Lead Opinion
[1] Courtney R. Robbins appeals the trial court’s grant' of summary judgment in favor of the Trustees of Indiana University and Ciarían Health Partners, Inc. She
I. Whether the trial court -erred in granting summary judgment in favor of the Trustees and Ciarían on the issue of vicarious liability; and
II. Whether the trial court erred in granting summary judgment in favor of the Trustees on the issue of negligent hiring.
We affirm.
Facts and Procedural History
[2] In September 2010, Tiffaney De-Bow, a licensed practical nurse, applied for a job at the Indiana University School of Medicine. Her application revealed that she had been a nurse for twelve years and had worked at three hospitals and a nursing home. Her application also revealed that she had been convicted of misdemean- or battery in May 2009. When questioned about the conviction, DeBow explained that during a confrontation with a woman who had made comments about DeBow’s daughter oh the Internet, DeBow poked the woman on the forehead.
[3] As part of the application process, DeBow also read and signed the Indiana University Department of Medicine Commitment to Confidentiality Agreement, which provides in relevant part as follows:
The IU Department of Medicine regards the security and confidentiality of its data and information to be of utmost importance. Each information user holds a position of trust in which he or 'she must preserve the confidentiality, privacy and security of Indiana University (IU), Indiana University Foundation (IUF), practice plan, patient medical record and protected health information (PHI) that is accessed, maintained, or transmitted in any form or medium.
Appellant’s Appendix at 49.
The Confidentiality Agreement also provided in part:
As an information user:
a. I will only access, use (read, add, change, or delete), or disclose information for which I have a business reáson and am authorized to do so. At no time will I access, use, or disclose confidential or sensitive information to any person or third party for a personal, unauthorized, unethical, or illegal reason. I will not share my password(s) nor will I use a sign-on/password that is not assigned to me.
b. I understand that my obligation to safeguard confidentiality at all times, both on1 duty and off-duty, remains' in full force during the entire term of my employment/affiliation and continues in effect after such employment/affiliation terminates....
Id.
After DeBow completed her employment application, an independent company conducted a pre-employment background check on her for the Trustees. The search revealed the misdemeanor battery conviction, which resulted in a one-year sentence with all but four days suspended, community service, six months on probation and twelve anger management classes. The search also revealed dismissed charges for class A misdemeanor criminal mischief in 2006 and class A misdemeanor driving while suspended in 2008 as well as a probation violation.
Following the background check, DeBow was offered a position providing health care services to the patients of the School of Medicine’s Gastroenterology Department. After DeBow accepted the position, Nada Phoenix, acting on behalf of the School of Medicine, submitted an Access Request to Ciarían Data Security to provide DeBow a username and password so she could access two-electronic medical
[7] • On October 11, 2010, her first day of work, DeBow began accessing the medical records of Robbins and her children. Specifically, a medical records access report shows that on October 11 and 13, DeBow accessed the medical records of Robbins and her children forty-two times between 2:05 p.m. and 4:28 p.m. Robbins was not a patient of the gastroenterology department, and the medical records De-Bow accessed were not created in connection with treatment and care of Robbins at the School of Medicine. DeBow found the information in one of the medical records systems owned by Ciarían. On October 13, DeBow posted medical information about Robbins obtained from these records on Robbins’s former boyfriend’s internet blog. When confronted by her employer, DeBow admitted what she had done and that she knew it was wrong. She admitted “that there was no legitimate business reason for her to access the records and explained that her sole motivation was that ... [she] desired revenge.” Id.. at 54.
[8] Pursuant to a plea agreement executed in. February 2012, DeBow pled guilty in federal court to the felony charge of wrongful disclosure of individually identifiable health information for obtaining Robbins’s health information during the course of her employment with the intent to transfer and use that information for personal gain and malicious harm and to embarrass Robbins, and DeBow was sentenced to probation for a term of three years and was fined $1,000.
[9] In November 2012, Robbins filed an amended complaint against the Trustees and Ciarían wherein she alleged that the defendants, were vicariously liable for the actions of DeBow, who allegedly committed the torts of invasion of privacy by the public disclosure of private facts and intentional infliction of emotional distress. Robbins alternatively argued that if the Trustees were not vicariously liable to her for these acts, they were liable to her for negligently hiring DeBow.
[10] The Trustees and Ciarían filed summary judgment motions. The Trustees designated DeBow’s affidavit in support of their motion. In the affidavit, De-Bow explained that she accessed Robbins’s medical records for “personal reasons.” Id. at 57. According to DeBow, she and Robbins “had been involved in an acrimonious personal feud for many years and that was [her] motivation to disclose protected medical information.” Id. DeBow further explained that she “was acting on [her] own initiative and not within the scope of [her] employment when [she] accessed and published [ ] Robbins’ records,” that she “was not involved in any way in the provision of medical care to [ ] Robbins or her children,” and that she “knew it was against [her] employer’s policies and rules and [her] acts were not part of [her] job.” Id. Following a hearing, the trial' court granted summary judgment in favor of the Trustees and Ciarían.
