Opinion
Court of Appeals Case No. 19A-CT-873
05-26-2020
COMMUNITY HEALTH NETWORK, INC., Appellant, v. Heather MCKENZIE and Daniel McKenzie, Individually and as Parents and Natural Guardians of J.M. and O.M., John McKenzie, Deborah West, Michael West, and Katrina Gray, Appellees.
Attorneys for Appellant: Sherry A. Fabina-Abney, Jenny R. Buchheit, Stephen E. Reynolds, Sean T. Dewey, Ice Miller LLP, Indianapolis, Indiana Attorneys for Appellee: William N. Riley, Anne Medlin Lowe, Riley Williams & Piatt, LLC, Indianapolis, Indiana Attorneys for Amicus curiae: A. Richard M. Blaiklock, Wade D. Fulford, Lewis Wagner, LLP, Indianapolis, Indiana
Attorneys for Appellant: Sherry A. Fabina-Abney, Jenny R. Buchheit, Stephen E. Reynolds, Sean T. Dewey, Ice Miller LLP, Indianapolis, Indiana
Attorneys for Appellee: William N. Riley, Anne Medlin Lowe, Riley Williams & Piatt, LLC, Indianapolis, Indiana
Attorneys for Amicus curiae: A. Richard M. Blaiklock, Wade D. Fulford, Lewis Wagner, LLP, Indianapolis, Indiana
Pyle, Judge.
Statement of the Case
[1] Plaintiffs-Appellees, Heather McKenzie ("Heather"), Daniel McKenzie ("Daniel"), John McKenzie ("John"), Deborah West ("Deborah"), Michael West ("Michael"), J.M. ("J.M."), and O.M. ("O.M.") (collectively, "Appellees") filed their complaint against Defendant-Appellant Community Health Network, Inc ("Community") and Defendant Katrina Gray ("Katrina") in January 2014 and amended their complaint in July 2015. The complaint arose following Katrina's unauthorized access of Appellees' private health information while she was an employee of Community. Appellees brought claims for vicarious liability under the doctrine of respondeat superior and negligent training, supervision, and retention against Community and negligence and invasion of privacy/intrusion against Katrina.
[2] This interlocutory appeal comes before us pursuant to the trial court's denial of Community's Trial Rule 12(B)(1) motion to dismiss Appellees' complaint and motion for summary judgment. Community contends that: (1) the trial court erred by denying its motion to dismiss Appellees' complaint for a lack of subject matter jurisdiction, asserting that their claims fall within the purview of the Medical Malpractice Act (the "MMA") and that the Appellees failed to comply with the procedural prerequisites of the MMA; and (2) the trial court erred by denying summary judgment on Appellees' claims of respondeat superior and negligent training, supervision, and retention. Community also argues that even if Katrina's actions were within the scope of her employment, it cannot be held vicariously liable under respondeat superior for Katrina's actions because Appellees' underlying negligence and invasion of privacy/intrusion claims against Katrina are not actionable under Indiana law.
[3] We conclude that Appellees' claims do not fall within the purview of the MMA and that the trial court properly denied Community's motion to dismiss. Additionally, on the claims involving respondeat superior, negligent training, supervision, and retention, and negligence, there are genuine issues of material fact precluding summary judgment in Community's favor. However, to the extent that Appellees' respondeat superior claim is based on an underlying act of invasion of privacy/intrusion by Katrina, we conclude that Community is entitled to judgment as a matter of law, in part, on the respondeat superior claim. Therefore, the judgment of the trial court is affirmed in part, reversed in part, and remanded with instructions
[4] We affirm in part, reverse in part, and remand with instructions.
Issues
1. Whether the trial court erroneously denied Community's motion to dismiss.
2. Whether the trial court erroneously denied Community's motion for summary judgment.
Facts
[5] Heather and Katrina worked together at the Indiana Orthopedic Center ("IOC") from January 2005 until September 2010. Katrina had been employed as a medical records coordinator at the IOC since 1999 and was Heather's direct supervisor between 2005 and 2010. Katrina's title at the IOC was "Health Information Management Coordinator." (App. Vol. VIII at 26). In this capacity, Katrina was responsible for "scheduling appointments and releasing medical records for [the IOC]." (App. Vol. VIII at 26).
[6] At some point, Katrina introduced Heather to her stepson, Kevin Gray ("Kevin"). In 2006, Heather began dating Kevin, and the two married in 2007. Heather and Kevin had two children, J.M. and O.M. Heather and Kevin eventually divorced in 2010. Heather received full custody of J.M. and O.M. In 2011, Heather married Daniel, and he adopted J.M. and O.M. A family feud between the Gray family and Appellees ensued.
[7] In 2012, Community acquired the IOC through an asset purchase. Community hired and trained Katrina as a medical records coordinator. As a condition of her employment with Community, Katrina was required to attend orientation and complete mandatory e-training on patient confidentiality and the Health Insurance Portability and Accountability Act of 1996 ("HIPPA").
[8] In June 2012, after successfully completing orientation and e-training, Katrina was provided access to Epic, an electronic medical records system. When using Epic, Katrina was authorized to schedule appointments and release records of the patients only within the IOC. Katrina was strictly prohibited from accessing any patient record without a business need or for personal reasons.
[9] In September 2013, Community received an internal employee complaint via its anonymous hotline, which served as an internal and external avenue to report any compliance issues involving Community's employees. The complaint alleged that Katrina had accessed her personal chart, which, if true, violated Community's policies and employee conduct rules. As a result, Community investigated Katrina's access and determined that she had accessed her own chart, as well as the confidential health records of multiple other patients–including Appellees–at various times between January and September 2013. For each unauthorized access, Katrina had used a Community computer system to look up private health information of Community's patients. She did so while she was on the job using equipment, software, and credentials provided to her by Community. Following Community's investigation, Community placed Katrina on administrative leave and eventually terminated her employment.
