Keyse v. Cleveland Clinic Found.

2024 Ohio 2806

• Court: Ohio Court of Appeals
• Decided: July 25, 2024
• Docket: 113264
• Status: Published

Opinion

[Cite as Keyse v. Cleveland Clinic Found., 2024-Ohio-2806.]

COURT OF APPEALS OF OHIO

EIGHTH APPELLATE DISTRICT COUNTY OF CUYAHOGA

KATHLEEN KEYSE, :

Plaintiff-Appellant, : No. 113264 v. :

CLEVELAND CLINIC FOUNDATION, :

Defendant-Appellee. :

JOURNAL ENTRY AND OPINION

JUDGMENT: AFFIRMED RELEASED AND JOURNALIZED: July 25, 2024

Civil Appeal from the Cuyahoga County Court of Common Pleas Case No. CV-22-961897

Appearances:

Mishkind Kulwicki Law Co., L.P.A., and David A. Kulwicki; Flowers & Grube, Paul W. Flowers, and Louis E. Grube, for appellant.

Tucker Ellis LLP, Susan M. Audey, Elisabeth C. Arko, Edward E. Taber, and Kelli R. Novak, for appellee.

KATHLEEN ANN KEOUGH, A.J.:

Plaintiff-appellant, Kathleen Keyse (“Keyse”), appeals from the trial

court’s judgment granting the motion for summary judgment of defendant-appellee,

Cleveland Clinic Foundation (“Cleveland Clinic”). We affirm. I. Background

Keyse, in a refiled action, sued Cleveland Clinic in April 2022,

asserting claims for (1) breach of fiduciary duty; (2) violation of right to privacy; (3)

fraud; and (4) punitive damages. The gist of Keyse’s complaint was that one of

Cleveland Clinic’s employees, Diane Shepherd (“Shepherd”), who is Keyse’s sister,

electronically accessed Keyse’s medical information on several occasions between

June and October 2020 without a business reason to do so. In short, Keyes alleged

that Shepherd “snooped” into Keyse’s medical records for her own personal reasons.

In her deposition, Shepherd admitted that she improperly accessed Keyse’s

electronic medical record but said she never disclosed the information to anyone

else. Shepherd also said that Cleveland Clinic sanctioned her for her improper

conduct by issuing her a final written warning and putting her on probation for two

years.

After discovery, Cleveland Clinic moved for summary judgment on all

of Keyse’s claims. The trial court denied the motion as to all claims except Keyse’s

claim for punitive damages, which the trial court found Keyse had withdrawn.

The case progressed and the parties prepared for trial. On the eve of

trial, Keyse withdrew her claims for breach of fiduciary duty and fraud, leaving only

her medical-privacy claim, which Keyse’s counsel acknowledged in an email to

Cleveland Clinic counsel was a Biddle claim.1

1 As will be discussed in more detail below, in Biddle v. Warren Gen. Hosp., 86

Ohio St.3d 395 (1999), the Ohio Supreme Court recognized a separate tort for the unauthorized disclosure of confidential medical information. Such a claim is now known Cleveland Clinic then filed seven motions in limine to exclude at trial:

(1) evidence of Keyse’s alleged emotional damages; (2) any allegations of disclosure

of medical information to a third party; (3) reference to other reported

impermissible access events involving other patients; (4) Keyse’s vicarious liability

argument as to Shepherd; (5) evidence of Keyse’s withdrawn claims and prayer for

punitive damages; (6) to enforce Ohio’s statutory damages cap; and (7) preclude

argument on expert issues not supported by an expert witness. The trial court

granted all seven motions.

Cleveland Clinic then moved for summary judgment on Keyse’s

Biddle claim, her sole remaining claim for trial. Keyse opposed the motion. The

trial court subsequently granted the motion, finding that Keyes “failed to present

any evidence of a disclosure of [her] nonpublic medical information to a third party,

as required by Biddle. Therefore, the court finds that [Keyse’s] claim fails as a matter

of law and [Cleveland Clinic] is entitled to judgment in its favor.” This appeal

followed.

II. Law and Analysis

A. Summary Judgment

In her first assignment of error, Keyse contends that the trial court

erred in granting Cleveland Clinic’s motion for summary judgment.

as a Biddle claim. In his April 12, 2023 email to Cleveland Clinic’s counsel, Keyse’s counsel wrote, “This email will confirm that I will only be pursuing the Biddle claim at trial.” We review summary judgment rulings de novo, applying the same

standard as the trial court. Grafton v. Ohio Edison Co., 77 Ohio St.3d 102, 106

(1996). We accord no deference to the trial court’s decision and conduct an

independent review of the record to determine whether summary judgment is

appropriate. Brewer v. Cleveland Bd. of Edn., 122 Ohio App.3d 378, 383 (8th Dist.

