OPINION
STUMBO, Judge:
These appeals arise from the same action below and were heard together by the Court. The primary issue presented by these appeals is whether, under Kentucky Revised Statute (KRS) 446.070, Donna Yeager has a right of action against the Appellees, both attorneys, who disclosed medical information during the course of a child custody hearing when Yeager alleges a violation of the Health Insurance Portability and Accountability Act of 1996 (HI-PAA). After careful review of the briefs presented and the law, we hold that KRS 446.070 does not give Yeager a right of action where a Federal statute preempts state statutes and does not expressly provide such a right. Further, the Appellees are not “covered entities” under HIPAA to which its regulations would apply; therefore, the Court affirms the circuit court’s decisions regarding the primary issues. The circuit court also imposed sanctions on defense counsel pursuant to Kentucky Civil Rule 11. We find these sanctions were inappropriate and we reverse and vacate that award.
Statement of Facts
' Donna Yeager, as the Executrix of the Estate of Stacey Clise, appealed a decision by the Grant Circuit Court in favor of the appellees, Daniel Dickerson and Stephen Dallas. The court granted a motion for summary judgment, pursuant to Rule 56.03, dismissing Yeager’s claims of wrongful death, intentional infliction of emotional distress, negligence, invasion of privacy and HIPAA violations. Yeager appeals claiming there are genuine issues of material fact not yet determined.
During a hearing to determine the guardianship of a minor child, the mother, Stacey Clise, was questioned by Appel-lee/Defendant attorney Daniel Dickerson (hereinafter “Attorney Dickerson”) who represented her ex-husband, Richard Clise, during the same hearing. Attorney Dickerson was joined by co-counsel and Appellee/Defendant Stephen Dallas (hereinafter “Attorney Dallas”). Attorney Dickerson questioned Ms. Clise pertaining to her medical history and treatment including questions about the type, frequency, and quantity of prescription drugs she was taking. During the course of the examination, Attorney Dallas utilized medical records regarding Ms Clise’s medical his[391]*391tory. The attorneys stated that they received the records from Mr. Clise who found them after Ms. Clise abandoned them at the residence the two shared prior to the divorce. Ms: Clise’s attorney, Eric Deters, informed the court that his client had not authorized the release of her medical records to Mr; Clise or his attorneys. He also stated, “it was possible they were violating the Health Insurance Portability and Accountability Act.” Appellees admit to disclosing the medical information without Ms. Clise’s authorization or consent.
The line of questioning continued and references to Ms. Clise’s medical condition and use of medication were used throughout the hearing to call into question her suitability for custody of a child recently severely injured from a school bus accident. Attorney Dickerson did not introduce Ms. Clise’s medical records into evidence at the hearing. The Guardian ad litem testified that Ms. Clise’s use of prescription drugs reflected negatively on her ability to act as guardian to her minor son and recommended that Mr. Clise retain guardianship. On the day following the hearing, Ms. Clise died due to an overdose of Oxycodone. Subsequently, Yeager, the mother of Ms. Clise, filed a suit against the Appellees alleging a violation of HIPAA on behalf of Ms. Clise’s Estate.
Discussion
Whether the Court should reverse the decision of the circuit court depends upon; (1) whether the Appellees or their former client are among the “covered entities” to which HIPAA applies; (2) whether HIPAA reserves a private right of action through which Yeager can recover; (3) and if so can a court hold the Appellees liable. Congress passed HIPAA to prevent the dissemination of health information stored electronically without the consent of patients. Rules and regulations were promulgated by the Department of Health and Human Services to ensure the privacy of patients’ medical information. Using this authority, the Secretary of Health and Human Services designated three covered entities which were prohibited from disclosing protected health information, whether “oral or recorded in any form or medium,” unless the entities comply with the Secretary’s rules and regulations. A violation occurs where a covered entity or business associate to a covered entity discloses individually identifiable health information without the consent of the patient, without a court order, or not in response to a proper subpoena to a third party. If a covered entity violated a patient’s rights under HIPAA then the violator is subject to government prosecution by the Department of Justice.
