Cmty. Health Network, Inc. v. McKenzie
| Decision Date | 26 May 2020 |
| Docket Number | Court of Appeals Case No. 19A-CT-873 |
| Citation | 150 N.E.3d 1026 |
| Parties | COMMUNITY HEALTH NETWORK, INC., Appellant, v. Heather MCKENZIE and Daniel McKenzie, Individually and as Parents and Natural Guardians of J.M. and O.M., John McKenzie, Deborah West, Michael West, and Katrina Gray, Appellees. |
| Court | Indiana Appellate Court |
Attorneys for Appellant: Sherry A. Fabina-Abney, Jenny R. Buchheit, Stephen E. Reynolds, Sean T. Dewey, Ice Miller LLP, Indianapolis, Indiana
Attorneys for Appellee: William N. Riley, Anne Medlin Lowe, Riley Williams & Piatt, LLC, Indianapolis, Indiana
Attorneys for Amicus curiae: A. Richard M. Blaiklock, Wade D. Fulford, Lewis Wagner, LLP, Indianapolis, Indiana
[1] Plaintiffs-Appellees, Heather McKenzie ("Heather"), Daniel McKenzie ("Daniel"), John McKenzie ("John"), Deborah West ("Deborah"), Michael West ("Michael"), J.M. ("J.M."), and O.M. ("O.M.") (collectively, "Appellees") filed their complaint against Defendant-Appellant Community Health Network, Inc ("Community") and Defendant Katrina Gray ("Katrina") in January 2014 and amended their complaint in July 2015. The complaint arose following Katrina's unauthorized access of Appellees' private health information while she was an employee of Community. Appellees brought claims for vicarious liability under the doctrine of respondeat superior and negligent training, supervision, and retention against Community and negligence and invasion of privacy/intrusion against Katrina.
[2] This interlocutory appeal comes before us pursuant to the trial court's denial of Community's Trial Rule 12(B)(1) motion to dismiss Appellees' complaint and motion for summary judgment. Community contends that: (1) the trial court erred by denying its motion to dismiss Appellees' complaint for a lack of subject matter jurisdiction, asserting that their claims fall within the purview of the Medical Malpractice Act (the "MMA") and that the Appellees failed to comply with the procedural prerequisites of the MMA; and (2) the trial court erred by denying summary judgment on Appellees' claims of respondeat superior and negligent training, supervision, and retention. Community also argues that even if Katrina's actions were within the scope of her employment, it cannot be held vicariously liable under respondeat superior for Katrina's actions because Appellees' underlying negligence and invasion of privacy/intrusion claims against Katrina are not actionable under Indiana law.
[3] We conclude that Appellees' claims do not fall within the purview of the MMA and that the trial court properly denied Community's motion to dismiss. Additionally, on the claims involving respondeat superior, negligent training, supervision, and retention, and negligence, there are genuine issues of material fact precluding summary judgment in Community's favor. However, to the extent that Appellees' respondeat superior claim is based on an underlying act of invasion of privacy/intrusion by Katrina, we conclude that Community is entitled to judgment as a matter of law, in part, on the respondeat superior claim. Therefore, the judgment of the trial court is affirmed in part, reversed in part, and remanded with instructions
[4] We affirm in part, reverse in part, and remand with instructions.
[5] Heather and Katrina worked together at the Indiana Orthopedic Center ("IOC") from January 2005 until September 2010. Katrina had been employed as a medical records coordinator at the IOC since 1999 and was Heather's direct supervisor between 2005 and 2010. Katrina's title at the IOC was "Health Information Management Coordinator." (App. Vol. VIII at 26). In this capacity, Katrina was responsible for "scheduling appointments and releasing medical records for [the IOC]." (App. Vol. VIII at 26).
[6] At some point, Katrina introduced Heather to her stepson, Kevin Gray ("Kevin"). In 2006, Heather began dating Kevin, and the two married in 2007. Heather and Kevin had two children, J.M. and O.M. Heather and Kevin eventually divorced in 2010. Heather received full custody of J.M. and O.M. In 2011, Heather married Daniel, and he adopted J.M. and O.M. A family feud between the Gray family and Appellees ensued.
