2024-CA-0022
Ky. Ct. App.Jan 31, 2025Background
- Wyatt Ledford, a transgender man and former employee/volunteer at UofL Health’s Peace Hospital, was admitted there as a psychiatric patient in October 2020 after a mental health crisis.
- During his inpatient stay, Ledford alleges Peace Hospital employees accessed and printed his protected health information (PHI) without a legitimate clinical purpose.
- Ledford resigned from his position, citing the unauthorized access to his medical records as a main reason for leaving.
- He filed suit under Kentucky common law for invasion of privacy and negligence against UofL Health, its agents, and supervisors.
- The trial court dismissed Ledford’s claims with prejudice, holding HIPAA preempted them based on a prior unpublished Kentucky appellate decision.
- Ledford appealed, arguing HIPAA does not preempt Kentucky common law claims regarding wrongful disclosure of confidential medical information.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Does HIPAA preempt state common law invasion of privacy? | HIPAA does not preempt state tort claims for invasion of privacy. | HIPAA preempts any tort based on disclosure of PHI. | Not preempted; such claims can exist alongside HIPAA. |
| Does HIPAA preempt a common law negligence claim? | Negligence claim is independent and not contrary to HIPAA. | All negligence based on PHI access is preempted. | Not preempted; claim is not barred by HIPAA. |
| Is a private right of action under state law allowed if HIPAA lacks one? | State law can provide remedies not found in HIPAA. | No private action intended – government enforcement only | State law can provide remedies; HIPAA does not bar them. |
| Did the trial court err by dismissing on preemption grounds? | HIPAA does not categorically bar such claims; should proceed to discovery | Dismissal correct, as claims are preempted by HIPAA. | Reversed; claims remanded for further proceedings. |
Key Cases Cited
- Archer v. Citizens Fidelity Bank & Tr. Co., 365 S.W.2d 727 (Ky. 1962) (clarifies how judgment on the pleadings operates)
- Brents v. Morgan, 299 S.W. 967 (Ky. 1927) (established Kentucky’s right to privacy tort)
- McCall v. Courier-Journal and Louisville Times Co., 623 S.W.2d 882 (Ky. 1981) (adopted invasion of privacy principles from Restatement)
- Pathways, Inc. v. Hammons, 113 S.W.3d 85 (Ky. 2003) (outlines elements of negligence in Kentucky law)
- Morgan v. Scott, 291 S.W.3d 622 (Ky. 2009) (universal duty of care in Kentucky negligence law)
- Joiner v. Tran & P Properties, LLC, 526 S.W.3d 94 (Ky. App. 2017) (standard of care in negligence)
- Young v. Carran, 289 S.W.3d 586 (Ky. App. 2008) (federal statutes not actionable under Kentucky’s negligence per se statute)
- T & M Jewelry, Inc. v. Hicks ex rel. Hicks, 189 S.W.3d 526 (Ky. 2006) (distinguishing use of statutes in negligence per se and common law negligence)