Cmty. Health Network v. McKenzie

Full title: Community Health Network, Inc., Appellant v. Heather McKenzie, et al.…

Court: Supreme Court of Indiana

Date published: Apr 13, 2022

185 N.E.3d 368 (Ind. 2022)

Opinion

Supreme Court Case No. 20S-CT-648

04-13-2022

COMMUNITY HEALTH NETWORK, INC., Appellant v. Heather MCKENZIE, et al., Appellees

ATTORNEYS FOR APPELLANT: Sherry A. Fabina-Abney, Jenny R. Buchheit, Stephen E. Reynolds, Sean T. Dewey, Ice Miller LLP, Indianapolis, Indiana ATTORNEY FOR APPELLEES: William N. Riley, RileyCate, LLC, Fishers, Indiana ATTORNEY FOR AMICI CURIAE INDIANA STATE MEDICAL ASSOCIATION AND AMERICAN MEDICAL ASSOCIATION: Libby Yin Goodknight, Krieg DeVault LLP, Indianapolis, Indiana ATTORNEYS FOR AMICUS CURIAE INDIANA HOSPITAL ASSOCIATION: Angela M. Smith, Andrew B. Howk, Hall Render Killian Heath & Lyman, Indianapolis, Indiana ATTORNEY FOR AMICI CURIAE INDIANA HEALTH IN FORMATION EXCHANGE AND REGENSTRIEF INSTITUTE: Alexandria H. Pittman, Ice Miller LLP, Indianapolis, Indiana ATTORNEY FOR AMICUS CURIAE INDIANA TRIAL LAWYERS ASSOCIATION: Gabriel A. Hawkins, Cohen & Malad, LLP, Indianapolis, Indiana ATTORNEYS FOR AMICUS CURIAE INDIANA PATIENT'S COMPENSATION FUND: A. Richard M. Blaiklock, Wade D. Fulford, Taylor L. Fontan, Lewis Wagner, LLP, Indianapolis, Indiana

Rush, Chief Justice.

ATTORNEYS FOR APPELLANT: Sherry A. Fabina-Abney, Jenny R. Buchheit, Stephen E. Reynolds, Sean T. Dewey, Ice Miller LLP, Indianapolis, Indiana

ATTORNEY FOR APPELLEES: William N. Riley, RileyCate, LLC, Fishers, Indiana

ATTORNEY FOR AMICI CURIAE INDIANA STATE MEDICAL ASSOCIATION AND AMERICAN MEDICAL ASSOCIATION: Libby Yin Goodknight, Krieg DeVault LLP, Indianapolis, Indiana

ATTORNEYS FOR AMICUS CURIAE INDIANA HOSPITAL ASSOCIATION: Angela M. Smith, Andrew B. Howk, Hall Render Killian Heath & Lyman, Indianapolis, Indiana

ATTORNEY FOR AMICI CURIAE INDIANA HEALTH IN FORMATION EXCHANGE AND REGENSTRIEF INSTITUTE: Alexandria H. Pittman, Ice Miller LLP, Indianapolis, Indiana

ATTORNEY FOR AMICUS CURIAE INDIANA TRIAL LAWYERS ASSOCIATION: Gabriel A. Hawkins, Cohen & Malad, LLP, Indianapolis, Indiana

ATTORNEYS FOR AMICUS CURIAE INDIANA PATIENT'S COMPENSATION FUND: A. Richard M. Blaiklock, Wade D. Fulford, Taylor L. Fontan, Lewis Wagner, LLP, Indianapolis, Indiana

On Petition to Transfer from the Indiana Court of Appeals, No. 19A-CT-873

Rush, Chief Justice. Nearly twenty-five years ago, Justice Dickson recognized a need for "deterrence and accountability" due to "the growing technological opportunities for invasive scrutiny into others’ lives, the compilation of private data, and the disclosure of purely personal matters." His prescient observation is more relevant today than ever before. Indeed, much of our personal information is stored digitally, and unauthorized access to private data has never been easier. Take medical records—with the click of a button, countless health-care professionals can view our most private, sensitive health information. To be sure, this ready access has revolutionized the industry, allowing medical personnel to diagnose and treat patients quickly and accurately. But with great access comes great responsibility—an abuse of which may give rise to liability.

