BROWN, Judge.
[1] Courtney R. Robbins appeals the trial court’s grant' of summary judgment in favor of the Trustees of Indiana University and Ciarían Health Partners, Inc. She [4]*4raises the following two issues, which we revise and restate as:,
I. Whether the trial court -erred in granting summary judgment in favor of the Trustees and Ciarían on the issue of vicarious liability; and
II. Whether the trial court erred in granting summary judgment in favor of the Trustees on the issue of negligent hiring.
We affirm.
Facts and Procedural History
[2] In September 2010, Tiffaney De-Bow, a licensed practical nurse, applied for a job at the Indiana University School of Medicine. Her application revealed that she had been a nurse for twelve years and had worked at three hospitals and a nursing home. Her application also revealed that she had been convicted of misdemean- or battery in May 2009. When questioned about the conviction, DeBow explained that during a confrontation with a woman who had made comments about DeBow’s daughter oh the Internet, DeBow poked the woman on the forehead.
[3] As part of the application process, DeBow also read and signed the Indiana University Department of Medicine Commitment to Confidentiality Agreement, which provides in relevant part as follows:
The IU Department of Medicine regards the security and confidentiality of its data and information to be of utmost importance. Each information user holds a position of trust in which he or 'she must preserve the confidentiality, privacy and security of Indiana University (IU), Indiana University Foundation (IUF), practice plan, patient medical record and protected health information (PHI) that is accessed, maintained, or transmitted in any form or medium.
Appellant’s Appendix at 49.
The Confidentiality Agreement also provided in part:
As an information user:
a. I will only access, use (read, add, change, or delete), or disclose information for which I have a business reáson and am authorized to do so. At no time will I access, use, or disclose confidential or sensitive information to any person or third party for a personal, unauthorized, unethical, or illegal reason. I will not share my password(s) nor will I use a sign-on/password that is not assigned to me.
b. I understand that my obligation to safeguard confidentiality at all times, both on1 duty and off-duty, remains' in full force during the entire term of my employment/affiliation and continues in effect after such employment/affiliation terminates....
Id.
After DeBow completed her employment application, an independent company conducted a pre-employment background check on her for the Trustees. The search revealed the misdemeanor battery conviction, which resulted in a one-year sentence with all but four days suspended, community service, six months on probation and twelve anger management classes. The search also revealed dismissed charges for class A misdemeanor criminal mischief in 2006 and class A misdemeanor driving while suspended in 2008 as well as a probation violation.
Following the background check, DeBow was offered a position providing health care services to the patients of the School of Medicine’s Gastroenterology Department. After DeBow accepted the position, Nada Phoenix, acting on behalf of the School of Medicine, submitted an Access Request to Ciarían Data Security to provide DeBow a username and password so she could access two-electronic medical [5]*5records systems owned by Ciarían, Phoenix also submitted DeBow’s signed Responsibility Statement wherein DeBow agreed to keep information in the .medical records confidential and not to disclose it for personal, unauthorized, unethical, or illegal reasons. Both the Access Request and Responsibility Statement identified DeBow as a non-Clarian employee.
[7] • On October 11, 2010, her first day of work, DeBow began accessing the medical records of Robbins and her children. Specifically, a medical records access report shows that on October 11 and 13, DeBow accessed the medical records of Robbins and her children forty-two times between 2:05 p.m. and 4:28 p.m. Robbins was not a patient of the gastroenterology department, and the medical records De-Bow accessed were not created in connection with treatment and care of Robbins at the School of Medicine. DeBow found the information in one of the medical records systems owned by Ciarían. On October 13, DeBow posted medical information about Robbins obtained from these records on Robbins’s former boyfriend’s internet blog. When confronted by her employer, DeBow admitted what she had done and that she knew it was wrong. She admitted “that there was no legitimate business reason for her to access the records and explained that her sole motivation was that ... [she] desired revenge.” Id.. at 54.
