MN court: HIPAA doesn't prevent state suits for wrongful EMR disclosure

A Minnesota appellate court ruled recently that HIPAA does not preempt contradictory state laws allowing patients to sue for wrongful disclosure of patient records.

A woman who visited Fairview Cedar Ridge Clinic in Apple Valley, MN, to get tested for sexually transmitted diseases when she took on a new sexual partner while estranged from her husband had her electronic records posted on MySpace by a relative of the husband. The patient sued under state law, but a trial court threw out the case on the grounds that HIPAA prohibits private lawsuits for violating federal privacy rules.

But the Minnesota Court of Appeals ruled that the state law does not contradict HIPAA and allowed the suit to go through. The case has been remanded to the lower court for trial.

To read more about this potentially significant case:
- check out this Thompson Publishing Group report
- see the appellate court's actual ruling (.pdf)