T.R. v. University of Kansas Med. Ctr.

• Court: Court of Appeals of Kansas
• Decided: July 5, 2024
• Docket: 126536
• Status: Unpublished

Opinion

NOT DESIGNATED FOR PUBLICATION

No. 126,536

IN THE COURT OF APPEALS OF THE STATE OF KANSAS

T.R., Appellant,

v.

UNIVERSITY OF KANSAS MEDICAL CENTER d/b/a JAYDOC FREE CLINIC, Appellee.

MEMORANDUM OPINION

Appeal from Wyandotte District Court; TIMOTHY L. DUPREE, judge. Oral argument held May 24, 2024. Opinion filed July 5, 2024. Affirmed.

Maureen M. Brady and Lucy McShane, of McShane & Brady, LLC, of Kansas City, Missouri, for appellant.

Michael T. Raupp, of Husch Blackwell, LLP, of Kansas City, Missouri, for appellee.

Before PICKERING, P.J., MALONE and WARNER, JJ.

PER CURIAM: T.R., a patient at the University of Kansas Medical Center, d/b/a JayDoc Free Clinic (KUMC), was seen by Dr. Rebecca Rezaei for a female pelvic examination, and T.R. agreed that two medical students could participate. T.R. alleged that Rezaei photographed T.R.'s genitalia with her personal cell phone during the exam and then texted it to T.R. and the two medical students. T.R. sued KUMC for damages under several common-law tort theories. The district court granted KUMC's motion to dismiss for failure to state a claim upon which relief can be granted because Kansas has never recognized a common-law duty for a medical entity to safeguard the privacy rights 1 of a patient. The district court also found that even if a common-law duty exists, KUMC was entitled to sovereign immunity under the Kansas Tort Claims Act (KTCA), K.S.A. 75-6101 et seq.

T.R. argues on appeal that the district court erred in granting KUMC's motion to dismiss because she asserts that Kansas does recognize a duty by a healthcare provider to safeguard, protect, and maintain the confidentiality of patients' medical records. T.R. also argues that KUMC does not have immunity under the KTCA. We agree with the district court that Kansas does not recognize a common-law duty for a medical entity to protect the privacy and confidentiality of patients that would give rise to a private cause of action for the alleged breach of that duty. As a result, we affirm the district court's judgment.

FACTUAL AND PROCEDURAL BACKGROUND

On April 19, 2021, T.R. was a patient at KUMC and permitted Rezaei to perform a pelvic examination with two medical students present. During the examination, Rezaei took out her personal cellular phone and took a picture of T.R.'s genitals. Rezaei texted the picture to the two medical students' personal cellular phones and to T.R.'s personal cellular phone. T.R. alleged that she was a recovering sexual assault survivor, and the actions of Rezaei caused her to suffer, among other injuries, loss of privacy, loss of medical expenses, loss of trust, loss of confidentiality, embarrassment, humiliation, emotional distress, and loss of enjoyment of life.

On March 3, 2022, T.R. filed a petition for damages against KUMC under the following common-law tort theories: breach of fiduciary duty of confidentiality, outrageous conduct, breach of implied contract, negligence, negligent training and supervision, and negligence per se. T.R. did not allege that the photograph of her genitals was not medically necessary or that it contained her face, name, or any other information

2 that would identify her as the subject. She also did not allege that the photo was ever viewed by any person beyond the three people involved in providing her medical care.

KUMC moved to dismiss T.R.'s petition under K.S.A. 60-212(b) for failure to state a claim upon which relief can be granted. In its suggestions in support of its motion, KUMC alleged that no Kansas court had ever recognized a duty of medical entities to safeguard and prevent the unauthorized access of private medical information and records in violation of the Health Information Portability and Accountability Act (HIPAA) and the Health Information Technology Act (HITECH). KUMC also alleged that even if a duty did exist, KUMC was immune from liability under the KTCA.

T.R. filed suggestions in opposition to KUMC's motion to dismiss. Among other arguments, T.R. alleged that "[w]hile a Kansas court apparently has not yet had an opportunity to address this specific issue, multiple other courts have found a common law duty in this exact context." She also claimed the provisions of the KTCA did not provide immunity because KUMC failed to obey the law pertaining to safeguarding protected health information (PHI) and personally identifiable information (PII).

