Yath v. Fairview Clinics, N.P., No. A08-1556.

• Decision Date: 23 June 2009
• Docket Number: No. A08-1556.
• Citation: 767 N.W.2d 34
• Parties: Candace YATH, Appellant, v. FAIRVIEW CLINICS, N. P., d/b/a Fairview Cedar Ridge Clinic, et al., Respondents, Navy Mao Tek, et al., Defendants, Net Phat, Respondent.
• Court: Minnesota Court of Appeals

767 N.W.2d 34

Candace YATH, Appellant, v. FAIRVIEW CLINICS, N. P., d/b/a Fairview Cedar Ridge Clinic, et al., Respondents Navy Mao Tek, et al., Defendants Net Phat, Respondent.

No. A08-1556.

Court of Appeals of Minnesota.

June 23, 2009.

Christopher M. Daniels, David J. Wymore, Daniels & Wymore, PLLC, Plymouth, MN, for appellant.

Paul C. Peterson, William L. Davidson, Lind, Jensen, Sullivan & Peterson, P.A., Minneapolis, MN, for respondents Fairview Clinics, N.P., Cedar Ridge Clinic, and Fairview Health Services, N.P.

Sylvia Ivey Zinn, Julia A. Lines, Brendel and Zinn, Ltd., Lake Elmo, MN, for respondent Net Phat.

Considered and decided by JOHNSON, Presiding Judge; ROSS, Judge; and CRIPPEN, Judge.^*

OPINION

ROSS, Judge.

This invasion-of-privacy case involves the Internet posting of embarrassing personal information taken surreptitiously from a patient's medical file. A Fairview Cedar Ridge Clinic employee saw a personal acquaintance at the clinic and read her medical file, learning that she had a sexually transmitted disease and a new sex partner other than her husband. The employee disclosed this information to another employee, who then disclosed it to others, including the patient's estranged husband. Then someone created a MySpace.com webpage posting the information on the Internet. The patient sued the clinic and the individuals allegedly involved in the disclosure under various legal theories. The district court granted summary judgment to the defendants on most of the claims.

This appeal from that judgment challenges several of the district court's decisions: (1) declining to impose sanctions for spoliation after one defendant deleted computer files allegedly to hide involvement in the Internet postings; (2) holding that the invasion-of-privacy claim failed because there was no "publicity"; (3) dismissing the negligent-infliction-of-emotional-distress claim for lack of a threshold showing of a viable invasion-of-privacy claim; (4) holding that the clinic cannot be held liable for the unauthorized acts of its employees; (5) holding that the claim of "breach of a confidential relationship" is not a recognized cause of action; and (6) holding that the Health Insurance Portability and Accountability Act (HIPAA) preempts Minnesota Statutes section 144.335.

We conclude that the district court did not abuse its discretion by declining to impose sanctions for spoliation because there was no proof that the deleted computer files included knowingly destroyed evidence. We also conclude that the invasion-of-privacy claim was correctly resolved by summary judgment for lack of evidence; that the district court properly dismissed the negligent-infliction-of-emotional-distress claim because the claim depends on the survival of the invasion-of-privacy claim; and that the claim of breach of confidential relationship as alleged is waived, and the claim as recast under a different theory on appeal fails as a matter of law. But we conclude that HIPAA does not preempt section 144.335, which authorizes a private cause of action for releasing health care records. We therefore affirm in part, reverse in part, and remand.

FACTS

The controversy in this case began when a clinic employee saw an acquaintance visiting a doctor and decided to nose around in the acquaintance's confidential file. Candace Yath went to a medical appointment in March 2006 at Fairview Cedar Ridge Clinic in Apple Valley. Yath told her doctor that she wanted to be tested for sexually transmitted diseases because she had a new sex partner. Navy Tek, a medical assistant who is related to Yath's husband, saw Yath at the clinic and became curious.

Tek's job gave her access to the clinic's electronic medical records. Tek decided to satisfy her curiosity by accessing Yath's medical file, knowing this would violate clinic policy. Tek learned from Yath's medical file that Yath's medical appointment was for sexually-transmitted-disease screening related to a new sex partner. She also learned that Yath had been diagnosed with a sexually transmitted disease.

Two days later, Tek sent an electronic mail message to Net Phat. Phat was related to both Tek and Yath by marriage, and she worked as a medical records coder at Fairview Ridges Hospital. In her e-mail to Phat, Tek wrote, "i gotta tell you somethin but can't do it over this....i'll call you when i'm not busy....but only if you promise not to say anything to anybody." Phat responded that she would not tell anyone and added, "Now I'm curious what it is ... you will have to tell me." Three minutes later, Tek replied, "you may already know anyways....i'll call you in a bit."