1997).

Under Civ.R. 56(C), summary judgment is appropriate when no

genuine issue exists as to any material fact and, viewing the evidence most strongly

in favor of the nonmoving party, reasonable minds can only reach a conclusion that

is adverse to the nonmoving party. The party moving for summary judgment has

the initial burden of identifying specific facts in the record that demonstrate an

entitlement to summary judgment. Dresher v. Burt, 75 Ohio St.3d 280, 292-293

(1996). If the movant fails to meet this burden, summary judgment is not

appropriate. Id. If the moving party meets this burden, the burden shifts to the

nonmoving party to point to specific facts in the record that demonstrate the

existence of a genuine issue of material fact for trial. Id.

“In general, a person’s medical records are confidential. Numerous

state and federal laws recognize and protect an individual’s interest in ensuring that

his or her medical information remains so.” Hageman v. Southwest Gen. Health

Ctr., 2008-Ohio-3343, ¶ 9. The Ohio Supreme Court explicitly recognized and

applied this principle of confidentiality in Biddle, 86 Ohio St.3d 395, where it

“recognized that the breach of patient confidentiality is a palpable wrong” but that “such an injury is difficult to remedy appropriately.” Id. at ¶ 10. Finding the various

methods that courts had developed to address such claims (including theories like

invasion of privacy, defamation, breach of contract, and others) to be ill-suited for

addressing a breach-of-confidence situation, the Biddle Court recognized a separate

tort for breach of confidentiality related to medical information. Id. at ¶ 11.2

The Court defined the boundaries of the new tort by recognizing two

related causes of action: one against physicians and hospitals that disclose

confidential medical information to a third party without authorization or privilege

to do so, and one against third parties who induce physicians or hospitals to disclose

such information. Id., citing Biddle at paragraphs one and three of the syllabus.

Setting forth the elements of the claim, the Biddle Court stated, “in

Ohio, an independent tort exists for the unauthorized, unprivileged disclosure to a

third party of nonpublic medical information that a physician or hospital has

2 In establishing the tort, the Ohio Supreme Court made clear that other common

law claims are not available where a Biddle claim exists:

As to appellees’ continued insistence that they be entitled to pursue other theories of liability, we agree with the reasoning of the appellate court that these other theories are either unavailable, inapplicable because of their respective doctrinal limitations, or subsumed by the tort of breach of confidence [i.e., a Biddle claim]. Indeed, it is the very awkwardness of the traditional causes of action that justifies the recognition of the tort for breach of confidence in the first place.

Biddle at 408-409. See also Sheldon v. Kettering Health Network, 2015-Ohio-3268, ¶ 29 (2d Dist.) (“Although case law delineating the parameters of a Biddle claim is still developing, the consolidation of other common law theories of recovery into that tort is certain.”). learned within a physician-patient relationship.” Biddle at paragraph one of the

syllabus.

Keyse contends that Cleveland Clinic admitted that Shepherd

improperly accessed her electronic medical records on several occasions and that

Shepherd’s unauthorized access constitutes an unprivileged disclosure to a third

party under Biddle sufficient to justify a denial of summary judgment and, therefore,

a reversal of the trial court’s judgment. (Appellant’s brief, p. 14.) She also contends

that summary judgment should have been denied because reasonable jurors could

conclude that Cleveland Clinic was obligated under the federal Health Insurance

Portability and Accountability Act of 1996 (“HIPAA”), which prevents healthcare

providers from disclosing health information except in certain specific

circumstances, to undertake more efforts to protect her from Shepherd’s

unauthorized access to her confidential medical records. (Appellant’s brief, p. 15.)

Cleveland Clinic, on the other hand, argues that the trial court

properly granted summary judgment in its favor because (1) a Biddle claim requires

disclosure to an “outside” third party, which Cleveland Clinic asserts means an entity

or person outside the walls of the hospital, which did not happen in this case; (2) in

any event, Cleveland Clinic made no intentional or unintentional disclosure of any

kind; rather, Shepherd improperly accessed Keyse’s confidential medical

information for a nonbusiness use; and (3) the narrowly tailored medical-privacy

claim under Biddle exists independent of HIPAA and although HIPAA may provide

guidance to courts regarding the contours of a Biddle claim, it does not expand Biddle so that an alleged regulatory violation of HIPAA is actionable under a breach-

of-confidence claim under Biddle. (Appellee’s brief, p. 13, 15, 17.)

Keyse responds that Shepherd was the “third party” to which her

nonpublic medical information was disclosed because

“disclosure to a third party” as used in the Biddle syllabus most aptly and reasonably should be interpreted to apply to a hospital’s impermissible disclosure to any person, employee or not, who has no legitimate business or medical reason for having access to the patient’s confidential information.

