US FederalCan I sue a hospital that discloses my medical information without authorization?
No, you cannot sue a hospital directly under HIPAA for unauthorized disclosure of your medical information—HIPAA does not create a private right of action for individuals.
What the Law Says
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes national standards to protect individuals’ medical records and other protected health information (PHI). However, it does not give patients the right to file a lawsuit in court against a hospital or provider for violations.
HIPAA is enforced exclusively by the U.S. Department of Health and Human Services (HHS), specifically the Office for Civil Rights (OCR). Individuals may file complaints with OCR, but they cannot bring private lawsuits under HIPAA itself.
The statute states: "The Secretary shall provide for the enforcement of this part in accordance with section 1320d-5 of this title." It further clarifies that "a person may not bring a civil action in any court against a covered entity for a violation of this part."
Statutory Texta person may not bring a civil action in any court against a covered entity for a violation of this part.
— 42 U.S.C. § 1320d — Health information privacy
What to Do
File a written complaint with HHS OCR within 180 days of discovering the violation.
Include details: who disclosed the information, what was disclosed, when and how it happened, and any harm suffered.
HHS will investigate and may impose penalties—including fines up to $50,000 per violation—or require corrective action.
Consider consulting an attorney about possible claims under state law (e.g., breach of confidentiality, invasion of privacy), which may allow lawsuits.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.