Byrne v. Avery Center for Obstetrics & Gynecology, P.C.

The Avery Center for Obstetrics and Gynecology (Avery) (defendant) provided Emily Byrne (plaintiff) with medical care and treatment. Avery provided all patients, including Byrne, with notice of its privacy policy regarding protected health information. Avery agreed, based on this policy and on law, that it would not disclose Byrne’s health information without her authorization. Byrne specifically instructed Avery not to release her medical records to Andro Mendoza, Byrne’s former boyfriend. When Mendoza filed a paternity suit against Byrne, Avery received a subpoena requesting Byrne’s medical records. Without notifying Byrne, Avery mailed a copy of Byrne’s medical file to the court. Mendoza then informed Byrne that he reviewed her medical record in the court file. Byrne filed a motion to seal her medical record, which the court granted. Byrne sued Avery, arguing, among other things, that Avery negligently failed to use proper care in protecting Byrne’s medical records and that Avery’s conduct amounted to negligent infliction of emotional distress. Both the negligence and negligent-infliction claims were brought under state law. In defense, Avery argued that the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) preempted any action dealing with the improper disclosure of medical information. The trial court agreed with Avery and also noted that HIPAA itself did not create a private right of action against healthcare providers. Byrne appealed, arguing that common-law negligence actions complemented rather than obstructed HIPAA and therefore were not preempted. The Connecticut Supreme Court heard the appeal.