Whether this Court should reverse the decision of the circuit court depends upon whether Appellees or then-former client are among the “covered entities” or “business associates” of covered entities to which HIPAA applies. 42 U.S.C.A. § 1320d-l. Covered entities generally include health-care providers, health plans, and health-care clearinghouses and their business associates. Id. In other jurisdictions, courts have held “covered entities” do not include attorneys unassociated with a “covered entity.” Community Hosp. Group, Inc. v. Blume Goldfaden Berkowitz Donnelly Fried & Forte, P.C., 381 N.J.Super. 119, 885 A.2d 18, 22 (2005). With respect to attorneys and disclosures during a judicial proceeding, HIPAA establishes the procedure for which a covered entity may disclose individually identifiable health information to an attorney. 45 C.F.R. § 164.512(e).
In Community Hospital, the New Jersey Superior Court, Appellate Division, held that attorneys are not “covered entities” as defined by Federal Regulations, 45 [392]*392C.F.R. § 160.103. Community Hosp. Group, Inc., at 22. In that case, the hospital brought an action against opposing counsel in a previous lawsuit claiming a common law right of privacy on behalf of two patients. The patients’ “confidential health information” was obtained by the attorneys through discovery in a pending medical malpractice claim involving the hospital. The patients, who were not involved in the' pending action, complained to their treating physician after receiving letters from the attorneys pertaining to their medical history. The hospital demanded that the attorneys reveal the source of their information, which they refused to do citing an attorney-client privilege. The hospital claimed they had standing under HIPAA to bring the action against the attorneys to enforce its privacy regulations and to mitigate any breach of HIPAA, which may have occurred by any employee of the hospital. The court recognized the action was not brought against anyone to whom HIPAA would apply stating, “ ‘[Covered entities’ are defined in the Code of Federal Regulations, 45 C.F.R. § 160.103, and [Community Hospital Group] concedes that defendants do not fall within that category.” Id.
Free access — add to your briefcase to read the full text and ask questions with AI
OPINION
STUMBO, Judge:
These appeals arise from the same action below and were heard together by the Court. The primary issue presented by these appeals is whether, under Kentucky Revised Statute (KRS) 446.070, Donna Yeager has a right of action against the Appellees, both attorneys, who disclosed medical information during the course of a child custody hearing when Yeager alleges a violation of the Health Insurance Portability and Accountability Act of 1996 (HI-PAA). After careful review of the briefs presented and the law, we hold that KRS 446.070 does not give Yeager a right of action where a Federal statute preempts state statutes and does not expressly provide such a right. Further, the Appellees are not “covered entities” under HIPAA to which its regulations would apply; therefore, the Court affirms the circuit court’s decisions regarding the primary issues. The circuit court also imposed sanctions on defense counsel pursuant to Kentucky Civil Rule 11. We find these sanctions were inappropriate and we reverse and vacate that award.
Statement of Facts
' Donna Yeager, as the Executrix of the Estate of Stacey Clise, appealed a decision by the Grant Circuit Court in favor of the appellees, Daniel Dickerson and Stephen Dallas. The court granted a motion for summary judgment, pursuant to Rule 56.03, dismissing Yeager’s claims of wrongful death, intentional infliction of emotional distress, negligence, invasion of privacy and HIPAA violations. Yeager appeals claiming there are genuine issues of material fact not yet determined.
During a hearing to determine the guardianship of a minor child, the mother, Stacey Clise, was questioned by Appel-lee/Defendant attorney Daniel Dickerson (hereinafter “Attorney Dickerson”) who represented her ex-husband, Richard Clise, during the same hearing. Attorney Dickerson was joined by co-counsel and Appellee/Defendant Stephen Dallas (hereinafter “Attorney Dallas”). Attorney Dickerson questioned Ms. Clise pertaining to her medical history and treatment including questions about the type, frequency, and quantity of prescription drugs she was taking. During the course of the examination, Attorney Dallas utilized medical records regarding Ms Clise’s medical his[391]*391tory. The attorneys stated that they received the records from Mr. Clise who found them after Ms. Clise abandoned them at the residence the two shared prior to the divorce. Ms: Clise’s attorney, Eric Deters, informed the court that his client had not authorized the release of her medical records to Mr; Clise or his attorneys. He also stated, “it was possible they were violating the Health Insurance Portability and Accountability Act.” Appellees admit to disclosing the medical information without Ms. Clise’s authorization or consent.