Tek called and told Phat that she saw Yath's record and that Yath had another sex partner. Phat wrote back to Tek, "Wow ... I'm shocked." She also wrote, "I look differently at my sister in law." Phat was unaware that Candace Yath and her husband, Paul, had separated.

In April 2006, Phat told her brother (Yath's now ex-husband) what Tek relayed from Yath's medical file. Paul asked Phat if she had seen Yath's file, but Phat said that she had not. Word eventually reached Candace Yath that Tek had viewed her medical file and had shared the information with Phat. Yath's grandmother called Cedar Ridge Clinic and spoke with Michelle St. Sauver, the clinic's manager. She complained that she believed that Tek had wrongfully accessed and told others the information in Yath's medical file. She also told St. Sauver that she believed Phat was involved.

Fairview investigated and learned that Tek had accessed Yath's medical file five times between March 21 and May 4, 2006. Fairview determined that Tek had no legitimate business reason to do so and that, therefore, her access was unauthorized by Fairview policy and prohibited by HIPAA. St. Sauver and a human resources worker confronted Tek on May 4. Although Tek initially denied accessing Yath's records, she recanted after St. Sauver showed her a computer usage audit. But she claimed that she had not disclosed the information to anyone.

St. Sauver also questioned Phat on May 4. Phat denied knowing anything about Yath's medical information. Neither Cedar Ridge Clinic nor Fairview Ridges Hospital, where Phat worked, investigated Phat's computer. St. Sauver and Lois Dahl, Fairview's information privacy and security director, explained that they did not search Phat's computer because Phat did not have a username or password that allowed her to access Yath's medical records at the clinic and because the clinic and hospital use different records software systems.

St. Sauver sent Tek home on May 4. Convinced that Tek had repeatedly accessed Yath's records without a legitimate business purpose, Fairview decided to fire Tek on May 10, 2006, for violating Fairview policy and HIPAA.

The next day, St. Sauver received an e-mail from Yath's grandmother accusing Tek or Phat of creating a disparaging Internet webpage at MySpace.com using the name "Rotten Candy" and posting information that Tek learned from Yath's medical file. The webpage included a photograph of Candace Yath and stated that "Rotten Candy" has a sexually transmitted disease, that she recently cheated on her husband, and that she is addicted to plastic surgery. The page listed six "friends," indicating that by then at least those six people had accessed the page.

Fairview investigated the accusations. It tried to view the webpage on either May 11 or May 12, 2006, but by then the webpage had been "removed." MySpace.com is a "blocked" website at Fairview, meaning that employees cannot access it using Fairview's internet system and that the webpage therefore could not have been created by an employee using a Fairview workplace computer. Yath and her attorneys also investigated the MySpace webpage. They discovered that the MySpace account for the webpage originated on a computer having an Internet Protocol address assigned to a business in Eagan. Tek's sister, Molyka Mao, worked at that business.¹

Yath sued Tek, Mao, Phat, and Fairview on a variety of theories. She sued all the defendants directly for invasion of her privacy, and all except Mao for "breach of a confidential relationship." She sued Tek, Mao, and Phat for intentional infliction of emotional distress. She sued Fairview for negligent infliction of emotional distress. She also sued all the defendants directly for violating Minnesota Statutes section 144.335, subdivision 3a(e), by disclosing information in Yath's medical file.

Fairview and Phat each moved for summary judgment. Yath opposed summary judgment and also moved for a default judgment against Tek and Mao, who never answered the complaint. Yath moved the district court to impose sanctions on Phat for spoliation of evidence on the accusation that Phat deleted files from her computer that may have proven that she participated in the disclosure. The district court awarded summary judgment in favor of Fairview. It granted Phat's motion for summary judgment on all claims except intentional infliction of emotional distress. The district court denied Yath's motion for sanctions against Phat for alleged spoliation of evidence. It also found that Yath's motion for a default judgment against Tek and Mao was premature.

Yath then dismissed her claims against Tek and Mao and filed an appeal with this court, challenging the district court's summary judgment decision. But we recognized that the judgment was partial and nonappealable because not all claims were decided. Yath returned to the district court and dismissed her claim of intentional infliction of emotional distress. The district court entered a final order and judgment that disposed of all claims. Yath filed her second appeal, and a special term panel of this court allowed her appeal and agreed that we would review both dispositive orders.

ISSUES

I. Did the district court abuse its discretion by denying Yath's motion for sanctions against Phat for alleged spoliation of...