Here, an employee of a health-care provider improperly accessed and disclosed information from numerous patients’ medical records. Determining whether the provider is liable for that conduct requires us to address several issues: the applicability of Indiana's Medical Malpractice Act; the proper scope-of-employment inquiry; the availability of emotional-distress damages in negligence-based claims; and the viability of an invasion-of-privacy claim for the public disclosure of private facts.

We conclude that the Medical Malpractice Act does not apply to these circumstances. We then find that there are genuine issues of material fact as to whether the employee's acts were within the scope of employment. Importantly, we confirm the viability of a tort claim for the public disclosure of private facts. But we ultimately hold that the health-care provider is not liable because the undisputed facts negate a required element on both the negligence claims and the public-disclosure claim.

Facts and Procedural History

Katrina Gray, a medical-records coordinator with Community Health Network, improperly accessed and disclosed information from the confidential medical records of several individuals. Among those affected are the plaintiffs in this case: Heather McKenzie; her husband Daniel McKenzie; her children J.M. and O.M.; her parents Deborah and Michael West; and her father-in-law John McKenzie (collectively "Plaintiffs"). Gray's access and alleged disclosure of Plaintiffs’ medical records, however, wasn't random. Rather—as the facts below illustrate—it was the latest chapter in a long-running family feud.

Deborah and Michael have known Gray since she was a child. In 2005, Gray, who worked at Indiana Orthopedic Center (IOC), helped Heather get a job there and was her direct supervisor. During this time, Heather began dating and eventually married Gray's stepson, and the couple had two children, J.M. and O.M. But around 2010, Heather's relationship with the Gray family quickly deteriorated.

Initially, Gray "was hurt" because Heather switched departments at IOC. Heather also separated from her husband—due in part to multiple documented incidents of his violent and abusive behavior—and began spending time with Daniel. Gray responded by "being crazy and mean" at work, regularly directing vulgar insults at Heather. Soon after, Heather was fired from IOC, which she attributed to Gray, and she divorced Gray's stepson. When Heather married Daniel in early 2011, his father, John, hired security for the wedding because of concerns about Gray's prior "retaliation" and her stepson's "violent" behavior. These events—and others—precipitated a rift between the Gray family and the West and McKenzie families.

Throughout this time, Gray continued working at IOC. Then, in 2012, Community purchased the practice and took over its management and operations. During the acquisition, nonphysician employees who wanted to remain with IOC had to apply for employment with Community. Gray applied and was hired and trained as a medical-records coordinator.

As part of its onboarding process, Community required Gray to review and agree to its policies and procedures, attend an orientation, and complete training on the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Upon completion, Gray received access to Community's electronic medical record system, which has "over 17,000 users." One of Community's policies indicated that employee access to protected health information is controlled and scrutinized in accordance with HIPAA and that "[a]ll appropriate access will be granted to the employee for the fulfillment of his/her job duties." Though Gray was authorized to schedule appointments and release records only for patients of the orthopedic providers in the practice, her broad access also allowed her to access the electronic medical records of non-IOC Community patients.

In January 2013, despite completing privacy trainings and having signed agreements that specifically prohibited the unauthorized access of electronic medical records, Gray began accessing non-IOC patients’ records. Over the next nine months, Gray accessed Heather's medical records sixteen times, Daniel's five times, J.M.’s six times, O.M.’s three times, Deborah's twice, and Michael's and John's once each. During that time, in February, Gray received a performance appraisal indicating that she was appropriately handling private health information and maintaining confidentiality expectations. Yet, just days before the review, she accessed the medical records of Heather and her parents.

Gray's actions went undetected by Community until September 2013 when it received an anonymous tip that she was viewing her own medical chart in violation of hospital policy. Community investigated the allegations and fired Gray after discovering she had repeatedly accessed Plaintiffs’ medical records. Further investigation revealed that Gray had also accessed the records of over 160 other Community patients, none of whom "received services" at IOC. Community subsequently sent notices to the affected patients, including Plaintiffs.

A few months later, Plaintiffs sued Community and Gray. They brought claims of respondeat superior and negligent training, supervision, and retention against Community and claims of negligence and invasion of privacy against Gray.

Community filed a motion to dismiss for lack of subject-matter jurisdiction and a motion for summary judgment. Community asserted that the trial court lacked jurisdiction because Indiana's Medical Malpractice Act (MMA) applied to Plaintiffs’ complaint, and the Plaintiffs had not satisfied the MMA's "express jurisdictional requirements." Community alternatively claimed that it was entitled to summary judgment because Gray's tortious acts were committed outside the scope of her employment, Plaintiffs lacked cognizable damages, and the claims against Gray were not actionable under Indiana law.