[7] In 2012, Community acquired the IOC through an asset purchase. Community hired and trained Katrina as a medical records coordinator. As a condition of her employment with Community, Katrina was required to attend orientation and complete mandatory e-training on patient confidentiality and the Health Insurance Portability and Accountability Act of 1996 ("HIPPA").
[8] In June 2012, after successfully completing orientation and e-training, Katrina was provided access to Epic, an electronic medical records system. When using Epic, Katrina was authorized to schedule appointments and release records of the patients only within the IOC. Katrina was strictly prohibited from accessing any patient record without a business need or for personal reasons.
[9] In September 2013, Community received an internal employee complaint via its anonymous hotline, which served as an internal and external avenue to report any compliance issues involving Community's employees. The complaint alleged that Katrina had accessed her personal chart, which, if true, violated Community's policies and employee conduct rules. As a result, Community investigated Katrina's access and determined that she had accessed her own chart, as well as the confidential health records of multiple other patients–including Appellees–at various times between January and September 2013. For each unauthorized access, Katrina had used a Community computer system to look up private health information of Community's patients. She did so while she was on the job using equipment, software, and credentials provided to her by Community. Following Community's investigation, Community placed Katrina on administrative leave and eventually terminated her employment.
[10] While Appellees received medical treatment at and were patients of Community, they had not received care or services at the IOC. In early November 2013, Appellees received notice from Community that their health information records had been compromised. The letters explained that Community had "learned that an employee [had] accessed" the Appellees' "medical record[s] without a business need[,]" and listed the specific dates the breaches had occurred. (App. Vol. VIII at 2-5). Appellees later learned that Katrina was the employee who had improperly accessed their medical records.
[11] In January 2014, Appellees filed suit against Community based on Katrina's unauthorized access of their medical records. This complaint named Community as the sole defendant and alleged two counts: (1) respondeat superior; and (2) negligent training, supervision, and retention. In July 2015, Appellees filed an amended complaint adding Katrina as a defendant. The amended complaint enumerated four counts: (1) respondeat superior against Community; (2) negligent training, supervision, and retention against Community; (3) negligence against Katrina; and (4) invasion of privacy/intrusion against Katrina. In regard to their respondeat superior claim against Community in count one, Appellees alleged that Community owed them a non-delegable duty to protect the privacy and confidentiality of their medical records. They further alleged that because Katrina had accessed their records in the course and scope of her employment with Community, Community was vicariously liable for Katrina's unauthorized acts and that as a proximate result of this breach, Appellees had suffered damages. As for the negligent training, supervision, and retention claim in count two, Appellees alleged that Community had: (1) breached its duty to train and instruct Katrina in the protection of confidential medical records; (2) failed to supervise Katrina in the protection of medical records and their confidentiality; (3) failed to employ methods and/or take appropriate steps to learn of an employee's misuse and abuse of authority; and (4) failed to implement appropriate measures for the protection of its patients' health information records.
[12] In September 2015, Community filed its amended answer. In January 2018, Community filed a motion to dismiss counts one and two of the amended complaint pursuant to Trial Rule 12(B)(1), alleging that the trial court lacked subject matter jurisdiction. Specifically, Community argued that Appellees' claims directly related to the provision of healthcare within the MMA and that Appellees had failed to exhaust their administrative remedies because they had not filed a complaint with the Indiana Department of Insurance ("IDOI") and had not obtained a medical panel decision.
[13] Contemporaneously, and alternatively, Community filed a motion for summary judgment requesting that the court enter judgment in its favor as to counts one and two of the amended complaint. Specifically, Community argued that: (1) it was not vicariously liable for Katrina's misconduct; (2) it owed no actionable duty to Appellees; and (3) Appellees were not sufficiently damaged by the personal health information breach. Community also argued that even if Katrina acted within the scope of her employment, it could not be held vicariously liable because Appellees' underlying negligence and invasion of privacy/intrusion claims against Katrina are not actionable under Indiana law.1
[14] In support of its motion for summary judgment, Community designated in relevant part: (1) depositions from Deborah, Michael, Heather, Daniel, John; (2) an affidavit with exhibits from a Senior Project Manager at Community explaining the conditions of Katrina's employment, including attending orientation, reviewing Community's policies and procedures, and completing mandatory e-training...
To continue reading
Request your trial