Opinion
Court of Appeals Case No. 19A-CT-2671
05-15-2020
Haley SODERVICK, Appellant-Plaintiff, v. PARKVIEW HEALTH SYSTEM, INC., Appellee-Defendant
Attorney for Appellant: Neal F. Eggeson, Jr., Eggeson Privacy Law, Fishers, Indiana Attorneys for Appellee: Mark W. Baeverstad, Ashley M. Gilbert-Johnson, Rothberg Logan & Warsco LLP, Fort Wayne, Indiana
Attorney for Appellant: Neal F. Eggeson, Jr., Eggeson Privacy Law, Fishers, Indiana
Attorneys for Appellee: Mark W. Baeverstad, Ashley M. Gilbert-Johnson, Rothberg Logan & Warsco LLP, Fort Wayne, Indiana
Baker, Judge.
[1] Following an alleged Health Insurance Portability and Accountability Act (HIPAA) violation by an employee of Parkview Health System, Inc. (Parkview), Haley SoderVick filed suit alleging, among other things, that Parkview was vicariously liable under respondeat superior for the employee's conduct. SoderVick now appeals the trial court's order granting summary judgment in favor of Parkview, challenging the holding regarding Parkview's liability under respondeat superior for its employee's misconduct. She argues that the employee's misconduct was within the scope of employment for purposes of respondeat superior. Finding that there is a genuine issue of material fact as to whether the employee was acting in the scope of employment and that the trial court erroneously granted summary judgment in favor of Parkview, we reverse in part and remand for further proceedings.
Facts
[2] On October 19, 2017, SoderVick went to an appointment at the office of Catherine Reese, M.D., an OB/GYN, at Parkview's campus in Wabash. At the time, Alexis Christian was employed by Parkview Physician Group—General Surgery as a medical assistant. Christian also occasionally worked with the OB/GYN group by assisting Dr. Reese's staff with registering and rooming patients and inputting patient registration information into Parkview's electronic health record system. Christian was working in this capacity for Dr. Reese on the day of SoderVick's appointment. As a Parkview employee, Christian had signed a Confidentiality Agreement and an Acknowledgment Regarding Access to Patient Information acknowledging her understanding of Parkview's confidentiality policy.
[3] During SoderVick's appointment with Dr. Reese, Christian accessed SoderVick's electronic health record for approximately one minute. Christian testified during a deposition that "[t]he only reason [she] was in [SoderVick's] chart was to enter [SoderVick's] personal information" from a patient information worksheet. Appellant's App. Vol. II p. 211. At the same time, Christian also asked another nearby medical assistant if she knew who SoderVick was; the assistant shared only that SoderVick was a dispatcher.
There are some inconsistencies in the record as to why Christian accessed SoderVick's record. An affidavit from Parkview's Associate Privacy Officer states that Christian accessed the chart "for an unknown reason." Appellant's App. Vol. II p. 59. Another affidavit from Christian's supervisor stated that her access was not related to the registering of patients in the front of the office, as Christian was working in the back of the office rooming patients, but that the short duration of Christian's access of the chart—less than one minute—was not "long enough to room a patient." Id. at 63-64.
[4] Christian then immediately texted information about SoderVick to Christian's then-husband, Caleb Thomas. In these texts, Christian disclosed SoderVick's name, the fact that she was a patient, a potential diagnosis, and that she worked as a dispatcher. Christian also texted Thomas that SoderVick was HIV-positive and had had more than fifty sexual partners, although this information was not included in her chart and was ultimately false. Christian testified that she had been checking Facebook on her phone during her lunch break earlier that day and had seen that SoderVick had liked a photo of Thomas. Later that afternoon, when Christian was "inputting chart information and came across all of that information" about SoderVick, she claims she felt "concerned" and therefore texted her husband asking if and how he knew SoderVick, curious as to whether they might have had a sexual history together. Id. at 217, 218.
[5] Sometime later, Thomas's sister, Casey Penrod, was using Thomas's phone and saw the texts from Christian about SoderVick. On April 17, 2018, Penrod reported to Parkview that Christian had texted information about a patient and that a potential HIPAA violation had occurred. Penrod provided Parkview with a screenshot of the text thread. Parkview then initiated an internal investigation of the alleged HIPAA violation, after which Christian's employment was terminated on May 2, 2018. SoderVick was notified of the disclosure of her protected health information on May 7, 2018.