The line of questioning continued and references to Ms. Clise’s medical condition and use of medication were used throughout the hearing to call into question her suitability for custody of a child recently severely injured from a school bus accident. Attorney Dickerson did not introduce Ms. Clise’s medical records into evidence at the hearing. The Guardian ad litem testified that Ms. Clise’s use of prescription drugs reflected negatively on her ability to act as guardian to her minor son and recommended that Mr. Clise retain guardianship. On the day following the hearing, Ms. Clise died due to an overdose of Oxycodone. Subsequently, Yeager, the mother of Ms. Clise, filed a suit against the Appellees alleging a violation of HIPAA on behalf of Ms. Clise’s Estate.
Discussion
Whether the Court should reverse the decision of the circuit court depends upon; (1) whether the Appellees or their former client are among the “covered entities” to which HIPAA applies; (2) whether HIPAA reserves a private right of action through which Yeager can recover; (3) and if so can a court hold the Appellees liable. Congress passed HIPAA to prevent the dissemination of health information stored electronically without the consent of patients. Rules and regulations were promulgated by the Department of Health and Human Services to ensure the privacy of patients’ medical information. Using this authority, the Secretary of Health and Human Services designated three covered entities which were prohibited from disclosing protected health information, whether “oral or recorded in any form or medium,” unless the entities comply with the Secretary’s rules and regulations. A violation occurs where a covered entity or business associate to a covered entity discloses individually identifiable health information without the consent of the patient, without a court order, or not in response to a proper subpoena to a third party. If a covered entity violated a patient’s rights under HIPAA then the violator is subject to government prosecution by the Department of Justice.
Whether this Court should reverse the decision of the circuit court depends upon whether Appellees or then-former client are among the “covered entities” or “business associates” of covered entities to which HIPAA applies. 42 U.S.C.A. § 1320d-l. Covered entities generally include health-care providers, health plans, and health-care clearinghouses and their business associates. Id. In other jurisdictions, courts have held “covered entities” do not include attorneys unassociated with a “covered entity.” Community Hosp. Group, Inc. v. Blume Goldfaden Berkowitz Donnelly Fried & Forte, P.C., 381 N.J.Super. 119, 885 A.2d 18, 22 (2005). With respect to attorneys and disclosures during a judicial proceeding, HIPAA establishes the procedure for which a covered entity may disclose individually identifiable health information to an attorney. 45 C.F.R. § 164.512(e).
In Community Hospital, the New Jersey Superior Court, Appellate Division, held that attorneys are not “covered entities” as defined by Federal Regulations, 45 [392]*392C.F.R. § 160.103. Community Hosp. Group, Inc., at 22. In that case, the hospital brought an action against opposing counsel in a previous lawsuit claiming a common law right of privacy on behalf of two patients. The patients’ “confidential health information” was obtained by the attorneys through discovery in a pending medical malpractice claim involving the hospital. The patients, who were not involved in the' pending action, complained to their treating physician after receiving letters from the attorneys pertaining to their medical history. The hospital demanded that the attorneys reveal the source of their information, which they refused to do citing an attorney-client privilege. The hospital claimed they had standing under HIPAA to bring the action against the attorneys to enforce its privacy regulations and to mitigate any breach of HIPAA, which may have occurred by any employee of the hospital. The court recognized the action was not brought against anyone to whom HIPAA would apply stating, “ ‘[Covered entities’ are defined in the Code of Federal Regulations, 45 C.F.R. § 160.103, and [Community Hospital Group] concedes that defendants do not fall within that category.” Id. The Court ultimately held that no private cause of action can be maintained under HIPPA. Id.
Yeager contends that under certain circumstances HIPAA applies to disclosures by attorneys. Yeager relies on a number of cases restricting ex parte communications between healthcare providers and attorneys pertaining to the health information of an individual. In Meek the Court held that any possible HIPAA violation by defendant’s counsel was remedied by the lower court when either party was allowed to question the plaintiffs treating physician prior to his testimony. Meek v. Vasconez, 2006 WL 1652736 (Ky.App.2006).
