Opinion
Court of Appeals Case No. 24A-CT-47
06-05-2024
Alexa HARRIS, Jillian Tomes, Alisha Bonneville, Ashley Schimmelman, Madison Hillyard, Alyssa Leffler, Tori Hildebrandt, Devan Grammer, Samantha Robbins, Olivia Baird, Addison Lenn, Amy Seibert, and Nicole Haag, Appellants-Plaintiffs v. DEACONESS HOSPITAL, INC., Deaconess Hospital Systems, Inc., Deaconess Clinic, Inc., Deaconess Clinic at Work, and Akitto Ledda, D.O., Appellees-Defendants
Attorneys for Appellants: Neal F. Eggeson, Jr., Eggeson Privacy Law, Fishers, Indiana, Taylor D. Ivy, Ladendorf Law, Indianapolis, Indiana Attorneys for Appellees: James L. Whitlatch, Kathryn E. DeWeese, Ryan M. Heeb, Bunger & Robertson, Bloomington, Indiana
Appeal from the Vanderburgh Superior Court, The Honorable Kelsey B. Hanlon, Special Judge, Trial Court Cause No. 82D07-2204-CT-1698
Attorneys for Appellants: Neal F. Eggeson, Jr., Eggeson Privacy Law, Fishers, Indiana, Taylor D. Ivy, Ladendorf Law, Indianapolis, Indiana
Attorneys for Appellees: James L. Whitlatch, Kathryn E. DeWeese, Ryan M. Heeb, Bunger & Robertson, Bloomington, Indiana
Vaidik, Judge.
Case Summary
[1] A doctor improperly accessed medical records of thirteen women who weren’t his patients but whom he had met or encountered in social settings, online, or at work. The women sued the medical clinic that employed the doctor, seeking to hold it vicariously liable for the doctor’s conduct under the doctrine of respondeat superior. To do so, they must prove two things: (1) the doctor committed one or more torts against them and (2) he was acting within the scope of his employment when he committed the tort(s). The women claim the doctor committed two torts—invasion of privacy by intrusion into emotional solace and intentional infliction of emotional distress—and that he did so within the scope of his employment. The trial court granted summary judgment to the clinic, concluding that the women can’t prevail on the underlying tort claims and that, even if they could, the doctor wasn’t acting within the scope of his employment.
[2] We affirm in part, reverse in part, and remand, reaching three conclusions. First, while there are strong arguments for recognizing the tort of intrusion into emotional solace, at least in the context of medical-record snooping, that recognition must come from our Supreme Court. Second, the tort of intentional infliction of emotional distress—despite its name—can be proven if the defendant intentionally or recklessly inflicted emotional distress, and there are genuine issues of material fact as to whether the doctor did so in this case, precluding summary judgment on that claim. Third, even though the clinic prohibited the doctor from accessing medical records for personal reasons, there is a genuine issue of material fact as to whether the doctor was acting within the scope of his employment when he did so, precluding summary judgment on the issue of vicarious liability.
Facts and Procedural History
[3] In late 2018, Deaconess Clinic, Inc., hired Dr. Akitto Ledda to work for its urgent-care centers. (We will use "Deaconess" to refer collectively to Deaconess Clinic, Inc., and the other corporate defendants: Deaconess Hospital, Inc.; Deaconess Hospital Systems, Inc.; and Deaconess Clinic at Work.) Dr. Ledda agreed in writing to Deaconess’s policies prohibiting employees from accessing patient records for personal reasons. He also received a variety of training on the importance of patient privacy.
[4] Nonetheless, between February and April of 2020, Dr. Ledda improperly accessed the records of a former patient, Mandy Ford, three times. Ford didn’t know about the violations, but in October 2020, she submitted a complaint to Deaconess, claiming, "Dr. Ledda contacted me via social media (facebook) and propositioned me by messaging me ‘hey, come over’ and provided an address." Appellants’ App. Vol. IV p. 134. Ford said the contact was "very distressing" and asked that Dr. Ledda’s conduct be investigated. Id. After determining that Dr. Ledda had not used his Deaconess email account to contact Ford, Deaconess took no action against him and did no further investigation.
[5] In April 2021, Deaconess activated violation-detection software that uses artificial intelligence and advanced analytics to analyze the access of patient records. In December 2021, the program detected suspicious activity by Dr. Ledda. Over the next two months, Deaconess investigated and learned that, between June 2020 and January 2022—after viewing Ford’s records—Dr. Ledda improperly accessed the records of forty-six other people who had never been his patients. When confronted with this information, Dr. Ledda admitted that he had improperly accessed the records for personal reasons. Deaconess fired Dr. Ledda and sent breach-notification letters to the forty-six individuals.
