Get Risk Analysis

Can You Sue for a HIPAA Violation? Legal Options Explained

Quick Answer
You cannot directly sue under HIPAA for damages. However, you can file a complaint with the HHS Office for Civil Rights, pursue claims under state privacy laws, medical malpractice statutes, or breach notification laws. Some violations may also be actionable under state tort law.

Myth vs. Reality

❌ Myth: You can sue a healthcare provider directly for HIPAA violations
Many people assume they can file a private lawsuit in court against a hospital or doctor for breaking HIPAA rules.
✓ Reality: HIPAA does not create a private right of action
HIPAA does not allow individuals to sue directly for damages. Only the U.S. Department of Health and Human Services (HHS) enforces HIPAA. However, you can pursue compensation through administrative complaints, state privacy laws, and other legal remedies.
❌ Myth: Filing a HIPAA complaint will get you paid immediately
Some believe that reporting to the HHS Office for Civil Rights results in automatic compensation to the victim.
✓ Reality: HHS complaints result in enforcement against the provider, not victim compensation
When you file a complaint with HHS, they investigate and may fine the healthcare provider, but the fine goes to the government, not you. Individual compensation requires separate state law claims or settlements.
❌ Myth: HIPAA violations can only be addressed through federal complaints
Some assume HIPAA is the only avenue for addressing privacy violations.
✓ Reality: Multiple legal pathways exist for HIPAA violations
Beyond HHS complaints, you can pursue claims under state breach notification laws, state consumer protection statutes, common law negligence, invasion of privacy, infliction of emotional distress, and data breach litigation. These paths may provide compensation.

Your Options When Your Privacy Has Been Violated

1. File a Complaint with HHS Office for Civil Rights

How it works: You can file a formal complaint with HHS describing the HIPAA violation. HHS investigates and may impose penalties on the covered entity.

What you get: No direct compensation to you, but the healthcare provider may be fined and forced to implement compliance improvements.

Deadline: Generally 180 days from discovery of the violation, though some states extend this.

2. Sue Under State Breach Notification Laws

How it works: If a healthcare provider fails to notify you of a data breach in a timely manner, you may have a claim under state law.

What you get: Actual damages (identity theft costs, credit monitoring), statutory damages per violation, and attorney fees in some states.

Examples: California, New York, and other states have specific breach notification requirements with private causes of action.

3. Pursue Common Law Claims

Invasion of Privacy: Suing for wrongful disclosure of private health information

  • Requires showing the provider made private facts public
  • Must demonstrate offense to reasonable person
  • Can recover emotional distress damages

Negligence: Healthcare provider failed to protect health information with reasonable care

  • Must show duty of care, breach, causation, and damages
  • Can recover economic damages and pain/suffering

4. File Class Action Litigation

How it works: If multiple people are affected by the same breach, attorneys may file class actions under various state laws.

Potential compensation: Settlements often include identity theft monitoring services, damages per class member, and attorney fees.

5. Pursue State Attorney General Complaints

How it works: Report the violation to your state's attorney general, who may pursue enforcement actions on your behalf.

Benefits: No cost to you; investigation by government agency; potential settlement funds for affected consumers.

Factors That Strengthen Your Case

  • Clear evidence of improper disclosure or breach
  • Documentation of damages (credit fraud, identity theft costs)
  • Proof of emotional distress (medical records, therapy documentation)
  • Pattern of violations by the provider
  • Failure to implement reasonable security measures
  • Prior notice of vulnerability or complaints

Frequently Asked Questions

Q: How do I file a complaint with HHS Office for Civil Rights?
A: Visit the HHS OCR website and submit a complaint form describing the violation, dates, and parties involved. You can file online, by mail, or phone. Include specific details about how your privacy was violated.
Q: What damages can I recover if I sue under state law?
A: You may recover actual damages (medical monitoring, identity theft costs), statutory damages (per-violation penalties), emotional distress damages, attorney fees, and costs. State laws vary significantly.
Q: Is there a deadline to file a HIPAA complaint?
A: Generally 180 days from discovery of the violation. Some states extend this. Always file promptly and consult an attorney about state-specific deadlines and longer limitations periods for other claims.
Q: Should I hire an attorney to pursue a HIPAA violation claim?
A: For HHS complaints, you may file yourself. For lawsuits, class actions, or state claims, an attorney is highly recommended. Many privacy lawyers work on contingency (no upfront fees).

Protect Your Organization from HIPAA Liability

Get a comprehensive security risk analysis to identify vulnerabilities that could lead to violations, complaints, and lawsuits.

Get Your Risk Analysis →