Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C.
Annotate this Case
Justia Opinion Summary
Want to stay in the know about new opinions from the Connecticut Supreme Court?
Sign up for free summaries delivered directly to your inbox. Learn More ›
You already receive new opinion summaries from Connecticut Supreme Court. Did you know we offer summary newsletters for even more practice areas and jurisdictions? Explore them here.
Plaintiff filed, among other claims, state law claims for negligence and negligent infliction of emotional distress against Defendant, a health care provider, alleging that Defendant improperly breached the confidentiality of Plaintiff’s medical records in the course of complying with a subpoena. The trial court dismissed Plaintiff’s negligence based claims, concluding that they were preempted by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which lacks a private right of action and preempts contrary state laws. The Supreme Court reversed, holding that HIPAA did not preempt Plaintiff’s state common-law causes of action for negligence or negligent infliction of emotional distress against Defendant because (1) Connecticut’s common law provides a remedy for a health care provider’s breach of confidentiality in the course of complying with a subpoena; and (2) HIPAA and its implementing regulations may be utilized to inform the standard of care applicable to claims arising from allegations of negligence in the disclosure of patients’ medical records pursuant to a subpoena.
Download PDF
****************************************************** The ‘‘officially released’’ date that appears near the beginning of each opinion is the date the opinion will be published in the Connecticut Law Journal or the date it was released as a slip opinion. The operative date for the beginning of all time periods for filing postopinion motions and petitions for certification is the ‘‘officially released’’ date appearing in the opinion. In no event will any such motions be accepted before the ‘‘officially released’’ date. All opinions are subject to modification and technical correction prior to official publication in the Connecticut Reports and Connecticut Appellate Reports. In the event of discrepancies between the electronic version of an opinion and the print version appearing in the Connecticut Law Journal and subsequently in the Connecticut Reports or Connecticut Appellate Reports, the latest print version is to be considered authoritative. The syllabus and procedural history accompanying the opinion as it appears on the Commission on Official Legal Publications Electronic Bulletin Board Service and in the Connecticut Law Journal and bound volumes of official reports are copyrighted by the Secretary of the State, State of Connecticut, and may not be reproduced and distributed without the express written permission of the Commission on Official Legal Publications, Judicial Branch, State of Connecticut. ****************************************************** EMILY BYRNE v. AVERY CENTER FOR OBSTETRICS AND GYNECOLOGY, P.C. (SC 18904) Rogers, C. J., and Norcott, Palmer, Zarella, Eveleigh, McDonald and Vertefeuille, Js.* Argued March 12, 2013—officially released November 11, 2014 Bruce L. Elstein, with whom, on the brief, was Henry Elstein, for the appellant (plaintiff). James F. Biondo, with whom, on the brief, was Audrey D. Medd, for the appellee (defendant). Opinion NORCOTT, J. Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d et seq., as a comprehensive legislative and regulatory scheme to, inter alia, protect the privacy of patients’ health information given emerging advances in information technology. In this appeal, we determine whether HIPAA, which lacks a private right of action and preempts ‘‘contrary’’ state laws; 42 U.S.C. § 1320d7 (2006);1 preempts state law claims for negligence and negligent infliction of emotional distress against a health care provider who is alleged to have improperly breached the confidentiality of a patient’s medical records in the course of complying with a subpoena. The plaintiff, Emily Byrne,2 appeals from the judgment of the trial court dismissing counts two and four of the operative amended complaint (complaint) filed against the defendant, the Avery Center for Obstetrics and Gynecology, P.C.3 On appeal, the plaintiff contends that the trial court improperly concluded that her state law claims for negligence and negligent infliction of emotional distress were preempted by HIPAA. We conclude that, to the extent that Connecticut’s common law provides a remedy for a health care provider’s breach of its duty of confidentiality in the course of complying with a subpoena, HIPAA does not preempt the plaintiff’s state common-law causes of action for negligence or negligent infliction of emotional distress against the health care providers in this case and, further, that regulations of the Department of Health and Human Services (department) implementing HIPAA may inform the applicable standard of care in certain circumstances. Accordingly, we reverse the judgment of the trial court. The trial court’s memorandum of decision sets forth the following undisputed facts and procedural history. ‘‘Before July 12, 2005, the defendant provided the plaintiff [with] gynecological and obstetrical care and treatment. The defendant provided its patients, including the plaintiff, with notice of its privacy policy regarding protected health information and agreed, based on this policy and on law, that it would not disclose the plaintiff’s health information without her authorization. ‘‘In May, 2004, the plaintiff began a personal relationship with Andro Mendoza, which lasted until September, 2004.4 . . . In October, 2004, she instructed the defendant not to release her medical records to Mendoza. In March, 2005, she moved from Connecticut to Vermont where she presently lives. On May 31, 2005, Mendoza filed paternity actions against the plaintiff in Connecticut and Vermont. Thereafter, the defendant was served with a subpoena requesting its presence together with the plaintiff’s medical records at the New Haven Regional Children’s [Probate Court] on July 12, 2005. The defendant did not alert the plaintiff of the subpoena, file a motion to quash it or appear in court. Rather, the defendant mailed a copy of the plaintiff’s medical file to the court around July 12, 2005. In September, 2005, ‘[Mendoza] informed [the] plaintiff by telephone that he reviewed [the] plaintiff’s medical file in the court file.’ On September 15, 2005, the plaintiff filed a motion to seal her medical file, which was granted. The plaintiff alleges that she suffered harassment and extortion threats from Mendoza since he viewed her medical records.’’5 (Footnotes altered.) The plaintiff subsequently brought this action against the defendant. Specifically, the operative complaint in the present case alleges that the defendant: (1) breached its contract with her when it violated its privacy policy by disclosing her protected health information without authorization; (2) acted negligently by failing to use proper and reasonable care in protecting her medical file, including disclosing it without authorization in violation of General Statutes § 52-146o6 and the department’s regulations implementing HIPAA;7 (3) made a negligent misrepresentation, upon which the plaintiff relied to her detriment, that her ‘‘medical file and the privacy of her health information would be protected in accordance with the law’’; and (4) engaged in conduct constituting negligent infliction of emotional distress. After discovery, the parties filed cross motions for summary judgment. With respect to the plaintiff’s negligence based claims in counts two and four of the complaint, the trial court agreed with the defendant’s contention that ‘‘HIPAA preempts ‘any action dealing with confidentiality/privacy of medical information,’ ’’ which prompted the court to treat the summary judgment motion as one seeking dismissal for lack of subject matter jurisdiction. In its memorandum of decision, the trial court first considered the plaintiff’s negligence claims founded on the violations of the regulations implementing HIPAA. The court first observed the ‘‘well settled’’ proposition that HIPAA does not create a private right of action, requiring claims of violations instead to be raised through the department’s administrative channels. The trial court then relied on Fisher v. Yale University, Superior Court, judicial district of New Haven, Complex Litigation Docket, Docket No. X10-CV-04-4003207-S (April 3, 2006), and Meade v. Orthopedic Associates of Windham County, Superior Court, judicial district of Windham, Docket No. CV-06-4005043-S (December 27, 2007),8 and rejected the plaintiff’s claim that she had not utilized HIPAA as the basis of her cause of action, but rather, relied on it as ‘‘ ‘evidence of the appropriate standard of care’ for claims brought under state law, namely, negligence.’’9 Emphasizing that the courts cannot supply a private right of action that the legislature intentionally had omitted, the trial court noted that the ‘‘plaintiff has labeled her claims as negligence claims, but this does not change their essential nature. They are HIPAA claims.’’ The trial court further determined that the plaintiff’s statutory negligence claims founded on a violation of § 52-146o were similarly preempted because the state statute had been superseded by HIPAA, and thus the plaintiff’s state statutory claim ‘‘amount[ed] to a claim for a HIPAA violation, a claim for which there is no private right of action.’’10 The trial court concluded similarly with respect to the plaintiff’s common-law negligence claims, observing that, under the regulatory definitions implementing HIPAA’s preemption provision; see 42 U.S.C. § 1320d7 (a); 45 C.F.R. § 160.202 (2004);11 to ‘‘the extent that common-law negligence permits a private right of action for claims that amount to HIPAA violations, it is a contrary provision of law and subject to HIPAA’s preemption rule. Because it is not more stringent, according to the definition of 45 C.F.R. § 160.202, the preemption exception does not apply.’’ For the same reasons, the trial court dismissed count four of the complaint, claiming negligent infliction of emotional distress. With respect to the remainder of the pending motions, the trial court first denied, on the basis of its previous preemption determinations, the plaintiff’s motion for summary judgment, which had claimed that the defendant’s conduct in responding to the subpoena violated the HIPAA regulations, specifically 45 C.F.R. § 164.512 (e),12 as a matter of law. The trial court denied, however, the defendant’s motion for summary judgment with respect to the remaining counts of the complaint, namely, count one alleging breach of contract and count three alleging negligent misrepresentation, determining that genuine issues of material fact existed with respect to contract formation through the defendant’s privacy policy, and whether the plaintiff had received and relied upon that policy. Thus, the trial court denied the defendant’s motion for summary judgment as to counts one and three of the complaint, and dismissed counts two and four of the complaint for lack of subject matter jurisdiction. This appeal followed. See footnote 3 of this opinion. On appeal, the plaintiff claims that the trial court improperly determined that HIPAA preempted her negligence based state law claims. Conceding that there is no private right of action under HIPAA, the plaintiff asserts that she is not asserting a claim for relief premised solely on a violation of HIPAA, but rather, relies heavily on Merrell Dow Pharmaceuticals, Inc. v. Thompson, 478 U.S. 804, 106 S. Ct. 3229, 92 L. Ed. 2d 650 (1986), Acosta v. Byrum, 180 N.C. App. 562, 638 S.E.2d 246 (2006), and R.K. v. St. Mary’s Medical Center, Inc., 229 W. Va. 712, 735 S.E.2d 715 (2012), cert. denied, U.S. , 133 S. Ct. 1738, 185 L. Ed. 2d 788 (2013), in support of the proposition that common-law negligence actions, with HIPAA informing the standard of care, may complement rather than ‘‘obstruct’’ HIPAA for preemption purposes. Citing, inter alia, Mead v. Burns, 199 Conn. 651, 662–63, 509 A.2d 11 (1986), and Wendland v. Ridgefield Construction Services, Inc., 184 Conn. 173, 181, 439 A.2d 954 (1981), the plaintiff emphasizes that the use of other state law causes of action to enforce statutes otherwise lacking private rights of action has been upheld by this court in the analogous contexts of the Connecticut Unfair Insurance Practices Act, General Statutes § 38a-815 et seq., and the federal Occupational Safety and Health Act (OSHA), 29 U.S.C. § 651 et seq., and its state counterpart, General Statutes § 31-367 et seq. The plaintiff further argues that, under HIPAA and its implementing regulation; see 42 U.S.C. § 1320d-7 (a) (1); 45 C.F.R. § 160.202; her state law claims for relief are not preempted because it is not ‘‘contrary to’’ HIPAA to provide for damages under state common-law claims for privacy breaches. In response, the defendant relies on the long line of federal and state cases establishing that there is no private right of action, express or implied, under HIPAA. See, e.g., O’Donnell v. Blue Cross Blue Shield of Wyoming, 173 F. Supp. 2d 1176 (D. Wyo. 2001); Fisher v. Yale University, supra, Superior Court, Docket No. X10CV-04-4003207-S. Observing that ‘‘playing word games does not change the underlying theory of liability,’’ the defendant relies on Young v. Carran, 289 S.W.3d 586 (Ky. App. 2008), review denied, 2009 Ky. LEXIS 592 (Ky. August 19, 2009), and Bonney v. Stephens Memorial Hospital, 17 A.3d 123 (Me. 2011), and contends that, because there is no private right of action under HIPAA, ‘‘a plaintiff cannot use a violation of HIPAA as the standard of care for underlying claims, such as negligence.’’ The defendant further emphasizes that the plaintiff’s negligence claim relying on § 52-146o is preempted because HIPAA is more stringent than the state statute. Finally, the defendant also argues briefly, in what appears to be either alternative grounds for affirming the judgment of the trial court or matters likely to arise on remand, that: (1) there is no private right of action under § 52-146o; and (2) it was not obligated, as a matter of law, to inform the plaintiff that it had complied with a subpoena, and its compliance with the subpoena did not violate her privacy rights.13 We note at the outset that whether Connecticut’s common law provides a remedy for a health care provider’s breach of its duty of confidentiality, including in the context of responding to a subpoena, is not an issue presented in this appeal. Thus, assuming, without deciding, that Connecticut’s common law recognizes a negligence cause of action arising from health care providers’ breaches of patient privacy in the context of complying with subpoenas,14 we agree with the plaintiff and conclude that such an action is not preempted by HIPAA and, further, that the HIPAA regulations may well inform the applicable standard of care in certain circumstances. I PREEMPTION CLAIMS The defendant’s claim that HIPAA preemption shifts the exclusive venue for the resolution of all disputes relating to that statute from the state court to the federal administrative forum implicates our subject matter jurisdiction. See, e.g., Stokes v. Norwich Taxi, LLC, 289 Conn. 465, 488 and n.18, 958 A.2d 1195 (2008). As the trial court properly noted, the defendant’s summary judgment essentially was a ‘‘motion to dismiss [that] . . . properly attacks the jurisdiction of the court, essentially asserting that the plaintiff cannot as a matter of law and fact state a cause of action that should be heard by the court. . . . A motion to dismiss tests, inter alia, whether, on the face of the record, the court is without jurisdiction. . . . [O]ur review of the court’s ultimate legal conclusion and resulting [determination] of the motion to dismiss will be de novo. . . . In undertaking this review, we are mindful of the well established notion that, in determining whether a court has subject matter jurisdiction, every presumption favoring jurisdiction should be indulged.’’ (Citation omitted; internal quotation marks omitted.) Conboy v. State, 292 Conn. 642, 650, 974 A.2d 669 (2009); see also Practice Book § 10-31 (a) (1). Whether state causes of action are preempted by federal statutes and regulations is a question of law over which our review is plenary. See, e.g., Hackett v. J.L.G. Properties, LLC, 285 Conn. 498, 502–503, 940 A.2d 769 (2008). Thus, we note that ‘‘the ways in which federal law may [preempt] state law are well established and in the first instance turn on congressional intent. . . . Congress’ intent to supplant state authority in a particular field may be express[ed] in the terms of the statute.’’ (Internal quotation marks omitted.) Id., 503; see also id., 504 (‘‘The question of preemption is one of federal law, arising under the supremacy clause of the United States constitution. . . . Determining whether Congress has exercised its power to preempt state law is a question of legislative intent.’’ [Internal quotation marks omitted.]). Turning to the HIPAA provisions at issue in this appeal, we note by way of background that, ‘‘[r]ecognizing the importance of protecting the privacy of health information in the midst of the rapid evolution of health information systems, Congress passed HIPAA in August 1996. HIPAA’s Administrative Simplification provisions, [§§] 261 through 264 of [Public Law 104-191], were designed to improve the efficiency and effectiveness of the health care system by facilitating the exchange of information with respect to financial and administrative transactions carried out by health plans, health care clearinghouses, and health care providers who transmit information in connection with such transactions. . . . ‘‘Within the Administrative Simplification section, Congress included another provision—[§] 264—outlining a two-step process to address the need to afford certain protections to the privacy of health information maintained under HIPAA. First, [§] 264 (a) directed [the department] to submit to Congress within twelve months of HIPAA’s enactment ‘detailed recommendations on standards with respect to the privacy of individually identifiable health information.’ . . . Second, if Congress did not enact further legislation pursuant to these recommendations within thirty-six months of the enactment of HIPAA, [the department] was to promulgate final regulations containing such standards.’’ (Citations omitted; footnote omitted.) South Carolina Medical Assn. v. Thompson, 327 F.3d 346, 348 (4th Cir.), cert. denied, 540 U.S. 981, 124 S. Ct. 464, 157 L. Ed. 2d 371 (2003). Because Congress ultimately failed to pass any additional legislation, the department’s final regulations implementing HIPAA, known collectively as the ‘‘Privacy Rule,’’ were ‘‘promulgated in February 2001,’’ with compliance phased in over the next few years.15 Id., 349. With respect to the preemptive effect of HIPAA, 42 U.S.C. § 1320d-7 (a) (i) provides that: ‘‘Except as provided in paragraph (2), a provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of this title, shall supersede any contrary provision of State law, including a provision of State law that requires medical or health plan records (including billing information) to be maintained or transmitted in written rather than electronic form.’’ (Emphasis added.) See footnote 1 of this opinion for the complete text of 42 U.S.C. § 1320d-7. The department’s regulations, namely, 45 C.F.R. § 160.202 (2004) and 45 C.F.R. § 160.203, provide additional explication of HIPAA’s preemptive effect. Specifically, 45 C.F.R. § 160.203 provides as a ‘‘general rule’’ that a ‘‘standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law preempts the provision of State law.’’ (Emphasis added.) A state law is ‘‘contrary’’ to HIPAA if ‘‘(1) A covered entity would find it impossible to comply with both the [s]tate and [f]ederal requirements; or (2) [t]he provision of [s]tate law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of part C of title XI of [HIPPA], [§] 264 of [Public Law] 104-191, as applicable.’’ (Emphasis added.) 45 C.F.R. § 160.202 (2004). The regulations define a ‘‘[s]tate law’’ as ‘‘a constitution, statute, regulation, rule, common law, or other [s]tate action having the force and effect of law.’’ (Emphasis added.) 45 C.F.R. § 160.202 (2004). As relevant to this appeal, state laws exempted from preemption include those that ‘‘[relate] to the privacy of individually identifiable health information16 and [are] more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter.’’17 (Emphasis added; footnote added.) 45 C.F.R. § 160.203 (b). A state law is ‘‘[m]ore stringent’’ ‘‘in the context of a comparison of a provision of [s]tate law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, [if it] meets one or more of the following criteria: *** ‘‘(4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable. . . . ‘‘(6) With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information.’’ 45 C.F.R. § 160.202 (2004); see also footnote 11 of this opinion. This statutory and regulatory background brings us to the question in the present appeal, namely, whether HIPAA preempts a state law claim sounding in negligence arising from a health care provider’s alleged breach of physician-patient confidentiality in the course of complying with a subpoena. It is by now well settled that the ‘‘statutory structure of HIPAA . . . precludes implication of a private right of action. [Section] 1320d–6 [of title 42 of the United States Code]18 expressly provides a method for enforcing its prohibition upon use or disclosure of individual’s health information—the punitive imposition of fines and imprisonment for violations.’’ (Footnote added.) University of Colorado Hospital Authority v. Denver Publishing Co., 340 F. Supp. 2d 1142, 1145 (D. Colo. 2004); see also, e.g., 42 U.S.C. § 1320d-5 (providing for administrative enforcement by department and state attorneys general); Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010); Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006); Rzayeva v. United States, 492 F. Supp. 2d 60, 83 (D. Conn. 2007); O’Donnell v. Blue Cross Blue Shield of Wyoming, supra, 173 F. Supp. 2d 1180–81. Nevertheless, it is similarly well established that, ‘‘[o]rdinarily, state causes of action are not [preempted] solely because they impose liability over and above that authorized by federal law.’’ (Internal quotation marks omitted.) English v. General Electric Co., 496 U.S. 72, 89, 110 S. Ct. 2270, 110 L. Ed. 2d 65 (1990); see also id., 87–90 (state tort claim for intentional infliction of emotional distress arising from termination of whistleblower not preempted by federal legislation intended to occupy field of nuclear safety, even with statutes’ provision of administrative remedy for whistleblower violations). As a corollary, ‘‘a complaint alleging a violation of a federal statute as an element of a state cause of action, when Congress has determined that there should be no private, federal cause of action for the violation, does not state a claim ‘arising under the [c]onstitution, laws, or treaties of the United States’ ’’ for purposes of federal question jurisdiction under 28 U.S.C. § 1331. Merrell Dow Pharmaceuticals, Inc. v. Thompson, supra, 478 U.S. 817; see also Grable & Sons Metal Products, Inc. v. Darue Engineering & Mfg., 545 U.S. 308, 319, 125 S. Ct. 2363, 162 L. Ed. 2d 257 (2005) (‘‘[a] general rule of exercising federal jurisdiction over state claims resting on federal mislabeling and other statutory violations would thus have heralded a potentially enormous shift of traditionally state cases into federal courts’’). Consistent with these principles, the regulatory history of the HIPAA demonstrates that neither HIPAA nor its implementing regulations were intended to preempt tort actions under state law arising out of the unauthorized release of a plaintiff’s medical records. As the plaintiff aptly notes, one commenter during the rulemaking process had ‘‘raised the issue of whether a private right of action is a greater penalty, since the proposed federal rule has no comparable remedy.’’19 Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,582 (December 28, 2000). In its administrative commentary to the final rule as promulgated in the Federal Register, the department responded to this question by stating, inter alia, that ‘‘the fact that a state law allows an individual to file [a civil action] to protect privacy does not conflict with the HIPAA penalty provisions,’’ namely, fines and imprisonment. (Emphasis added.) Id. This agency commentary on final rules in the Federal Register is significant evidence of regulatory intent. See, e.g., Exelon Generation Co., LLC v. Local 15, International Brotherhood of Electrical Workers, AFL-CIO, 676 F.3d 566, 573–75 (7th Cir. 2012); Southeast Alaska Conservation Council v. United States Army Corps of Engineers, 486 F.3d 638, 648 (9th Cir. 2007), rev’d on other grounds sub nom. Coeur Alaska, Inc. v. Southeast Alaska Conservation Council, 557 U.S. 261, 129 S. Ct. 2458, 174 L. Ed. 2d 193 (2009). Indeed, ‘‘[w]here an agency has authoritatively interpreted its own rule, courts generally defer to that reading unless it is plainly erroneous or inconsistent with the regulation.’’ (Internal quotation marks omitted.) Exelon Generation Co., LLC v. Local 15, International Brotherhood of Electrical Workers, AFL-CIO, supra, 570. Consistent with this regulatory history, the parties’ briefs and our independent research disclose a number of cases from the federal and sister state courts holding that HIPAA, and particularly its implementation through the Privacy Rule regulations, does not preempt causes of action, when they exist as a matter of state common or statutory law, arising from health care providers’ breaches of patient confidentiality in a variety of contexts; indeed, several have determined that HIPAA may inform the relevant standard of care in such actions.20 See I.S. v. Washington University, United States District Court, Docket No. 4:11CV235SNLJ (E.D. Mo. June 14, 2011) (The court rejected the defendant’s argument that the ‘‘negligence per se’’ count of the plaintiff’s complaint, premised on HIPAA violations, ‘‘in reality is a claim for violation of HIPAA, which is impermissible under federal law,’’ but remanding claim to state court because it ‘‘does not raise any compelling federal interest nor is a substantial federal question presented. Although HIPAA is clearly implicated in the claim for negligence per se, said claim fall[s] within that broad class of state law claims based on federal regulations in the state court . . . .’’ [Internal quotation marks omitted.]); Harmon v. Maury County, United States District Court, Docket No. 1:05CV0026 (M.D. Tenn. August 31, 2005) (concluding that plaintiffs’ negligence per se claims founded on violation of HIPAA privacy regulation were not preempted because ‘‘HIPAA’s provisions do not completely preempt state law and expressly preserve state laws that are not inconsistent with its terms’’ and ‘‘there is no private remedy under federal law and the critical interest is the privacy interests of the [p]laintiffs’’); Fanean v. Rite Aid Corp. of Delaware, Inc., 984 A.2d 812, 823 (Del. Super. 2009) (concluding that claim of negligence per se could not be premised on HIPAA violation, but following Toll Bros., Inc. v. Considine, 706 A.2d 493 [Del. 1998], holding ‘‘that a common law negligence claim can be predicated upon OSHA requirements,’’ in concluding that common-law negligence claim could utilize HIPAA as ‘‘guidepost for determining the standard of care’’); Young v. Carran, supra, 289 S.W.3d 588–89 (rejecting plaintiff’s attempt to use HIPAA as foundation for damages claim under state ‘‘negligence per se’’ statute, but observing that state case law permits use of federal statutes otherwise to inform standard of care in common-law negligence action); Bonney v. Stephens Memorial Hospital, supra, 17 A.3d 128 (‘‘[a]lthough . . . HIPAA standards, like state laws and professional codes of conduct, may be admissible to establish the standard of care associated with a state tort claim, [HIPAA] itself does not authorize a private action’’); Yath v. Fairview Clinics, N.P., 767 N.W.2d 34, 49–50 (Minn. App. 2009) (concluding that state statutory cause of action for improper disclosure of medical records was not preempted by HIPAA because ‘‘[a]lthough the penalties under the two laws differ, compliance with [the Minnesota statute] does not exclude compliance with HIPAA,’’ and ‘‘[r]ather than creating an ‘obstacle’ to HIPAA, [the Minnesota statute] supports at least one of HIPAA’s goals by establishing another disincentive to wrongfully disclose a patient’s health care record’’); Acosta v. Byrum, supra, 180 N.C. App. 571–73 (The court concluded that the trial court improperly dismissed the negligent infliction of emotional distress case because the allegation that, when the psychiatrist ‘‘provided his medical access code . . . [he] violated the rules and regulations established by HIPAA . . . does not state a cause of action under HIPAA. Rather, [the] plaintiff cites to HIPAA as evidence of the appropriate standard of care, a necessary element of negligence.’’); Sorensen v. Barbuto, 143 P.3d 295, 299 n.2 (Utah App. 2006) (The court noted that, in concluding that the trial court improperly dismissed the plaintiff’s claim for breach of professional duties, that the defendant physician ‘‘contends that [the plaintiff] is not entitled to a private right of action for breach of professional standards,’’ but that the plaintiff ‘‘does not contend in his brief, however, that a private right of action exists. Rather, [the plaintiff] asserts that the professional standards contribute to the proper standard of care, citing [HIPAA], the American Medical Association’s Principles of Medical Ethics, and the Hippocratic Oath.’’); R.K. v. St. Mary’s Medical Center, Inc., supra, 229 W. Va. 719–21 (concluding that state law claims for, inter alia, negligence, outrageous conduct, and invasion of privacy arising from defendant hospital staff’s disclosure of plaintiff’s psychiatric treatment records to his wife’s divorce attorney, were not preempted by HIPAA and that goals of common-law remedies and HIPAA ‘‘are similar’’ in that ‘‘both protect the privacy of an individual’s health care information’’); but cf. Espinoza v. Gold Cross Services, Inc., 234 P.3d 156, 158–59 (Utah App. 2010) (contrasting similar actions brought under California’s unfair competition statute and declining to consider HIPAA copy fee schedules in concluding that plaintiff’s common-law unjust enrichment claim arising from defendant’s allegedly excessive copying fees failed because ‘‘[w]e have no basis in state or federal law to enforce federal regulations promulgated under HIPAA, either directly or as a component of a state cause of action’’).21 On the basis of the foregoing authorities, we conclude that, if Connecticut’s common law recognizes claims arising from a health care provider’s alleged breach of its duty of confidentiality in the course of complying with a subpoena, HIPAA and its implementing regulations do not preempt such claims. We further conclude that, to the extent it has become the common practice for Connecticut health care providers to follow the procedures required under HIPAA in rendering services to their patients, HIPAA and its implementing regulations may be utilized to inform the standard of care applicable to such claims arising from allegations of negligence in the disclosure of patients’ medical records pursuant to a subpoena.22 The availability of such private rights of action in state courts, to the extent that they exist as a matter of state law, do not preclude, conflict with, or complicate health care providers’ compliance with HIPAA. On the contrary, negligence claims in state courts support ‘‘at least one of HIPAA’s goals by establishing another disincentive to wrongfully disclose a patient’s health care record.’’ Yath v. Fairview Clinics, N.P., supra, 767 N.W.2d 50. Accordingly, we conclude that the trial court improperly dismissed counts two and four of the plaintiff’s complaint, sounding in negligence and negligent infliction of emotional distress. II OTHER CLAIMS Beyond the preemption issue, the parties raise two other matters that require attention because they may provide us with an opportunity to address issues that are likely to arise on remand or potentially provide an alternative basis for affirming the judgment of the trial court, at least in part. See, e.g., Total Recycling Services of Connecticut, Inc. v. Connecticut Oil Recycling Services, LLC, 308 Conn. 312, 325, 63 A.3d 896 (2013). Specifically, we address: (1) the parties’ request that we determine whether the defendant was negligent as a matter of law by not informing the plaintiff of the subpoena and by mailing the plaintiff’s medical records into court; and (2) the defendant’s argument that it is entitled to summary judgment on the plaintiff’s state statutory claims because § 52-146o does not provide a private right of action. A We first note that the plaintiff asks us, as a matter of judicial economy in the event of a remand, to determine, as a matter of law, whether the defendant’s act of mailing the medical records into court in response to the subpoena complied with General Statutes § 52143 and the federal regulatory provisions under HIPAA, namely, 45 C.F.R. § 164.512 (e) (1) (ii) and (iii), with respect to notifying the plaintiff or seeking a qualified protective order. See