Byrne v. Avery Center for Obstetrics & Gynecology, P.C.
102 A.3d 32
Conn.2014Background
- Plaintiff Emily Byrne received gynecological care from defendant Avery Center; she instructed the center not to release her records to a former partner, Andro Mendoza.
- Mendoza subpoenaed Byrne’s medical records for a probate paternity proceeding; Avery Center mailed her records to the court without notifying Byrne, and Mendoza later viewed them in the court file.
- Byrne sued Avery Center alleging breach of contract, negligence (count 2), negligent misrepresentation, and negligent infliction of emotional distress (count 4); she invoked HIPAA regulations and Connecticut law as bases for negligence.
- The trial court dismissed counts 2 and 4, concluding HIPAA preempted these state-law negligence claims because HIPAA contains no private right of action and state claims that amount to HIPAA violations are "contrary" and therefore preempted.
- The Supreme Court of Connecticut assumed (without deciding) the existence of a state-law negligence remedy for breaches of patient confidentiality in subpoena contexts and held HIPAA does not preempt state common-law negligence or negligent-infliction claims; HIPAA regulations may inform the standard of care.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether HIPAA preempts state common-law negligence claims for wrongful disclosure of medical records in response to a subpoena | Byrne: HIPAA has no private right of action but may inform the standard of care; state common-law claims complement rather than conflict with HIPAA | Avery: Because HIPAA provides the enforcement scheme and no private remedy, state claims based on HIPAA are preempted and effectively attempt to create a private right | Court: HIPAA does not preempt state common-law negligence or negligent-infliction claims; HIPAA regulations can inform the standard of care |
| Whether HIPAA’s lack of a private right of action bars using HIPAA as evidence of duty/standard of care in state tort claims | Byrne: Federal omission of a private remedy does not automatically bar state tort causes that use federal standards as evidence of duty | Avery: Allowing state tort claims would circumvent Congress’s choice to limit enforcement to administrative/federal remedies | Court: State tort claims may proceed; using HIPAA as evidence of standard of care is permissible (subject to state-law rules on negligence per se and proof) |
| Whether Connecticut statute § 52-146o is preempted or provides a private right of action | Byrne: She uses § 52-146o as one basis among others for negligence standard; does not press an independent statutory cause | Avery: § 52-146o is less stringent than HIPAA and therefore preempted; also contends it provides no private right of action | Court: Declined to decide whether § 52-146o creates a private cause of action; treated plaintiff’s reference to § 52-146o as part of common-law negligence theory, not a standalone statutory claim |
| Whether defendant complied with HIPAA and state subpoena rules by mailing records to court without notice | Byrne: Defendant failed to satisfy HIPAA’s "satisfactory assurances" or provide notice/seek protective order | Avery: It followed attorney directions and its privacy policy; Probate Court’s handling of the file contributed to disclosure | Court: Record is undeveloped; court declines to decide compliance now and remands for further proceedings; notes pretrial/court procedures must be HIPAA-compliant |
Key Cases Cited
- Merrell Dow Pharmaceuticals, Inc. v. Thompson, 478 U.S. 804 (discusses consequences when Congress omits a private right of action)
- Mead v. Burns, 199 Conn. 651 (Connecticut precedent on using regulatory standards to inform common-law duties)
- Grable & Sons Metal Prods., Inc. v. Darue Eng’g & Mfg., 545 U.S. 308 (federal question jurisdiction and limits on removal based on federal issues embedded in state claims)
- Yath v. Fairview Clinics, N.P., 767 N.W.2d 34 (Minn. appellate decision holding state privacy statute not preempted and allowing HIPAA to inform standard of care)
- R.K. v. St. Mary’s Med. Ctr., Inc., 735 S.E.2d 715 (W. Va. decision holding state tort claims for improper disclosure not preempted by HIPAA)