Hayden v. Franciscan Alliance, Inc.

• Decision Date: 19 August 2019
• Docket Number: Court of Appeals Case No. 18A-CT-1777
• Citation: 131 N.E.3d 685
• Parties: Leslie D. HAYDEN, Appellant-Plaintiff, v. FRANCISCAN ALLIANCE, INC., Appellee-Defendant.
• Court: Indiana Appellate Court

131 N.E.3d 685

Leslie D. HAYDEN, Appellant-Plaintiff,

v.FRANCISCAN ALLIANCE, INC.,¹ Appellee-Defendant.

Court of Appeals Case No. 18A-CT-1777

Court of Appeals of Indiana.

FILED August 19, 2019

Attorneys for Appellant: Robert D. King, Jr., David R. Thompson, Indianapolis, Indiana

Attorneys for Appellee: Christopher L. Riegler, Kimberly E. Schroder, Patricia B. Freije, Katz Korin Cunningham, P.C., Indianapolis, Indiana

Mathias, Judge.

[1] Franciscan Alliance, Inc. ("Franciscan") filed a motion for summary judgment on the issues of respondeat superior and negligent hiring and retention of an employee on April 5, 2018. Marion Superior Court granted summary judgment for Franciscan on July 6, 2018. Leslie Hayden ("Hayden") now appeals, arguing there are issues of material fact that preclude summary judgment. We affirm.

Facts and Procedural History

[2] On November 18, 2013, Hayden had x-rays taken at St. Francis Hospital's Radiology Department for a broken arm. Appellant's App. Vol. III, pp. 54–56. Two years later, in 2015, Jessica Hensley ("Hensley") texted a screenshot of Hayden's confidential medical records to Hayden's boyfriend, and posted the records on Facebook. Id. at 53; Appellant's App. Vol. I, p. 137. Hayden recalled that Brooke Collins ("Collins"), Hensley's best friend, worked as a registrar in the St. Francis Hospital Radiology Department, where Hayden received treatment in 2013. Appellant's App. Vol. III, p. 59. Hayden had a complex and acrimonious relationship with Hensley and Collins that dated back to high school. Appellant's App. Vol. I, pp. 125, 128, 149.

[3] Hayden contacted the hospital's Administrative Director of Compliance and Privacy in July 2015 to ask for an audit of her medical account. Appellant's App. Vol. III, pp. 57, 163. The hospital found that Collins's password was used to access Hayden's account on November 29, 2013, eleven days after Hayden received treatment for her broken arm. Appellant's App. Vol. I, pp. 81–82. Hayden was not a patient of Franciscan on November 29 when Collins's password was used to access her account. Franciscan concluded that Collins's access was unauthorized and improper. Appellant's App. Vol. III, p. 191. Collins has since admitted to accessing Hayden's private patient information on November 29, 2013. Appellant's App. Vol. IV, p. 84.

[4] On November 25, 2015, Hayden brought suit against Hensley, Collins, and Franciscan. A fourth defendant, Southside OB-GYN, P.C. was also named but later dismissed by stipulation. Appellant's App. Vol. I, p. 11. Hayden alleged (I) respondeat superior against Franciscan for the acts of Collins, (II) negligence against Franciscan in failing to have appropriate prophylactic structures and systems in place to safeguard private patient information, (III) Health Insurance Portability Accountability Act ("HIPAA") violations against St. Francis, and (IV) negligence, invasion of privacy & public disclosure of private facts against Collins and Hensley for accessing, reviewing, and disseminating Hayden's private and confidential medical records.

[5] Collins was hired as a registrar at St. Francis Hospital in April 2011. Appellant's Confidential App. Vol. II, p. 72. The job required her to "get patient information, register them, verify their insurance, verify their personal information, and then enter it in the computer[.]" Id. Collins was subject to a background check, which showed that Collins had been arrested but not convicted for felony theft and misdemeanor conversion while in high school. Appellant's App. Vol. III, p. 175–76. Collins had stolen medicine from Walmart and had withdrawn $400 from her father's bank account. Id. at 132–37. Charges in both instances were dismissed. Id. at 137. Franciscan did not ask Collins about her criminal history in her initial interview, nor in a re-interview when she was transferred to St. Francis's south campus. Id. at 139, 144, 155.

[6] Cory Baute ("Baute"), Franciscan's Chief HR and Support Services Executive for Franciscan Health's Central Indiana Division, signed an affidavit stating that nothing in Collins's application or background would or should have precluded her employment as a registrar at St. Francis. Appellant's Confidential App. Vol. II, p. 97. Baute did not work for Franciscan in 2011 when Collins was hired but testified that the hiring practices in 2011 were "generally the same as they are now." Appellant's App. Vol. III, p. 180.

