Reports of HIPAA fines from the OCR are all over the news, but the reason we never hear about lawsuits from patients is because even if they do file a suit, a judge will dismiss the case.
On June 15, a U.S. district court judge in Washington, D.C. dismissed the case brought by Hope Lee-Thomas. Lee-Thomas alleged that Laboratory Corporation of America (LapCorp) violated HIPAA regulations in June 2017. The supposed breach occurred when the patient was instructed to submit medical information at a computer intake station. This station was in a public area where other people might be able to see the information she submitted. This might be considered an incidental disclosure, depending on how a judge might view the situation.
In July 2017, Lee-Thomas submitted a letter to Providence Hospital arguing the incident at the computer intake station constituted a possible HIPAA privacy violation. She also filed a complaint with the Office for Civil Rights (OCR). The OCR responded to her complaint in November 2017 that they would not investigate the situation.
The June 15 ruling stated that the alleged violation “is the only cause of action” included in the case, and that given “the clear consensus among courts that have addressed the question, no private action exists under HIPAA, and accordingly, Ms. Lee-Thomas has failed to state a claim upon which relief can be granted.”
Essentially, only the OCR and State Attorneys General may file lawsuits against health care organizations for alleged HIPAA violations. However, there are many state breach laws that allow patients to file suits for damages, but that requires the patient to provide proof that damages have occurred or are very likely to occur.
To learn what you can do to avoid HIPAA fines and possible attorney general lawsuits, sign up for HIPAAgps today.
Recent Comments