HIPAA does not create private right of action

Where an inmate’s doctor disclosed his HIV status to others within earshot of their conversation, the man does not have a private right of action based on the Health Insurance Portability and Accountability Act of 1996, or HIPAA, the 4th U.S. Circuit Court of Appeals has ruled in an issue of first impression.

The Fourth Circuit joined other circuits in finding that HIPAA did not include a vehicle for patients to sue for an alleged violation. The statute leaves enforcement of HIPAA to the government.

The case is Payne v. Taslimi (VLW No. 021-2-186). Judge Julius N. Richardson wrote the opinion for the unanimous panel.

Medication reminder

The plaintiff, Christopher Payne, was incarcerated at Deep Meadow Correctional Center in State Farm.

One day in 2018, Dr. Jahal Taslimi came by his bed in the medical unit and reminded him that he had not taken his HIV medications that day.

In his complaint, Payne stated that the medical unit is “an open dorm,” and that others –  including other prisoners and staff – could overhear the remark, which disclosed his HIV status.

He claimed that others in the room “stopped talking and looked” at him.

Taslimi apologized, Richardson wrote, “but Payne alleges that the damage was done: other prison staff and inmates learned that Payne was on HIV medication.”

Payne filed a series of grievances at the prison, all of which were denied.

He then sued in federal court, alleging a violation of his privacy and of HIPAA. After the district court dismissed his case for failure to state a claim, he appealed to the Fourth Circuit.

Right to privacy

But the judges of the Fourth Circuit likewise rejected his lawsuit.

Considering the privacy claim, Richardson noted that Taslimi disclosed Payne’s HIV status while Payne was a patient in a prison medical center.

He said a prisoner’s reasonable expectations of privacy are limited.

The judge observed that Payne was not claiming an expectation of privacy in the initial disclosure of his HIV diagnosis and medical records to prison officials.

Rather, he was challenging the “secondary disclosure from prison officials to prison guards and inmates in the medical ward,” the judge said.

But if he lacked an expectation of privacy in disclosure to the prison, he also had no expectation for any secondary disclosure. Richardson wrote, “Where an inmate lacks a reasonable expectation of privacy, he lacks it for all purposes.”

The fact that Payne had been diagnosed with a communicable disease, HIV, made a difference as well. “Disclosure of Payne’s diagnosis and medication information simply does not implicate the same Fourth Amendment concerns as forcing someone to, for example, undergo surgery or subject themselves to invasive medical procedures,” the court said.

The location and substance of the discussion are relevant for measuring Payne’s privacy rights: Payne was told that he had not taken his medicine within the prison medical unit, the most relevant place for such information to be shared and where it might be difficult to ensure others would not hear, Richardson said.

And the information dealt with his communicable disease and whether he was taking his medication, “which is especially relevant in a prison where disease can spread rapidly (as seen by the COVID-19 pandemic),” Richardson wrote.

HIPAA violation?

Payne also sued Taslimi for violating HIPAA.

HIPAA provides that “[a] person who knowingly . . . discloses individually identifiable health information to another person” without authorization shall be fined, imprisoned, or both, the judge said.

For Payne to recover under HIPAA, he said that he must allege the violation of a right, not just the violation of a law.

“[T]he statute must create a private right to sue that may be enforced under § 1983,” Richardson said.

Several other federal circuits – the Second, Fifth, Sixth, Seventh, Eighth, Ninth and 10^th circuits – have considered whether HIPAA created a private right to sue and every one of them has found that it does not.

HIPAA does not create a private cause of action “but delegates enforcement authority to the Secretary of the Department of Health and Human Services, reflecting Congress’s intent to forgo creating a private remedy,” the court concluded, affirming the dismissal of Payne’s lawsuit.