STATE OF MAINE BUSINESS AND CONSUMER COURT CUMBERLAND, ss CIVIL ACTION DOCKET NO. BCD-CIV-2023-00028
SAYLOR DESJARDIN,
Plaintiff, ORDER DENYING DEFENDANTS LESLIE AND CONNOR WIRCHAKS’
v. MOTION TO DISMISS
LESLIE WIRCHAK, et al., Defendants.
The question presented by this motion to dismiss is whether a hospital patient whose electronic medical record was repeatedly accessed, viewed, and misappropriated for illegitimate reasons by prying unauthorized hospital employees during the nine months of her pregnancy and beyond can bring a claim against the employees without first going through the medical malpractice pre-litigation screening panel.
On May 9, 2023, Plaintiff Saylor DesJardin (“DesJardin”) filed a seven-count complaint against the defendants. Count I, Invasion of Privacy and Count VI, Unlawful Disclosure of Health Care Information under 22 M.R.S. § 1711-C(13)(B) were brought against Defendant Leslie Wirchak (“Leslie”) and John Does 1-5. Count II, Intentional Infliction of Emotional Distress was brought against Leslie and Defendant Connor Wirchak (“Connor”). The other remaining counts were brought against Defendants Eastern Maine Healthcare Systems, doing business as Northern Light Health, and Eastern Maine Medical Center, doing business as Northern Light Eastern Maine Medical Center (collectively “Hospital Defendants”).
2
On June 30, 2023, Leslie and Connor, hereinafter collectively referred to as the Wirchaks, brought a Motion to Dismiss all claims against them for lack of subject matter jurisdiction because DesJardin did not comply with the Maine Health Security Act (“MHSA”), 24 M.R.S. §§ 2501- 2988 (2023). DesJardin filed her Opposition to the Wirchaks’ Motion on July 28, 2023. 1 The Wirchaks filed a Reply in Support of their Motion on August 11, 2023. The Court held oral argument on August 30, 2023.
For the reasons enumerated below, the Court DENIES the Wirchak’s Motion to Dismiss.
STANDARD OF REVIEW
Under the MHSA, a plaintiff is barred from filing a complaint in a professional negligence action against a health care practitioner or entity unless she has previously served and filed a notice of claim and presented the claim to a mandatory prelitigation screening panel at a hearing. 24 M.R.S. §§ 2903(1), 2851, 2854, 2903(1)(B); Hill v. Kwan, 2009 ME 4, ¶ 8, 962 A.2d 963, 966; Choroszy v. Tso, 647 A.2d 803, 805 n. 1 (Me. 1994). When a complaint is filed in violation of the MHSA, the proper step for the court is to dismiss the action for lack of subject matter jurisdiction. Hill, 2009 ME 4, ¶ 8, 962 A.2d at 966 (citing M.R. Civ. P. 12(b)(1) “lack of jurisdiction over the subject matter”). Since this motion to dismiss challenges the court’s subject matter jurisdiction, it is a motion to dismiss pursuant to M.R. Civ. P. 12(b)(1). Taylor v. State, Dept. of Educ., No. CUMSC-CV-14-120, 2016 WL 1069905, at *2 (Me. Super. Ct. Jan. 28, 2016)
“When a court’s jurisdiction is challenged, the plaintiff bears the initial burden of establishing that jurisdiction is proper.” Com. Bank & Tr. Co. v. Dworman, 2004 ME 142, ¶ 8, 861 A.2d 662. The court makes no favorable inferences in favor of the plaintiff. Persson v. Dep’t of Human Servs., 2001 ME 124, ¶ 8, 775 A.2d 363. Therefore, the question before the Court on this
1 The Hospital Defendants brought a Motion to Dismiss pursuant to M.R. Civ. P. 12(b)(6) on June 23, 2023, which was also argued August 30, 2023. The motions are addressed in separate orders.
3
Motion is whether the Wirchaks’ alleged conduct constitutes professional negligence under the MHSA. The Court concludes it does not, and the Court has jurisdiction to consider DesJardin’s claims against the Wirchaks.
