FILED May 26 2020, 8:41 am
CLERK Indiana Supreme Court Court of Appeals and Tax Court
ATTORNEYS FOR APPELLANT ATTORNEYS FOR APPELLEE Sherry A. Fabina-Abney William N. Riley Jenny R. Buchheit Anne Medlin Lowe Stephen E. Reynolds Riley Williams & Piatt, LLC Sean T. Dewey Indianapolis, Indiana Ice Miller LLP ATTORNEYS FOR AMICUS Indianapolis, Indiana CURIAE A. Richard M. Blaiklock Wade D. Fulford Lewis Wagner, LLP Indianapolis, Indiana
IN THE COURT OF APPEALS OF INDIANA
Community Health Network, May 26, 2020 Inc., Court of Appeals Case No. Appellant, 19A-CT-873 Appeal from the Marion Superior v. Court The Honorable Cynthia J. Ayers, Heather McKenzie and Daniel Judge McKenzie, individually and as Trial Court Cause No. parents and natural guardians of 49D04-1401-CT-433 J.M. and O.M., John McKenzie, Deborah West, Michael West, and Katrina Gray, Appellees.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 1 of 33 Pyle, Judge.
Statement of the Case
[1] Plaintiffs-Appellees, Heather McKenzie (“Heather”), Daniel McKenzie
(“Daniel”), John McKenzie (“John”), Deborah West (“Deborah”), Michael
West (“Michael”), J.M. (“J.M.”), and O.M. (“O.M.”) (collectively,
“Appellees”) filed their complaint against Defendant-Appellant Community
Health Network, Inc (“Community”) and Defendant Katrina Gray (“Katrina”)
in January 2014 and amended their complaint in July 2015. The complaint
arose following Katrina’s unauthorized access of Appellees’ private health
information while she was an employee of Community. Appellees brought
claims for vicarious liability under the doctrine of respondeat superior and
negligent training, supervision, and retention against Community and
negligence and invasion of privacy/intrusion against Katrina.
[2] This interlocutory appeal comes before us pursuant to the trial court’s denial of
Community’s Trial Rule 12(B)(1) motion to dismiss Appellees’ complaint and
motion for summary judgment. Community contends that: (1) the trial court
erred by denying its motion to dismiss Appellees’ complaint for a lack of subject
matter jurisdiction, asserting that their claims fall within the purview of the
Medical Malpractice Act (the “MMA”) and that the Appellees failed to comply
with the procedural prerequisites of the MMA; and (2) the trial court erred by
denying summary judgment on Appellees’ claims of respondeat superior and
negligent training, supervision, and retention. Community also argues that
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 2 of 33 even if Katrina’s actions were within the scope of her employment, it cannot be
held vicariously liable under respondeat superior for Katrina’s actions because
Appellees’ underlying negligence and invasion of privacy/intrusion claims
against Katrina are not actionable under Indiana law.
[3] We conclude that Appellees’ claims do not fall within the purview of the MMA
and that the trial court properly denied Community’s motion to dismiss.
Additionally, on the claims involving respondeat superior, negligent training,
supervision, and retention, and negligence, there are genuine issues of material
fact precluding summary judgment in Community’s favor. However, to the
extent that Appellees’ respondeat superior claim is based on an underlying act
of invasion of privacy/intrusion by Katrina, we conclude that Community is
entitled to judgment as a matter of law, in part, on the respondeat superior
claim. Therefore, the judgment of the trial court is affirmed in part, reversed in
part, and remanded with instructions
[4] We affirm in part, reverse in part, and remand with instructions.
Issues
1. Whether the trial court erroneously denied Community’s motion to dismiss.
2. Whether the trial court erroneously denied Community’s motion for summary judgment.
Facts
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 3 of 33 [5] Heather and Katrina worked together at the Indiana Orthopedic Center
(“IOC”) from January 2005 until September 2010. Katrina had been employed
as a medical records coordinator at the IOC since 1999 and was Heather’s
direct supervisor between 2005 and 2010. Katrina’s title at the IOC was
“Health Information Management Coordinator.” (App. Vol. VIII at 26). In
this capacity, Katrina was responsible for “scheduling appointments and
releasing medical records for [the IOC].” (App. Vol. VIII at 26).
[6] At some point, Katrina introduced Heather to her stepson, Kevin Gray
(“Kevin”). In 2006, Heather began dating Kevin, and the two married in 2007.
Heather and Kevin had two children, J.M. and O.M. Heather and Kevin
eventually divorced in 2010. Heather received full custody of J.M. and O.M.
In 2011, Heather married Daniel, and he adopted J.M. and O.M. A family
feud between the Gray family and Appellees ensued.
[7] In 2012, Community acquired the IOC through an asset purchase. Community
hired and trained Katrina as a medical records coordinator. As a condition of
her employment with Community, Katrina was required to attend orientation
and complete mandatory e-training on patient confidentiality and the Health
Insurance Portability and Accountability Act of 1996 (“HIPPA”).
[8] In June 2012, after successfully completing orientation and e-training, Katrina
was provided access to Epic, an electronic medical records system. When using
Epic, Katrina was authorized to schedule appointments and release records of
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 4 of 33 the patients only within the IOC. Katrina was strictly prohibited from
accessing any patient record without a business need or for personal reasons.
[9] In September 2013, Community received an internal employee complaint via its
anonymous hotline, which served as an internal and external avenue to report
any compliance issues involving Community’s employees. The complaint
alleged that Katrina had accessed her personal chart, which, if true, violated
Community’s policies and employee conduct rules. As a result, Community
investigated Katrina’s access and determined that she had accessed her own
chart, as well as the confidential health records of multiple other patients–
including Appellees–at various times between January and September 2013.
For each unauthorized access, Katrina had used a Community computer
system to look up private health information of Community’s patients. She did
so while she was on the job using equipment, software, and credentials
provided to her by Community. Following Community’s investigation,
Community placed Katrina on administrative leave and eventually terminated
her employment.
