819 S.E.2d 809
Va.2018Background
- Lindsey Parker alleged two Carilion employees accessed and disclosed her confidential medical diagnosis to a third party without authorization while the employees worked for Carilion, which operates the clinics involved.
- Parker sued Carilion, Carilion Healthcare Corporation, and the two employees for wrongful disclosure (Fairfax Hospital tort), respondeat superior (vicarious liability), and negligence per se based on alleged HIPAA violations; process was served only on Carilion.
- Carilion admitted the employees were its employees but demurred, arguing the employees acted outside the scope of employment and that Carilion had no direct liability for the disclosures or under negligence per se/HIPAA.
- The circuit court sustained Carilion’s demurrers and dismissed Parker’s claims but gave Parker leave to amend; she did not amend and appealed.
- The Supreme Court of Virginia held Parker’s appeal timely, reversed dismissal of the respondeat superior claim (finding the complaint created a rebuttable presumption that the employees acted within the scope of employment), but affirmed dismissal of Parker’s direct-liability and negligence-per-se claims against Carilion.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Timeliness of appeal | Parker’s notice was timely because the demurrer order was not final until the amendment period lapsed | Carilion: Rule 1:1 makes the order "entered" when signed; 30-day clock ran from signature | Timely: final order not effective until the amendment period expired; notice of appeal timely |
| Vicarious liability (respondeat superior) | Admission of employer–employee relationship creates rebuttable presumption employees acted within scope; demurrer improper | Carilion: pleadings show employees acted outside scope as a matter of law, so employer not liable | Reversed dismissal: complaint created a rebuttable presumption of scope-of-employment; question for later factfinding |
| Direct corporate liability under Fairfax Hospital (non-disclosure tort) | Carilion had an independent duty to safeguard patient data and thus is directly liable for its employees’ disclosures | Carilion: corporate direct liability requires authorization, ratification, or action by agents with corporate authority; mere employee wrongdoing yields only respondeat superior | Affirmed dismissal: Parker did not allege corporate officers/authorized agents or facts showing direct corporate conduct; claim must proceed, if at all, as respondeat superior |
| Negligence per se based on HIPAA | HIPAA imposes standards to safeguard PHI; Code § 8.01-221 converts HIPAA violations into negligence per se | Carilion: HIPAA does not create a private right of action under Virginia common law; § 8.01-221 does not create new causes of action | Affirmed dismissal: no underlying common-law duty to secure systems as alleged; negligence per se not available from HIPAA violations and § 8.01-221 does not create a new tort |
Key Cases Cited
- Fairfax Hosp. v. Curtis, 254 Va. 437 (1997) (recognized a tort duty of health-care providers not to disclose patient information without authorization)
- Majorana v. Crown Cent. Petroleum Corp., 260 Va. 521 (2000) (employer–employee presumption and its role at pleading/summary stages)
- Plummer v. Center Psychiatrists, Ltd., 252 Va. 233 (1996) (applying scope-of-employment presumption at demurrer stage)
- Gina Chin & Assocs. v. First Union Bank, 260 Va. 533 (2000) (scope-of-employment: tort committed while performing normal function may impose vicarious liability despite personal motive)
- Norris v. Mitchell, 255 Va. 235 (1998) (when an order sustaining a demurrer with leave to amend becomes final)
- Giant of Md., Inc. v. Enger, 257 Va. 513 (1999) (clarifying the ‘‘service itself’’/job-related-service principle for respondeat superior)
- Williamson v. Old Brogue, Inc., 232 Va. 350 (1986) (doctrine of negligence per se does not create a cause of action where none existed at common law)
- Steward v. Holland Family Props., LLC, 284 Va. 282 (2012) (reaffirming that a statutory standard of care does not by itself create a duty of care for negligence per se)