FACTUAL ALLEGATIONS
The Complaint makes the following material allegations:
I. DesJardin’s relationship with Connor Wirchak.
DesJardin, a resident of Franklin in Hancock County, was in a contentious relationship with Connor from approximately January 2020 through October 2021. Compl. ¶¶ 1, 18. Leslie is Connor’s mother. Compl. ¶ 20. At all times relevant to this matter, Leslie was a non-clinical, administrative employee and agent of Hospital Defendants. Compl. ¶¶ 2, 74. Later, but in a time frame relevant to this matter, Connor also became an employee and agent of Hospital Defendants. Compl. ¶ 90.
In the Fall of 2021, Connor began residing with his mother, Leslie. Compl. ¶ 36. In early October 2021, DesJardin advised Connor that she was officially ending their relationship, which upset him. Compl. ¶ 37. Around this same time, DesJardin suspected that she was pregnant. Compl. ¶ 38. On October 10, 2021, a test confirming DesJardin’s pregnancy was performed at a medical facility unaffiliated with Hospital Defendants. Compl. ¶ 38.
On October 11, 2021, DesJardin informed Connor and Leslie that she was pregnant with Connor’s child. Compl. ¶¶ 39-40. Connor accused DesJardin of lying about the pregnancy. Compl. ¶ 41. DesJardin informed Connor that she planned to receive care at one of the Hospital Defendants’ facilities, and she provided him with the date of her next appointment. Compl. ¶ 42. Connor declined to attend DesJardin’s appointments. Compl. ¶ 43.
II. DesJardin commences pre-natal care; unauthorized access of DesJardin’s health care information.
4
On October 19, 2021, DesJardin began receiving pre-natal care at facilities operated by Hospital Defendants. Compl. ¶ 44. She continued to receive care at those facilities throughout the duration of her pregnancy, the child’s birth, and for her post-partum healthcare. Compl. ¶ 44. In the course of DesJardin’s care and treatment at Hospital Defendants’ facilities, Hospital Defendants gathered, retained, and maintained DesJardin’s “health care information” within the meaning of applicable Maine and federal law. 2 Compl. ¶ 45. At no time did DesJardin give either Connor or Leslie her authorization or permission to access or view any of her health care information maintained by Hospital Defendants, let alone any records related to her pregnancy. Compl. ¶ 46. Nor did she identify Connor to Hospital Defendants as her legal spouse or cohabitant. Compl. ¶ 47. She did not give Hospital Defendants her consent to disclose her health care information to Connor or Leslie. Compl. ¶ 48. At all relevant times, DesJardin expected that the health care information she provided to Hospital Defendants would be kept confidential and that her information would only be accessed and utilized as necessary for the provision of healthcare to her. Compl. ¶ 49.
DesJardin’s expectations proved to be misplaced. Connor advised Leslie and a John Doe 3 that DesJardin had a pre-natal appointment scheduled for October 19, 2021, at one of Hospital Defendants’ facilities, and he directed Leslie or the John Doe to access the record for that appointment. Compl. ¶ 53. On or about October 12, 2021, one day after DesJardin notified Connor and Leslie about her pregnancy and one week before she began receiving pre-natal care, Leslie or
2 See 22 M.R.S. §1711-C(1)(E), Maine’s statute governing “[c]onfidentiality of health care information,” and 42 U.S.C. § 1320d(4), defining “[h]ealth information” within the meaning of the federal Health Insurance Portability and Accountability Act, or “HIPAA.” 3 In addition to Connor and Leslie, the Complaint names John Does 1-5 as individual defendants (the “John Doe Defendants”). The John Doe Defendants are individuals who, at all relevant times, were associated with Leslie or Connor, employed by Hospital Defendants, had access to patient health care information maintained by Hospital Defendants, and who accessed, viewed, or distributed Desjardin’s health care information without Desjardin’s knowledge or consent and without a work-related reason for doing so. Compl. ¶ 6. Hospital Defendants know but have declined to supply the names of the John Doe Defendants.
5
the John Doe began surveilling DesJardin’s reproductive health. Compl. ¶ 50. Specifically, Leslie or the John Doe accessed DesJardin’s health care information and protected health information (“PHI”) 4 contained within the electronic medical record (“EMR”) maintained by Hospital Defendants. Compl. ¶ 50. Subsequently, on numerous occasions during Fall 2021, Leslie, or the John Doe Defendants acting at her direction, accessed DesJardin’s EMR within Hospital Defendants’ custody without any work-related reason for doing so and without DesJardin’s knowledge or consent. Compl. ¶¶ 54, 57.
a. John Doe 1 accessed DesJardin’s protected health information.