[10] While Appellees received medical treatment at and were patients of
Community, they had not received care or services at the IOC. In early
November 2013, Appellees received notice from Community that their health
information records had been compromised. The letters explained that
Community had “learned that an employee [had] accessed” the Appellees’
“medical record[s] without a business need[,]” and listed the specific dates the
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 5 of 33 breaches had occurred. (App. Vol. VIII at 2-5). Appellees later learned that
Katrina was the employee who had improperly accessed their medical records.
[11] In January 2014, Appellees filed suit against Community based on Katrina’s
unauthorized access of their medical records. This complaint named
Community as the sole defendant and alleged two counts: (1) respondeat
superior; and (2) negligent training, supervision, and retention. In July 2015,
Appellees filed an amended complaint adding Katrina as a defendant. The
amended complaint enumerated four counts: (1) respondeat superior against
Community; (2) negligent training, supervision, and retention against
Community; (3) negligence against Katrina; and (4) invasion of
privacy/intrusion against Katrina. In regard to their respondeat superior claim
against Community in count one, Appellees alleged that Community owed
them a non-delegable duty to protect the privacy and confidentiality of their
medical records. They further alleged that because Katrina had accessed their
records in the course and scope of her employment with Community,
Community was vicariously liable for Katrina’s unauthorized acts and that as a
proximate result of this breach, Appellees had suffered damages. As for the
negligent training, supervision, and retention claim in count two, Appellees
alleged that Community had: (1) breached its duty to train and instruct Katrina
in the protection of confidential medical records; (2) failed to supervise Katrina
in the protection of medical records and their confidentiality; (3) failed to
employ methods and/or take appropriate steps to learn of an employee’s misuse
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 6 of 33 and abuse of authority; and (4) failed to implement appropriate measures for
the protection of its patients’ health information records.
[12] In September 2015, Community filed its amended answer. In January 2018,
Community filed a motion to dismiss counts one and two of the amended
complaint pursuant to Trial Rule 12(B)(1), alleging that the trial court lacked
subject matter jurisdiction. Specifically, Community argued that Appellees’
claims directly related to the provision of healthcare within the MMA and that
Appellees had failed to exhaust their administrative remedies because they had
not filed a complaint with the Indiana Department of Insurance (“IDOI”) and
had not obtained a medical panel decision.
[13] Contemporaneously, and alternatively, Community filed a motion for summary
judgment requesting that the court enter judgment in its favor as to counts one
and two of the amended complaint. Specifically, Community argued that: (1)
it was not vicariously liable for Katrina’s misconduct; (2) it owed no actionable
duty to Appellees; and (3) Appellees were not sufficiently damaged by the
personal health information breach. Community also argued that even if
Katrina acted within the scope of her employment, it could not be held
vicariously liable because Appellees’ underlying negligence and invasion of
privacy/intrusion claims against Katrina are not actionable under Indiana law. 1
1 Katrina has not sought summary judgment on the negligence or invasion of privacy/intrusion claims against her.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 7 of 33 [14] In support of its motion for summary judgment, Community designated in
relevant part: (1) depositions from Deborah, Michael, Heather, Daniel, John;
(2) an affidavit with exhibits from a Senior Project Manager at Community
explaining the conditions of Katrina’s employment, including attending
orientation, reviewing Community’s policies and procedures, and completing
mandatory e-training on patient confidentiality and HIPAA; (3) an affidavit
with exhibits from Community’s Vice President of Compliance explaining its
policies, training materials, and mechanisms for monitoring access to medical
records; and (4) interrogatories from Katrina, Heather, Michael, Deborah,
John, and Daniel.
[15] Appellees responded by designating several depositions, exhibits, and affidavits
in support of their argument that genuine issues of material fact precluded
summary judgment. One such exhibit was an affidavit with a report by their
retained expert, Dr. Kayur V. Patel (“Dr. Patel”), discussing Community’s
“policies and procedures safeguarding . . . electronically-stored private health
information.” (App. Vol. IV at 91). In his report, Dr. Patel stated that he was
“asked to evaluate whether or not, as a facility, Community Health had
implemented and acted under HIPAA . . . Breach Notification Rule, modified
September 23, 2013 and American Medical Association Guidelines and
whether or not its employee adhered to follow it, safeguarding the privacy and
security of PHI (Protected Health Information).” (App. Vol. IV at 93).
[16] In September 2018, the trial court heard argument on Community’s motion to
dismiss and motion for summary judgment. The trial court also heard
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 8 of 33 argument on a motion to intervene that had been filed by Stephen Robertson,
Commissioner of the IDOI, as Administrator of the Indiana Patient’s
Compensation Fund (“PCF”). At the end of the hearing, the trial court ordered
that the parties submit proposed findings of fact and conclusions of law. In
November 2018, the trial court denied all three motions in its findings of fact
and conclusions of law. When denying Community’s motion to dismiss, the
trial court concluded in relevant part:
The conduct in this case was possible as part of the regular business functions of [Katrina] and therefore falls outside the [MMA]. [Katrina] was a clerical employee of Community. The [Appellees] were not patients of the practice at which [Katrina] worked and the misconduct alleged by the [Appellees] did not involve providing medical treatment to them.
***
The [Appellees] allege that Community breached it[s] duty to secure and maintain health information by its failure to adopt or enforce a variety of mechanisms, policies, or procedures that govern handling of medical records. Such policies and procedures are indirectly related to patient care in that the records are a confidential repository for medical events and diagnoses that have occurred or may occur in the future. The accumulation and review of patient records plays an important part in how a physician may make a medical decision, however, handling the records themselves are not treatment of the patient by medical professional.
Therefore, this [c]ourt has subject matter jurisdiction over the case before the bench and over the claims that Community Health Network and Katrina Gray mishandled confidential information. Community’s 12(B)(1) [m]otion to [d]ismiss is hereby denied.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 9 of 33 (App. Vol. II at 26-28).
