Source: https://healthlawmonitor.jacksonkelly.com/2012/11/west-virginia-allows-suit-over-breach-of-medical-records-confidentiality.html
Timestamp: 2019-04-25 19:58:39+00:00

Document:
Hospitals and other health care providers are subject to suit for damages where medical records are released in violation of HIPAA regulations, the Supreme Court of Appeals held on November 15, 2012. In RK v. St. Mary’s Medical Center, (opinion here) the Court reversed the dismissal of a complaint alleging breach of medical record confidentiality and held the action (1) was not preempted by HIPAA, and (2) not subject to the limitations of the Medical Professional Liability Act. These findings have the potential for significant liability for health care providers where there is a breach of medical record confidentiality.
Claims for breach of medical record confidentiality had long been allowed in West Virginia under Morris v. Consolidation Coal Co., 191 W. Va. 426, 446 S.E.2d 648 (1994)(prohibiting ex parte contact with physicians) and Allen v. Smith, 368 SE 2d 924, 179 W. Va. 360 (1988)(allowing suit for violation of statute providing confidentiality to psychiatric records). Since these cases pre-dated the enactment of HIPAA, there was reason (and hope) to believe state law actions would be preempted.
[W]e conclude that state common-law claims for the wrongful disclosure of medical or personal health information are not inconsistent with HIPAA. Rather, … such state-law claims compliment HIPAA by enhancing the penalties for its violation and thereby encouraging HIPAA compliance. Accordingly, we now hold that common-law tort claims based upon the wrongful disclosure of medical or personal health information are not preempted by the Health Insurance Portability and Accountability Act of 1996.
The West Virginia Medical Professional Liability Act contains a general limitation on non-economic loss of $250,000, and generally requires expert testimony, with pre-suit requirement to provide an affidavit supporting the allegations of negligence. The MPLA was enacted because of the difficulty health care providers in West Virginia had in procuring insurance.
Examining the factual circumstances in which this Court has found the MPLA to apply, we agree with the circuit court that the allegations asserted in the instant case, which pertain to the improper disclosure of medical records, does not fall within the MPLA’s definition of “health care,” and, therefore, the MPLA does not apply. Accordingly, we affirm the circuit court’s order insofar as it refused St. Mary’s motion to dismiss for failure to comply with the pre-suit requirements of the MPLA.
West Virginia is not alone in allowing these actions, as shown by the decisions cited in the opinion. In Pennsylvania, Baum v. Keystone Mercy Health Plan, 826 F. Supp. 2d 718, 721 (E.D. Pa. 2011) allowed a state-law tort case over medical records release. The Ohio Supreme Court reached the same conclusion, finding “in Ohio, an independent tort exists for the unauthorized, unprivileged disclosure to a third party of non-public medical information that a physician or hospital has learned within a physician-patient relationship” Biddle v. Warren Gen. Hosp., 86 Ohio St. 3d 395, 401, 715 N.E.2d 518, 523 (1999). In Virginia, Fairfax Hosp By and Through INOVA Health Sys. Hosps., Inc. v. Curtis, 254 Va. 437, 442, 492 S.E.2d 642, 645 (1997).
This decision is not good news for West Virginia health care providers, who can be sued under West Virginia law with HIPAA used as evidence, and without the protection of the MPLA: Plaintiffs are not required to provide notice of claim and certificate of merit prior to bringing suit. Perhaps more important, since damages related to medical records release will almost invariably be non-economic, such as pain and suffering and mental distress, the lack of protection is significant, leaving open the spectre of unpredictable jury verdicts. In general, the decision echoes a trend in the court’s decisions narrowly interpreting the reach of the MPLA, thereby exposing health care providers to increase liability.
Since the cause of action is still based in negligence, health care providers should ensure they have HIPAA consistent policies in place to maintain confidentiality and to deal with inadvertent release of medical information. Those health care providers with insurance coverage should verify their policies extend coverage to suits for damages over medical record release.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v.