[8] Pursuant to a plea agreement executed in. February 2012, DeBow pled guilty in federal court to the felony charge of wrongful disclosure of individually identifiable health information for obtaining Robbins’s health information during the course of her employment with the intent to transfer and use that information for personal gain and malicious harm and to embarrass Robbins, and DeBow was sentenced to probation for a term of three years and was fined $1,000.
[9] In November 2012, Robbins filed an amended complaint against the Trustees and Ciarían wherein she alleged that the defendants, were vicariously liable for the actions of DeBow, who allegedly committed the torts of invasion of privacy by the public disclosure of private facts and intentional infliction of emotional distress. Robbins alternatively argued that if the Trustees were not vicariously liable to her for these acts, they were liable to her for negligently hiring DeBow.
[10] The Trustees and Ciarían filed summary judgment motions. The Trustees designated DeBow’s affidavit in support of their motion. In the affidavit, De-Bow explained that she accessed Robbins’s medical records for “personal reasons.” Id. at 57. According to DeBow, she and Robbins “had been involved in an acrimonious personal feud for many years and that was [her] motivation to disclose protected medical information.” Id. DeBow further explained that she “was acting on [her] own initiative and not within the scope of [her] employment when [she] accessed and published [ ] Robbins’ records,” that she “was not involved in any way in the provision of medical care to [ ] Robbins or her children,” and that she “knew it was against [her] employer’s policies and rules and [her] acts were not part of [her] job.” Id. Following a hearing, the trial' court granted summary judgment in favor of the Trustees and Ciarían.
Discussion
[11] Summary judgment is appropriate only when there are no genuine issues of material fact and the moving party is entitled to judgment-as a matter of law. Ind. Trial Rule 56(C).. In reviewing a trial court’s ruling on -summary judgment, this court stands in the shoes of the trial court and applies the same standard in determining whether to affirm or reverse the grant of summary judgment. Doe v. La[6]*6fayette Sch. Corp., 846 N.E.2d 691, 696 (Ind.Ct.App.2006), reh’g denied. We must therefore determine whether there is a genuine issue of material fact and whether the trial court has correctly applied the law. Id.
[12] Relying on specifically designated evidence, the moving party bears the burden of making a prima facie showing that there are no genuine issues of material fact and that it is entitled to judgment as a matter of law. Id. If the moving party meets this burden, the burden then shifts to the nonmovant to set forth specifically designated facts showing that there is a genuine issue for trial. Id.
[13] A genuine issue of material fact exists where facts concerning an issue that, would dispose of the issue are in dispute or where the undisputed material facts are capable of supporting conflicting inferences on such an issue. Id. In our review, we consider all of the designated evidence in the light most favorable to th¿ nonmoving party. Id.
I.
A. Ciarían
[14] The first issue is whether the trial court erred in granting summary judgment in favor of the Trustees and Ciarían on the issue of vicarious liability. According to Robbins, the Trustees and Ciarían are vicariously liable to Robbins for the actions of DeBow, who allegedly committed the torts of invasion of privacy with the public disclosure of private facts and intentional infliction of emotional distress: Vicarious liability will be imposed upon an employer under the doctrine of respondeat superior where the employee has inflicted harm while acting within the scope of employment. Barnett v. Clark, 889 N.E.2d 281, 283 (Ind.2008).
[15] At the outset, we note that the parties agree that Ciarían was not DeBow’s employer. Robbins, however, argues that Ciarían can be held liable under the respondeat superior doctrine because Ciarían and the Trustees were in a joint venture and DeBow was Clarian’s agent.
[16] A joint venture is an association of two or more persons formed to carry out a single business enterprise for profit. Walker v. Martin, 887 N.E.2d 125, 138 (Ind.Ct.App.2008), reh’g denied, trans. denied. In a joint venture, the parties must be bound by an express or implied contract providing for (1) a community of interests, and (2) joint mutual control, which is an equal right to direct and govern the undertaking that binds the parties to the agreement. Id. A joint venture is similar to a partnership except that a joint venture contemplates a single transaction. Id. A joint venture agreement must also provide for the sharing of profits. Id.
