Menorah Park Center for Senior Living v. Rolston

Summary

The Supreme Court of Ohio held that HIPAA does not preempt an Ohio common-law claim for unauthorized disclosure of confidential medical information. The court recognized an exception to liability when a medical provider reasonably limits the disclosure to the minimum information necessary to file a successful action for unpaid medical bills. The court reversed the Eighth District Court of Appeals and remanded the cause to the trial court.

Holdings

1. HIPAA and the HIPAA Privacy Rule do not preempt Ohio's common-law cause of action for the unauthorized, unprivileged disclosure of nonpublic medical information recognized in Biddle.
2. A medical provider has a qualified privilege under Biddle to disclose patient information for the purpose of obtaining payment for medical services when the provider reasonably limits the disclosure to the minimum amount necessary to state a successful claim for unpaid charges.
3. Menorah Park's disclosure fell within the Biddle exception because the attached bills disclosed only the provider's and patient's names and addresses, service dates, billing or procedure codes, general categories of services, and amounts charged, paid, and due.
4. Biddle remains good law and need not be overruled or modified.

Questions Presented

1. Whether HIPAA and the HIPAA Privacy Rule preempt Ohio's common-law claim under Biddle for unauthorized disclosure of nonpublic medical information.
2. Whether HIPAA's minimum-necessary standard may inform the scope of Ohio's Biddle tort without creating a private cause of action under HIPAA.
3. Whether a medical provider has a qualified privilege under Biddle to disclose a limited amount of patient information in a court filing seeking payment of unpaid medical bills.
4. Whether Menorah Park's attached billing statements disclosed only the minimum amount of medical information necessary to state a claim for payment.

Disposition

reversed_and_remanded