footnote 12 of this opinion. In response, the defendant, relying on the deposition testimony of its HIPAA consultant, contends that its act of mailing the records to the Probate Court complied with Connecticut and federal law, as its staff complied with the directions of the attorney who had issued the subpoena and its privacy policy had unequivocally informed the plaintiff that it would use or disclose health information in response to a subpoena without patient authorization or the opportunity to object. The defendant posits that the true responsibility for the breach of the plaintiff’s privacy lies with the members of the Probate Court staff who did not seal the records upon receipt pending a court order making them available to counsel. Given the apparently undeveloped factual record at this point, and the fact that the plaintiff’s breach of contract and negligent misrepresentation claims remain pending, requiring further proceedings before the trial court; see footnote 3 of this opinion; we decline to address this claim further, other than to note that state court pretrial practices must be HIPAA compliant; see, e.g., Law v. Zuckerman, 307 F. Supp. 2d 705, 710–11 (D. Md. 2004); Arons v. Jutkowitz, 9 N.Y.3d 393, 415, 880 N.E.2d 831, 850 N.Y.S.2d 345 (2007); a requirement that extends to responses to subpoenas. See State v. La Cava, Superior Court, judicial district of Danbury, Docket No. CR-06-0128258-S (May 17, 2007) (43 Conn. L. Rptr. 417, 418) (The trial court granted the hospital’s motion to quash the subpoena of the hospital records requested pursuant to General Statutes § 4-104 because ‘‘delivery of the hospital record to the clerk of court authorized by § 4-104 constitutes a transfer of protected health information to an outside entity. Yet, under 45 C.F.R. § 164.512 [e] [1] [ii], a hospital cannot transfer protected health information to an outside entity without receiving the satisfactory assurances set forth in 45 C.F.R. § 164.512 [e] [1] [ii] [A] or [B], or complying with the requirements of 45 C.F.R. § 164.512 [e] [1] [vi]. Hence, a covered entity would find it impossible to comply with § 4-104 without violating 45 C.F.R. § 164.512 [e].’’). B We next turn to the defendant’s argument, founded on the Superior Court’s decision in Meade v. Orthopedic Associates of Windham County, supra, Superior Court, Docket No. CV-06-4005043-S, that it is entitled to summary judgment on the plaintiff’s state law statutory claims under § 52-146o because that statute does not provide a private right of action. The plaintiff does not contend otherwise in her reply brief. Indeed, her arguments on other points therein suggest that her claims in this case are limited to violations of the state common law. We decline to reach the defendant’s statutory argument because we do not read the plaintiff’s complaint as asserting a statutory right of action under § 52-146o. Accordingly, we take no position on whether § 52-146o provides a statutory right of action. ‘‘The interpretation of pleadings is always a question of law for the court . . . . Our review of the trial court’s interpretation of the pleadings therefore is plenary. . . . Furthermore, we long have eschewed the notion that pleadings should be read in a hypertechnical manner. Rather, [t]he modern trend, which is followed in Connecticut, is to construe pleadings broadly and realistically, rather than narrowly and technically. . . . [T]he complaint must be read in its entirety in such a way as to give effect to the pleading with reference to the general theory upon which it proceeded, and do substantial justice between the parties. . . . Our reading of pleadings in a manner that advances substantial justice means that a pleading must be construed reasonably, to contain all that it fairly means, but carries with it the related proposition that it must not be contorted in such a way so as to strain the bounds of rational comprehension. . . . Although essential allegations may not be supplied by conjecture or remote implication . . . the complaint must be read in its entirety in such a way as to give effect to the pleading with reference to the general theory upon which it proceeded, and do substantial justice between the parties. . . . As long as the pleadings provide sufficient notice of the facts claimed and the issues to be tried and do not surprise or prejudice the opposing party, we will not conclude that the complaint is insufficient to allow recovery.’’ (Citations omitted; internal quotation marks omitted.) Grenier v. Commissioner of Transportation, 306 Conn. 523, 536–37, 51 A.3d 367 (2012). The operative complaint asserts four counts, each captioned with a common-law cause of action, namely, (1) breach of contract, (2) negligence, (3) negligent misrepresentation, and (4) negligent infliction of emotional distress. The alleged violation of § 52-146o is mentioned once as a specification of negligence in count two, negligence, which is incorporated by reference into count four, stating that ‘‘the defendant was negligent and [careless] in one or more of the following ways . . . . It disclosed the medical file, without authority, in violation of . . . § 52-146o.’’ In context, with all of the captioned causes of action arising from the common law, we read this single mention of § 52-146o as providing one of several bases for establishing the standard of care applicable to the plaintiff’s common-law negligence claims and not as asserting an independent cause of action. See footnote 22 of this opinion and accompanying text. Thus, we conclude that the plaintiff’s complaint does not plead a statutory cause of action arising under § 52-146o, and decline to decide whether that statute provides such a private right of action. The judgment is reversed and the case is remanded to the trial court for further proceedings according to law. In this opinion PALMER, EVELEIGH, McDONALD and VERTEFEUILLE, Js., concurred. * The listing of justices reflects their seniority status on this court as of the date of oral argument. This case was originally scheduled to be argued before a panel of this court consisting of Chief Justice Rogers and Justices Norcott, Palmer, Zarella, Eveleigh, McDonald and Vertefeuille. Although Justice Palmer was not present when the case was argued before the court, he read the record and briefs and listened to a recording of oral argument prior to participating in this decision. 1 Title 42 of the United States Code, § 1320d-7 (a), provides in relevant part: ‘‘(1) . . . Except as provided in paragraph (2), a provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of this title, shall supersede any contrary provision of State law, including a provision of State law that requires medical or health plan records (including billing information) to be maintained or transmitted in written rather than electronic form. ‘‘(2) Exceptions ‘‘A provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of this title, shall not supersede a contrary provision of State law, if the provision of State law— ‘‘(A) is a provision the Secretary determines— ‘‘(i) is necessary— ‘‘(I) to prevent fraud and abuse; ‘‘(II) to ensure appropriate State regulation of insurance and health plans; ‘‘(III) for State reporting on health care delivery or costs; or ‘‘(IV) for other purposes; or ‘‘(ii) addresses controlled substances; or ‘‘(B) subject to section 264 (c) (2) of the Health Insurance Portability and Accountability Act of 1996, relates to the privacy of individually identifiable health information. . . .’’ 2 We note that the trial court subsequently granted the plaintiff’s motion to add Douglas Wolinsky, the bankruptcy trustee appointed by the United States Bankruptcy Court for the District of Vermont, as a party plaintiff. See General Statutes § 52-108; Practice Book § 9-18. For the sake of convenience, all references to the plaintiff in this opinion are to Byrne. 3 Ordinarily, the trial court’s dismissal of counts two and four of the operative complaint would not constitute an appealable final judgment. See Kelly v. New Haven, 275 Conn. 580, 594, 881 A.2d 978 (2005). We note, however, that the plaintiff obtained permission to file the present appeal with the Appellate Court pursuant to Practice Book § 61-4. This appeal was subsequently transferred to this court pursuant to General Statutes § 51199 (c) and Practice Book § 65-1. We also note that the defendant filed a cross appeal to the Appellate Court from the trial court’s denial of its motion for summary judgment with respect to counts one and three of the complaint. After a hearing, the Appellate Court dismissed the defendant’s cross appeal for lack of a final judgment, noting that the defendant had not obtained permission pursuant to Practice Book § 61-4 to appeal from that aspect of the trial court’s decision. 