The United States District Court for the Eastern District of Pennsylvania issued a decision in the matter of Rigaud v. Garofalo, E.D. on May 2, 2005, finding that HIPAA did not create a seperate cause of action and the action did not support federal subject matter jurisdiction for the employment claim.
The discharged employee alleged that the employer improperly utilized PHI to make an employment decision in violation of HIPAA.
The court stated the following:
While the Third Circuit has not specifically addressed the issue whether there is an express or implied private right of action under HIPAA, several other federal courts have held that there is no such right. See O’Donnell v. Blue Cross Blue Shield of Wyoming, 173 F. Supp. 2d 1176, 1179-80 (D.C. Wyo. 2001); Brock v. Provident Am. Ins. Co., 144 F. Supp. 2d 652, 657 (N.D. Tex. 2001); Means v. Indep. Life and Accident Insurance Co., 963 F. Supp. 1131, 1135 (M.D. Ala. 1997); Wright v. Combined Insurance Company of Am., 959 F. Supp. 356, 362-63 (N.D. Miss. 1997). HIPAA’s Privacy Rule itself provides specific enforcement mechanisms for aggrieved parties. See 145 C.F.R. § 160.306 (stating an aggrieved party may complain to the Secretary and that the Secretary may investigate the complaints filed under the Section). The Privacy Rule also provides an administrative process by which the Secretary may investigate and impose civil monetary penalties for a failure to comply with the Privacy Rule. See 45 C.F.R. §§ 160.500 - 160.570. Based on HIPAA’s failure to provide for a private federal remedy and the absence of any legislative intent to create a private right of action, this Court concludes that it lacks subject matter jurisdiction over the instant matter.
Even if the Court construed HIPAA to create a private right of action, Plaintiff would be barred because she failed to exhaust her administrative remedies. HIPAA expressly provides defendants a right to notice and a hearing before an Administrative Law Judge, and the opportunity voluntarily to cooperate with the Secretary to resolve the matter through informal means. See 45 C.F.R. §§ 160.500 - 160.570. Moreover, the Privacy Rule under HIPAA provides an explicit exception for disclosures made in accordance with the laws relating to workers’ compensation. See 45 C.F.R. § 164.512(l) (permitting the disclosure of health information made for workers’ compensation purposes without an individual’s authorization).
Under Pennsylvania’s Worker’s Compensation Act, a healthcare provider who treats an injured employee is required to report to the employer the employee’s history, diagnosis, treatment, prognosis and physical findings. See 77 P.S. § 531. A provider has a continuing obligation to supplement its report as long as treatment continues. See id. Thus, even accepting Plaintiff’s
allegations that Dr. Heebner and/or Dr. Nicholson contacted her former employer regarding the
altered prescription as true, the doctors would not have violated HIPAA.
Additionally, HIPAA provides that a covered entity may use or disclose protected health information, provided that the individual is informed in advance of the use or disclosure and has
the opportunity to agree to or prohibit or restrict the use or disclosure of the information. See 45
C.F.R. § 164.510. At each visit, Plaintiff signed a consent form specifically authorizing the
release to Suburban Woods of all information relating to her treatment. See Defendants’ Motion
to Dismiss at Exhibit B. Accordingly, Plaintiff’s claim in Count I for a violation of HIPAA’s
Privacy Rule will be dismissed.