[6] SoderVick filed a complaint for damages with jury demand against Parkview on September 28, 2018. The complaint alleged claims for respondeat superior, direct negligence for Parkview's negligent training, supervision, and retention, and direct negligence for Parkview's violation of its statutory and common-law duties of protection of privacy under HIPAA. On July 19, 2019, Parkview moved for summary judgment on each of the three claims, arguing that (1) Parkview was not liable under respondeat superior because it did not authorize Christian's conduct and there was no legitimate business reason for her conduct; (2) Parkview was not negligent in its training, monitoring, and supervision of its employees; and (3) no violation of HIPAA occurred.
[7] On July 22, 2019, SoderVick filed a response conceding summary judgment on the direct negligence and HIPAA claims. She argued that the issue of respondeat superior must be left to the jury and that there was a clear HIPAA violation for which Parkview could be held vicariously liable. Parkview filed a reply in support of its motion on September 3, 2019.
[8] The trial court held a hearing on Parkview's motion for summary judgment on September 25, 2019, and took the matter under advisement. On October 25, 2019, the trial court entered an order granting in part and denying in part the motion for summary judgment. That order was vacated on October 29 and the trial court entered a new order, again granting in part and denying in part Parkview's motion for summary judgment. In both orders, the trial court granted summary judgment in favor of Parkview for counts I (respondeat superior) and II (direct negligence) and denied summary judgment for count III (HIPAA violation). Both parties filed motions to reconsider on November 7, 2019. On November 15, the trial court granted Parkview's motion to reconsider, denied SoderVick's motion, and ultimately granted summary judgment in favor of Parkview on all three counts. SoderVick now appeals the grant of summary judgment solely on the respondeat superior claim.
The trial court vacated the original summary judgment order because the order "erroneously relied heavily" on a Court of Appeals decision for which a Petition to Transfer had been filed and was still pending. Appellant's App. Vol. III p. 46. Transfer has since been denied. See Hayden v. Fransiscan All., Inc. , 131 N.E.3d 685, 691 (Ind. Ct. App. 2019), trans. denied .
Discussion & Decision
[9] On appeal, SoderVick challenges only the grant of summary judgment on the respondeat superior claim. She argues that the trial court erred by misapplying Indiana's respondeat superior standard as to whether Parkview could be held vicariously liable for (1) Christian accessing SoderVick's health record; and (2) Christian communicating true and false information about SoderVick to a third party.
In addition to responding to SoderVick's arguments regarding Parkview's vicarious liability for Christian's actions, Parkview also devotes a great deal of time to arguing that it is entitled to summary judgment on any underlying claims of defamation and false-light invasion of privacy regardless of the ultimate determination on the issue of respondeat superior. But neither of these two torts were actually alleged in SoderVick's complaint, and the trial court did not address the merits or viability of these underlying torts allegedly committed by Christian; it focused its opinion entirely on the respondeat superior issue. SoderVick did briefly discuss these underlying torts in her Memorandum in Opposition to Defendant's Motion for Summary Judgment, but explicitly stated therein that the discussion was included "in an abundance of caution" and only "[t]o the extent [that] these claims may be read into Parkview's summary judgment motion." Appellant's App. Vol. II p. 115. Because SoderVick never alleged defamation or invasion of privacy in her complaint and because neither of those torts were the basis of Parkview's motion for summary judgment—and therefore were not considered by the trial court—we decline to consider them here.
I. Standard of Review
[10] Our standard of review for summary judgment is well established:
Summary judgment is appropriate only when there are no genuine issues of material fact and the moving party is entitled to judgment as a matter of law. Ind. Trial Rule 56(C). In reviewing a trial court's ruling on summary judgment, this court stands in the shoes of the trial court and applies the same standard in determining whether to affirm or reverse the grant of summary judgment. We must therefore determine whether there is a genuine issue of material fact and whether the trial court has correctly applied the law.
