Cmty. Health Network, Inc. v. McKenzie

• Decision Date: 13 April 2022
• Docket Number: Supreme Court Case No. 20S-CT-648
• Citation: 185 N.E.3d 368
• Parties: COMMUNITY HEALTH NETWORK, INC., Appellant v. Heather MCKENZIE, et al., Appellees
• Court: Indiana Supreme Court

185 N.E.3d 368

COMMUNITY HEALTH NETWORK, INC., Appellant

v.Heather MCKENZIE, et al., Appellees

Supreme Court Case No. 20S-CT-648

Supreme Court of Indiana.

Argued: January 7, 2021

Filed April 13, 2022

ATTORNEYS FOR APPELLANT: Sherry A. Fabina-Abney, Jenny R. Buchheit, Stephen E. Reynolds, Sean T. Dewey, Ice Miller LLP, Indianapolis, Indiana

ATTORNEY FOR APPELLEES: William N. Riley, RileyCate, LLC, Fishers, Indiana

ATTORNEY FOR AMICI CURIAE INDIANA STATE MEDICAL ASSOCIATION AND AMERICAN MEDICAL ASSOCIATION: Libby Yin Goodknight, Krieg DeVault LLP, Indianapolis, Indiana

ATTORNEYS FOR AMICUS CURIAE INDIANA HOSPITAL ASSOCIATION: Angela M. Smith, Andrew B. Howk, Hall Render Killian Heath & Lyman, Indianapolis, Indiana

ATTORNEY FOR AMICI CURIAE INDIANA HEALTH IN FORMATION EXCHANGE AND REGENSTRIEF INSTITUTE: Alexandria H. Pittman, Ice Miller LLP, Indianapolis, Indiana

ATTORNEY FOR AMICUS CURIAE INDIANA TRIAL LAWYERS ASSOCIATION: Gabriel A. Hawkins, Cohen & Malad, LLP, Indianapolis, Indiana

ATTORNEYS FOR AMICUS CURIAE INDIANA PATIENT'S COMPENSATION FUND: A. Richard M. Blaiklock, Wade D. Fulford, Taylor L. Fontan, Lewis Wagner, LLP, Indianapolis, Indiana

On Petition to Transfer from the Indiana Court of Appeals, No. 19A-CT-873

Rush, Chief Justice.

Nearly twenty-five years ago, Justice Dickson recognized a need for "deterrence and accountability" due to "the growing technological opportunities for invasive scrutiny into others’ lives, the compilation of private data, and the disclosure of purely personal matters." His prescient observation is more relevant today than ever before. Indeed, much of our personal information is stored digitally, and unauthorized access to private data has never been easier. Take medical records—with the click of a button, countless health-care professionals can view our most private, sensitive health information. To be sure, this ready access has revolutionized the industry, allowing medical personnel to diagnose and treat patients quickly and accurately. But with great access comes great responsibility—an abuse of which may give rise to liability.

Here, an employee of a health-care provider improperly accessed and disclosed information from numerous patients’ medical records. Determining whether the provider is liable for that conduct requires us to address several issues: the applicability of Indiana's Medical Malpractice Act; the proper scope-of-employment inquiry; the availability of emotional-distress damages in negligence-based claims; and the viability of an invasion-of-privacy claim for the public disclosure of private facts.

We conclude that the Medical Malpractice Act does not apply to these circumstances. We then find that there are genuine issues of material fact as to whether the employee's acts were within the scope of employment. Importantly, we confirm the viability of a tort claim for the public disclosure of private facts. But we ultimately hold that the health-care provider is not liable because the undisputed facts negate a required element on both the negligence claims and the public-disclosure claim.

Facts and Procedural History

Katrina Gray, a medical-records coordinator with Community Health Network, improperly accessed and disclosed information from the confidential medical records of several individuals. Among those affected are the plaintiffs in this case: Heather McKenzie; her husband Daniel McKenzie; her children J.M. and O.M.; her parents Deborah and Michael West; and her father-in-law John McKenzie (collectively "Plaintiffs"). Gray's access and alleged disclosure of Plaintiffs’ medical records, however, wasn't random. Rather—as the facts below illustrate—it was the latest chapter in a long-running family feud.

Deborah and Michael have known Gray since she was a child. In 2005, Gray, who worked at Indiana Orthopedic Center (IOC), helped Heather get a job there and was her direct supervisor. During this time, Heather began dating and eventually married Gray's stepson, and the couple had two children, J.M. and O.M. But around 2010, Heather's relationship with the Gray family quickly deteriorated.

Initially, Gray "was hurt" because Heather switched departments at IOC. Heather also separated from her husband—due in part to multiple documented incidents of his violent and abusive behavior—and began spending time with Daniel.

