Opinion
Supreme Court Case No. 23S-CT-116
09-25-2023
Z.D., Appellant v. COMMUNITY HEALTH NETWORK, INC., Appellee
ATTORNEYS FOR APPELLANT: Neal F. Eggeson, Jr., Eggeson Privacy Law, Fishers, Indiana, Bradley C. Lohmeier, Lohmeier Law LLC, Indianapolis, Indiana ATTORNEYS FOR APPELLEE: Jenny R. Buchheit, Sean T. Dewey, Alexandria H. Pittman, Ice Miller LLP, Indianapolis, Indiana ATTORNEYS FOR AMICUS CURIAE INDIANA LEGAL FOUNDATION, INC.: Bryan H. Babb, Seema R. Shah, Bose McKinney & Evans LLP, Indianapolis, Indiana ATTORNEYS FOR AMICUS CURIAE DEFENSE TRIAL COUNSEL OF INDIANA: Peter H. Pogue, Michael F. Mullen, Schultz & Pogue LLC, Indianapolis, Indiana, Lucy R. Dollens, Quarles & Brady LLP, Indianapolis, Indiana ATTORNEYS FOR AMICUS CURIAE INDIANA HOSPITAL ASSOCIATION: Andrew B. Howk, Angela M. Smith, Matthew M. Schappa, Hall Render Killian Heath & Lyman, Indianapolis, Indiana
ATTORNEYS FOR APPELLANT: Neal F. Eggeson, Jr., Eggeson Privacy Law, Fishers, Indiana, Bradley C. Lohmeier, Lohmeier Law LLC, Indianapolis, Indiana
ATTORNEYS FOR APPELLEE: Jenny R. Buchheit, Sean T. Dewey, Alexandria H. Pittman, Ice Miller LLP, Indianapolis, Indiana
ATTORNEYS FOR AMICUS CURIAE INDIANA LEGAL FOUNDATION, INC.: Bryan H. Babb, Seema R. Shah, Bose McKinney & Evans LLP, Indianapolis, Indiana
ATTORNEYS FOR AMICUS CURIAE DEFENSE TRIAL COUNSEL OF INDIANA: Peter H. Pogue, Michael F. Mullen, Schultz & Pogue LLC, Indianapolis, Indiana, Lucy R. Dollens, Quarles & Brady LLP, Indianapolis, Indiana
ATTORNEYS FOR AMICUS CURIAE INDIANA HOSPITAL ASSOCIATION: Andrew B. Howk, Angela M. Smith, Matthew M. Schappa, Hall Render Killian Heath & Lyman, Indianapolis, Indiana
On Petition to Transfer from the Indiana Court of Appeals, No. 22A-CT-644
Rush, Chief Justice.
Private health information often includes highly sensitive details about an individual's personal life. When this information is shared with healthcare providers, they are responsible for implementing protective measures to prevent breaches and unauthorized disclosures. If an unauthorized disclosure occurs, affected patients may seek relief under various tort theories. But not all torts permit the same recovery. This is especially true when a patient seeks relief under an invasion of privacy claim and a negligence claim.
Here, a hospital mailed a letter containing a patient's intensely private health matter to a teenage acquaintance of the patient's daughter, and that teenager posted the letter to Facebook. Seeking recovery for emotional distress and other damages, the patient sued the hospital contending it (1) invaded her privacy by publicly disclosing her private information and (2) negligently failed to maintain the confidentiality of her information. The hospital moved for summary judgment, which the trial court granted.
We affirm in part and reverse in part. We first conclude the hospital is not entitled to summary judgment on the patient's privacy claim because the hospital did not negate the public-disclosure tort's publicity element. Specifically, a genuine issue of material fact remains as to whether the information was communicated in a way that it would reach a large enough number of people such that it was sure to become public knowledge. We then conclude the hospital is entitled to partial summary judgment on the patient's negligence claim. Although the patient is barred from recovering damages for emotional distress on this claim, we find genuine issues of material fact remain as to whether her pecuniary damages are recoverable and whether the hospital was the proximate cause of those damages.