Relying on specifically designated evidence, the moving party bears the burden of making a prima facie showing that there are no genuine issues of material fact and that it is entitled to judgment as a matter of law. If the moving party meets this burden, the burden then shifts to the nonmovant to set forth specifically designated facts showing that there is a genuine issue for trial.
A genuine issue of material fact exists where facts concerning an issue that would dispose of the issue are in dispute or where the undisputed material facts are capable of supporting conflicting inferences on such an issue. In our review, we consider all of the designated evidence in the light most favorable to the nonmoving party.
Robbins v. Trustees of Ind. Univ. , 45 N.E.3d 1, 5-6 (Ind. Ct. App. 2015) (internal quotations and some internal citations omitted). "If there is any doubt as to what conclusion a jury could reach, then summary judgment is improper." Simon Prop. Grp., L.P. v. Acton Enters., Inc. , 827 N.E.2d 1235, 1240 (Ind. Ct. App. 2005).
II. Respondeat Superior
[11] The trial court, in its third and final order granting summary judgment in favor of Parkview, concluded that there was no genuine issue of material fact and that Parkview was entitled to judgment as a matter of law with regards to its vicarious liability under respondeat superior principles for Christian's actions. The trial court held that "Christian's texts to a third party, whether they contained truthful information or false information about SoderVick, clearly fell outside the scope of her employment with Parkview and, therefore, Parkview is not vicariously liable for these acts." Appealed Order p. 5. The trial court also noted that its conclusion was further bolstered by evidence establishing that there was no legitimate business purpose for Christian's access of SoderVick's record on the day of her appointment. SoderVick now argues that the trial court misapplied the respondeat superior standard and that all of Christian's actions involving the access and communication of SoderVick's personal information were within the scope of her employment for purposes of establishing Parkview's vicarious liability.
[12] When considering an employer's liability for the actions of its employee, "[t]he general rule is that vicarious liability will be imposed upon an employer under the doctrine of respondeat superior where the employee has inflicted harm while acting ‘within the scope of employment’ " and the employer would not otherwise be liable for its own acts. Barnett v. Clark , 889 N.E.2d 281, 283 (Ind. 2008) (quoting Sword v. NKC Hosps., Inc. , 714 N.E.2d 142, 148 (Ind. 1999) ). To fall within the scope of employment, the employee's injurious act must either (1) "be incidental to the conduct authorized," or (2) "to an appreciable extent, further the employer's business." Id. "Whether an act falls within the scope of employment is generally a question of fact." Cox v. Evansville Police Dep't , 107 N.E.3d 453, 460 (Ind. 2018).
[13] SoderVick argues that Christian's conduct falls under the first prong of the scope of employment analysis—whether the misconduct was "incidental to" authorized conduct—because the acts of accessing and texting SoderVick's personal health information was incidental to conduct Parkview had authorized Christian to do as part of her employment. SoderVick frames the relevant analysis as one in which "the focus must be on context—not on the specific act of texting," whereas the analysis provided by Parkview disregards the larger employment context and focuses only on "the specific act of sending a text message to [Christian's] husband." Appellant's Reply Br. p. 8.
[14] In Walgreen Co. v. Hinchy , the following jury instruction was held to be a correct statement of law as to what factors may be considered in determining whether a wrongful act was "incidental to" the employee's job duties:
1. whether the wrongful act was of the same general nature as her authorized job duties;
2. whether the wrongful act is intermingled with authorized job duties; and
3. whether the employment provided the opportunity or the means by which to commit the wrongful act.
21 N.E.3d 99, 112 (Ind. Ct. App. 2014) (holding that the question of vicarious liability was one for the jury where pharmacist reviewed and shared a customer's prescription information with a third party, "[e]ven though some of her actions were unauthorized").
[15] Recently, in Cox v. Evansville Police Department , our Supreme Court provided a detailed explanation of the "incidental to" prong of the scope of employment analysis:
Although scope-of-employment liability is rooted in ... control, it extends beyond actual or possible control, holding employers responsible for some risks inherent in the employment context. Ultimately, the scope of employment encompasses the activities that the employer delegates to employees or authorizes employees to do, plus employees' acts that naturally or predictably arise from those activities.
