And I am a therapist who works closely with a legal team now. It's not that easy to sue over; you could technically sue for negligence or malpractice, but certain factors are required for it to stand in court. A lot of lawyers will try to garner business, but if you call with details and it doesn't stand, they won't actually take the case. I've also tried to sue over a HIPAA violation that created some difficulties in my life, but because certain things were not measurable, it wouldn't stand.

The courts tend to not take these cases seriously because so many people try to trump up situations in order to get a payout. It's not that easy as saying, "oh you released my info to my family member and now I'm embarrassed or it ruined the relationship." It has to be a really serious breach... like release info to tabloids on a celebrity which hurt their brand image, so there was a monetary loss.

Most lawyers who are worth their salt won't take the case on a breach unless there is some major, quantifiable loss that can be traced back ONLY to that. They will just send you to the state board of health to file a complaint. If it's the first offense, the person/organization gets a pamphlet, a couple offenses means a mandatory HIPAA training.. You have to have MANY complaints before anything serious happens, including a fine. To lose your license to practice takes a lot more than that. It will depend on the state, but many are very lenient with this because people get pissed off over healthcare and lodge complaints all the time.