After a hearing, the trial court denied the motion to dismiss, finding the MMA did not apply because the Plaintiffs "were not patients of the practice at which Gray worked" and Gray's alleged misconduct "did not involve providing medical treatment to them." The court also denied summary judgment, finding unresolved factual questions on whether Gray's conduct was within the scope of her employment; whether Plaintiffs had actual damages; and whether Gray had publicly disclosed information from the records.

In a permissive interlocutory appeal, the Court of Appeals affirmed in part and reversed in part. Cmty. Health Network, Inc. v. McKenzie , 150 N.E.3d 1026, 1030–31 (Ind. Ct. App. 2020). It affirmed the trial court's denial of Community's motion to dismiss, concluding that the underlying claims did not fall under the MMA. Id. at 1037–39. And it affirmed the trial court's denial of summary judgment except for Plaintiffs’ invasion-of-privacy claim. Id. at 1040–45. On that claim, the panel held that Community was entitled to judgment as a matter of law because the subtort at issue—public disclosure of private facts—is not recognized in Indiana. Id. at 1044–45.

Community then sought transfer, which we granted, vacating the Court of Appeals opinion. Ind. Appellate Rule 58(A).

Discussion and Decision

Before analyzing whether Plaintiffs’ claims survive summary judgment, we address a threshold issue: whether Plaintiffs’ claims against Community are subject to the MMA. Community asserts "there is no dispute that Plaintiffs’ claims fall within the scope of the MMA." Plaintiffs disagree, maintaining the MMA does not apply to "claims alleging the mishandling of a patient's confidential information." On this record, we agree with Plaintiffs. The misconduct alleged does not constitute "malpractice," and thus, the trial court did not err in denying Community's motion to dismiss for lack of subject-matter jurisdiction.

We then address whether Community is entitled to summary judgment. Plaintiffs seek to hold Community vicariously liable for Gray's tortious acts—negligence and invasion of privacy—under the doctrine of respondeat superior , and directly liable for negligent training, supervision, and retention. Ultimately, we conclude that Community is entitled to summary judgment because it has negated a required element on each claim. But within our analysis, we clarify the proper scope-of-employment inquiry when vicarious liability is predicated on an employee's unauthorized acts. Finally, we explicitly recognize the viability of an invasion-of-privacy tort claim based on the public disclosure of private facts. But because Community has negated the tort's "publicity" element, that claim also fails.

I. The MMA does not apply to Plaintiffs’ claims.

We first address whether Plaintiffs’ claims against Community relating to Gray's unauthorized access and disclosure of electronic medical records are subject to the MMA. The interpretation of the MMA presents a question of law subject to de novo review. Howard Reg'l Health Sys. v. Gordon , 952 N.E.2d 182, 185 (Ind. 2011). We note, however, that it was designed to curtail, not expand, liability for malpractice. Chamberlain v. Walpole , 822 N.E.2d 959, 963 (Ind. 2005). Thus, the MMA is in derogation of the common law and should be strictly construed against imposing limitations on a claimant's right to bring suit. See, e.g. , G.F. v. St. Catherine Hosp., Inc. , 124 N.E.3d 76, 84 (Ind. Ct. App. 2019), trans. denied. The MMA grants authority over medical malpractice actions first to a medical review panel, which must render an opinion on a claimant's proposed complaint before the claimant can sue a health-care provider in court. Ind. Code § 34-18-8-4. Malpractice is a "tort or breach of contract based on health care or professional services that were provided, or that should have been provided, by a health care provider, to a patient." I.C. § 34-18-2-18. This definition imposes four requirements, two of which are not challenged here—Plaintiffs allege a "tort ... by a health care provider," and Plaintiffs are all "patient[s]" of Community. See id. The contested issues are whether the tortious conduct was (1) based on "health care" or "professional services" (2) that were, or should have been, provided "to a patient." Id. Because neither requirement is met, we hold the MMA does not apply.

