The HIPAA legislation itself does not include the option for individual patients to sue any CE or BA that may violate their privacy protections included in the law.

HITECH added the ability for the States Attorney General offices to file a cased on behalf of their constituents, however.  

The biggest change, however, is the ruling by several State Supreme Courts that allows a complaint to use HIPAA as a legal standard of care.  That opens the door for all kinds of options.

More details at helpmewithhipaa.com/30