Last reviewed: 2026-07-23
If someone exposed your private medical information — a nurse who gossiped about your diagnosis, a clinic that faxed your records to the wrong employer, an ex who somehow got your chart — you are right to be angry and right to ask whether you can make them pay. The honest answer surprises most people: you cannot sue under HIPAA itself, but in Georgia and South Carolina you often can sue under state law for the unauthorized disclosure of your medical information — and when that breach accompanies negligent care, it can become part of a medical malpractice claim.
Key Takeaways
- You cannot sue under HIPAA itself — the federal law has no private right of action, so no individual can file a HIPAA lawsuit for damages.
- You can often sue under state law. South Carolina recognizes a breach-of-confidence tort (McCormick v. England); Georgia allows invasion-of-privacy and negligence claims for medical-information disclosure.
- HIPAA's only patient remedy is an OCR complaint to the U.S. Department of Health and Human Services — filed within 180 days of when you knew of the violation.
- OCR fines go to the government, not to you. A resolution or civil penalty punishes the provider but does not compensate the patient.
- Deadlines are jurisdiction-specific: Georgia's general injury deadline is 2 years (O.C.G.A. § 9-3-33); South Carolina's is 3 years (S.C. Code § 15-3-530).
- A privacy breach can be malpractice when it accompanies negligent treatment — triggering the med-mal deadlines in O.C.G.A. § 9-3-71 (GA) and S.C. Code § 15-3-545 (SC).
- Roden Law reviews HIPAA-related privacy claims for free with no fees unless we win.
Can you sue for a HIPAA violation? The direct answer
The short answer is layered: HIPAA gives you no way to sue, but Georgia and South Carolina state law frequently do. HIPAA (the Health Insurance Portability and Accountability Act) sets the federal privacy rules that doctors, hospitals, insurers, and their business partners must follow, but Congress did not build in a "private right of action" — meaning the statute does not let an individual patient take a violator to court for money damages.
According to the U.S. Department of Health and Human Services, enforcement of HIPAA is handled by the government, not by private lawsuits, and courts across the country have consistently dismissed cases that try to sue "under HIPAA." If a website tells you to "file a HIPAA lawsuit," be cautious — what that usually means is a state-law claim that uses the HIPAA breach as evidence.
Graeham C. Gillin, a partner at Roden Law who is licensed in South Carolina, explains that the practical path for most patients is not the federal statute at all: the real question is whether the disclosure caused you a concrete harm that a Georgia or South Carolina court will recognize under its own privacy and negligence law.
What HIPAA actually does for patients
HIPAA gives you the right to file a federal complaint with the government, but not the right to collect money from it. The mechanism is a complaint to the HHS Office for Civil Rights (OCR), the agency that investigates providers and enforces the privacy rules.
According to the HHS Office for Civil Rights, a HIPAA complaint generally must be filed within 180 days of when you knew (or should have known) about the violation, though OCR can grant extensions for good cause. You can file online through the HHS OCR complaint portal.
Here is the part that disappoints most patients: OCR outcomes are corrective action plans, resolution agreements, and civil monetary penalties — all paid to the federal government, not to you. According to the U.S. Department of Health and Human Services, money collected through HIPAA enforcement is not a source of compensation for the injured patient.
The penalties can still be substantial. According to the Federal Register, the 2026 inflation-adjusted HIPAA civil penalty schedule (effective January 28, 2026) runs in tiers based on culpability:
| HIPAA penalty tier (2026, per violation) | Culpability level | Approximate range |
|---|---|---|
| Tier 1 | Did not know, and reasonable diligence would not have revealed it | ~$145 – $73,011 |
| Tier 2 | Reasonable cause, not willful neglect | ~$1,461 – $73,011 |
| Tier 3 | Willful neglect, corrected in time | ~$14,602 – $73,011 |
| Tier 4 | Willful neglect, not corrected | ~$73,011 – more than $2.19 million (annual cap) |
Keep in mind that these are approximate ranges OCR applies at its discretion — and every dollar goes to the government. If you want to be compensated, you have to look to state law.
