A Missouri federal district court has ruled, in I.S. v. Washington University, that a HIPAA-covered entity’s disclosure of protected information can form the basis for a state-law negligence claim.  The Court reached this holding despite the well-accepted principle there is no private cause of action under HIPAA. 

The plaintiff, I.S., was undergoing medical treatment …