To determine whether the conduct was based on "health care" or "professional services," we look first to the definitions provided in the MMA. "Health care" is "an act or treatment performed or furnished, or that should have been performed or furnished, by a health care provider for, to, or on behalf of a patient during the patient's medical care, treatment, or confinement." Id. § -13 (emphasis added). The statute's focus on timing—requiring that the alleged tortious conduct (whether by omission or commission) occur "during" a patient's care, treatment, or confinement—imposes a temporal requirement that tethers the misconduct to patient care. See id. But here, neither Plaintiffs nor Community have alleged or shown any such connection. And without this requisite temporal tie, the underlying actions are not "health care" under the MMA.

The remaining question is whether the unauthorized access of Plaintiffs’ medical records qualifies as a "professional service" under the MMA. Unlike "health care," "professional service" is not defined in the MMA. Community contends that its "maintenance of medical records, as well as its determination and utilization of the appropriate mechanisms, training protocols, and procedures for logging, auditing, monitoring, detecting, or otherwise securing access to patient records, are professional services." To be sure, Community uses professional judgment when it establishes protocols for creating, maintaining, and accessing patient information. But even if we assume that the mere exercise of professional judgment makes doing so a "professional service," Community's relevant protocols and procedures could support a malpractice claim only if they were provided "to a patient." Id. § -18.

Although this case presents a close call, on this record we conclude that Community's internal business decisions and access protocols for medical records are not professional services provided to a patient. Community acts largely on its own behalf in developing and implementing its policies for safeguarding confidential patient health information. And these policies—which are directed inward to Community employees, not outward to its patients—are used to execute Community's regulatory obligations and balance its business risks. Simply put, Community's applicable protocols and procedures are neither conduct related "to the promotion of a patient's health" nor do they require "the provider's exercise of professional expertise, skill, or judgment." Gordon , 952 N.E.2d at 185. Additionally relevant here, Plaintiffs were not patients of any of the orthopedic providers for whom Gray was responsible for scheduling appointments and releasing medical records. Thus, Gray's unauthorized access of Plaintiffs’ medical records was unrelated to any professional service executed on their behalf as Community's patients. To summarize, the alleged misconduct does not fall under the MMA. It lacks a temporal connection to any care provided by Community to the Plaintiffs as patients. And it was also unrelated to either the promotion of a patient's health or the provider's exercise of professional expertise, skill, or judgment. We note, however, that while the MMA is inapplicable here, the same may not be true for other claims involving medical records. Take, for example, claims for their improper maintenance. Where shoddy maintenance leaves medical records inaccurate, inaccessible, or missing, providers may not have at their disposal reliable patient information for diagnosing or treating an illness. See id. at 186. In such circumstances, the connection "to a patient" is clear and direct—and so is the MMA's application. See id. But those circumstances are not before us. And thus, the trial court did not err in denying Community's motion to dismiss for lack of subject-matter jurisdiction.

II. While questions of fact remain on the scope-of-employment issue, Community has negated an element of each claim.

Community maintains that it is entitled to summary judgment on Plaintiffs’ claims. Summary judgment is appropriate when—after drawing all reasonable inferences in favor of the nonmoving party—the designated evidence shows no genuine issue of material fact, and the movant is entitled to judgment as a matter of law. Ind. Trial Rule 56(C) ; see also Siner v. Kindred Hosp. Ltd. P'ship , 51 N.E.3d 1184, 1187 (Ind. 2016). A movant can make this showing when undisputed evidence affirmatively negates a required element. Siner , 51 N.E.3d at 1187–88.

Plaintiffs seek to hold Community liable under two theories: negligent training, supervision, and retention and the doctrine of respondeat superior. The first imposes direct liability on Community and requires that Gray's access and disclosure of Plaintiffs’ medical records was outside the scope of her employment. See Sedam v. 2JR Pizza Enters., LLC , 84 N.E.3d 1174, 1178 (Ind. 2017). The second imposes vicarious liability on Community for Gray's tortious acts—negligence and invasion of privacy—and requires that the misconduct was within the scope of her employment. See id. So, though these are alternative theories of relief that ultimately seek the same result, the claims under both can survive summary judgment if there is a genuine issue of material fact on the scope-of-employment issue. Whether an act falls within this scope is generally a question of fact. Knighten v. E. Chi. Hous. Auth. , 45 N.E.3d 788, 794 (Ind. 2015).

A. An employee's conduct may fall within the scope of employment even though it is unauthorized and violates an agreed-to policy.

Community contends that Gray's improper access of Plaintiffs’ medical records falls outside the scope of her employment, as a matter of law, for two related reasons: (1) her conduct was unauthorized; and (2) it violated signed acknowledgements in which she agreed to maintain the confidentiality of patients’ medical records. Both facts are true and relevant, but they are not dispositive here.

