Yes, that's a good point. I think the lack of case law is really the key here. Interesting that this hasn't all been sorted out in case law. It seems people aren't as sue-happy as one might be made to believe.Fact of the matter is, none of this is settled caselaw even though it's been 13 years since HIPAA was approved.
So here's the thing: In order to sue, you need a reason. If suing is super-duper easy and cheap, people will sue over everything. If suing is expensive, people will sue over things that will be profitable. An attorney will take a case on spec but only if they suspect they'll make enough, as their fee, to cover their investment of time. You can absolutely file a HIPAA complaint. However, you will get no money out of it. If HHS decides your rights were violated, HHS will fine the violator. You will see nothing. So if you want personal redress, you have to be able to demonstrate that you, personally, suffered injury. If you are a private figure, your anonymity has a value of zero. If you are a public figure, you likely don't do yelp reviews using your first name and last initial (Amy W.: "They tried to make me go to this rehab but I said, no, no no!"). If you are a private figure who becomes famous because of your yelp review you become a limited-purpose public figure and your anonymity has a value of less than zero. In order for caselaw to advance on this one, a private individual would have to demonstrate that they experienced material harm from a pseudonymous HIPAA disclosure. I'm pretty imaginative, but off the top of my head I'm drawing a blank.
HHS doesn't have to sue. They are judge, jury and executioner. HHS determines your violations outside a court of law. HHS assigns penalties outside a court of law. It's like the FAA or the DOT or the SEC or any other USA TLA: if they decide you owe money, you owe money. It's not a judgement, it's a fine. What you, as a non-governmental entity, can do, is argue the fairness or validity of the law under which you were fined... but the law itself is entirely under their purvey. http://www.washingtonpost.com/wp-dyn/content/article/2011/02/22/AR2011022207094.html That's what this looks like - not a litigious reshaping of the law but a top-down bureaucracy determining how badly you're fucked. Again, in the land of civil fun the law can be shaped... but now we're back in that corner case I lack the imagination to create.