Nobody knows better than hospitals how difficult, complicated and expensive it is to comply with the confidentiality requirements of HIPAA (for Health Insurance Portability & Accountability Act).  And hospitals and their lawyers are well aware of HIPAA’s provision preempting all contrary state laws.

But on Nov. 11 the Conn. Supreme Court will officially release a decision reminding us that patients may have breach-of-confidentiality claims against hospitals under state law, even if they have complied with HIPAA.  In other words, compliance with HIPAA is necessary, but it may not be sufficient, to protect a hospital from liability.

Here’s what happened.  Emily was a patient at Avery Center for Obstetrics & Gynecology.  When she broke up with Andro, she told the Center not to disclose her medical records to him.  But when the Center got a subpoena from Andro in a paternity suit, it complied and sent a copy of Emily’s records to the court.

Emily sued the Center for breach of confidentiality and emotional distress.  The trial court granted the Center’s motion to dismiss on the grounds that HIPAA preempts “any contrary provision of law.”  Emily appealed, and the Supreme Court reversed the trial court’s dismissal.  The Supreme Court ruled that while HIPAA preempts state law that is contrary to its provisions, it doesn’t preempt state law that is more stringent than those provisions or that imposes “liability over and above” the provisions.

Bottom line?  A hospital needs to understand state law, statutory and common alike, on confidentiality and make sure it complies with that state law in addition to understanding and complying with HIPAA.

The case is Byrne v. Avery Ctr. for Obs. & Gyn., 2014 BL 308749, Conn., No. SC 18904.