Court: Patients can't file federal privacy suits against doctors

The first federal appeals court decision to affirm that patients cannot sue under HIPAA offers some relief for physicians. But with patients still able to bring privacy claims in state court, the ruling does little to alleviate doctors' concerns about the possibility of lawsuits for confidentiality breaches.

The 5th U.S. Circuit Court of Appeals in November concluded that, because Congress delegated HIPAA enforcement to the Dept. of Health and Human Services, lawmakers did not intend to create a private right for individuals to sue for privacy violations.

The patient in the case at hand sued her doctor, alleging that he broke federal privacy law when he disclosed her medical information in a deposition without her consent.

"HIPAA has no express provision creating a private cause of action," the opinion states. "Instead, it focuses on regulating persons that have access to individually identifiable medical information and who conduct certain electronic health care transactions."

The ruling was the first by a federal appeals court. It upheld similar decisions by nine lower courts, judges said. They noted, however, that the patient was free to pursue her claim in state court.

"It's a good thing for physicians whenever they can be assured that the courts are going to interpret federal law consistently," said Lee A. Spangler, assistant general counsel to the Texas Medical Assn. Texas falls within the 5th Circuit's jurisdiction. But the ruling does not mean that doctors are in the clear, Spangler said.

"State laws have always been in place to protect patient privacy," he said. "Though they may vary in their protection, there's always a way for patients to recover for inappropriate disclosure."

While doctors might expect federal privacy rules to supersede state laws, many state laws are more stringent and override federal law, attorneys say.

Gregory D. Frost, a partner and HIPAA specialist at the Louisiana-based law firm Adams and Reese LLP, said the federal statute was designed to create a floor, not a ceiling, for patient privacy protections. "HIPAA becomes the standard against which we decide whether a physician has wrongfully disclosed information, but states are free to provide more rights and remedies," he said.

"HIPAA only preempts state law to the extent they are contrary, and in my experience, state laws will have additional requirements, so you end up complying with both," Frost added.

The appeals court noted that the federal government does enforce HIPAA by imposing civil and criminal fines for improper disclosures.

But Louisiana attorney Mary Grace Knapp, who represents the patient in the case, says that does nothing to compensate patients who have been hurt by a confidentiality breach.

"HIPAA has to provide a cause of action. Otherwise it doesn't have any teeth and doesn't afford the public the level of protection that we are led to believe [it does]," Knapp said. She is considering an appeal.

Physician deposition sparks the suit

The patient in the case, Margaret A. Acara, was injured in a car crash and sued the other driver's insurance company, Knapp explained. Acara saw a neurologist, who determined that her vertebral artery occlusion had been caused by the impact from the car wreck, she said.

But the defense attorneys took the deposition of Acara's cardiologist, Bradley C. Banks, MD, who did not treat her injury but said it had not been caused by the car crash, Knapp said. She said Dr. Banks testified about Acara's medical condition without reviewing her medical records and without getting her consent. Dr. Banks' attorneys did not return calls for comment.

Knapp said his actions forced Acara to settle with the insurance company because Louisiana laws provided little recourse. "The significance of the suit is, not only was it a HIPAA violation, but it was the first where damages are alleged to have occurred to the patient," Knapp said.

Even though the appeals court's ruling means doctors may not have to worry about lawsuits being generated by HIPAA privacy violations, they still should treat any disclosures with care, the TMA's Spangler said. "Their duties to confidentiality and patient privacy are the same as they were before."

The difficulty is whether state or federal law is stronger, and how to meet the tougher standards, doctors and lawyers say. Physicians may not know when they can release information if they are brought into a lawsuit.

HIPAA and state laws generally provide an exception to patient privilege when a physician is served with a subpoena, court order or other legal request for protected information, Frost explained.

Doctors can try to get patient authorization when faced with these requests, he said. But if they aren't sure what is being requested of them, they should seek legal counsel, Frost recommended.

Spangler agrees. "In the usual circumstance, it's generally not if [doctors] are going to release information, it's how and when," he said.

Because the interaction between state and federal privacy laws is confusing, Spangler said, "sometimes doctors need guidance as to the how and when."