Courtney R. Robbins v. The Trustees of Indiana University and Clarian Health Partners, Inc.
45 N.E.3d 1
Ind. Ct. App.2015Background
- Tiffaney DeBow, a licensed practical nurse, was hired by Indiana University School of Medicine after a background check revealed prior misdemeanor convictions; she signed a confidentiality agreement limiting access to PHI to authorized business purposes only.
- Ciarían Health Partners, owner of the electronic medical record systems, issued DeBow a username/password at the School’s request; Ciarían was not DeBow’s employer.
- On her first days of work DeBow accessed Courtney Robbins’s and her children’s medical records dozens of times though Robbins was not a gastroenterology patient; DeBow later publicly posted Robbins’s medical information online and admitted she acted for personal revenge.
- DeBow pled guilty in federal court to wrongful disclosure of individually identifiable health information; Robbins sued the Trustees of Indiana University and Ciarían asserting respondeat superior (vicarious liability) for invasion of privacy (public disclosure of private facts) and intentional infliction of emotional distress, and alternatively negligent hiring.
- The trial court granted summary judgment for the Trustees and Ciarían; the appellate court affirmed, holding neither defendant was vicariously liable and that negligent hiring was not shown.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether Ciarían can be vicariously liable for DeBow under respondeat superior (via joint venture or agency) | Ciarían and Trustees were joint venturers and DeBow was Ciarían’s agent, so Ciarían is liable | No joint venture (no profit-sharing or mutual control); DeBow was not Ciarían’s agent—Ciarían merely provided EMR access | Affirmed: Ciarían not vicariously liable |
| Whether Trustees are vicariously liable for DeBow’s disclosure (respondeat superior) | Trustees should be liable because acts occurred at work using employer systems | DeBow acted entirely for personal reasons, was expressly unauthorized by confidentiality agreement, and her acts were not within scope of employment | Affirmed: Trustees not vicariously liable |
| Whether the Trustees are liable for negligent hiring/retention | Trustees knew or should have known DeBow had propensity for criminal acts and created foreseeable risk | DeBow’s prior convictions did not indicate propensity to misuse EMR; Robbins was not a foreseeable victim given department and duties | Affirmed: summary judgment for Trustees on negligent hiring |
| Whether the tort of public disclosure of private facts is recognized in Indiana (relevant to vicarious-liability claim) | Plaintiff proceeds assuming tort is actionable | Defendants argued (and courts have questioned) whether Indiana recognizes that sub-tort | Court did not resolve the recognition question because vicarious liability failed; concurrence notes Indiana generally treats the tort as not recognized currently |
Key Cases Cited
- Barnett v. Clark, 889 N.E.2d 281 (Ind. 2008) (respondeat superior scope-of-employment principles)
- Doe v. Lafayette Sch. Corp., 846 N.E.2d 691 (Ind. Ct. App. 2006) (scope-of-employment analysis where employee used employer resources for personal purposes)
- Walgreen Co. v. Hinchy, 21 N.E.3d 99 (Ind. Ct. App. 2014) (pharmacist’s unauthorized access arguably incidental to authorized duties; precluded summary judgment)
- Doe v. Methodist Hosp., 690 N.E.2d 681 (Ind. 1997) (plurality discussing whether Indiana recognizes public disclosure of private facts)
- Felsher v. Univ. of Evansville, 755 N.E.2d 589 (Ind. 2001) (supreme court treated public disclosure branch as not recognized)
- Sandage v. Bd. of Comm’rs of Vanderburgh County, 897 N.E.2d 507 (Ind. Ct. App. 2008) (negligent hiring: foreseeability and contact with victims are essential factors)