Facts and Procedural History
In September 2018, Z.D. received medical care at one of Community Health Network's emergency departments. Following her visit, a Community employee called Z.D. to discuss her health matters. Unable to reach her, the employee prepared a letter documenting Z.D.’s private health information, which included her recent diagnosis and suggested treatment. Although the letter was addressed to Z.D., it was placed in an envelope addressed in handwriting to the wrong person and mailed to that person.
As it turns out, that person—Jonae Kendrick—was a teenager who attended or had recently attended the same high school as Z.D.’s daughter. When Kendrick received the envelope, she opened it, took a picture of the one-page letter, posted it on her Facebook page, and attempted to "tag" Z.D. in the post. Z.D.’s daughter, who was Facebook friends with Kendrick, saw the post and notified her mother. Z.D.’s daughter asked Kendrick to remove the post, but she declined. Z.D. then contacted Kendrick and asked her to return the letter in exchange for $100, which she accepted. Eventually the post was removed from Facebook.
Based on these events, Z.D. sued Community. She alleged Community was (1) directly responsible for its negligent training, supervision, and retention of employees; (2) vicariously liable for its employee's unauthorized disclosure of Z.D.’s private health information; and (3) directly or vicariously liable for negligently maintaining the confidentiality of her private information. Based on those allegations, Z.D. sought damages for emotional distress, loss of privacy, loss of income, reputational damage, and cost of rent because she had to move out of her fiancé’s home and rent her own apartment due to the strain the disclosure of her diagnosis put on their relationship.
Community moved for summary judgment on each of Z.D.’s claims, raising the following arguments: (1) it was not the proximate cause of her damages; (2) she could not recover emotional-distress damages in her negligence claim due to the modified impact rule's direct physical-impact requirement; (3) her claim for negligent training, supervision, and retention failed as a matter of law because the employee acted within the scope of employment; and (4) to the extent she pled a claim for public disclosure of private facts, the tort was not cognizable in Indiana but, even if it was, Community negated the publicity element.
In response, Z.D. argued summary judgment was inappropriate. For the negligence claims, Z.D. maintained an unresolved question of fact remained as to whether Community was the proximate cause of her alleged damages, and even if the modified impact rule applied, claims for negligence-based medical privacy breaches should be exempt from its application. Z.D. also argued that she properly raised a public-disclosure claim, the tort is cognizable in Indiana, and Community did not negate the publicity element.
Following a hearing, the trial court granted summary judgment to Community on each of Z.D.’s claims. The court found Community was entitled to summary judgment on Z.D.’s claim for negligent training, supervision, and retention because it was undisputed that the employee's misconduct arose within the scope of employment. The trial court then reasoned that Z.D.’s remaining two claims, which it believed "seek to hold Community liable for negligence, indirectly or directly," failed as a matter of law because (1) Z.D.’s emotional-distress damages were not recoverable due to the modified impact rule; and (2) even if they were recoverable, Community's disclosure of her private information was not the proximate cause of her alleged damages. The trial court did not address Z.D.’s alleged pecuniary damages. And it also did not analyze Z.D.’s public-disclosure claim because, in the court's view, such a claim had not been brought. Z.D. appealed, raising several issues.
The Court of Appeals affirmed in part and reversed in part. Z.D. v. Cmty. Health Network, Inc. , 197 N.E.3d 330, 334 (Ind. Ct. App. 2022). It affirmed the trial court's grant of summary judgment on Z.D.’s claim for negligent retention and supervision. Id. at 335–36. But it only partially affirmed the court's grant of summary judgment on Z.D.’s other negligence claim, finding that although her emotional-distress damages were not recoverable due to the modified impact rule, issues of fact remained as to whether she could recover her alleged pecuniary damages and whether Community was the proximate cause of those damages. Id. at 339–43. And finally, it reversed the court's grant of summary judgment on Z.D.’s claim for public disclosure of private facts, finding the claim adequately pled and that Community did not negate the tort's publicity element. Id. at 336–39.
Both parties petitioned for transfer, which we granted, vacating the Court of Appeals’ opinion. Ind. Appellate Rule 58(A).
