RENDERED: MARCH 18, 2022; 10:00 A.M. NOT TO BE PUBLISHED
Commonwealth of Kentucky Court of Appeals
NO. 2021-CA-0466-MR
JANE DOE APPELLANT
APPEAL FROM BOYD CIRCUIT COURT v. HONORABLE GEORGE W. DAVIS III, JUDGE ACTION NO. 20-CI-00971
ASHLAND HOSPITAL CORPORATION AND SHELLY JEAN DAVIS BAIER APPELLEES
OPINION AFFIRMING
** ** ** ** **
BEFORE: LAMBERT, MAZE, AND L. THOMPSON, JUDGES.
MAZE, JUDGE: Jane Doe (Doe) appeals from an order of the Boyd Circuit Court
dismissing her claims against Ashland Hospital Corporation, d/b/a King’s
Daughters Medical Center (KDMC) and Shelly Jean Davis Baier (Baier). On
appeal, Doe makes four arguments: 1) the trial court’s order dismissing should be
reversed because there were sufficient facts presented as to the allegations of her
-1- amended complaint separate from HIPAA1 to survive dismissal; 2) the trial court
should be reversed because there are other independent claims upon which relief
could have been granted other than a direct HIPAA violation; 3) the trial court
should be reversed as to Doe’s claim for invasion of privacy on the grounds that
sufficient facts were presented in support of each element of that claim; and 4) the
trial court should be reversed as to the dismissal of Doe’s remaining claims
because relief may be granted as to those claims. The Court having found no
reversible error in the Boyd Circuit Court’s order dismissing, we affirm.
As a minor, Doe was sexually assaulted by an adult male babysitter.
He was convicted of that offense. At trial, his defense counsel put on evidence in
the form of Doe’s medical records to demonstrate that there was no physical
evidence of rape. Those records were not obtained by subpoena or search warrant.
Baier is the mother of Doe’s assailant. She is also an employee of
KDMC. Doe was treated at that facility between April 13, 2018 and April 30,
2018. It has been alleged that Doe’s medical records from that period were
procured by Baier and transmitted to her son’s defense counsel. An action was
filed in the trial court in which Doe asserted causes of action for invasion of
privacy, negligent hiring, training, retention and supervision, negligence,
negligence per se, breach of fiduciary duty, gross negligence, breach of expressed
1 Health Insurance Portability and Accountability Act of 1996.
-2- or implied contract, identity theft, and intentional infliction of emotional distress.
Both Baier and KDMC filed motions to dismiss and Doe responded.
On April 6, 2021, the trial court entered an order sustaining those
motions dismissing Doe’s claims in their entirety. The trial court concluded that
“Plaintiff’s claims are merely an attempt to strap Common Law claims onto the
back of prohibited behavior under the Federal HIPPA [sic] statute.” The trial court
found that, as a matter of law, HIPAA does not create a private cause of action.
The trial court concluded that Doe’s claims were preempted by the application of
HIPAA since the Kentucky common law claims pled did not provide for a more
stringent standard than that set forth in HIPAA.
A motion to dismiss for failure to state a claim upon which relief may
be granted is only appropriate where “it appears the pleading party would not be
entitled to relief under any set of facts which could be proved[.]” Pari-Mutuel
Clerk’s Union of Kentucky Local 541, SEIU, AFL-CIO v. Kentucky Jockey Club,
551 S.W.2d 801, 803 (Ky. 1977). As such, this Court’s review is de novo. Fox v.
Grayson, 317 S.W.3d 1, 7 (Ky. 2010).
The trial court set forth two bases for its order dismissing. First, the
trial court concluded that “HIPAA does not create a civil cause of action under
state or federal law.” As noted in Caldwell v. Chauvin, 464 S.W.3d 139, 148 (Ky.
2015), the Secretary of the United States Department of Health and Human
-3- Services (HHS) was charged with promulgating privacy regulations to promote the
purpose of HIPAA. 45 C.F.R.2 §§ 160-164 outlines the responsibility of a
“covered entity” for an individual’s “protected health information.” In 45 C.F.R. §
160.306 an administrative remedy is set forth for any breach of that responsibility,
providing for civil penalties against the “covered entity.” However, both state and
federal courts have consistently held that there is no private cause of action for
such conduct.
