Dawn Marie Leach v. Iowa Board of Nursing

• Court: Court of Appeals of Iowa
• Decided: August 7, 2019
• Docket: 18-1705
• Status: Published

Opinion

IN THE COURT OF APPEALS OF IOWA

No. 18-1705 Filed August 7, 2019

DAWN MARIE LEACH, Plaintiff-Appellant,

vs.

IOWA BOARD OF NURSING, Defendant-Appellee. ________________________________________________________________

Appeal from the Iowa District Court for Polk County, Michael D. Huppert,

Judge.

A nurse appeals from the district court’s dismissal of her petition for

judicial review challenging the Iowa Board of Nursing’s conclusion she violated

the confidentiality or privacy rights of a patient and imposition of a citation and

warning. AFFIRMED.

David L. Brown and Tyler R. Smith of Hansen, McClintock & Riley, Des

Moines, for appellant.

Thomas J. Miller, Attorney General, and Tessa Register, Assistant

Attorney General, for appellee.

Considered by Potterfield, P.J., and Doyle and Tabor, JJ. 2

POTTERFIELD, Presiding Judge.

Nurse Dawn Leach appeals from the district court’s dismissal of her

petition for judicial review challenging the Iowa Board of Nursing’s conclusion she

violated the confidentiality or privacy rights of a patient and imposition of a

citation and warning. Leach maintains the district court erred in dismissing her

petition for judicial review because the Board’s conclusion is “[b]ased upon an

irrational, illogical, or wholly unjustifiable application of law to fact that has clearly

been vested by a provision of law in the discretion of the agency,” Iowa Code

§ 17A.19(10)(m), and is “not supported by substantial evidence in the record

before the court when that record is viewed as a whole,” Id. § 17A.19(10)(f).1

I. Background Facts and Proceedings.

Leach was employed by Unity Point Health Finley Hospital (Finley) to work

as a nurse in the intensive care unit (ICU). On eleven dates during December

2015, Leach remotely accessed patient census lists while she was not working.

The census lists contained private health information, such as patient names,

ages, diagnosis, unit, diet order, medications, and primary insurer.

Finley learned of the access in January 2016 and questioned Leach about

it. Leach admitted she accessed the lists, stating she did so in order to check

ICU capacity to determine whether it was likely she would be required to work

1 As she did at the district court, Leach also includes a laundry list of other grounds she alleges requires reversal under Iowa Code section 17A.19(10). The district court concluded the other grounds were waived for lack of authority or argument supporting them. Insofar as the district court did not consider and rule upon the other grounds pursuant to section 17A.19(10), these claims have not been preserved for our review. See Garwick v. Iowa Dep’t of Transp., 611 N.W.2d 286, 288 (Iowa 2000) (finding an issue not preserved for review when the plaintiff failed to raise the issue with enough specificity to the district court on judicial review and noting, “[Plaintiff’s] allegation in his petition for judicial review is far too unspecific to preserve a . . . challenge”). 3

her assigned shifts.2 Leach was advised that checking the list was in violation

the hospital’s information security policies that prevented remote access into the

hospital’s system without authorization—which Leach did not have—and when

not necessary to complete her job responsibilities. Finley issued Leach an

employee disciplinary notice on January 20; she was suspended for two twelve-

hour shifts and required to repeat the HIPAA NetLearning module.

Leach’s supervisor filed a complaint with the Board, and, after an

investigation, the Board found probable cause to file a notice of hearing and

statement of charges against Leach. It was alleged Leach violated the

confidentiality or privacy rights of the patient or client, in violation of Iowa Code

section 147.55(3) (2015) and Iowa Administrative Code rule 655-4.6(4)(h).

A contested hearing took place in January 2018. The Board made the

following finding of facts:

[Leach] accessed the patient lists for the sole purpose of determining the ICU’s census so she could determine whether she would [be] working her assigned shift the following day or placed on call. [She] did not use the information from the patient lists for any other purpose, and she did not share the information with anyone. [Leach] denies that she looked at any information other than the number of patients. .... . . . [Leach] was not authorized to access Finley patient lists from remote locations, and she did not need the patient list information in order to perform her duties as an ICU nurse at Finley.

2 According to the finding of facts made by the Board: The nurses’ work schedule was established in six week blocks and was published to the nurses at least two weeks prior. Nurses could also sign up to work an “as needed” shift. Four nurses were assigned to each shift, but the ICU also had a rotating “low census” list. If the patient census in the ICU was low, then the first person on the “low census” list would be put [on] call and would not have to work that shift. Nurses could call the charge nurse on the unit to find out if they would be needed for their assigned shift. 4

The Board found a preponderance of the evidence supported that Leach

committed unethical conduct by violating the confidentiality or privacy rights of

patients in accessing protected health information on the census lists without the

need to do so. The Board imposed a citation and a warning as discipline.

Leach filed an application for rehearing with the Board, claiming the

Board’s finding of a violation was “[u]nsupported by the evidence presented at

the hearing” and “[i]nconsistent with the Board’s factual findings.” The Board

denied the application, reiterating that accessing the protected health information

without a legitimate or proper reason was sufficient to find Leach violated the

confidentiality or privacy rights of the patient. Additionally, the Board stated it

fully considered the circumstances of the violation (i.e. that [Leach] did not understand that her actions violated patient confidentiality, that she did not disclose the information to anyone else, and that the hospital determined her actions were not a reportable HIPAA “breach”) when it chose to impose the least severe sanction—a citation and a warning.