We summarily affirm the Court of Appeals’ following holdings: (1) Community is entitled to summary judgment on Z.D.’s claim alleging Community is liable for its negligent training, retention, and supervision of employees; (2) Z.D.’s allegations, particularly those found in Count I of her complaint, pled all the facts necessary to support a public-disclosure claim; and (3) Community failed to establish that "only a single inference or conclusion regarding proximate cause and intervening cause could be drawn based on the designated evidence." See App. R. 58(A)(2) ; Z.D. , 197 N.E.3d at 336, 338, 341–43.
Standard of Review
We review the trial court's summary judgment decision de novo. U.S. Automatic Sprinkler Corp. v. Erie Ins. Exch. , 204 N.E.3d 215, 220 (Ind. 2023). Community is entitled to summary judgment if the designated evidence shows there is no genuine issue of material fact and that it is entitled to judgment as a matter of law. See Ind. Trial Rule 56(C). A genuine issue of material fact exists when there is "contrary evidence showing differing accounts of the truth," or when "conflicting reasonable inferences" may be drawn from the parties’ consistent accounts and resolution of that conflict will affect the outcome of a claim. Wilkes v. Celadon Grp., Inc. , 177 N.E.3d 786, 789 (Ind. 2021) ; see also Lyons v. Richmond Cmty. Sch. Corp. , 19 N.E.3d 254, 259 (Ind. 2014). To the extent we "have any doubts concerning the existence of a genuine issue of material fact, we must resolve those doubts in favor of the nonmoving party." Reed v. Reid , 980 N.E.2d 277, 303 (Ind. 2012). Indeed, it is well settled that "Indiana consciously errs on the side of letting marginal cases proceed to trial on the merits, rather than risk short-circuiting meritorious claims." Hughley v. State , 15 N.E.3d 1000, 1004 (Ind. 2014).
Discussion and Decision
Tort law encompasses a "series of causes of action." Kenneth S. Abraham & G. Edward White, Conceptualizing Tort Law: The Continuous (And Continuing) Struggle , 80 Md. L. Rev. 293, 343 (2021). Some are used alternatively as "different means of obtaining the same relief for the same harm," while others are used independently to pursue recovery for distinct harms or when "various theories of recovery require ... differing standards of conduct." 1A C.J.S. Actions § 174 (2023). Though Z.D.’s two claims before us—one alleging invasion of privacy premised on the public disclosure of private facts and the other alleging negligence—stem from the same general incident, each constitutes a separate cause of action.
And here, these independent claims compel independent inquiries. Z.D.’s public-disclosure claim requires us to consider whether Community's disclosure of her private information must be intentional, whether damages for emotional distress are recoverable in the absence of an intentional disclosure, and the precise contours of the tort's publicity element. Z.D.’s negligence claim requires a different consideration—namely, whether to exempt negligence-based medical privacy breaches from the modified impact rule's physical-impact requirement.
We first hold Community is not entitled to summary judgment on Z.D.’s public-disclosure claim. In reaching that conclusion, we clarify that plaintiffs can recover damages for emotional distress upon satisfying the public-disclosure tort's elements—none of which require a showing of intentionality. And we further clarify that disclosure to one person can, depending on the surrounding facts and circumstances, satisfy the tort's publicity element. We then hold Community is entitled to partial summary judgment on Z.D.’s negligence claim. To that end, we decline to exempt negligence-based medical privacy breaches from our modified impact rule's physical-impact requirement, entitling Community to summary judgment on Z.D.’s negligence claim for her alleged emotional-distress damages. But we find genuine issues of material fact remain as to whether Z.D. can recover her alleged pecuniary damages and whether Community was the proximate cause of those damages. We thus affirm in part and reverse in part.
I. Community is not entitled to summary judgment on Z.D.’s public-disclosure claim.
As we explained last year, Hoosiers may seek relief through an invasion of privacy claim premised on the public disclosure of private facts when, like here, their private information is wrongly disclosed. Cmty. Health Network, Inc. v. McKenzie , 185 N.E.3d 368, 380–82 (Ind. 2022). However, this privacy tort is not designed to rectify all unauthorized disclosures of private information. Instead, a public-disclosure claim is actionable only upon satisfying four elements: the information disclosed was private; the information was "communicated in a way that either reaches or is sure to reach the public in general or a large enough number of persons such that the matter is sure to become public knowledge"; the information would be highly offensive to a reasonable person; and the information was not of legitimate public concern. Id. at 382.
