A key provision of the American Recovery and Reinvestment Act of 2009 has the potential to dramatically increase health-care providers' legal liability. The Recovery Act requires health-care providers to demonstrate the “meaningful use” of electronic medical records in order to maintain their Medicaid and Medicare reimbursement levels. As a result, the rapidly increasing use of electronic medical records is a double-edged sword for health-care providers.

On one hand, electronic medical records offer more efficient and economical records access, resulting in cost savings for health-care providers and better patient care. On the other hand, they are susceptible to hacking and inadvertent disclosures. Hackers have targeted health-care providers and, as recently as August 2014, more than 4.5 million patients' Social Security numbers, contact information and birth dates were stolen from a multistate hospital system. As the number of hacking attempts continues to increase, some courts have displayed a willingness to allow plaintiffs to bring claims for negligence and privacy violations against health-care providers under state law. In the process, those courts have rejected the providers' arguments that federal law preempts those claims.

The Connecticut Supreme Court recently held that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) does not preempt state law claims for negligence against a health-care provider that improperly breaches the confidentiality of a patient's records in responding to a subpoena. Byrne v. Avery Ctr. For Obstetrics & Gynecology, 314 Conn. 433 (2014). Emily Byrne, a patient at the Avery Center, instructed her doctor not to provide her protected health information (PHI) to her estranged significant other, Andro Mendoza. Mendoza subsequently filed a paternity suit against Byrne and served a subpoena on the Avery Center requesting Byrne's medical records. The Avery Center turned the records over to the court without notifying Byrne, filing a motion to quash the subpoena or appearing in court.