Amanda Henry v. Community Healthcare System Community Hospital

• Court: Indiana Court of Appeals
• Decided: October 8, 2019
• Docket: 19A-CT-1256
• Status: Published

Opinion

FILED Oct 08 2019, 8:33 am

CLERK Indiana Supreme Court Court of Appeals and Tax Court

ATTORNEY FOR APPELLANT ATTORNEYS FOR APPELLEE Neal F. Eggeson, Jr. Sharon L. Stanzione Eggeson Privacy Law Alan M. Kus Fishers, Indiana Johnson & Bell, P.C. Crown Point, Indiana

IN THE COURT OF APPEALS OF INDIANA

Amanda Henry, October 8, 2019 Appellant-Plaintiff, Court of Appeals Case No. 19A-CT-1256 v. Appeal from the Lake Superior Court Community Healthcare System The Honorable John M. Sedia, Community Hospital, Judge Appellee-Defendant Trial Court Cause No. 45D01-1811-CT-803

Baker, Judge.

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 1 of 9 [1] Amanda Henry appeals the trial court’s order dismissing the complaint she filed

against Community Healthcare System Community Hospital (Community)

after a Community employee allegedly provided Henry’s medical records to the

employee’s spouse, who happened to be Henry’s employer. Henry argues that

(1) while HIPAA does not contain a private right of action, it can form the basis

of a duty and/or standard of care; (2) the trial court erroneously found that

Indiana does not recognize the tort of public disclosure of private information;

and (3) dismissal was improper where there were multiple viable negligence-

based claims implicated by the complaint. Finding that Henry has one or more

claims that should have survived dismissal, we reverse and remand for further

proceedings.

Facts 1

[2] On March 1, 2018, Henry received medical treatment at Community Hospital

in Munster. As part of her treatment, she underwent radiographic imaging.

Three days later, Henry’s employer showed her digital images of her X-rays on

the employer’s cell phone. Henry later learned that her employer is married to

the radiologic technician who performed her radiographic imaging.

[3] On October 24, 2018, Henry filed a complaint against Community. The

relevant portions of the complaint read as follows:

1 We held oral argument in Indianapolis on September 23, 2019. We thank counsel for both parties for their truly superb oral and written presentations.

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 2 of 9 3. On March 1, 2018, plaintiff received medical care at Community.

4. Community owes a duty to protect the privacy, security, and confidentiality of health records generated or maintained by providers within its network.

5. At some point between March 1, 2018 and March 4, 2018, a Community workforce member shared plaintiff’s protected health information with the workforce member’s spouse.

6. On March 4, 2018, the workforce member’s spouse showed plaintiff digital images (contained in the spouse’s cellular telephone) of plaintiff’s March 1, 2018 x-ray films.

***

11. As a direct and proximate result of the above-described acts of Community and of Community’s workforce member, plaintiff has suffered damages for which Community is liable.

Appellant’s App. Vol. II p. 10-11 (emphases omitted). Community filed an

answer denying the allegations.

[4] On April 17, 2019, Community moved to dismiss the complaint pursuant to

Indiana Trial Rule 12(B)(6). Henry responded the same day. The trial court

held a hearing on the motion to dismiss on June 3, 2019, and entered an order

dismissing the complaint the next day. The trial court found that because the

motion to dismiss was filed after the pleadings were closed, the motion should

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 3 of 9 be treated as a motion for judgment on the pleadings pursuant to Trial Rule

12(C). In relevant part, the trial court found as follows:

Here, the question is quite simple: Does Henry have a right of action against Community on the facts she alleges?

It has long been held that no private action exists under HIPAA, found at 42 U.S.C. § 1320(d), and its implementing regulations[.]

