Connecticut Ruling Finds HIPAA Does Not Preempt State Law Claims
On November 11, 2014, the Connecticut Supreme Court held in Emily Byrne v. Avery Center for Obstetrics and Gynecology, P.C. (“Avery Center”) (SC 18904) that the federal Health Insurance Portability and Accountability Act (“HIPAA”) does not preempt state common law negligence and emotional distress claims against medical providers who improperly breach the confidentiality of a patient’s medical records and that “HIPAA may inform the applicable standard of care in certain circumstances.” In reaching its decision, the high court reversed the trial court’s dismissal of plaintiff Emily Byrne’s state common law causes of action for negligence and negligent infliction of emotion distress against Avery Center for releasing information about her pregnancy without her authorization in complying with a subpoena in a paternity action. Although other states have reached similar holdings, the Connecticut ruling is notable in light of the passage of the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, which expanded HIPAA liability to business associates. As such, covered entities as well as their business associates risk increased exposure under HIPAA and state laws, including negligence, invasion of privacy and state privacy claims.
Previewing the 114th Congress
Republicans scored historic victories in Tuesday night’s midterm elections, retaking the Senate majority for the first time since 2006 by adding at least seven seats and possibly as many as 10. The GOP increased its majority in the House of Representatives by at least 13 seats (with some races still undecided), achieving the largest House Republican majority since the Hoover Administration. And Republicans added three more governors to their ranks.
The End of the Road for CIPA Class Actions?
California has been experiencing a wave of putative class actions under the California Invasion of Privacy Act (“CIPA”). A decision this week by a federal court judge in California could halt new case filings and lay the groundwork for the dismissal of pending actions.
Ninth Circuit Rules In Favor of Redbox Under Song-Beverly Credit Card Act
Consumer class actions under California’s Song-Beverly Credit Card Act have been shaped by significant case law developments over the last few years. Friday’s Ninth Circuit decision in Sinibaldi v. Redbox is a decisive victory for retailers of rented goods which will allow them wide latitude to collect personal information, such as zip codes, when using credit cards as a form of security.
Heads Up for Privacy, Data Protection and Cybersecurity in 2014
The new year will ring in significant privacy, data protection and cybersecurity changes in the U.S., Europe, Asia and elsewhere around the world. Below are some key developments and possible concrete action items for General Counsels, Chief Privacy Officers and Chief Information Officers:
California Anti-Spam Law Is Toughest In The Nation, But May Be Superseded By Impending Federal Legislation
On January 1, 2004, a bill recently signed by Governor Gray Davis will take effect that has been hailed by many as the toughest anti-spamming law in the nation. With narrow exceptions, the bill, SB 186, prevents marketers and advertisers from sending unsolicited email advertisements from California, regardless of whether the recipient is located in or outside the state. Targeting marketers and advertisers located outside California, SB 186 also prohibits sending unsolicited commercial email advertisements to a California email address. However, as explained below, SB 186 may well eventually be superseded by impending federal legislation.
California’s Office of Privacy Protection Issues – Recommendations on Notification of Security Breaches Involving Personal Information
The recent release of new guidelines on responding to computer security breaches offer important guidance for all companies with valuable electronic information. On October 10, 2003, the Office of Privacy Protection within the State of California’s Department of Consumer Affairs issued its “Recommended Practices on Notification of Security Breach Involving Personal Information.” The Office of Privacy Protection is tasked with recommending policies and practices that protect California consumers’ privacy.
California Supreme Court Resolves Apparent Conflict Between Trade Secret Law And Free Speech Rights
In a recent case of first impression, the California Supreme Court unanimously held a trial court’s preliminary injunction preventing publication of a computer program for descrambling digital video disks did not violate the defendant’s free speech rights, assuming the trial court properly issued the injunction under California’s trade secret law. In its August 25, 2003 decision in DVD Copy Control Assoc., Inc. v. Andrew Bunner, the Court resolved an apparent conflict between the free speech clauses of the United States and California Constitutions and California’s trade secret laws. This decision is significant because it is one of the first in the country to deal with the interplay between the free speech rights of parties who wish to publish technical information on the Internet and the property rights of parties who claim trade secret ownership in such information.