On June 15, 2018, the U.S. District Court for the District of Columbia ruled that the HIPAA statute does not provide a private cause of action. A patient at a hospital in Washington, District of Columbia, claimed that the medical intake computer station violated HIPAA’s privacy protections. She filed a complaint with the Office for Civil Rights (OCR) and the District of Columbia’s Office of Human Rights, but neither would pursue her claims.

The District Court noted that other federal courts that have considered the issue “have reached a consensus that the statutory language of HIPAA grants no private right of action.” 

The case is Lee-Thomas v. LabCorp., No. 18-591 (RC) (D.D.C. June 15, 2018).