[10] While Appellees received medical treatment at and were patients of Community, they had not received care or services at the IOC. In early November 2013, Appellees received notice from Community that their health information records had been compromised. The letters explained that Community had "learned that an employee [had] accessed" the Appellees' "medical record[s] without a business need[,]" and listed the specific dates the breaches had occurred. (App. Vol. VIII at 2-5). Appellees later learned that Katrina was the employee who had improperly accessed their medical records.
[11] In January 2014, Appellees filed suit against Community based on Katrina's unauthorized access of their medical records. This complaint named Community as the sole defendant and alleged two counts: (1) respondeat superior; and (2) negligent training, supervision, and retention. In July 2015, Appellees filed an amended complaint adding Katrina as a defendant. The amended complaint enumerated four counts: (1) respondeat superior against Community; (2) negligent training, supervision, and retention against Community; (3) negligence against Katrina; and (4) invasion of privacy/intrusion against Katrina. In regard to their respondeat superior claim against Community in count one, Appellees alleged that Community owed them a non-delegable duty to protect the privacy and confidentiality of their medical records. They further alleged that because Katrina had accessed their records in the course and scope of her employment with Community, Community was vicariously liable for Katrina's unauthorized acts and that as a proximate result of this breach, Appellees had suffered damages. As for the negligent training, supervision, and retention claim in count two, Appellees alleged that Community had: (1) breached its duty to train and instruct Katrina in the protection of confidential medical records; (2) failed to supervise Katrina in the protection of medical records and their confidentiality; (3) failed to employ methods and/or take appropriate steps to learn of an employee's misuse and abuse of authority; and (4) failed to implement appropriate measures for the protection of its patients' health information records.
[12] In September 2015, Community filed its amended answer. In January 2018, Community filed a motion to dismiss counts one and two of the amended complaint pursuant to Trial Rule 12(B)(1), alleging that the trial court lacked subject matter jurisdiction. Specifically, Community argued that Appellees' claims directly related to the provision of healthcare within the MMA and that Appellees had failed to exhaust their administrative remedies because they had not filed a complaint with the Indiana Department of Insurance ("IDOI") and had not obtained a medical panel decision.
[13] Contemporaneously, and alternatively, Community filed a motion for summary judgment requesting that the court enter judgment in its favor as to counts one and two of the amended complaint. Specifically, Community argued that: (1) it was not vicariously liable for Katrina's misconduct; (2) it owed no actionable duty to Appellees; and (3) Appellees were not sufficiently damaged by the personal health information breach. Community also argued that even if Katrina acted within the scope of her employment, it could not be held vicariously liable because Appellees' underlying negligence and invasion of privacy/intrusion claims against Katrina are not actionable under Indiana law.
Katrina has not sought summary judgment on the negligence or invasion of privacy/intrusion claims against her.
[14] In support of its motion for summary judgment, Community designated in relevant part: (1) depositions from Deborah, Michael, Heather, Daniel, John; (2) an affidavit with exhibits from a Senior Project Manager at Community explaining the conditions of Katrina's employment, including attending orientation, reviewing Community's policies and procedures, and completing mandatory e-training on patient confidentiality and HIPAA; (3) an affidavit with exhibits from Community's Vice President of Compliance explaining its policies, training materials, and mechanisms for monitoring access to medical records; and (4) interrogatories from Katrina, Heather, Michael, Deborah, John, and Daniel.
[15] Appellees responded by designating several depositions, exhibits, and affidavits in support of their argument that genuine issues of material fact precluded summary judgment. One such exhibit was an affidavit with a report by their retained expert, Dr. Kayur V. Patel ("Dr. Patel"), discussing Community's "policies and procedures safeguarding ... electronically-stored private health information." (App. Vol. IV at 91). In his report, Dr. Patel stated that he was "asked to evaluate whether or not, as a facility, Community Health had implemented and acted under HIPAA ... Breach Notification Rule, modified September 23, 2013 and American Medical Association Guidelines and whether or not its employee adhered to follow it, safeguarding the privacy and security of PHI (Protected Health Information)." (App. Vol. IV at 93).
[16] In September 2018, the trial court heard argument on Community's motion to dismiss and motion for summary judgment. The trial court also heard argument on a motion to intervene that had been filed by Stephen Robertson, Commissioner of the IDOI, as Administrator of the Indiana Patient's Compensation Fund ("PCF"). At the end of the hearing, the trial court ordered that the parties submit proposed findings of fact and conclusions of law. In November 2018, the trial court denied all three motions in its findings of fact and conclusions of law. When denying Community's motion to dismiss, the trial court concluded in relevant part:
The conduct in this case was possible as part of the regular business functions of [Katrina] and therefore falls outside the [MMA]. [Katrina] was a clerical employee of Community. The [Appellees] were not patients of the practice at which [Katrina] worked and the misconduct alleged by the [Appellees] did not involve providing medical treatment to them.
* * *
The [Appellees] allege that Community breached it[s] duty to secure and maintain health information by its failure to adopt or enforce a variety of mechanisms, policies, or procedures that govern handling of medical records. Such policies and procedures are indirectly related to patient care in that the records are a confidential repository for medical events and diagnoses that have occurred or may occur in the future. The accumulation and review of patient records plays an important part in how a physician may make a medical decision, however, handling the records themselves
are not treatment of the patient by medical professional.
* * *
Therefore, this [c]ourt has subject matter jurisdiction over the case before the bench and over the claims that Community Health Network and Katrina Gray mishandled confidential information. Community's 12(B)(1) [m]otion to [d]ismiss is hereby denied.