On October 20, 2021, Defendant John Doe 1, a person associated with Leslie or Connor and employed by a Hospital Defendant, accessed the scheduling application utilized by Hospital Defendant Northern Light Health to search DesJardin’s name and access her scheduled appointments. Compl. ¶ 58. John Doe 1 again searched DesJardin’s name in Hospital Defendants’ scheduling application on October 21 and November 15, 2021, and accessed her scheduled appointments. Compl. ¶ 58.
Apart from accessing DesJardin’s appointments through Hospital Defendants’ scheduling application, on November 2, 2021, John Doe 1 accessed DesJardin’s EMR and viewed documents or notes from a visit DesJardin made to Northern Light Women’s Health. Compl. ¶ 59. John Doe 1 again entered DesJardin’s EMR on November 3, 2021, the day following one of DesJardin’s pre- natal appointments, and viewed four documents or notes. Compl. ¶¶ 60-61.
John Doe 1 accessed DesJardin’s EMR at the direction of Leslie or Connor, and he disclosed its contents to them. Compl. ¶¶ 62-63. John Doe 1 accessed DesJardin’s EMR in the
4 “Protected health information” is defined by the rules implementing HIPAA. See HIPAA Privacy Rule, 45 C.F.R. § 160.103 (2023). Under HIPAA, covered entities and their business associates must observe heightened security standards to preserve the confidentiality of their patients’ PHI. See 45 C.F.R. §§ 164.306-164.316.
6
course of his employment by Hospital Defendants and by using credentials provided to him to access Hospital Defendants’ electronic medical recordkeeping system. Compl. ¶ 64.
b. John Doe 2 accessed DesJardin’s protected health information.
Like John Doe 1, John Doe 2, a person associated with Leslie or Connor and employed by Hospital Defendants, accessed the scheduling application within DesJardin’s EMR on three separate occasions: October 20, October 25, and November 2, 2021. Compl. ¶ 65. John Doe 2 viewed DesJardin’s appointments scheduled with Hospital Defendants. Compl. ¶ 65. John Doe 2 viewed DesJardin’s EMR at the direction of Leslie or Connor, and he disclosed its contents to them. Compl. ¶¶ 66-67. John Doe 2 accessed DesJardin’s PHI while working in the course of his employment for the Hospital Defendants and by using credentials provided to him to access Hospital Defendants’ electronic medical recordkeeping system. Compl. ¶ 68.
There were other instances during Fall 2021 when DesJardin’s health care information and PHI was accessed and viewed, but it is not clear by whom. For example, on November 12, 2021, either Leslie or a John Doe acting at her direction accessed a record from one of DesJardin’s visits to the emergency department at a Hospital Defendant’s facility, which included DesJardin’s clinical diagnoses. Compl. ¶ 55. On another occasion, either Leslie or a John Doe acting at her direction accessed DesJardin’s demographic information and “problems list.” Compl. ¶ 56. III. DesJardin discovers that her medical record was accessed without her consent.
Hospital Defendants did not notify DesJardin about any of the occasions during Fall 2021 when Leslie or the John Doe Defendants accessed DesJardin’s EMR. Compl. ¶ 71. On November 16, 2021, DesJardin received an anonymous message notifying her that Connor had accessed her medical record. Compl. ¶ 72. As of November 2021, DesJardin received healthcare only from facilities operated by a Hospital Defendant. Compl. ¶ 73. At that time, DesJardin was aware that
7
Leslie was employed by a Hospital Defendant. Compl. ¶ 74.
After she received the anonymous message, DesJardin contacted Connor about it. Compl.
¶ 75. Connor explained that his mother, Leslie, was accessing DesJardin’s medical record. Compl. ¶ 75. DesJardin confirmed that neither Leslie nor Connor had DesJardin’s consent or authorization to access her medical record. Compl. ¶ 76. On or about November 16, 2021, DesJardin contacted Hospital Defendants to address the situation. Compl. ¶ 78.