[17] When denying Community’s motion for summary judgment on counts one and
two, the trial court concluded in relevant part:
[Katrina’s] access to patient medical records was incidental to authorized conduct. Without information on what exactly [Katrina] did or intended to do with the data she viewed, leaves open questions of fact for the jury.
[Katrina] stated, in her response to the allegations that, “I did not have a clear understanding of the scope of my authority in this area until the subject incident.” Thus, a question of fact as to whether and to what extent [Katrina] understood or acknowledged Community’s privacy policies remains for trial. Therefore, summary judgment is not appropriate on the question of whether Community is vicariously liable for the breaches of its former employee, [Katrina].
On the question of duty of Community to the owners of breached records, Community argued that it and [Katrina] have no duty to the [Appellees] to keep their medical records private. However, both state and federal law outline the duty of health care providers to protect the confidentiality of the patients’ health and medical records. Also, Community produced documents recognizing its ‘legal and ethical’ duty to its patients to keep their medical records confidential. Further, a party responsible for gathering and storing individuals’ private health information has a duty to keep confidential that information. Rocca v. [Southern] Hills Counselling Ctr., Inc., 671 N.E.2d 913, 916 (Ind. Ct. App. 1996). Under these facts and circumstances, the Court denies Community’s motion for summary judgment as to whether it and Gray owe a duty to the [Appellees].
The designated evidence supports an inference that [Katrina’s] violations of the [Appellees’] privacy rights were allowed as part of Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 10 of 33 the general daily access that [Katrina] had to patient medical records. [Katrina] looked at her own medical records and the records of other patients, in addition to the [Appellees] records during an eight-month period. Whether Community breached its duty to protect the confidentiality of those records from [Katrina] (as in limiting access to patient records to those inside her department only) whatever her personal reasons for viewing the records may have been, is a question of fact. In sum, although the breach is admitted and training of [Katrina] may have been adequate and appropriate, questions of fact remain as to whether Community failed to take appropriate steps to implement measures to learn of an employee’s misuse or abuse of authority and whether Community failed to narrow [Katrina’s] access to prevent the spread of confidential medical information to unauthorized sources.
[Katrina] asserted, when confronted with these unauthorized access allegations that, despite the policies of and/or training by Community, she did not “have a clear understanding of the scope of [her] authority in this area until the subject incident.” Therefore, whether Defendants breached their duty to the [Appellees] is a question for the fact finder. Summary judgment on the issue of breach of duty is denied.
Here, each [of the Appellees] designated evidence supporting an inference that he or she has suffered emotional distress due to the breach. The weight assigned to this evidence, and a determination of the existence and extent of the damages to the [Appellees], is a question for the jury, Am. Family Mut. Ins. Co. v. Matusiak, 878 N.E.2d 529, 533 (Ind. Ct. App. 2007). Community’s motion for summary judgment on the [Appellees’] damages is denied.
[Appellees] designated evidence supporting an inference that [Katrina] did or may have publicly disclosed facts about the [Appellees’] private lives to social acquaintances and her co- workers, creating a question of fact as to whether and to what extent these disclosures occurred. Therefore, Community’s
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 11 of 33 motion for summary judgment on the [Appellees’] invasion of privacy claim is denied.
(App. Vol. II at 30-36).
[18] Thereafter, Community filed a motion to certify the trial court’s ruling for an
interlocutory appeal. The trial court certified its order, and Community filed a
motion for permission to file an interlocutory appeal, which we granted.
Community now appeals.2
Decision
[19] On appeal, Community argues that the trial court erred by: (1) denying its
motion to dismiss Appellees’ complaint; and (2) denying its motion for
summary judgment on counts one and two of Appellees’ amended complaint.
We will address each of these arguments in turn.
1. Motion to Dismiss
[20] Community first argues that the trial court erred by denying its motion to
dismiss pursuant to Trial Rule 12(B)(1) for lack of subject matter jurisdiction.
Community contends that Appellees’ claims fall squarely within the purview of
the MMA and that Appellees failed to comply with the MMA when they did
2 Community requested oral argument in this matter. In a separate issued order, we deny Community’s oral argument motion.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 12 of 33 not submit a proposed complaint with the IDOI and did not obtain an opinion
from a medical review panel before filing their complaint with the trial court.
[21] Trial Rule 12(B)(1) addresses the “[l]ack of jurisdiction over the subject matter.”
In reviewing a motion to dismiss for lack of subject matter jurisdiction pursuant
to Trial Rule 12(B)(1), the relevant question is whether the type of claim
presented falls within the general scope of the authority conferred upon the
court by constitution or statute. Metz as Next Friend of Metz v. Saint Joseph Reg’l
Med. Center-Plymouth Campus, Inc., 115 N.E.3d 489, 493 (Ind. Ct. App. 2018).
A motion to dismiss for lack of subject matter jurisdiction presents a threshold
question with respect to a court’s power to act. Id. Our standard of review for a
trial court’s grant or denial of such motion “is a function of what occurred in
the trial court.” Id. (internal citation and quotation omitted). “Where the facts
before the trial court are not in dispute, the question of subject matter
jurisdiction is one of law, and we review the trial court’s ruling de novo.” Muir
Woods Section One Association, Inc. v. Fuentes, 136 N.E.3d 647, 651 (Ind. Ct. App.
2019).
[22] The MMA dictates the statutory procedures for medical malpractice actions.
See I.C. § 34-18-1-1 et seq. The MMA defines “malpractice” as “a tort or
breach of contract based on health care or professional services that were provided, or
that should have been provided, by a health care provider, to a patient.” I.C. §
34-18-2-18 (emphasis added). The fact that Community is a health care
provider is undisputed. The MMA defines “tort” as a “legal wrong, breach of
duty, or negligent or unlawful act or omission proximately causing injury or
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 13 of 33 damage to another.” I.C. § 34-18-2-28. The MMA defines “health care” as “an
act, or treatment performed or furnished, or that should have been performed or
furnished, by a health care provider for, to, or on behalf of a patient during the
patient’s medical care, treatment, or confinement.” I.C. § 34-18-2-13. Despite
the MMA’s comprehensiveness, the phrase, “professional services,” is
undefined.
