Hospital Portal Disclosed a Foster Parent's Contact Information

Attorney Answer

Yes, this looks like a privacy failure — but HIPAA itself will not get you into court. Your two real moves are a federal complaint to the Office for Civil Rights and a state-law claim in West Virginia, and one of them has a 180-day clock.

HIPAA is enforced by the federal government, not by patients. You file an administrative complaint; you do not file a HIPAA lawsuit. Under 45 C.F.R. § 160.306(b)(3), that complaint "must be filed within 180 days of when the complainant knew or should have known that the act or omission complained of occurred, unless this time limit is waived by the Secretary for good cause shown." You learned of this when the text arrived, so the clock is already running.

Your claim in state court is separate and is not blocked by HIPAA. In R.K. v. St. Mary's Medical Center, Inc., 229 W. Va. 712, 735 S.E.2d 715 (2012), West Virginia's highest court held that common-law tort claims based on the wrongful disclosure of medical or personal health information are not preempted by HIPAA, because such state-law claims are not inconsistent with HIPAA and instead complement it by enhancing the penalties for its violation. The trial court's dismissal of those claims on preemption grounds was error, and the case was reversed. Two honest caveats. R.K. involved hospital employees improperly accessing and disclosing records — close to your facts, but not identical to a patient portal that auto-populated a guardian's contact details. And the same opinion dealt with whether the West Virginia Medical Professional Liability Act governs claims like these, which carries pre-suit notice and screening-certificate requirements. Do not assume you can simply file; that question has to be answered first.

What you can do

1. Screenshot the text messages — the number, the words "I got your name and number off of MyChart," the date and time — and save them somewhere other than your phone. 2. Write to the hospital's Privacy Officer (not the front desk, not the doctor) today. Ask in writing for: your information to be removed from the child's portal-visible record, a written explanation of how it was disclosed, and an accounting of disclosures. 3. File the complaint with the HHS Office for Civil Rights at hhs.gov/ocr. It is free, you do not need a lawyer, and it is the step with the deadline. 4. Notify the child's caseworker and the placement worker in writing, and tell the court at the next hearing. This is a placement-safety issue, not only a privacy one — the bio parent now has your address. 5. Ask the court or your caseworker about address-confidentiality protections and about whether the no-contact terms are being violated. 6. Talk to a West Virginia lawyer about a state-law privacy claim and, first, whether the Medical Professional Liability Act's pre-suit steps apply to it.

⏱ Time limits apply. The administrative complaint deadline is set by 45 C.F.R. § 160.306(b)(3) — 180 days from when you knew or should have known — and it can be waived only for good cause. Your state-law claim runs on a separate and different clock. Both depend on the specific dates in your case.