"HIPAA does not provide a private cause of action to individuals affected by a health care privacy breach. This means that an individual whose PHI has been used or disclosed by a health care provider in violation of HIPAA may not bring a civil claim against the health care provider under HIPAA. Moreover, HIPAA specifically preempts any contrary provision of state law ... Recent decisions by state courts, however, have held that HIPAA is the standard industry practice for health care providers and may form the basis for state law negligence claims involving disclosure of patient medical records."  MORE >>