In Meek, the appellant originally alleged medical negligence by Defendant/Appellee surgeon. The jury returned a verdict in favor of the defendant and the plaintiff appealed arguing, in part, misconduct of the defense attorneys by having communications with the plaintiffs treating physician, which violated HIPAA. The defense argued that the disclosure was proper because both the treating physician and the defendant were employed with the University of Kentucky Medical Center and under the Insurance Act, the University was required to defend the malpractice suit. Therefore, disclosure was proper because defense counsel was a “business associate” as defined by the statute. The lower court recognized this as a possible HIPAA violation and ordered that the plaintiffs counsel could interview the physician prior to his testimony. The Court acknowledged that this remedied the violation, if there was one.
Appellees contend that HIPAA does not apply -to attorneys unassociated with a “covered entity.” With regard to Meek, they argue that the case involved communications of the defense attorney with another employee of the same hospital and does not create liability for an attorney under HIPAA. The basis of their argument is that the communications on the part of the treating physician constituted a possible violation of HIPAA and not any conduct on the part of defendant’s counsel.
In the present case, Appellees received the records from their client, Mr. Clise. They then used the records as a básis for questioning during a custody proceeding. The records contained Ms. Clise’s personal health information obtained by her from her treating physician. Mr. Clise came into possession of the records- upon his and Ms. Clise’s separation when she left them at their former residence. These facts are similar to those of [393]*393Community Hospital where the attorneys obtained personal health information from an unknown source. As stated previously, Community Hospital holds that in an action brought by the hospital on behalf of patients not involved in the underlying medical malpractice suit for a HIPAA violation, attorneys were not subject to the regulations of HIPAA because they were not “covered entities.”
Additionally, the present case is not one of ex parte communications as in Meek. In Meek, the lower court recognized a possible HIPAA violation through communications of the defense attorneys and the plaintiffs treating physician. However, the court was not specific as to the actual liability of the attorney, instead focusing on the employment of the doctor with the University of Kentucky and the employment of the defendant with the University. The Court did not address whether attorneys were “covered entities” as Yeager suggests.
This contrasts with the current case in that Appellees had no communications with any physician treating Ms. Clise. Their communications were strictly with their client, Mr. Clise, who supplied the records as a result of their abandonment. Had the Appellees contacted any “covered entity” under HIPAA, then the covered entity’s compliance with HIPAA requires patient consent, court order, or proper subpoena before any disclosures of personally identifiable health information. Therefore, we believe that the Appellees are not “covered entities” to which HIPAA would apply.
Right of Action under HIPAA
The most important issue is whether Yeager has a private action under HI-PAA for which she can recover. “HIPAA does not create a state-based private cause of action for violations of its provisions.” Young v. Carran, 289 S.W.3d 586, 588 (Ky.App.2008), citing McMillen v. Kentucky Dept. of Corrections, 233 S.W.3d 203, 205 (Ky.App.2007). Furthermore, “federal courts have uniformly held that HIPAA does not create a private cause of action even at the federal level.” Id. However, KRS 446.070 provides recovery for individuals injured by violations of “any statute” so long as they are members of the class of persons meant for protection by the statute. Kentucky courts have consistently held that the “any statute” language is limited to state statutes only and does not extend to federal statutes of which congress has not expressly intended to create a private right of action. Id. at 589.
The Court in Young held that KRS 446.070 does not give a private right of action for the violation of a federal statute where Congress has not expressly designated such a right. Id. at 588. In Young, the appellant sought recovery based on an alleged HIPAA violation by the former attorney for her ex-husband. The case arose out of a child custody dispute between the appellant and her ex-husband. The appellant signed a release for her ex-husband’s attorneys granting access to certain medical records provided that those records or their contents were never released to their client. During the litigation, the ex-husband dismissed his attorney and requested his file. The firm released the file; however, they also inadvertently released the appellant’s medical records with it. The lower court dismissed all claims against the firm. On appeal, the appellant argued that KRS 446.070 gave her the right to sue the firm for the alleged violation of HIPAA. The Court denied the request reasoning that “[t]he General Assembly did not intend [KRS 446.070] ‘to embrace the whole of federal laws and the laws of other states [394]*394and thereby confer a private civil remedy for such a vast array of violations.’ ” Id. at 589 (citation omitted).