[23] The MMA is not all-inclusive for claims against health care providers, nor is it
intended to be extended to cases of ordinary negligence. Peters v. Cummins
Mental Health, Inc., 790 N.E.2d 572, 576 (Ind. Ct. App. 2003), trans. denied.
Rather, the MMA was designed to curtail, not expand, liability for medical
malpractice. Chamberlain v. Walpole, 882 N.E.2d 959, 963 (Ind. 2005). As such,
the MMA is in derogation of common law and should be narrowly construed.
Patel v. Barker, 742 N.E.2d 28, 31 (Ind. Ct. App. 2001), reh’g denied, trans. denied.
When the General Assembly enacts a statute in derogation of the common law,
courts presume that the General Assembly is aware of the common law and
that the General Assembly does not intend to make any change beyond what is
declared in express terms or by unmistakable implication. Weldon v. Universal
Reagents, Inc., 714 N.E.2d 1104, 1107-08 (Ind. Ct. App. 1999).
[24] Indiana courts have developed an analytical framework to determine whether
the MMA applies to a certain claim. The courts look to the substance of a
claim, not the manner in which the conduct is framed in a pleading by the
claimant. G.F. v. St. Catherine Hosp., Inc., 124 N.E.3d 76, 85 (Ind. Ct. App.
2019), trans. denied. Claims that boil down to a “question of whether a given
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 14 of 33 course of treatment was medically proper and within the appropriate standard
are the quintessence of a malpractice case.” Howard Reg’l Health Sys. v. Gordon,
952 N.E.2d 182, 185 (Ind. 2011) (internal quotation omitted). Thus, to fall
within the purview of the MMA, a provider’s conduct must be undertaken in
the interest of, or for the benefit of, the patient’s health. Id. Put differently, the
conduct must be “curative or salutary conduct of a health care provider acting
within his or her professional capacity.” Murphy v. Motrell, 684 N.E.2d 1185,
1188 (Ind. Ct. App. 1997), trans. denied. Conversely, the MMA does not apply
to conduct “demonstrably unrelated to the promotion of the plaintiff’s health or
an exercise of the provider’s professional expertise, skill, or judgment.” Gordon,
952 N.E.2d at 186.
[25] Given the limiting language of the MMA, not every negligent act or omission
by a health care provider constitutes medical malpractice. G.F., 124 N.E.3d at
85. Indeed, the MMA applies to “a variety [of] claims that do not look like
traditional medical malpractice.” Terry v. Cmty. Health Network, Inc., 17 N.E.3d
389, 393 (Ind. Ct. App. 2014) (citations omitted). We have also explained that:
A case sounds in ordinary negligence [rather than medical negligence] where the factual issues are capable of resolution by a jury without application of the standard of care prevalent in the local medical community. By contrast, a claim falls under the [MMA] where there is a causal connection between the conduct complained of and the nature of the patient-health care provider relationship.
Metz, 115 N.E.3d at 495 (quoting Terry, 17 N.E.3d at 393) (internal citations
omitted).
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 15 of 33 [26] Community argues that the trial court erred when it concluded that Appellees’
claims do not fall within the purview of the MMA. Specifically, Community
urges that its “maintenance of medical records, as well as its determination and
utilization of the appropriate mechanisms, training protocols, and procedures
for logging, auditing, monitoring, detecting, or otherwise securing access to
patient records, are professional services [it] offers in furtherance of its patient
care.” (Community’s Br. 33-34). Therefore, Community argues, Appellees’
claims “unequivocally fall[] within the purview of the MMA.” (Community’s
Br. 33). In response, Appellees argue that “claims alleging the mishandling of a
patient’s confidential information––even by a treating physician––are not
governed by the Medical Malpractice Act.” (Appellees’ Br. 21). In this specific
case, we agree with Appellees.
[27] Community relies on Gordon for the proposition that the maintenance and
preservation of medical records “is so closely entwined with health care” that
the present claims are governed by the MMA. Gordon, 952 N.E.2d at 186.
Gordon involved claims against a hospital and other defendants for medical
malpractice and for a spoliation of evidence due to the hospital’s loss of a
portion of the plaintiff’s past health records. Our supreme court first addressed
the spoliation claim and determined that the maintenance of health records was
within the purview of the MMA because the “skillful, accurate, and ongoing
maintenance of test and treatment records bears strongly on subsequent
treatment and diagnosis of patients.” Id. at 186. The Gordon Court continued
its analysis and concluded that the statute on the maintenance of health records
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 16 of 33 does not create a separate cause of action for negligent loss of the medical
records from the MMA. The Court also determined that the plaintiffs
presented a claim for first-party spoliation, not third-party spoliation. The
Court held that the spoliation claim against the hospital was a prohibited first-
party spoliation claim. Taken together, the Gordon Court held that the hospital
was entitled to summary judgment on the count alleging spoliation of evidence.
[28] Contrary to Community’s assertions, we do not find Gordon persuasive here
because its holding on the maintenance of records is not applicable to this case.
Gordon dealt with the “skillful, accurate, and ongoing” maintenance of a
patient’s health records by “physicians and other health care providers” so that
the health care providers can have access to relevant information for the
treatment of their patients. Id. at 186. The underlying claims against the
hospital and one of its physicians were for medical malpractice and,
importantly, spoliation, claiming that the hospital lost health records that were
vital to the medical malpractice claim. Here, the underlying claims against
Community are for respondeat superior and negligent training, supervision, and
retention. Appellees do not allege that records were lost, nor do they claim that
Katrina provided them medically improper treatment; rather, their claims
against Community arise from Katrina’s access of their confidential health
information records. As such, the MMA does not apply to Appellees’ claims
because the conduct at issue is “demonstrably unrelated to the promotion of the
plaintiff’s health or an exercise of the provider’s professional expertise, skill, or
judgment.” Id. at 186.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 17 of 33 [29] Additionally, we find this Court’s recent decision in G.F. to be more instructive.