In Young v. Carran, 289 S.W.3d 586, 588-89 (Ky. App. 2008), the
Court specifically held that there is no private cause of action for a violation of
HIPAA under KRS3 446.070, the statute codifying “negligence per se.” Yeager v.
Dickerson, 391 S.W.3d 388, 393 (Ky. App. 2013).
The second reason set forth in support of the trial court’s order is that
“HIPAA preempts state law unless the state enacts more stringent measures.” 45
C.F.R. § 160.203 states that “[a] standard, requirement, or implementation
specification adopted under this subchapter that is contrary to a provision of State
law, preempts the provision of State law.” The rule then sets forth several
exceptions including subsection (2)(b), which specifies that a provision is not
preempted where it “relates to the privacy of individually identifiable health
2 Code of Federal Regulations. 3 Kentucky Revised Statutes.
-4- information and is more stringent than a standard, requirement, or implementation
specification adopted under subpart E of part 164 of this subchapter.”
Doe has asserted three Kentucky statutes in support of her argument
that the claims set forth in her amended complaint were not preempted by HIPAA
and its associated regulations. However, the statutes in question, to the extent they
may apply, are not “more stringent” than those imposed in support of HIPAA and
its purposes. KRS 210.235 applies to mental health records maintained by the
Cabinet for Health and Family Services. Although it contains a general prohibition
on disclosure of such records, it also contains certain exceptions, including one for
court proceedings. KRS 422.317 requires a licensed hospital to provide a patient
with a free copy of his or her medical records upon request. KRS 422.315 grants
that patient and any other person or entity acting on his or her behalf standing to
apply for a protective order in a court proceeding where medical records have been
“copied and delivered pursuant to KRS 422.300 to 422.330[.]” In Young, similar
arguments were made on appeal regarding KRS 210.235
Free access — add to your briefcase to read the full text and ask questions with AI
RENDERED: MARCH 18, 2022; 10:00 A.M. NOT TO BE PUBLISHED
Commonwealth of Kentucky Court of Appeals
NO. 2021-CA-0466-MR
JANE DOE APPELLANT
APPEAL FROM BOYD CIRCUIT COURT v. HONORABLE GEORGE W. DAVIS III, JUDGE ACTION NO. 20-CI-00971
ASHLAND HOSPITAL CORPORATION AND SHELLY JEAN DAVIS BAIER APPELLEES
OPINION AFFIRMING
** ** ** ** **
BEFORE: LAMBERT, MAZE, AND L. THOMPSON, JUDGES.
MAZE, JUDGE: Jane Doe (Doe) appeals from an order of the Boyd Circuit Court
dismissing her claims against Ashland Hospital Corporation, d/b/a King’s
Daughters Medical Center (KDMC) and Shelly Jean Davis Baier (Baier). On
appeal, Doe makes four arguments: 1) the trial court’s order dismissing should be
reversed because there were sufficient facts presented as to the allegations of her
-1- amended complaint separate from HIPAA1 to survive dismissal; 2) the trial court
should be reversed because there are other independent claims upon which relief
could have been granted other than a direct HIPAA violation; 3) the trial court
should be reversed as to Doe’s claim for invasion of privacy on the grounds that
sufficient facts were presented in support of each element of that claim; and 4) the
trial court should be reversed as to the dismissal of Doe’s remaining claims
because relief may be granted as to those claims. The Court having found no
reversible error in the Boyd Circuit Court’s order dismissing, we affirm.
As a minor, Doe was sexually assaulted by an adult male babysitter.
He was convicted of that offense. At trial, his defense counsel put on evidence in
the form of Doe’s medical records to demonstrate that there was no physical
evidence of rape. Those records were not obtained by subpoena or search warrant.