(Appellant’s reply brief, p. 3.) She contends that the trial court should therefore have

denied summary judgment because there are disputed issues of fact over whether

Shepherd qualifies as a third party under Biddle.

We need not resolve the issue of whether Shepherd qualifies in these

circumstances as a third party under Biddle or whether disclosure must be outside

the walls of the entity holding the information because our review of the record

demonstrates that Cleveland Clinic made no disclosure whatsoever of Keyse’s

confidential medical information and, therefore, Keyse’s Biddle claim fails as a

matter of law.

The breach of confidence tort recognized in Biddle requires “the

unauthorized, unprivileged disclosure to a third party of nonpublic medical

information that a physician or hospital has learned within a physician-patient

relationship.” Biddle, 86 Ohio St.3d at 523. A Biddle claim therefore requires a

disclosure. According to Black’s Law Dictionary, “disclosure” is “[t]he act or process

of making known something that was previously unknown.” Black’s Law Dictionary (11th Ed. 2019). But Cleveland Clinic did not do any act, either

intentionally or unintentionally, that made Keyse’s medical information known to

anyone. Rather, as Shepherd admitted in her deposition, she improperly accessed

her sister’s confidential medical information entirely on her own without

authorization to do so.

Ohio courts and federal courts interpreting Biddle claims under Ohio

law have refused to allow plaintiffs to pursue Biddle claims where third parties

wrongfully intercepted or accessed the plaintiffs’ privileged medical information and

the defendants did not disseminate or disclose the information either intentionally

or unintentionally. For example, in Scott v. Ohio Dept. of Rehab. & Corr., 2013-

Ohio-4383 (10th Dist.), ten inmates at the Mansfield Correctional Institution filed

suit against the Ohio Department of Rehabilitation and Correction (“ODRC”)

asserting a Biddle claim after their names and HIV-positive medical status were

listed on pharmacy documents that were left in trash cans that were accessible to

other inmates who found the documents and then disseminated them to the general

inmate population, to the detriment of the plaintiffs. Id. at ¶ 8. Recognizing “the

known propensity of some inmates to ingeniously and maliciously exploit any

opportunity for leverage over staff or fellow inmates,” id. at ¶ 30, the appellate court

affirmed the trial court’s grant of summary judgment to ODRC on the inmates’

Biddle claim, finding that “supervised inmate access to trash containing unshredded

medical documents does not constitute ‘disclosure’ for purposes of the tort of

unauthorized disclosure of medical information as defined by Biddle.” Id. at ¶ 29. Likewise, in Foster v. Health Recovery Servs., 493 F.Supp.3d 622

(S.D.Ohio 2020), the defendant learned that its network had been breached when

an unauthorized IP address remotely accessed its computer network and obtained

the personal information of its clients, including the plaintiff. The plaintiff filed a

Biddle claim based on the unauthorized disclosure of his health information to third

parties. Id. at 629. The Foster Court found that the plaintiff’s allegations were

insufficient to state a Biddle claim because the “[d]efendant did not commit an

intentional or unintentional act of disclosure. Instead, what is alleged is that a third

party has exploited [d]efendant’s security weakness to access the information

without [d]efendant’s authorization.” Id. at 636.

In Tucker v. Marietta Area Health Care, Inc., S.D.Ohio Nos. 2:22-cv-

184, 2:22-cv-221, and 2:22-cv-385, 2023 U.S. Dist. LEXIS 13974 (Jan. 26, 2023),

the defendant, a regional medical services business, was the target of a cyberattack

during which the hacker gained access to defendant’s computer system and acquired

the protected health information of defendant’s current and former patients. Id. at

*2. The plaintiff sued, asserting various common law claims against the defendant.

The defendant filed a motion to dismiss all of the plaintiff’s claims, arguing that they

were preempted under Biddle. The district court disagreed, finding that “Biddle

applies only when a defendant has made a disclosure.” Id. at *8. The court reasoned

that because the case involved unauthorized access to the plaintiff’s medical

information by a third party, and not a disclosure by the defendant, Biddle did not

apply. Id. Similarly, in Sheldon v. Kettering Health Network, 2015-Ohio-3268

(2d Dist.), the court found that “the facts alleged [did] not constitute a ‘disclosure’

for purposes of a Biddle breach-of-confidentiality claim” against the defendant

health care organization where one of the defendant’s employees “intentionally and

improperly” accessed the defendant’s software system to obtain his ex-wife’s

electronic medical information and then shared that information with his lover, who

was also a co-worker. Id. at ¶ 13, 33. The court found that the employee’s actions

were clearly “unauthorized” because although he “may have had authority to access

any hospital medical record for a legitimate administrative purpose,” he did not have

authority to access the defendant’s software “for personal spying on his former

spouse or his sharing of that information with a co-worker.” Id. at ¶ 26.