As to Henry’s claim under the Public Disclosure Privacy Act, the very recent case of [F.B.C. v. MDwise, Inc., 122 N.E.3d 834 (Ind. Ct. App. Apr. 16, 2019), trans. pending,] held:

. . . [t]he tort of Disclosure has not yet been recognized in Indiana. . . . In Doe v. Methodist Hospital, the Indiana Supreme Court declined to adopt [the tort of private disclosure of public facts (“Disclosure”)], which is a sub-tort of invasion of privacy, as an actionable claim. 690 N.E.2d 681, 693 (Ind. 1997). The Court recognized that while neighboring states have adopted a more liberal Disclosure standard, it was not persuaded to adopt Disclosure as a cognizable claim in Indiana. Id. at 692-93. See also Felsher v. University of Evansville, 755 N.E.2d 589, 593 (Ind. 2001).

It is therefore ordered, adjudged and decreed by the Court as follows:

1. The Motion to Dismiss of [Community] is granted.

2. This case is ordered dismissed with prejudice.

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 4 of 9 Appealed Order p. 2-3 (emphasis and citation in original omitted). Henry now

appeals.

Discussion and Decision [5] As noted above, the trial court treated Community’s motion to dismiss as a

motion for judgment on the pleadings pursuant to Indiana Trial Rule 12(C).2

We apply a de novo standard of review to a ruling on a motion for judgment on

the pleadings. Murray v. City of Lawrenceburg, 925 N.E.2d 728, 731 (Ind. 2010).

When evaluating such a motion, we must accept as true the well-pleaded

material facts alleged in the complaint. Consol. Ins. Co. v. Nat’l Water Servs.,

LLC, 994 N.E.2d 1192, 1196 (Ind. Ct. App. 2013). A Rule 12(C) motion is

granted only where it is clear from the face of the complaint that under no

circumstances could relief be granted. Id. A complaint will withstand a motion

for judgment on the pleadings if it states any set of allegations, no matter how

inartfully pleaded, upon which the trial court could have granted relief. Tony v.

Elkhart Cty., 851 N.E.2d 1032, 1035 (Ind. Ct. App. 2006).

[6] Community attempts to frame this case under the Health Insurance Portability

and Accountability Act (HIPAA) and the Indiana Access to Health Care

Records Statute (IAHRS), arguing that there is no private right of action under

2 Henry argues that nothing in the rules provides for this procedure. She maintains that the motion to dismiss should have been denied as untimely and that Community should have then had to file a motion for judgment on the pleadings. As everyone would have ended up in the same place had that occurred, we will join the trial court in considering the matter as a ruling on a motion for judgment on the pleadings for the sake of judicial economy and efficiency.

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 5 of 9 either statute. This framing is a red herring, however, inasmuch as Henry

agrees that there is no private right of action and is not attempting to assert one.

[7] Instead, Henry argues that HIPAA may be used to establish the standard of

care in a common law negligence action. To ensure that litigants are not

enabled to make an end-run around the lack of a private right of action under

HIPAA, Community argues that there must first be a common law duty. We

agree.

[8] There is an age-old recognition that medical providers owe a duty of

confidentiality to their patients. While this duty is now codified by statute in

Indiana, that does not change the historical recognition of the duty at common

law.3 See Schlarb v. Henderson, 211 Ind. 1, 4, 4 N.E.2d 205, 206 (1936)

(acknowledging, in the context of doctor-patient privilege, that there was a

“common-law rule before the statute” to ensure open communication “without

the danger of publicity concerning such private and intimate affairs”); Springer v.

Byram, 137 Ind. 15, 36 N.E. 361, 363 (1894) (observing that communications

made by a patient to a doctor are “intended to be private and confidential, and

can never be divulged without the consent of the patient”). This common law

duty finds support in the ethical rules governing the medical profession. See

3 We acknowledge the caselaw providing that, in the context of the doctor-patient privilege in our judicial system, the privilege did not exist at common law and is, instead, a statutory creation of the legislature. E.g., Terre Haute Reg’l Hosp., Inc. v. Trueblood, 600 N.E.2d 1358 (Ind. 1992). But we do not believe that the existence of this privilege in the context of our judicial system has any bearing on the historical duty of confidentiality owed by medical providers to their patients.

