Abney Law is proud to announce a significant appellate victory in W.L. v. UofL Health-Louisville, Inc., et al., a case that has major implications for patient privacy rights in Kentucky. On January 31, 2025, the Kentucky Court of Appeals issued a published opinion reversing the dismissal of our client’s claims and remanding the case for further proceedings.
Background of the Case
Our client, W.L., was an employee at Peace Hospital, a behavioral health facility operated by UofL Health. In October 2020, after seeking treatment at the facility where he worked, W.L. learned that his confidential medical records had been improperly accessed by numerous colleagues who were not involved in his care. The unauthorized access of his records, which contained highly sensitive personal and medical information, caused him severe emotional distress and ultimately led to his resignation.
In response, W.L. filed suit against UofL Health, alleging claims of common law invasion of privacy and negligence. However, the trial court dismissed his claims, ruling that they were preempted by the Health Insurance Portability and Accountability Act (HIPAA). The trial court relied on Doe v. Ashland Hospital Corporation, an unpublished case, to conclude that HIPAA preempted all state common law claims based on improper access to medical records.
The Appellate Court’s Decision
On appeal, Abney Law successfully argued that HIPAA does not preempt state-law claims for invasion of privacy and negligence. The Kentucky Court of Appeals agreed, issuing an important decision that makes clear that individuals in Kentucky have the right to pursue legal action when their private medical information is unlawfully accessed.
The Court emphasized that while HIPAA does not provide a private right of action, it does not bar individuals from bringing common law claims under Kentucky law. In its ruling, the Court stated:
“HIPAA does not categorically bar all state law claims seeking redress for the wrongful disclosure of HIPAA-protected information. To the extent that Doe v. Ashland implicitly reached the opposite conclusion, we decline to follow suit.”
What This Means Moving Forward
This decision sets an important precedent for privacy rights in Kentucky. It reaffirms that patients and employees in healthcare settings can seek justice when their sensitive medical information is wrongfully accessed. Employers and healthcare providers must take proper precautions to protect confidential health records or risk liability under state law.
Abney Law remains committed to fighting for individuals whose rights have been violated. This victory is a testament to our dedication to ensuring that privacy laws are upheld and that those harmed by wrongful actions have a path to justice.
Contact Us
If you believe your privacy rights have been violated or you have been retaliated against for reporting misconduct, contact Abney Law today. We are here to help you navigate your legal options and fight for the justice you deserve.