Pension & Benefits News Whether employer was vicariously liable for medical assistant’s alleged HIPAA violation was question of fact for the jury
Wednesday, June 10, 2020

Whether employer was vicariously liable for medical assistant’s alleged HIPAA violation was question of fact for the jury

By Pension and Benefits Editorial Staff

An appeals court in Indiana has reversed and remanded to the trial court a judgment that granted summary judgment to a medical practice after the trial court found no vicarious liability to the employer for the acts of its employee. The employee’s scope of employment could have included acts that the employer expressly forbade, that violated the employer’s rules, orders, or instructions, and that the employee committed for self-gratification or self-benefit.

Transmittal of confidential patient information. On October 19, 2017, a patient went to an appointment at the office of an OB/GYN practitioner at a Parkview Health System, Inc.’s (Parkview) campus. A medical assistant who was employed at Parkview at that time accessed the patient’s electronic health record for approximately one minute, purportedly to enter personal information from a patient information worksheet. She then sent a text to her husband about the patient, including her name, a potential diagnosis, and that the patient was HIV-positive and had more than fifty sexual partners, although this information was not included in the patient chart and was ultimately false. The medical assistant was motivated to send the patient’s information because she feared that her husband had engaged in a sexual relationship with the patient. She had previously signed a Confidentiality Agreement and an Acknowledgment Regarding Access to Patient Information acknowledging her understanding of Parkview’s confidentiality policy.

Patient’s lawsuit against Parkview. After it was reported to Parkview that a potential Health Insurance Portability and Accountability Act (HIPPA) violation had occurred, an investigation was conducted and the medical assistant was terminated on May 2, 2018, and the patient was notified of the disclosure of her protected health information on May 7, 2018. She filed a complaint for damages with jury demand against Parkview on September 28, 2018, alleging claims for respondeat superior, direct negligence for Parkview’s negligent training, supervision, and retention, and direct negligence for Parkview’s violation of its statutory and common-law duties of protection of privacy under HIPAA. On July 19, 2019, Parkview moved for summary judgment on each of the three claims, which the trial court ultimately granted. The patient appealed, and for the reasons stated below, the appeals court reversed and remanded.

Issue of ‘scope of employment’. The trial court had ruled that there was no genuine issue of material fact and that Parkview was entitled to judgment as a matter of law with regards to its vicarious liability under respondeat superior principles, because the texts to a third party clearly fell outside the scope of her employment. The trial court further noted that the medical assistant had no legitimate business purpose for accessing the medical record on the day of the appointment. The patient argued on appeal that the trial court misapplied the respondeat superior standard and that all of the medical assistant’s actions involving the access and communication of personal patient information were within the scope of her employment for purposes of establishing Parkview’s vicarious liability.

Doctrine of respondeat superior. When considering an employer’s liability for the actions of its employee, the general rule is that vicarious liability will be imposed upon an employer under the doctrine of respondeat superior where the employee has inflicted harm while acting ‘within the scope of employment’ and the employer would not otherwise be liable for its own acts. To fall within the scope of employment, the employee’s injurious act must either (1) be incidental to the conduct authorized, or (2) to an appreciable extent, further the employer’s business. Whether an act falls within the scope of employment is generally a question of fact.

‘Incidental to’ element. The patient contended that the misconduct was ‘incidental to’ the authorized conduct because the acts of accessing and texting the personal health information was incidental to conduct Parkview had authorized the medical assistant to do as part of her employment. The appeals court agreed, citing precedent that ultimately, the scope of employment encompasses the activities that the employer delegates to employees or authorizes employees to do, plus employees’ acts that naturally or predictably arise from those activities.

That means that the scope of employment—which determines whether the employer is liable—may include acts that the employer expressly forbids; that violate the employer’s rules, orders, or instructions; that the employee commits for self-gratification or self-benefit; that breach a sacred professional duty; or that are egregious, malicious, or criminal.

Genuine issues of material fact. The appeals court ruled that when all of the above standards were applied, there existed several genuine issues of material fact as to whether Parkview should be held vicariously liable for the medical assistant’s conduct, thus rendering summary judgment inappropriate. Accordingly, they reversed the grant of summary judgment and remanded the matter back to the trial court.

SOURCE: SoderVick v. Parkview Health Systems, Inc. (Ind. App.), No. 19A-CT-2671, May 15, 2020.

Back to Top

Interested in submitting an article?

Submit your information to us today!

Learn More