## Facts

- Vicki Sheldon alleged that her former spouse, Duane Sheldon, a Kettering Health Network (KHN) employee, accessed her electronic medical records without authorization.
- She alleged Duane and others used fictitious names to access protected health information and shared her information with a subordinate employee.
- She claimed KHN failed to implement and follow safeguards for electronic protected health information, including periodic audit reports to detect improper access.
- Sheldon sued KHN and Duane asserting state-law tort claims, including negligence, invasion of privacy, and negligence per se, largely premised on alleged HIPAA privacy and security violations.
- KHN moved to dismiss, arguing the claims were an impermissible attempt to privately enforce HIPAA, which provides no private right of action.

## Issues

1. Whether alleged HIPAA violations can serve as the statutory or regulatory predicate for an Ohio negligence per se claim against a health care entity.
2. Whether permitting a HIPAA-based negligence per se theory would improperly create an indirect private enforcement mechanism for HIPAA.

## Decision

- The Court of Appeals affirmed the trial court’s dismissal of Sheldon’s HIPAA-based negligence per se claim.
- The court held HIPAA does not create a private right of action and cannot be used to establish negligence per se under Ohio law.
- The court distinguished between using HIPAA as the basis for liability (not permitted) and referencing HIPAA as evidence relevant to the standard of care in a traditional negligence claim (potentially permitted).

## Legal Principles

- HIPAA’s enforcement scheme is governmental and administrative; it does not authorize private civil actions.
- Under Ohio law, negligence per se uses a legislative enactment to define duty and breach only when the enactment is of a kind intended to support civil liability; courts will not use negligence per se to create a private remedy Congress withheld.
- A plaintiff may not plead negligence per se by treating HIPAA duties as the legally enforceable standard of conduct, even if HIPAA requirements are framed as specific operational safeguards.
- HIPAA-related standards may, where otherwise relevant, be considered as evidence informing the standard of care in an ordinary negligence claim, without converting HIPAA into the source of the cause of action.

## Conclusion

The court held that HIPAA cannot be used as the statutory predicate for negligence per se in Ohio because HIPAA provides no private right of action and assigns enforcement to public authorities, though HIPAA requirements may be referenced as evidence in proving the standard of care for a state-law negligence claim.


Sheldon v. Kettering Health Network, 40 N.E.3d 661 (Ohio Ct. App. 2015)