Summary
holding that "there is no designated evidence that the Hospital disclosed the information to, or in a way that was sure to reach, the public or a large number of people"
Summary of this case from Fox v. Franciscan All.Opinion
Court of Appeals Case No. 22A-CT-2223
02-01-2023
Brittany RUBENDALL, on her own behalf and on behalf of those similarly situated, Appellant-Plaintiff, v. COMMUNITY HOSPITAL OF ANDERSON AND MADISON COUNTY, Appellee-Defendant.
Attorney for Appellant: Neal F. Eggeson, Jr., Fishers, Indiana Attorneys for Appellee: Jenny R. Buchheit, George A. Gasper, Sean T. Dewey, Indianapolis, Indiana
Attorney for Appellant: Neal F. Eggeson, Jr., Fishers, Indiana
Attorneys for Appellee: Jenny R. Buchheit, George A. Gasper, Sean T. Dewey, Indianapolis, Indiana
Altice, Chief Judge.
Case Summary
[1] Brittany Rubendall, on behalf of herself and others similarly situated, filed a putative class-action lawsuit against Community Hospital of Anderson and Madison County (the Hospital) for negligence and invasion of privacy based on public disclosure of private facts (PDPF). Prior to considering class certification, the trial court permitted the Hospital to file a motion for summary judgment, which the trial court granted. On appeal, Rubendall presents two issues for our review, which we restate as:
1. Did the trial court err in concluding that Rubendall's negligence claim failed as a matter of law because she could not satisfy the modified impact rule?
2. Did the trial court err in concluding that Rubendall's PDPF claim failed as a matter of law as there was no evidence to support a finding of publication?
[2] We affirm.
Facts & Procedural History
We held oral argument in Indianapolis on January 19, 2023. We commend counsel for both parties for the quality of their written and oral advocacy.
[3] Beginning in or around 2001, the Hospital used an email-to-pager messaging system to notify various departments and staff members of "an add-on same day surgery." Appellant's Appendix Vol. II at 114. This system transmitted protected health information (PHI) of affected patients using an unencrypted format over open radio airwaves. The PHI transmitted in this manner included the patient's name, age, date of birth, provider, procedure, and date of service.
[4] On or about July 1, 2019, Rubendall was scheduled to receive health care services from the Hospital. Because Rubendall's procedure was an add-on same day procedure, an email was sent to notify the surgery department and staff members of the schedule change. Specifically, at approximately 12:10 p.m., an employee of the Hospital sent an email with the subject "ADD ON TODAY" advising the surgery department and staff members of Rubendall's surgery scheduled for 4:30 p.m. The message was sent through the Hospital's email-to-pager messaging system.
[5] Prior to this date, a local news reporter had received a tip that the Hospital was transmitting PHI in such manner, prompting the reporter to begin an investigation into possible HIPAA violations. The reporter purchased an SDR radio and used it to intercept the Hospital's transmissions on or about July 1, 2019. Using freely available online software, the reporter was then able to decode the transmissions. In September 2019, the reporter contacted Rubendall and informed her that her PHI had been intercepted and translated. The reporter was able to recite Rubendall's date of birth, the date she received treatment at the Hospital's emergency room, and the diagnosis she received from the ER doctor.
SDR is an acronym for a software-defined radio.
Approximately three months after the instant action was filed, the Hospital started requiring the use of a Case ID in lieu of patient identifiers when using the email-to-pager messaging system. Soon thereafter, the Hospital stopped using this system altogether.
[6] On June 8, 2020, Rubendall, on behalf of herself and those similarly situated, filed a putative class-action lawsuit against the Hospital, generally asserting claims for negligence and invasion of privacy based on PDPF. On August 10, 2020, the Hospital moved to dismiss the complaint pursuant to Ind. Trial Rule 12(B)(6), which motion the trial court denied on August 24, 2020. Rubendall later filed an Amended Class Action Complaint in March 2021, and the Hospital filed its answer and affirmative defenses. The parties conducted some written discovery, but the matter was largely dormant until our Supreme Court issued its decision in Cmty. Health Network v. McKenzie , 185 N.E.3d 368 (Ind. 2022) on April 13, 2022, wherein the Court addressed the requirements for recovery of emotional distress damages in a negligence action and, after recognizing PDPF as a viable cause of action in Indiana, addressed the element of publicity as a required element thereof. In light of McKenzie , the Hospital filed a Motion to Stay Briefing on Class Certification so it could seek summary judgment. The trial court granted the motion.