This means that the scope of employment—which determines whether the employer is liable—may include acts that the employer expressly forbids; that violate the employer's rules, orders, or instructions; that the employee commits for self-gratification or self-benefit; that breach a sacred professional duty; or that are egregious, malicious, or criminal.
Cox , 107 N.E.3d at 461 (internal citations omitted). Employers will not be held responsible for acts that are entirely unauthorized or for "acts done ‘on the employee's own initiative, [ ] with no intention to perform it as part of or incident to the service for which he is employed.’ " Hayden , 131 N.E.3d at 691 (quoting Doe v. Lafayette Sch. Corp. , 846 N.E.2d 691, 702 (Ind. Ct. App. 2006), abrogated on other grounds by State Farm Mut. Auto. Ins. Co. v. Jakupko , 881 N.E.2d 654 (Ind. 2008) ). "If some of the employee's actions were authorized, the question of whether the unauthorized acts were within the scope of employment is one for the jury." Konkle v. Henson , 672 N.E.2d 450, 457 (Ind. Ct. App. 1996) (emphasis added). But likewise, "if none of the employee's acts were authorized, the matter is a question of law." City of Fort Wayne v. Moore , 706 N.E.2d 604, 607 (Ind. Ct. App. 1999).
SoderVick also directs our attention to the discussion in Cox of the public policy behind including unauthorized, forbidden acts within the scope of employment: "First, it is equitable to hold people responsible for some harms arising from activities that benefit them.... Second, holding employers liable for those injurious acts helps prevent recurrence." Cox , 107 N.E.3d at 461-62.
[16] We agree with SoderVick that when all of the above standards are applied to her case, there are several genuine issues of material fact as to whether Parkview should be held vicariously liable for Christian's conduct, thus rendering summary judgment inappropriate. First, the evidence shows that Christian's misconduct was "of the same general nature" as her regular and authorized job duties. Hinchy , 21 N.E.3d at 112. Christian's official, documented job duties included "implementation of the electronical medical records," "continuous[ ] monitoring of schedules and communication," and other tasks involving patient chart access. Appellant's App. Vol. II p. 160. Further, on the day of SoderVick's appointment, Christian "assisted with the registration process for [SoderVick's] appointment with Dr. Reese." Id. at 133. And regardless of whether Christian was working in the front of the office registering patients or in the back of the office rooming patients, statements by her supervisor imply that accessing a patient's chart would be a standard part of either of those assigned roles. See id. at 64.
[17] Second, Christian was in the midst of performing authorized job duties—namely, entering patient information into the electronic charts—when she accessed SoderVick's record and proceeded to text information about SoderVick to Thomas, thereby making the misconduct "intermingled" with her ordinary, authorized job duties. Hinchy , 21 N.E.3d at 112. Parkview admits that it "authorized Christian to access patients' medical records for business purposes," appellant's app. vol. II p. 97, and Christian testified during her deposition that she accessed SoderVick's chart as part of her authorized job duties:
I was taking new patient packets that we would receive in and putting the information into the charts and then scanning them into the media section of Epic, so that we can go back in and review them, if there's a question on history or something.
* * *
... [T]he only thing I had was [SoderVick's] patient packet and entering it into Epic, which is the computer program system that Parkview uses.
Id. at 208, 210. Thus, even if the specific act of texting information about SoderVick was not authorized, Christian's misconduct occurred while at work and was sandwiched between other authorized job functions—facts which weigh in favor of finding that the misconduct was within the scope of employment.
[18] Third, Parkview stated that "Christian was at work, used Parkview's equipment, and utilized access granted by Parkview" in committing the wrongful acts. Appellant's App. Vol. II p. 97. This also weighs in favor of finding that Christian was acting within the scope of her employment, as it suggests that, at least to some degree, Christian's employment at Parkview enabled her to commit the misconduct in question. See, e.g. , Hinchy , 21 N.E.3d at 112 (listing "whether the employment provided the opportunity or the means by which to commit the wrongful act" as a relevant factor in determining whether misconduct was incidental to ordinary job duties).
[19] Next, the fact that the wrongful act violates an explicit policy or rule of the employer's does not preclude respondeat superior. See, e.g. , Cox , 107 N.E.3d at 461 ("[T]he scope of employment ... may include acts that the employer expressly forbids ...."). Therefore, Parkview may be held vicariously liable for Christian's misconduct even if the actions in question ran directly counter to Parkview rules or policies, such as the Confidentiality Agreement and the Acknowledgment Regarding Access to Patient Information.
