Unless it has changed in the last two years, an individual with access to medical records is absolutely, personally—as an individual—liable for failure to follow the rules.
You release my STD report on Twitter, and you lose, the lab loses, the company loses..you all lose.
“Every district court that has considered this issue is in agreement that the statute does not support a private right of action.” Acara v. Banks, 470 F.3d 569, 571–72 (5th Cir. 2006).
There is no private right of action under HIPAA, express or implied. Meadows v. United Servs., 963 F.3d 240, 242 (2d Cir. 2020).
No private right of action exists under HIPAA in any event, Lucero v. United States, No. 20-1163, 2021 U.S. App. LEXIS 6308, at *6 (10th Cir. Mar. 4, 2021)
HIPAA does not provide an express or implied private right of action... Kittel v. Advantage Physical Therapy, No. 19-55690, 2021 U.S. App. LEXIS 1185, at *3 (9th Cir. Jan. 15, 2021).
HIPAA “provides no private right of action.” Webb v. Smart Document Sols., LLC, 499 F.3d 1078, 1081 (9th Cir. 2007).
It is up to the GOVERNMENT to pursue any HIPAA violations. Citizens can file a complaint with HHS, but they can’t file a lawsuit based on a HIPAA claim.
There may be State common law claims regarding the privacy of medical information, but those are distinct and separate from HIPAA and wouldn’t necessarily apply to a situation like this.
I am as against the idea of a “vaccine passport” as anyone. I won’t participate in such a system. However, the people who think HIPAA is a magic talisman here are sorely mistaken.
I worked at an insurance company and if you left a personal file unsecured on your desk, you would be warned and potentially terminated if it was a pattern.