A recent New Jersey case addressed a statute of limitations issue pertaining to claims arising from a physician’s disclosure of a patient’s HIV-positive status to a third party without his consent.

Plaintiff was a patient of the defendant physician, a board-certified nephrologist. He was being treated for acute kidney failure. During an emergency consultation in plaintiff’s private hospital room, defendant discussed his medical condition and disclosed plaintiff’s HIV-positive status in the presence of a third party without plaintiff’s consent.

Plaintiff’s original complaint included a claim that the defendant physician violated the Health Insurance Portability and Accountability Act (HIPPA). However, a private right of action cannot be maintained under HIPAA. A patient’s privacy rights, though, extend beyond HIPPA. Further, a physician’s violation of HIPAA may be used to support common-law tort claims.

Plaintiff’s amended complaint therefore asserted three causes of action: common law invasion of privacy based on harmful public disclosure of private facts, medical malpractice based on the improper disclosure, and violation of the AIDS Assistance Act.

The defendant hospital and defendant physician moved to dismiss plaintiff’s complaint, arguing the claims were barred by the one-year statute of limitations applicable to defamation claims. Defendants analogized the invasion of privacy claim to claims for placing plaintiff in a false light in the public eye and defamation. Defendants argued that all three claims were predicated on the public disclosure of private facts and should be subject to the one-year statute of limitations that applies in that context.

Plaintiff disputed defendants’ contention that the one-year statute of limitations applies because he did not claim defamation. Where plaintiff’s medical malpractice claim would generally be subject to a two year statute of limitations, plaintiff asserted that the two-year statute of limitations for personal injury claims should apply to all three counts of his complaint.

The court found that the two-year statute of limitations applies to plaintiff’s claims. Improper disclosure of plaintiff’s HIV-positive status to a third party without plaintiff’s prior informed consent constituted a violation of the AIDS Assistance Act, an invasion of privacy by public disclosure of private fact, and medical malpractice. The court found that the breach of a physician’s duty to maintain his patient’s confidentiality constituted a deviation from the standard of care, leading to a medical malpractice personal injury claim based on negligence. The court also found that plaintiff’s medical malpractice claim is analogous to the invasion of privacy claims. Because defendant’s conduct constituted a claim for “injury to the person,” the court found that all three claims are subject to the two year statute of limitations.