A lawyer who handles health-information privacy, medical confidentiality, or data breaches is usually the best starting point after an improper medical disclosure. However, HIPAA itself generally does not give an individual a private lawsuit for damages. In Acara v. Banks, the Fifth Circuit expressly rejected a private cause of action under HIPAA. A lawyer must therefore identify an available legal claim rather than simply label a complaint a “HIPAA lawsuit.” [1]
Rules that determine the answer
An administrative complaint is a separate option. The HHS Office for Civil Rights accepts complaints against covered entities and business associates, generally within 180 days after the person knew of the act or omission. OCR may extend that period for good cause. Its process does not require hiring an attorney. The complaint should identify the entity, describe what happened, and supply relevant dates and records; HIPAA also prohibits retaliation for filing a complaint. [2]
An unwanted disclosure is not automatically prohibited: HIPAA permits various uses and disclosures under specified conditions. Similarly, not every person or business holding health information is a HIPAA-covered entity. [2] Ask prospective counsel to distinguish an unlawful disclosure, an available civil cause of action, provable harm, and likely recoverable relief. A medical-malpractice lawyer may be appropriate when clinical treatment caused injury, but a disclosure-only case often requires different experience.
What to do next
- Find an attorney licensed where a potential civil claim would be brought, and ask specifically about medical privacy and data-breach experience.
- Bring the breach notice, relevant authorizations, disclosure dates, messages, and a clear account of resulting harm. Preserve originals and avoid circulating the sensitive records unnecessarily.
- Ask which state or other law could provide a remedy, what evidence it requires, and when its limitation period expires.
- Consider an OCR complaint alongside legal consultation. Do not assume an agency complaint pauses a separate lawsuit deadline or guarantees a payment.
Practical example
A clinic sends a patient’s records to the wrong recipient. A privacy lawyer might evaluate state confidentiality or negligence law, while the patient separately reports the disclosure to OCR. If the issue instead involves an employer’s use of personnel records, the lawyer must first determine whether HIPAA applies to that information and whether employment law supplies the relevant remedy.
For related situations, see HIPAA and court testimony and medical privacy in divorce proceedings.
Primary sources
- Acara v. Banks, Fifth Circuit: HIPAA does not create a private damages action
- HHS OCR: health-information complaint requirements and process
Sources checked: October 31, 2026.