Last reviewed: 2026-07-24
A HIPAA violation and medical malpractice are two different legal wrongs. One is a records-and-privacy failure — your protected health information is exposed, snooped on, lost, or shared without permission. The other is negligent medical care that physically injures a patient. A privacy breach on its own supports a state-law privacy claim; it becomes part of a malpractice case only when it accompanies substandard treatment that causes harm.
Key Takeaways
- A HIPAA violation is a privacy failure and medical malpractice is negligent care that injures you — they are separate legal claims with separate proof.
- HIPAA gives patients no private right of action; the direct remedy is an Office for Civil Rights complaint filed within 180 days.
- A privacy breach can still support a state-law claim: breach of confidence in South Carolina (McCormick v. England) or invasion of privacy in Georgia.
- The strongest cases live in the overlap — when records are mishandled and the underlying care fell below the medical standard.
- Georgia medical-malpractice claims run 2 years with a 5-year repose (O.C.G.A. § 9-3-71); South Carolina runs 3 years from discovery with a 6-year repose (S.C. Code § 15-3-545).
- If you suspect both a privacy breach and negligent care, preserve your records and speak with a lawyer before deadlines run.
What medical malpractice actually requires
Medical malpractice is negligent medical care that injures a patient, and proving it requires four specific elements. First, a duty — a provider-patient relationship that obligates the provider to act competently. Second, a breach of the professional standard of care — the provider did something a reasonably careful practitioner in the same field would not have done, or failed to do something they should have. Third, causation — that breach, not something else, caused the injury. Fourth, damages — real physical, financial, or emotional harm resulting from the negligence.
Expert testimony is generally required to establish the standard of care and how it was breached, because jurors are not expected to know what competent treatment looks like in a specialized field. Common examples include misdiagnosis or delayed diagnosis, surgical errors, medication and dosage errors, birth injuries, and anesthesia mistakes. If you want a fuller picture of what these cases involve, our medical malpractice lawyers page walks through how each type is proven.
What a HIPAA violation actually is
A HIPAA violation is a failure to protect the privacy or security of your health information, and it takes many forms. Unauthorized disclosure of records, an employee snooping in a chart with no treatment reason, lost or stolen files, sharing information with someone you never authorized, and failing to notify you after a breach all qualify. HIPAA — the Health Insurance Portability and Accountability Act — sets the federal privacy floor that hospitals, clinics, and their business associates must meet.
According to the U.S. Department of Health and Human Services, HIPAA does not give patients a private right of action, so you cannot sue "under HIPAA" directly. The primary federal remedy is a complaint to the HHS Office for Civil Rights. According to the HHS Office for Civil Rights, that complaint must generally be filed within 180 days of when you knew or should have known about the violation, with a good-cause extension possible. Any penalties the agency imposes are paid to the government, not to you — roughly $145 per violation and up to about $2.19 million per year for uncorrected willful neglect under the 2026 adjusted amounts. For the full walkthrough of that process and the state-law claims that can put money in a patient's hands, see our flagship guide on whether you can sue for a HIPAA violation.
Why a HIPAA violation alone falls outside malpractice
A HIPAA violation and a malpractice claim answer to two different legal duties, which is exactly why a privacy breach by itself sits outside malpractice law. Malpractice protects the quality of your care; the privacy rules protect the confidentiality of your records. Because the duties differ, so does everything downstream. The typical harm from a pure privacy breach is dignitary, reputational, or financial — embarrassment, a leaked diagnosis, identity theft — rather than a physical injury from botched treatment. And the proof differs: a pure privacy claim needs no medical expert to establish a standard of care, while a malpractice claim almost always does.
Graeham C. Gillin, a partner in Roden Law's Charleston office and a South Carolina-licensed attorney, explains that the cleanest way to think about it is to ask what went wrong: if the records were mishandled you are likely looking at a privacy claim, but if the care fell below the professional standard and injured you, that is malpractice — and a single event can trigger both at once.
| HIPAA violation | Medical malpractice | |
|---|---|---|
| Nature of the wrong | Privacy/records failure | Negligent medical care |
| Duty breached | Confidentiality of health information | Professional standard of care |
| Typical harm | Reputation, dignity, finances | Physical injury and its consequences |
| Enforcement / who you sue | OCR complaint to the government; state privacy suit against the provider | Malpractice suit against the negligent provider |
| Medical expert needed? | Not for a pure privacy claim | Generally yes |
| Deadline (GA) | Privacy: 2 yrs (O.C.G.A. § 9-3-33) | 2 yrs / 5-yr repose (O.C.G.A. § 9-3-71) |
| Deadline (SC) | Privacy: 3 yrs (S.C. Code § 15-3-530) | 3 yrs from discovery / 6-yr repose (S.C. Code § 15-3-545) |
When the two overlap — the important part
The overlap is where the strongest cases live, because one event can breach both your privacy and your standard of care at the same time. Records that are altered or selectively disclosed during a treatment dispute can signal an attempt to paper over negligence. The harmful disclosure of a sensitive diagnosis — HIV status, a psychiatric condition, a reproductive-health matter — can compound an injury caused by negligent care. And in a nursing home, sloppy handling of a resident's records is often one visible symptom of the broader neglect our nursing home abuse lawyers investigate.
