Bonney v. Stephens Memorial Hospital, 17 A.3d 123

Bonneys injured at home; they were treated at Stephens Memorial Hospital in Norway, Maine.
A hospital security guard overheard their account of the assault and telephoned police, disclosing information.
Police used the disclosure to obtain a warrant; this led to a residence search and the Bonneys’ indictment for drug trafficking.
The Bonneys sued the Hospital and guard for state-law privacy/NDI claims and a federal HIPAA claim.
The Superior Court granted summary judgment for the Hospital on state-law immunity and dismissed the HIPAA claim.
The Supreme Judicial Court held HIPAA does not create a private right of action and that § 287(3) immunity does not apply here, vacating the state-law judgment and remanding.

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether § 287(3) grants immunity for the disclosure at issue	Bonneys argue immunity applies to reports aiding prosecution.	Hospital argues immunity covers reports to law enforcement when a victim is examined for prosecution.	Immunity does not apply; reporting during treatment not tied to a prosecutorial examination.
Whether HIPAA provides a private right of action	Bonneys seek damages under HIPAA for privacy violation.	HIPAA does not authorize private actions; enforcement is governmental.	No private right of action under HIPAA; dismissal affirmed.

Acara v. Banks, 470 F.3d 569 (5th Cir. 2006) (HIPAA private right of action is not implied; enforcement by Secretary)
Garrison City Broad., Inc. v. York Obstetrics & Gynecology, P.A., 985 A.2d 465 (Me. 2009) (statutory interpretation; de novo review of immunity)
Saunders v. Tisher, 902 A.2d 830 (Me. 2006) (standard for evaluating dismissal on pleadings)
Kurtz & Perry, P.A. v. Emerson, 8 A.3d 677 (Me. 2010) (summary judgment standard; record viewed in the light most favorable)
Beal v. Allstate Ins. Co., 989 A.2d 733 (Me. 2010) (de novo review of grant of summary judgment)