Opinion
Court of Appeals Case No. 21A-PL-1738
12-08-2021
FRANCISCAN ALLIANCE, INC., Appellant-Plaintiff, v. Christina A. PADGETT, Appellee-Defendant.
Attorneys for Appellant: Kristopher N. Kazmierczak, R. Brock Jordan, Christopher L. Riegler, Katz Korin Cunningham PC, Indianapolis, Indiana Attorneys for Appellee: Ryan W. Sullivan, Andrew Dutkanych, III, Biesecker Dutkanych & Macer, LLC, Indianapolis, Indiana
Attorneys for Appellant: Kristopher N. Kazmierczak, R. Brock Jordan, Christopher L. Riegler, Katz Korin Cunningham PC, Indianapolis, Indiana
Attorneys for Appellee: Ryan W. Sullivan, Andrew Dutkanych, III, Biesecker Dutkanych & Macer, LLC, Indianapolis, Indiana
Bailey, Judge.
Case Summary
[1] Christina A. Padgett ("Padgett"), while employed by Franciscan Alliance, Inc. ("Franciscan"), accessed confidential information about a patient. The State of Indiana subsequently sued Franciscan for violations of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), citing Padgett's access of confidential protected health information ("PHI") as evidence of Franciscan's inadequate procedures to protect such information. Franciscan entered into a settlement agreement with the State under which it agreed to comply with HIPAA's requirements and pay damages in the amount of $80,000. Franciscan subsequently sued Padgett for breach of contract, breach of fiduciary duty, negligence, and indemnification. Franciscan now appeals the trial court order denying it summary judgment and granting Padgett summary judgment on all of Franciscan's claims.
[2] We affirm in part, reverse in part, and remand with instructions.
Issues
[3] We restate the issues raised by Franciscan as the following dispositive issues:
I. Whether the undisputed designated evidence establishes that Franciscan's claims against Padgett are time barred.
II. Whether the undisputed designated evidence establishes the existence of a contract between Padgett and Franciscan.
III. Whether the undisputed designated evidence establishes whether Padgett was authorized to access the confidential patient information at issue.
IV. Whether the undisputed designated evidence establishes whether Padgett's access of confidential patient information caused Franciscan's alleged damages.
Facts and Procedural History
[4] Padgett was hired by Indiana Heart Physicians, Inc. in or around February of 2008. On January 1, 2010, Franciscan acquired Indiana Heart Physicians, Inc., and Franciscan employed Padgett in the position of patient service representative until her resignation on April 11, 2014.
Franciscan is a medical health provider, d/b/a "Franciscan Physician Network." App. at 96.
[5] In her position with Franciscan, Padgett had access to confidential patient information. On November 11, 2011, Padgett signed a document entitled "Franciscan Alliance, Inc. ("FA") Workforce Confidentiality Agreement ("Agreement")" ("the Agreement"). The Agreement stated in relevant part:
On February 5, 2008—almost two years before Franciscan acquired Indiana Heart Physicians, Inc.—Padgett had signed a document entitled "Indiana Heart Physicians, Inc. Confidentiality Statement." As Franciscan was not party to that agreement, the Confidentiality Statement is not at issue in this case. See generally Doe v. Carmel Operator, LLC , 160 N.E.3d 518, 522 (Ind. 2021) (noting one not a party to the contract may directly enforce the contract as a third party beneficiary only if the contracting parties clearly intended to directly benefit the non-party by imposing a duty in his favor).
* * *
2. Access to Confidential Information. I ... hereby acknowledge that in and as a result of my relationship to FA:
a. I may have Access to certain Confidential Information but only for legitimate business purposes;
* * *
3. General Covenants and Conditions. ... I further agree that I will not, at any time, during or following the term of my FA relationship, directly or indirectly, Access any such Confidential Information without the prior express written consent of an authorized FA representative, except to the extent permitted by law, regulation[,] and FA policies, procedures, standards[,] and other applicable requirements ("Applicable Requirements").