Baier is the mother of Doe’s assailant. She is also an employee of
KDMC. Doe was treated at that facility between April 13, 2018 and April 30,
2018. It has been alleged that Doe’s medical records from that period were
procured by Baier and transmitted to her son’s defense counsel. An action was
filed in the trial court in which Doe asserted causes of action for invasion of
privacy, negligent hiring, training, retention and supervision, negligence,
negligence per se, breach of fiduciary duty, gross negligence, breach of expressed
1 Health Insurance Portability and Accountability Act of 1996.
-2- or implied contract, identity theft, and intentional infliction of emotional distress.
Both Baier and KDMC filed motions to dismiss and Doe responded.
On April 6, 2021, the trial court entered an order sustaining those
motions dismissing Doe’s claims in their entirety. The trial court concluded that
“Plaintiff’s claims are merely an attempt to strap Common Law claims onto the
back of prohibited behavior under the Federal HIPPA [sic] statute.” The trial court
found that, as a matter of law, HIPAA does not create a private cause of action.
The trial court concluded that Doe’s claims were preempted by the application of
HIPAA since the Kentucky common law claims pled did not provide for a more
stringent standard than that set forth in HIPAA.
A motion to dismiss for failure to state a claim upon which relief may
be granted is only appropriate where “it appears the pleading party would not be
entitled to relief under any set of facts which could be proved[.]” Pari-Mutuel
Clerk’s Union of Kentucky Local 541, SEIU, AFL-CIO v. Kentucky Jockey Club,
551 S.W.2d 801, 803 (Ky. 1977). As such, this Court’s review is de novo. Fox v.
Grayson, 317 S.W.3d 1, 7 (Ky. 2010).
The trial court set forth two bases for its order dismissing. First, the
trial court concluded that “HIPAA does not create a civil cause of action under
state or federal law.” As noted in Caldwell v. Chauvin, 464 S.W.3d 139, 148 (Ky.
2015), the Secretary of the United States Department of Health and Human
-3- Services (HHS) was charged with promulgating privacy regulations to promote the
purpose of HIPAA. 45 C.F.R.2 §§ 160-164 outlines the responsibility of a
“covered entity” for an individual’s “protected health information.” In 45 C.F.R. §
160.306 an administrative remedy is set forth for any breach of that responsibility,
providing for civil penalties against the “covered entity.” However, both state and
federal courts have consistently held that there is no private cause of action for
such conduct.
In Young v. Carran, 289 S.W.3d 586, 588-89 (Ky. App. 2008), the
Court specifically held that there is no private cause of action for a violation of
HIPAA under KRS3 446.070, the statute codifying “negligence per se.” Yeager v.
Dickerson, 391 S.W.3d 388, 393 (Ky. App. 2013).
The second reason set forth in support of the trial court’s order is that
“HIPAA preempts state law unless the state enacts more stringent measures.” 45
C.F.R. § 160.203 states that “[a] standard, requirement, or implementation
specification adopted under this subchapter that is contrary to a provision of State
law, preempts the provision of State law.” The rule then sets forth several
exceptions including subsection (2)(b), which specifies that a provision is not
preempted where it “relates to the privacy of individually identifiable health
2 Code of Federal Regulations. 3 Kentucky Revised Statutes.
-4- information and is more stringent than a standard, requirement, or implementation
specification adopted under subpart E of part 164 of this subchapter.”
Doe has asserted three Kentucky statutes in support of her argument
that the claims set forth in her amended complaint were not preempted by HIPAA
and its associated regulations. However, the statutes in question, to the extent they
may apply, are not “more stringent” than those imposed in support of HIPAA and
its purposes. KRS 210.235 applies to mental health records maintained by the
Cabinet for Health and Family Services. Although it contains a general prohibition
on disclosure of such records, it also contains certain exceptions, including one for
court proceedings. KRS 422.317 requires a licensed hospital to provide a patient
with a free copy of his or her medical records upon request. KRS 422.315 grants
that patient and any other person or entity acting on his or her behalf standing to
apply for a protective order in a court proceeding where medical records have been
“copied and delivered pursuant to KRS 422.300 to 422.330[.]” In Young, similar
arguments were made on appeal regarding KRS 210.235 and KRS 422.317, but
were not raised in the trial court and were therefore not considered on appeal. 289
S.W.3d 589. However, as provided in 902 KAR4 20:016(e), HIPAA supplies the
standard to be applied to disclosure of protected health information by a covered
4 Kentucky Administrative Regulations.
-5- entity. As such, these Kentucky statutes may not be used as an independent basis
to support Doe’s claims.