(App. Vol. II at 26-28).
[17] When denying Community's motion for summary judgment on counts one and two, the trial court concluded in relevant part:
[Katrina's] access to patient medical records was incidental to authorized conduct. Without information on what exactly [Katrina] did or intended to do with the data she viewed, leaves open questions of fact for the jury.
* * *
[Katrina] stated, in her response to the allegations that, "I did not have a clear understanding of the scope of my authority in this area until the subject incident." Thus, a question of fact as to whether and to what extent [Katrina] understood or acknowledged Community's privacy policies remains for trial. Therefore, summary judgment is not appropriate on the question of whether Community is vicariously liable for the breaches of its former employee, [Katrina].
On the question of duty of Community to the owners of breached records, Community argued that it and [Katrina] have no duty to the [Appellees] to keep their medical records private. However, both state and federal law outline the duty of health care providers to protect the confidentiality of the patients' health and medical records. Also, Community produced documents recognizing its ‘legal and ethical’ duty to its patients to keep their medical records confidential. Further, a party responsible for gathering and storing individuals' private health information has a duty to keep confidential that information. Rocca v. [Southern] Hills Counseling Ctr., Inc. , 671 N.E.2d 913, 916 (Ind. Ct. App. 1996). Under these facts and circumstances, the Court denies Community's motion for summary judgment as to whether it and Gray owe a duty to the [Appellees].
* * *
The designated evidence supports an inference that [Katrina's] violations of the [Appellees'] privacy rights were allowed as part of the general daily access that [Katrina] had to patient medical records. [Katrina] looked at her own medical records and the records of other patients, in addition to the [Appellees] records during an eight-month period. Whether Community breached its duty to protect the confidentiality of those records from [Katrina] (as in limiting access to patient records to those inside her department only) whatever her personal reasons for viewing the records may have been, is a question of fact. In sum, although the breach is admitted and training of [Katrina] may have been adequate and appropriate, questions of fact remain as to whether Community failed to take appropriate steps to implement measures to learn of an employee's misuse or abuse of authority and whether Community failed to narrow [Katrina's] access to prevent the spread of confidential medical information to unauthorized sources.
* * *
[Katrina] asserted, when confronted with these unauthorized access allegations that, despite the policies of and/or training by Community, she did not "have a clear understanding of the scope of [her] authority in this area until the
subject incident." Therefore, whether Defendants breached their duty to the [Appellees] is a question for the fact finder. Summary judgment on the issue of breach of duty is denied.
Here, each [of the Appellees] designated evidence supporting an inference that he or she has suffered emotional distress due to the breach. The weight assigned to this evidence, and a determination of the existence and extent of the damages to the [Appellees], is a question for the jury, Am. Family Mut. Ins. Co. v. Matusiak , 878 N.E.2d 529, 533 (Ind. Ct. App. 2007). Community's motion for summary judgment on the [Appellees'] damages is denied.
* * *
[Appellees] designated evidence supporting an inference that [Katrina] did or may have publicly disclosed facts about the [Appellees'] private lives to social acquaintances and her co-workers, creating a question of fact as to whether and to what extent these disclosures occurred. Therefore, Community's motion for summary judgment on the [Appellees'] invasion of privacy claim is denied.
(App. Vol. II at 30-36).
[18] Thereafter, Community filed a motion to certify the trial court's ruling for an interlocutory appeal. The trial court certified its order, and Community filed a motion for permission to file an interlocutory appeal, which we granted. Community now appeals.
Community requested oral argument in this matter. In a separate issued order, we deny Community's oral argument motion.
Decision
[19] On appeal, Community argues that the trial court erred by: (1) denying its motion to dismiss Appellees' complaint; and (2) denying its motion for summary judgment on counts one and two of Appellees' amended complaint. We will address each of these arguments in turn.
1. Motion to Dismiss
[20] Community first argues that the trial court erred by denying its motion to dismiss pursuant to Trial Rule 12(B)(1) for lack of subject matter jurisdiction. Community contends that Appellees' claims fall squarely within the purview of the MMA and that Appellees failed to comply with the MMA when they did not submit a proposed complaint with the IDOI and did not obtain an opinion from a medical review panel before filing their complaint with the trial court.
[21] Trial Rule 12(B)(1) addresses the "[l]ack of jurisdiction over the subject matter." In reviewing a motion to dismiss for lack of subject matter jurisdiction pursuant to Trial Rule 12(B)(1), the relevant question is whether the type of claim presented falls within the general scope of the authority conferred upon the court by constitution or statute. Metz as Next Friend of Metz v. Saint Joseph Reg'l Med. Center-Plymouth Campus, Inc. , 115 N.E.3d 489, 493 (Ind. Ct. App. 2018). A motion to dismiss for lack of subject matter jurisdiction presents a threshold question with respect to a court's power to act. Id. Our standard of review for a trial court's grant or denial of such motion "is a function of what occurred in the trial court." Id. (internal citation and quotation omitted). "Where the facts before the trial court are not in dispute, the question of subject matter jurisdiction is one of law, and we review the trial court's ruling de novo." Muir Woods Section One Association, Inc. v. Fuentes , 136 N.E.3d 647, 651 (Ind. Ct. App. 2019). [22] The MMA dictates the statutory procedures for medical malpractice actions. See I.C. § 34-18-1-1 et seq. The MMA defines "malpractice" as "a tort or breach of contract based on health care or professional services that were provided , or that should have been provided, by a health care provider, to a patient." I.C. § 34-18-2-18 (emphasis added). The fact that Community is a health care provider is undisputed. The MMA defines "tort" as a "legal wrong, breach of duty, or negligent or unlawful act or omission proximately causing injury or damage to another." I.C. § 34-18-2-28. The MMA defines "health care" as "an act, or treatment performed or furnished, or that should have been performed or furnished, by a health care provider for, to, or on behalf of a patient during the patient's medical care, treatment, or confinement." I.C. § 34-18-2-13. Despite the MMA's comprehensiveness, the phrase, "professional services," is undefined.