Here, it is undisputed that Z.D. has satisfied three of these elements for summary judgment purposes. Community disclosed Z.D.’s private health information, the nature of that information would be highly offensive to a reasonable person, and the information was not of legitimate public concern. Yet, Community contends Z.D.’s claim fails as a matter of law for three reasons: (1) the public-disclosure tort is an intentional tort, and there is no genuine issue of material fact suggesting the disclosure of her private information was intentional; (2) if the public-disclosure tort permits relief for unintentional disclosures, her alleged emotional-distress damages are barred by the modified impact rule; and (3) there is no genuine issue of material fact that the disclosure was made to the public or was sure to reach either the public in general or a large enough number of people such that the information would become public knowledge. We disagree with each contention.
A. Indiana's public-disclosure tort is not an intentional tort.
In McKenzie , we "explicitly" adopted the elements of the public-disclosure tort under the Restatement (Second) of Torts § 652D. 185 N.E.3d at 382. And Section 652D ’s plain language reveals that intent is not an element. Restatement (Second) of Torts § 652D (Am. L. Inst. 1977) ; cf. id. § 652B (requiring intent as an element of the claim for invasion of privacy by intrusion upon seclusion). Community acknowledges that " McKenzie didn't expressly state disclosure was an ‘intentional’ tort," but it urges us to recognize it as such now. We decline to do so for several reasons.
Among courts that have addressed this issue, Community contends "most courts" limit the availability of a public-disclosure claim to intentional disclosures. To be sure, we oftentimes find how other jurisdictions treat a particular issue instructive, especially when the issue involves a state common law matter. See Automatic Sprinkler , 204 N.E.3d at 226. Our review reveals that only a handful of jurisdictions have directly addressed whether a showing of intent is required; and they are, at most, split on the issue. See, e.g. , Doe v. Henry Ford Health Sys. , 308 Mich.App. 592, 865 N.W.2d 915, 919–20 (2014) (requiring a showing of intent). But see, e.g. , Greenwood v. Taft , Stettinius & Hollister , 105 Ohio App.3d 295, 663 N.E.2d 1030, 1035 n.8 (1995) (following the Restatement, which does not require a showing of intent). More tellingly, the states that require a showing of intent provide no explanation or analysis for imposing this additional element. See, e.g. , Doe , 865 N.W.2d at 920 (summarily concluding that the tort requires a showing of intent). We thus find little to no persuasive value in following the few states that treat their public-disclosure tort as an intentional tort.
In our view, we find it more instructive to consider whether imposing an intent requirement comports with the public-disclosure tort's purpose. As we observed in McKenzie , in our digital age, "private information is more easily accessed and disseminated—particularly in ways that can reach a large audience." 185 N.E.3d at 381. Given that recognition, we expressed that the public-disclosure tort "offers a meaningful way to deter unauthorized disclosures of private information" and noted "when deterrence or other preventative measures fail, it can provide victims with meaningful redress." Id. at 381–82. According to Community, this purpose "is not served when the alleged disclosure was unintentional." Amicus curiae the Indiana Hospital Association likewise asserts it would be "imprudent" to expose hospitals to liability for unintentional disclosures because "there is already a clear and known regulatory structure," captured under federal law, to ensure private health information is "appropriately protected." We view the matter differently.
The public-disclosure tort embodies dual imperatives, neither of which are served by imposing an intent requirement. First, from individuals and entities alike, the tort demands protection for private information. This imperative is premised on the understanding that, although information today is widely accessible and shareable, we need not abandon our commitment to protecting privacy. To reinforce that commitment, the public-disclosure tort serves to deter the unauthorized disclosure of private information. Such deterrence may be achieved by implementing protective measures, including enforcing privacy policies and security systems, as well as through adhering to state and federal regulations governing how private information is maintained. These measures foster greater protection for private information, which, in turn, minimizes the potential for liability stemming from an unauthorized disclosure. But, as this case exemplifies, such measures may fall short.
