OPINION OF THE COURT
Jeffrey A. Cohen, J.Motion by the defendant Jean Kalache for an order, pursuant to CPLR 3043 (b), striking the plaintiff’s third supplemental bill of particulars on the grounds that the plaintiff has alleged a new cause of action and/or theory which was not previously pleaded in the complaint or in the original bill of particulars.*
It is ordered that this motion is determined as follows:
In this medical malpractice action, plaintiff alleges causes of action for medical malpractice and lack of informed consent. Plaintiff served a bill of particulars on or about June 10, 2009, wherein plaintiff responded “not applicable” to the question regarding the statutes and laws violated by defendant Kalache. Plaintiff served a supplemental bill of particulars on January 26, 2010. After defendant Kalache was deposed on April 14, 2010, the plaintiff served a second supplemental bill of particulars dated April 26, 2010, which alleged for the first time that defendant Kalache violated several sections of the Education Law and a section of the Penal Law. By order dated June 21, 2010, the court (Scheinkman, J.) denied defendant Kalache’s motion to strike the second supplemental bill of particulars on the ground that plaintiff first ascertained that defendant Kalache may have violated certain statutes at defendant Kalache’s deposition. On or about July 14, 2010, plaintiff served a third supplemental bill of particulars, which alleged violations of CPLR 4504, section 1177 (a) of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub L 104-191, 110 US Stat 1936, 2029, codified at 42 USC § 1320d-6 [a]), and the rules and regulations of the medical staff at St. Joseph’s Medical Center with respect to progress notes, consultation reports, and medical records. Defendant Kalache rejected the third supplemental bill of particulars on the grounds that it asserted a new theory based upon facts not alleged in the original complaint or bill of particulars, and was palpably improper as *1007there was no evidence that the statutes or rules and regulations of the hospital were violated.
Defendant Kalache now seeks an order striking plaintiff’s third supplemental bill of particulars on the ground that it asserts new theories of negligence. Defendant Kalache asserts that these theories were discoverable by counsel for plaintiff prior to the commencement of the action. Further, defendant Kalache contends that even if plaintiffs counsel only recently discovered these alleged violations after the completion of defendant Kalache’s deposition on July 9, 2010, there is not a scintilla of proof of these alleged violations. Accordingly, defendant Kalache contends that plaintiffs third supplemental bill of particulars should be stricken in its entirety.
Plaintiff opposes the motion. Plaintiff contends that the present motion should be denied on the ground that the court’s order of June 21, 2010, which denied defendant Kalache’s motion to strike the second supplemental bill of particulars, should be given res judicata effect insofar as the court held that when a plaintiff discovers statutory violations, the bill of particulars must be supplemented to provide notice to defendant. Plaintiff further contends that the new claims in the third supplemental bill of particulars assert that plaintiffs privacy and confidentiality rights were violated by defendant Kalache when he revealed her information to his other patients. Plaintiffs counsel admits that he learned earlier in the action that defendant Kalache had mailed plaintiff a Medicare printout listing other patients’ information, as well as plaintiffs, but that plaintiff was unaware as to whether defendant Kalache had also mailed a similar printout containing plaintiff’s information to other patients. Defendant Kalache rejected plaintiffs request for billing notices sent to other patients. In opposition to the motion plaintiff relies upon the deposition of defendant Kalache that “perhaps” the Medicare printout which was sent to plaintiff was the only time such a notice was sent revealing other patients’ information, and that he did not know if plaintiffs information was sent to other patients. Plaintiff asserts that “[i]t is likely that defendant Kalache sent similar notices to his other patients, and thereby violated plaintiffs right of privacy by revealing her [personal information].” Plaintiff further asserts that defendant hospital did not provide its rules until depositions, and that defendant Kalache violated the rules by failing to maintain the records in “original form” since he concedes he altered his original consultant note in plaintiff’s hospital record by later rewriting his note.
*1008Defendant Kalache’s motion to strike plaintiff’s third supplemental bill of particulars is granted on a number of grounds. First, CPLR 3025 provides that “[a] party may amend his [or her] pleading once without leave of court within twenty days after its service” (CPLR 3025 [a]), and “[a] party may amend his [or her] pleading, or supplement it by setting forth additional or subsequent transactions or occurrences, at any time by leave of court or by stipulation of all parties” (CPLR 3025 [b]). In the present case, plaintiff failed to obtain leave of court to supplement her bill of particulars for a third time prior to serving same on defendants. Plaintiff also failed to seek leave in response to the present motion.