The district court held a hearing on the motion to dismiss with arguments by counsel, but the transcript is not in the record on appeal. On March 29, 2023, the district court filed a journal entry granting KUMC's motion to dismiss. The district court found that KUMC is a public entity and arm of the State of Kansas, and under the KTCA it does not bear greater liability than a private person operating in the private sector. The district court found that no Kansas court has ever recognized a legal duty for medical centers to "safeguard" or "protect" the medical records of patients who receive treatment at their facilities. The district court also found that KUMC was entitled to immunity under two specific provisions of the KTCA—K.S.A. 75-6104(c), which preserves sovereign immunity for public entities against claims for "enforcement or failure to enforce a law," and K.S.A. 75-6104(e), which preserves sovereign immunity against claims based on "the

3 exercise or performance or the failure to exercise or perform a discretionary function or duty." T.R. timely appealed the district court's judgment.

T.R. raises four separate but interrelated claims on appeal: (1) The district court incorrectly found that Kansas does not recognize a duty by a healthcare provider to safeguard, protect, and maintain the confidentiality of a patient's medical records; (2) the district court incorrectly found that T.R.'s claims against KUMC are not recognized tort actions for which sovereign immunity has been waived; (3) the district court incorrectly found that KUMC is immune from liability under the KTCA under K.S.A. 75-6104(c); and (4) the district court incorrectly found that KUMC is immune from liability under the KTCA under K.S.A. 75-6104(e). T.R. must prevail on her first claim to receive any relief. Grouping T.R.'s claims together, the overriding issue on appeal is whether the district court erred in granting KUMC's motion to dismiss for failure to state a claim.

DID THE DISTRICT COURT ERR IN DISMISSING T.R.'S CAUSE OF ACTION FOR FAILURE TO STATE A CLAIM UPON WHICH RELIEF COULD BE GRANTED?

T.R. first claims the district court incorrectly found that Kansas does not recognize a duty by a healthcare provider to safeguard, protect, and maintain the confidentiality of a patient's medical records. She asserts that just because no Kansas court has recognized such a duty does not mean that one does not exist. KUMC argues that the district court correctly found that Kansas does not recognize a legal duty for a medical center to ensure the confidentiality of medical records for patients treated in its facilities.

"Whether a district court erred by granting a motion to dismiss for failure to state a claim is a question of law subject to unlimited review." Jayhawk Racing Properties v. City of Topeka, 313 Kan. 149, 154, 484 P.3d 250 (2021). Likewise, "[w]hether a duty exists is a question of law, and an appellate court's review is unlimited." Adams v. Board of Sedgwick County Comm'rs, 289 Kan. 577, Syl. ¶ 4, 214 P.3d 1173 (2009).

4 KUMC sought dismissal under K.S.A. 60-212(b)(6) for failure to state a claim upon which relief can be granted. When considering a motion under K.S.A. 60-212(b)(6), a court must accept the plaintiff's factual allegations as true, but "there is nothing which requires a court to treat legal conclusions contained within the petition as also being true." Duckworth v. City of Kansas City, 243 Kan. 386, 391, 758 P.2d 201 (1988). T.R. brought six tort claims under Kansas law against KUMC related to the alleged release of her private medical records. All six depend on a medical center's duty to "protect," "safeguard," or "keep confidential" the medical records of patients receiving treatments at its facilities. No Kansas case has ever recognized that duty, a fact that she concedes.

The only case that addresses Kansas law on this subject is Link v. Lawrence Memorial Hospital, No. 22-cv-2111-EFM, 2022 WL 11089239, at *4 (D. Kan. 2022) (unpublished opinion). In Link, the court dismissed the plaintiff's claim for breach of confidentiality against a hospital based on the plaintiff's failure to provide any legal authority suggesting that Kansas recognized a tort duty of confidentiality. 2022 WL 11089239, at *4-5. The plaintiff, Link, was an employee of the hospital, a governmental entity, and she was also receiving treatment from one of the hospital's physicians for an "embarrassing" condition. A hospital senior director sent an email containing Link's unredacted medical records to several clinics and departments within the hospital. Link sued the hospital for "(I) breach of confidentiality, (II) intrusion upon seclusion, (III) giving publicity to private facts, (IV) intentional infliction of emotional distress, and (V) retaliation under the Family Medical Leave Act." 2022 WL 11089239, at *1. The only claim identical to a claim here is the breach of confidentiality, which the Link court dismissed, recognizing that neither Kansas medical licensure laws, HIPAA, nor common- law principles support an assertion that Kansas recognizes a duty by a hospital to keep medical records of patients confidential:

