Byrne v. Avery Center for Obstetrics & Gynecology, P.C.

Summary

The court held that HIPAA does not preempt state common-law negligence and negligent-infliction-of-emotional-distress claims based on a health care provider's alleged improper disclosure of medical records in response to a subpoena. HIPAA and its implementing regulations may inform the applicable standard of care, but they do not create the cause of action. The court reversed the dismissal of those claims and declined to decide whether the Connecticut confidentiality statute independently creates a private right of action.