Second, even if plaintiff had properly moved for leave to supplement her bill of particulars, leave would be denied. While leave to serve an amended or supplemental pleading is to be liberally granted and the merit of the proposed amendment need not be established, an amendment which is “ ‘palpably insufficient’ to state a cause of action or defense or is patently devoid of merit” will not be permitted (Lucido v Mancuso, 49 AD3d 220, 229 [2d Dept 2008]; see Efstathiou v Cuzco, LLC, 51 AD3d 712 [2d Dept 2008]). To that end, in Lucido (49 AD3d 220 [2008]), the court denied plaintiff leave to amend the bill of particulars to assert a Labor Law § 241 (6) cause of action since the court determined the proposed claim to be palpably without merit on the grounds that the injured plaintiff was not involved in any construction, excavation, or demolition work covered under the statute, and plaintiff failed to allege a violation of a specific and concrete provision of the Industrial Code as required by the statute.
In the present case, plaintiff’s third supplemental bill of particulars alleges, inter alia, a violation of HIPAA and CPLR 4504, which both establish a statutory privilege which prevents the disclosure of medical records and information without authorization from the patient. Although the statutory privilege may overlap with the implied fiduciary duty of confidentiality which attaches to a physician-patient relationship (Juric v Bergstraesser, 44 AD3d 1186 [3d Dept 2007]; MacDonald v Clinger, 84 AD2d 482 [4th Dept 1982]), a cause of action for breach of fiduciary duty of confidentiality for unauthorized disclosure of medical records or information does not arise from a statutory right or evidentiary rules (Lightman v Flaum, 97 NY2d 128, 136 [2001]; Daly v Metropolitan Life Ins. Co., 4 Misc 3d 887 [Sup Ct, NY County 2004]). In Lightman (97 NY2d 128 [2001]), *1009the Court of Appeals specifically found that the evidentiary rules set forth in article 45 of the CPLR, including CPLR 4504, are not the source of the underlying duties of fiduciary duty of confidentiality which exist in a confidential relationship, such as physician-patient, and article 45 does not establish the parameters of those fiduciary relationships. Accordingly, the Court of Appeals in Lightman (97 NY2d 128 [2001]) held that CPLR 4505, which establishes an evidentiary privilege for communications between a clergy and congregant, does not give rise to a cause of action for breach of fiduciary duty. Similarly, the courts have held that HIPAA and the Privacy Rules (45 CFR parts 160, 164) promulgated thereunder do not create a private cause of action (Webb v Smart Document Solutions, LLC, 499 F3d 1078 [9th Cir 2007]; Acara v Banks, 470 F3d 569, 571 [5th Cir 2006]; Cassidy v Nicolo, 2005 WL 3334523, 2005 US Dist LEXIS 34160 [WD NY 2005]). Accordingly, those claims of plaintiff’s third supplemental bill of particulars which allege violations of CPLR 4504 and HIPAA are patently insufficient to state a cause of action (Lucido v Mancuso, 49 AD3d 220 [2008]).
Finally, the claim in plaintiff’s third supplemental bill of particulars which alleges a violation of defendant hospital’s rules and regulations is palpably meritless. The third supplemental bill of particulars alleges a violation of the defendant hospital’s rules and regulations with respect to “progress notes,” “consultation reports” and “medical records as a legal document.” Again, it is questionable whether a private cause of action arises as to any violation of a hospital’s rules and regulations. In any event, the claim is not specifically detailed so as to give defendant Kalache notice of the alleged violation. Notably, those portions of the hospital’s rules and regulations regarding progress notes and consultation reports essentially require that such notes and reports be recorded at the time of observation, dated and signed. As to the medical records as legal records, the hospital’s rules and regulations require, inter alia, that said records be maintained in original form for a period of no less than six years after date of service. Plaintiff’s contention in opposition to the present motion that defendant Kalache did not maintain the records in their original form because he added a note to his original consultant note does not assert a violation of the defendant hospital’s rules and regulations insofar as the rules and regulations do not prohibit a physician from amending or adding to their prior notes in the medical chart of a patient.
*1010In view of the foregoing, it is ordered that defendant Kalache’s motion to strike plaintiff’s third supplemental bill of particulars is granted; and it is further ordered that insofar as discovery is complete in this action, a trial readiness order shall issue.
The reply affirmation of Angela M. Ribaudo, dated August 25, 2010, with exhibits, has not been considered by this court insofar as the order to show cause specifically stated that no reply papers shall be accepted.