A New Mexico HIPAA violation lawsuit filed by the victim of a sexual assault whose identity was improperly disclosed has been referred to the Supreme Court to assess whether the claim has standing.
The lawsuit was filed by the plaintiff ‘G.R.’ who suffered a sexual assault and sought treatment for her injuries at Gallup Indian Medical Center (GIMC) where she was employed. G.R. alleges that following treatment, details of the assault and her injuries were disclosed to her co-workers.
The sharing of that information resulted in the patient being humiliated and suffering further trauma. The patient had spent one month off work due to the assuault, and a further two months off work as a result of the disclosure. G.R felt there was no alternative but to leave her job as a direct result to avoid further humiliation.
If the disclosure occurred, this would be a violation of the HIPAA Privacy Rule; however, there is no private cause of action in HIPAA Rules. Patients are therefore unable to take legal action against their healthcare organizations for negligence per se based on alleged unauthorized disclosures of protected health information.
The defendant sought to have some of the claims dismissed, although a New Mexico District Court failed to dismiss the HIPAA violation claim.
The plaintiff argued that HIPAA violations occurred and employees acted unreasonably by sharing PHI publicly, and were negligent.
The court ruled that “the violation of HIPAA establishes that Defendant’s employees acted unreasonably in sharing protected health information with the public. Thus the HIPAA provides one element of a Common Law claim for negligence.”
The District Court said in a memorandum that “The question of whether HIPAA regulations may be used as a legislatively imposed standard of care for purposes of establishing negligence per se in New Mexico is a potentially complex question of law.”
Lawsuits have been filed in other states for negligence based on alleged HIPAA violations, although those lawsuits have not been allowed to proceed; however, there is a lack of precedents in New Mexico.
“This Court is uncertain whether the New Mexico Supreme Court would unconditionally bar a claim for negligence per se based on enactments that lack private rights of action; there are no reported New Mexico decisions to guide us.”
The case will now proceed to the New Mexico Supreme Court to rule on whether a claim for negligence per se based on a violation of HIPAA – for which there is no private cause of action – should proceed.