There is no private cause of action to address an improper disclosure of medical information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the U.S. Court of Appeals for the Fourth Circuit has held for the first time. Payne v. Taslimi, No. 18-7030, 2021 U.S. App. LEXIS 15972 (4th Cir. May 27, 2021).

The Court further precluded a cause of action based on a “right of privacy” theory under the 14th Amendment, but only because the plaintiff — a prisoner with limited rights of privacy — was unable to show he had a reasonable expectation of privacy to his medical diagnoses.

Although this case unfolded in a prison setting, this ruling could have implications in the workforce and reminds employers to treat confidential medical information of its workers carefully.

The Fourth Circuit has jurisdiction over Maryland, North Carolina, South Carolina, Virginia, and West Virginia.

Background

Christopher Payne, an inmate at the Deep Meadow Correctional facility, was receiving care in the prison’s “open doom” medical unit. Payne alleges that a prison doctor walked up to his bed and said in a voice loud enough to be heard by nearby staff, other offenders, and civilians, that Payne had “not taken [his] HIV medications.”

Payne filed suit (on a pro se basis), claiming his medical records were confidential and the Deep Meadow Correctional Facility had violated his rights under HIPAA and the 14th Amendment when its physician announced his HIV medical diagnosis. The district court summarily dismissed Payne’s claims and Payne appealed. Apparently concerned with the issues that Payne was raising, the Fourth Circuit appointed counsel to assist Payne with his appeal.

Circuit Court Opinion

Despite the assistance of counsel, the Fourth Circuit affirmed the district court’s dismissal. As for Payne’s HIPAA claim, the Court confirmed there is no private cause of action under that statute. In so doing, the Fourth Circuit has joined a growing list of circuits (including the Second, Fifth, Seventh, Eighth, Ninth, and Tenth) that have similarly held that no such private cause of action exists.

Whether the disclosure of medical records violated Payne’s right of privacy, however, presented a more difficult issue. The Court noted that, although it has not been the “model of clarity” on this issue, the correct test to apply is whether there is a “reasonable expectation of privacy” in the information at issue and, if so, if there is a compelling government interest that outweighs that privacy interest. As a prisoner, Payne’s lacked a reasonable expectation of privacy in his medical diagnoses or treatment plan, especially where the information concerned a communicable disease, the Court said.

Implications for Employers

Private employers in the Fourth Circuit who may have been concerned about HIPAA exposure from individual litigants can take comfort in this decision. However, the case signals that, where there is reasonable expectation of privacy in information shared with a governmental employer, it is possible a cause of action might exist under the 14th Amendment if that information is disclosed without an accompanying compelling government interest.

Further, there is a number of other federal statutes that requires employers to treat their employee’s medical information in a confidential fashion, such as the Americans with Disabilities Act and Genetic Information Nondiscrimination Act. Employers would be wise to use discretion when handling the confidential information of their employees.

Summer intern Evan D. Holden contributed significantly to this article.