DesJardin informed Hospital Defendants that she received information about Leslie’s access of her medical record as an unauthorized third party. Compl. ¶ 79. DesJardin added that Leslie was the mother of her ex-boyfriend, Connor. Compl. ¶ 80. However, DesJardin was not yet aware of the breaches carried out by John Doe 1 and John Doe 2. Compl. ¶ 82. Hospital Defendants responded that they would investigate DesJardin’s allegations. Compl. ¶ 81. IV. Hospital Defendants’ initial investigation of and response to DesJardin’s allegations.
Hospital Defendants commenced their investigation into DesJardin’s allegations during November or December 2021. Compl. ¶ 88. Hospital Defendants discussed DesJardin’s allegations with Leslie, who erroneously identified herself to Hospital Defendants as DesJardin’s “mother-in- law.” Compl. ¶ 89. Meanwhile, during December 2021 while Hospital Defendants’ investigation was ongoing, DesJardin learned that Connor was hired by a Hospital Defendant. Compl. ¶ 90. Connor’s employment by a Hospital Defendant exacerbated DesJardin’s concerns about unauthorized access of her medical record. Compl. ¶ 91.
On or about January 10, 2022, DesJardin received a letter from Hospital Defendants regarding their investigation into her allegations. Compl. ¶ 92; Compl. Ex. A. 5 The letter came during DesJardin’s second trimester, when she was established with one of the Hospital
5 The letter attached to the Complaint as Exhibit A is actually dated January 10, 2021, but as pointed out during oral argument, the date on the letter displays the wrong year. The correct date is January 10, 2022.
8
Defendant’s facilities where she planned to give birth to her child. Compl. ¶ 101. That letter provided, in relevant part:
As we discussed when we spoke, we take patient privacy very seriously and we are following up with you on the incident we discussed regarding an employee accessing your electronic medical record.
On November 16, 2021, you alerted us to a suspected questionable access into your medical record by your former mother-in-law, who is also an employee at [Eastern Maine Medical Center]. Upon investigation, it was determined that an employee accessed your record on October 12[th], October 19[th], November 1st, and November 12[th], without a work-related reason for doing so. The employee appears to have accessed an [Emergency Department] Visit encounter that occurred on November 12, 2021, which included clinical diagnoses. The employee also appears to have accessed your demographics, and your problems list.
We regret this unfortunate incident. We are committed to protecting your privacy and go to considerable lengths to do so. When such an incident does occur, we wish to assure you that we take all reasonable steps to investigate the incident, reduce the risk of harm to you, and protect against any further inappropriate disclosures.
In this instance, we are continuing to monitor for questionable and inappropriate access in the electronic medical record, are providing privacy education to all employees, and provided re-education to staff in this specific department on what is appropriate and inappropriate access in the electronic medical record.
Compl. Ex. A. The letter failed to identify the breaches committed by the John Doe Defendants. Compl. ¶ 98. Neither Hospital Defendant took any action against Leslie or any of the John Doe Defendants as a result of the investigation. Compl. ¶ 99.
V. Occurrence of additional breaches of DesJardin’s electronic medical record during Spring 2022.
Whatever steps Hospital Defendants took, if any, to protect DesJardin’s private healthcare information were ineffective. On or about March 14, 2022, John Doe 1 again accessed Hospital Defendants’ scheduling application to search for DesJardin’s appointments. Compl. ¶ 105. John Doe 2 did the same on April 4, 2022, leading up to the birth of DesJardin’s child. Compl. ¶ 107.
DesJardin was eventually admitted on an inpatient basis to a Hospital Defendant’s facility sometime near the end of April 2022, and she gave birth there weeks later during May. Compl. ¶
9
108. Neither Connor nor Leslie were present for the birth. Compl. ¶ 109. DesJardin did not identify Connor as her child’s father on the birth certificate. Compl. ¶ 110.
