A federal district court in Montana has confirmed that HIPAA precludes a private right of action for patients to claim an unauthorized access, use, or disclosure of protected health information. Nonetheless, the court denied the defendant covered entity’s motion to dismiss the complaint, holding that the plaintiff could move forward with state-specific claims of invasion of privacy, negligence, negligent infliction of emotional distress, and violation of Montana’s Consumer Protection Act because the federal law does not bar the suit under state law. The court held that, although HIPAA does not allow private lawsuits to be brought for unauthorized disclosure of health information, it does not preempt state law remedies that offer stronger protections than HIPAA.
