For a HIPAA violation, the attorney you want is usually a personal injury lawyer with experience in medical privacy cases, or in certain situations a medical malpractice attorney or a privacy and data breach specialist. The reason the choice matters is structural: HIPAA itself does not let you sue anyone, so your case has to be built on state law claims like negligence or invasion of privacy, with the HIPAA breach used as evidence that the provider fell below the required standard of care.1U.S. Courts. Acara v. Banks, No. 06-30356 (5th Cir. 2007) The lawyer you hire needs to be comfortable in state court, skilled at proving damages, and able to use federal privacy standards to anchor the claim.
Why the Attorney’s Job Is State Law, Not HIPAA
Federal courts have consistently held that HIPAA contains no private right of action. Only the Secretary of Health and Human Services can enforce it, through the Office for Civil Rights, and any penalties collected go to the U.S. Treasury rather than to you.1U.S. Courts. Acara v. Banks, No. 06-30356 (5th Cir. 2007) That is why the choice of attorney is really a choice about who can run a state court case effectively.
HIPAA’s regulations still play a powerful role once you get into that state court. Courts in multiple states have recognized that HIPAA’s privacy and security standards can define the duty of care a healthcare provider owes you. The Connecticut Supreme Court endorsed this directly, holding that HIPAA’s standards may inform the negligence standard of care in lawsuits over unauthorized disclosures of medical records.2Wiggin and Dana LLP. The Connecticut Supreme Court Opens Door for Expanded Negligence Liability Based on HIPAA Violations The usual claims your attorney will consider are negligence, invasion of privacy, and breach of fiduciary duty. Negligence tends to be strongest because your attorney can point to specific HIPAA provisions the provider violated and argue those violations prove carelessness. Some states also have their own medical privacy statutes that go beyond HIPAA and do create a private right of action, and an attorney who handles these cases regularly will know whether your state’s laws give you an independent basis to sue.
Which Type of Attorney Fits Which Kind of Breach
Personal Injury Attorney
A personal injury attorney is often the most natural fit. These lawyers spend their careers proving that someone else’s carelessness caused measurable harm, which is exactly the structure of a privacy breach case. They know how to calculate and present damages like emotional distress, reputational harm, and financial losses, and they are comfortable with the burden of proof and the procedural mechanics of state court litigation.
Medical Malpractice Attorney
When the privacy breach is tangled up with substandard medical care, a medical malpractice attorney brings specialized value. If a hospital’s sloppy recordkeeping led to both a treatment error and an unauthorized disclosure of your records, a malpractice lawyer can handle the interconnected claims. These attorneys also understand the expert witness requirements that many states impose in healthcare litigation, which can be decisive.
Privacy and Data Breach Attorney
For cases involving large-scale electronic breaches, stolen health records, or cyberattacks on a provider’s systems, an attorney who specializes in privacy and data breach litigation brings focused expertise. These lawyers understand digital forensic evidence, know how to trace the source of a data leak through network and email analysis, and can work at the intersection of federal and state data security regulations. This matters most when the breach involves a hacked electronic health record system or a vendor that mishandled data, rather than a single employee who gossiped about your diagnosis.
Who Your Attorney Will Actually Sue
HIPAA applies to three categories of organizations known as covered entities: healthcare providers who transmit information electronically, health plans such as insurance companies and HMOs, and healthcare clearinghouses that process health data.3HHS.gov. Covered Entities and Business Associates If the organization that exposed your information falls into one of these categories, it is directly subject to HIPAA’s rules.
The responsible party is not always the doctor’s office or the hospital. Providers routinely share protected health information with outside vendors called business associates, including billing companies, IT service providers, cloud storage vendors, transcription services, and even attorneys who access patient records during legal work.4HHS.gov. Business Associates Under the HITECH Act, business associates are directly liable for HIPAA violations, including failures to safeguard your data, impermissible disclosures, and breaches of the security requirements.5HHS.gov. Direct Liability of Business Associates
Bring this up with your attorney early. If a billing company or IT vendor caused the breach, your lawsuit may need to target that business associate in addition to, or instead of, the healthcare provider. A covered entity that knows its business associate violated their agreement is also required to take corrective steps or report the problem to OCR, so failures on both sides may be at play.4HHS.gov. Business Associates Choosing an attorney who has litigated against both hospitals and their vendors is worth the extra vetting.