Similarly to Young, in the present case, where the attorneys disclosed Ms. Clise’s medical records to her ex-husband, the alleged violation occurred when Appellees disclosed Ms. Clise’s medical information during her testimony based on records obtained from their client, Mr. Clise. Yeager claims that because the General Assembly intended a right of action under KRS 446.070 for any violation of KRS 422.305 and KRS 422.315, then any violation of HIPAA also inherently contains an intended right of action because it preempts state law. However, the Court in Young refused to extend the right of action to HIPAA expressly stating, the General Assembly did not intend it “to embrace the whole of federal laws and the laws of other states and thereby confer a private civil remedy for such a vast array of violations.” Young, at 589.
In the case sub judice, Yeager contends that because HIPAA preempts KRS 422.3051 and KRS 422.315,2 KRS 446.070 provides a remedy that would otherwise be available from the Kentucky Statutes. Yeager argues that the present case is distinguishable from the Court’s decision in T & M Jewelry, Inc. v. Hicks ex rel. Hicks, 189 S.W.3d 526 (Ky.2006). In that case, the Court held that the negligence per se statute of KRS 446.070 does not apply to federal law; however, a court could use federal law to determine duty of care. Id. at 530.
In Hicks, a store sold a gun to a person, who was under the age of 21, in violation of a federal statute. The person was an 18-year-old male who then accidently shot his girlfriend. The Court ruled that KRS 446.070 did not establish a private cause of action because the statute only applied to state statutes and if Congress did not intend to provide a private cause of action, KRS 446.070 could not create one. However, the Court did allow the common law negligence claim to go forward and the lower court could use the federal law in establishing the defendant’s duty.
Appellees argue that KRS 446.070 does not give a private right of action. This is supported in Hicks, supra, where the Supreme Court would not allow KRS 446.070 to establish a negligence per se case against the Defendant for violating a federal law in which Congress did not intend to include a private right of action in it. Similarly, HIPAA provides for prosecution by the Justice Department and this Court has interpreted HIPPA not to contain a right for an individual to sue. Young, at 588. Therefore, this Court should conclude that even though HIPAA preempts state law in which KRS 446.070 is applicable, the General Assembly did not intend to infer a right under a federal law where Congress has not.
We also find that the judicial proceeding privilege is applicable in the case at hand. “The prevailing rule and the one recognized in this jurisdiction is that statements in pleadings filed in judicial proceedings are absolutely privileged when material, pertinent, and relevant to the subject under inquiry, though it is claimed that they are false and alleged with malice.” Schmitt v. Mann, 291 Ky. 80, 163 S.W.2d 281, 283 (Ky.1942). “ ‘Great latitude is permissible upon a cross-examination ... A question not strictly relevant, but which is collateral, may be asked him in order to show that he has, by some disgraceful conduct, rendered himself less [395]*395credible, or to fix his identity and antecedents.’ ” Smith v. Hodges, 199 S.W.3d 185, 194 (Ky.App.2005) (quoting Stewart v. Hall, 88 Ky. 375,1885 WL 5815 (Ky.1885)). KRS 403.270 provides that the mental and physical health of a child’s parent is a relevant factor for a court to consider in custodial issues.
In Smith, the Court held statements made during a testimony were privileged and not subject to action by the Appellant. Smith at 194. The Appellant filed suit seeking damages for alleged defamatory statements made by a former employee during a deposition. In a federal lawsuit brought against the Appellant by a customer for violation of the federal Fair Credit Reporting Act, the employee made reference during a deposition that it “was common knowledge around the dealership that he had a real bad cocaine problem.” The Court held the statements were privileged because they were relevant to the lawsuit in that the Appellant’s state of mind was an important factor in determining whether the federal Fair Credit Reporting Act was violated.