... By signing this Agreement, I hereby agree that ... my obligations shall include, but are not limited to, the following:
a. Accessing any and all Confidential Information of FA only for legitimate business purposes in accordance with Applicable Requirements;
...
c. Safeguarding all Confidential Information from any inappropriate or unauthorized Access;
* * *
4. Violations. I acknowledge that any inappropriate or unauthorized Access to Confidential Information is a serious violation.
* * *
I understand that by signing this agreement I must only use and access information that is needed to perform my job duties, and inappropriate use or disclosure of information on my part may result in legal action, including personal liability. ...
App. at 73-74 (emphasis in original).
[6] During a period between October 2012 and April 2014, Padgett periodically accessed the confidential information of a particular patient for the alleged purpose of learning when the patient would be at Padgett's workplace so that Padgett could avoid the patient's alleged harassment of Padgett.
[7] On August 21, 2018, the State of Indiana filed a lawsuit in federal court against Franciscan for its alleged HIPAA violations. The State's complaint alleged Franciscan had inadequate procedures in place to protect patients’ PHI from unauthorized access, as required under HIPAA. Specifically, the complaint stated that Franciscan had inadequate procedures relating to: information access monitoring, responses to security incidents, and termination of unauthorized access to patient information. The complaint further alleged that Franciscan did not retain written records of its policies and procedures as required under HIPAA, and that Franciscan had not updated its policies in a timely manner. The complaint alleged that, between October 1, 2012, and March 25, 2014, Padgett had frequently accessed a particular patient's PHI when such access was "not required for Padgett's work." App. at 99. The State further alleged that Franciscan did not learn of Padgett's alleged unauthorized access until the patient complained about the access, and Franciscan did not end the alleged unauthorized access prior to Padgett's resignation on April 11, 2014. The State sought an injunction to enjoin Franciscan from "further violations" of HIPAA requirements, and it also sought statutory damages pursuant to HIPAA. Id. at 100.
[8] On August 30, 2018, Franciscan entered into a settlement agreement with the State of Indiana under which Franciscan agreed to comply with specified HIPAA regulations regarding Franciscan's policies and procedures, including "implement[ing]" policies and procedures relating to information access monitoring and responses to security incidents. App. at 105. Franciscan also agreed to pay $80,000 to the Indiana Attorney General. The parties agreed to entry of final judgment in conformity with the settlement agreement terms. Neither party made any admissions in the settlement agreement regarding whether Padgett's access of the patient information was unauthorized or whether Franciscan had violated any provisions of HIPAA.
[9] On September 12, 2018, Franciscan filed its complaint against Padgett in this cause. The complaint raised breach of contract, breach of fiduciary duty, negligence, and indemnification claims. Franciscan sought an order that Padgett pay the $80,000 Franciscan had paid the State of Indiana to settle the HIPAA lawsuit and expenses and costs Franciscan had incurred "as a direct and proximate result of [Padgett's] improper actions." App. at 18. On October 3, 2018, Padgett filed her answer and a counterclaim against Franciscan for bringing an allegedly frivolous lawsuit.
[10] On December 17, 2020, Franciscan filed a motion for summary judgment on all its claims. In support of its motion, Franciscan designated evidence that included the affidavit of Douglas Essex ("Essex"), legal counsel employed by Franciscan, in which he stated that "Padgett had inappropriately accessed the patient's PHI without a legitimate business need." App. at 70. Attached to Essex's affidavit as Exhibit D were three pages of materials Essex stated were "a transcript of the training Padgett received which includes her training on protecting PHI and select excerpts of training slides from presentations provided to Padgett." App. at 69, 82-84. The documents in designated Exhibit D list eighteen "identifiers of PHI defined by HIPAA" and also state, in relevant part:
Exhibit D consists only of three pages that appear to be the training slides to which Essex referred.
Minimum Necessary – Accessing only the information you need to do your job, and nothing additional.
