Probably. The Health Insurance Portability and Accountability Act (HIPAA) is designed to require “covered entities” to protect your private health information from being unnecessarily disclosed. Generally, a covered entity can use your health information for treatment, payment, or office operations.
HIPAA is enforced by the Office of Civil Rights (OCR) through the Department of Health and Human Services. HIPAA does not provide a private right of action to patients. This means that a patient cannot sue a covered entity directly under HIPAA. If a patient believes HIPAA has been violated, their recourse is to file a complaint with the covered entity or the OCR.
In some states, though, individuals have attempted to bring HIPAA violations indirectly through applicable state laws, most commonly through state tort laws for invasion of privacy.
This is not an argument that is likely to succeed in Idaho courts. First, the Idaho Supreme Court has found that “HIPAA does not itself create a protectable Fourth Amendment interest.” State v. Mubita, 145 Idaho 925, 188 P.3d 867 (2008). Secondly, the violation of HIPAA would have to include “publicity” of the private information to be actionable under an invasion of privacy theory. Peterson v. Idaho First Nat. Bank, 83 Idaho 578, 367 P.2d 284, (1961) (“absent communication to the public, no liability attaches.”). Most HIPAA complaints involve the disclosure of information to private individuals and not public disclosures.
However, Idaho courts have left room to argue the HIPAA violations may be actionable under a breach of contract theory. In other words, there is an agreement that the health care provider will keep health care records private. Disclosure of the private records, whether public or not, violates that agreement.
The main problem with a case under a breach of contract theory is that it may be limited in the types of damages that could be recovered. See Thomas v. Med. Ctr. Physicians, P.A., 138 Idaho 200, 211, 61 P.3d 557, 568 (2002).
Another avenue may be to assert claims for negligent infliction of emotional distress. Again, as far as I can tell, this has been untested in the Idaho courts.