[23] The MMA is not all-inclusive for claims against health care providers, nor is it intended to be extended to cases of ordinary negligence. Peters v. Cummins Mental Health, Inc. , 790 N.E.2d 572, 576 (Ind. Ct. App. 2003), trans. denied . Rather, the MMA was designed to curtail, not expand, liability for medical malpractice. Chamberlain v. Walpole , 822 N.E.2d 959, 963 (Ind. 2005). As such, the MMA is in derogation of common law and should be narrowly construed. Patel v. Barker , 742 N.E.2d 28, 31 (Ind. Ct. App. 2001), reh'g denied , trans. denied . When the General Assembly enacts a statute in derogation of the common law, courts presume that the General Assembly is aware of the common law and that the General Assembly does not intend to make any change beyond what is declared in express terms or by unmistakable implication. Weldon v. Universal Reagents, Inc. , 714 N.E.2d 1104, 1107-08 (Ind. Ct. App. 1999).
[24] Indiana courts have developed an analytical framework to determine whether the MMA applies to a certain claim. The courts look to the substance of a claim, not the manner in which the conduct is framed in a pleading by the claimant. G.F. v. St. Catherine Hosp., Inc. , 124 N.E.3d 76, 85 (Ind. Ct. App. 2019), trans. denied . Claims that boil down to a "question of whether a given course of treatment was medically proper and within the appropriate standard are the quintessence of a malpractice case." Howard Reg'l Health Sys. v. Gordon , 952 N.E.2d 182, 185 (Ind. 2011) (internal quotation omitted). Thus, to fall within the purview of the MMA, a provider's conduct must be undertaken in the interest of, or for the benefit of, the patient's health. Id. Put differently, the conduct must be "curative or salutary conduct of a health care provider acting within his or her professional capacity." Murphy v. Mortell , 684 N.E.2d 1185, 1188 (Ind. Ct. App. 1997), trans. denied . Conversely, the MMA does not apply to conduct "demonstrably unrelated to the promotion of the plaintiff's health or an exercise of the provider's professional expertise, skill, or judgment." Gordon , 952 N.E.2d at 186.
[25] Given the limiting language of the MMA, not every negligent act or omission by a health care provider constitutes medical malpractice. G.F. , 124 N.E.3d at 85. Indeed, the MMA applies to "a variety [of] claims that do not look like traditional medical malpractice." Terry v. Cmty. Health Network, Inc. , 17 N.E.3d 389, 393 (Ind. Ct. App. 2014) (citations omitted). We have also explained that:
A case sounds in ordinary negligence [rather than medical negligence] where the factual issues are capable of resolution by a jury without application of the
standard of care prevalent in the local medical community. By contrast, a claim falls under the [MMA] where there is a causal connection between the conduct complained of and the nature of the patient-health care provider relationship.
Metz , 115 N.E.3d at 495 (quoting Terry , 17 N.E.3d at 393 ) (internal citations omitted).
[26] Community argues that the trial court erred when it concluded that Appellees' claims do not fall within the purview of the MMA. Specifically, Community urges that its "maintenance of medical records, as well as its determination and utilization of the appropriate mechanisms, training protocols, and procedures for logging, auditing, monitoring, detecting, or otherwise securing access to patient records, are professional services [it] offers in furtherance of its patient care." (Community's Br. 33-34). Therefore, Community argues, Appellees' claims "unequivocally fall[ ] within the purview of the MMA." (Community's Br. 33). In response, Appellees argue that "claims alleging the mishandling of a patient's confidential information––even by a treating physician––are not governed by the Medical Malpractice Act." (Appellees' Br. 21). In this specific case, we agree with Appellees.
[27] Community relies on Gordon for the proposition that the maintenance and preservation of medical records "is so closely entwined with health care" that the present claims are governed by the MMA. Gordon , 952 N.E.2d at 186. Gordon involved claims against a hospital and other defendants for medical malpractice and for a spoliation of evidence due to the hospital's loss of a portion of the plaintiff's past health records. Our supreme court first addressed the spoliation claim and determined that the maintenance of health records was within the purview of the MMA because the "skillful, accurate, and ongoing maintenance of test and treatment records bears strongly on subsequent treatment and diagnosis of patients." Id. at 186. The Gordon Court continued its analysis and concluded that the statute on the maintenance of health records does not create a separate cause of action for negligent loss of the medical records from the MMA. The Court also determined that the plaintiffs presented a claim for first-party spoliation, not third-party spoliation. The Court held that the spoliation claim against the hospital was a prohibited first-party spoliation claim. Taken together, the Gordon Court held that the hospital was entitled to summary judgment on the count alleging spoliation of evidence.
[28] Contrary to Community's assertions, we do not find Gordon persuasive here because its holding on the maintenance of records is not applicable to this case. Gordon dealt with the "skillful, accurate, and ongoing" maintenance of a patient's health records by "physicians and other health care providers" so that the health care providers can have access to relevant information for the treatment of their patients. Id. at 186. The underlying claims against the hospital and one of its physicians were for medical malpractice and, importantly, spoliation, claiming that the hospital lost health records that were vital to the medical malpractice claim. Here, the underlying claims against Community are for respondeat superior and negligent training, supervision, and retention. Appellees do not allege that records were lost, nor do they claim that Katrina provided them medically improper treatment; rather, their claims against Community arise from Katrina's access of their confidential health information records. As such, the MMA does not apply to Appellees' claims because the conduct at issue is "demonstrably unrelated to the promotion of the plaintiff's health or an exercise of the provider's professional expertise, skill, or judgment." Id. at 186.
