HIPAA – PRIVATE RIGHT OF ACTION

Acara v. Banks, No.06-30356 (5th Cir. Nov. 13, 2006)

A patient filed suit against her doctor for disclosing her medical information during a deposition without her consent. The patient's complaint claimed subject matter jurisdiction based on an alleged violation of the Health Insurance Portability and Accountability Act (HIPAA). The patient later sought to amend the complaint by changing her residency in order to establish diversity jurisdiction. The district court did not allow this amendment, and held that there was no private cause of action under HIPAA. Therefore, the district court granted the doctor's motion to dismiss.

The United States Court of Appeals of the Fifth Circuit affirmed the dismissal. The court held that HIPAA does not contain any express language conferring privacy rights on a specific class of individuals. Rather, it focuses on regulating persons who have access to private medical information. This strong indication that Congress meant to preclude private actions was not overcome by the patient's claim. Additionally, because the patient and doctor lacked diversity (both were residents of Louisiana), the federal courts lacked subject matter jurisdiction to hear the claim.