Young v. Carran
289 S.W.3d 586
Ky. Ct. App.
2008
Check Treatment

OPINION

LAMBERT, Senior Judge.

The issue presented is whether Appellant may maintain a private cause of action against an opposing law firm for viоlation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) 2 for the inadvertent disclosure of her medical and psychiаtric records to the opposing party in child custody litigation. The trial court granted summary judgment as to the HIPAA claim and all claims. This аppeal followed.

This case arose out of a child custody dispute between Young and her child's father, John Martin. Martin was оriginally represented by Christopher J. Mehling, an attorney with Taliaferro, Shirooni, Carran & Keys. During the litigation, Young and Martin signed an agreed оrder whereby Young was required to provide Mehling with authorizations sufficient to obtain her medical and psychiatric records. The order also provided that those records could be reviewed by Mehling but were not to be shown or provided to Martin. All records were to be returned to Young. Some time *588 after acquiring the medical records from a facility named NorthKey, Mehling was elected judge of the Kenton Family Court and his ‍​‌‌‌‌‌​​​‌​‌‌‌​​​​‌‌​‌‌​​‌​​​​‌​‌‌‌‌​‌​​‌‌‌‌​‌​​‍representation of Martin was discontinued. Appellee Robert Carran gave notice оf substitution of counsel on December 22, 2006.

Soon thereafter, Martin decided that he no longer wished to be represented by the Taliaferro firm, so he requested a partial refund of his retainer fee and his file. In April 2007, Martin went to Carran's office and picked uр a package that contained his file and a refund check. Martin then got into his truck, opened the package, and lоoked inside long enough to find and remove his check. While doing so, he discovered a separate packet of matеrial with "NorthKey" written on top, but did not read any of the documents contained therein. Martin then placed the entire package under the seat of his truck. About two weeks later, he looked for the package and found that it was missing. He later learned that Young had taken it from his truck, a fact Young admits.

On June 21, 2007, Carran received a letter from Eric C. Deters, Young's attorney, concerning the medical records and the fact that they had been given to Martin. The correspondence between Deters and Carran was acrimonious, and on July 31, 2007, Young filed suit against Carran and the Taliaferro firm. Young's complaint contained five separate clаims for damages all arising from the disclosure of Young's medical records to Martin: (1) intentional infliction of emotional distress; (2) negligenсe; (8) violation of privacy rights; (4) violation of HIPAA; and (5) breach of contract. Young alleged that as a result of Appellees actions she had suffered severe emotional distress, depression, anxiety, and other personal injuries.

On September 20, 2007, Apрellees filed an answer to Young's complaint along with a motion for summary judgment as to all of her claims. On January 3, 2008, the trial court grаnted the motion for summary judgment. The court held that HI-PAA does not create a private cause of action for violations such as those alleged by Young. With respect to Young's HI-PAA claim, the court further held that KRS 446.070 is limited in applicability to state statutes and does not apply to federal laws such as HIPAA or the laws of other states.

On appeal, Young abandoned all of her trial cоurt claims except the claim for damages based on an alleged HIPAA violation. Young argues that summary judgment was improper as to her claim that Appellees violated her rights under HIPAA by providing her medical records to Martin. This court has recently held that HIPAA does not create a state-based private cause of action for violations of its provisions. McMillen v. Kentucky Dept. of Corrections, 233 S.W.3d 203, 205 (Ky.App.2007). We also note that federal courts have uniformly held that HIPAA does not ‍​‌‌‌‌‌​​​‌​‌‌‌​​​​‌‌​‌‌​​‌​​​​‌​‌‌‌‌​‌​​‌‌‌‌​‌​​‍create a private cause of action even at the federal level. See, e.g., Acara v. Banks, 470 F.3d 569, 571-72 (5th Cir.2006); Doe v. Board of Trustees of University of Illinois, 429 F.Supp.2d 930, 944 (N.D.Ill.2006); Dominiс J. v. Wyoming Valley West High School, 362 F.Supp.2d 560, 573 (M.D.Pa.2005); Logan v. Dept. of Veterans Affairs, 357 F.Supp.2d 149, 155 (D.D.C.2004); University of Colorado Hosp. v. Denver Pub. Co., 340 F.Supp.2d 1142, 1145 (D.Colo.2004).