Rubendall identified the proposed class as all current and former patients of the Hospital whose PHI was transmitted via the Hospital's email-to-pager messaging system.
Rubendall also asserted a claim for invasion of privacy by intrusion. She does not challenge the trial court's grant of summary judgment as to this claim.
The matter of class certification is still pending before the trial court. Thus, the facts and issues herein pertain only to Rubendall's claims as an individual.
[7] Following the parties’ briefing and designation of evidence, the trial court held a summary judgment hearing on August 4, 2022. On September 19, 2022, the court issued its order granting the Hospital's motion for summary judgment and entering final judgment against Rubendall and in favor of the Hospital. Specifically, the trial court, relying on McKenzie , concluded that Rubendall could not recover emotional distress damages on her negligence claim as she did not satisfy the modified-impact rule and that her claim for PDPF failed as the designated evidence negated the publicity element. Rubendall appealed. Additional facts will be provided as necessary.
Discussion
[8] We review summary judgment de novo and apply the same standard as the trial court. Hughley v. State , 15 N.E.3d 1000, 1003 (Ind. 2014). "Summary judgment is appropriate only where the evidence shows there is no genuine issue of material fact and the moving party is entitled to a judgment as a matter of law." Strickholm v. Anonymous Nurse Prac. , 136 N.E.3d 264, 267 (Ind. Ct. App. 2019). "A fact is ‘material’ if its resolution would affect the outcome of the case, and an issue is ‘genuine’ if a trier of fact is required to resolve the parties’ differing accounts of the truth, or if the undisputed material facts support conflicting reasonable inferences[.]" Williams v. Tharp , 914 N.E.2d 756, 761 (Ind. 2009) (citations omitted).
[9] "To prevail on a motion for summary judgment, a party must demonstrate that the undisputed material facts negate at least one element of the other party's claim." Strickholm , 136 N.E.3d at 267. "Once the moving party has met this burden with a prima facie showing, the burden shifts to the nonmoving party to establish that a genuine issue does in fact exist." Id. (italics omitted). "Our review of a summary judgment ruling is limited to those materials designated to the trial court." Millikan v. City of Noblesville , 160 N.E.3d 231, 236 (Ind. Ct. App. 2020). " ‘In determining whether there is a genuine issue of material fact precluding summary judgment, all doubts must be resolved against the moving party and the facts set forth by the party opposing the motion must be accepted as true.’ " Strickholm , 136 N.E.3d at 267 (quoting Lawlis v. Kightlinger & Gray , 562 N.E.2d 435, 438-39 (Ind. Ct. App. 1990), trans. denied ). "The party appealing the summary judgment bears the burden of persuading us that the trial court erred." Id. Our Supreme Court has observed that summary judgment is a "relatively high bar," and we should "consciously err[ ] on the side of letting marginal cases proceed to trial on the merits, rather than risk short-circuiting meritorious claims." Hughley , 15 N.E.3d at 1004.
McKenzie
[10] We begin our analysis with discussion of our Supreme Court's recent decision in McKenzie , upon which the trial court relied in granting summary judgment in favor of the Hospital. In that case, a medical-records coordinator for a hospital, who had access to confidential medical records, improperly accessed and disclosed the confidential medical records of several individuals, including the plaintiffs. The plaintiffs filed a complaint against the hospital seeking to hold it vicariously liable for the coordinator's negligence and for invasion of privacy based on PDPF and directly liable for negligent training, supervision, and retention. After the trial court denied the hospital's motion to dismiss and motion for summary judgment, the hospital appealed.
[11] This court upheld the denial of the motion to dismiss and the denial of summary judgment as to all claims except for the invasion of privacy claim. With regard to the latter, this court held that the Hospital was entitled to judgment as a matter of law "because the subtort at issue—public disclosure of private facts—is not recognized in Indiana." McKenzie , 185 N.E.3d at 375 (citing Cmty. Health Network, Inc., v. McKenzie , 150 N.E.3d 1026, 1044-45 (Ind. Ct. App. 2020), trans. granted ).