[29] Additionally, we find this Court's recent decision in G.F. to be more instructive. In that case, we addressed "[w]hether the MMA applies to claims involving negligent dissemination of protected health information." G.F. , 124 N.E.3d at 80. In G.F. , the physician disclosed the patient's confidential health information to a third-party visitor who was present in the plaintiff's hospital room. The patient brought an action against his treating physician, hospital, and the Indiana Patient's Compensation Fund, seeking declaration that his claims against the physician and hospital did not fall within the purview of the MMA. The plaintiff then moved for summary judgment on his declaratory judgment claims. After the trial court permitted the physician and hospital to file a belated response, the court found that the patient's claim was governed by the MMA and denied the summary judgment motion in its entirety.
[30] On appeal, this Court accepted the patient's argument that his claim was not within the boundaries of the MMA. The G.F. Court began its analysis by noting that the patient was not contending that his physician's statement led to an inaccurate diagnosis, improper treatment, or bodily injury. Rather, he articulated his claim as whether the MMA applies to claims involving the violation of a patient's medical confidentiality and negligent or intentional disclosure of protected health information. The G.F. Court explained that the test for resolving such a claim is "based on the provider's behavior or practices while acting in his professional capacity as a provider of medical services." G.F. , 124 N.E.3d at 88 (internal quotation and citation omitted). This Court explained that the physician's communication had the dual effect of providing medical information to a patient while inadvertently disclosing confidential information to a third-party. Because it was the disclosure of confidential information and not the services provided by the physician that was the focus of the patient's claim, this Court reasoned that at no point did the disclosure of such confidential information constitute health care treatment to the plaintiff, nor did the physician's statements have a curative or salutary effect on the plaintiff. Therefore, the G.F. Court held that the plaintiff's complaint, "as it pertain[ed] to the negligent or intentional disclosure of protected health information, [wa]s not subject to the limitations of the MMA." Id.
[31] As in G.F. , Appellees' complaint is not subject to the limitations of the MMA. Katrina worked for Community as a medical records coordinator and was responsible for "scheduling appointments and releasing medical records for [the IOC]." (App. Vol. VII at 26). Her position did not involve the provision of health care to Appellees. Furthermore, Appellees were not patients of the practice at which Katrina worked. It cannot be said that her conduct was in furtherance of providing health care or professional services to Appellees. See H.D. v. BHC Meadows Hosp., Inc. , 884 N.E.2d 849, 856 (Ind. Ct. App. 2008) (holding that a claim based on a therapist's decision to send a fax containing information about an adolescent patient's mental health to the patient's school was not a malpractice claim subject to the MMA), reh'g denied , trans. denied .
[32] Accordingly, Appellees' claims are not related to the promotion of their health and do not involve the use of professional expertise, skill, or judgment, as contemplated by the MMA. Therefore, the trial court did not lack subject matter jurisdiction and did not err when it denied Community's motion to dismiss.
In an attempt to further support its argument that Appellees' claims fall under the MMA, Community also argues that the "substance of [Appellees'] claims against [it] require reference to the applicable standard of care, which is clearly outside the province of the jury." (Community's Br. 34-35). In support, Community emphasizes Appellees' retention of a physician expert and his report regarding Community's "policies and procedures safeguarding ... electronically-stored private health information." (App. Vol. IV at 91). We disagree with Community. The fact that Appellees retained an expert to explain Community's maintenance of health information does not automatically bring Appellees' claims within the purview of the MMA.
2. Summary Judgment
[33] We now turn to Community's contention that the trial court erred by denying its motion for summary judgment. Our standard of review in summary judgment appeals is as follows:
We review summary judgment de novo, applying the same standard as the trial court: "Drawing all reasonable inferences in favor of ... the non-moving parties, summary judgment is appropriate ‘if the designated evidentiary matter shows that there is no genuine issue as to any material fact and that the moving party is entitled to judgment as a matter of law.’ " Williams v. Tharp , 914 N.E.2d 756, 761 (Ind. 2009) (quoting T.R. 56(C)). "A fact is ‘material’ if its resolution would affect the outcome of the case, and an issue is ‘genuine’ if a trier of fact is required to resolve the parties' differing accounts of the truth, or if the undisputed material facts support conflicting reasonable inferences." Id. (internal citations omitted).
The initial burden is on the summary-judgment movant to "demonstrate [ ] the absence of any genuine issue of fact as to a determinative issue," at which point the burden shifts to the non-movant to "come forward with contrary evidence" showing an issue for the trier of fact. Id. at 761-62 (internal quotation marks and substitution omitted).
Hughley v. State , 15 N.E.3d 1000, 1003 (Ind. 2014) (alterations original to Hughley ).
[34] We emphasize that summary judgment is a "high bar" for the moving party to clear in Indiana. Id. at 1004. "In particular, while federal practice permits the moving party to merely show that the party carrying the burden of proof [at trial] lacks evidence on a necessary element, we impose a more onerous burden: to affirmatively ‘negate an opponent's claim.’ " Id. at 1003 (quoting Jarboe v. Landmark Comm. Newspapers of Ind., Inc. , 644 N.E.2d 118, 123 (Ind. 1994), reh'g denied ). Further:
Summary judgment is a desirable tool to allow the trial court to dispose of cases where only legal issues exist. But it is also a "blunt ... instrument" by which the non-prevailing party is prevented from having his day in court. We have therefore cautioned that summary judgment is not a summary trial and the Court of Appeals has often rightly observed that it is not appropriate merely because the non-movant appears unlikely to prevail at trial. In essence, Indiana consciously errs on the side of letting marginal cases proceed to trial on the merits, rather than risk short-circuiting meritorious claims.