[6] Thirteen women who received notification letters—the plaintiffs in this matter—claim that Dr. Ledda had met or encountered them in social settings, online, or at work, with some describing troubling behavior (as set forth in the Plaintiffs’ opening brief on appeal):
Olivia Baird met Dr. Ledda in April 2021 when Dr. Ledda approached her and her group of friends at a bar. She encountered him again several times thereafter - each time following her around, trying to hang out with her, and hugging her.
Alisha Bonneville met Dr. Ledda when he introduced himself to her at a bar. She saw him again at a party.
Devan Grammer first met Dr. Ledda when he approached her at a bar (she was alone), asked if he could sit. with her, hugged her, and then asked her out on a date.
Nicole Haag first met Dr. Ledda at a bar. For 10-12 months after that first meeting, Ms. Haag noticed that Dr. Ledda always showed up at locations where she and her friends were - often following them to other bars without actually talking to them or being in their group. Sometimes, Dr. Ledda would come into the retail store where Ms. Haag worked - though he would never buy anything. Then, on April 10, 2021, Dr. Ledda messaged Ms. Haag to ask if she would be going out to the bars that evening; Ms. Haag told Dr. Ledda that she would not be going out because she was sick. Then, Dr. Ledda accessed Ms. Haag’s chart and, that same evening, showed up at a bar where Ms. Haag was present. Someone drugged Ms. Haag’s drink, and she had to be carried out of the bar.
Alexa Harris met Dr. Ledda at a sports bar when he approached her and introduced himself. After that, Dr. Ledda routinely showed up at her work on nights she bartended and would ask her out on dates.
Ashley Schimmelman met Dr. Ledda at an Evansville bar after which Dr. Ledda texted her numerous times (to which she never replied). At some point thereafter, she saw Dr. Ledda again at a bar when he sat at a table near her and texted her that "she looked really good." Though Ms. Schimmelman blocked Dr. Ledda’s number after that, he nevertheless showed up at her work with cookies and a letter. Ms. Schimmelman instructed Dr. Ledda to leave her alone; yet Dr. Ledda again showed up one night when she and her friends were out at the bars, following her around until one of her friends confronted Dr. Ledda.
Tori Hildebrandt met Dr. Ledda at a bar when he approached her and introduced himself. As a friend of Ashley Schimmelman, Ms. Hildebrandt often would be present when Dr. Ledda would approach her group of friends, making her uncomfortable to the point that she once considered contacting law enforcement.
Madison Hillyard first met Dr. Ledda at a bar when he bought her a drink. Ms. Hillyard encountered Dr. Ledda multiple times after that during which Dr. Ledda was "persistent in pursuing her." Dr. Ledda hugged her during one of these encounters. Eventually, Ms. Hillyard’s coworkers persuaded Dr. Ledda to leave her alone.
Alyssa Leffler first met Dr. Ledda while out celebrating a friend’s birthday on January 19, 2022 - one day prior to Dr. Ledda’s access of her medical chart. On that occasion (and on multiple occasions thereafter), Dr. Ledda offered to purchase her drinks when he would encounter her out at the bars.
Addison Lenn never met Dr. Ledda in person. Having connected on Facebook through a mutual connection, Addison accidentally reacted to a story Dr. Ledda posted on January 14, 2021. That same day, Dr. Ledda accessed her medical chart.
Samantha Robbins worked with Dr. Ledda at Deaconess. Often, Dr. Ledda would go out of his way to encounter her - sometimes even using the restroom and breakroom by her office despite having his own restroom and breakroom. On one occasion, Dr. Ledda came into the office (on his day off) and asked Ms. Robbins to attend a concert with him. Thereafter, he messaged her on Facebook asking for a date - which led Ms. Robbins to block him on Facebook. He also used Ms. Robbins’ arm to create a medical splint - a request which Ms. Robbins did not feel she could refuse because of Dr. Ledda’s position at Deaconess. When informed that she would be "floated" to Dr. Ledda’s clinic, she left her employ with Deaconess.
Amy Seibert does not remember meeting Dr. Ledda, but she worked as a server/bartender at a popular Evansville bar Dr. Ledda would frequent.