[20] Because at least some of the acts surrounding Christian's misconduct were authorized, the issue of respondeat superior must be left to the jury. See, e.g. , Moore , 706 N.E.2d at 607 (stating scope of employment matters are a question of law, and therefore appropriate for summary judgment, only if none of the employee's acts were authorized by the employer). SoderVick contends that "the designated evidence proves that all of Ms. Christian's acts were authorized," appellant's br. p. 20 (emphasis in original). But here, because the evidence demonstrates that even just some of Christian's acts were authorized—for example, accessing the chart to input patient information, as discussed previously—the issue is inappropriate for summary judgment. See Konkle , 672 N.E.2d at 457.
[21] As noted above, Parkview focuses on the specific act of Christian texting her husband, and argues further that we should focus on Christian's subjective intent behind her conduct—that is, whether Christian acted entirely in self-interest. Parkview acknowledges that "there may be an issue of fact with regard to whether Christian's chart access was authorized or unauthorized," but nonetheless maintains that, because the texts to Christian's husband were sent "for personal reasons and held no business purpose," the acts fall outside of the scope of employment. Id. at 17. "[A]cts for which the employer is not responsible are those done on the employee's own initiative, [ ] with no intention to perform it as part of or incident to the service for which he is employed." Doe , 846 N.E.2d at 702 (internal quotations omitted). However,"[w]here an employee acts partially in self-interest but is still partially serving his employer's interests," then vicarious liability will attach. Id. at 701-02 (internal quotations omitted).
[22] We do not disagree that subjective intent and a focus on the specific act of misconduct, rather than the whole employment context, are relevant considerations in the second prong of the scope of employment framework, which considers whether the injurious act "further[ed] the employer's business." Barnett v. Clark , 889 N.E.2d at 283 ; see also, e.g. , Doe , 846 N.E.2d at 702 (finding that teacher who engaged in a romantic relationship with a student, including sending sexually charged emails from a school computer to the student, was not acting in the scope of employment in part because his actions "were fueled entirely by self-interest in a romantic relationship"). But where Parkview's proffered analysis falls short is that it focuses solely on these considerations—relevant only to half of the possible scope of employment framework—and wholly fails to address any arguments made with regards to whether Christian's actions fit under the "incidental to" prong.
[23] Parkview relies primarily on our decision in Robbins to support its argument that the circumstances and intent surrounding only the specific act of misconduct, rather than the broader employment context, is the only relevant focus of our inquiry. In Robbins , a nurse, DeBow, was employed to provide health care services to patients of the IU School of Medicine's Gastroenterology Department, and upon employment signed a confidentiality agreement. 45 N.E.3d at 4-5. On her first day of work, DeBow accessed the medical records of Robbins and her children, neither of whom were patients of the Gastroenterology Department, and she posted medical information about Robbins on Robbins's ex-boyfriend's blog. DeBow admitted to her employer that she knew her actions were wrong, and stated that there was "no legitimate business reason for her to access the records" and that her only motivation was "revenge." Id. at 5. Upholding the grant of summary judgment in favor of the employer, this Court reasoned that DeBow acted "on her own initiative and unrelated to any business function of her employment or her employer" in accessing and disclosing Robbins's private medical records, and that the actions themselves were "unauthorized and illegal." Id. at 10-11.
[24] But like Parkview's analysis in this case, the Robbins Court's discussion does not mention the longstanding disjunctive approach to scope of employment analysis. Instead, it omits any discussion of the "incidental to" authorized activities prong and focuses entirely on whether the nurse's activities furthered the employer's interests. In Parkview's view, this omission means that Robbins , as a recent decision of ours, represents the current standard of scope of employment review. But more recent cases on scope of employment have continued relying on the two-pronged disjunctive standard, suggesting that Robbins stands only for the proper analysis under the prong of the traditional scope of employment test that deals with furthering the employer's interests. See, e.g. , Cox , 107 N.E.3d at 461 ("Ultimately, the scope of employment encompasses the activities that the employer ... authorizes employees to do, plus employees' acts that naturally or predictably arise from those activities.").
