## Facts

- Emily Byrne received obstetrical and gynecological care from Avery Center for Obstetrics and Gynecology, P.C., which maintained her medical records.
- The practice provided a privacy policy indicating it would not disclose protected health information without authorization.
- After a personal relationship ended, Byrne instructed the practice not to release her medical records to the former partner.
- The former partner later filed a paternity action and served the practice with a subpoena duces tecum for Byrne’s medical records.
- Byrne alleged the practice mailed the records to the court without notifying her, obtaining authorization, objecting, or moving to quash.
- Byrne alleged the former partner obtained and used the records to harass and threaten her, causing emotional distress.

## Issues

1. Whether HIPAA, despite lacking a private right of action, preempts Connecticut common-law claims (negligence and negligent infliction of emotional distress) based on an alleged improper disclosure of medical records made while responding to a subpoena.
2. Whether HIPAA’s implementing regulations may be used to inform the standard of care in state-law negligence-based claims without converting them into an impermissible private HIPAA enforcement action.
3. Whether the trial court properly dismissed the negligence and negligent infliction of emotional distress counts for lack of subject-matter jurisdiction.

## Decision

- The Connecticut Supreme Court reversed the trial court’s dismissal of the negligence and negligent infliction of emotional distress counts and remanded for further proceedings.
- The court held that HIPAA did not preempt state common-law claims seeking a remedy for a health care provider’s alleged breach of patient confidentiality in responding to a subpoena.
- The court held that HIPAA regulations may inform the applicable standard of care in appropriate state-law negligence cases.
- The court concluded the trial court erred by treating the claims as HIPAA-based and dismissing them for lack of subject-matter jurisdiction.

## Legal Principles

- HIPAA’s lack of a private right of action bars suits that directly attempt to enforce HIPAA, but it does not automatically bar state-law causes of action addressing similar conduct.
- HIPAA preempts only “contrary” state law; state tort remedies that align with HIPAA’s privacy aims and provide equal or greater protection are generally not “contrary.”
- State common-law negligence and emotional-distress claims for wrongful disclosure of medical information may proceed even when HIPAA regulations are relevant, so long as HIPAA is not the source of the cause of action.
- HIPAA’s implementing regulations may be considered as evidence of the standard of care in determining whether a health care provider acted reasonably when disclosing records in response to legal process.

## Conclusion

The court held that HIPAA did not preempt Connecticut negligence-based claims arising from an alleged unauthorized disclosure of patient records in response to a subpoena, and that HIPAA procedures may be used as evidence of the standard of care, making dismissal for lack of jurisdiction improper.


Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 314 Conn. 433, 102 A.3d 32 (2014)