[17] Our review of the designated materials reveals a Definitive Health Care Resources Consolidation Agreement, which sets forth the relationship between Ciarían and the Trustees. Specifically, the Agreement provides in relevant part as follows:
11.01 General Relationships; Retention of Profits and Losses
[Ciarían] is a separate operational, financial and corporate organization from the Trustees ... [A]ll revenue of the Hospitals ... shall be the sole property of [Ciarían] and likewise [Ciarían] shall be solely responsible for all costs and expenses related to the ownership, management, and operations of the Hospitals and its other property, assets, and business. Any losses from the operation of the Hospitals shall remain [Clarian’s] sole responsibility ... and shall not be subject to allocation to or payable by ... the Trustees.... Any revenue- exceed[7]*7ing expenses shall remain the property of [Ciarían] and shall not be subject to distribution to ... the Trustees — ”
Appellant’s Appendix at 536. Because this Agreement does not give Ciarían and the Trustees an equal right to direct and govern any undertaking and does not provide for the sharing of profits, Ciarían and the Trustees were not in a joint venture for the purpose of a finding of vicarious liability.
[18] And DeBow was not Cla-rian’s agent. For the liability of an agent to be imputed to a principal, an agency relationship must exist. Smith v. Delta Tau Delta, Inc., 9 N.E.3d 154, 164 (Ind.2014). An essential element of that relationship is that the agent must act on the principal’s behalf. Id. The agent must also consent to act on the principal’s behalf and be subject to the principal’s control. Id. Whether an agency relationship exists is generally a question of fact, but if the evidence is undisputed, summary judgment may be appropriate, Id.
[19] Our review of the designated evidence reveals that DeBow, who took care of patients in the medical school’s gas-troenterology department, did not act on Clarian’s behalf and was not subject to Clarian’s control. Rather, at the medical school’s request, Ciarían simply issued a username and password to DeBow so that she could access the electronic medical records that Ciarían owned. Ciarían is not subject to vicarious liability for DeBow’s actions.
B. Trustees
[20] We next turn to whether the Trustees as DeBow’s employer may be held vicariously liable for the actions of DeBow. In her amended complaint, Robbins alleged that the Trustees were vicariously liable for the actions of DeBow and that DeBow committed the tort of invasion of privacy by the public disclosure of private facts as well as the tort of intentional infliction of emotional distress. If the Trustees may not be held vicariously liable for the actions of DeBow, then the Trustees are entitled to summary judgment with respect to Robbins’s claim based on the alleged public disclosure of private facts by DeBow, and her claim based on the alleged intentional infliction of emotional distress by DeBow.1
[8]*8[21] Under the doctrine of re-spondeat superior, an employer, who is not liable because of its own acts, can be held liable “for the wrongful acts of his employee which, are committed within the scope of employment.” Doe, 846 N.E.2d at 701. An employee is acting .within the scope of her employment when she is acting, at least in part, to further the interests of her employer. Id. Where an employee acts partially in self-interest but is still partially serving her employer’s interests, liability will attach. Id. at 701-702. However, simply because ah act could not have occurred without access to the • employer’s facilities does not bring it within the scope of employment. Id. at 702.
[22] In addition, although Indiana courts have established that an employer can be vicariously liable for the criminal acts of an employee, this determination depends 'upon whether the employee’s actions were authorized by the employer. Id. If it is determined that none of the employee’s acts were authorized, there is no respondeat superior liability. Id. “Furthermore, acts for which the employer is not responsible are those done ‘on the employee’s own initiative, [ ] with no intention to perform it as part of or incident to the service for which he is employed.” Id. (quoting Stropes v. Heritage House Childrens Ctr., 547 N.E.2d 244, 247 (Ind.1989), reh’g denied). “However, an employee’s wrongful act may still fall within the scope of his employment if his purpose was, to an appreciable extent, to further his employer’s business, even if the act was predominantly motivated by an intention to benefit the employee himself.” Stropes, 547 N.E.2d at 247. If some of the employee’s actions were authorized, the question of whether the unauthorized acts Were within the scope of employment is one for the jury. Doe, 846 N,E.2d at 702; The Indiana Supreme Court, in addressing an employer’s vicarious liability for an employee’s wrongful actions, addressed whether the employee was explicitly or impliedly authorized to take the action and whether the acts were an extension of [9]*9authorized acts, were incidental to or associated with the employee’s' authorized duties, furthered the employer’s business, or were motivated to any extent by the employer’s interests. See Barnett, 889 N.E.2d at 286.