Accordingly, because the facts did not constitute a “disclosure” by the health care

organization, but rather the deliberate, unauthorized access to the information by

an employee, the court affirmed the trial court’s dismissal of the plaintiff’s claims.

Id.

Finally, in Kennedy v. Corrado, Hamilton C.P. No. A1900656, 2019

Ohio Misc. LEXIS 7130 (May 30, 2019), the trial court found that allegations that an

employee of the defendant healthcare organization accessed the plaintiff’s medical

records without authorization to do so and then shared those records with others

did not constitute a “disclosure” by the healthcare organization for purposes of a

Biddle claim and dismissed the plaintiff’s claim. Id. at *4. Contrary to Keyse’s argument that these cases are “inapposite” to the

facts of this case, we find them directly on point. Just as in Scott, Sheldon, Tucker,

Foster, and Kennedy, this case involves the deliberate unauthorized access of the

plaintiff’s medical information by a third party. There are no facts suggesting that

Cleveland Clinic either intentionally or unintentionally disclosed Keyse’s

confidential medical information to Shepherd. Instead, the evidence is clear that

Shepherd acted willfully, improperly, and entirely on her own to gain access to

Keyse’s confidential medical information. Although as a Cleveland Clinic employee

Shepherd was authorized to access Keyse’s medical records for a legitimate business

purpose, she was not authorized to access them for her own personal reasons, which

she admitted she did when she “snooped” into Keyse’s records. Accordingly, just as

in the preceding cases, Shepherd’s unauthorized, intentional, deliberate “snooping”

into her sister’s records does not constitute a “disclosure” by Cleveland Clinic under

Biddle. Because there is no evidence that the Cleveland Clinic disclosed Keyse’s

medical information to anyone, Keyse cannot prove an essential element of her

Biddle claim and, therefore, the trial court properly granted Cleveland Clinic’s

motion for summary judgment on her claim.

Any argument by Keyse that the trial court should have denied

summary judgment because a jury could reasonably conclude that Cleveland Clinic

should have done more under HIPAA to protect the release of her information to

Shepherd is wholly without merit. Although HIPAA may provide guidance for

establishing Biddle liability, “it is well-settled that a HIPAA violation does not create a private cause of action for the party whose information has been released.”

Menorah Park Ctr. for Senior Living v. Rolston, 2020-Ohio-6658, ¶ 36. Thus,

allowing the jury to consider Cleveland Clinic’s compliance with HIPAA despite the

failure of Keyse’s Biddle claim would in effect create a private cause of action for

Keyse under HIPAA, something the law clearly does not allow.

The first assignment of error is overruled.

B. Motions in Limine

In her second assignment of error, Keyse contends that the trial court

abused its discretion in granting Cleveland Clinic’s motions in limine.

“It is well-settled that the granting or denial of a motion in limine is a

tentative, interlocutory precautionary ruling reflecting the trial court’s anticipatory

treatment of an evidentiary issue which the trial court may change at trial when the

disputed evidence appears in context.” State v. Taylor, 2004-Ohio-3115, ¶ 6 (8th

Dist.), citing State v. Grubb, 28 Ohio St.3d 199, 201 (1986). “‘A preliminary ruling

has no effect until it is acted upon at trial’” and hence, is not a final appealable order.

Liebe v. Admin., 2014-Ohio-1834, ¶ 9 (8th Dist.), quoting State v. Kulasa, 2012-

Ohio-6021, ¶ 20 (10th Dist.).

Cleveland Clinic contends that it would be premature for this court to

address Keyse’s arguments regarding the motions in limine because the trial court’s

rulings were conditional, interlocutory rulings that were not decided in the context

of a full trial and, thus, for us to address Keyse’s arguments regarding the motions

in limine would be “tantamount to giving advisory opinions on questions not properly before this court.” (Appellee’s brief, p. 36.) Once a final judgment is

rendered, however, all interlocutory orders are merged into the final judgment of

the trial court and become appealable. Marc Glassman, Inc. v. Fagan, 2006-Ohio-

5577, ¶ 11 (8th Dist.).

Nevertheless, this assignment is error is rendered moot by our

disposition of the first assignment of error affirming the trial court’s grant of

summary judgment to Cleveland Clinic. Accordingly, the second assignment of

error is overruled. See App.R. 12(A)(1)(c).

Judgment affirmed.

It is ordered that appellee recover from appellant costs herein taxed.

The court finds there were reasonable grounds for this appeal.

It is ordered that a special mandate be sent to said court to carry this judgment

into execution.

A certified copy of this entry shall constitute the mandate pursuant to Rule 27

of the Rules of Appellate Procedure.

KATHLEEN ANN KEOUGH, ADMINISTRATIVE JUDGE

EILEEN A. GALLAGHER, J., and LISA B. FORBES, J., CONCUR