Jillian Tomes worked at a bar Dr. Ledda frequented. Dr. Ledda would constantly hit on her, brag about being a doctor, and ask her to go boating. One night, Ms. Tomes encountered Dr. Ledda at another bar which led to Dr. Ledda following her continuously and trying to talk to her until Ms. Tomes enlisted the help of a male friend to keep Dr. Ledda away from her.
See Appellants’ Br. pp. 14-16.
[7] These women ("the Plaintiffs") filed suit against Dr. Ledda and Deaconess. As relevant here, the Plaintiffs claimed that (1) Dr. Ledda committed the torts of intrusion into emotional solace and intentional infliction of emotional distress and (2) he did so within the scope of his employment, making Deaconess vicariously liable for his torts under the doctrine of respondeat superior. The Plaintiffs reached a settlement with Dr. Ledda but kept their claims against Deaconess.
Mandy Ford was also named as a plaintiff but later voluntarily dismissed her claims.
The Plaintiffs’ complaint included other claims that aren’t at issue in this appeal.
[8] Deaconess moved for summary judgment, arguing: (1) Indiana’s appellate courts have declined to recognize the tort of intrusion into emotional solace; (2) Dr. Ledda didn’t intend to inflict emotional distress; and (3) in any event, Dr. Ledda’s acts were outside the scope of his employment, meaning Deaconess can’t be held vicariously liable. In response, the Plaintiffs conceded that "Indiana does not currently recognize Intrusion into emotional solace" but argued that "this issue clamors for examination by our Supreme Court." Appellants’ App. Vol. III p. 233. The Plaintiffs disputed Deaconess’s arguments regarding intentional infliction of emotional distress and scope of employment. Among other things, the Plaintiffs designated the affidavit of a HIPAA security expert who opined that Deaconess should have and could have done more to monitor Dr. Ledda’s record access, especially after receiving Ford’s complaint. Appellants’ App. Vol. IV pp. 19-28.
[9] After a hearing, the trial court granted Deaconess’s motion. It accepted the Plaintiffs’ concession that intrusion into emotional solace isn’t recognized under Indiana law. The court also agreed with Deaconess that Dr. Ledda didn’t intend to cause emotional distress to the Plaintiffs and that, regardless, his acts were outside the scope of his employment.
[10] The trial court declared its order immediately appealable under Trial Rule 54(B), and the Plaintiffs now appeal. Discussion and Decision
[1, 2] [11] The Plaintiffs contend the trial court erred by granting summary judgment to Deaconess. We review a motion for summary judgment de novo, applying the same standard as the trial court. Hughley v. State, 15 N.E.3d 1000, 1003 (Ind. 2014). That is, "The judgment sought shall be rendered forthwith if the designated evidentiary matter shows that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." Ind. Trial Rule 56(C). Even when the facts relevant to an issue are undisputed, summary judgment is inappropriate if those facts support conflicting reasonable inferences. Williams v. Tharp, 914 N.E.2d 756, 761 (Ind. 2009).
[12] The trial court granted Deaconess summary judgment on two independent grounds. First, it rejected the Plaintiffs’ underlying tort claims—intrusion into emotional solace and intentional infliction of emotional distress. Second, it found that even if the Plaintiffs could prove one or both of those underlying claims, Dr. Ledda was not acting within the scope of his employment and therefore Deaconess cannot be held vicariously liable under the doctrine of respondeat superior. We begin by addressing the underlying tort claims and conclude that while intrusion into emotional solace is not currently a viable tort claim in Indiana, genuine issues of material fact preclude summary judgment on the Plaintiffs’ claim of intentional infliction of emotional distress. Therefore, we must ad- dress the scope-of-employment issue, and we again find a genuine issue of material fact precluding summary judgment.
I. We decline to recognize a tort claim for intrusion into emotional solace
[3] [13] The Plaintiffs ask us to recognize the tort of intrusion into emotional solace. Citing both the Restatement (Second) of Torts and Prosser and Keeton on Torts, our Supreme Court has recognized "intrusion" (or "intrusion upon seclusion") as one form of invasion of privacy, along with "appropriation of likeness," "public disclosure of private facts," and "false-light publicity." Cmty. Health Network, Inc. v. McKenzie, 185 N.E.3d 368, 380 (Ind. 2022) (citing Restatement (Second) of Torts § 652A (Am. L. Inst. 1977)); Cullison v. Medley, 570 N.E.2d 27, 31 (Ind. 1991) (citing Prosser and Keeton on Torts § 117 (Sth ed. 1984)). The issue presented here is whether the tort is limited to physical invasions of personal space (e.g., home or body) or also includes non-physical intrusions into private affairs (financial records, medical records, etc.).