Our Supreme Court in Cox twice cited to Hinchy with approval for its use of the disjunctive approach, whereas Robbins was not cited by the Court at all, let alone with any approval. Cox , 107 N.E.3d at 461 ; see also Hinchy , 21 N.E.3d at 107 ("To fall within the scope of employment, the injurious act must be incidental to the conduct authorized or it must, to an appreciable extent, further the employer's business." (internal quotations omitted and emphasis added)). Most recently, in Burton v. Benner , our Supreme Court again employed the traditional disjunctive standard, further suggesting that Robbins is an outlier. 140 N.E.3d 848, 852 (Ind. 2020). Although Burton deals with a respondeat superior question under the Indiana Tort Claims Act, which provides an employer will not be found vicariously liable only if employee acted "clearly outside" the scope of employment, id. , the analysis for what constitutes scope of employment in the first place is the same as under common law respondeat superior principles. The Court found that Benner, an off-duty police officer who was pulled over for speeding while driving his commission, was not acting clearly outside of the scope of his employment because his conduct was the same general nature or incidental to authorized conduct: he followed State Police procedures for operating the commission, maintained radio contact, and conformed to a dress code. Id. at 252-53.
[25] As such, we agree with SoderVick that "[t]o the extent the employee's subjective motivation matters at all, at most it would only inform the latter prong" of scope of employment analysis—that is, subjective motivation is relevant only as to whether the misconduct furthers the employer's interests, not whether it was incidental to authorized conduct. Appellant's Br. p. 23; see also Stropes , 547 N.E.2d at 249 (citing with approval other courts that held that, when looking at the misconduct's relation to the entire employment context, " ‘the employee's motivation should not be a consideration’ at all in determining the imposition of liability" on an employer) (quoting Marston v. Minneapolis Clinic of Psychiatry , 329 N.W.2d 306, 311 (Minn. 1982) ).
Parkview especially emphasizes how Christian signed a confidentiality agreement like the employee in Robbins did and that she was "not acting to further the interests of her employer," instead acting "in self-interest and as part of her own personal agenda." Appellee's Br. at 18. In her deposition, Christian did confirm that the "motivation in texting [her husband] was personal," appellant's app. vol. II p. 219, but the evidence shows the reason for accessing the record in the first place was likely business-related. And although Christian also signed a Confidentiality Agreement, Robbins does not necessarily require finding that fact to be dispositive in the way Parkview argues it should. See Robbins , 45 N.E.3d at 14 (Crone, J., concurring) ("I would not find the Confidential Agreement to be dispositive ...."); see also Cox , 107 N.E.3d at 461 ("[S]cope of employment ... may include acts that the employer expressly forbids; that violate the employer's rules, orders, or instructions; that the employee commits for self-gratification or self-benefit; that breach a sacred professional duty; or that are egregious, malicious, or criminal.").
[26] Parkview argued in its motion for summary judgment that there was no genuine issue of material fact as to whether Christian was acting in the scope of her employment. But we find that that there is a genuine issue of fact on the scope of employment issue; specifically, there is an issue of fact as to whether Christian's conduct was incidental to authorized employment activities. We therefore find that the trial court erred in granting summary judgment in favor of Parkview on the respondeat superior claim, reverse that portion of the order, and remand for further proceedings.
[27] The judgment of the trial court is reversed in part and remanded for further proceedings.
Kirsch, J., concurs.
Tavitas, J., dissents with a separate opinion.
Tavitas, Judge, dissenting.
[28] I respectfully dissent from the majority's decision that genuine issues of material fact preclude summary judgment in favor of Parkview. I conclude that the trial court properly granted summary judgment to Parkview because Christian was not acting in the scope of her employment.
[29] In support of its decision, the majority relies mainly upon Walgreen Co. v. Hinchy . I conclude, however, that Hayden v. Franciscan All., Inc. , 131 N.E.3d 685, 691 (Ind. Ct. App. 2019), trans. denied , is more persuasive.
