Court Rules State Law Privacy Claim Not Preempted by ERISA

The District Court for the Middle District of Florida recently ruled that a plaintiff’s state law invasion of privacy claim was not preempted by the Employee Retirement Income Security Act (ERISA).  In this case, the plaintiff was mailed a letter from his health insurer where the address window on the envelope containing the letter was too large and showed the plaintiff’s private health information, including information related to the plaintiff’s HIV status.  The plaintiff brought a number of state law claims against the insurer including breach of contract, negligence, negligent infliction of emotional distress, and invasion of privacy.  The defendant insurer argued that these state law claims should be dismissed because they are preempted by ERISA.  By way of background, ERISA (a federal law) contains preemption provisions, meaning that ERISA takes precedence over state laws that relate to employee benefit plans.  One of ERISA’s preemption provisions, ERISA § 502, generally applies to actions brought by an ERISA participant to recover benefits due under the terms of a plan, to enforce rights under the plan, or to clarify rights to future benefits under the terms of a plan.  In this case, the court agreed with the defendant that the state law negligence and breach of contract claims should be preempted by ERISA § 502 because those claims related to plan terms.  However, the plaintiff’s state law invasion of privacy claim was allowed to proceed in state court because the privacy claim did not depend on the terms of the benefit plan.  Rather, the privacy claim was based solely on the insurer’s statutory obligations under state law.  This ruling is significant because it provides a path for the plaintiff to sue based on a disclosure of private health information.  Generally, when discussing the disclosure of sensitive health information, it is in the context of a breach of HIPAA’s privacy and security rules.  Although the Department of Health and Human Services might assess a significant penalty for a HIPAA breach, most courts have ruled that HIPAA does not provide a basis for an individual to sue.  Doe v. Aetna Life Ins. Co. (M.D. Fla. 2018).