[28] In support of her argument that the trial court erred in granting summary judgment in favor of the Trustees^ Robbins directs us to this court’s opinion in Walgreen Co. v. Hinchy, 21 N.E.3d 99 (Ind.Ct.App.2014), on reh’g, 25 N.E.3d 748 (Ind.Ct.App.2015), trans. denied. In Walgreen, a pharmacist, while at work, looked up the prescription profile of á customer in the Walgreen computer system. 21 N.E.3d at 104. A person who was in a relationship with the pharmacist sent text messages to the Walgreen customer stating that he had a printout related to the customer’s prescription " information. Id. at 104-105. The customer later contacted Walgreen to report her suspicion that the pharmacist had looked at her personal records and disclosed the information she learned to an unauthorized individual. Id.' at 105. In addressing vicarious liability under the doctrine of respondeat superior, this court found that the pharmacist’s actions were of the same general nature as those authorized, or incidental to the actions that were authorized, by Walgreen. Id. at 108. The court noted that the pharmacist was authorized to use the computer system, handle prescriptions for customers, look up customer information, review patient prescription histories, and make prescription-related printouts. Id. The court further observed that the customer belonged to the general category of individuals to whom the pharmacist owed a duty of privacy protection by virtue of her employment as a pharmacist. Id. The court held that the fact that some of the pharmacist’s actions were authorized, or incidental to authorized actions, or of the same general nature as authorized actions, precluded, summary judgment. Id.
[24] The court in Walgreen also discussed this court’s previous opinion in Doe, 846 N.E.2d 691. In Doe, a teacher gathered email addresses from his students in' order to communicate with them about homework and other matters. Id. at 695. The teacher later advertised in an email to his students that he and his wife were looking for a babysitter, Doe responded, and soon thereafter began babysitting for the teacher. Id. The relationship betwefen the teacher and Doe became romantic, and the email exchanges between them became sexually charged. Id. In emailing Doe, the teacher used a personal email account but regularly sent the emails using a school-provided laptop computer, and some of the emails were sent during school hours. Id. The teacher was later' convicted of child seduction and engaging in deviate sexual conduct. Id. Doe filed a complaint for damages against the school, and the trial court entered summary judgment in favor of the school, noting the teacher was not acting within the scope of his employment but rather acting on his own initiative. Id. at 695-697. Doe appealed and argued in part that the school was vicariously liable for the acts of the teacher by way of the doctrine of respondeat superior. Id. at 701.
[25] In support of her argument that the school was vicariously liable, Doe argued that the teacher used a school-providr ed laptop to send her emails and that emailing students was an act authorized by the school. M-This court observed that, if some of an employee’s actions were authorized, the question of whether the unauthorized acts were within the scope of employment is one for the jury. Id. at 702. We noted that, simply because the teacher used the school’s equipment and facilities to initiate a relationship with Doe, [10]*10his acts did not necessarily fall within his scope of employment. Id. We held that, while the school authorized the teacher “to send emails to students for school purposes,” there was no indication that the school “authorized him to send emails to students for personal reasons.” Id. On this basis, we concluded that .the teacher, “on his own initiative and unrelated to any school function,” instigated an intimate relationship with Doe. Id. We also concluded that his actions “were not incident to any service provided by [the school], but rather were fueled entirely by self-interest in a romantic relationship with Doe.” Id. We affirmed the entry of summary judgment in favor of the school. Id.
