Summary
rejecting plaintiff's argument that KRS § 446.070 creates a state cause of action for HIPAA violations
Summary of this case from Short v. Marvin Keller Trucking, Inc.Opinion
No. 2008-CA-000082-MR.
October 24, 2008. Discretionary Review Denied by Supreme Court August 19, 2009.
Appeal from the Circuit Court, Kenton County, Martin J. Sheehan, J.
Eric C. Deters, Independence, KY, for appellant.
Donald L. Stepner, Jeffrey A. Stepner, Covington, KY, for appellees.
OPINION
The issue presented is whether Appellant may maintain a private cause of action against an opposing law firm for violation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for the inadvertent disclosure of her medical and psychiatric records to the opposing party in child custody litigation. The trial court granted summary judgment as to the HIPAA claim and all claims. This appeal followed.
The provisions of HIPAA pertinent to this case are codified at 42 U.S.C. §§ 1320d to 1320d-8.
This case arose out of a child custody dispute between Young and her child's father, John Martin. Martin was originally represented by Christopher J. Mehling, an attorney with Taliaferro, Shirooni, Carran Keys. During the litigation, Young and Martin signed an agreed order whereby Young was required to provide Mehling with authorizations sufficient to obtain her medical and psychiatric records. The order also provided that those records could be reviewed by Mehling but were not to be shown or provided to Martin. All records were to be returned to Young. Some time after acquiring the medical records from a facility named NorthKey, Mehling was elected judge of the Kenton Family Court and his representation of Martin was discontinued. Appellee Robert Carran gave notice of substitution of counsel on December 22, 2006.
Soon thereafter, Martin decided that he no longer wished to be represented by the Taliaferro firm, so he requested a partial refund of his retainer fee and his file. In April 2007, Martin went to Carran's office and picked up a package that contained his file and a refund check. Martin then got into his truck, opened the package, and looked inside long enough to find and remove his check. While doing so, he discovered a separate packet of material with "NorthKey" written on top, but did not read any of the documents contained therein. Martin then placed the entire package under the seat of his truck. About two weeks later, he looked for the package and found that it was missing. He later learned that Young had taken it from his truck, a fact Young admits.
On June 21, 2007, Carran received a letter from Eric C. Deters, Young's attorney, concerning the medical records and the fact that they had been given to Martin. The correspondence between Deters and Carran was acrimonious, and on July 31, 2007, Young filed suit against Carran and the Taliaferro firm. Young's complaint contained five separate claims for damages all arising from the disclosure of Young's medical records to Martin: (1) intentional infliction of emotional distress; (2) negligence; (3) violation of privacy rights; (4) violation of HIPAA; and (5) breach of contract. Young alleged that as a result of Appellees' actions she had suffered severe emotional distress, depression, anxiety, and other personal injuries.
On September 20, 2007, Appellees filed an answer to Young's complaint along with a motion for summary judgment as to all of her claims. On January 3, 2008, the trial court granted the motion for summary judgment. The court held that HIPAA does not create a private cause of action for violations such as those alleged by Young. With respect to Young's HIPAA claim, the court further held that KRS 446.070 is limited in applicability to state statutes and does not apply to federal laws such as HIPAA or the laws of other states.
On appeal, Young abandoned all of her trial court claims except the claim for damages based on an alleged HIPAA violation. Young argues that summary judgment was improper as to her claim that Appellees violated her rights under HIPAA by providing her medical records to Martin. This court has recently held that HIPAA does not create a state-based private cause of action for violations of its provisions. McMillen v. Kentucky Dept. of Corrections, 233 S.W.3d 203, 205 (Ky.App. 2007). We also note that federal courts have uniformly held that HIPAA does not create a private cause of action even at the federal level. See, e.g., Acara v. Banks, 470 F.3d 569, 571-72 (5th Cir. 2006); Doe v. Board of Trustees of University of Illinois, 429 F.Supp.2d 930, 944 (N.D.Ill. 2006); Dominic J. v. Wyoming Valley West High School, 362 F.Supp.2d 560, 573 (M.D.Pa. 2005); Logan v. Dept. of Veterans Affairs, 357 F.Supp.2d 149, 155 (D.D.C. 2004); University of Colorado Hosp. v. Denver Pub. Co., 340 F.Supp.2d 1142, 1145 (D.Colo. 2004).
Young attempts to circumvent this authority by arguing that KRS 446.070 creates a state cause of action for a violation of HIPAA. KRS 446.070 codifies the common-law doctrine of "negligence per se" in Kentucky. Davidson v. American Freightways, Inc., 25 S.W.3d 94, 99 (Ky. 2000). Negligence per se "is merely a negligence claim with a statutory standard of care substituted for the common law standard of care." Real Estate Marketing, Inc. v. Franz, 885 S.W.2d 921, 926-27 (Ky. 1994), quoting Atherton Condominium Apartment-Owners Association Board of Directors v. Blume Development Company, 115 Wash.2d 506, 799 P.2d 250 (1990). KRS 446.070 provides an avenue by which a damaged party may sue for a violation of a statutory standard of care if the statute in question provides no inclusive civil remedy and if the party is within the class of persons the statute is intended to protect. Hargis v. Baize, 168 S.W.3d 36, 40 (Ky. 2005). It provides that "[a] person injured by the violation of any statute may recover from the offender such damages as he sustained by reason of the violation, although a penalty or forfeiture is imposed for such violation." KRS 446.070.
Young's claim in this regard must fail because Kentucky courts have held that the "any statute" language in KRS 446.070 is limited to Kentucky statutes and does not extend to federal statutes and regulations or local ordinances. T M Jewelry, Inc. v. Hicks ex rel. Hicks, 189 S.W.3d 526, 530 (Ky. 2006); Alderman v. Bradley, 957 S.W.2d 264, 266-67 (Ky.App. 1997). The General Assembly did not intend it "to embrace the whole of federal laws and the laws of other states and thereby confer a private civil remedy for such a vast array of violations." T M Jewelry, Inc., 189 S.W.3d at 530. Therefore, the trial court's dismissal of Young's HIPAA claim via KRS 446.070 was proper.
Young next contends that 42 U.S.C. § 1320d-6 and its corresponding regulations impose a duty of care on Appellees allowing for a Kentucky "common law" negligence per se claim. Young's reliance upon T M Jewelry, Inc. v. Hicks ex rel. Hicks, supra, in support of her argument is misplaced. In that case, the Supreme Court of Kentucky used provisions of the federal Gun Control Act of 1968 to define a duty of care for purposes of a common law negligence action — not a KRS 446.070 negligence per se claim. See T M Jewelry, Inc., 189 S.W.3d at 532. Indeed, the Court expressly refused to apply the act in a negligence per se context. Id. at 530. Therefore, her claim must be rejected.
Young's remaining arguments relating to HIPAA preemption of KRS 210.235 and 422.317 were not presented in the trial court. For failure of preservation, we decline to consider the claims. Regional Jail Authority v. Tackett, 770 S.W.2d 225, 228 (Ky. 1989).
The judgment of the Kenton Circuit Court is affirmed.
ALL CONCUR.