South Carolina: how patients actually sue for a medical privacy breach
South Carolina patients can sue for the unauthorized disclosure of medical information under a recognized state tort called breach of physician–patient confidence. According to the South Carolina Court of Appeals in McCormick v. England, 328 S.C. 627, 494 S.E.2d 431 (S.C. Ct. App. 1997), a doctor who discloses confidential patient information without authorization can be held liable to the patient — a claim that exists entirely independent of HIPAA.
The theories. In South Carolina, a medical privacy breach may support a breach-of-confidence claim, an invasion-of-privacy claim, and, depending on the facts, an ordinary negligence claim. You must show a real disclosure of protected information and real harm flowing from it — reputational damage, lost employment, emotional distress, or financial loss.
The deadline. In South Carolina, you generally have 3 years to file a personal-injury claim (S.C. Code § 15-3-530) — and a strong case is worth nothing if it is filed late. For a deeper look at the South Carolina timeline, see our post on medical malpractice filing limits in South Carolina.
Our Charleston medical malpractice attorneys handle these claims across the Lowcountry and up through the Columbia and Myrtle Beach service areas.
Georgia: invasion of privacy and negligence claims
Georgia patients can sue for a medical privacy breach under the state's common-law right to privacy — which Georgia courts were the first in the nation to recognize, and which covers the unauthorized disclosure of private facts like your medical information.
The theories. In Georgia, an improper disclosure of medical records can support an invasion-of-privacy claim and a negligence claim. O.C.G.A. § 24-12-1 governs when a provider is permitted to release a patient's medical information, so a release that falls outside those rules can help establish a breach of duty. Courts have allowed HIPAA to be used as evidence of the applicable standard of care in negligence cases — "have allowed," not guaranteed, and how it plays out depends heavily on your facts.
The deadline. In Georgia, you generally have 2 years to bring a personal-injury claim (O.C.G.A. § 9-3-33). Georgia's shorter window makes early action even more important than in South Carolina. For the full breakdown, read our guide to medical malpractice limits in Georgia, and if your case touches our home base, our Savannah injury attorneys can review it.
Georgia vs. South Carolina at a glance
The core rules line up state by state as follows — both states bar HIPAA lawsuits but both give patients a state-law path, with different deadlines.
| Question | Georgia | South Carolina |
|---|---|---|
| Can you sue under HIPAA itself? | No — no private right of action | No — no private right of action |
| Primary state-law claim | Invasion of privacy; negligence | Breach of confidence (McCormick v. England); invasion of privacy |
| Statute governing record release | O.C.G.A. § 24-12-1 | Common-law + provider duty of confidence |
| General injury deadline | 2 years (O.C.G.A. § 9-3-33) | 3 years (S.C. Code § 15-3-530) |
| Medical malpractice deadline | 2 years / 5-year repose (O.C.G.A. § 9-3-71) | 3 years from discovery / 6-year repose (S.C. Code § 15-3-545) |
When a HIPAA violation becomes a medical malpractice case
A privacy breach becomes a medical malpractice case when it happens alongside negligent medical care, because the two harms then share the same treatment relationship and often the same evidence. This intersection is where many of the strongest claims live, and it is easy to miss.
Consider a few patterns our medical malpractice lawyers see: records altered or improperly disclosed during a dispute over botched treatment; a harmful disclosure of a sensitive diagnosis paired with care that fell below the standard; or a facility mishandling a vulnerable resident's records as part of a broader pattern of neglect, which often overlaps with nursing home abuse claims. In the worst cases, negligent care contributes to a death, and the privacy issues become one part of a larger wrongful death claim.
When the breach is part of a malpractice case, different deadlines apply. In Georgia, medical malpractice claims must generally be filed within 2 years, subject to a 5-year statute of repose (O.C.G.A. § 9-3-71). In South Carolina, the deadline is generally 3 years from treatment or discovery, subject to a 6-year repose (S.C. Code § 15-3-545). Because these rules can change your filing window, having a lawyer classify your claim correctly early on is critical. And if the underlying injury happened in hospital care, our guide to suing a hospital for negligence explains the special rules — expert affidavits and, in South Carolina, pre-suit mediation — those cases must follow.