[14] The Plaintiffs acknowledge that in Cullison, the Court stated, "When the invasion of a plaintiff’s right to privacy takes the form of intrusion, it consists of an intrusion upon the plaintiff’s physical solitude or seclusion as by invading his home or conducting an illegal search." 570 N.E.2d at 31 (emphasis added). They also acknowledge that this Court has often cited Cullison for the proposition that an intrusion claim requires a physical invasion. See, e.g., Albanese Confectionery Grp., Inc. v. Cwik, 165 N.E.3d 139, 148 (Ind. Ct. App. 2021), trans. denied; F.B.C. v. MDwise, Inc., 122 N.E.3d 834 (Ind. Ct. App. 2019), trans. denied, overruled on other grounds by McKenzie, 185 N.E.3d 368; Westminster Presbyterian Church of Muncie v. Yonghong Cheng, 992 N.E.2d 859 (Ind. Ct. App. 2013), trans. denied; Newman v. Jewish Cmty. Ctr. Ass’n of Indianapolis, 875 N.E.2d 729 (Ind. Ct. App. 2007), trans. denied. However, they argue that the "physical solitude or seclusion" statement in Cullison was dicta that we shouldn’t treat as binding precedent. Specifically, the Plaintiffs assert that because Cullison involved a physical invasion of the plaintiff’s home, the Court didn’t have to decide whether a non-physical invasion would suffice and the statement therefore wasn’t necessary to its decision. See State v. Hardy, 7 N.E.3d 396, 401 (Ind. Ct. App. 2014) ("Obiter dictum—dicta—refers to statements that a court makes that are not necessary in the determination of the issues presented.").
[15] The Plaintiffs offer persuasive arguments for recognizing the tort of intrusion into emotional solace. Neither the Restatement (Second) of Torts nor Prosser and Keeton on Torts limits intrusion to physical invasions. See Restatement (Second) of Torts § 652B (Am. L. Inst. 1977) (calling for the liability of "[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns" (emphases added)); Prosser and Keeton on Torts § 117 (noting that the tort of intrusion has been "carried beyond" physical intrusion and "extended to eavesdropping upon private conversations by means of wiretapping and microphones"). Also, technological advancements since Cullison have made non-physical invasions of privacy easier and more common. See F.B.C., 122 N.E.3d at 838-40 (Bailey, J., dissenting). And other jurisdictions allow intrusion actions where there has been no physical invasion. See, e.g., Taus v. Loftus, 40 Cal.4th 683, 54 Cal.Rptr.3d 775, 151 P.3d 1185 (2007); Johnson v. Stewart, 854 So. 2d 544 (Ala. 2002); Swarthout v. Mut. Serv. Life Ins. Co., 632 N.W.2d 741 (Minn. Ct. App. 2001). [4] [16] Even still, for two reasons, we believe that any recognition of this tort in Indiana must come from our Supreme Court or the legislature. First, our Supreme Court has consistently denied transfer in cases where we relied on the "physical solitude or seclusion" language from Cullison, including two very recent eases where one of the Plaintiffs’ attorneys made the same arguments he makes here. See Fox v. Franciscan All., Inc., 204 N.E.3d 320 (Ind. Ct. App. 2023), trans. denied; Henry v. Cmty. Healthcare Sys. Cmty. Hosp., 184 N.E.3d 645 (Ind. Ct. App. 2022), trans. denied, overruled on other grounds by McKenzie, 185 N.E.3d 368. While the denial of transfer in a particular case is not a ruling on the merits of the legal question, our Supreme Court’s repeated denials on this particular issue are in line with what the Court said in Cullison.
[17] Second, in a recent decision addressing the public-disclosure-of-privatefacts form of invasion of privacy, the Court stressed the importance of the "publicity" element. Z.D. v. Cmty. Health Network, Inc., 217 N.E.3d 527, 538 (Ind. 2023). This element requires that the private information be "communicated in a way that either reaches or is sure to reach the public in general or a large enough number of persons such that the matter is sure to become public knowledge." Id. at 533. The Court explained that this "necessary restraint" prevents "exposing individuals and entities to inordinate liability each time someone’s privacy is compromised." Id. at 538. This language weighs heavily against adopting intrusion into emotional solace, which would have no publicity element.
[18] For these reasons, we decline to recognize the tort of intrusion into emotional solace, and we affirm the grant of summary judgment to Deaconess on this claim. However, as we explain in the next two sections, the Plaintiffs may be able to recover for intentional infliction of emotional distress.
