation.

    Post a Reply
  26. People! This is just the comments section after a magazine article! No one here can answer your questions! Please try your state or local legal aid office or on-line forum (if they have one.) Maybe try googling actionable HIPAA violations. Some of the above commenters may have a case , but, unfortunately, sometimes nasty gossip is just a fact of life. You can’t always make money on spiteful, mean people or even incompetent ones. It’s sad , but true. Unless you are Donald Trump, you can’t bring lawsuits against anyone you want
    to, no matter how much they may deserve it. To all those whose life was badly disrupted, what did folks do before HIPAA was established? Please…
    take a deep breath and try to forgive and forget. It may be your only option. I wish you all the good karma you surely deserve! God Bless, and try to get some rest.

    SANDERS…please try and get a second opinion from both a doctor and a lawyer. You may need other meds or none. If none, you can drive, If the lawyer says it will take another two years..you will need the money, cause he won’t wait on it. Your solutions seem to be sucking even more life from you. Good luck and hang in there!

    Post a Reply
  27. can I bring civil action and seek damages from Social Security for giving out my personal info to some other person who got me cut off disability due to me not getting mail from social security it put me in hardship back on social security now but still waiting on the checks to start back up under the HIPAA violations.

    Post a Reply
  28. @Deb October 30, 2015-“try to forgive and forget.” I don’t think so! Peoples medical privacy has been breached. Those very inept actions and release of medical information cause humiliation, embarrassment, a potential lose of a job or not getting hired for a job, plus mental anguish, to name just a few.

    They have every right to seek legal recourse for the damages they have endured at the hands of the people they trusted with their medical information.

    Post a Reply
  29. My question is this, my ex husband’s wife made my daughter her first gyno appt because she wanted to know if my daughter is having sex. When my daughter went to the appt my daughter filled out the paperwork and did not put her step mother on any of the paperwork. The step mother called the dr office requesting to know the outcome of the appt. They would not give her any information because she was not listed on the papers. She threw a huge fit and even told them she was her mother and has all right to know. Now the step mother works for an insurance company and knows all about the hipaa rules. I found out when I took my daughter in for a follow up appt that she was listed as my daughter’s mother. I corrected that right away. Do I have grounds to file hipaa violation against her for intruding on my daughter’s medical files?

    By the way my daughter’s is almost 18 and my ex and I have 50/50 custody. She does not have an custodial rights to my daughter.

    Post a Reply

Leave a Reply to tara Cancel reply

Your email address will not be published. Required fields are marked *

Share This

Share This

Share this post with your friends!