Indiana Court of Appeals Rules Claim Involving Unauthorized Access of Patient Information Does Not Fall Under Indiana Medical Malpractice Act

In Community Health Network, Inc. v. McKenzie (an opinion which has since been vacated), the Indiana Court of Appeals addressed several important health law issues, one of which was whether a claim of negligence arising out of a hospital employee’s accessing another’s private health information falls under Indiana’s Medical Malpractice Act. The Court of Appeals ruled that such mishandling of a patient’s confidential information “even by a treating physician—are not governed by the Medical Malpractice Act.”

The claimant, Heather McKenzie, was initially employed at Indiana Orthopedic Center (“IOC”), along with Katrina Gray. Katrina was the medical records coordinator and was Heather’s direct supervisor. Katrina introduced Heather to her stepson, Kevin, and the two married and had two children. Thereafter, Kevin and Heather divorced and Heather received full custody of the children. Heather later married Daniel McKenzie. The Gray family and the McKenzie family had a “family feud” according to the Court.

In 2012, Community acquired IOC through an asset purchase. Katrina was hired and trained by Community to be the medical records coordinator and was required to train on HIPPA. After training Katrina was provided access to Epic, an electronic medical records system. She was authorized to schedule appointments and release records of patients only within IOC and “strictly prohibited” from accessing any patient record without a business need or for personal reasons. After Community investigated an anonymous internal employee complaint received via Community’s anonymous hotline, it was determined that Katrina had accessed her own chart, as well as the confidential health records of multiple other patients, including the McKenzies. Katrina was placed on leave and then terminated. The McKenzies were later notified of the unauthorized access of their medical information and eventually learned that Katrina was the culprit.

Community later argued that McKenzies claim should be dismissed because they did not follow the administrative procedures set forth by Indiana’s Medical Malpractice Act. Specifically, they argued that the McKenzies had failed to file a proposed complaint with the Indiana Department of Insurance and, therefore, the trial court lacked subject matter jurisdiction. However, the trial court disagreed noting that the misconduct did not “involve providing medical treatment” to the McKenzies and, furthermore, “[t]he accumulation and review of patient records plays an important part in how a physician may make a medical decision, however, handling the records themselves are not treatment of the patient by medical professional.” And, as to Community’s culpability for Katrina’s actions, the trial court noted she testified, “I did not have a clear understanding of the scope of my authority in this area until the subject incident.” Finally, the trial court reiterated Indiana law that “a party responsible for gathering and storing individuals’ private health information has a duty to keep confidential that information.”

The Court of Appeals agreed with the trial court’s assessment and distinguished prior Indiana cases relied upon by Community for the proposition that disclosing confidential information should fall within the Medical Malpractice Act. The Court noted that although maintaining health records or the lack thereof involves “skillful, accurate, and ongoing” maintenance by “physicians and other health care providers,” the unauthorized access of records was not vital to a medical malpractice claim, but issues of training, supervision, and retention. Nowhere did the McKenzies claim that Katrina access was related to professional expertise, skill, or judgment.

The Court of Appeals also addressed whether the McKenzies could legally maintain respondeat superior/vicarious liability claims as well was claims of negligent training, supervision, and retention. The court found issues of fact relating to those claims. However, the Court did find that Indiana does not recognize a legal claim for “public disclosure of private facts,” citing the case of Doe v. Methodist Hosp. Moreover, the Court also found that there was no legal claim under Indiana law for “intrusion” under the facts of the case, as the McKenzies did not allege any physical intrusion by Katrina into their physical solitude, rather than emotional. You can read more about this interesting case in the Court’s 33-page opinion here.