Health insurance act affords privacy, but not private actions.

Since 2001, when the Health Insurance Portability and Accountability Act (HIPAA) took effect, plaintiffs in many courts have attempted to claim violation of the act as a tort. HIPAA set standards for electronic health care transactions and includes measures to protect the security and privacy of patients' personal health data.

The Fifth Circuit recently became the first federal appeals court to rule on the question, holding that HIPAA provides no private cause of action. (Acara v. Banks, 2006 WL 3262444 (5th Cir. Nov. 13, 2006).) The court listed similar decisions by district courts in Alabama; California; Colorado; Louisiana; Mississippi; New York; Wyoming; and Washington, D.C.; and by the U.S. Court of Claims.

The plaintiff in the case, Margaret Acara, sued an insurance company, which deposed a doctor who had treated her. Acara alleged that the doctor had wrongfully disclosed her medical information during the deposition without getting her permission. She claimed subject matter jurisdiction based on the defendant's violation of HIPAA.

The court noted that Acara had "the relatively heavy burden to show Congress intended private enforcement and must overcome the presumption that Congress did not intend to create a private cause of action."

The court concluded that she had not met her burden. Noting that HIPAA has no express provision creating a private cause of action and that the act specifically delegates enforcement to the secretary of the U.S. Department of Health and Human Services (HHS), the court reasoned that "there is a strong indication that Congress intended to preclude private enforcement." In the absence of a private cause of action, it said, there is no federal subject matter jurisdiction for the claim.

"One's only remedy is administrative," said trial lawyer Jane Peak of Morgantown, West Virginia, who handles employment cases and has followed emerging HIPAA litigation. "Although complaints have been filed [with HHS], no health care provider had been fined as of June 2006. Unfortunately, the law, as enforced by this administration, has no teeth. Hopefully, we can get the upcoming Congress to address this."

Although HIPAA preempts more-stringent state laws relating to health information privacy, Peak noted that plaintiff attorneys may use its privacy requirements to bolster other state law claims.

"HIPAA regulations impose standards and requirements on covered entities that may well be used by private plaintiffs in the pursuit of causes of action brought under state law," said Peak, such as claims alleging negligent disclosure of information or negligent supervision and training.