California has long been considered a bastion of consumer protection and individual privacy rights. By its recently issued decision in Brown v. Mortensen, (2011) 51 Cal. 4th 1052 the California Supreme Court buttressed that reputation by holding that state law remedies potentially available under California's Confidentiality of Medical Information Act, Cal. Civ. Code §56 (Confidentiality Act), are not preempted by federal law, specifically, the Fair Credit Reporting Act, 15 U.S.C. §1681 (FCRA). (A copy of the decision can be accessed here.)

California's Confidentiality Act generally prohibits unauthorized dissemination of individually identifiable medical information (PHI), and provides for compensatory damages, punitive damages and attorneys' fees. The federal Health Insurance Portability and Accountability Act, 42 U.S.C. §1320d (HIPAA), contains a privacy rule that prohibits, among other things, unauthorized dissemination of PHI, and imposes civil and criminal penalties for violations. The Health Information Technology for Economic and Clinical Health Act, which was passed as part of the American Recovery and Reinvestment Act of 2009, greatly increased the statutory penalties that Department of Health and Human Services' Office of Civil Rights could impose as a result of privacy rule violations. Unlike the Confidentiality Act, HIPAA does not provide a private right of action or provide a mechanism for individuals to recover compensatory damages.

The facts of the Brown case are straightforward. Brown and his two children were patients of a dentist. A billing dispute arose and the matter was referred to a collection agency, which repeatedly disclosed Brown's and his children's dental records to various reporting agencies allegedly for the purpose of verifying that a debt was owed (despite the fact that no one contended Brown owed money for dentistry on the children and Brown never authorized the disclosure of this information to any third parties). Brown sued seeking compensatory damages under the Confidentiality Act.

Please see full article below for more information.