Understanding a Possible HIPAA Privacy Violation

Attorney Answer

With only "email" identified so far, there isn't yet enough detail to say whether a HIPAA violation occurred — but one thing cannot wait: a complaint to HHS must generally be filed within 180 days of when you knew or should have known about the disclosure, so please tell us the date this happened, because if it was more than 180 days ago, that window may already be closing or closed.

HIPAA is federal law, not a state law — it applies the same way in Kentucky as everywhere else. Importantly, HIPAA does not give you a personal right to sue over a disclosure; it is enforced through a complaint to the U.S. Department of Health and Human Services Office for Civil Rights (OCR). Under 45 C.F.R. § 160.306, that complaint must generally be filed within 180 days of when you knew or should have known about the disclosure, unless HHS waives the deadline for good cause shown. Any personal claim for damages would need to rest on a separate legal theory, such as a general breach-of-confidentiality or negligence claim, rather than HIPAA itself.

What you can do:

1. Identify the exact date you learned your health information was disclosed by email, and write it down now.

2. If it has been under 180 days, file a complaint with HHS OCR promptly.

3. Ask a local attorney whether a separate state-law claim, such as breach of confidentiality or negligence, may also apply to your situation.

⏱ Time limits apply. HHS OCR complaints must generally be filed within 180 days of when you knew or should have known about the disclosure. Have a local attorney review your timeline promptly to confirm where you stand.