4 We note that the operative complaint in the present case alleges that the plaintiff discovered she was pregnant around the same time she terminated her relationship with Mendoza. 5 We also note that, according to the operative complaint, Mendoza has utilized the information contained within these records to file numerous civil actions, including paternity and visitation actions, against the plaintiff, her attorney, her father and her father’s employer, and to threaten her with criminal charges. 6 General Statutes § 52-146o provides: ‘‘(a) Except as provided in sections 52-146c to 52-146j, inclusive, and subsection (b) of this section, in any civil action or any proceeding preliminary thereto or in any probate, legislative or administrative proceeding, a physician or surgeon, as defined in subsection (b) of section 20-7b, shall not disclose (1) any communication made to him by, or any information obtained by him from, a patient or the conservator or guardian of a patient with respect to any actual or supposed physical or mental disease or disorder, or (2) any information obtained by personal examination of a patient, unless the patient or his authorized representative explicitly consents to such disclosure. ‘‘(b) Consent of the patient or his authorized representative shall not be required for the disclosure of such communication or information (1) pursuant to any statute or regulation of any state agency or the rules of court, (2) by a physician, surgeon or other licensed health care provider against whom a claim has been made, or there is a reasonable belief will be made, in such action or proceeding, to his attorney or professional liability insurer or such insurer’s agent for use in the defense of such action or proceeding, (3) to the Commissioner of Public Health for records of a patient of a physician, surgeon or health care provider in connection with an investigation of a complaint, if such records are related to the complaint, or (4) if child abuse, abuse of an elderly individual, abuse of an individual who is physically disabled or incompetent or abuse of an individual with intellectual disability is known or in good faith suspected.’’ We note that the legislature made certain technical changes to § 52-146o subsequent to the events underlying the present appeal. See Public Acts 2011, No. 11-129, § 20. For purposes of convenience and clarity, however, all references to § 52-146o within this opinion are to the current revision of the statute. 7 Specifically, the plaintiff alleged, in paragraphs 25 (f), (g), (h), (i) and (j) of the complaint, violations of the following regulations of the department: (1) 45 C.F.R. § 164.512 (e) (1) (ii) by ‘‘failing to seek itself or obtain ‘satisfactory assurances’ from the person seeking the information in that the person seeking the information failed to provide to the defendant proof that reasonable efforts were made to either . . . [e]nsure that the plaintiff was provided sufficient notice of the request, or . . . [s]eek a qualified protective order’’; (2) 45 C.F.R. § 164.512 (e) (1) (iii) ‘‘in failing to determine that the plaintiff had not received satisfactory notice of the request for her records from the face of the subpoena’’; (3) 45 C.F.R. §§ 164.508 (b) (2) and 164.508c (1)-(3) ‘‘in that the subpoena was not a valid authorization to produce the records’’; (4) 45 C.F.R. § 164.522 ‘‘in failing to follow the plaintiff’s request for additional privacy protection of her protected health information from production to the party requesting it’’; and (5) 45 C.F.R. § 164.502 ‘‘in failing to determine and produce only the minimum necessary data requested.’’ 8 In Fisher, a judge of the Superior Court concluded that HIPAA’s omission of a private right of action preempts, under 42 U.S.C. § 1320d-7 (a) (2) (B), state law causes of action arising from health care providers’ breaches of patient privacy. Specifically, the court concluded that a plaintiff’s claim, which was brought under the Connecticut Unfair Trade Practices Act (CUTPA), General Statutes § 42-110a et seq., challenging a hospital’s ‘‘fail[ure] to comply with HIPAA’s privacy requirements’’ was preempted because ‘‘[i]f Congress had intended to allow for a private action as part of this program, it could have included it in the legislation or authorized the Secretary [of the department] to provide for the same by rulemaking,’’ and ‘‘[t]herefore, to the extent CUTPA permits a private right of action for a HIPAA violation, CUTPA constitutes a ‘contrary’ provision of state law and falls within the ambit of the HIPAA general preemption rule.’’ Fisher v. Yale University, supra, Superior Court, Docket No. X10-CV-04-4003207-S. In so concluding, the court rejected the plaintiff’s argument that, ‘‘since a violation of HIPAA is a violation of a clearly delineated public policy, it is actionable under CUTPA, and that the ability of a plaintiff to bring the action will result in greater privacy protection to her as a subject of individually identifiable health information.’’ Id.; see also Salatto v. Hospital of Saint Raphael, Superior Court, judicial district of New Haven, Docket No. CV-09-5032170S (October 6, 2010) (The trial court granted a motion for summary judgment as to the plaintiff’s ‘‘negligence per se claims [that] assert that the defendant violated his right to confidentiality, pursuant to HIPAA. It is well settled that HIPAA does not create a private right of action.’’); Meade v. Orthopedic Associates of Windham County, supra, Superior Court, Docket No. CV-064005043-S (‘‘[t]his court concurs with the reasoning in Fisher and, therefore, finds that the plaintiff’s CUTPA claim is preempted by HIPAA and does not provide a private right of action’’). 9 The trial court further disagreed with the plaintiff’s argument analogizing HIPAA to the federal Occupational Safety and Health Act, 29 U.S.C. §651 et seq., whose regulations ‘‘may be used as evidence of the standard of care in a negligence action against an employer’’; Wagner v. Clark Equipment Co., 243 Conn. 168, 188, 700 A.2d 38 (1997); observing that ‘‘[n]o such history exists for HIPAA regulations.’’ 10 Specifically, the trial court noted the ‘‘stark difference’’ between § 52146o and the more comprehensive safeguards for the disclosure of medical records in administrative and judicial proceedings set forth by 45 C.F.R. § 164.512 (e); see footnote 12 of this opinion; and observed that, ‘‘[t]o the extent that § 52-146o permits disclosure of protected medical records pursuant to a subpoena without the safeguards required by HIPAA, it is both contrary to and less stringent than HIPAA and therefore superseded by HIPAA.’’ 11 Title 45 of the Code of Federal Regulations (2004), § 160.202, implements 42 U.S.C. § 1320d-7, and provides: ‘‘For purposes of this subpart, the following terms have the following meanings: ‘‘Contrary, when used to compare a provision of [s]tate law to a standard, requirement, or implementation specification adopted under this subchapter, means: ‘‘(1) A covered entity would find it impossible to comply with both the [s]tate and [f]ederal requirements; or ‘‘(2) The provision of [s]tate law stands as an obstacle to the accomplishment and execution of the full purposes and objectives of part C of title XI of the Act, section 264 of [Public Law] 104–191, as applicable. ‘‘More stringent means, in the context of a comparison of a provision of [s]tate law and a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter, a [s]tate law that meets one or more of the following criteria: ‘‘(1) With respect to a use or disclosure, the law prohibits or restricts a use or disclosure in circumstances under which such use or disclosure otherwise would be permitted under this subchapter, except if the disclosure is: ‘‘(i) Required by the Secretary in connection with determining whether a covered entity is in compliance with this subchapter; or ‘‘(ii) To the individual who is the subject of the individually identifiable health information. ‘‘(2) With respect to the rights of an individual, who is the subject of the individually identifiable health information, regarding access to or amendment of individually identifiable health information, permits greater rights of access or amendment, as applicable. ‘‘(3) With respect to information to be provided to an individual who is the subject of the individually identifiable health information about a use, a disclosure, rights, and remedies, provides the greater amount of information. ‘‘(4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable. ‘‘(5) With respect to recordkeeping or requirements relating to accounting of disclosures, provides for the retention or reporting of more detailed information or for a longer duration. ‘‘(6) With respect to any other matter, provides greater privacy protection for the individual who is the subject of the individually identifiable health information. ‘‘Relates to the privacy of individually identifiable health information means, with respect to a [s]tate law, that the [s]tate law has the specific purpose of protecting the privacy of health information or affects the privacy of health information in a direct, clear, and substantial way. ‘‘State law means a constitution, statute, regulation, rule, common law, or other [s]tate action having the force and effect of law.’’ (Emphasis in original.) 12 Title 45 of the Code of Federal Regulations, § 164.512, provides in relevant part: ‘‘A covered entity may use or disclose protected health information without the written authorization of the individual, as described in § 164.508, or the opportunity for the individual to agree or object as described in § 164.510, in the situations covered by this section, subject to the applicable requirements of this section. When the covered entity is required by this section to inform the individual of, or when the individual may agree to, a use or disclosure permitted by this section, the covered entity’s information and the individual’s agreement may be given orally. ‘‘(a) Standard: Uses and disclosures required by law. (1) A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies with and is limited to the relevant requirements of such law. ‘‘(2) A covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section for uses or disclosures required by law. *** ‘‘(e) Standard: Disclosures for judicial and administrative proceedings.—(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding: ‘‘(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or ‘‘(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if: ‘‘(A) The covered entity receives satisfactory assurance, as described in paragraph (e) (1) (iii) of this section, from the party seeking the information that reasonable efforts have been made by such party to ensure that the individual who is the subject of the protected health information that has been requested has been given notice of the request; or ‘‘(B) The covered entity receives satisfactory assurance, as described in paragraph (e) (1) (iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e) (1) (v) of this section. ‘‘(iii) For the purposes of paragraph (e) (1) (ii) (A) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information if the covered entity receives from such party a written statement and accompanying documentation demonstrating that: ‘‘(A) The party requesting such information has made a good faith attempt to provide written notice to the individual (or, if the individual’s location is unknown, to mail a notice to the individual’s last known address); ‘‘(B) The notice included sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court or administrative tribunal; and ‘‘(C) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and: ‘‘(1) No objections were filed; or ‘‘(2) All objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution. ‘‘(iv) For the purposes of paragraph (e) (1) (ii) (B) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information, if the covered entity receives from such party a written statement and accompanying documentation demonstrating that: ‘‘(A) The parties to the dispute giving rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over the dispute; or ‘‘(B) The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal. ‘‘(v) For purposes of paragraph (e) (1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e) (1) (ii) of this section, an order of a court or of an administrative tribunal or a stipulation by the parties to the litigation or administrative proceeding that: ‘‘(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and ‘‘(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding. ‘‘(vi) Notwithstanding paragraph (e) (1) (ii) of this section, a covered entity may disclose protected health information in response to lawful process described in paragraph (e) (1) (ii) of this section without receiving satisfactory assurance under paragraph (e) (1) (ii) (A) or (B) of this section, if the covered entity makes reasonable efforts to provide notice to the individual sufficient to meet the requirements of paragraph (e) (1) (iii) of this section or to seek a qualified protective order sufficient to meet the requirements of paragraph (e) (1) (iv) of this section. ‘‘(2) Other uses and disclosures under this section. The provisions of this paragraph do not supersede other provisions of this section that otherwise permit or restrict uses or disclosures of protected health information. . . .’’ (Emphasis in original.) 13 Similarly, the plaintiff also asks us, as a matter of judicial economy in the event of a remand, to determine, as a matter of law, whether the defendant’s act of mailing the medical records into court in response to the subpoena complied with General Statutes § 52-143 and the federal regulatory provisions under HIPAA, namely, 45 C.F.R. § 164.512 (e) (1) (ii) and (iii), with respect to notifying the plaintiff or seeking a qualified protective order. See footnote 12 of this opinion. We address this claim in part II A of this opinion. 14 For additional background discussion of health care providers’ commonlaw duty to protect patient confidences, and the related cause of action, compare, for example, Biddle v. Warren General Hospital, 86 Ohio St. 3d 395, 715 N.E.2d 518 (1999), with Quarles v. Sutherland, 215 Tenn. 651, 389 S.W.2d 249 (1965). 15 ‘‘The Privacy Rule forbids an organization subject to its requirements (a ‘covered entity’) from using or disclosing an individual’s health information (‘protected health information’) except as mandated or permitted by its provisions . . . . ‘Covered entities’ generally include health plans, health care clearinghouses and health care providers such as physicians, hospitals and HMOs . . . . ‘Protected health information’ encompasses any individu- ally identifiable health information held or transmitted by a covered entity in any form or medium, whether electronic, paper or oral . . . .’’ (Citations omitted.) Arons v. Jutkowitz, 9 N.Y.3d 393, 412–13, 880 N.E.2d 831, 850 N.Y.S.2d 345 (2007); id. (discussing, inter alia, 45 C.F.R. §§ 164.502 [a] [1], 164.512 [e]). In the litigation context specifically, as reflected in 45 C.F.R. § 164.512 (e) (1) (i) and (ii), the ‘‘Privacy Rule also permits covered entities to use or disclose protected health information without authorization pursuant to a court or administrative order so long as only the protected health information covered by the order is disclosed . . . or in response to a subpoena, discovery request or other lawful process if the entity has received satisfactory assurances that the party seeking the disclosure has made reasonable efforts to ensure that the individual has been given notice of the request, or has made reasonable efforts to secure a qualified protective order from a court or administrative tribunal . . . .’’ (Citations omitted.) Id., 414; see footnote 12 of this opinion for the text of 45 C.F.R. § 164.512 (e). 16 See footnote 11 of this opinion. 17 Also exempted from preemption are: (1) provisions of state law approved by the secretary of the department subject to certain conditions; see 45 C.F.R. § 160.203 (a); (2) a ‘‘provision of [s]tate law, including [s]tate procedures established under such law, as applicable, [which] provides for the reporting of disease or injury, child abuse, birth, or death, or for the conduct of public health surveillance, investigation, or intervention’’; 45 C.F.R. § 160.203 (c); and (3) a ‘‘provision of [s]tate law [that] requires a health plan to report, or to provide access to, information for the purpose of management audits, financial audits, program monitoring and evaluation, or the licensure or certification of facilities or individuals.’’ 