Leach filed a petition for judicial review, urging the district court to reverse

the Board’s ruling. She maintained that because the Board never made a finding

she read or shared any of the protected health information contained on the

census lists, the Board’s finding of a violation was irrational, illogical, or wholly

unjustifiable. She also claimed there was not substantial evidence to find she

viewed any protected health information.

The district court determined there was no real argument regarding

substantial evidence “in light of the agreement of the parties as to the operative

facts.” The court also found that the Board’s determination Leach had violated

the rule was not irrational, illogical, or wholly unjustifiable, as “[t]he mere access 5

of the information is what constituted grounds for discipline; the viewing or

examination of that information was not required.”

Leach appeals.

II. Standard of Review.

“A court’s review of agency action is severely circumscribed. The

administrative process presupposes that judgment calls are to be left to the

agency.” Burns v. Bd. of Nursing, 495 N.W.2d 698, 699 (Iowa 1993). “Thus the

court may reverse, modify, or grant other appropriate relief only if agency action

is affected by error of law, is unsupported by substantial evidence in the record,

or is characterized by abuse of discretion.” Id.

III. Discussion.

Iowa Code section 147.55(3) allows the Board to discipline a licensed

nurse “when the licensee is guilty of . . . engaging in unethical conduct or practice

harmful or detrimental to the public. Proof of actual injury need not be

established.” Iowa Code § 147.55(3). Iowa Administrative Code rule 655-

4.6(4)(h) further defines behavior that “constitutes unethical conduct or practice

harmful or detrimental to the public” and includes, “Violating the confidentiality or

privacy rights of the patient or client.”

On judicial review, Leach emphasizes that the Board never made a finding

she read any of the protected health information she accessed on the census

lists and maintains there is not substantial evidence to make such a finding. See

Iowa Code § 17A.19(10)(f). Additionally, she claims that concluding she violated

the confidentiality or privacy rights of a patient without a finding she read the

protected health information she accessed is irrational, illogical, or wholly 6

unjustifiable. See id. § 17A.19(10)(m). Leach’s claim boils down to an argument

that accessing—without reading or sharing—of a patient’s protected health

information is not sufficient conduct to find a violation of a patient’s confidentiality

or privacy rights. She relies on this court’s ruling in Hoffman v. Iowa Bd. of

Nursing, No. 05-1403, 2006 WL 2421643 (Iowa Ct. App. Aug. 23, 2006), to

support her argument.

In Hoffman, the Board cited a nurse for violating patient confidentiality

when she and her young children helped the doctor she worked for copy patient

records in order for the doctor to take them to his new practice. 2006 WL

2421643, at *1. “Hoffman’s children, ages eleven and thirteen, assisted in the

copying process by pressing the ‘start’ button on the copy machine and by

monitoring the copying process to make sure only one page went through the

machine at a time.” Id. The Board found Hoffman violated section 147.55(3) and

rule 655-4.6(4)(h) “by allowing ‘her children to participate in copying confidential

patient records’” and noted the “presence and participation of the children still

violated patient confidentiality by giving them access to confidential information,

including but not limited to the names of the patients.” Id. Our court reversed,

stating:

The only persons to whom improper access to confidential records was even arguably given were the children. There is no finding by the agency that the children read any of the information contained within the medical records, or even the names on the files. They simply pressed the “start” button on the copy machine and were supervised throughout the process. The copying was done at the direction of Dr. Sterrett and the children were paid for their participation. Finding a violation of patient confidentiality under these facts is unreasonable, arbitrary, capricious, and an abuse of discretion 7

Id. at *2.

The two sets of facts are distinguishable. In Hoffman, our court

questioned whether the children’s presence in the same room as and limited role

in helping copy the paper files—pressing the start button and watching to ensure

only one page went through the machine at a time—constituted “access” to

patient records. Id. Here, Leach admits that she repeatedly accessed the

census list, which contained numerous forms of protected health information.

Leach denies reading the parts of the list containing the protected information,

but she does not deny that she accessed the information and that the information

was not necessary for her to complete her job duties. Accessing the unneeded

confidential information is a violation of hospital policies put in place to protect

patient confidentiality, which Leach knew or should have known about.

The Board is vested with rulemaking and interpretative authority. See

Iowa Code § 147.76 (“The boards for the various professions shall adopt all

necessary and proper rules to administer and interpret this chapter . . .”); see

also Iowa Med. Soc’y v. Iowa Bd. of Nursing, 831 N.W.2d 826, 838 (Iowa 2013)

(“The legislature has clearly vested the nursing board with rulemaking and

interpretative authority . . . .”). Therefore, “[w]e are required to view the nursing

board’s [application of law to fact] through the prism of our deferential standard of

review.” Iowa Med., 831 N.W.2d at 840. In doing so, we cannot say the Board’s

determination is irrational, illogical, or wholly unjustifiable when it found

purposefully accessing confidential patient information that is not needed to

perform one’s job duties—without further action—constitutes a violation of patient

confidentiality rights. 8

We affirm the district court’s dismissal of Leach’s petition for judicial

review.

AFFIRMED.