This reality leads to the second imperative: when failures occur, injured individuals deserve a remedy. See Samuel D. Warren & Louis D. Brandeis, The Right to Privacy , 4 Harv. L. Rev. 193, 213–15 (1890). Protective measures may fail due to intentional exploitation but also due to reckless or negligent conduct. Whatever the source, once a private matter becomes public knowledge, the prospect of injury is not only real and foreseeable but also personal. And, importantly, unlike sources of federal and state law governing regulation of private information, the public-disclosure tort affords individuals the opportunity to pursue relief for their damages. See Joshua D.W. Collins, Toothless HIPAA: Searching for a Private Right of Action to Remedy Privacy Rule Violations , 60 Vand. L. Rev. 199, 201–02, 224–25 (2007). Neither the prospect nor magnitude of harm depends on whether the disclosure was intentional or not—it merely depends on the nature of the matter disclosed and the magnitude of the disclosure. We thus find no basis for limiting the availability of the public-disclosure tort to only intentional disclosures of private information.
At the same time, we are mindful that seamless access to private information in the healthcare industry facilitates the efficacy of medical care. But as we cautioned last year, this access comes with "great responsibility." McKenzie , 185 N.E.3d at 373. Hoosiers’ private information warrants protection from intentional exploitation and inadvertent exposure alike. Accordingly, individuals and entities, including healthcare providers, must do their part to safeguard private information. If they do, their potential for liability is greatly minimized; but if they don't, and the four elements of the public-disclosure tort are met, affected individuals deserve to be made whole and reclaim the inherent value of their privacy. So, because Z.D. was not required to allege that Community's wrongful disclosure of her private information was intentional, Community is not entitled to summary judgment on that basis. We now turn to Community's second argument as to why it is entitled to summary judgment.
B. Recovery for emotional distress is available in a public-disclosure claim.
Under our common law, certain damages may not be recoverable in certain tort claims. See, e.g. , Residences at Ivy Quad Unit Owners Ass'n v. Ivy Quad Dev., LLC , 179 N.E.3d 977, 983 (Ind. 2022) (explaining that recovery for economic loss is generally unavailable in a negligence action due to Indiana's economic loss doctrine). This limiting principle is especially true when a plaintiff seeks to recover emotional-distress damages in a negligence action, which triggers our modified impact rule. In relevant part, that rule precludes such recovery unless the plaintiff sustains a "direct physical impact" from the alleged negligence. Spangler v. Bechtel , 958 N.E.2d 458, 466–67 (Ind. 2011). Community acknowledges a public-disclosure claim is distinct from a negligence claim and concedes that, in light of the Restatement (Second) of Torts § 652H, the former explicitly permits recovery for emotional-distress damages. But Community suggests the modified impact rule should apply if, as we concluded above, the public-disclosure tort permits recovery for unintentional disclosures. We disagree.
A public-disclosure claim is not a negligence claim, and it does not transform into one merely because a negligent act or omission occurs. Compare Restatement (Second) of Torts §§ 297 – 309 (characterizing the types of negligent acts), with Restatement (Second) of Torts § 652A (characterizing the types of invasions of privacy). Accordingly, the modified impact rule straightforwardly does not apply to public-disclosure claims. And this makes sense, as "the impact doctrine ... generally is inapplicable to recognized torts in which damages often are predominantly emotional, such as defamation or invasion of privacy." Kush v. Lloyd , 616 So. 2d 415, 422 (Fla. 1992). In the context of a public-disclosure claim, it is inherently plausible—if not inevitable—the affected individual will suffer emotional distress when their intimate details are shared with the public. As noted above, this sentiment is explicitly embodied in Section 652H, which provides that plaintiffs who prevail in a public-disclosure claim can recover various damages, including those "for emotional distress." Restatement (Second) of Torts § 652H cmt. b.
We clarify that, upon satisfying the public-disclosure tort's elements, plaintiffs may recover emotional-distress damages. Thus, Community is not entitled to summary judgment on Z.D.’s public-disclosure claim on the grounds that she is barred from recovering these damages. We now turn to Community's final argument as to why it is entitled to summary judgment.
C. Community has not negated the publicity element of Z.D.’s public-disclosure claim.
In McKenzie , we adopted the publicity element of the public-disclosure tort as articulated in the Restatement (Second) of Torts § 652D. 185 N.E.3d at 382. A matter is given unreasonable publicity when it is "made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge." Restatement (Second) of Torts § 652D cmt. a. Notably, Section 652D emphasizes the distinction between publication and publicity, explaining the "difference is not one of the means of communication, which may be oral, written or by any other means" but rather "one of a communication that reaches, or is sure to reach, the public." Id.