[26] We find the reasoning in Doe persuasive in light of the particular facts and circumstances of this case. DeBow accessed Robbins’s medical records while at work. However, like in Doe, the fact that DeBow used the access provided to her to obtain Robbins’s medical information does not necessarily mean that her acts were within her scope of employment. Id.
[27] Importantly, in signing the Indiana University Department of Medicine Commitment of Confidentiality Agreement, DeBow agreed that she would “only access, use (read, add, change, or' delete),' or disclose information for which [she had] a business reason and [was ] authorized to do so” and that “[a]t no time [would she] access, use, or disclose confidential or sensitive information to any person or third party for a personal, unauthorized, unethical, or illegal reason.” Appellant’s Appendix at 49 (emphases added). The designated evidence thus establishes that, while DeBow’s employer authorized her to access patient information for business reasons, she was expressly not authorized to access, use, or disclose the information for. personal, unauthorized, unethical, or illegal reasons. Indeed, De-Bow stated in her affidavit, which was designated by the Trustees, that she accessed Robbins’s medical records “for personal reasons and not as part of [her] employment by Indiana University.” Id. at 57. DeBow also stated that she “was acting on [her] own initiative and not within thé scope of [her] employment when [she] accessed and published [] Robbins’ records,” that she “was not involved in any way in the provision of medical care” to Robbins, and that she “knew it was against [her] employer’s policies and rules and [her] acts were not part of [her] job.” Id.
[28] The affidavit of an administrative supervisor in the gastroenterology department, also designated by, the Trustees, stated that, when DeBow was asked about improperly accessing Robbins’s health records, DeBow “admitted that there was no legitimate business reason for her to access the records and explained that her sole motivation was that ... [she] desired revenge.” Id. at 54. Robbins does not point to .designated evidence opposing these statements. Robbins does not claim that DeBow accessed her records for business reasons. The Trustees’ designated evidence establishes that Robbins was not a patient of the School of Medicine’s Gas-troenterology Department, unlike in Walgreen where the person whose information was accessed was a Walgreen customer. In her amended complaint, which was designated by the Trustees, Robbins claimed that DeBow “had no reason to access [her] and her children’s health care records” and that DeBow “was, not involved in any way with providing. any heath [sic] care or treatment of Robbins or her children.” Id. at 36.
[29] DeBow of- her own initiative and unrelated to any business function of her employment or her employer, accessed and disclosed the private medical 'records of Robbins. This disclosure was unautho[11]*11rized and illegal. DeBow pled guilty in federal court to the wrongful disclosure of individually identifiable health information for obtaining Robbins’s health information for personal gain. DeBow’s wrongful act was not to any extent to further her employer’s business. DeBow was not explicitly or impliedly authorized to access or disclose, medical records for personal reasons, her actions were not an extension of authorized access for the purpose of treating Robbins, and the acts were not motivated to any extent by her employer’s interests. DeBow’s actions were not incident to any service provided by her employer but were motivated entirely by self-interest related to a personal relationship with Robbins and to humiliating Robbins. The actions of DeBow were riot sufficiently associated with her employment duties so as to fall within the scope of her employment. -'
[30] Walgreen does not require a different'outcome. Some of the pharmacist’s actions in 'Walgreen were authorized, such as handling prescriptions for Walgreen customers, reviewing prescription histories, ' and making prescription-related printouts. The Walgreen opinion did not discuss whether the pharmacist signed an agreement explicitly limiting her access to customer records and forbidding the use of records for personal reasons. As revealed by the confidentiality agreement arid other designated evidence discussed above, none of DeBow’s conduct, including accessing and disclosing Robbins’s medical records for personal reasons, was authorized by her employer.
[31] We conclude that the Trustees designated evidence making a prima facie showing that DeBow’s wrongful acts were not committed within the scope of employment, that Robbins did not set forth designated facts showing there is a genuine issue for trial, and thus that the Trustees established that they as DeBow’s employer may not be held vicariously liable for De-Bow’s actions under the doctrine of re-spondeat superior. Accordingly, we affirm the entry of summary judgment in favor of the Trustees as to Robbins’s claim of invasion of privacy by public disclosure of private facts and her claim of intentional infliction of emotional distress.