II. There are genuine issues of material fact as to whether Dr. Ledda intentionally or recklessly caused severe emotional distress to the Plaintiffs
[5] [19] The trial court granted summary judgment to Deaconess on the Plaintiffs’ claim for intentional infliction of emotional distress based on its conclusion that Dr. Ledda didn’t intend to cause emotional distress to the Plaintiffs. The Plaintiffs contend that intent to harm is not required—recklessness is enough—and that even if intent to harm is required there is a genuine issue of material fact as to Dr. Ledda’s intent. Deaconess doesn’t dispute that, if recklessness is enough, there is a genuine issue of material fact precluding summary judgment; rather, it argues that intent to harm is required and that there is no evidence that Dr. Ledda set out to cause severe emotional distress to the Plaintiffs. See Appellees’ Br. p. 37. Notwithstanding the common name of this tort—"intentional infliction of emotional distress"—we agree with the Plaintiffs that recklessly causing emotional distress can be enough.
[20] Our Supreme Court first recognized the tort of intentional infliction of emotional distress in the Cullison decision we discussed above. 570 N.E.2d at 31. Specifically, the Court adopted the Restatement (Second) of Torts § 46 (Am. L. Inst. 1965). That section is titled "Outrageous Conduct Causing Severe Emotional Distress." and provides, in relevant part, "One who by extreme and outrageous conduct intentionally or recklessly causes severe emotional distress to another is subject to liability for such emotional distress[.]" Under this formulation, recklessly causing severe emo- tional distress can be enough, if it is caused by extreme or outrageous conduct. Comment i to Section 46 confirms this fact:
Intention and recklessness. The rule stated in this Section applies where the actor desires to inflict severe emotional distress, and also where he knows that such distress is certain, or substantially certain, to result from his conduct. It applies also where he acts recklessly, as that term is defined in § 500, in deliberate disregard of a high degree of probability that the emotional distress will follow.
We have cited this comment with approval. See J.H. v. St. Vincent Hosp. & Health Care Ctr., Inc., 19 N.E.3d 811, 820 (Ind. Ct. App. 2014); Bradley v. Hall, 720 N.E.2d 747, 752 n.6 (Ind. Ct. App. 1999). The highest courts of other states have also held that reckless conduct can support a claim for intentional infliction of emotional distress, citing the Restatement. See, e.g., Rogers v. Louisville Land Co., 367 S.W.3d 196 (Tenn. 2012); Petersen v. Sioux Valley Hosp. Ass’n, 491 N.W.2d 467 (S.D. 1992).
[6] [21] As Deaconess emphasizes, the Cullison Court also stated, "It is the intent to harm one emotionally that constitutes the basis for the tort of an intentional infliction of emotional distress." 570 N.E.2d at 31. There is obvious tension between that sentence and the Court’s adoption (in the preceding sentence) of the Restatement’s "intentionally or recklessly" formulation. See Lachenman v. Stice, 838 N.E.2d 451, 456 n.5 (Ind. Ct. App. 2005) (discussing Cullison and stating that "a demonstrated intent to harm seems inconsistent with mere reckless conduct"), reh’g denied, trans. denied. But six years after Cullison, the Court cited the Restatement formulation without repeating the "intent to harm" language. See Doe v. Methodist Hosp., 690 N.E.2d 681, 691 (Ind. 1997), overruled on other grounds by McKenzie, 185 N.E.3d 368. Given the Court’s approval of the Restatement standard in both Cullison and Doe, we conclude that a defendant who recklessly causes "severe emotional distress" through "extreme and outrageous conduct" can be held liable for intentional infliction of emotional distress. We recognize that the "intentionally or recklessly" standard allows for more claims than a strict "intent to harm" standard would, but those other Restatement elements provide important guardrails that limit the number of successful claims.
[22] Because intent to harm isn’t required, and because Deaconess hasn’t challenged the "extreme and outrageous conduct" or "severe emotional distress" elements at this stage, it is not entitled to summary judgment on the Plaintiffs’ underlying claim for intentional infliction of emotional distress. Therefore, we must address the trial court’s alternative ground for granting summary judgment to Deaconess: Dr. Ledda was not acting within the scope of his employment.