Young attempts to cireumvent this authority by arguing that KRS 446.070 creates a state cause of action for a violation of HIPAA. KRS 446.070 codifies the common-law doctrine of "negligence per se" in Kеntucky. Davidson v. American Freightways, Inc., 25 S.W.3d 94, 99 (Ky.2000). Negligence per se "is merely a *589 negligence claim with a statutory standard of care substituted for the ‍​‌‌‌‌‌​​​‌​‌‌‌​​​​‌‌​‌‌​​‌​​​​‌​‌‌‌‌​‌​​‌‌‌‌​‌​​‍common law standard of сare." Real Estate Marketing, Inc. v. Franz, 885 S.W.2d 921, 926-27 (Ky.1994), quoting Atherton Condominium Apartment-Ouwners Association Board of Directors v. Blume Developmеnt Company, 115 Wash.2d 506, 799 P.2d 250 (1990). KRS 446.070 provides an avenue by which a damaged party may sue for a violation of a statutory standard of care if thе statute in question provides no inclusive civil remedy and if the party is within the class of persons the statute is intended to protect. Hargis v. Baize, 168 S.W.3d 36, 40 (Ky.2005). It provides that "[a] person injured by the violation of any statute may recover from the offender such damages as hе sustained by reason of the violation, although a penalty or forfeiture is imposed for such violation." KRS 446.070.

Young's claim in this regard must fail because Kentucky courts have held that the "any statute" language in KRS 446.070 is limited to Kentucky statutes and does not extend to federal statutes and regulations or local ordinances. T & M Jewelry, Inc. v. Hicks ex rel. Hicks, 189 S.W.3d 526, 530 (Ky.2006);, Alderman v. Bradley, 957 S.W.2d 264, 266-67 (Ky.App.1997). The General Assembly did not intend it "to embrace the whole of federal lаws and the ‍​‌‌‌‌‌​​​‌​‌‌‌​​​​‌‌​‌‌​​‌​​​​‌​‌‌‌‌​‌​​‌‌‌‌​‌​​‍laws of other states and thereby confer a private civil remedy for such a vast array of violations." T & M Jewelry, Inc., 189 S.W.3d at 580. Thereforе, the trial court's dismissal of Young's HIPAA claim via KRS 446.070 was proper.

Young next contends that 42 U.S.C. § 18320d-6 and its corresponding regulations impose a duty оf care on Appellees allowing for a Kentucky "common law" negligence per se claim. Young's reliance upоn T & M Jewelry, Inc. v. Hicks ex rel. Hicks, supra, in support of her argument is misplaced. In that case, the Supreme Court of Kentucky used provisions of the federal Gun Control Act of 1968 to define a duty of care for purposes of a common law negligence aсtion-not a KRS 446.070 negligence per se claim. See T & M Jewelry, Inc., 189 S.W.3d at 532. Indeed, the Court expressly refused to apply the act in a negligence per se context. Id. at 530. Therefore, her claim must be rejected.

Young's remaining arguments relating to HIPAA preemption of KRS 210.285 and 422.317 were not presented in the trial ‍​‌‌‌‌‌​​​‌​‌‌‌​​​​‌‌​‌‌​​‌​​​​‌​‌‌‌‌​‌​​‌‌‌‌​‌​​‍court. For failure of preservation, we decline to consider the claims. Regional Jail Authority v. Tackett, 770 S.W.2d 225, 228 (Ky.1989).

The judgment of the Kenton Cireuit Court is affirmed.

ALL CONCUR.

Notes

2

. The provisions of HIPAA pertinent to this case are codified at 42 U.S.C. §§ 1320d to 1320d-8.