2019 Ohio 2114
Ohio Ct. App.2019Background
- Menorah Park sued Rolston in small claims to collect unpaid charges for rehabilitation/therapy and attached unredacted billing statements to its complaint showing medical-service descriptions, dates, procedure codes, and balances.
- Rolston answered and filed a class-action counterclaim asserting a common-law tort for breach of confidence (unauthorized disclosure of nonpublic medical information under Biddle).
- Menorah Park moved to dismiss under Civ.R. 12(B)(6), arguing the disclosures were permitted by HIPAA for payment collection, that HIPAA allows no private right of action, and that it had released account information (not medical records).
- Rolston responded that her claim is a state common-law Biddle claim (not a HIPAA private cause of action), and alleged Menorah Park failed to satisfy HIPAA’s "minimum necessary" requirement when it attached unredacted statements.
- The trial court granted dismissal; on appeal the Eighth District reviewed de novo and considered whether a Biddle claim is preempted by HIPAA and whether Rolston’s pleading states a viable Biddle claim.
Issues
| Issue | Plaintiff's Argument (Menorah Park) | Defendant's Argument (Rolston) | Held |
|---|---|---|---|
| Whether Rolston’s Biddle common-law claim survives a Civ.R. 12(B)(6) motion | Disclosure was authorized by HIPAA for payment; HIPAA provides no private right and governs preemption | Rolston alleges an unauthorized, unprivileged disclosure and that Menorah Park failed to limit disclosures to the minimum necessary, so state tort applies | Court reversed dismissal; counterclaim survives 12(B)(6) (remand for further proceedings) |
| Whether HIPAA preempts an Ohio common-law Biddle tort | HIPAA governs and disclosure for payment is permitted, so Biddle claim is foreclosed or preempted | State common-law Biddle claim is not inconsistent with HIPAA and is not preempted where disclosure is not authorized by HIPAA | Court held Biddle claim is not preempted by HIPAA and may proceed if facts support unauthorized disclosure |
| Whether attaching unredacted billing statements can constitute an "unauthorized disclosure" | Attachment of billing/account information is permissible for collection and not a Biddle disclosure | Unredacted statements reveal nonpublic medical information beyond what is "minimum necessary" to collect a debt | Court found pleadings sufficiently alleged an unauthorized disclosure to withstand dismissal |
| Whether courts should treat HIPAA as creating the exclusive remedy for wrongful disclosures | HIPAA’s lack of private remedy means state claims are barred or irrelevant | Absence of a HIPAA private right does not preclude state common-law remedies; state law complements HIPAA | Court agreed state tort claims are viable and HIPAA does not preempt Biddle claims in this context |
Key Cases Cited
- Biddle v. Warren Gen. Hosp., 86 Ohio St.3d 395 (recognizes Ohio common-law tort for unauthorized, unprivileged disclosure of nonpublic medical information)
- Hageman v. Southwest Gen. Health Ctr., 119 Ohio St.3d 185 (discusses HIPAA’s protection of health information and relevant regulations)
- R.K. v. St. Mary’s Med. Ctr., Inc., 229 W.Va. 712 (holds state common-law wrongful-disclosure claims are not preempted by HIPAA)
- Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 314 Conn. 433 (HIPAA did not preempt state common-law claims for wrongful disclosure in response to subpoena)
- Mitchell v. Lawson Milk Co., 40 Ohio St.3d 190 (standard for evaluating Civ.R. 12(B)(6) motions)