In that case, we addressed “[w]hether the MMA applies to claims involving
negligent dissemination of protected health information.” G.F., 124 N.E.3d at
80. In G.F., the physician disclosed the patient’s confidential health
information to a third-party visitor who was present in the plaintiff’s hospital
room. The patient brought an action against his treating physician, hospital,
and the Indiana Patient’s Compensation Fund, seeking declaration that his
claims against the physician and hospital did not fall within the purview of the
MMA. The plaintiff then moved for summary judgment on his declaratory
judgment claims. After the trial court permitted the physician and hospital to
file a belated response, the court found that the patient’s claim was governed by
the MMA and denied the summary judgment motion in its entirety.
[30] On appeal, this Court accepted the patient’s argument that his claim was not
within the boundaries of the MMA. The G.F. Court began its analysis by
noting that the patient was not contending that his physician’s statement led to
an inaccurate diagnosis, improper treatment, or bodily injury. Rather, he
articulated his claim as whether the MMA applies to claims involving the
violation of a patient’s medical confidentiality and negligent or intentional
disclosure of protected health information. The G.F. Court explained that the
test for resolving such a claim is “based on the provider’s behavior or practices
while acting in his professional capacity as a provider of medical services.”
G.F., 124 N.E.3d at 88 (internal quotation and citation omitted). This Court
explained that the physician’s communication had the dual effect of providing
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 18 of 33 medical information to a patient while inadvertently disclosing confidential
information to a third-party. Because it was the disclosure of confidential
information and not the services provided by the physician that was the focus of
the patient’s claim, this Court reasoned that at no point did the disclosure of
such confidential information constitute health care treatment to the plaintiff,
nor did the physician’s statements have a curative or salutary effect on the
plaintiff. Therefore, the G.F. Court held that the plaintiff’s complaint, “as it
pertain[ed] to the negligent or intentional disclosure of protected health
information, [wa]s not subject to the limitations of the MMA.” Id.
[31] As in G.F., Appellees’ complaint is not subject to the limitations of the MMA.
Katrina worked for Community as a medical records coordinator and was
responsible for “scheduling appointments and releasing medical records for [the
IOC].” (App. Vol. VII at 26). Her position did not involve the provision of
health care to Appellees. Furthermore, Appellees were not patients of the
practice at which Katrina worked. It cannot be said that her conduct was in
furtherance of providing health care or professional services to Appellees. See
H.D. v. BHC Meadows Hosp., Inc., 884 N.E.2d 849, 856 (Ind. Ct. App. 2008)
(holding that a claim based on a therapist’s decision to send a fax containing
information about an adolescent patient’s mental health to the patient’s school
was not a malpractice claim subject to the MMA), reh’g denied, trans. denied.
[32] Accordingly, Appellees’ claims are not related to the promotion of their health
and do not involve the use of professional expertise, skill, or judgment, as
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 19 of 33 contemplated by the MMA.3 Therefore, the trial court did not lack subject
matter jurisdiction and did not err when it denied Community’s motion to
dismiss.
2. Summary Judgment
[33] We now turn to Community’s contention that the trial court erred by denying
its motion for summary judgment. Our standard of review in summary
judgment appeals is as follows:
We review summary judgment de novo, applying the same standard as the trial court: “Drawing all reasonable inferences in favor of . . . the non-moving parties, summary judgment is appropriate ‘if the designated evidentiary matter shows that there is no genuine issue as to any material fact and that the moving party is entitled to judgment as a matter of law.’” Williams v. Tharp, 914 N.E.2d 756, 761 (Ind. 2009) (quoting T.R. 56(C)). “A fact is ‘material’ if its resolution would affect the outcome of the case, and an issue is ‘genuine’ if a trier of fact is required to resolve the parties’ differing accounts of the truth, or if the undisputed material facts support conflicting reasonable inferences.” Id. (internal citations omitted).
The initial burden is on the summary-judgment movant to “demonstrate [ ] the absence of any genuine issue of fact as to a determinative issue,” at which point the burden shifts to the non- movant to “come forward with contrary evidence” showing an
3 In an attempt to further support its argument that Appellees’ claims fall under the MMA, Community also argues that the “substance of [Appellees’] claims against [it] require reference to the applicable standard of care, which is clearly outside the province of the jury.” (Community’s Br. 34-35). In support, Community emphasizes Appellees’ retention of a physician expert and his report regarding Community’s “policies and procedures safeguarding . . . electronically-stored private health information.” (App. Vol. IV at 91). We disagree with Community. The fact that Appellees retained an expert to explain Community’s maintenance of health information does not automatically bring Appellees’ claims within the purview of the MMA.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 20 of 33 issue for the trier of fact. Id. at 761-62 (internal quotation marks and substitution omitted).
Hughley v. State, 15 N.E.3d 1000, 1003 (Ind. 2014) (alterations original to
Hughley).
[34] We emphasize that summary judgment is a “high bar” for the moving party to
clear in Indiana. Id. at 1004. “In particular, while federal practice permits the
moving party to merely show that the party carrying the burden of proof [at
trial] lacks evidence on a necessary element, we impose a more onerous burden:
to affirmatively ‘negate an opponent’s claim.’” Id. at 1003 (quoting Jarboe v.
Landmark Comm. Newspapers of Ind., Inc., 644 N.E.2d 118, 123 (Ind. 1994), reh’g
denied). Further:
Summary judgment is a desirable tool to allow the trial court to dispose of cases where only legal issues exist. But it is also a “blunt . . . instrument” by which the non-prevailing party is prevented from having his day in court. We have therefore cautioned that summary judgment is not a summary trial and the Court of Appeals has often rightly observed that it is not appropriate merely because the non-movant appears unlikely to prevail at trial. In essence, Indiana consciously errs on the side of letting marginal cases proceed to trial on the merits, rather than risk short-circuiting meritorious claims.
Id. (citations and some quotations omitted; omissions original to Hughley).
