Summary:
Following the disclosure in more than 4,200 Proofs of Claim by Wake Med of personal identifying information, several Debtors sought sanctions for violations of Federal Rule of Bankruptcy Procedure 9037, HIPAA, and 11 U.S.C. §107.
The bankruptcy court held that it was not a “HIPAA compliance tribunal” and might not have jurisdiction to decide such claims. Further, “[t]he case law overwhelmingly holds that there is no private right of action under HIPAA or §107 ”, leaving Rule 9037 as the primary remedy. Where, however, ““it was shown that a creditor flaunted the law with knowledge of its proscriptions, failed to take remedial action once violations were discovered, or acted deliberately as opposed to mistakenly or inadvertently”, Carter v. Flagler Hospital, Inc. (In re Carter), 411 B.R. 730 (Bankr. M.D. Fla. 2009)(quoting Newton v. ACC of Enter. (In re Newton), A.P. No. 08-1106-DHW, 2009 WL 277437, *5 (Bankr. M.D. Ala. Jan. 29, 2009), the bankruptcy court held that § 105(a) provided authority to sanction parties for contempt.
Following a review of the procedures and failures by Wake Med, the bankruptcy court held that based on “the magnitude of the violation, and the fact that there was no supervision or training, indicates that Wake Med was more than negligent” and was, in fact, “unforgivable.” Accordingly, in additional requiring payment of damages to the Debtors and attorneys’ fees (totaling more than $80,000), Wake Med was required to pay $50,000 to the Clerk of Court and is subject to on-going reporting and training requirements under the supervision of the Bankruptcy Administrator.
Commentary:
While the bankruptcy court held that is no private right of action under HIPAA, this only partially accurate in North Carolina. In Acosta v. Byrum, 638 SE 2d 246 (N.C. Ct. App. 2006), a HIPAA violation was found to be a breach of the standard of care and thus actionable, basically as medical malpractice. Further, it is not clear what court would constitute a “HIPAA compliance tribunal” with greater jurisdiction over Proofs of Claim than the bankruptcy court. There does not appear to have been a request that the reference of this case be withdrawn back to the federal district court or that the North Carolina Board of Medical Examiners was alerted to this serious violation.
For a copy of the opinion, please see:
Branch- Sanctions for Disclosure of Personal and Medical Information in Proof of Claim
Acosta v. Byrum- HIPAA Violation as Medical Malpractice
Blog comments