[12] On transfer, our Supreme Court noted that the plaintiffs’ alleged damages were "fear, anxiety, or sadness—emotional distress—from [the coordinator's] unauthorized access and disclosure of their private medical records." 185 N.E.3d at 379. While acknowledging that their distress was "understandable," the Court nevertheless reaffirmed that "emotional-distress damages are recoverable in negligence-based claims only when a party can satisfy (1) the modified-impact rule or (2) the bystander rule." Id. (citing Spangler v. Bechtel , 958 N.E.2d 458, 466, 471 (Ind. 2011) ). Under the modified-impact rule, the plaintiff must show that they "personally sustained a physical impact." Id. (quoting Spangler , 958 N.E.2d at 467 ). Under the bystander rule, the plaintiff must "contemporaneously perceive[ ] a loved one's negligently inflicted death or serious injury." Id. The McKenzie Court concluded that the plaintiffs failed to satisfy either and, thus, could not recover for their claimed emotional distress damages. Because the undisputed facts negated the damages element, the Court held that the hospital was entitled to summary judgment on plaintiffs’ negligence claim.
[13] Turning to the plaintiffs’ claim for PDPF, the McKenzie Court explicitly recognized, for the first time, the viability of an invasion-of-privacy claim via PDPF in Indiana. In so doing, the Court expressly adopted the elements as set forth in the RESTATEMENT ( SECOND ) OF TORTS : PUBLICITY GIVEN TO PRIVATE LIFE § 652D (the Restatement): (1) the information disclosed must be private in nature; (2) the disclosure must be made to the public; (3) the disclosure must be one that would be highly offensive to a reasonable person; and (4) the information disclosed is not of legitimate public concern. McKenzie , 185 N.E.3d at 380.
[14] The McKenzie Court considered the second element and explained that publicity means that "the information must be communicated in a way that either reaches or is sure to reach the public in general or a large enough number of persons such that the matter is sure to become public knowledge." Id. at 383 (citing the Restatement). The Court noted that in determining whether a communication gives sufficient "publicity" to support a PDPF claim, courts should consider the facts and circumstances of each case. Id.
[15] The McKenzie Court determined that the designated evidence showed, at best, that the coordinator may have disclosed information from the plaintiffs’ medical records to members of the coordinator's own family. The Court held that such did not satisfy the publicity element. Id. (citing the Restatement ("a communication to a small group of persons is generally not actionable"). The Court further noted that there was no evidence in the record that the coordinator disclosed the information "to, or in a way that was sure to reach the public or a large number of people." Id. The Court therefore held that because the undisputed evidence negated the element of publicity, the trial court properly granted summary judgment in favor of the hospital. Id. at 383. We now turn to the case at hand.
1. Negligence
[16] Rubendall asserts that a claim for "loss of privacy" arising from a breach of medical privacy should be regarded as separate and distinct from a claim for emotional distress damages. She maintains that the trial court and the Hospital erroneously conflate the two different claims for damages to use the modified-impact rule to preclude recovery for either. She asks this court to declare that loss of privacy is an available claim for damages in negligence-based privacy actions and that the modified-impact rule does not preclude recovery therefor. See Appellant's Reply Brief at 5, 15-17.
[17] Rubendall admits that she has not suffered any physical or economic damages but alleges that she has "suffered an irreparable loss of privacy which, in turn, results in embarrassment, stress, and anxiety." Appellant's Appendix Vol. II at 132. In McKenzie , our Supreme Court identified the plaintiffs’ claimed damages as "fear, anxiety, or sadness," which the Court characterized as "emotional distress." 185 N.E.3d at 379.
[18] Here, Rubendall labels her damages as "loss of privacy," which she associates with "embarrassment, stress, and anxiety." Appellant's Appendix Vol. II at 132. As in McKenzie , we conclude that, despite the label attached, Rubendall is seeking recovery for emotional distress damages through her negligence claim. It has been less than a year since our Supreme Court reaffirmed that the modified-impact rule operates to bar a claim for emotional distress damages in a negligence action based on a breach of medical privacy where the plaintiff cannot show that they "personally sustained a physical impact." Id. (quoting Spangler , 958 N.E.2d at 467 ). We are bound by our Supreme Court's decision and therefore apply the modified-impact rule to Rubendall's negligence claim. Because she admits that she has not suffered any physical impact, her negligence claim fails as a matter of law. The trial court did not err in granting summary judgment in favor of the Hospital.