"Plaintiff alleges that Kansas medical licensure laws, common law principles of trust, and the Hippocratic oath all form the foundation for this duty, but she neglects to offer any

5 inkling of specificity or supporting Kansas case law. And Plaintiff's claim that she is seeking to vindicate the duty of confidentiality owed to her under HIPPA runs headlong into the Tenth Circuit's jurisprudence that indicates HIPPA does not create a private right of action for alleged disclosures of the plaintiff's confidential medical information. Though this does not directly answer the question of whether Kansas courts would recognize a tort duty of confidentiality based on the guarantees of HIPPA, Plaintiff fails to provide any citation to legal authority that suggests Kansas would recognize such a duty."2022 WL 11089239, at *4.

T.R. asserts that the novelty of a claim and the lack of precedent do not prove that a cause of action does not exist. See Hoffman v. Dautel, 189 Kan. 165, 168-69, 368 P.2d 57 (1962) (recognizing that novelty is not enough to prevent recovery but declining to conclude that the plaintiffs had alleged a new cause of action for loss of consortium by a child). In her reply brief, T.R. cites Hill v. State, 310 Kan. 490, 500-05, 448 P.3d 457 (2019), "[a]s an example where the Kansas Supreme Court recognized, for the first time, that actions short of termination or demotion could support a common-law cause of action for employer retaliation." But Hill does not help T.R.'s cause.

Hill held that the common-law retaliation tort encompasses a retaliatory job transfer by an employer. 310 Kan. at 505. In this way, it extended or enlarged an existing tort action. But here, T.R. has not identified any recognized tort action that can or should be extended. She is advocating for an entirely new tort action. Also, the Hill court relied on legislatively declared public policy in K.S.A. 2018 Supp. 75-2949(g), which states: "No employee shall be disciplined or discriminated against in any way because of the employee's proper use of the appeal procedure." 310 Kan. at 501-02. But as for T.R.'s claim, no statute declares it to be the public policy of Kansas that medical centers protect the confidentiality of patients' medical records.

6 T.R.'s reliance on Kansas statutes is misplaced.

T.R. cites to several Kansas statutes in her attempt to show that healthcare providers have a common-law duty of confidentiality, beginning with the physician- patient privilege codified at K.S.A. 2023 Supp. 60-427. T.R. admits there was no testimonial doctor-patient privilege at common law. See Wesley Medical Center v. Clark, 234 Kan. 13, 24, 669 P.2d 209 (1983). The doctor-patient privilege is a creature of statute. K.S.A. 2023 Supp. 60-427. T.R. fails to explain how K.S.A. 2023 Supp. 60-427 would apply to medical centers rather than treating physicians. T.R. relies on the definition of "[c]onfidential communication" within K.S.A. 2023 Supp. 60-427 to assert that healthcare providers have a duty to maintain the confidentiality of communications between a physician and patient. But K.S.A. 2023 Supp. 60-427 merely allows the holder of the privilege to refuse to disclose certain communications in a civil action or in a prosecution for a misdemeanor. It does not create a private right of action for a patient to seek damages against a physician for disclosing a confidential communication.

The Kansas Legislature has made it clear that no statute or other enactment shall create a private right of action unless the right is expressly stated therein. K.S.A. 2023 Supp. 60-5201(b) states: "It is the intent of the legislature that no statute, rule, regulation or other enactment of the state shall create a private right of action unless such right is expressly stated therein." T.R. fails to acknowledge this provision.

T.R. cites to other statutes that she asserts "recognize the confidential nature of physician-patient communications and medical records." T.R. relies on K.S.A. 2023 Supp. 45-221(a)(3), which excepts medical records pertaining to identifiable patients from disclosure under the Kansas Open Records Act (KORA), to maintain her argument that healthcare providers have a duty to protect confidential communications. But violators of KORA are only subject to penalties when sued by the state attorney general.

7 See K.S.A. 45-223. T.R. does not state how KORA can be construed to allow a patient to seek damages against a medical center for disclosing confidential information.