What You Need to Be Able to Prove
Winning a state lawsuit requires proving you suffered real harm, and this is where many privacy cases get difficult. The damage from a medical record disclosure is often emotional or reputational rather than a clear dollar amount on a bill.
Compensatory damages cover measurable losses: money you spent on credit monitoring after a breach, income you lost because an employer learned about a medical condition, or costs of therapy to deal with the fallout. These are the easiest damages to prove because they come with receipts. Emotional distress damages are recoverable too, but courts generally require evidence that your distress was severe, not just that you felt upset or embarrassed. Medical records showing treatment for anxiety or depression, a therapist’s notes, or a detailed personal journal documenting how the breach affected your daily life all strengthen this claim.
In some cases a court may award nominal damages, a small token amount recognizing that your rights were violated even if you cannot prove concrete financial harm. Nominal awards are typically just a dollar or a modest sum. They formally establish that a wrong occurred, but they will not fund a meaningful recovery.
The strength of your damages directly affects which attorneys will take your case. Lawyers working on contingency need to see a path to a recovery large enough to justify their investment of time. If your only harm is that a nurse mentioned your diagnosis to a neighbor and you felt embarrassed, most attorneys will pass. If your employer fired you after learning about a substance abuse treatment record that was improperly disclosed, that is a case attorneys will fight over.
Deadlines That Determine When to Call
Two separate clocks start running after you learn about a privacy breach. A complaint to the Office for Civil Rights must be filed within 180 days of when you knew or should have known about the violation, with a possible good-cause extension.6eCFR. 45 CFR 160.306 – Complaints to the Secretary An OCR complaint does not compensate you, but it triggers a federal investigation and creates a paper trail that strengthens your state lawsuit. Filing one does not prevent you from also suing in state court, and you can pursue both at the same time.
Your state lawsuit has its own statute of limitations, which is entirely separate. For negligence and personal injury claims, deadlines across the states range from one year to six years, with two to three years being the most common window. Medical malpractice claims often have shorter or differently structured deadlines than general negligence. Missing your state’s filing deadline means losing the right to sue permanently, regardless of how strong the evidence is. That is why an attorney should be among the first calls you make.
Covered entities are required to notify you of a breach of unsecured protected health information within 60 calendar days of discovering it.7eCFR. 45 CFR 164.404 – Notification to Individuals If you received a breach notification letter, hold onto it. It is critical evidence, and the date you received it likely marks when the statute of limitations clock started.
What to Bring to the Consultation
Attorneys evaluate cases quickly, and the more organized you are, the faster they can tell you whether you have a viable claim.
- A written timeline of when you first learned about the breach, who you believe disclosed the information, what was shared, and who received it.
- Any formal breach notification letter from the provider, along with emails, text messages, letters, social media posts, or screenshots showing the disclosure happened.
- Financial records tied to the breach, such as job termination paperwork, credit monitoring expenses, and therapy bills, plus any personal journal entries documenting your emotional state afterward.
- Full names and contact information for the healthcare provider, clinic, hospital, or vendor you believe is responsible.
- A copy of your OCR complaint if you have already filed one, or a note to raise the timing question with your attorney if you have not.
How the Attorney Gets Paid
Most personal injury and medical malpractice attorneys work on a contingency fee basis, taking a percentage of whatever you recover and charging nothing upfront. The standard range is roughly 33% to 40% of the settlement or verdict, though many states cap contingency fees in medical malpractice cases using sliding scales, where the allowed percentage drops as the recovery amount increases. Ask for the fee agreement in writing before signing anything.
Contingency fees do not cover every cost. Filing fees, expert witness fees, medical record retrieval costs, and deposition expenses are usually separate. Some attorneys advance these costs and deduct them from your recovery; others expect you to pay them as they come up. Clarify this during your consultation, because expert witnesses in healthcare cases can be expensive.
The contingency model has a practical filter built in. Because the attorney only gets paid if you win, they are unlikely to take a case they do not believe has real value. If several attorneys decline your case, that is useful information about the strength of your claim. It does not mean no wrong occurred, but it may mean the provable damages are not large enough to support the cost of litigation.