2. Invasion of Privacy - PDPF
[19] As in McKenzie , here, the Hospital sought and obtained summary judgment as to the element of publicity. Rubendall argues that the circumstances of this case are distinguishable from McKenzie . First, she characterizes the Hospital's broadcasting of patients’ PHI over short-wave radio airwaves without encryption to roughly 50,000+ people (in the Anderson area) as publicity per se. In support of this argument, Rubendall relies on Yath v. Fairview Clinics, N.P. , 767 N.W.2d 34 (Minn. Ct. App. 2009).
[20] In Yath , private information was disclosed when it was posted on a public webpage for anyone to view, even though the evidence showed that the information was viewed by only a small number of people. In considering the circumstances, the Yath court found the internet communication to be "materially similar in nature to a newspaper publication or a radio broadcast because upon its release it is available to the public at large." Id. at 43 (emphasis supplied). Rather than looking to whether a private communication reached a sufficient number of individuals such that the information is deemed to have been communicated to the public, the Yath court focused on the fact that the communication was offered in a public forum. In such case, the court found that the number of actual viewers was irrelevant and that publicity occurred and the tort was triggered when the information was made publicly available. Rubendall argues that "one is hard-pressed to imagine a more public disclosure than broadcasting information unencrypted over open radio airwaves." Appellant's Brief at 13. [21] Likening the circumstances of this case to those in McKenzie where the disclosure was to only a few persons, the Hospital points out that here the designated evidence shows that only one unauthorized person—the reporter—intercepted and decoded the Message. The Hospital thus asserts that the disclosure was not made to the public. The Hospital maintains that, as in McKenzie , communication to a small number of persons (i.e., one) is not actionable. The Hospital also argues that the record is devoid of evidence that the information was disclosed to, or in a way that was sure to reach, the public or a large number of people. The Hospital asserts that the designated evidence negates the publicity element and that, therefore, the trial court properly granted summary judgment in its favor on Rubendall's PDPF claim. We agree.
In a footnote, Rubendall directs us to two federal cases. First, she cites Tureen v. Equifax, Inc. , 571 F.2d 411, 417-18 (8th Cir. 1978), in which the court noted generally that "any broadcast over the radio" is sufficient to establish publicity within the meaning of that term as it is used in the Restatement. She also cites for comparison McKamey v. Roach , 55 F.3d 1236, 1239-40 (6th Cir. 1995), wherein the court discussed the lack of an expectation of privacy in cordless telephone communications because such are broadcast over the radio waves "to all who wish to overhear" and noted that such radio waves "are easily intercepted."
[22] We first note that Yath has no precedential value and that, in any event, it is distinguishable. We find that it is fundamentally different to post information on a public webpage as in Yath than to transmit information via short-wave radio airwaves. As pointed out by the Hospital, one had to have a special radio and then take a separate step of downloading special software from the internet to decode the information the Hospital transmitted via short-wave radio airwaves. This is quite different than a broadcast over traditional radio airwaves where members of the public can hear what is being broadcast with their car radio or home stereo systems. The Hospital notes too that the transmission containing Rubendall's PHI could be intercepted only at a precise moment in time and was not otherwise accessible outside of that moment.
[23] For these reasons, the Hospital's transmission of PHI via short-wave radio airwaves between departments is not actionable here. As in McKenzie , where our Supreme Court concluded as a matter of law that the designated evidence did not support a finding of publicity, we likewise conclude that there is no designated evidence that the Hospital disclosed the information to, or in a way that was sure to reach, the public or a large number of people. But see Z.D. v. Cmty. Health Network, Inc. , 197 N.E.3d 330 (Ind. Ct. App. 2022) (holding that where hospital addressed letter containing plaintiff's diagnosis to incorrect recipient and then that person posted the letter on Facebook, the matter of publicity was a question of fact), trans. pending. The trial court did not err in granting summary judgment in favor of the Hospital on Rubendall's PDPF claim.
Both sides sought transfer to the Supreme Court. Several amicus curiae have been granted permission to appear. As of January 23, 2023, transfer remains pending.
[24] Judgment affirmed.
Brown, J. and Tavitas, J., concur.