As a workforce member, you will have access to a lot of information, [sic] remember , you only can access information you need to do your job.
Your authorized access is a job privilege which you may use for work purposes. You have an obligation to our organization to limit your access of information to the minimum necessary to perform your job duties.
* * *
[A] violation occurs when workforce members knowingly violate our Privacy or Security policies, access, use, or disclose PHI in violation of HIPAA for personal or financial gain or to bring harm or malice to others.
Some examples of this are:
* * *
– Unauthorized and intentional access to PHI for other unlawful, unethical[,] or other unprofessional purposes. ...
App. at 83-84 (emphasis in original) .
Franciscan included in its memorandum in support of its motion for summary judgment and in its appeal brief alleged portions of Franciscan's training materials that define the term "protected health information." App. at 52; Appellant Br. at 13. Franciscan cites to Exhibit D of Essex's affidavit as containing those portions. However, that Exhibit does not contain the portions of the alleged training materials defining the term protected health information; therefore, we disregard any reference to the same.
[11] On January 19, 2021, Padgett filed a cross-motion for summary judgment on all of Franciscan's claims and on her counter-claim. Padgett's designated evidence included her affidavit in which she stated that she accessed the information on the particular patient at issue in order to avoid the patient's alleged harassment of Padgett. Specifically, Padgett alleged she accessed the information only to learn on which dates and times the patient had appointments in the office where Padgett worked, so that Padgett could avoid further contact with the patient.
[12] Franciscan filed supplemental designated evidence that included an affidavit of Mary Jocelyn Stevenson ("Stevenson"), Padgett's former supervisor at Franciscan. Stevenson stated, in pertinent part,
Ms. Padgett had the same access to patient schedules and patient registration that is available to all of the scheduling and registration employees in the department. Ms. Padgett did not require access to a patient's clinical information to determine when the patient will be in the office for an appointment.
App. at 164.
[13] On May 27, 2021, the trial court denied Franciscan's summary judgment motion and granted Padgett's summary judgment motion on all of Franciscan's claims. The trial court also denied Padgett's motion for summary judgment on her counter-claim and entered judgment for Franciscan on that claim. Franciscan now appeals the summary judgment order entered on all its claims.
Padgett does not appeal the judgment entered on her counter-claim.
Discussion and Decision
Standard of Review
[14] Both parties moved for summary judgment on Franciscan's claims. We review a grant or denial of a motion for summary judgment under the same standard used by the trial court; that is,
[t]he moving party bears the initial burden of making a prima facie showing that there are no genuine issues of material fact and that it is entitled to judgment as a matter of law. Summary judgment is improper if the movant fails to carry its burden, but if it succeeds, then the nonmoving party must come forward with evidence establishing the existence of a genuine issue of material fact. In determining whether summary judgment is proper, the reviewing court considers only the evidentiary matter the parties have specifically designated to the trial court. See Ind. Trial R. 56(C), (H). We construe all factual inferences in the non-moving party's favor and resolve all doubts as to the existence of a material issue against the moving party. The fact that the parties have filed cross-motions for summary judgment does not alter our standard for review, as we consider each motion separately to determine whether the moving party is entitled to judgment as a matter of law.
Reed v. Reid , 980 N.E.2d 277, 285 (Ind. 2012) (case quotations and citations omitted). In reviewing a summary judgment, we "consciously err on the side of letting marginal cases proceed to trial on the merits, rather than risk short-circuiting meritorious claims." Hughley v. State , 15 N.E.3d 1000, 1004 (Ind. 2014).
Statutes of Limitation
[15] Indiana law provides that:
An action relating to the terms, conditions, and privileges of employment except actions based upon a written contract (including, but not limited to, hiring or the failure to hire, suspension, discharge, discipline, promotion, demotion, retirement, wages, or salary) must be brought within two (2) years of the date of the act or omission complained of.
