The Vermont Supreme Court has ruled that patients can file lawsuits against hospitals and employees for privacy breaches, according to the HIPAA Journal.
The ruling stemmed from a lawsuit that a patient filed against a hospital and employee alleging the hospital violated her privacy by releasing her information to law enforcement. The patient was being treated in the emergency room when the nurse notified police of the patient's blood alcohol level.
A HIPAA rule limits the use and disclosure of protected health information to treatment, payment and healthcare operations. There are exceptions, such as when the disclosure is made when a patient is in serious threat to health or safety.
When a patient's health or safety is at serious threat, a nurse or provider may disclose patient information to a person who could lesson or prevent the treat.
While the decision to allow patients to sue a hospital is common, it is atypical in Vermont where the state and HIPAA laws do not include a private cause of action, according to the HIPAA Journal. Under HIPAA, patients do not have the right to sue their providers; however, the case to sue the hospital had standing under a common-law private right of action for damages.