Similarly to Smith, the Appellees’ alleged violation of HIPAA occurred as a result of disclosure during cross-examination. In the present case, the statements and questions by the Appellees were relevant to a child custody hearing according to KRS 403.270; therefore, the Appellees argue correctly that statements made during a judicial proceeding are privileged and not subject to any action because the statements were relevant and made during a court proceeding.
Rule 11 Sanctions
The final issue in this case concerns an appeal filed by Yeager and her attorney Eric Deters and a cross-appeal filed by attorneys Dickerson and Dallas. The issue involves the grant of a motion for sanctions pursuant to Kentucky Civil Rule (CR) 11 against each attorney representing Yeager in this case. The appeal challenges the granting of these fees and the cross-appeal challenges the adequacy of the award. Attorney’s fees are appropriate sanctions for violations of CR 11. CR 11 states that every pleading, motion, or other paper to be filed with the court is to be signed by an attorney of record.
The signature of an attorney or party constitutes a certification by him that he has read the pleading, motion or other paper; that to the best of his knowledge, information, and belief formed after reasonable inquiry it is well grounded in fact and is warranted by existing law or a good faith argument for the extension, modification or reversal of existing law, and that it is not interposed for any improper purpose, such as to harass or to cause unnecessary delay or needless increase in the cost of litigation.
CR 11. If a signed pleading is filed for an unreasonable purpose, a trial court can sanction the attorney.
We find that sanctions were inappropriate in this case.
While some courts apply an across-the-board abuse of discretion standard of review to all Rule 11 rulings, we think where sanctions are imposed our role requires a multi-standard approach, that is, a clearly erroneous standard to the trial court’s findings in support of sanctions, a de novo review of the legal conclusion that a violation occurred, and an abuse of discretion standard on the type and/or amount of sanctions imposed. (Citation omitted).
Clark Equipment Company, Inc. v. Bowman, 762 S.W.2d 417, 421 (Ky.App.1988). Rule 11 sanctions are to be used only in extraordinary circumstances and this Court has previously emphasized that it is not a “vehicle to obtain relief by one who [396]*396has suffered damages by simple negligence in the filing of a lawsuit or by the filing of a meritless lawsuit.” Id. at 420. It cautioned that even if a case is meritless, the Rule has no “application unless it is demonstrated that a party or his lawyer signed a paper in violation of the Rule.” Id. (quotation and citation omitted).
The imposition of sanctions in this case is equivalent to an award of attorney’s fees to the prevailing party. Although the trial court found that the complaint alleging violation of HIPAA privacy protections was not well grounded in fact or in existing law and there was no good faith argument for the extension, modification, or reversal of existing law, we believe that its findings were based on hindsight rather than whether the complaint was reasonable when filed. The complaint was filed prior to this Court’s opinions in McMillen v. Kentucky Dept. of Corrections, 233 S.W.3d 203 (Ky.App.2007), and Young v. Carran, 289 S.W.3d 586 (Ky.App.2008). In addition, this was also an issue that was newly arisen in the courts, trial counsel consulted with another legal professional, and independent research was performed prior to filing the complaint.
We believe that the complaint filed by the appellants was well grounded in fact, because the appellees had utilized records subject to HIPAA protection if disclosed by certain entities. The appellants made good faith arguments for extension, modification, or reversal of existing law; therefore, their complaint was not for improper purposes such as to harass, or to cause unnecessary delay or needless increase in the cost of litigation. Under the facts and applying a de novo standard of review, the trial court’s conclusion that a Rule 11 violation occurred was erroneous.
Conclusion
The circuit court’s decision is hereby affirmed in part and reversed in part. This Court has recently ruled that KRS 446.070 does not give a private right of action for violations of HIPAA. Further, Yeager has not proven that Appellees are “covered entities” to which HIPAA regulations and penalties would apply because Appellees are not medical providers or custodians entrusted with the decedent’s medical records. Moreover, the decedent’s medical records were not introduced into evidence, but merely referred to during court proceedings. Any statements and lines of questioning by the attorneys cannot give rise to action under the Judicial Proceedings Privilege. However the trial court did err in imposing Rule 11 sanctions; therefore, that award is vacated.
ALL CONCUR.