[35] Community asserts that it is entitled to judgment as a matter of law on
Appellees’ claims against it for respondeat superior and negligent supervision,
training, and retention. We address each claim in turn.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 21 of 33 [36] As a preliminary matter, we note that Community asserts that the trial court
erred by allowing both the respondeat superior and negligent supervision,
training, and retention claims to proceed. Community argues that if “[Katrina]
was acting in the scope of her employment, then the trial court should have
summarily dismissed [the negligent supervision, training, and retention claim].
Alternatively, if [Katrina] was not acting within the scope of her employment,
[the respondeat superior claim] should have been summarily dismissed.”
(Community’s Br. 38) (emphasis in original). While Appellees’ respondeat
superior and negligent supervision, training and retention claims are alternative
theories for holding an employer liable, our supreme court has held that unless
an “employer admits that an employee was acting within the course and scope
of his or her employment,” both claims may proceed. Sedam v. 2JR Pizza
Enterprises, LLC, 84 N.E.3d 1174, 1179 (Ind. 2017). Here, Community has not
made such an admission. Thus, we conclude that given the stage in litigation,
the trial court did not err in allowing Appellees to proceed on both claims for
respondeat superior and negligent supervision, training, and retention.
A. Respondeat Superior
[37] Community first argues that it is entitled to summary judgment on Appellees’
claim alleging respondeat superior liability. The general rule is that vicarious
liability can be imposed when an employer, who is not liable because of his
own acts, is found responsible “for the wrongful acts of his employee which are
committed within the scope of employment.” Sword v. NKC Hosps., Inc., 714
N.E.2d 142, 148 (Ind. 1999) (quotation and citation omitted). “[C]onduct is
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 22 of 33 within the scope of employment when it is ‘of the same general nature as that
authorized, or incidental to the conduct authorized.’” Walgreen Co. v. Hinchy,
21 N.E.3d 99, 107 (Ind. Ct. App. 2014) (quoting Celebration Fireworks, Inc., v.
Smith, 727 N.E.2d 450, 453 (Ind. 2000)), aff’d on reh’g, trans. denied.
Furthermore, “an employee’s wrongful act may still fall within the scope of
employment if [her] purpose was, to an appreciable extent, to further [her]
employer’s business, even if the act was predominantly motivated by an
intention to benefit the employee [herself].” Knighten v. E. Chi. Hous. Auth., 45
N.E.3d 788, 792 (Ind. 2015) (citation omitted). On the other hand, “an
employee’s act is not within the scope of employment when it occurs within an
independent course of conduct not intended by the employee to serve any
purpose of the employer.” Barnett v. Clark, 889 N.E.2d 281, 284 (Ind. 2008)
(emphasis omitted) (quoting Restatement (Third) of Agency § 7.07(2) (Am.
Law Inst. 2006)).
[38] An employer is not held liable under the doctrine of respondeat superior
because it did anything wrong, but “because of the [employer’s] relationship to
the wrongdoer.” Sword, 714 N.E.2d at 147. “Ultimately, we have found that
‘the scope of employment encompasses the activities that the employer
delegates to employees or authorizes employees to do, plus employees’ acts that
naturally or predictably arise from those activities.’” Burton v. Benner, 140
N.E.3d 848, 852 (Ind. 2020) (quoting Cox v. Evansville Police Dep’t, 107 N.E.3d
453, 461 (Ind. 2018)). The scope of employment rule emanates from the
concept of control. Cox, 107 N.E.3d at 461. More specifically, it springs from
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 23 of 33 the employer’s control over its employees and their employment activities: the
employer controls whom it hires, what employment duties it assigns, how it
empowers employees to carry out those duties, and how it guards against harm
arising from employment activities. Id.
[39] “[I]t is well established that whether an employee’s actions were within the
scope of employment is a question of fact to be determined by the factfinder.”
Knighten, 45 N.E.3d at 794 (quoting Walgreen, 21 N.E.3d at 107). Even if some
of the actions were unauthorized, the question of whether the actions were
within the scope of employment is for the jury. Konkle v. Henson, 672 N.E.2d
450, 457 (Ind. Ct. App. 1996). Only if none of the employee’s act were
authorized is the question a matter of law that need not be submitted to the trier
of fact. City of Fort Wayne v. Moore, 706 N.E.2d 604, 607 (Ind. Ct. App. 1999),
trans. denied.
[40] Here, this case involves a question of fact regarding whether Katrina’s actions
were within the scope of her employment with Community. Community
argues that “[b]ecause [Katrina] did not have a business need to access
[Appellees’] records, and because she did so for solely personal reasons,
Community cannot be held vicariously liable for her conduct[]” under
respondeat superior. (Community’s Br. 42).
[41] In support of its argument that Katrina was acting outside the scope of her
employment, Community directs our attention to Robbins v. Trs. of Ind. Univ., 45
N.E.3d 1 (Ind. Ct. App. 2015).
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 24 of 33 [42] In Robbins, this Court affirmed summary judgment in favor of a university
hospital and a data security company on the issue of vicarious liability. A
nurse, who was an employee of the university hospital, was generally
authorized to access medical records as part of her employment. Despite
signing a confidentiality agreement, the nurse accessed and then posted a
patient’s medical information on the internet. The nurse then pled guilty in
federal court to the felony charge of wrongful disclosure of individually
identifiable information. Thereafter, the patient filed a complaint against the
university hospital and data security company wherein she alleged that the
defendants were vicariously liable for the actions of the nurse. The university
hospital and data security company filed summary judgment motions. As part
of its designated evidence, the university hospital designated an affidavit by the
nurse in support of its motion. In the affidavit, the nurse admitted that she
accessed the patient’s information solely for personal reasons and that she was
acting on her own initiative and not within the scope of her employment. The
affidavit further explained that the nurse was not involved in any way in the
provision of medical care and that she knew that it was against her employer’s
policies and rules.