The privacy side of an overlap case rests on state law, and it differs by state. According to the South Carolina Court of Appeals in McCormick v. England, 328 S.C. 627, 494 S.E.2d 431 (S.C. Ct. App. 1997), a physician who discloses confidential patient information can be liable for breach of confidence — the doctrine South Carolina patients rely on. In Georgia, the first state to recognize a common-law invasion of privacy, that tort covers medical information, and O.C.G.A. § 24-12-1 frames the disclosures a provider is permitted to make. When either privacy theory travels alongside a genuine malpractice claim, the combined case is usually far stronger than either piece standing alone. And when the negligent care took place in a hospital, our walkthrough of suing a hospital for negligence in Georgia or South Carolina covers the procedural gates that apply.
The filing deadlines you cannot miss
The deadline to sue depends on the claim and the state, and missing it usually ends the case no matter how strong the facts. In Georgia, a medical-malpractice claim generally must be filed within 2 years of the injury, subject to a 5-year statute of repose (O.C.G.A. § 9-3-71); in South Carolina, the window is generally 3 years from discovery with a 6-year repose (S.C. Code § 15-3-545). A pure privacy or general-injury claim follows the ordinary personal-injury clock — 2 years in Georgia (O.C.G.A. § 9-3-33) and 3 years in South Carolina (S.C. Code § 15-3-530).
Because the exact trigger date can be contested, do not try to calculate it alone. Our deeper breakdowns of the Georgia medical malpractice limits and the South Carolina medical malpractice limits explain how repose periods and discovery rules can shorten — or occasionally extend — your real deadline.
What to do if you suspect both
Take a few concrete steps to protect a possible privacy-plus-malpractice claim before the deadlines run:
- Request a full copy of your records in writing, and note the date — later alterations become easier to spot against a preserved baseline.
- Write down what happened while it is fresh: who disclosed what, who was involved in your care, and what harm followed.
- File an OCR complaint within 180 days if you believe your privacy was violated, so the federal clock is preserved.
- Talk to a lawyer promptly about whether the underlying care also fell below the standard — the malpractice deadline is often shorter than you expect.
According to Roden Law case data, the firm has recovered more than $300 million for injured clients, and we review potential HIPAA-and-malpractice cases at no charge. Serving patients from our Charleston and Savannah offices and every location in between — see all of our office locations — Roden Law works on contingency: no fees unless we win. To have your situation reviewed, contact us or call 1-844-RESULTS. Free Case Review — No Fees Unless We Win.
Frequently Asked Questions
Q: Is a HIPAA violation medical malpractice?
A: A HIPAA violation and medical malpractice are separate legal wrongs. A HIPAA violation is a privacy failure — your records were exposed or misused — while malpractice is negligent care that injures you. A privacy breach becomes part of a malpractice case only when it accompanies substandard treatment that causes harm.
Q: What qualifies as medical malpractice?
A: Medical malpractice requires four elements: a provider-patient duty, a breach of the professional standard of care, causation, and actual damages. Expert testimony is generally needed to show what a competent practitioner would have done and how the provider fell short, which is why not every bad outcome qualifies as malpractice.
Q: Can you sue for a HIPAA violation?
A: You cannot sue directly under HIPAA because it has no private right of action, but you can file an Office for Civil Rights complaint within 180 days and pursue a state-law privacy claim against the provider. Our flagship guide on suing for a HIPAA violation explains both paths in detail.
Q: What are examples of medical malpractice?
A: Common examples include misdiagnosis or delayed diagnosis, surgical errors, medication and dosage mistakes, birth injuries, anesthesia errors, and failure to obtain informed consent. Each involves care that fell below the professional standard and injured the patient. Our medical malpractice lawyers page details how these cases are proven.
Q: What happens if a doctor violates HIPAA?
A: When a doctor violates HIPAA, you can file a complaint with the HHS Office for Civil Rights, which may investigate and impose penalties paid to the government. According to the HHS Office for Civil Rights, penalties can reach roughly $2.19 million per year for uncorrected willful neglect. To recover money yourself, you generally must bring a state-law privacy claim.
Q: How long do I have to file a medical malpractice claim in Georgia or South Carolina?
A: In Georgia, you generally have 2 years from the injury with a 5-year statute of repose (O.C.G.A. § 9-3-71). In South Carolina, you generally have 3 years from discovery with a 6-year repose (S.C. Code § 15-3-545). Because the trigger date is often disputed, confirm your deadline with a lawyer quickly.
About the Author
This article was reviewed by Graeham C. Gillin, a Partner in Roden Law's Charleston office who is licensed to practice law in South Carolina and, with Roden Law's Georgia-barred attorneys, coordinates dual-jurisdiction cases across both states. Graeham focuses on cases where negligent care and mishandled records overlap, helping injured patients understand which claims apply and how to protect their deadlines.
This article is for general information only and is not legal advice. Reading it does not create an attorney-client relationship. Attorney advertising. Prior results do not guarantee a similar outcome.
About the Author