Ind. Code § 34-11-2-1. An action based upon a written contract "must be commenced within ten (10) years after the cause of action accrues." I.C. § 34-11-2-11. The party pleading a statute of limitation bears the burden of proving the lawsuit was commenced beyond the statutory time allowed. Cooper Indus., LLC v. City of S. Bend , 899 N.E.2d 1274, 1279 (Ind. 2009). The determination of when a cause of action accrues is generally a question of law. Id. at 1280.
[16] It is well established in Indiana that a statute of limitation does not begin to run until all the elements of a cause of action can be shown. Id.
In the American legal system, demonstrated harm is an indispensable element of virtually every type of civil claim. In cases ranging from contract to tort to medical malpractice, a claimant cannot recover a monetary judgment unless he has suffered actual damage. The law does not usually permit monetary recovery for claims solely involving future damages; rather, some damage must have already begun to occur. This notion that the statute of limitation begins to run when all the elements of a cause of action can be shown (including whether some damages have been felt) is part of how we determine when a cause "accrues."
Pflanz v. Foster , 888 N.E.2d 756, 758-59 (Ind. 2008) (citation omitted); see also Cooper Industries , 899 N.E.2d at 1284 ("A statute of limitation does not begin to run against a cause of action before that cause of action exists, i.e., before a judicial remedy is available to the plaintiff." (citation omitted)). Thus, a cause of action accrues when a wrongfully inflicted injury causes some ascertainable damage, though it is not necessary that the extent of damage be known or ascertainable. Estate of Spry v. Batey , 804 N.E.2d 250, 252-53 (Ind. Ct. App. 2004), trans. denied.
[17] Here, Franciscan sued Padgett for breach of contract, breach of fiduciary duty, negligence, and indemnification. It is an essential element of each of those causes of action that the injury—i.e., the alleged breach of contract and/or common law duty—caused some harm to Franciscan. Franciscan designated undisputed evidence that it suffered monetary damages, allegedly as a result of Padgett's alleged wrongful actions, when it was sued by the State of Indiana in August 2018 and settled that lawsuit the following month. Thus, Franciscan's claims did not accrue, and the statute of limitations did not begin to run, until August of 2018 at the earliest. Franciscan filed all its claims against Padgett the following month. Therefore, even assuming the applicable statute of limitation was two years, all of Franciscan's claims were timely filed. See I.C. § 34-11-2-1.
See, e.g. , Haegert v. Univ. of Evansville , 977 N.E.2d 924, 937 (Ind. 2012) (noting a breach of contract claim requires proof of damages resulting from the breach); Jaffri v. JPMorgan Chase Bank, N.A. , 26 N.E.3d 635, 639 (Ind. Ct. App. 2015) (noting a breach of fiduciary duty requires proof the breach of duty caused harm to the beneficiary); Goodwin v. Yeakle's Sports Bar & Grill, Inc. , 62 N.E.3d 384, 386 (Ind. 2016) (noting a negligence claim requires proof of a compensable injury proximately caused by a breach of duty); Underwood v. Fulford , 128 N.E.3d 519, 525 (Ind. Ct. App. 2019) (noting the obligation to indemnify does not arise until the party seeking indemnity suffers loss or damages).
Because Franciscan filed its breach of contract claim well within the two-year statute of limitations, we need not decide whether the longer ten-year statute of limitations for written contract claims under Indiana Code Section 34-11-2-11 applies, as Franciscan claims.
[18] Padgett contends that the two-year statute of limitations on all of Franciscan's claims began to run on March 25, 2014, when Franciscan first learned of Padgett's alleged wrongful actions. However, Padgett designated no undisputed evidence showing that her alleged wrongful actions—i.e., the alleged injury—caused any ascertainable harm to Franciscan on March 25, 2014, or at any time thereafter, until the State sued Franciscan.
[19] The undisputed designated evidence indicates that Franciscan did not suffer any ascertainable alleged harm from Padgett's alleged wrongful actions until the State sued Franciscan in August of 2018. The undisputed designated evidence also establishes that Franciscan sued Padgett within two years of that alleged harm. Therefore, Franciscan filed its claims in a timely manner and is entitled to judgment on that issue as a matter of law. The trial court erred in granting Padgett summary judgment, and denying Franciscan summary judgment, on the issue of timeliness of the claims.