[43] In addressing the vicarious liability claim, this Court found that although the
nurse was authorized to access patient information, the existence of the
confidentiality agreement meant that the nurse was “expressly not authorized to
access, use, or disclose the information for personal, unauthorized, unethical, or
illegal reasons.” Id. at 10 (emphasis in original). This Court continued its
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 25 of 33 analysis by emphasizing that the nurse’s affidavit, which was designated by the
university hospital, stated that she had accessed the patient’s medical records on
“her own initiative and unrelated to any business function of her employment
or her employer[.]” Id. In holding that the nurse’s actions were outside the
scope of her employment, the Robbins Court also noted that the nurse had pled
guilty in federal court as a result of her wrongful act, and that the patient had
never been treated in the nurse’s department. Here, Community did not
designate an affidavit detailing such an admission by Katrina. Furthermore,
Katrina did not plead guilty in federal court as a result of her action. Thus,
Community’s reliance is misplaced because Robbins involved designated
evidence indicating the employee acted for her own benefit.
[44] We, however, find our Court’s decision in Walgreen Co. v. Hinchy, as relied upon
by Appellees, to control the outcome here. In Hinchy, an employee pharmacist
improperly accessed the prescription records of a Walgreen customer and
divulged the information she had learned from those records to the customer’s
ex-boyfriend. The customer filed a complaint against Walgreen and the
pharmacist, seeking respondeat superior liability against Walgreen for the
pharmacist’s actions, in addition to negligent training, supervision, and
retention, as well as professional malpractice. Walgreen moved for summary
judgment, and the trial court granted the motion with respect to the negligent
training claim, but otherwise denied the motion. At the ensuing jury trial, the
jury found in favor of the Walgreen customer.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 26 of 33 [45] Walgreen appealed the partial denial of its motion for summary judgment and
this Court affirmed. The Hinchy Court explained that the pharmacist was
“authorized to use the Walgreen computer system and printer, handle
prescriptions for Walgreen customers, look up customer information on the
Walgreen computer system, review patient prescription histories, and make
prescription-related printouts.” Hinchy, 21 N.E.3d at 108. The Hinchy Court
further noted that the pharmacist was at work and using Walgreen equipment
when the actions occurred, and much of her conduct was of the same general
nature as her ordinary job duties authorized by her employer. As a result, the
Hinchy Court held that whether the pharmacist’s actions were within the scope
of the pharmacist’s employment was properly determined by the jury rather
than as a matter of law in a summary judgment proceeding.
[46] Here, as in Hinchy, Katrina’s actions were of the same general nature as those
authorized, or incidental to the actions that were authorized, by Community.
There is no dispute that Katrina was authorized to use her assigned desktop
computer with Epic and other software to access patient health information.
There remains a question of fact regarding why and what Katrina did with
Appellees’ private health information. Because Katrina misused employer-
conferred power and authority to access the health information, whether
Katrina was acting within the scope of her employment is an issue to be
determined by the trier of fact. See Knighten, 45 N.E.3d at 794. Accordingly,
the trial court did not err when it denied Community’s motion for summary
judgment on Appellees’ respondeat superior claim.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 27 of 33 B. Negligent Training, Supervision, and Retention
[47] Community also argues that the trial court erroneously denied its motion for
summary judgment on Appellees’ negligent training, supervision, and retention
claim.
[48] A claim for negligent training, supervision, and retention is a species of
negligence. Negligence claims have three elements: (1) a duty owed by the
defendant to the plaintiff; (2) a breach of that duty; and (3) injury to the plaintiff
proximately caused by the defendant’s breach. Scott v. Retz, 916 N.E.2d 252,
257 (Ind. Ct. App. 2009). In negligence cases, summary judgment is “rarely
appropriate.” Rhodes v. Wright, 805 N.E.2d 382, 387 (Ind. 2004). In order for
Community to obtain summary judgment in its favor on the negligent training,
supervision, and retention claim, it was required to designate evidence to
affirmatively negate or demonstrate that one of the elements of Appellees’ claim
was not satisfied. See Jarboe, 644 N.E.2d at 123. Thus, our task on appeal is
not to determine whether Appellees have proven each element of the negligent
training, supervision, and retention claim. Rather, we must determine whether
Community has adequately met its initial burden of proving an absence of any
genuine issue of material fact or of affirmatively negating at least one element
with respect to Appellees’ claim. Community argues that it negated all the
elements of negligence.
[49] Turning to the first element of negligence, duty, Community begins by arguing,
correctly, that neither HIPAA nor INDIANA CODE § 16-39-5-3, as relied upon
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 28 of 33 by the trial court, provide private rights of action. However, the absence of a
private right of action under either statute does not necessarily resolve the issue
before us. Our recent decision in Henry v. Cmty. Healthcare Sys. Cmty. Hosp., 134
N.E.3d 435 (Ind. Ct. App. 2019), is instructive. In Henry, we held that “[t]here
is an age-old recognition that medical providers owe a duty of confidentiality to
their patients.” Id. at 437. The Henry Court further explained that while this
duty is codified by statute, the historical recognition of the duty at common law
was unchanged. Id. at 437-38. Therefore, this Court concluded that “there is–
and, in modern times, always has been–a common law duty of confidentiality
owed by medical providers to their patients.” Id. at 438.
[50] Community produced documents exhibiting its own recognition that its
patients are entitled to confidentiality of their medical information.
Furthermore, in response to a request for admission, Community admitted that
“it had a responsibility to provide reasonable and appropriate safeguards to
ensure confidentiality, integrity, and availability of the electronic protected
health information of its patients.” (App. Vol. VIII at 43). Accordingly,
Community’s argument that it negated the element of a duty owed to Appellees
fails.
[51] Next, Community argues it “affirmatively negated any finding of breach[]”
because it appropriately trained and supervised Katrina, and it was unaware of
Katrina’s misconduct or propensity to commit misconduct. (Community’s Br.
45). Although the existence of duty is a matter of law for the court to decide, a
breach of duty, which requires a reasonable relationship between the duty
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 29 of 33 imposed and the act alleged to have constituted the breach, is usually a matter
left to the trier of fact. Mangold ex rel. Mangold v. Ind. Dep’t of Nat. Res., 756
N.E.2d 970, 975 (Ind. 2001).
