The Connecticut Supreme Court held that the federal Health Insurance Portability and Accountability Act (HIPAA) does not bar individuals from bringing negligence and emotional distress claims under state common law for breach of confidentiality against medical providers who unlawfully exposed their protected health information (PHI).  In an opinion released this week, which will be officially released November 11th, the court recognized that HIPAA does not provide a private right of action for the disclosure of PHI. However, the court stated that the availability of a private right of action under state law does not “preclude, conflict with, or complicate health care providers’ compliance with HIPAA.”  The court went on to say that state law claims support HIPAA’s goals by providing a “disincentive to wrongfully disclose” PHI.

The court stated that to the extent that adherence to HIPAA has become common practice for health care providers, HIPAA may be used to inform the standard of care related to negligence claims.  Connecticut follows a series of other states in holding that plaintiffs may bring claims for unlawful disclosures of medical records under state common laws.