T.R. relies on the definition of "[u]nprofessional conduct" under the statutes pertaining to those licensed to practice the healing arts. See K.S.A. 65-2837(b)(6) (including "[w]illful betrayal of confidential information" under definition of "[u]nprofessional conduct"). But unprofessional conduct under this statute can only give rise to disciplinary action against a licensee by the Board of Healing Arts. See Zhu v. St. Francis Health Center, No. 94,900, 2007 WL 316805, at *3 (Kan. App. 2007) (unpublished opinion) (holding Kansas Healing Arts Act does not give rise to private cause of action). It does not allow a patient to seek damages against a medical center for disclosing confidential information. T.R. could file a complaint with the Kansas Board of Healing Arts if she thought that Rezaei's actions constituted unprofessional conduct.

Finally, T.R. cites K.S.A. 3-1007(p)(4) and K.S.A. 8-1023(d) which provide that the collection of blood samples to law enforcement shall not be subject to the physician- patient privilege as a recognition by the Kansas Legislature that communications between a physician and patient generally are confidential. But again, nothing about these statutes create a private right of action for a patient to seek damages against a physician for disclosing confidential information.

Caselaw cited by T.R. is distinguishable.

T.R. cites a number of Kansas cases for her assertion that communications between a patient and physician are confidential. But these cases are distinguishable. As KUMC argues "none of the cases cited by T.R. even consider tort liability arising from the relationship between a medical center and individuals treated at their facilities." First, T.R. cites State ex rel. Stephan v. Harder, 230 Kan. 573, 641 P.2d 366 (1982). Harder involved the Kansas Public Records Inspection Act. T.R. quotes a line of dictum from the

8 opinion: "It is undisputed that names and addresses of persons receiving medical assistance, the amounts received, the specific medical aid received, and the medical records of those persons, are confidential." 230 Kan. at 577. T.R. claims that Harder "recognized the confidential nature of communications between a patient and physician." But the Harder court was relying on K.S.A. 39-709b, which sets out the confidentiality of applications for recipients of temporary assistance for needy families. 230 Kan. at 577. It has nothing to do with communication between a patient and a physician, nor what duty of confidentiality, if any, medical entities owe their patients.

Next, T.R. cites to In re Estate of Broderick, 34 Kan. App. 2d 695, 705, 125 P.3d 564 (2005), in which another panel of this court referred to the physician-patient privilege under K.S.A. 60-427 as encompassing a hospital. But as discussed above, K.S.A. 2023 Supp. 60-427 merely allows the holder of the privilege to refuse to disclose certain communications in a civil action or in a prosecution for a misdemeanor. See K.S.A. 2023 Supp. 60-427(b). It does not allow a patient to seek damages against a physician or medical center for disclosing confidential communication. Likewise, the 1992 Attorney General opinion T.R. cites references the statutory physician-patient privilege, which does not provide a private cause of action for damages upon disclosure. See Att'y Gen. Op. No. 1992-057.

T.R. quotes language from Wesley Medical Center, 234 Kan. at 19-20, to support her assertion that "healthcare providers are not allowed to disclose patient medical records or communications without specific authorization." Wesley Medical Center is about the contours of the statutory patient-physician privilege. As stated above, the privilege concerns whether disclosure can be compelled in a civil action or prosecution for a misdemeanor. The privilege does not create a private right of action and has nothing to do with what occurs after a disclosure has been made.

9 Finally, T.R. cites one case—Natanson v. Kline, 186 Kan. 393, 403-04, 350 P.2d 1093 (1960)—to support her assertion that "Kansas cases also recognize the fiduciary relationship that exists between a physician and patient." Again, T.R. references dictum to try to prove her point. Natanson was about a physician accused of treating a patient without her informed consent regarding the procedure. The Natanson court did not cite to a single Kansas authority that would support the assertion that a physician has a fiduciary duty to his or her patient. Even if a physician were a fiduciary, it does not follow that a medical center has a duty to protect the confidentiality of communications between a patient and a physician. Also, as KUMC points out, the Kansas Supreme Court has stated in another case that "the relationship between a hospital and its patients is not a fiduciary relationship." McCoy v. Wesley Hospital and Nurse Training School, 188 Kan. 325, 334, 362 P.2d 841 (1961).

T.R.'s policy arguments fail.