[52] Community designated evidence detailing the steps it took to implement and
enforce policies and procedures governing employee training and education.
However, in response, Appellees designated evidence supporting reasonable
inferences that Katrina was not properly trained, supervised, and that she
should not have been retained because Community had notice of her
unauthorized access to health information prior to the breach. For example,
the Appellees’ designated a report from an expert in hospital management
stating that the access to Appellees’ health information occurred because
“Community Health did not have proper systems and protocols in place
regarding its employees use of protected health information, neither was there
appropriate training and education for their staff, nor did they have effective
auditing and monitoring in place. There is a definite lack of systems and
procedures.” (App. Vol. VIII at 9). The expert further stated that “[t]he fact
that [Katrina] accessed private patient information and no one at the hospital
was aware of the same for such a long period of time indicates that even if there
are protocols in place, they are not being followed appropriately.” (App. Vol.
VIII at 10). Furthermore, Appellees designated evidence indicating that
Katrina’s supervisor had notice of Katrina’s unauthorized access of other
patients’ health information prior to the subject actions here.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 30 of 33 [53] Additionally, it is not enough for Community to point to its training and
education materials that should have prevented Katrina’s access of Appellees’
health information. Indeed, our supreme court has held that “[e]ven though an
employee violates the employer’s rules, orders, or instructions, or engages in
expressly forbidden actions, an employer may be held accountable for the
wrongful act if the employee was acting within the scope of employment.”
Warner Trucking v. Carolina Cas. Ins. Co., 686 N.E.2d 102, 105 (Ind. 1997).
Thus, the conflicting designated evidence creates genuine issues of material fact
as to whether Community breached its duty to protect the confidentiality of
Appellees’ records.
[54] Finally, Community argues that Appellees’ negligent supervision, training, and
retention claim “must fail because they failed to proffer any evidence of an
injury which resulted from [it’s] actions.” (Community’s Br. 48). However, it
is well-settled that although federal practice permits the moving party to merely
show that the party carrying the burden of proof at trial lacks evidence on a
necessary element, Indiana state courts impose a more onerous burden: to
affirmatively “negate an opponent’s claim.” Hughley, 15 N.E.3d at 1003
(citation omitted). Here, Community’s designated evidence and argument in
support of summary judgment on Appellees’ injury do not affirmatively negate
Appellees’ claim. Moreover, the existence and extent of the damages to
Appellees will need to be proven at trial. Therefore, the weight assigned to this
yet-to-be-determined evidence is a question for the jury, and the trial court did
not err in denying Community’s motion for summary judgment on this issue.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 31 of 33 C. Actionability of Underlying Claims
[55] As an offshoot of its argument that the trial court erred in denying summary
judgment in its favor, Community also argues that even if Katrina was acting
within the scope of her employment, it cannot be held vicariously liable for
Katrina’s actions because Appellees’ underlying negligence and invasion of
privacy/intrusion claims are not actionable under Indiana law. For the reasons
stated above, we conclude that there are genuine issues of material fact as to
whether Katrina violated Community’s policies and Community’s knowledge
thereof regarding Appellees’ negligence claim. However, we agree with
Community that Appellees’ claim for invasion of privacy/intrusion must fail.
[56] There are four sub-torts under invasion of privacy: (1) false light; (2) public
disclosure of private facts; (3) intrusion upon seclusion; and (4) appropriation of
likeness. Westminster Presbyterian Church of Muncie v. Yonghong Cheng, 992
N.E.2d 859, 868 (Ind. Ct. App. 2013), trans. denied. In this case, Appellee’s
have alleged the disclosure of private facts. In Doe v. Methodist Hosp., our
supreme court declined to recognize the sub-tort of public disclosure of private
facts as an actionable claim. 690 N.E.2d 681, 693 (Ind. 1997). The court
revisited the issue in Felsher v. Univ. of Evansville, explaining that its “discussion
of [the history of the invasion of privacy tort] and the Second Restatement
served as a prelude to [its] decision not to recognize a branch of the tort
involving the public disclosure of private facts.” 755 N.E.2d 589, 593 (Ind.
2001). See also F.B.C. v. MDWise, Inc., 122 N.E.3d 834, 836-37 (Ind. Ct. App.
2019) (explaining that the tort of public disclosure has not yet been recognized
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 32 of 33 in Indiana), trans. denied. Here, Appellees’ complaint alleges that Katrina gave
publicity to a matter that concerned their “private medical lives.” (App. Vol. II
at 63). Based on the above case law, Community cannot be held vicariously
liable for a tort that has yet to be recognized.
[57] In regard to the intrusion claim, the F.B.C. Court also explained that
“[i]ntrusion occurs when there has been an ‘intrusion upon the plaintiff’s
physical solitude or seclusion as by invading his home or conducting an illegal
search.’” Id. at 837 (quoting Cullison v. Medley, 570 N.E.2d 27, 31 (Ind. 1991)).
This Court further explained that we have “specifically chosen not to recognize
claims of [i]ntrusion where the intrusion only invades plaintiff’s emotional
solace.” Id. Because Appellees’ do not claim any physical intrusion by
Katrina, Community cannot be held vicariously liable for Appellees’ intrusion
claim. Therefore, to the extent that Appellees’ respondeat superior claim is
based on an underlying act of invasion of privacy/intrusion by Katrina, we
conclude that Community is entitled to judgment as a matter of law
3. Conclusion
[58] For all of these reasons, the judgment of the trial court is affirmed in part,
reversed in part, and remanded with instructions to grant summary judgment in
favor of Community on Appellees’ invasion of privacy/intrusion claim.
[59] Affirmed in part, reversed in part, and remanded with instructions.
Robb, J., and Mathias, J., concur.
Court of Appeals of Indiana | Opinion 19A-CT-873 | May 26, 2020 Page 33 of 33