Comment by rafram
3 hours ago
The main HIPAA claim seems to be that the victim didn’t provide (or consent to the publication of) that X-ray, and neither did their only family member known to possess it. I don’t know who released it, but if it was someone in the medical office, that is a genuine HIPAA violation.
It could be a violation at the medical office, but Lim isn't a covered entity, and the document accuses her directly.
HIPAA only covers entities that are legally required to follow it. Covered entities and business associates. It doesn’t apply to anyone else.