Recently, in Cox v. Evansville Police Department , we provided a thorough overview of Indiana's scope-of-employment rule. 107 N.E.3d 453, 460–62 (Ind. 2018). We explained that scope of employment can include acts that "naturally or predictably arise" from authorized activities. Id. at 461. And thus, scope-of-employment liability may reach unauthorized conduct, including that which violates "the employer's rules, orders, or instructions." Id. ; accord Warner Trucking, Inc. v. Carolina Cas. Ins. Co., 686 N.E.2d 102, 105 (Ind. 1997) ; Stropes ex rel. Taylor v. Heritage House Childs. Ctr. of Shelbyville, Inc. , 547 N.E.2d 244, 249–50 (Ind. 1989). A primary reason for imposing liability for such conduct is to "prevent recurrence." Cox , 107 N.E.3d at 462. This reason is significant here, as technological advances have led to health-care employers placing expansive access to private patient information at employees’ fingertips. And when the employer controls that access, the threat of liability for "injurious conduct" flowing from that control encourages preventive measures. Id.

To be sure, if an employee engages in unauthorized conduct that is in direct violation of agreed-to policies and procedures—such as a confidentiality agreement—then this evidence weighs heavily toward a finding that the actions were outside the scope of employment. See, e.g. , Robbins v. Trs. of Ind. Univ. , 45 N.E.3d 1, 11 (Ind. Ct. App. 2015). But also relevant is evidence demonstrating that the employee's actions naturally or predictably arose from delegated employment activities within the employer's control. See, e.g. , SoderVick v. Parkview Health Sys., Inc. 148 N.E.3d 1124, 1132 (Ind. Ct. App. 2020). With these considerations in mind, we determine if the record leads to a conclusion that Gray's actions fell outside the scope of her employment as a matter of law.

B. There are genuine issues of material fact on the scope-of-employment issue.

The designated evidence raises questions of fact as to whether Gray's unauthorized access of Plaintiffs’ medical records arose naturally or predictably from her unrestricted access to the records of all Community patients. We reach this conclusion based on a combination of factors: Community's complete control over Gray's access to patient records; Gray's lack of understanding regarding the scope of that access; and Community's failure to identify the misconduct.

Community, which has millions of patient encounters annually across its 200-plus sites of care, controlled the extent of Gray's access to medical records. And "it was not unusual for [Gray] to access high volumes of patient records on a daily basis." Community maintains that it "compartmentalized the scope of authorized access" for IOC employees like Gray. But undisputed evidence shows that she accessed not only Plaintiffs’ medical records, but also the records of more than 160 other patients—none of whom were IOC patients—without detection, over the course of several months. So, while Gray wasn't supposed to view non-IOC patient records, Community apparently granted permissions allowing her to view the records of any Community patient.

Further, though Gray signed confidentiality agreements relating to patients’ medical records, designated evidence shows she "did not have a clear understanding of the scope" of her authority "to access patient health information." In fact, when confronted by a supervisor with the misconduct, Gray "repeatedly stated that she did not think [her unauthorized access] was ‘that critical.’ "

Plaintiffs also designated the report of an expert in hospital management who found that Community lacked proper systems to regulate its employees’ use of medical records. Other evidence establishes that Community "had the ability to run more robust reports for improper accessing of protected health information." But it seemingly did not utilize that ability and never discovered Gray's actions on its own. Community's failure to do so here is particularly relevant because designated evidence shows this was not Gray's first time improperly accessing medical records. Indeed, Plaintiff Deborah West testified that she had previously sent Gray's supervisor a letter informing him that Gray "was in other people's [medical] records and talking about it." Though this occurred before Community acquired IOC, that employee remained with Community and was one of Gray's supervisors during the time she repeatedly accessed—undetected—non-IOC patient records.

So, drawing every reasonable inference in Plaintiffs’ favor, these unique circumstances create genuine issues of material fact as to whether Gray's conduct fell within the scope of her employment. As such, both theories under which Plaintiffs seek to hold Community liable—negligent training, supervision, and retention and the doctrine of respondeat superior —can survive summary judgment. But this conclusion does not foreclose summary judgment to Community on different grounds.

C. Community is entitled to summary judgment on both negligence-based claims because the undisputed facts negate the damages element.

