Jackson v. Mercy Behavioral Health (Summary)

HIPAA – NO PRIVATE RIGHT OF ACTION

Jackson v. Mercy Behavioral Health, Civil No. 14-1000 (W.D. Pa. Jan. 28, 2015)

The U.S. District Court for the Western District of Pennsylvania granted a hospital’s motion to dismiss a patient’s claims that her civil rights were violated under HIPAA.

A patient was receiving treatment at a hospital and was placed into a 30-day residential diversion program. During that time, the patient’s medical records were sent to her dentist without her consent. A hospital employee then told the patient to sign an after-the-fact consent for the release of records, saying that failure to do so would result in early discharge from the residential program. The patient refused to sign the release, and was discharged from the program three days early. She then alleged that the hospital violated HIPAA and engaged in unlawful retaliation when she did not sign the after-the-fact consent.

The court dismissed the patient’s claims, finding that the court lacked subject matter jurisdiction over the action because HIPAA violations are within the jurisdiction of the Department of Health and Human Services and the Department of Justice’s Office of Civil Rights. Additionally, the court held that the patient did not have a claim upon which a relief could be granted, as HIPAA does not provide a private cause of action on individuals.