Private Cause of Action For Violation of HIPAA

By: Donna Russo, Esq.

In a new decision, Smith v. Arvind Datla, M.D. and Consultants in Kidney Diseases, P.A. N.J.      Super    (App. Div. 2017), the Appellate Division acknowledged a private cause of action for disclosure of medical information in violation of HIPAA.

This case involves the disclosure in front of third persons that the Plaintiff is HIV positive.  The case is not limited to disclosure of HIV.  The type of disclosure would be a factor in any claim for damages.

In this case, the Defendant Datla, an employee of Consultants in Kidney Disease, P.A. was  consulting with the Plaintiff who was in the hospital for acute kidney failure.  A third party was also in the room.  Defendant Datla disclosed plaintiff’s HIV positive status in the presence of this unauthorized third party.

Plaintiff filed suit alleging (1) invasion of privacy based on public disclosure of private facts; (2) medical malpractice based on improper disclosure; and (3) violation of HIPAA.  The defense argued that all three claims were time-barred by a one year statute of limitations based on the defense analogy that the claims are placing plaintiff in a false light in the public eye and defamation.

The Appellate Division stated that New Jersey courts have not established a statute of limitations for public disclosure of private facts.  New Jersey courts recognize four types of invasion of privacy claims and the statute of limitations for three of these types of claims is settled law: (1) an invasion of privacy based on intrusion on seclusion is a two-year statute of limitations; (2) claims for invasion of privacy based on placing plaintiff in a false light is a one year statute of limitations; (3) claims for invasion of privacy based on a person’s name or likeness is six years.  The reason for this distinction is “whether plaintiff’s injuries for invasion of privacy is more like an ‘injury to person’ under N.J.S.A. 2A: 14-2(a), as to which a two-year statute of limitations applies, or like injuries for defamation under N.J.S.A. 2A: 14-3, as to which the one year statute applies.”  As to claims involving person’s name or likeness, the statute of limitations is six years because the claim is viewed as damage to a property right.

In deciding the statute of limitations for invasion of privacy based on the disclosure of private facts, the Appellate Division looked to the most analogous cause of action.  The Court found “..the tort of ‘invasion of privacy by unreasonable publication of private facts occurs when it is shown that ‘the matters revealed were actually private, that dissemination of such facts would be offensive to a reasonable person, and that there is no legitimate interest of the public in being apprised of the facts publicized.’”

The Appellate Division ruled that the disclosure of private facts align more closely with discrimination claims and intrusion on solitude or seclusion.  The Court ruled that the statute of limitations for disclosure of private facts is  two years.

The Supreme Court also permitted Plaintiff’s medical malpractice to continue.  The Court stated: “The breach of a physician’s duty to maintain the confidentiality of his patient’s medical records is a deviation from the standard of care, giving rise to a personal injury claim based upon negligence, not defamation or placing plaintiff in a false light.”  The statute of limitations for medical malpractice is two years.

The Supreme Court also reviewed a claim under statutory law which specifically addresses the disclosure of HIV information.  N.J.S.A. 26: 5C-7.  It is a violation to disclose identifying information about a person who has or is suspected of having AIDS or HIV.  The Act provided for a private right of action including an action for actual damages, equitable relief and attorney’s fees.  If the disclosure is wantonly reckless or intentionally malicious, punitive damages may be awarded.  The statute of limitations for violation of the Act is two years.