Plaintiffs maintain that Community is liable under two negligence theories: vicarious liability for Gray's negligence and direct liability for negligent supervision, training, and retention. The allegations for the claims are different, but both require the same three elements: (1) duty; (2) breach; and (3) compensable damages proximately caused by the breach. See Scott v. Retz , 916 N.E.2d 252, 257 (Ind. Ct. App. 2009). Though summary judgment is rarely appropriate in negligence cases, it is appropriate when the undisputed facts negate one of the required elements. Id. And here, both negligence claims fail as a matter of law for the same reason: lack of compensable damages.

The undisputed facts show that the Plaintiffs suffered fear, anxiety, or sadness—emotional distress—from Gray's unauthorized access and disclosure of their private medical records. While their distress is understandable, emotional-distress damages are recoverable in negligence-based claims only when a party can satisfy (1) the modified-impact rule or (2) the bystander rule. Spangler v. Bechtel , 958 N.E.2d 458, 466, 471 (Ind. 2011). Plaintiffs satisfy neither.

The modified-impact rule requires that "the plaintiff personally sustained a physical impact." Id. at 467. But the undisputed facts establish that Plaintiffs suffered no physical impact themselves. The bystander rule requires that the plaintiff contemporaneously perceived a loved one's negligently inflicted death or serious injury. Id. (citing Groves v. Taylor , 729 N.E.2d 569, 573 (Ind. 2000) ). But the undisputed facts establish that Plaintiffs did not perceive any physical injury to a loved one. Thus, because emotional-distress damages are unavailable to Plaintiffs, both negligence claims fail.¹

1 A claim for intentional infliction of emotional distress does not have the same limitations on emotional-distress damages, see, e.g. , Atl. Coast Airlines v. Cook , 857 N.E.2d 989, 997 n.7 (Ind. 2006), but no such claim was brought in this case.

Community is therefore entitled to summary judgment on the claim for vicarious liability based on Gray's alleged negligence and on the claim for negligent hiring, retention, and supervision. We now turn to Plaintiffs’ remaining claim—invasion of privacy premised on the public disclosure of private facts. D. Indiana recognizes a tort claim for the public disclosure of private facts, but the undisputed evidence negates the tort's publicity element.

Finally, Plaintiffs seek to hold Community vicariously liable for their underlying invasion-of-privacy tort claim against Gray. An "invasion of privacy" encompasses four distinct injuries: (1) intrusion upon seclusion; (2) appropriation of likeness; (3) public disclosure of private facts; and (4) false-light publicity. Restatement (Second) of Torts § 652A (Am. L. Inst. 1977). Plaintiffs’ claim falls into the third category—public disclosure of private facts.² This category "is not concerned with ... the accuracy of the private facts revealed," but rather "the propriety of stripping away the veil of privacy with which we cover the embarrassing, the shameful, the tabooed, truths about us." Haynes v. Alfred A. Knopf, Inc. , 8 F.3d 1222, 1230 (7th Cir. 1993).

2 Although also styled as an "intrusion" claim, the complaint's allegations relate solely to the public disclosure of private facts.

Community maintains it is entitled to summary judgment for two alternative reasons: (1) the disclosure tort does not exist in Indiana; and (2) assuming Indiana recognizes the tort, "the undisputed facts affirmatively negate" the publicity element. We address each argument in turn.

1. Indiana recognizes a tort claim for the public disclosure of private facts.

Community asserts that the disclosure tort "is non-existent" in Indiana, while Plaintiffs call this characterization "inaccurate." To be fair, their diverging views are understandable—but confusion surrounding the tort did not always exist. Today, we confirm the viability of a tort claim for the public disclosure of private facts in Indiana. This decision is guided by what led to its uncertainty and why its existence is so vital now.

Over seventy-five years ago, this Court recognized a general right of privacy, finding it necessary to establish a "point of equilibrium" between public interests and privacy interests. State ex rel. Mavity v. Tyndall , 224 Ind. 364, 66 N.E.2d 755, 760 (1946) (cleaned up). Three years later, our Court of Appeals particularized this general privacy right and outlined four distinct breaches, including "the publicizing of one's private affairs with which the public has no legitimate concern." Cont'l Optical Co. v. Reed , 119 Ind. App. 643, 86 N.E.2d 306, 308 (1949) (en banc). For the next forty-plus years, the viability of a public-disclosure claim was never in doubt. See, e.g. , Near E. Side Cmty. Org. v. Hair , 555 N.E.2d 1324, 1334–35 (Ind. Ct. App. 1990) ; Cullison v. Medley , 570 N.E.2d 27, 31 (Ind. 1991) ; Nobles v. Cartwright , 659 N.E.2d 1064, 1073–74 (Ind. Ct. App. 1995).

