Tucker Ellis Market Share Analysis for August 2026

Medical privacy litigation is growing rapidly in Ohio. In the wake of two major changes in the law in this area, medical providers and other businesses that maintain protected health information (“PHI”) such as medical records are seeing an increasing number of lawsuits alleging improper disclosures of such confidential information. This new wave of potential liability presents several avoidable pitfalls for Ohio businesses and individuals. The two major changes in the law of medical privacy, as it relates to Ohio litigants, are: (1) the watershed case of Biddle v. Warren General Hosp. (1999), 86 Ohio St.3d 395; and (2) the passage of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The 1999 Biddle case recognized a new and independent tort under Ohio law arising from the unauthorized, improper disclosure of confidential information to third parties. The federal HIPAA privacy rules, which took effect on April 14, 2003, provide a number of requirements whereby “covered entities” (entities that routinely handle PHI) must take certain steps to avoid improperly disclosing confidential information. See 45 C.F.R. Parts 160 and 164, et seq. These HIPAA regulations include requirements that covered entities give individuals notice of their privacy practices, try to obtain written acknowledgment of receipt of the notice, and obtain authorizations when applicable. Furthermore, covered entities must limit disclosure of confidential information to certain designated activities such as health care operations, patient care and payment. The combined effect of Biddle and HIPAA on medical privacy litigation in Ohio has only begun to appear. Recent developments show that plaintiffs are finding more opportunities to file litigation alleging improper disclosure of PHI. For example, in Gomcsak v. Dawson, Cuyahoga County, Ohio Court of Common Pleas, Case No. 481082, filed September 9, 2002, plaintiff’s medical records were subpoenaed by her husband’s attorney du