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 6 of 9 Canfield v. Sandock, 563 N.E.2d 526, 529 and 529 n.2 (Ind. 1990) (observing that

“the ethical rules of the medical profession . . . prohibit disclosure of

confidential information in non-judicial settings” and that the “Hippocratic

Oath imposes on physicians a duty to maintain confidences acquired in their

professional capacity”); see also Am. Med. Ass’n, Code of Medical Ethics

Opinion 3.2.1, https://www.ama-assn.org/delivering-

care/ethics/confidentiality (stating that physicians “have an ethical obligation

to preserve the confidentiality of information gathered in association with the

care of the patient”); Vargas v. Shepherd, 903 N.E.2d 1026, 1031-32 (Ind. Ct.

App. 2009) (acknowledging argument that medical providers assume a duty to

abide by ethical guidelines, including obtaining patient consent before

disclosing any medical information, and assuming without deciding that such a

duty exists).

[9] We have little trouble concluding, based on the above authority, that there is—

and, in modern times, always has been—a common law duty of confidentiality

owed by medical providers to their patients. And it is necessarily true that if a

duty exists, a breach of that duty is also possible. Indeed, this Court has more

than once considered a claim that a medical provider negligently or recklessly

disseminated a patient’s confidential information, finding that such a claim

sounds in ordinary negligence rather than in medical malpractice. G.F. v. St.

Catherine Hosp., Inc., 124 N.E.3d 76, 86-88 (Ind. Ct. App. 2019), trans. denied;

H.D. v. BHC Meadows Hosp., Inc., 884 N.E.2d 849, 855-56 (Ind. Ct. App. 2008);

see also Reply Br. p. 15 n.4 (citing to multiple cases from other states showing

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 7 of 9 that torts related to medical privacy breaches are well established based on an

underpinning of the public policy goal of protecting physician-patient

communications).

[10] Having found that a common law duty exists, we have little trouble agreeing

with a sister court that “HIPAA and its implementing regulations may be

utilized to inform the standard of care” in tort claims related to alleged breaches

of the duty of confidentiality owed by medical providers to their patients. Byrne

v. Avery Ctr. for Obstetrics & Gynecology, P.C., 102 A.3d 32, 49 (Conn. 2014).

[11] Under Indiana’s liberal notice pleading standard, we find that Henry’s

complaint includes the operative facts necessary to make a negligence-based

claim against Community. See ARC Constr. Mgmt., LLC v. Zelenak, 962 N.E.2d

692, 697 (Ind. Ct. App. 2012) (holding that “[u]nder Indiana’s notice pleading

system, a pleading need not adopt a specific legal theory of recovery to be

adhered to throughout the case”). Specifically, the complaint alleged a duty to

protect the privacy, security, and confidentiality of her health records, a breach

of that duty by Community’s employee when the employee shared Henry’s x-

rays with employee’s spouse, and resulting damages, if any. Under these

circumstances, it was erroneous to grant Community’s motion for judgment on

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 8 of 9 the pleadings because it is not clear from the face of the complaint that under no

circumstances could relief be granted.4, 5

[12] The judgment of the trial court is reversed and remanded for further

Kirsch, J., and Crone, J., concur.

4 Because we find that the complaint survives dismissal based on medical providers’ common law duty of confidentiality, we need not and will not discuss Henry’s other claims implicated by the complaint, including public disclosure of private facts and other negligence-based claims. On remand, Henry is free to pursue whichever theories of the case she chooses so long as they stem from the operative facts pleaded in her complaint. 5 If this litigation continues, at some point, Henry will have to show that she sustained damages as a result of the alleged breach of confidentiality, whether in the context of a negligence-based claim or an invasion of privacy claim. We note that the Restatement (Second) of Torts indicates that, for an invasion of privacy claim, damages can include (1) the harm to the plaintiff’s privacy interest itself; (2) the plaintiff’s mental distress; and (3) special damages. Restatement (Second) of Torts § 652H. If, in the context of a negligence-based claim, Henry cannot prove damages, we note that the Vargas Court, in similar circumstances, explained that the appropriate remedy would be “a complaint to the medical licensing board or professional organization.” 903 N.E.2d at 1032.

Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 9 of 9