This Court holds that the trial court’s findings and conclusions are
dispositive as to all of Appellant’s claims. However, since she has made additional
arguments specifically addressing her claims for invasion of privacy and negligent
hiring, we will address those briefly.
Even if her claim for invasion of privacy was not preempted, it was
simply not pled as being anything other than a HIPAA violation. It appears that
Appellant has pled that there was an unreasonable intrusion upon her seclusion and
that the private information so obtained was publicly disclosed. McCall v.
Courier-Journal and Louisville Times Co., 623 S.W.2d 882, 887 (Ky. 1981).
However, she repeatedly alleged in her amended complaint that Baier procured and
produced the information outside of her employment. As held in Osborne v.
Payne, 31 S.W.3d 911, 915 (Ky. 2000), there can be no claim for respondeat
superior liability where an employee engages in wrongful conduct while he or she
is not acting to advance the cause of his or her employer. Thus, Appellant’s claim
for invasion of privacy against KDMC cannot survive independently of the HIPAA
violation.
Appellant contends that her claim that Baier was negligently hired,
trained, supervised, and retained may survive separately from the HIPAA violation
-6- because KDMC did not have policies and procedures in place to protect a patient
from this kind of disclosure. In support of that argument, she cites Doe v. St.
Joseph Health System, No. 2017-CA-000794-MR, 2018 WL 6600230 (Ky. App.
Dec. 14, 2018), in which the Court held that a separate claim for the employer’s
own negligence in hiring may survive without respondeat superior liability.
However, that case did not specifically address the issue of preemption.
In Section II of her amended complaint, Doe sets out her cause of
action against KDMC for negligent hiring, training, retention, and supervision.
She asserts that because of her “special relationship” to Baier and KDMC, the
latter had a duty to not employ, retain, and/or train Baier because of her
“dangerous propensities and violations of policy and obvious actions.” She also
alleges that KDMC “knew or reasonably should have known” upon investigation
of Baier prior to her employment. She states that KDMC also knew or should have
known of her own vulnerability as a minor as well as a rape victim. She further
asserts that she was “informed and believes” that KDMC had no “system or
procedure” in place to “investigate supervise, monitor, or train to prevent the
unauthorized” use of her medical records for “exploitation.” Doe also concludes
that KDMC had been placed on notice by third parties that “Baier, had engaged in
dangerous and inappropriate conduct both before and during her employment,” and
therefore could be expected to do so again.
-7- As argued by KDMC in its brief, “HIPAA preemption encompasses
more than unauthorized disclosure of protected health information.” It also
addresses such issues as the security of electronic information systems, required
training for the employees of covered entities and the utilization of policies and
procedures to provide HIPAA compliant system. 45 C.F.R. §§ 164.103-318.
Moreover, that system is subject to oversight by the Secretary of Health and
Human Services. 45 C.F.R. § 160.306. Thus, once again, the HIPAA standards are
the more “stringent” and state law claims such as those presented herein are
preempted.
Although the disclosure herein was undoubtedly reprehensible it is not
actionable as a matter of law. While the Court finds the result of its ruling herein
to be unfortunate, it is constrained to follow the law.
Accordingly, we affirm the order of the Boyd Circuit Court.
ALL CONCUR.
-8- BRIEF FOR APPELLANT: BRIEF FOR APPELLEE ASHLAND HOSPITAL Brandon M. Music CORPORATION: Grayson, Kentucky W. Mitchell Hall, Jr. Olivia H. Gilkison Ashland, Kentucky
BRIEF FOR APPELLEE SHELLY JEAN DAVIS BAIER:
David F. Latherow Ashland, Kentucky
-9-