Background
Sha-Ann Arndts, proceeding pro se, sued the University of Cincinnati Medical Center after alleging wrongdoing connected to her medical care. Her amended complaint asserted defamation, fraud, tampering with records, fraudulent billing, failure to report abuse, and violations of HIPAA and Ohio Revised Code Chapter 3798.
The trial court granted UC’s Civ.R. 12(B)(6) motion and dismissed the entire complaint without explanation. Arndts appealed, arguing that dismissal was improper and disputing potential grounds including res judicata.
The Court’s Holding
The First District affirmed dismissal of the defamation claim because the alleged statements that Arndts had mental illness and addiction were, at most, defamatory per quod, and she did not plead special damages. It also affirmed dismissal of the fraud, tampering-with-records, and fraudulent-billing claims because they were not pleaded with the particularity required for fraud, and of the failure-to-report-abuse claim because R.C. 5101.63 does not independently provide an abused adult a civil cause of action.
The court held that HIPAA itself provides no private cause of action. But Arndts’s allegations that UC disclosed her nonpublic medical information to third parties without consent plausibly stated an Ohio common-law breach-of-confidentiality claim under Biddle v. Warren General Hospital. The court reversed dismissal of that claim and remanded; it also held that res judicata could not support a Civ.R. 12(B)(6) dismissal of the surviving claim.
Key Takeaways
- HIPAA does not authorize a private damages action, but Ohio recognizes a tort for unauthorized disclosure of nonpublic medical information.
- A complaint need not label the state-law privacy claim correctly if its alleged facts provide fair notice and support relief.
- Res judicata generally is not a proper basis for dismissal under Civ.R. 12(B)(6) because it requires material beyond the complaint.
Why It Matters
The decision underscores that health-care privacy allegations may survive even when a plaintiff incorrectly frames them as a HIPAA claim. Ohio providers facing unauthorized-disclosure allegations should assess potential common-law confidentiality exposure, not merely HIPAA’s lack of a private right of action.