That changed, however, in 1997 with Doe v. Methodist Hospital , 690 N.E.2d 681 (Ind. 1997) (plurality opinion). There, Doe sued a coworker for invasion of privacy after the coworker disclosed Doe's HIV-positive status to two fellow employees. Id. at 683. A plurality of the Court affirmed summary judgment for the coworker, concluding that "[t]he facts and the complaint in this particular case do not persuade us to endorse the sub-tort of disclosure." Id. at 693. In a separate opinion, Justice Dickson agreed with the result—given that Doe failed to satisfy a required element—but disagreed that the disclosure tort wasn't cognizable. Id. (Dickson, J., concurring in result). He observed that the tort "grows in importance as a valuable source of deterrence and accountability" due to "our ever-increasing population and the growing technological opportunities for invasive scrutiny into others’ lives, the compilation of private data, and the disclosure of purely personal matters." Id. at 695.

Fast forward four years to Felsher v. University of Evansville , 755 N.E.2d 589 (Ind. 2001). Though that case did not directly involve a public-disclosure claim, this Court briefly brought up Doe and characterized the plurality opinion as a "decision not to recognize a branch of the [invasion-of-privacy] tort involving the public disclosure of private facts." Id. at 593 (citing Doe , 690 N.E.2d at 682, 693 ). Felsher ’s pronouncement arguably closed the door to disclosure claims in Indiana. But less than three months later, in Allstate Insurance Co. v. Dana Corp. , 759 N.E.2d 1049, 1056–57 (Ind. 2001), this Court cast doubt on Felsher ’s seemingly decisive statement. There, we observed—without ever mentioning Felsher —that "[t]he extent to which the tort of invasion of privacy is recognized in Indiana is not yet settled." Id. In making that statement, the Court described Doe as a "disagreement" over whether to recognize a tort claim for "public disclosure of private facts." Id. at 1057 (citing Doe , 690 N.E.2d 681 ).

After this trilogy of equivocal opinions, our Court of Appeals has understandably adopted disparate positions on whether the disclosure tort is viable in Indiana. Compare Munsell v. Hambright , 776 N.E.2d 1272, 1282–83 (Ind. Ct. App. 2002) (analyzing the merits of a public-disclosure claim and thus recognizing its viability), trans. denied , Vargas v. Shepherd , 903 N.E.2d 1026, 1031 (Ind. Ct. App. 2009) (same), and J.H. v. St. Vincent Hosp. & Health Care Ctr., Inc. , 19 N.E.3d 811, 815–16 (Ind. Ct. App. 2014) (same), with Westminster Presbyterian Church of Muncie v. Cheng , 992 N.E.2d 859, 868 (Ind. Ct. App. 2013) (maintaining that a public-disclosure claim is not recognized in Indiana), trans. denied , F.B.C. v. MDwise, Inc. , 122 N.E.3d 834, 836–37 (Ind. Ct. App. 2019) (same), trans. denied , and Henry v. Cmty. Healthcare Sys. Cmty. Hosp. , No. 21A-CT-2150, 184 N.E.3d 645 (Ind. Ct. App. Feb. 15, 2022) (same).

Among these disparate positions, two of our appellate judges—in separate opinions—have urged us to recognize the disclosure tort, pointing to recent technological advancements that have digitized our personal lives. Judge Crone highlighted the increase in speed and ease with which sensitive, personal information can now be accessed and "broadcast to the public." Robbins, 45 N.E.3d at 13 (Crone, J., concurring in part and concurring in result in part). More recently, Judge Bailey similarly observed that "with the ubiquity of digital data, it is easier than ever for unwanted third parties to obtain—and share—sensitive information." F.B.C. , 122 N.E.3d at 839 (Bailey, J., dissenting).

We echo their concerns and join nearly every other state in explicitly recognizing an invasion-of-privacy tort claim based on the public disclosure of private facts.³ Recognition of this tort is especially important today, as private information is more easily accessed and disseminated—particularly in ways that can reach a large audience. In effect, the disclosure tort offers a meaningful way to deter unauthorized disclosures of private information. And when deterrence or other preventive measures fail, it can provide victims with meaningful redress.

