YOUNG (BILLIE R.) VS. CARRAN (ROBERT), ET AL.Annotate this Case
RENDERED: OCTOBER 24, 2008; 2:00 P.M.
TO BE PUBLISHED
Commonwealth of Kentucky
Court of Appeals
BILLIE R. YOUNG
APPEAL FROM KENTON CIRCUIT COURT
HONORABLE MARTIN J. SHEEHAN, JUDGE
ACTION NO. 07-CI-02273
ROBERT CARRAN AND TALIAFERRO,
SHIROONI, CARRAN & KEYS, PLLC
** ** ** ** **
BEFORE: KELLER AND WINE, JUDGES; LAMBERT,1 SENIOR JUDGE.
LAMBERT, SENIOR JUDGE: The issue presented is whether Appellant may
maintain a private cause of action against an opposing law firm for violation of the
Health Insurance Portability and Accountability Act of 1996 (HIPAA) 2 for the
Senior Judge Joseph E. Lambert sitting as Special Judge by assignment of the Chief Justice
pursuant to Section 110(5)(b) of the Kentucky Constitution and Kentucky Revised Statutes
The provisions of HIPAA pertinent to this case are codified at 42 U.S.C. §§ 1320d to 1320d-8.
inadvertent disclosure of her medical and psychiatric records to the opposing party
in child custody litigation. The trial court granted summary judgment as to the
HIPAA claim and all claims. This appeal followed.
This case arose out of a child custody dispute between Young and her
child’s father, John Martin. Martin was originally represented by Christopher J.
Mehling, an attorney with Taliaferro, Shirooni, Carran & Keys. During the
litigation, Young and Martin signed an agreed order whereby Young was required
to provide Mehling with authorizations sufficient to obtain her medical and
psychiatric records. The order also provided that those records could be reviewed
by Mehling but were not to be shown or provided to Martin. All records were to
be returned to Young. Some time after acquiring the medical records from a
facility named NorthKey, Mehling was elected judge of the Kenton Family Court
and his representation of Martin was discontinued. Appellee Robert Carran gave
notice of substitution of counsel on December 22, 2006.
Soon thereafter, Martin decided that he no longer wished to be
represented by the Taliaferro firm, so he requested a partial refund of his retainer
fee and his file. In April 2007, Martin went to Carran’s office and picked up a
package that contained his file and a refund check. Martin then got into his truck,
opened the package, and looked inside long enough to find and remove his check.
While doing so, he discovered a separate packet of material with “NorthKey”
written on top, but did not read any of the documents contained therein. Martin
then placed the entire package under the seat of his truck. About two weeks later,
he looked for the package and found that it was missing. He later learned that
Young had taken it from his truck, a fact Young admits.
On June 21, 2007, Carran received a letter from Eric C. Deters,
Young’s attorney, concerning the medical records and the fact that they had been
given to Martin. The correspondence between Deters and Carran was acrimonious,
and on July 31, 2007, Young filed suit against Carran and the Taliaferro firm.
Young’s complaint contained five separate claims for damages all arising from the
disclosure of Young’s medical records to Martin: (1) intentional infliction of
emotional distress; (2) negligence; (3) violation of privacy rights; (4) violation of
HIPAA; and (5) breach of contract. Young alleged that as a result of Appellees’
actions she had suffered severe emotional distress, depression, anxiety, and other
On September 20, 2007, Appellees filed an answer to Young’s
complaint along with a motion for summary judgment as to all of her claims. On
January 3, 2008, the trial court granted the motion for summary judgment. The
court held that HIPAA does not create a private cause of action for violations such
as those alleged by Young. With respect to Young’s HIPAA claim, the court
further held that KRS 446.070 is limited in applicability to state statutes and does
not apply to federal laws such as HIPAA or the laws of other states.
