Indiana Supreme Court Recognizes Public Dissemination of Private Health Information May Give Rise to Public-Disclosure Tort Claim

In Z.D. v. Community Health Network, Inc., the Indiana Supreme Court addressed a patient’s claim for invasion of privacy and negligence against a hospital that disclosed her private health information to a wrong person.

Z.D. received medical care at Community Health Network’s emergency department in 2018. A hospital employee called Z.D. to discuss her health matters but could not reach her. The employee then prepared a letter containing Z.D.’s diagnosis and treatment, but placed it in an envelope addressed to Jonae Kendrick, a teenager who knew Z.D.’s daughter. Kendrick opened the letter, posted it on Facebook, and tried to tag Z.D. Z.D.’s daughter saw the post and notified her mother. Kendrick declined Z.D.’s daughter’s request to remove the post. However, Kendrick later relented and removed the post in response to Z.D.’s request that she remove the post and return the letter in exchange for $100. Z.D. sued the hospital for invasion of privacy and negligence, seeking damages for emotional distress and other losses.

The trial court granted summary judgment to the hospital on all of Z.D.’s claims. The court found that the hospital was not the proximate cause of Z.D.’s damages, that Z.D. could not recover emotional-distress damages in her negligence claim due to the modified impact rule, and that Z.D. did not bring a claim for public disclosure of private facts.

The Court of Appeals affirmed in part and reversed in part. We previously wrote a blog about this decision you can read here. It affirmed the trial court’s grant of summary judgment on Z.D.’s claim for negligent training, supervision, and retention of employees, but reversed on her other claims.

Significantly, in reversing the trial court, the Court of Appeals adopted the elements of the public-disclosure tort found in the Restatement (Second) of Torts § 652D. This tort consists of four elements: 1) the information disclosed was private; 2) the information was “communicated in a way that either reaches or is sure to reach the public in general or a large enough number of persons such that the matter is sure to become public knowledge”; 3) the information would be highly offensive to a reasonable person; and 4) the information was not of legitimate public concern. Ultimately, it held that Z.D. adequately pled a public-disclosure claim that the hospital did not negate the publicity element of that claim, and that issues of fact remained as to whether Z.D. could recover pecuniary damages and whether the hospital was the proximate cause of those damages in her negligence claim.

The Supreme Court affirmed in part and reversed in part. First, it agreed with the Court of Appeals that Z.D. properly raised a public-disclosure claim and that the hospital did not negate the publicity element. It clarified that the public-disclosure tort does not require a showing of intent, that recovery for emotional distress is available in such a claim, and that disclosure to one person can satisfy the publicity element depending on the facts and circumstances. The Court explained that not requiring any intent is consistent with the public-disclosure tort’s dual purpose. The tort helps deter public disclosures by incentivizing protective measures through negative reinforcement. In other words, lackadaisical privacy practices may yield a civil remedy for the individual whose information was shared publicly. And, regardless of the intent of the disclosing party, the impact to an individual whose private information is shared publicly will be no different. The level of harm to that individual is tied to the nature of the facts disclosed and the extent of the disclosure.

The Supreme Court also agreed with the Court of Appeals that Z.D.’s negligence claim remained for pecuniary damages (claimed loss of income and rental expenses) but declined to exempt negligence-based medical privacy breaches from the modified impact rule’s physical-impact requirement for the recovery of emotional distress damages. The Court believed the public-disclosure tort better addresses the harm by “incorporat[ing] certain, necessary restraints, particularly the highly offensive and publicity elements, to provide relief to those who suffer invasion of privacy without exposing individuals and entities to inordinate liability each time someone’s privacy is compromised.”

This case confirms that Indiana recognizes a tort for invasion of privacy by public disclosure of private facts, and that plaintiffs can recover emotional-distress damages without proving intent or physical impact if they satisfy the four elements of the tort. It also reaffirms that negligence claims for emotional-distress damages are subject to the modified impact rule, which requires a direct physical impact from the negligence. It further highlights the importance of protecting private health information from unauthorized disclosures, and the potential liability for healthcare providers who fail to do so. You can read the Court’s decision here.