CT Supreme Court Decision Creates a New Cause of Action for Breach of Medical Confidentiality

by Gregory J. Pepe

The Connecticut Supreme Court will allow a case to go forward under a new cause of action in Connecticut. Byrne v. Avery Center for Obstetrics and Gynecology, P.C., 327 Conn. 540 (2018) holds that in some circumstances a medical practice can be held liable for the disclosure of an individual’s medical records when the individual has not consented to the release. In the past, although federal HIPAA regulations created rules for the protection of confidential medical records, there was no private cause of action when that protection was compromised.

In Byrne, a woman was a patient of the defendant medical practice. As is standard practice for virtually all practices these days, the practice disclosed its patient confidentiality terms in a written document, pledging not to disclose the patient’s medical records without her consent, except in circumstances required by law. The patient had a relationship with a man but she instructed the defendant not release her medical records to him. When the plaintiff moved to Vermont, the man filed a paternity action against her and sought her medical records regarding that suit. The man’s attorney issued a subpoena for the records, and the medical practice simply turned them over pursuant to the subpoena.

The procedural history of the case is long, and the case was dismissed twice based on the law as it stood at the time of the dismissals.

In deciding to adopt a new common law cause of action, the Court explained that it looks to see whether “…existing judicial remedies are sufficient to compensate those who seek the recognition of the new cause of action …”. In examining the Byrne case, the Court concluded that no such remedy existed in Connecticut, and allowed the case to move forward. The Court also found that a subpoena is not an order of the court, which would have permitted the records to be disclosed under HIPAA.

Medical practitioners should evaluate the policies surrounding the release of medical records considering this decision, and make certain that those in your office authorized to deliver medical records understand the nuance of this case, and the new financial risk associated with making the wrong decision. The days of a mistake without financial consequences are apparently over.

Gregory J. Pepe

Gregory J. Pepe, founding principal, practices in the areas of commercial finance, healthcare law, alternative dispute resolution and mediation, and general business law. Attorney Pepe represents numerous physician groups, including large integrated practices, IPAs, and PHOs. He has been an advisor to many state medical societies, including the Connecticut State Medical Society regarding physician practice management issues within the context of organized medicine, and regarding initiation of litigation by medical societies against managed care companies.