What to do now: a step-by-step checklist
Act quickly and preserve everything, because privacy claims turn on documentation and the clock is already running:
- Document the disclosure. Write down what was disclosed, who disclosed it, who received it, and when and how you found out. Screenshots, letters, emails, and voicemails all matter.
- Request your records. Ask the provider for a copy of your records and an accounting of disclosures. What they release — and what is missing — often tells the story.
- File an OCR complaint. To hold the provider accountable federally, file with HHS OCR within the 180-day window. Remember this pressures the provider but does not pay you.
- Talk to a Georgia or South Carolina attorney about state-law claims. This is the only path to compensation. A lawyer will tell you whether your facts support a privacy, negligence, or malpractice claim, and which deadline governs.
Roden Law offers a free, no-obligation case review from offices in Savannah, Charleston, Columbia, and Murrells Inlet (Myrtle Beach), and we work on contingency — you pay nothing upfront and no fees unless we win. Start with our free consultation page or explore all of our office locations.
According to Roden Law's own case data, the firm has recovered more than $300 million for injured clients across Georgia and South Carolina — a track record that matters against a hospital's legal team.
📞 Call 1-844-RESULTS for a Free Case Review — No Fees Unless We Win.
Frequently Asked Questions
Q: Can I sue for a HIPAA violation?
A: Not under HIPAA itself — the federal law has no private right of action, so no individual can file a HIPAA lawsuit for money. But Georgia and South Carolina patients can often sue under state law (invasion of privacy, negligence, or breach of confidence) for the unauthorized disclosure of medical information. Whether you have a viable case depends on the harm the disclosure caused, which a lawyer can assess for free.
Q: How much is a HIPAA violation lawsuit worth?
A: There is no fixed dollar amount, and any honest lawyer will tell you so up front. Because you cannot sue under HIPAA, the value comes from your state-law claim and depends on the actual harm — emotional distress, reputational damage, lost income, or financial loss. HIPAA's own civil penalties, which can exceed $2 million per year for the worst violations, are paid to the government, never to the patient.
Q: Is a HIPAA violation medical malpractice?
A: Sometimes. A privacy breach becomes part of a medical malpractice claim when it happens alongside negligent care — for example, records altered during a treatment dispute or a harmful disclosure paired with substandard treatment. When it does, different deadlines apply: 2 years with a 5-year repose in Georgia (O.C.G.A. § 9-3-71), and 3 years with a 6-year repose in South Carolina (S.C. Code § 15-3-545).
Q: How do I report a HIPAA violation?
A: File a complaint with the HHS Office for Civil Rights, generally within 180 days of when you learned of the violation, using the online portal at hhs.gov. OCR can investigate and impose corrective action or penalties, but it does not award money to you. To pursue compensation, you also need to speak with a Georgia or South Carolina attorney about a state-law claim.
Q: What happens if a doctor violates HIPAA?
A: If a doctor violates HIPAA, OCR can investigate and impose corrective action plans, resolution agreements, or civil penalties paid to the government. Separately, the patient may have a state-law claim for damages. According to the U.S. Department of Health and Human Services, penalties depend on the provider's culpability, ranging from roughly $145 per violation to more than $2 million per year for willful neglect that goes uncorrected.
Q: What information can be shared without violating HIPAA?
A: Providers may generally share your health information for treatment, payment, and health-care operations, and when the law requires it — such as certain public-health reporting or a valid court order. In Georgia, O.C.G.A. § 24-12-1 governs when providers may release records. A disclosure that falls outside these permitted purposes — gossip, a leak to an employer, or any unauthorized release — is where a state-law privacy claim may begin.
About the Author
Graeham C. Gillin is a Partner and COO at Roden Law, based in the firm's Charleston office and licensed to practice law in South Carolina. He leads the firm's medical malpractice and medical-privacy matters and, with Roden Law's Georgia-barred attorneys, coordinates dual-jurisdiction cases across Georgia and South Carolina.
This article is for general information only and is not legal advice, and reading it does not create an attorney–client relationship. Laws change and every case is different — speak with a licensed Georgia or South Carolina attorney about your situation. Attorney advertising.
About the Author
