Hi, my question is reguarding the statut of limitations on HIPAA violations. My experience is complicated but i will make short. I began goi...

Question

Hi, my question is reguarding the statut of limitations on HIPAA violations. My experience is complicated but i will make short. I began going to a new doctor and after several visits for stomach issues was ordered for a CT scan. Well a few of my co workers also went to this doctors office and were even friends with the nurses there at the time. When my results came back, i went to work and told my co workers it was just my gaul bladder and one of them stated "yeah I already knew one of the girls let me know", she just acted like she was that concerned. It bothered me that my confidntial information was leaked out and someone else knew before I knew. What if it would have been something that was really sensitive or worse? Well during this time i was going through some emotional things and placed on several different anti depressants which really had me out of wack for a while, I guess thats why I did not really say anything about it at the time. This has been about a year ago now and I need to go back to the doctor but really don't want to go because of that incident I don't feel my information would be confidential there. I haven't found a new doctor and it just frustates me that now I am inconvenienced by there indiscretion, which is what brings me to my question about limit of statut for HIPAA violations.

Answer

1- The statute of limitations for a HIPAA enforcement action is six years. The complainant files a complaint with the Dept. of Health and Human Services (HHS) and they decide if there should be any civil fines or criminal penalties.

2-The complainant (patient) does not get any restitution (aka money) out of a HIPAA violation penalty enforced by HHS. The fine is paid directly to the government.

3-If you want to recover money for personal damages, you will need to file suit under for a tort (usually invasion of privacy) in state court. It is still wise to file a HIPAA violation complaint with HHS because a proven HIPAA violation will provide a strong foundation for the invasion of privacy action in state court.

4-Be aware, the state court invasion of privacy action will have its own statute of limitations, which is shorter than six years. In NC, it is typically three years.