Community contends it has negated the publicity element because its employee disclosed Z.D.’s private information to only one individual. But Z.D. maintains the dispositive consideration is the "end result" of that disclosure—not necessarily the reach of the initial disclosure. Both perspectives miss the mark. And, ultimately, resolution of this issue turns on our standard of review.
To be entitled to summary judgment, Community must demonstrate the absence of any genuine issue of material fact that it communicated Z.D.’s information in a way that (1) did not reach the public or a large number of people such that the matter was sure to become public knowledge; and (2) was not sure —that is, not probable—to reach the public or a large number of people such that the matter was sure to become public knowledge.
Citing McKenzie , Community asserts it has negated the publicity element because "disclosure to one person simply is not actionable as a matter of law." Community is mistaken. Indeed, we recognized in McKenzie that "[t]he facts and circumstances of each case must be taken into consideration in determining whether the communication gave sufficient ‘publicity’ to support a public-disclosure claim." 185 N.E.3d at 382. And while we observed that "communication to a small group of persons is generally not actionable," we held the particular claim in that case failed because the record was "devoid of evidence" the information was disclosed "to, or in a way that was sure to reach, the public or a large number of people." Id. at 383 (emphasis added). Thus, contrary to Community's assertion, disclosure to one person may, based on the facts and circumstances in a particular case, satisfy the publicity element. See id. at 382 ; see also Karch v. BayBank FSB , 147 N.H. 525, 794 A.2d 763, 774 (2002) ; Shattuck-Owen v. Snowbird Corp. , 16 P.3d 555, 559 (Utah 2000) ; Robert C. Ozer, P.C. v. Borquez , 940 P.2d 371, 377 n.7 (Colo. 1997).
Here, the undisputed evidence reveals the misaddressed envelope containing Z.D.’s private information was limited, reaching only Kendrick's household. Accordingly, Community has demonstrated as a matter of law the disclosure itself did not reach the public. But this finding is not dispositive of whether Community demonstrated the disclosure was not communicated in a way that it would reach a large enough number of people such that the information was sure to become public knowledge. Making that determination requires inquiry into the designated evidence related to the employee's disclosure, including the medium used to communicate the information and any details probative of a relationship between Community's employee, Kendrick, and Z.D. See David A. Elder, Privacy Torts § 3.3 (2022) ("The cases uniformly hold that the publicity requirement is met only if said publicization is attributable to the defendant—i.e., defendant must have caused, precipitated or permitted the publicity.")
Community points to evidence indicating that, apart from this incident, Z.D. has no connection to Kendrick. Community further highlights evidence revealing that Z.D. believed someone made a "mistake" in misaddressing the letter. But a full review of this record reveals that conflicting inferences can be drawn as to whether Z.D.’s information was communicated in such a way that it was sure to become public knowledge. Community's employee not only misaddressed the envelope containing Z.D.’s private health information, but she handwrote the address. Though doing so could have been quite simple, Community designated no evidence establishing the employee was completely unconnected to Z.D. or Kendrick, or that addressing an envelope in handwriting is consistent with ordinary practices at the hospital. Further, the employee did not address and send Z.D.’s private information to a complete stranger to Z.D.’s family; it was sent to Kendrick, a teenager who either attended or had recently attended the same high school as Z.D.’s daughter. The teens were also Facebook friends, and Kendrick even attempted to "tag" Z.D. in her Facebook post. Again, Community designated no evidence establishing that its employee was wholly unaware of these connections or that Kendrick was wholly unfamiliar with Z.D. Simply put, without any evidence providing insight into the employee's or Kendrick's actions, we simply do not know if the misaddressed envelope was merely accidental or rather oriented (if not orchestrated) for further dissemination—both inferences are plausible on this record.