John Doe 1 and John Doe 2, at the direction of Connor or Leslie, accessed DesJardin’s EMR on multiple occasions between March 14 and June 20, 2022, and shared DesJardin’s health care information and PHI with Connor and Leslie. Compl. ¶¶ 113-114. Notably, on May 25, 2022, John Doe 1 accessed DesJardin’s EMR and viewed notes related to her inpatient stay in anticipation of the childbirth. Compl. ¶ 111. On June 20, 2022, John Doe 1 again accessed DesJardin’s EMR and viewed notes from an encounter DesJardin had with a women’s health practitioner two weeks after giving birth. Compl. ¶ 112. VI. DesJardin again discovers that her medical record was accessed without her consent.
On or about July 7, 2022, DesJardin received a second anonymous message informing her that Connor was accessing her medical record. Compl. ¶ 119. DesJardin confronted Hospital Defendants about the reported breaches. Compl. ¶ 121. Hospital Defendants investigated DesJardin’s new allegations, and on August 17, 2022, supplied DesJardin with a letter:
On July 7, 2022, you contacted [Eastern Maine Medical Center’s] Patient Experience Department with questions relating to the employment status of the employee who had previously accessed your medical record without a work-related reason for doing so, along with other employment related questions. We spoke on July 22, 2022, and we discussed that we could not share specific employment information but that we could run an audit to assure that the employees you were concerned about, Leslie and Connor Wirchak, were not accessing your record or your son’s record. On July 28, 2022, we relayed that our audit did not find any inappropriate access by these employees but that we wanted to continue to investigate your concerns.
On August 12, 2022, we discussed that upon further investigation it was determined that two employees accessed your record without a work-related reason for doing so. These employees were associated with Leslie Wirchak. The first employee accessed the scheduling application in the electronic medical record on October 20, 2021, October 25, 2021, November 2, 2021, and April 4, 2022, and appears to have searched for appointments under your name. The employee may have viewed any scheduled appointments within Northern Light Health that you had at the time.
10
The second employee also accessed the scheduling application on October 15, 2021, October 20, 2021, November 15, 2021, and March 14, 2022, and appears to have searched for appointments under your name. This employee may have also been able to view any scheduled appointments within Northern Light Health that you had at the time. In addition, on November 2, 2021, the employee accessed your record and viewed an encounter you had at Northern Light Women’s Health in Ellsworth. The employee viewed two documents or notes. On November 3, 2021, the employee entered your record and viewed four documents and/or notes but it is unclear which encounter the documents that were accessed were tied to. On May 25, 2022, the employee accessed your record and viewed records relating to an inpatient hospital admission from April 26, 2022 to May 19, 2022 at Northern Light Maine Coast Hospital, and on June 20, 2022, the employee accessed an encounter you had at Northern Light Women’s Health on May 31, 2022. There has not been any further access into your son’s record by any of these employees.
We sincerely regret this unfortunate incident. We are committed to protecting your privacy and we want to assure you that we take this very seriously. As we discussed when we last spoke on August 12, 2022, we referred this matter to [Eastern Maine Medical Center’s] Human Resources Department for review and action in accordance with our policies for all employees involved. In addition, we are running weekly audit reports of your and your son’s medical record to continue to monitor all access. We are also developing a re-education plan for all of our practices on what is appropriate and inappropriate access in the electronic medical record. We have also made [your doctor] aware of the situation as we discussed.
Lastly, as one of the employees viewed your demographic information, out of an abundance of caution you may want to place a fraud alert on your credit report.
Compl. Ex. B. Hospital Defendants would not disclose the identities of John Doe 1 or John Doe 2. Compl. ¶ 128. Based on the Hospital Defendants’ own concessions, neither the Wirchaks nor the John Does had any work-related reasons for accessing DesJardin’s EMR and personal health information at any time.
ANALYSIS
The Wirchaks argue that DesJardin’s allegations arise from professional negligence for failure to provide healthcare services and thus her claims should have been brought pursuant to the MHSA. The Court disagrees.
The MHSA defines an “[a]ction for professional negligence” as
11
any action for damages for injury or death against any health care provider, its agents or employees, or health care practitioner, his agents or employees, whether based upon tort or breach of contract or otherwise, arising out of the provision or failure to provide health care services.