Existence of a Contract
[20] The basic requirements for a contract are offer, acceptance, consideration, and a meeting of the minds between the contracting parties on all essential elements or terms of the contract. See Perrill v. Perrill , 126 N.E.3d 834, 840-41 (Ind. Ct. App. 2019), trans. denied. When the terms of a purported contract are clear and unambiguous, we will apply the plain and ordinary meaning of those terms and enforce the contract accordingly. Id. Under such circumstances, "contract cases are particularly suited for summary judgment." Id. However, when a purported "contract's terms are ambiguous or uncertain and its interpretation requires extrinsic evidence, its construction is a matter for the fact-finder." Johnson v. Johnson , 920 N.E.2d 253, 256 (Ind. 2010). A contract's terms are ambiguous "only when reasonably intelligent persons would honestly differ as to the meaning of those terms." Perrill , 126 N.E.3d at 841 (internal quotation and citation omitted).
[21] Here, although it is clear from the face of the Agreement that Padgett accepted its terms, it is not clear what "offer"—if any—she accepted or what consideration was given. Franciscan claims the contract offered Padgett continued at-will employment and that was the consideration for her acceptance of the contract. However, the language of the document is not clear on that point; certainly it does not explicitly state that it is offering Padgett such employment in exchange for her acceptance of the confidentiality terms. The document states that Padgett has access to confidential information "as a result of [her] relationship with [Franciscan]." App. at 73. It further states that her employment could be terminated if she violated the terms of the agreement, thus implying that her continued employment is conditioned upon her acceptance and compliance with the agreement. However, reasonable persons could differ as to the meaning of that ambiguous language. The interpretation of the document requires extrinsic evidence, such as testimony from the parties, regarding whether the Agreement contains an offer and consideration in the form of continued at-will employment. That question must be resolved by a fact-finder, not by a court on a motion for summary judgment.
See Ackerman v. Kimball Intern., Inc. , 652 N.E.2d 507, 509 (Ind. 1995) (adopting and incorporating Court of Appeals decision that a promise to continue at-will employment may be valid consideration for a contract).
Breach of Contract and/or Duty
[22] To prevail on its breach of contract claim, Franciscan must prove not only the existence of a contract between it and Padgett, but also Padgett's breach of that contract, and damages to Franciscan resulting from Padgett's breach. See, e.g., Haegert v. Univ. of Evansville , 977 N.E.2d 924, 937 (Ind. 2012). To prevail on its breach of fiduciary duty claim, Franciscan must prove the existence of a fiduciary duty, a breach of the duty owed by Padgett to Franciscan, and harm to Franciscan from Padgett's breach. See, e.g., Butler v. Symmergy Clinic, PC , 158 N.E.3d 407, 414 (Ind. Ct. App. 2020). Similarly, to prevail on its negligence claim, Franciscan must show a duty owed to Franciscan by Padgett, Padgett's breach of her duty by allowing her conduct to fall below the applicable standard of care, and a compensable injury to Franciscan proximately caused by Padgett's breach of duty. See, e.g., Bojak's Bar & Grille v. Henry , 170 N.E.3d 264, 266 (Ind. Ct. App. 2021).
[23] Even assuming, arguendo , the existence of a contract and the existence of a duty owed by Padgett to Franciscan, summary judgment is not appropriate because there are genuine issues of material fact regarding whether Padgett breached the contract and/or her common law duty.