45 C.F.R. § 160.203 (d). 18 Title 42 of the United States Code, § 1320d-6 provides: ‘‘(a) Offense ‘‘A person who knowingly and in violation of this part— ‘‘(1) uses or causes to be used a unique health identifier; ‘‘(2) obtains individually identifiable health information relating to an individual; or ‘‘(3) discloses individually identifiable health information to another person, ‘‘shall be punished as provided in subsection (b) of this section. For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1320d-9 (b) (3) of this title) and the individual obtained or disclosed such information without authorization. ‘‘(b) Penalties ‘‘A person described in subsection (a) of this section shall— ‘‘(1) be fined not more than $50,000, imprisoned not more than [one] year, or both; ‘‘(2) if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than [five] years, or both; and ‘‘(3) if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, be fined not more than $250,000, imprisoned not more than [ten] years, or both.’’ 19 This question had been raised in connection with proposed language for 45 C.F.R. § 160.202 that would have specifically defined the application of the phrase ‘‘more stringent’’ in a variety of contexts, including stating that ‘‘more stringent’’ means, ‘‘[w]ith respect to penalties, provides greater penalties.’’ (Emphasis added.) Standards for Privacy of Individually Identifiable Health Information, 64 Fed. Reg. 59,918, 60,051 (November 3, 1999); see also id., p. 59,997 (explaining department’s initial decision to provide specific definitions). In the commentary to the final rule, the department stated that it had ‘‘reconsidered the proposed ‘penalty’ provision of the proposed definition of ‘more stringent’ and have eliminated it. The HIPAA statute provides for only two types of penalties: fines and imprisonment. Both types of penalties could be imposed in addition to the same type of penalty imposed by a state law, and should not interfere with the imposition of other types of penalties that may be available under state law. Thus, we think it is unlikely that there would be a conflict between state and federal law in this respect, so that the proposed criterion is unnecessary and confusing.’’ Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,582 (December 28, 2000). 20 We also note the body of case law establishing that, in the absence of a private right of action under HIPAA, the federal courts lack jurisdiction to remove actions containing a state law claim relying on HIPAA to support the standard of care. This body of case law indicates HIPAA’s failure to preempt state law causes of action by implication. See Hearn v. Reynolds, 876 F. Supp. 2d 798, 799–800 (S.D. Miss. 2012) (remanding removed case to state court because, although complaint stated that ‘‘publications amounted to HIPAA violations,’’ ‘‘HIPAA creates no private right of action’’ and complaint indicated that plaintiff ‘‘is concerned primarily with an intent to injure his standing in the community rather than a disclosure of his medical history’’); Baum v. Keystone Mercy Health Plan, 826 F. Supp. 2d 718, 721 (E.D. Pa. 2011) (remanding removed case to state court although HIPAA ‘‘is implicated because the federal statute requires [d]efendants to ‘reasonably safeguard protected health information,’ such as the information on the misplaced USB drive, ‘from any intentional or unintentional use or disclosure’ . . . this is a fairly straightforward state-law tort case’’ with claims of negligence, negligence per se and violations of Pennsylvania’s unfair trade practices statute); K.V. v. Women’s Healthcare Network, LLC, United States District Court, Docket No. 07-0228-CV-W-DW (W.D. Mo. June 6, 2007) (The court remanded the removed case, claiming negligence and negligence per se arising from HIPAA violations, to the state court because ‘‘the parties concede that various courts around the country have determined that there is no express or implied private cause of action under HIPAA. Additionally, the state law claim raised in [c]ount [9] does not raise a substantial federal question of great federal interest. The privacy standards imposed by HIPAA are not uniquely federal and do not raise any issue of great federal interest.’’); Harmon v. Maury County, United States District Court, Docket No. 1:05CV0026 (M.D. Tenn. August 31, 2005) (The court remanded the removed case to the state court because, although the plaintiffs’ negligence per se claims cited HIPAA privacy regulation, ‘‘Congress did not provide an exclusive federal remedy under HIPAA and HIPAA does not completely preempt state law. There is no compelling federal interest nor is a substantial federal question presented. [The] [p]laintiffs’ claims fall within that broad class of state law claims based on federal regulations in the state court, as described in [Grable & Sons Metal Products, Inc. v. Darue Engineering & Mfg., supra, 545 U.S. 308].’’). 21 We find misplaced the defendant’s reliance on the Kentucky decision in Young v. Carran, supra, 289 S.W.3d 586, and the Maine decision in Bonney v. Stephens Memorial Hospital, supra, 17 A.3d 123. The court in Young held only that HIPAA does not provide a private right of action—a proposition not challenged by the plaintiff in this appeal—and that the HIPAA regulations could not be used to support a negligence per se claim because of a Kentucky statute that previously had been interpreted by the state’s Supreme Court to limit negligence per se claims to violations only of Kentucky state statutes. See Young v. Carran, supra, 588–89, citing T & M Jewelry, Inc. v. Hicks ex rel. Hicks, 189 S.W.3d 526, 530 (Ky. 2006). Indeed, the Kentucky court indicated that a properly pleaded claim of negligence, rather than negligence per se, could be founded on federal regulatory violations, noting that, in T & M Jewelry, Inc., the Kentucky Supreme Court had ‘‘used provisions of the federal Gun Control Act of 1968 to define a duty of care for purposes of a common law negligence action—not a . . . negligence per se claim.’’ Young v. Carran, supra, 589. Bonney similarly held only that HIPAA did not afford the plaintiffs therein a private right of action, and specifically noted that ‘‘HIPAA standards, like state laws and professional codes of conduct, may be admissible to establish the standard of care associated with a state tort claim,’’ which is precisely what the plaintiff in this appeal seeks to do. Bonney v. Stephens Memorial Hospital, supra, 17 A.3d 127–28. Finally, we disagree with the defendant’s attempt to diminish the Utah Court of Appeals decision in Sorensen v. Barbuto, supra, 143 P.3d 299 n.2, which had rejected the claim that the plaintiff was ‘‘not entitled to a private right of action for breach of professional standards,’’ which included ‘‘HIPAA, the American Medical Association’s Principles of Medical Ethics, and the Hippocratic Oath.’’ The Utah court emphasized that the plaintiff therein did not contend that those provisions afforded him a private right of action, but ‘‘[r]ather . . . that the professional standards contribute to the proper standard of care . . . .’’ Id. Plainly implicit in this conclusion is that it is proper in Utah to utilize HIPAA as evidence of the standard of care in negligence actions. 22 Although it is not entirely clear from her brief, the record, or the allega- tions in the operative complaint whether the plaintiff seeks to use the HIPAA regulations simply as evidence of the standard of care, or as a basis for negligence per se, this lack of clarity does not affect our preemption analysis. We note, however, that whether the particular HIPAA regulations at issue are suitable for use as a legislatively imposed standard of care for purposes of establishing negligence per se is a potentially complex question of law that has not been adequately briefed by the parties herein, and therefore, is one that we need not decide in this appeal. See, e.g., Gore v. People’s Savings Bank, 235 Conn. 360, 380, 665 A.2d 1341 (1995) (‘‘[i]n deciding whether the legislature intended to provide for such statutory liability, we look to the language of the statute and to the legislative history and purposes underlying the provision’s enactment’’).
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