Deaconess argues that this case is similar to Fox v. Franciscan Alliance, Inc., 204 N.E.3d 320 (Ind. Ct. App. 2023), trans. denied. There, a hospital employee improperly accessed the records of the plaintiffs, and we affirmed summary judgment against the plaintiffs on their claim for intentional infliction of emotional distress. While the panel in that case mentioned the Restatement standard that includes recklessness, it cited and ultimately relied on the "intent to harm" language from Cullison. Id. at 329-30. As just discussed, we conclude that intent to harm is not required—recklessness can suffice.
III. There is a genuine issue of material fact as to whether Dr. Ledda was acting within the scope of his employment
[7, 8] [23] In order to hold Deaconess vicariously liable for Dr. Ledda’s record access under the doctrine of respondeat superior (Latin for "let the superior make answer"), the Plaintiffs must show that Dr. Ledda was acting within the scope of his employment. Cox v. Evansville Police Dep’t, 107 N.E.3d 453, 460 (Ind. 2018). Summary judgment is sometimes appropriate on scope of employment, but it is generally a question of fact. Id.
[24] Our Supreme Court examined whether improperly accessing medical records was within the scope of employment in Community Health Network, Inc. v. McKenzie, 185 N.E.3d 368 (Ind. 2022). The employer argued that the employee’s conduct was outside the scope of her employment "for two related reasons: (1) her conduct was unauthorized; and (2) it violated signed acknowledgements in which she agreed to maintain the confidentiality of patients’ medical records." Id. at 377. The Court began its summary-judgment analysis by making clear that even unauthorized conduct can fall within the scope of employment:
Scope of employment can include acts that naturally or predictably arise from authorized activities. And thus, scope-of-employment liability may reach unauthorized conduct, including that which violates the employer’s rules, orders, or instructions. A primary reason for imposing liability for such conduct is to prevent recurrence. This reason is significant here, as technological advances have led to health-care employers placing expansive access to private patient information at employees’ fingertips. And when the employer controls that access, the threat of liability for injurious conduct flowing from that control encourages preventive measures.
To be sure, if an employee engages in unauthorized conduct that is in direct violation of agreed-to policies and procedures—such as a confidentiality agreement—then this evidence weighs heavily toward a finding that the actions were outside the scope of employment. But also relevant is evidence demonstrating that the employee’s actions naturally or predictably arose from delegated employment activities within the employer’s control.
Id. at 377-78 (cleaned up).
[25] The Court then turned to the facts before it. Citing three factors, the Court found genuine issues of material fact as to whether the employee’s improper record access was within the scope of her employment. First, the employer had complete control over the employee’s record access and gave her the ability to view the records of any patient, even though she was only supposed to view the records of certain patients. Second, there was evidence that the employee didn’t have a clear understanding of the scope of her authority to access records and that she didn’t think her unauthorized access was "that critical." Id. at 378. Third, there was evidence that the employer "lacked proper systems to regulate its employees’ use of medical records" and that it didn’t take full advantage of the systems it did have. Id. This allowed the employee to improperly view the records of many patients over several months without detection by the employer; the employer was unaware of any unauthorized access until it received an anonymous tip.
[9] [26] There are some differences here. Unlike the employee in McKenzie, Dr. Ledda knew and admitted that accessing the Plaintiffs’ records was unauthorized and inappropriate. And unlike the employer in McKenzie, Deaconess itself discovered Dr. Ledda’s improper access, after being alerted by its violation-detection software. But other evidence weighs in favor of the Plaintiffs. Deaconess had complete control over Dr. Ledda’s record access and gave him the ability to view the records of people who weren’t his patients. Also, Dr. Ledda was improperly accessing records for more than eighteen months before Deaconess learned of his misconduct. Deaconess didn’t even investigate Dr. Ledda’s record access after his former patient Mandy Ford complained in late 2020 that he had propositioned her. Such an investigation would have revealed that Dr. Ledda improperly accessed Ford’s records, which likely would have resulted in a much earlier termination of Dr. Ledda’s employment. Finally, a HIPAA security expert opined that Deaconess should have and could have done more to monitor Dr. Ledda’s record access, especially after receiving Ford’s complaint. Tellingly, Deaconess doesn’t address the Ford situation or the expert’s opinion in its appellate brief.
[27] Despite the differences between this case and McKenzie, we conclude that there is a genuine issue of material fact as to whether Dr. Ledda’s improper record access arose naturally and predictably from his authorized activities. Therefore, the trial court erred by granting summary judgment to Deaconess on the Plaintiffs’ claim for intentional infliction of emotional distress.
[28] Affirmed in part, reversed in part, and remanded.
May, J., and Kenworthy, J., concur.