3 See Abby DeMare, Note, The Disclosure Tort in Indiana: How a Contemporary Twist Could Revive a Dormant Remedy , 54 Ind. L. Rev. 661, 670 n.95 (2021) (collecting cases, demonstrating that only four states—other than Indiana—have not yet recognized the disclosure subtort).

We explicitly adopt the disclosure tort as it is articulated in the Restatement (Second) of Torts § 652D, which establishes four requirements: (1) the information disclosed must be private in nature; (2) the disclosure must be made to the public; (3) the disclosure must be one that would be highly offensive to a reasonable person; and (4) the information disclosed is not of legitimate public concern. We briefly detail the contours of each in turn.

The first requirement—private facts—means that the information is both factually true and privately held. Id. cmt. b. Thus, if the information is left "open to public inspection" or if "the defendant merely gives further publicity to information about the plaintiff that is already public," this element is not satisfied. Id.

The second requirement—publicity—means that the information must be communicated in a way that either reaches or is sure to reach the public in general or a large enough number of persons such that the matter is sure to become public knowledge. Id. cmt. a. Yet there is no threshold number that constitutes "a large number" of persons. See id. The facts and circumstances of each case must be taken into consideration in determining whether the communication gave sufficient "publicity" to support a public-disclosure claim. See id.

The third requirement—highly offensive to a reasonable person—means the disclosure must be one that offends society's accepted, communal norms and social mores. See id. cmt. c. In recognition that complete privacy is illusory, this element is satisfied when publicity is given to private information "such that a reasonable person would feel justified in feeling seriously aggrieved by it." Id.

The fourth requirement—lack of newsworthiness—means that the information disclosed is not of legitimate concern to the public. Id. cmt. d. Generally, the public is properly concerned with the lives of voluntary public figures, id. cmt. e, and matters "customarily regarded as ‘news,’ " id. cmt. g. When determining what is a matter of legitimate public concern, "account must be taken of the customs and conventions of the community." Id. cmt. h. Ultimately, the proper inquiry is whether "a reasonable member of the public ... would say that he had no concern" with the information disclosed. Id. In this way, the newsworthiness element restricts liability "to the extreme case, thereby providing the breathing space needed by the press." Gilbert v. Med. Econs. Co. , 665 F.2d 305, 308 (10th Cir. 1981).

With this framework in hand, we now determine whether Plaintiffs’ public-disclosure claim survives summary judgment.

2. Community is entitled to summary judgment on the public-disclosure claim because the undisputed facts negate the publicity element.

Community maintains that Plaintiffs’ public-disclosure claim must fail because "there was no publication as a matter of law." On this record, we agree.

Community designated Gray's statement that she "did not publish, discuss, or retain any medical information of any party." In countering that assertion, Plaintiffs maintain there is a genuine issue of material fact by pointing to the testimony of two witnesses. First, Deborah West indicated that Gray, prior to working for Community, openly discussed "other patients’ medical records." But Gray's prior conduct with other medical records is irrelevant in considering whether she divulged information from Plaintiffs’ records. Second, Daniel McKenzie recalled a conversation in which a family member mentioned "that the Grays knew about" an extremely personal and sensitive aspect of one of the plaintiff's medical histories that, in his view, the Gray family only "would have known about" through the medical records. But even if Gray divulged this information to members of her family, a communication to a small group of persons is generally not actionable. See Restatement (Second) of Torts § 652D cmt. a. And it is not actionable here because the record is devoid of evidence that Gray disclosed the information to, or in a way that was sure to reach, the public or a large number of people. See id.

Because the publicity element fails as a matter of law, Community is entitled to summary judgment on the claim for respondeat superior liability premised on Gray's alleged public disclosure of private facts.

Conclusion

We affirm the trial court's denial of Community's motion to dismiss for lack of subject-matter jurisdiction because Plaintiffs’ claims are not subject to Indiana's Medical Malpractice Act. But we reverse the denial of Community's motion for summary judgment because Community has affirmatively negated a required element on each of the claims against it. We thus remand to the trial court with instructions to enter judgment in favor of Community on all claims.⁴

4 We thank all amici for their helpful briefs.

David, Massa, Slaughter, and Goff, JJ., concur.