Gray responded by "being crazy and mean" at work, regularly directing vulgar insults at Heather. Soon after, Heather was fired from IOC, which she attributed to Gray, and she divorced Gray's stepson. When Heather married Daniel in early 2011, his father, John, hired security for the wedding because of concerns about Gray's prior "retaliation" and her stepson's "violent" behavior. These events—and others—precipitated a rift between the Gray family and the West and McKenzie families.

Throughout this time, Gray continued working at IOC. Then, in 2012, Community purchased the practice and took over its management and operations. During the acquisition, nonphysician employees who wanted to remain with IOC had to apply for employment with Community. Gray applied and was hired and trained as a medical-records coordinator.

As part of its onboarding process, Community required Gray to review and agree to its policies and procedures, attend an orientation, and complete training on the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Upon completion, Gray received access to Community's electronic medical record system, which has "over 17,000 users." One of Community's policies indicated that employee access to protected health information is controlled and scrutinized in accordance with HIPAA and that "[a]ll appropriate access will be granted to the employee for the fulfillment of his/her job duties." Though Gray was authorized to schedule appointments and release records only for patients of the orthopedic providers in the practice, her broad access also allowed her to access the electronic medical records of non-IOC Community patients.

In January 2013, despite completing privacy trainings and having signed agreements that specifically prohibited the unauthorized access of electronic medical records, Gray began accessing non-IOC patients’ records. Over the next nine months, Gray accessed Heather's medical records sixteen times, Daniel's five times, J.M.’s six times, O.M.’s three times, Deborah's twice, and Michael's and John's once each. During that time, in February, Gray received a performance appraisal indicating that she was appropriately handling private health information and maintaining confidentiality expectations. Yet, just days before the review, she accessed the medical records of Heather and her parents.

Gray's actions went undetected by Community until September 2013 when it received an anonymous tip that she was viewing her own medical chart in violation of hospital policy. Community investigated the allegations and fired Gray after discovering she had repeatedly accessed Plaintiffs’ medical records. Further investigation revealed that Gray had also accessed the records of over 160 other Community patients, none of whom "received services" at IOC. Community subsequently sent notices to the affected patients, including Plaintiffs.

A few months later, Plaintiffs sued Community and Gray. They brought claims of respondeat superior and negligent training, supervision, and retention against Community and claims of negligence and invasion of privacy against Gray.

Community filed a motion to dismiss for lack of subject-matter jurisdiction and a motion for summary judgment. Community asserted that the trial court lacked jurisdiction because Indiana's Medical Malpractice Act (MMA) applied to Plaintiffs’ complaint, and the Plaintiffs had not satisfied the MMA's "express jurisdictional requirements." Community alternatively claimed that it was entitled to summary judgment because Gray's tortious acts were committed outside the scope of her employment, Plaintiffs lacked cognizable damages, and the claims against Gray were not actionable under Indiana law.

After a hearing, the trial court denied the motion to dismiss, finding the MMA did not apply because the Plaintiffs "were not patients of the practice at which Gray worked" and Gray's alleged misconduct "did not involve providing medical treatment to them." The court also denied summary judgment, finding unresolved factual questions on whether Gray's conduct was within the scope of her employment; whether Plaintiffs had actual damages; and whether Gray had publicly disclosed information from the records.

In a permissive interlocutory appeal, the Court of Appeals affirmed in part and reversed in part. Cmty. Health Network, Inc. v. McKenzie , 150 N.E.3d 1026, 1030–31 (Ind. Ct. App. 2020). It affirmed the trial court's denial of Community's motion to dismiss, concluding that the underlying claims did not fall under the MMA. Id. at 1037–39. And it affirmed the trial court's denial of summary judgment except for Plaintiffs’ invasion-of-privacy claim. Id. at 1040–45. On that claim, the panel held that Community was entitled to judgment as a matter of law because the subtort at issue—public disclosure of private facts—is not recognized in Indiana. Id. at 1044–45.

Community then sought transfer, which we granted, vacating the Court of Appeals opinion. Ind. Appellate Rule 58(A).

Discussion and Decision

Before analyzing whether Plaintiffs’ claims survive summary judgment, we address a threshold issue: whether Plaintiffs’ claims against Community are subject to the MMA. Community asserts "there is no dispute that Plaintiffs’ claims fall within the scope of the MMA." Plaintiffs disagree, maintaining the MMA does not apply to "claims alleging the mishandling of a patient's confidential information." On this record, we agree with Plaintiffs. The misconduct alleged does not constitute "malpractice," and thus, the trial court did not err in denying Community's motion to dismiss for lack of subject-matter jurisdiction.

We...