Id. (citations and some quotations omitted; omissions original to Hughley ).
[35] Community asserts that it is entitled to judgment as a matter of law on Appellees' claims against it for respondeat superior and negligent supervision, training, and retention. We address each claim in turn.
[36] As a preliminary matter, we note that Community asserts that the trial court erred by allowing both the respondeat superior and negligent supervision, training, and retention claims to proceed. Community argues that if "[Katrina] was acting in the scope of her employment, then the trial court should have summarily dismissed [the negligent supervision, training, and retention claim]. Alternatively, if [Katrina] was not acting within the scope of her employment, [the respondeat superior claim] should have been summarily dismissed." (Community's Br. 38) (emphasis in original). While Appellees' respondeat superior and negligent supervision, training and retention claims are alternative theories for holding an employer liable, our supreme court has held that unless an "employer admits that an employee was acting within the course and scope of his or her employment," both claims may proceed. Sedam v. 2JR Pizza Enterprises, LLC , 84 N.E.3d 1174, 1179 (Ind. 2017). Here, Community has not made such an admission. Thus, we conclude that given the stage in litigation, the trial court did not err in allowing Appellees to proceed on both claims for respondeat superior and negligent supervision, training, and retention.
A. Respondeat Superior
[37] Community first argues that it is entitled to summary judgment on Appellees' claim alleging respondeat superior liability. The general rule is that vicarious liability can be imposed when an employer, who is not liable because of his own acts, is found responsible "for the wrongful acts of his employee which are committed within the scope of employment." Sword v. NKC Hosps., Inc. , 714 N.E.2d 142, 148 (Ind. 1999) (quotation and citation omitted). "[C]onduct is within the scope of employment when it is ‘of the same general nature as that authorized, or incidental to the conduct authorized.’ " Walgreen Co. v. Hinchy , 21 N.E.3d 99, 107 (Ind. Ct. App. 2014) (quoting Celebration Fireworks, Inc. v. Smith , 727 N.E.2d 450, 453 (Ind. 2000) ), aff'd on reh'g , trans. denied . Furthermore, "an employee's wrongful act may still fall within the scope of employment if [her] purpose was, to an appreciable extent, to further [her] employer's business, even if the act was predominantly motivated by an intention to benefit the employee [herself]." Knighten v. E. Chi. Hous. Auth. , 45 N.E.3d 788, 792 (Ind. 2015) (citation omitted). On the other hand, "an employee's act is not within the scope of employment when it occurs within an independent course of conduct not intended by the employee to serve any purpose of the employer." Barnett v. Clark , 889 N.E.2d 281, 284 (Ind. 2008) (emphasis omitted) (quoting Restatement (Third) of Agency § 7.07(2) (Am. Law Inst. 2006) ).
[38] An employer is not held liable under the doctrine of respondeat superior because it did anything wrong, but "because of the [employer's] relationship to the wrongdoer." Sword , 714 N.E.2d at 147. "Ultimately, we have found that ‘the scope of employment encompasses the activities that the employer delegates to employees or authorizes employees to do, plus employees' acts that naturally or predictably arise from those activities.’ " Burton v. Benner , 140 N.E.3d 848, 852 (Ind. 2020) (quoting Cox v. Evansville Police Dep't , 107 N.E.3d 453, 461 (Ind. 2018) ). The scope of employment rule emanates from the concept of control. Cox , 107 N.E.3d at 461. More specifically, it springs from the employer's control over its employees and their employment activities: the employer controls whom it hires, what employment duties it assigns, how it empowers employees to carry out those duties, and how it guards against harm arising from employment activities. Id.
[39] "[I]t is well established that whether an employee's actions were within the scope of employment is a question of fact to be determined by the factfinder." Knighten , 45 N.E.3d at 794 (quoting Walgreen , 21 N.E.3d at 107 ). Even if some of the actions were unauthorized, the question of whether the actions were within the scope of employment is for the jury. Konkle v. Henson , 672 N.E.2d 450, 457 (Ind. Ct. App. 1996). Only if none of the employee's act were authorized is the question a matter of law that need not be submitted to the trier of fact. City of Fort Wayne v. Moore , 706 N.E.2d 604, 607 (Ind. Ct. App. 1999), trans. denied .
[40] Here, this case involves a question of fact regarding whether Katrina's actions were within the scope of her employment with Community. Community argues that "[b]ecause [Katrina] did not have a business need to access [Appellees'] records, and because she did so for solely personal reasons, Community cannot be held vicariously liable for her conduct[ ]" under respondeat superior. (Community's Br. 42).
[41] In support of its argument that Katrina was acting outside the scope of her employment, Community directs our attention to Robbins v. Trs. of Ind. Univ. , 45 N.E.3d 1 (Ind. Ct. App. 2015).
[42] In Robbins , this Court affirmed summary judgment in favor of a university hospital and a data security company on the issue of vicarious liability. A nurse, who was an employee of the university hospital, was generally authorized to access medical records as part of her employment. Despite signing a confidentiality agreement, the nurse accessed and then posted a patient's medical information on the internet. The nurse then pled guilty in federal court to the felony charge of wrongful disclosure of individually identifiable information. Thereafter, the patient filed a complaint against the university hospital and data security company wherein she alleged that the defendants were vicariously liable for the actions of the nurse. The university hospital and data security company filed summary judgment motions. As part of its designated evidence, the university hospital designated an affidavit by the nurse in support of its motion. In the affidavit, the nurse admitted that she accessed the patient's information solely for personal reasons and that she was acting on her own initiative and not within the scope of her employment. The affidavit further explained that the nurse was not involved in any way in the provision of medical care and that she knew that it was against her employer's policies and rules.