When, as here, a private matter is disclosed to the wrong person, the mere possibility that the information can be given unwanted and unreasonable publicity does not necessarily render it sure to become public knowledge. But at the summary judgment stage, we must construe all inferences and doubts as to material factual issues in a manner favorable to the nonmovant, which is Z.D. And in doing so, we find the record supports conflicting inferences as to whether Community's disclosure of Z.D.’s private health information to Kendrick was communicated in a way that it would reach a large enough number of people such that it was sure to become public knowledge. As a result, Community is not entitled to summary judgment on Z.D.’s public-disclosure claim.
We now turn to whether Community is entitled to summary judgment on Z.D.’s negligence claim, which demands a separate inquiry.
II. Community is entitled to partial summary judgment on Z.D.’s negligence claim.
For decades, the impact doctrine controlled whether a plaintiff could recover damages for emotional distress in a negligence action. See Shuamber v. Henderson , 579 N.E.2d 452, 454 (Ind. 1991). Under this doctrine, a plaintiff could recover emotional-distress damages only when their distress was accompanied by and resulted from a physical injury caused by an impact. Id. We later "modified" the impact doctrine by discarding the physical-injury requirement. Id. at 456. Under our modified impact rule, a plaintiff may recover damages for emotional distress if they sustain a "direct physical impact" from the negligence. See, e.g. , Atl. Coast Airlines v. Cook , 857 N.E.2d 989, 991, 996 (Ind. 2006).
Community contends that because Z.D. did not sustain a direct physical impact from its alleged negligent handling of her private health information, the modified impact rule bars her from recovering emotional-distress damages. Mindful of the modified impact rule, Z.D. urges us to altogether exempt negligence-based medical privacy breaches from the rule's physical-impact requirement. We decline to do so. In reaching that conclusion, we consider the purpose of imposing this requirement under our common law. See Automatic Sprinkler , 204 N.E.3d at 225. And we then consider whether "new conditions have emerged" that undermine the purpose of this requirement as applied in the context of medical-privacy breaches. Id. The physical-impact requirement is neither arbitrary nor terribly austere. See Atl. Coast , 857 N.E.2d at 996. Indeed, it is not uncommon for plaintiffs to recover emotional-distress damages following negligent acts or omissions. Bader v. Johnson , 732 N.E.2d 1212, 1221–22 (Ind. 2000) (collecting cases). But emotional distress is not a natural or foreseeable consequence of all negligent acts and omissions. Premised on this recognition, the physical-impact requirement properly limits recovery of such damages to situations when there is a direct, but also physical, nexus between the negligence and the resulting distress—this way, the distress is readily ascertainable. And physical impacts of a "slight" or even a "tenuous" nature can satisfy this requirement. Id. ; cf. Munsell v. Hambright , 776 N.E.2d 1272, 1280 (Ind. Ct. App. 2002), trans. denied. Ultimately, whether a particular physical impact will suffice depends on the facts and circumstances of a particular case. See Atl. Coast , 857 N.E.2d at 996 (collecting cases).
Absent incidents of medical malpractice, see, e.g. , Keim v. Potter , 783 N.E.2d 731, 735 (Ind. Ct. App. 2003), which did not occur here, Z.D. fairly observes that patients will rarely, if ever, sustain a direct physical impact from the mishandling of their private health information. Yet, exempting a general class of negligent conduct from the physical-impact requirement presupposes emotional distress is a readily foreseeable and ascertainable consequence of that conduct. And we simply find no basis for reaching such a conclusion under these circumstances. Not all private health information is alike. Some reveals intimate moments about one's life; others, however, are innocuous and mundane. Accordingly, the likelihood that a patient will suffer emotional distress following the mere mishandling of private information—standing alone—is, at best, uncertain.
At the same time, we share Z.D.’s sentiment that because private health information is entitled to protection, healthcare providers must do their part to enforce security measures that prevent breaches. And we also recognize technological innovations implemented in the healthcare industry have facilitated increased access to and the sharing of private health information, further implicating its protected status. But, in our view, the foreseeability and legitimacy of emotional distress following the negligent maintenance of private information fundamentally depends on the nature of the information involved and the magnitude of the mishandling. And, as discussed above, our tort law provides a path for recovery under such heightened circumstances through a public-disclosure claim.
