Although HIPAA does not create a private cause of action, a recent Indiana Superior Court jury verdict demonstrates that HIPAA still could play an important role in private causes of action in state court based on negligence and professional liability as it relates to confidentiality. On July 26, 2013, a jury in Marion County, Indiana, awarded $1.44 million to a Walgreens customer based on allegations that the customer’s pharmacist accessed, reviewed and shared the customer’s prescription history with others who then used the information to intimidate and harass the customer. At the heart of the case was a tangled love triangle in which the pharmacist’s husband had fathered a child with a customer. Upon learning of the relationship, the pharmacist allegedly accessed the customer’s prescription information and shared it with her husband, who used the information to intimidate the customer when she demanded child support payments.
The customer filed suit against both the pharmacist and Walgreens in Indiana Superior Court, claiming that both parties had breached their statutory and common law duties of confidentiality and privacy. The complaint also included claims of negligence, invasion of privacy and publication of private facts against the pharmacist and claims of negligent training, supervision and retention against Walgreens for continuing to employ the pharmacist after discovering the incident. The court granted Walgreens’ motion for summary judgment on the negligent training claim. At trial, plaintiff argued that even though HIPAA did not create a private cause of action, it still defined the standard of care for a pharmacist’s duty of confidentiality and privacy to plaintiff’s health information. Thus, according to plaintiff, because the pharmacist’s actions violated HIPAA, the pharmacist had breached the standard of care and should therefore be held liable for the harm caused to plaintiff. Additionally, because the pharmacist had acted within the scope of her employment, plaintiff argued that Walgreens also was liable for the pharmacist’s actions. After a four-day trial, the jury agreed on both points, awarding $1.44 million in damages to plaintiff. Walgreens intends to appeal the verdict.
This is not the first case in which HIPAA has been the centerpiece of a private cause of action, but it does appear to be the first case resulting in a substantial jury verdict against a provider using HIPAA as the basis for the standard of care. Whether and to what extent HIPAA can be used to establish the standard of care in a professional liability, negligence or other breach of professional duty case will be dependent on state tort law, and the outcome of this case on appeal is unpredictable. Nonetheless, as HIPAA continues to receive attention from trial lawyers seeking to establish the standard of care in negligence and professional liability cases involving the improper disclosure of health information, healthcare providers must be aware that, depending on the law of the state in which they are licensed, their potential liability for HIPAA violations could extend beyond civil monetary penalties.