Although HIPAA does not create a private cause of action, a recent Indiana Superior Court jury verdict indicates that HIPAA could still play an important role in private causes of action in state court based on negligence and professional liability as it relates to confidentiality. On July 26, a jury in Marion County, Indiana awarded $1.44 million to a Walgreens customer based on allegations that the customer's pharmacist accessed, reviewed, and shared the customer's prescription history with others who then used the information to intimidate and harass the customer. At the heart of the case was a tangled love triangle in which the pharmacist's husband had previously been romantically involved with the customer, resulting in the birth of a child. When the pharmacist learned of the relationship, she allegedly accessed the customer's prescription information and shared it with her husband, who then used the information to intimidate the customer when she began demanding child support payments.
The customer filed suit against both the pharmacist and Walgreens in Indiana Superior Court, claiming that both parties had breached their statutory and common law duties of confidentiality and privacy. The complaint also included claims of negligence, invasion of privacy, and publication of private facts against the pharmacist and claims of negligent training, supervision, and retention against Walgreens for continuing to employ the pharmacist even after discovering the incident. The Court granted Walgreens' Motion for Summary Judgment on the negligent training claim
At trial, Plaintiff argued that even though HIPAA did not create a private cause of action, it still defined the standard of care for a pharmacist's duty of confidentiality and privacy to Plaintiff's health information. Thus, according to Plaintiff, because the pharmacist's actions violated HIPAA, the pharmacist had breached the standard of care and should therefore be held liable for the harm caused to Plaintiff. Additionally, because the pharmacist had acted within the scope of her employment, Plaintiff argued that Walgreens was also liable for the pharmacist's actions. After a four day trial, the jury agreed on both points, awarding $1.44 million in damages to Plaintiff. Walgreens intends to appeal the verdict.
This is not the first case in which HIPAA has been the centerpiece of a private cause of action, but it does appear to be the first case resulting in a substantial jury verdict against a provider using HIPAA as the basis for the standard of care. Whether and to what extent HIPAA can be used to establish the standard of care in a professional liability, negligence, or other breach of professional duty case will be dependent on state tort law, and the outcome of this case on appeal is unpredictable. Nonetheless, as HIPAA continues to receive attention from trial lawyers seeking to establish the standard of care in negligence and professional liability cases involving the improper disclosure of health information, health care providers must be aware that, depending on the law of the state in which they are licensed, their potential liability for HIPAA violations could extend beyond Civil Monetary Penalties.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.