[24] The Agreement between Padgett and Franciscan states that Padgett will access confidential information only for "legitimate business purposes." App. at 73. However, neither the document itself nor any of the designated evidence establish the meaning of that term. Padgett contends she accessed the confidential information in order to achieve the legitimate business purpose of avoiding harassment in the workplace. That claim finds some support in the training materials Franciscan designated, which allow access to confidential information "necessary to perform ... job duties" and only prohibit access to confidential information when the access is "for personal financial gain or to bring harm or malice to others." Id. at 82-83. Franciscan, on the other hand, designated an affidavit from Essex stating that an audit by Franciscan determined that Padgett "had inappropriately accessed the patient's PHI without a legitimate business need." Id. at 70. These are genuine issues of material fact that must be resolved by the finder of fact.
There is no designated evidence establishing that Padgett "conceded" that her access of the confidential information was "unauthorized and for personal use," as Franciscan claims. Appellant's Br. at 15.
[25] Similarly, even if we assume Padgett owed Franciscan a common law duty of loyalty, see Smith v. Taulman , 20 N.E.3d 555, 569 (Ind. Ct. App. 2014) (noting an employee owes his employer a fiduciary duty of loyalty) (citation omitted), and/or reasonable care, see, e.g., Franklin v. Benock , 722 N.E.2d 874, 878-79 (Ind. Ct. App. 2000) (discussing the duty, under a negligence analysis, to exercise reasonable care under the circumstances), trans. denied , there are genuine issues of material fact as to whether she breached that duty. It is up to a fact-finder to weigh the conflicting evidence to determine whether or not Padgett accessed the confidential information in conformity with her duty to Franciscan.
Cause of Damages
[26] The existence of damages caused by Padgett's alleged actions is a necessary element of all of Franciscan's claims. But, even if we could say that Padgett's actions constituted a breach of an enforceable contract and/or a common law duty to Franciscan, there are genuine issues of material fact regarding whether any such breach caused Franciscan's alleged damages.
See, e.g., Haegert , 977 N.E.2d at 937 (regarding breach of contract); Butler , 158 N.E.3d at 414 (regarding breach of fiduciary duty); Bojak's Bar & Grille , 170 N.E.3d at 266 (regarding negligence); INS Investigations Bureau, Inc. v. Lee , 784 N.E.2d 566, 576 (Ind. Ct. App. 2003) (regarding indemnity), trans. denied.
[27] Neither party designated undisputed evidence that would establish whether or not Padgett was the cause of Franciscan's monetary damages stemming from the State's HIPAA lawsuit. Padgett contends that it was Franciscan's inadequate HIPAA procedures that caused the State to sue it, and we note that Franciscan agreed in the settlement of the HIPAA case to "implement" procedures required by HIPAA. Padgett further asserts that she would not have been able to access the confidential information if Franciscan had had adequate HIPAA procedures in place. Franciscan, on the other hand, alleges that it had adequate procedures in place and points out that it did not admit to having inadequate procedures in its settlement of the HIPAA lawsuit. Franciscan contends that the State would not have sued it over the alleged HIPAA violations if not for Padgett's unauthorized access of PHI.
[28] Neither party has pointed to undisputed designated evidence that establishes its claims regarding the cause of Franciscan's alleged damages. As we have previously noted, "[t]he question of causation is usually inappropriate for summary disposition because it often requires a weighing of disputed facts." Franklin v. Benock , 722 N.E.2d 874, 880 (Ind. Ct. App. 2000), trans. denied. Such is the case here.
Conclusion
[29] The undisputed designated evidence establishes that all of Franciscan's claims were brought within the two-year statute of limitations. Therefore, to the extent summary judgment in favor of Padgett was based on the claims having been time barred, we reverse.
[30] However, neither party designated evidence establishing whether Padgett was authorized to access the confidential patient information at issue or, if she was not, whether her unauthorized actions caused the damages Franciscan incurred in the State's HIPAA lawsuit against it. Therefore, as to Franciscan's contract, tort, and indemnification claims, we affirm denial of summary judgment for Franciscan, reverse summary judgment in favor of Padgett, and remand for further proceedings consistent with this decision.
[31] Affirmed in part, reversed in part, and remanded with instructions.
Mathias, J., and Altice, J., concur.