II.
[32] The next issue is whether the trial court erred in granting summary judgment in favor of the Trustees on the issue of negligent hiring.2 Specifically, Robbins argues that the Trustees knew or should have known that DeBow had a propensity to commit criminal acts and they “[were] asking for trouble.” Appellant’s Brief at 28.
[33] Indiana recognizes the tort of negligent hiring and retention of an employee. Konkle v. Henson, 672 N.E.2d 450, 460 (Ind.Ct.App.1996), We have adopted the Restatement (Second) of Torts' § 317 (1965), which provides:
A master is under a duty .to exercise reasonable care so to control his servant while acting outside the scope of his employment as to prevent him from intentionally harming others or from so conducting himself as to create an unreasonable risk of bodily harm to them, if
■(a) the servant
(i) is upon ‘the premises in possession of the blaster or upon which the servant is privileged to enter only as his servant, or '
(ii) is using a chattel of the master, and
[12]*12(b) the master
(i) knows or has reason to know that he has the ability to control his servant, and
(ii) knows or should know of the necessity and opportunity for exercising such control;'
[34] In addition, there are general rules and concepts surrounding the imposition of a duty that must also be satisfied. Clark v. Aris, Inc., 890 N.E.2d 760, 763 (Ind.Ct.App.2008), tmns. denied. In determining whether to impose a duty of care, three factors must be considered: (1) the relationship between the parties, (2) the reasonable foreseeability of harm to the person injured, and (3) public policy concerns.' Id. (citing Webb v. Jarvis, 575 N.E.2d 992, 995 (Ind.1991)). Imposition óf a duty is limited to those instances where a reasonably foreseeable victim is injured by a reasonably foreseeable harm. Id. at 764 (citing Webb, 575 N.E.2d at 995). Whether-a duty exists is ordinarily a question of law, but sometimes the existence of a duty depends, upon underlying facts 'that require resolution by the trier of fact. Id.
[35] Sandage v. Board of Commissioners of Vanderburgh County, 897 N.E.2d 507 (Ind.Ct.App.2008), is instructive on the issue of negligent hiring and an employee’s criminal history. There, an employer hired Travis Moore, a jail inmate on work release who had been convicted of robbery and recently tested positive for THC, to clean parking lots. Instead of returning to jail after work one evening, Moore went to a private home. and killed three people. The .victims’ estates filed a complaint for damages against Sandage’s employer alleging that the employer had negligently hired and retained Sandage. The trial court granted the employer’s . summary judgment motion. On appeal, this court pointed out that Moore’s employment did not put him in contact with the victims and the murders did not constitute a recurrence of criminal behavior for which Moore had earlier been convicted. Id. at 513. We therefore affirmed the trial court’s grant of summary judgment in favor of the employer. See also Clark, 890 N.E.2d at 765 (concluding that where Baer’s employment did not put him in contact with the victims and nothing in his criminal history suggested that he was capable of murder, neither the victims nor the tragic harm that'befell them was reasonably foreseeable).-
[36] Here, as in Sandage and Clark, DeBow’s employment did not put her in contact with the victim, who was not a department of gastroenterology patient. DeBow was not authorized to access Robbins’s electronic medical records when she was not a patient of DeBow’s employer, and DeBow’s violation of medical confidentiality did not constitute a recurrence of criminal behavior for which DeBow had earlier been convicted. Specifically, there were no prior reports of DeBow accessing and publishing any other patient’s confidential medical records. Under these circumstances, Robbins was not a reasonably foreseeable victim and DeBow’s internet posting of information that humiliated Robbins was not a reasonably foreseeable harm.. The trial court did not err in granting summary judgment in favor of the Trustees on the negligent hiring issue.
Conclusion
[37] , For the foregoing reasons, the trial court did not err in granting summary judgment in favor of the Trustees and Ciarían.
[38] Affirmed.
PYLE, J., concurs.
CRONE, J., concurs in part and concurs in result' in part with separate opinion.