24 M.R.S. § 2502(6). The Law Court has described the MHSA as “broadly worded and all- encompassing,” Salerno v. Spectrum Med. Group, P.A., 2019 ME 139, ¶ 18, 215 A.3d 804, 811 (quoting Saunders v. Tisher, 2006 ME 94, ¶ 9, 902 A.2d 830), and as “fully occupy[ing] the field of claims brought against health care providers,” id. (quoting Brand v. Seider, 1997 ME 176, ¶ 4, 697 A.2d 846). However, the statutory definition of “an action for professional negligence” contains several clear and distinct elements. Id. (citing D.S. v. Spurwink Servs., Inc., 2013 ME 31, ¶¶ 21, 24, 65 A.3d 1196 (declining to expand the MHSA’s definition of “health care provider” against which an action for professional negligence may be brought pursuant to the MHSA)). “One of those elements is that the claim must arise out of the provision or failure to provide health care services.” Id. (quoting 24 M.R.S. § 2502(6)) (internal quotation marks omitted).
The MHSA was enacted to regulate the medical malpractice insurance industry in response to the rising insurance costs against health care providers - not to create procedural hurdles for every claim against or involving the medical field. See Allen v. Stanley Med. Research Inst., No. CV-05-03, 2005 WL 3845660, at *2-3 (Me. Super. Ct. Dec. 13, 2005) (discussing MHSA inapplicability to an out of state medical research lab); see also Salerno, 2019 ME 139, ¶ 18, 215 A.3d 804, 811. As a result, despite the breadth of the MHSA, health care services under the MHSA are defined as “acts of diagnosis, treatment, medical evaluation or advice or such other acts as may be permissible under the health care licensing, certification or registration laws of this State.” 24 M.R.S. § 2951(1); Allen, 2005 WL 3845660, at *1. The Law Court has determined that the legislative intent of the MHSA was not to extend to the definition of health care services “beyond [the] services prescribed by or performed under the general direction of a person licensed to
12
practice medicine, dentistry, podiatry, or surgery” so involvement or contact with a medical facility or healthcare provider does not automatically imply the applicability of the MHSA. See D.S. v. Spurwink Servs., Inc., 2013 ME 31, ¶ 21, 65 A.3d 1196 (finding a private school did not become a health care provider under the MHSA just because it retained a psychiatrist to make recommendations on a student’s ISP); see also Salerno, 2019 ME 139, ¶ 19, 215 A.3d 804 (concluding that a patient sustaining injuries in a medical facility locker following her medical rehabilitation treatment because a rubber mat was left in the wrong place in the locker room was not a circumstance related to the provision of health care); Price, M.D. v. Delprete, D.O., No. cv- 1458, 2014 WL 7920836, at *2 (Me. Super. Ct. Aug. 27, 2014) (hospital’s failure to maintain confidential records would not be subject to the MHSA unless there was an allegation that the underlying health care services deviated from the applicable standard of care).
In this case, the analysis is straightforward. The Wirchaks did not have a work-related reason for accessing DesJardin’s EMR and personal health information. They were not providing health care services, nor were they performing related activities such as billing, scheduling, quality control, training or a myriad of other legitimate activities that support hospital operations. The mere fact that their unauthorized access occurred at a hospital where they were employed is of no consequence. While DesJardin did have a patient relationship with one or more health care practitioners at Hospital Defendants’ facilities, those relationships did not extend to Leslie or Connor using the EMR to pry into DesJardin’s private life. The conduct of a hospital employee accessing a patient’s confidential information for illegitimate purposes like snooping or spying is no more providing a health care service subject to the MHSA than if a health care practitioner ran over her own patient in the hospital parking lot. See Price, 2014 WL 7920836, at *1. Since DesJardin’s claims against the Wirchaks do not arise out of the provision or failure to provide health care services, DesJardin was not first required to submit her claims to a prelitigation screening panel pursuant to the MHSA.
CONCLUSION
For the reasons stated above, the Court finds that the procedural requirements of the MHSA are inapplicable to DesJardin's claims against the Wirchaks. The Court has jurisdiction and so DENIES the Wirchak's Motion to Dismiss.
Pursuant to M.R. CiV. P. 79(a), the Clerk is instructed to incorporate this Order by reference on the docket for this case.
So Ordered.
08/31/2023
Dated:
Michael A. Duddy
Judge, Business and Consumer Docket
I3