[43] In addressing the vicarious liability claim, this Court found that although the nurse was authorized to access patient information, the existence of the confidentiality agreement meant that the nurse was "expressly not authorized to access, use, or disclose the information for personal, unauthorized, unethical, or illegal reasons." Id. at 10 (emphasis in original). This Court continued its analysis by emphasizing that the nurse's affidavit, which was designated by the university hospital, stated that she had accessed the patient's medical records on "her own initiative and unrelated to any business function of her employment or her employer[.]" Id. In holding that the nurse's actions were outside the scope of her employment, the Robbins Court also noted that the nurse had pled guilty in federal court as a result of her wrongful act, and that the patient had never been treated in the nurse's department. Here, Community did not designate an affidavit detailing such an admission by Katrina. Furthermore, Katrina did not plead guilty in federal court as a result of her action. Thus, Community's reliance is misplaced because Robbins involved designated evidence indicating the employee acted for her own benefit.
[44] We, however, find our Court's decision in Walgreen Co. v. Hinchy , as relied upon by Appellees, to control the outcome here. In Hinchy , an employee pharmacist improperly accessed the prescription records of a Walgreen customer and divulged the information she had learned from those records to the customer's ex-boyfriend. The customer filed a complaint against Walgreen and the pharmacist, seeking respondeat superior liability against Walgreen for the pharmacist's actions, in addition to negligent training, supervision, and retention, as well as professional malpractice. Walgreen moved for summary judgment, and the trial court granted the motion with respect to the negligent training claim, but otherwise denied the motion. At the ensuing jury trial, the jury found in favor of the Walgreen customer.
[45] Walgreen appealed the partial denial of its motion for summary judgment and this Court affirmed. The Hinchy Court explained that the pharmacist was "authorized to use the Walgreen computer system and printer, handle prescriptions for Walgreen customers, look up customer information on the Walgreen computer system, review patient prescription histories, and make prescription-related printouts." Hinchy , 21 N.E.3d at 108. The Hinchy Court further noted that the pharmacist was at work and using Walgreen equipment when the actions occurred, and much of her conduct was of the same general nature as her ordinary job duties authorized by her employer. As a result, the Hinchy Court held that whether the pharmacist's actions were within the scope of the pharmacist's employment was properly determined by the jury rather than as a matter of law in a summary judgment proceeding.
[46] Here, as in Hinchy , Katrina's actions were of the same general nature as those authorized, or incidental to the actions that were authorized, by Community. There is no dispute that Katrina was authorized to use her assigned desktop computer with Epic and other software to access patient health information. There remains a question of fact regarding why and what Katrina did with Appellees' private health information. Because Katrina misused employer-conferred power and authority to access the health information, whether Katrina was acting within the scope of her employment is an issue to be determined by the trier of fact. See Knighten , 45 N.E.3d at 794. Accordingly, the trial court did not err when it denied Community's motion for summary judgment on Appellees' respondeat superior claim.
B. Negligent Training, Supervision, and Retention
[47] Community also argues that the trial court erroneously denied its motion for summary judgment on Appellees' negligent training, supervision, and retention claim.
[48] A claim for negligent training, supervision, and retention is a species of negligence. Negligence claims have three elements: (1) a duty owed by the defendant to the plaintiff; (2) a breach of that duty; and (3) injury to the plaintiff proximately caused by the defendant's breach. Scott v. Retz , 916 N.E.2d 252, 257 (Ind. Ct. App. 2009). In negligence cases, summary judgment is "rarely appropriate." Rhodes v. Wright , 805 N.E.2d 382, 387 (Ind. 2004). In order for Community to obtain summary judgment in its favor on the negligent training, supervision, and retention claim, it was required to designate evidence to affirmatively negate or demonstrate that one of the elements of Appellees' claim was not satisfied. See Jarboe , 644 N.E.2d at 123. Thus, our task on appeal is not to determine whether Appellees have proven each element of the negligent training, supervision, and retention claim. Rather, we must determine whether Community has adequately met its initial burden of proving an absence of any genuine issue of material fact or of affirmatively negating at least one element with respect to Appellees' claim. Community argues that it negated all the elements of negligence.
[49] Turning to the first element of negligence, duty, Community begins by arguing, correctly, that neither HIPAA nor INDIANA CODE § 16-39-5-3, as relied upon by the trial court, provide private rights of action. However, the absence of a private right of action under either statute does not necessarily resolve the issue before us. Our recent decision in Henry v. Cmty. Healthcare Sys. Cmty. Hosp. , 134 N.E.3d 435 (Ind. Ct. App. 2019), is instructive. In Henry , we held that "[t]here is an age-old recognition that medical providers owe a duty of confidentiality to their patients." Id. at 437. The Henry Court further explained that while this duty is codified by statute, the historical recognition of the duty at common law was unchanged. Id. at 437-38. Therefore, this Court concluded that "there is–and, in modern times, always has been–a common law duty of confidentiality owed by medical providers to their patients." Id. at 438.
[50] Community produced documents exhibiting its own recognition that its patients are entitled to confidentiality of their medical information. Furthermore, in response to a request for admission, Community admitted that "it had a responsibility to provide reasonable and appropriate safeguards to ensure confidentiality, integrity, and availability of the electronic protected health information of its patients." (App. Vol. VIII at 43). Accordingly, Community's argument that it negated the element of a duty owed to Appellees fails.