On appeal, Young abandoned all of her trial court claims except the
claim for damages based on an alleged HIPAA violation. Young argues that
summary judgment was improper as to her claim that Appellees violated her rights
under HIPAA by providing her medical records to Martin. This court has recently
held that HIPAA does not create a state-based private cause of action for violations
of its provisions. McMillen v. Kentucky Dept. of Corrections, 233 S.W.3d 203,
205 (Ky. App. 2007). We also note that federal courts have uniformly held that
HIPAA does not create a private cause of action even at the federal level. See,
e.g., Acara v. Banks, 470 F.3d 569, 571-72 (5th Cir. 2006); Doe v. Board of
Trustees of University of Illinois, 429 F.Supp.2d 930, 944 (N.D. Ill. 2006);
Dominick J. v. Wyoming Valley West High School, 362 F.Supp.2d 560, 573 (M.D.
Pa. 2005); Logan v. Dept. of Veterans Affairs, 357 F.Supp.2d 149, 155 (D.D.C.
2004); University of Colorado Hosp. v. Denver Pub. Co., 340 F.Supp.2d 1142,
1145 (D. Colo. 2004).
Young attempts to circumvent this authority by arguing that KRS
446.070 creates a state cause of action for a violation of HIPAA. KRS 446.070
codifies the common-law doctrine of “negligence per se” in Kentucky. Davidson
v. American Freightways, Inc., 25 S.W.3d 94, 99 (Ky. 2000). Negligence per se
“is merely a negligence claim with a statutory standard of care substituted for the
common law standard of care.” Real Estate Marketing, Inc. v. Franz, 885 S.W.2d
921, 926-27 (Ky. 1994), quoting Atherton Condominium Apartment-Owners
Association Board of Directors v. Blume Development Company, 115 Wash.2d
506, 799 P.2d 250 (1990). KRS 446.070 provides an avenue by which a damaged
party may sue for a violation of a statutory standard of care if the statute in
question provides no inclusive civil remedy and if the party is within the class of
persons the statute is intended to protect. Hargis v. Baize, 168 S.W.3d 36, 40 (Ky.
2005). It provides that “[a] person injured by the violation of any statute may
recover from the offender such damages as he sustained by reason of the violation,
although a penalty or forfeiture is imposed for such violation.” KRS 446.070.
Young’s claim in this regard must fail because Kentucky courts have
held that the “any statute” language in KRS 446.070 is limited to Kentucky statutes
and does not extend to federal statutes and regulations or local ordinances. T & M
Jewelry, Inc. v. Hicks ex rel. Hicks, 189 S.W.3d 526, 530 (Ky. 2006); Alderman v.
Bradley, 957 S.W.2d 264, 266-67 (Ky. App. 1997). The General Assembly did not
intend it “to embrace the whole of federal laws and the laws of other states and
thereby confer a private civil remedy for such a vast array of violations.” T & M
Jewelry, Inc., 189 S.W.3d at 530. Therefore, the trial court’s dismissal of Young’s
HIPAA claim via KRS 446.070 was proper.
Young next contends that 42 U.S.C. § 1320d-6 and its corresponding
regulations impose a duty of care on Appellees allowing for a Kentucky “common
law” negligence per se claim. Young’s reliance upon T & M Jewelry, Inc. v. Hicks
ex rel. Hicks, supra, in support of her argument is misplaced. In that case, the
Supreme Court of Kentucky used provisions of the federal Gun Control Act of
1968 to define a duty of care for purposes of a common law negligence action –
not a KRS 446.070 negligence per se claim. See T & M Jewelry, Inc., 189 S.W.3d
at 532. Indeed, the Court expressly refused to apply the act in a negligence per se
context. Id. at 530. Therefore, her claim must be rejected.
Young’s remaining arguments relating to HIPAA preemption of KRS
210.235 and 422.317 were not presented in the trial court. For failure of
preservation, we decline to consider the claims. Regional Jail Authority v. Tackett,
770 S.W.2d 225, 228 (Ky. 1989).
The judgment of the Kenton Circuit Court is affirmed.
BRIEF FOR APPELLANT:
BRIEF FOR APPELLEES:
Eric C. Deters
Donald L. Stepner
Jeffrey A. Stepner