This monthly column is written by Ellie F. Chapman of Morgan, Lewis & Bockius LLP in San Francisco. It is designed to provide RPP readers with a sampling of the types of patient privacy cases that courts are now hearing. It is not intended to be a comprehensive monthly survey of all patient privacy court actions. Contact Ellie at ellie.chapman@morganlewis.com.
◆ Federal court affirms no individual right of action under HIPAA. On June 15, Judge Rudolph Contreras held that the Health Insurance Portability and Accountability Act (HIPAA) does not provide a private cause of action for individuals in Lee-Thomas v. LabCorp, Case No. 18-cv-00591. In an action against LabCorp, plaintiff Hope Lee-Thomas alleged that during a visit to Providence Hospital in Washington, D.C., her patient privacy rights under HIPAA were violated because her protected health information (PHI) was in plain sight of other individuals when she was instructed to input her medical information into a computer intake station. The federal judge rejected the claim, stating that although HIPAA provides both civil and criminal penalties for improperly handled or disclosed PHI, the statutory language clearly restricts enforcement to actions by the Department of Health and Human Services (HHS) and states’ attorneys general: “Courts in this and other circuits that have considered the question have reached a consensus that the statutory language of HIPAA grants no private right of action.” In June 2017, Lee-Thomas received treatment from LabCorp during a visit to Providence Hospital, where she noticed the proximity of other patients to the intake station where she was inputting her medical information. She photographed the stations and notified a LabCorp employee. Shortly after the hospital visit, Lee-Thomas sent a letter to Providence Hospital and a complaint to HHS describing the alleged HIPAA violations. She later filed another complaint with the District of Columbia Office of Human Rights (OHR), claiming that LabCorp’s alleged HIPAA violations constituted a failure to make “proper public accommodations” for patients. HHS dismissed Lee-Thomas’s complaint for failure to state a claim, and OHR proposed that she bring the claim in the Superior Court of the District of Columbia, which she proceeded to do. LabCorp removed the case to the U.S. Court of Appeals for the District of Columbia Circuit and moved to dismiss for failure to state a claim on the grounds that HIPAA does not provide a private right of action. Judge Contreras agreed with LabCorp and granted the motion to dismiss, citing HIPAA’s lack of private right of action. In addition, Lee-Thomas failed to respond to LabCorp’s motion to dismiss, which further “necessitate[d] dismissal of her case.” In a footnote to his opinion, Judge Contreras noted that OHR’s suggestion that Lee-Thomas lodge a civil suit referred “solely to a claim pursuant to the D.C. Human Rights Act, which plaintiff does not raise here.” Although Judge Contreras’s opinion makes it clear that individuals cannot bring a case based exclusively on violations of HIPAA, claims related to privacy of health information may still be viable under state privacy laws.