[51] Next, Community argues it "affirmatively negated any finding of breach[ ]" because it appropriately trained and supervised Katrina, and it was unaware of Katrina's misconduct or propensity to commit misconduct. (Community's Br. 45). Although the existence of duty is a matter of law for the court to decide, a breach of duty, which requires a reasonable relationship between the duty imposed and the act alleged to have constituted the breach, is usually a matter left to the trier of fact. Mangold ex rel. Mangold v. Ind. Dep't of Nat. Res. , 756 N.E.2d 970, 975 (Ind. 2001).
[52] Community designated evidence detailing the steps it took to implement and enforce policies and procedures governing employee training and education. However, in response, Appellees designated evidence supporting reasonable inferences that Katrina was not properly trained, supervised, and that she should not have been retained because Community had notice of her unauthorized access to health information prior to the breach. For example, the Appellees' designated a report from an expert in hospital management stating that the access to Appellees' health information occurred because "Community Health did not have proper systems and protocols in place regarding its employees use of protected health information, neither was there appropriate training and education for their staff, nor did they have effective auditing and monitoring in place. There is a definite lack of systems and procedures." (App. Vol. VIII at 9). The expert further stated that "[t]he fact that [Katrina] accessed private patient information and no one at the hospital was aware of the same for such a long period of time indicates that even if there are protocols in place, they are not being followed appropriately." (App. Vol. VIII at 10). Furthermore, Appellees designated evidence indicating that Katrina's supervisor had notice of Katrina's unauthorized access of other patients' health information prior to the subject actions here.
[53] Additionally, it is not enough for Community to point to its training and education materials that should have prevented Katrina's access of Appellees' health information. Indeed, our supreme court has held that "[e]ven though an employee violates the employer's rules, orders, or instructions, or engages in expressly forbidden actions, an employer may be held accountable for the wrongful act if the employee was acting within the scope of employment." Warner Trucking v. Carolina Cas. Ins. Co. , 686 N.E.2d 102, 105 (Ind. 1997). Thus, the conflicting designated evidence creates genuine issues of material fact as to whether Community breached its duty to protect the confidentiality of Appellees' records.
[54] Finally, Community argues that Appellees' negligent supervision, training, and retention claim "must fail because they failed to proffer any evidence of an injury which resulted from [it's] actions." (Community's Br. 48). However, it is well-settled that although federal practice permits the moving party to merely show that the party carrying the burden of proof at trial lacks evidence on a necessary element, Indiana state courts impose a more onerous burden: to affirmatively "negate an opponent's claim." Hughley , 15 N.E.3d at 1003 (citation omitted). Here, Community's designated evidence and argument in support of summary judgment on Appellees' injury do not affirmatively negate Appellees' claim. Moreover, the existence and extent of the damages to Appellees will need to be proven at trial. Therefore, the weight assigned to this yet-to-be-determined evidence is a question for the jury, and the trial court did not err in denying Community's motion for summary judgment on this issue.
C. Actionability of Underlying Claims
[55] As an offshoot of its argument that the trial court erred in denying summary judgment in its favor, Community also argues that even if Katrina was acting within the scope of her employment, it cannot be held vicariously liable for Katrina's actions because Appellees' underlying negligence and invasion of privacy/intrusion claims are not actionable under Indiana law. For the reasons stated above, we conclude that there are genuine issues of material fact as to whether Katrina violated Community's policies and Community's knowledge thereof regarding Appellees' negligence claim. However, we agree with Community that Appellees' claim for invasion of privacy/intrusion must fail.
[56] There are four sub-torts under invasion of privacy: (1) false light; (2) public disclosure of private facts; (3) intrusion upon seclusion; and (4) appropriation of likeness. Westminster Presbyterian Church of Muncie v. Yonghong Cheng , 992 N.E.2d 859, 868 (Ind. Ct. App. 2013), trans. denied . In this case, Appellee's have alleged the disclosure of private facts. In Doe v. Methodist Hosp. , our supreme court declined to recognize the sub-tort of public disclosure of private facts as an actionable claim. 690 N.E.2d 681, 693 (Ind. 1997). The court revisited the issue in Felsher v. Univ. of Evansville , explaining that its "discussion of [the history of the invasion of privacy tort] and the Second Restatement served as a prelude to [its] decision not to recognize a branch of the tort involving the public disclosure of private facts." 755 N.E.2d 589, 593 (Ind. 2001). See also F.B.C. v. MDwise, Inc. , 122 N.E.3d 834, 836-37 (Ind. Ct. App. 2019) (explaining that the tort of public disclosure has not yet been recognized in Indiana), trans. denied . Here, Appellees' complaint alleges that Katrina gave publicity to a matter that concerned their "private medical lives." (App. Vol. II at 63). Based on the above case law, Community cannot be held vicariously liable for a tort that has yet to be recognized.
[57] In regard to the intrusion claim, the F.B.C. Court also explained that "[i]ntrusion occurs when there has been an ‘intrusion upon the plaintiff's physical solitude or seclusion as by invading his home or conducting an illegal search.’ " Id. at 837 (quoting Cullison v. Medley , 570 N.E.2d 27, 31 (Ind. 1991) ). This Court further explained that we have "specifically chosen not to recognize claims of [i]ntrusion where the intrusion only invades plaintiff's emotional solace." Id. Because Appellees' do not claim any physical intrusion by Katrina, Community cannot be held vicariously liable for Appellees' intrusion claim. Therefore, to the extent that Appellees' respondeat superior claim is based on an underlying act of invasion of privacy/intrusion by Katrina, we conclude that Community is entitled to judgment as a matter of law
3. Conclusion
[58] For all of these reasons, the judgment of the trial court is affirmed in part, reversed in part, and remanded with instructions to grant summary judgment in favor of Community on Appellees' invasion of privacy/intrusion claim.
[59] Affirmed in part, reversed in part, and remanded with instructions.
Robb, J., and Mathias, J., concur.