A negligence action is not the superior path for rectifying an invasion of privacy—an invasion of privacy claim is. And Z.D.’s request that we exempt an entire category of negligent conduct from the rule's physical-impact requirement would not only perpetuate conflation of distinct claims for relief but also effectively nullify the crucial function the public-disclosure tort plays under our common law. Indeed, this tort incorporates certain, necessary restraints, particularly the highly offensive and publicity elements, to provide relief to those who suffer an invasion of privacy without exposing individuals and entities to inordinate liability each time someone's privacy is compromised. By contrast, general negligence-based claims incorporate no such restraints. So, if we granted Z.D.’s request, plaintiffs could seek emotional-distress damages following any breach or disclosure of private information—irrespective of both the magnitude of the disclosure and the relative sensitivity of the information disclosed. In all, Z.D.’s concerns are well taken, but they are better suited for the General Assembly's deliberation.
In short, plaintiffs like Z.D. may assert negligence-based claims when their private information is mishandled, but the modified impact rule precludes recovery for emotional distress unless the plaintiff sustained a direct physical impact from the negligence. Here, the designated evidence reveals Z.D. suffered emotional distress as a result of Community's alleged failure to maintain the confidentiality of her private information. Because this alleged negligence did not produce a direct physical impact, the modified impact rule precludes Z.D. from recovering emotional-distress damages.
But Z.D. also seeks recovery for loss of income and rental expenses, which are pecuniary damages—not emotional-distress damages. The trial court did not address these damages in rendering its judgment, and Community does not designate any evidence demonstrating that Z.D. is barred from recovering them. For this reason and because genuine issues of material fact remain as to whether Community was the proximate cause of these damages, Community is entitled to only partial summary judgment on Z.D.’s negligence claim.
Aside from these damages, Z.D. additionally seeks to recover for loss of privacy in her negligence action and contends these damages are distinct from emotional-distress damages. But the record confirms Z.D.’s alleged loss of privacy is indistinguishable from emotional distress, as she equates her loss of privacy with an "emotional injur[y]" that resulted in "depression."
Conclusion
Community is not entitled to summary judgment on Z.D.’s public-disclosure claim because it has not negated the publicity element. However, Community is entitled to partial summary judgment on Z.D.’s negligence claim. Though Z.D. cannot recover emotional-distress damages resulting from Community's alleged negligence due to the modified impact rule, genuine issues of material fact remain regarding whether she can recover her alleged pecuniary damages and whether Community was the proximate cause of those damages. We therefore affirm in part, reverse in part, and remand for proceedings consistent with this opinion.
We thank amici—Indiana Legal Foundation, Defense Trial Counsel of Indiana, and Indiana Hospital Association—for their helpful briefs.
Massa and Goff, JJ., concur.
Slaughter, J., concurs in part and dissents in part with separate opinion.
Molter, J., not participating.
Slaughter, J., concurring in part, dissenting in part.
I concur with Part II of the Court's opinion, which affirms partial summary judgment for Community Health Network on Z.D.’s negligence claim. I agree that our modified-impact rule prevents Z.D. from recovering emotional-distress damages, but that her claim remains for pecuniary damages.
In contrast to Part II, I respectfully dissent from Part I, which holds that Z.D. survives summary judgment on her public-disclosure claim. I would affirm the trial court's grant of summary judgment for Community on this claim because Z.D. fails the claim's publicity element. Last year, in Community Health Network, Inc. v. McKenzie , 185 N.E.3d 368 (Ind. 2022), we expressly adopted section 652D of the Second Restatement of Torts. Id. at 382. That section establishes four elements to the disclosure tort, one of which is publicity. Ibid. The Restatement defines publicity as the dissemination of information in a way that "the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge." Restatement (Second) of Torts § 652D cmt. a (1977).
The Court today reaffirms McKenzie ’s adoption of section 652D. But it holds that communication to just one person may still amount to publicity if it is sure to reach the public or many people. Ante , at 536. Respectfully, the Court misapplies McKenzie and the Restatement. Under these authorities, Community's transmission, by letter, of Z.D.’s medical information to one wrong addressee was not "to the public at large, or to so many persons" that the transmission itself can be blamed for her information becoming "public knowledge". The transmission of Z.D.’s confidential information, by mail, to a single recipient does not amount to publicity as a matter of law. On this record, I would affirm the trial court's judgment.
For these reasons, I concur in part and dissent in part.