Holli K. Archer

The plaintiff filed a lawsuit against the defendant hospital alleging, among other things, negligent mishandling of her medical records. Specifically, she alleged her blood test results were sent to a doctor she did not know and who was not authorized to receive her results. Further, she was unable to access her results until weeks after their unauthorized release. The plaintiff argued that the hospital has a common law duty to protect her health care information and to make that information available to her, and that the hospital’s failure to do so constituted ordinary negligence, which resulted in her suffering an array of injuries. She also asserted that safeguarding a patient’s medical records from exposure will enhance the privacy goal under HIPAA. 

The hospital argued that the plaintiff has no standing to bring a claim as to the unauthorized release of her medical information. The plaintiff argued that the hospital has a common law duty, or should impose one, to protect her medical information. She outright agreed with the hospital that there is no private right of action under HIPAA, but she further argued that the hospital failed to show how HIPAA preempts state common law to deny her of standing. The hospital responded that the plaintiff even admitted there is no common law duty to protect her medical information, and that the duty she was seeking is already enforced on the hospital by statute and regulation. After the plaintiff filed a surreply, stating similar arguments as in her initial response, the trial court ultimately granted the hospital’s motion and dismissed the plaintiff’s amended complaint. 

On Appeal, the Superior Court addressed whether the trial court erred in dismissing a negligence claim against the hospital for an unauthorized release of the plaintiff’s medical records because the duty allegedly owned to plaintiff was also a duty imposed by HIPAA, to which there is no private cause of action. As to the trial court’s reasoning, the court stated that the plaintiff was seeking to have the court enforce a common law duty on the hospital in connection with disclosure of her medical records, but the disclosure requirements the plaintiff “claims were violated are statutorily created by and covered under HIPAA,” for which plaintiff agrees no private cause of action exists. Therefore, the plaintiff was seeking to transform HIPAA’s disclosure requirements into a common law duty. To support a negligence claim, among other elements “[a] complaint must state a duty of care owed by the defendant to the plaintiff and allege facts that would demonstrate the defendant’s breach of that duty,” which the plaintiff fails to do in this case. The Superior Court stated that the plaintiff failed to point to any source of a duty of care owed to her, apart from HIPAA. The Superior Court also stated that the plaintiff failed to point to case law that establishes that a common law duty exists, and she failed to address the Althaus factors for determining if a court should impose a previously unrecognized duty of care. Without an actionable duty, no negligence claim can exist, and the the Superior Court agreed with the trial court ruling on this issue. 

Although a non-precedential decision, this case may still be referred to for its persuasive value, and it demonstrates that motions for judgment on the pleadings continue to be successful in dismissing claims where a plaintiff fails to prove that a recognized duty exists to state a claim of negligence. 
 

 

^{Case Law Alerts, 1st Quarter, January 2022 is prepared by Marshall Dennehey Warner Coleman & Goggin to provide information on recent developments of interest to our readers. This publication is not intended to provide legal advice for a specific situation or to create an attorney-client relationship. Copyright © 2022 Marshall Dennehey Warner Coleman & Goggin, all rights reserved. This article may not be reprinted without the express written permission of our firm.}