HIPAA and the standard of care

Many of you know that in addition to appeals, I also practice in health law. In the past, some clients have fretted about the the possibility of a "HIPAA suit" because of an accidental disclosure of a person's protected health information. I have always been able to reassure that that HIPPA contains no private right of action. A private right of action is not created just because a federal statute has been violated. The right typically must be created by the statute. Of course, I have also warned that what could happen is that a plaintiff uses HIPAA to set the standard of care when bringing a common law cause of action such as invasion of privacy.

Well, a recent North Carolina appeals court case appears to do just that. In Acosta v. Byrum, the Court clearly says that HIPAA may be used as evidence of the standard of care in a negligence action against a health care provider. Let this case serve as a reminder to all health care providers that although there is no private cause of action under HIPAA, the federal statute is very relevant for establishing the standard of care in other causes of action.