T.R. argues that the confidentiality of medical records and communication between a healthcare provider and patient is a matter of public policy in Kansas. She quotes language from Werner v. Kliewer, 238 Kan. 289, 293, 710 P.2d 1250 (1985), stating that "the confidentiality of the physician-patient relationship is a matter of strong public policy in Kansas." Again, T.R. relies on dictum to try to prove her point. Werner involved a divorce action where wife's psychiatrist sent a letter directly to the district court judge expressing concern over wife's risk of harm to herself and the ability to care for the minor children. Wife sued the psychiatrist for invasion of privacy or, alternatively, breach of contract. The Werner court held that wife could not sustain a claim against the psychiatrist for either invasion of privacy or breach of contract. 238 Kan. at 298. Werner does not hold that there is a duty in Kansas for medical centers to protect the confidentiality of their patients' medical records.

10 T.R. next cites to cases from other states to try to prove that there should be a claim in Kansas for breach of the duty of confidentiality. Decisions from other jurisdictions are not binding on the panel. State v. Quested, 302 Kan. 262, 273, 352 P.3d 553 (2015). T.R. cites to an Indiana case where the court held that there has always been a common-law duty of confidentiality in Indiana owed by healthcare providers to their patients and recognizing a claim for breach of that duty. See Henry v. Community Healthcare System Community Hospital, 134 N.E.3d 435, 438 (Ind. Ct. App. 2019). T.R. cites to a Missouri case in which a court recognized a cause of action for damages in tort against a physician who discloses confidential medical information based on Missouri's common law that a physician owes a fiduciary duty of confidentiality to a patient. See Brandt v. Medical Defense Associates, 856 S.W.2d 667, 670 (Mo. 1993).

Finally, T.R. argues that HIPAA does not preclude a state-law claim for negligent disclosure of confidential medical records. T.R. concedes that HIPAA does not provide for a private right of action, but then cites other jurisdictions that have used HIPAA to "inform the standard of care owed by medical practitioner." See Shepherd v. Costco Wholesale Corporation, 250 Ariz. 511, 517, 482 P.3d 390 (2021); Harrington v. Madison County, No. CV-21-15-BU-BMM, 2021 WL 5770299, at *2-3 (D. Mont. 2021) (unpublished opinion). KUMC counters that "even if HIPAA could inform as to the standard of care owed with respect to the confidentiality of medical records, [it is] completely irrelevant if the plaintiff cannot establish the existence of a separate legal duty owed to them." "HIPAA provides that '[a] person who knowingly . . . discloses individually identifiable health information to another person' without authorization shall be fined, imprisoned, or both." Payne v. Taslimi, 998 F.3d 648, 660 (4th Cir. 2021) (quoting 42 U.S.C. § 1320d-6[a][3], [b]). But HIPAA does not create a private right of action. See Wilkerson v. Shinseki, 606 F.3d 1256, 1267 n.4 (10th Cir. 2010).

To begin to sum up, no Kansas court has recognized a cause of action for a hospital's failure to keep medical records of patients confidential. There is no reason for

11 our court to be the first. Significantly, in Kansas, there was no physician-patient privilege at common law. It is a creature of statute. K.S.A. 2023 Supp. 60-427. The statute only allows the holder of the privilege to refuse to disclose certain communications in legal proceedings. The statute does not create a private right of action for an alleged violation.

The district court correctly found that Kansas does not recognize a duty by a healthcare provider to safeguard, protect, and maintain the confidentiality of a patient's medical records. All of T.R.'s claims against KUMC are premised upon the existence of this duty. Absent such a duty, T.R.'s claims fail as a matter of law.

"A plaintiff seeking recovery under the KTCA must raise a recognized cause of action." Prager v. Kansas Dept. of Revenue, 271 Kan. 1, 36, 20 P.3d 39 (2001). The KTCA states that a governmental entity is liable for damages caused by its employees where the governmental entity, if a private person, would be liable under the laws of the state. See K.S.A. 75-6103(a). T.R. does not allege that KUMC is not a governmental entity. Because the tort theories T.R. advanced in her petition are not recognized in Kansas, KUMC has sovereign immunity under the KTCA. We need not address the district court's findings that KUMC also was immune from liability under K.S.A. 75- 6104(c) and K.S.A. 75-6104(e). We conclude the district court did not err in dismissing T.R.'s cause of action for failure to state a claim upon which relief could be granted.

Affirmed.