[30] First, I agree with Hayden that our Supreme Court's opinion in Cox is distinguishable. Hayden noted:
The Indiana Supreme Court specifically noted the "unique institutional prerogatives of [ ] police employment" in deciding that the question of vicarious liability for the sexual assault of a woman in police custody was a question for the jury. 107 N.E.3d at 464. Cox expanded liability because police officers wield "broad authority and intimidating power" that comes with an "inherent risk of abuse." Id. at 459, 463. The public policy behind the Cox extension of the doctrine of respondeat superior for law enforcement officials' conduct does not exist here.
Hayden , 131 N.E.3d at 691.
[31] Second, the facts in Hayden are similar to the facts here. In Hayden , a patient received treatment at the hospital for a broken arm. Eleven days later, a hospital registration employee, Collins, accessed the patient's medical records. Two years later, Collins' friend texted a screenshot of the medical records to the patient's boyfriend. Collins had received extensive HIPAA compliance training from her employer. Collins also signed an acknowledgment affirming her understanding that she may only "use and access information that is needed to perform [her] job duties, and inappropriate use or disclosure of information on [her] part may result in legal action, including personal liability." Hayden , 131 N.E.3d at 690.
[32] The patient filed a complaint against the hospital and others. One of the claims against the hospital was respondeat superior for Collins' actions. The trial court granted the hospital's motion for summary judgment. On appeal, we affirmed. We held:
Although Collins was authorized to use Franciscan's computer to look up patient records, she was not authorized to do so for personal reasons. As in Robbins [v. Trustees of Indiana University , 45 N.E.3d 1 (Ind. Ct. App. 2015) ], where the confidentiality agreement expressly prohibited the nurse from accessing and/or disclosing patient records for personal reasons, Collins signed an agreement at the onset of her employment that stated she could only "use and access information that is needed to perform [her] job duties, and inappropriate use or disclosure of information on [her] part may result in legal action, including personal liability." Appellant's Confidential App. Vol. II, p. 81. There is no evidence that the pharmacist in Hinchy signed a confidentiality agreement.
Collins accessed Hayden's records eleven days after Hayden's visit to the Radiology Department. Hayden was not a patient of Franciscan on November 28 or 29, 2013. Collins thus had no legitimate business need to access Hayden's medical records on November 29, 2013 because Collins did not need to look her up for an appointment or to prepare patient records for November 29, 2013. Collins's access to the medical records was expressly not authorized; the information was not needed to perform her job duties and thus was not sanctioned. In addition, Hayden's comparison to Hinchy is ultimately untenable because there is no evidence that the pharmacist in Hinchy signed a confidentiality agreement like the nurse in Robbins or Collins.
* * * * *
The trial court properly granted summary judgment to Franciscan on the issue of respondeat superior. Franciscan established that Collins accessed the medical records for non-employment-related reasons, in direct violation of the confidentiality agreement she signed at the onset of her employment with Franciscan. Hayden failed to designate any evidence to the contrary. For these reasons, Franciscan is entitled to summary judgment as a matter of law.
Id. at 692-93.
[33] Here, Christian accessed SoderVick's medical records during SoderVick's appointment, and Christian texted some accurate and some inaccurate information regarding SoderVick to her husband. Parkview designated evidence that an investigation revealed Christian had "no legitimate business purpose for accessing Ms. Sodervick's chart and was not involved in the provision of medical care to Ms. Sodervick." Appellant's App. Vol. II p. 65. Christian admitted during the investigation that "she was concerned that her [husband] might be cheating on her with Ms. Sodervick." Id. Christian had received training from Parkview regarding patient privacy, protected health information, security, and HIPAA compliance. Christian signed a Confidentiality Agreement and Acknowledgement Regarding Access to Patient Information. The Acknowledgement provided: "Accesses to patient information outside of information required for job responsibilities could be in violation of the federal HIPAA privacy rule, Indiana state law, and the Parkview policies ...." Id. at 75. The Acknowledgement listed "corrective action" for failure to follow the policies, including possible "immediate termination." Id.
[34] As in Hayden , Christian accessed the medical records for a non-employment related reason in direct violation of the Parkview Confidentiality Agreement and Acknowledgement that Christian signed. I conclude, based on Hayden , that the trial court properly granted summary judgment to Parkview. Accordingly, I dissent.