[7] Franciscan also presented Linda Fletcher ("Fletcher"), the Hospital's Information Security Officer, to testify about HIPAA compliance, patient privacy, and the security of electronic medical records. Appellant's App. Vol. III, p. 119. Fletcher testified that background checks assist with HIPAA compliance and are one of the controls Franciscan uses to ensure "staff are appropriate to handle the [protected health] information." Id. at 121. When asked whether certain backgrounds are disqualifying, Fletcher responded, "That would be handled at the St. Francis level within HR... they run the background checks and they're responsible for the criteria used to qualify and disqualify people." Id. at 122. She did not know what criteria the HR departments use but testified that disqualifying backgrounds would presumably include any abuse of private health information, criminal background, and tendency for fraud and abuse. Id. at 122–23. When asked whether a history of theft would be disqualifying, Fletcher responded, "It depends on the theft, I guess." Id. at 124.

[8] Once hired, Collins was required to undergo HIPAA training. After completing training, Collins signed the General Orientation Agreement, which provided that she had "received and underst[ood] the information regarding the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations and hospital[ ] policies and procedures regarding Safety, Security, PI, and Patient Rights as presented during and contained in the General Orientation Handbook." Appellant's Confidential App. Vol. II, p. 80. She also signed an acknowledgment affirming her understanding that she may only "use and access information that is needed to perform [her] job duties, and inappropriate use or disclosure of information on [her] part may result in legal action, including personal liability." Id. at 81.

[9] Collins also received regular trainings, including classes on HIPAA compliance, patient privacy and security, and appropriate access to and usage of medical records, and periodically took tests about patient privacy. Id. at 83. Supervisors were near Collins's work area and made regular rounds to check on the registrars. Id. Annual audits analyzed the online activities of the registrars. Id. Collins testified that she had been trained and educated by Franciscan and was aware of appropriate and inappropriate access of patient records. Appellant's App. Vol. III, p. 158. She also knew that accessing and forwarding medical records to outside parties was against hospital policy. Id. at 159. Collins voluntarily resigned in February 2014. Appellant's Confidential App. Vol. II, p. 72.

[10] Collins filed a motion for summary judgment on September 1, 2017 in which Franciscan joined. The court granted partial summary judgment on Count III, finding that Hayden had no private right of action under HIPAA. Franciscan filed a subsequent motion for summary judgment on April 5, 2018. Collins filed an amended answer and response in order to admit accessing Hayden's private patient information on November 29, 2013. Franciscan asked that Collins's amended answer and responses be considered as part of its pending motion for summary judgment. The Court granted the motion for summary judgment. Hayden now appeals.

Standard of Review

[11] A trial court should grant a motion for summary judgment only when the evidence shows that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law. Altevogt v. Brand , 963 N.E.2d 1146, 1150 (Ind. Ct. App. 2012) (citing Ind. Trial Rule 56(C) ). The trial court's grant of a motion for summary judgment is "cloaked with a presumption of validity." Id. In reviewing a trial court's summary judgment motion, an appellate court applies a de novo standard of review. Alldredge v. Good Samaritan Home, Inc. , 9 N.E.3d 1257, 1259 (Ind. 2014).

[12] Here, the trial court made findings of fact and conclusions of law in support of its entry of summary judgment. We are not bound by the trial court's findings and conclusions. Altevogt , 963 N.E.2d at 1150.

Discussion and Decision

[13] Hayden argues that the trial court improperly granted summary judgment to Franciscan. Hayden raises four issues on appeal that we consolidate and restate as two issues. First, she argues that summary judgment should not have been granted on Franciscan's respondeat superior claim. Second, she argues the trial court erroneously granted summary judgment to Franciscan on negligent hiring, retention, monitoring, supervision, and training.

I. Respondeat Superior

[14] Hayden first claims that Franciscan is liable for Collins's actions under respondeat superior. Appellant's Br. at 23. An employer is liable for an employee's tortious acts under respondeat superior only if those acts occurred within the scope of employment. Cox v. Evansville Police Department , 107 N.E.3d 453, 460 (Ind. 2018). An employee acts within the scope of employment when an act furthers the employer's business to an appreciable extent or is incidental to authorized conduct. Walgreen Co. v. Hinchy , 21 N.E.3d 99, 107 (Ind. Ct. App. 2014). An act is incidental to authorized conduct when it is "subordinate to or pertinent to an act which the [employee] is employed to perform[.]" Id. (quoting Bushong v. Williamson , 790 N.E.2d 467, 473 (Ind. 2003) ).

[15] Employers are not responsible for acts that are unauthorized, or acts done "on the employee's own initiative, [ ] with no intention to perform it as part of or incident to the...