Discussion
[11] Summary judgment is appropriate only when there are no genuine issues of material fact and the moving party is entitled to judgment-as a matter of law. Ind. Trial Rule 56(C).. In reviewing a trial court’s ruling on -summary judgment, this court stands in the shoes of the trial court and applies the same standard in determining whether to affirm or reverse the grant of summary judgment. Doe v. La
[12] Relying on specifically designated evidence, the moving party bears the burden of making a prima facie showing that there are no genuine issues of material fact and that it is entitled to judgment as a matter of law. Id. If the moving party meets this burden, the burden then shifts to the nonmovant to set forth specifically designated facts showing that there is a genuine issue for trial. Id.
[13] A genuine issue of material fact exists where facts concerning an issue that, would dispose of the issue are in dispute or where the undisputed material facts are capable of supporting conflicting inferences on such an issue. Id. In our review, we consider all of the designated evidence in the light most favorable to th¿ nonmoving party. Id.
I.
A. Ciarían
[14] The first issue is whether the trial court erred in granting summary judgment in favor of the Trustees and Ciarían on the issue of vicarious liability. According to Robbins, the Trustees and Ciarían are vicariously liable to Robbins for the actions of DeBow, who allegedly committed the torts of invasion of privacy with the public disclosure of private facts and intentional infliction of emotional distress: Vicarious liability will be imposed upon an employer under the doctrine of respondeat superior where the employee has inflicted harm while acting within the scope of employment. Barnett v. Clark,
[15] At the outset, we note that the parties agree that Ciarían was not DeBow’s employer. Robbins, however, argues that Ciarían can be held liable under the respondeat superior doctrine because Ciarían and the Trustees were in a joint venture and DeBow was Clarian’s agent.
[16] A joint venture is an association of two or more persons formed to carry out a single business enterprise for profit. Walker v. Martin,
[17] Our review of the designated materials reveals a Definitive Health Care Resources Consolidation Agreement, which sets forth the relationship between Ciarían and the Trustees. Specifically, the Agreement provides in relevant part as follows:
11.01 General Relationships; Retention of Profits and Losses
[Ciarían] is a separate operational, financial and corporate organization from the Trustees ... [A]ll revenue of the Hospitals ... shall be the sole property of [Ciarían] and likewise [Ciarían] shall be solely responsible for all costs and expenses related to the ownership, management, and operations of the Hospitals and its other property, assets, and business. Any losses from the operation of the Hospitals shall remain [Clarian’s] sole responsibility ... and shall not be subject to allocation to or payable by ... the Trustees.... Any revenue- exceed*7 ing expenses shall remain the property of [Ciarían] and shall not be subject to distribution to ... the Trustees — ”
Appellant’s Appendix at 536. Because this Agreement does not give Ciarían and the Trustees an equal right to direct and govern any undertaking and does not provide for the sharing of profits, Ciarían and the Trustees were not in a joint venture for the purpose of a finding of vicarious liability.
[18] And DeBow was not Cla-rian’s agent. For the liability of an agent to be imputed to a principal, an agency relationship must exist. Smith v. Delta Tau Delta, Inc.,
[19] Our review of the designated evidence reveals that DeBow, who took care of patients in the medical school’s gas-troenterology department, did not act on Clarian’s behalf and was not subject to Clarian’s control. Rather, at the medical school’s request, Ciarían simply issued a username and password to DeBow so that she could access the electronic medical records that Ciarían owned. Ciarían is not subject to vicarious liability for DeBow’s actions.
B. Trustees
[20] We next turn to whether the Trustees as DeBow’s employer may be held vicariously liable for the actions of DeBow. In her amended complaint, Robbins alleged that the Trustees were vicariously liable for the actions of DeBow and that DeBow committed the tort of invasion of privacy by the public disclosure of private facts as well as the tort of intentional infliction of emotional distress. If the Trustees may not be held vicariously liable for the actions of DeBow, then the Trustees are entitled to summary judgment with respect to Robbins’s claim based on the alleged public disclosure of private facts by DeBow, and her claim based on the alleged intentional infliction of emotional distress by DeBow.
[22] In addition, although Indiana courts have established that an employer can be vicariously liable for the criminal acts of an employee, this determination depends 'upon whether the employee’s actions were authorized by the employer. Id. If it is determined that none of the employee’s acts were authorized, there is no respondeat superior liability. Id. “Furthermore, acts for which the employer is not responsible are those done ‘on the employee’s own initiative, [ ] with no intention to perform it as part of or incident to the service for which he is employed.” Id. (quoting Stropes v. Heritage House Childrens Ctr.,
[28] In support of her argument that the trial court erred in granting summary judgment in favor of the Trustees^ Robbins directs us to this court’s opinion in Walgreen Co. v. Hinchy,
[24] The court in Walgreen also discussed this court’s previous opinion in Doe,
[25] In support of her argument that the school was vicariously liable, Doe argued that the teacher used a school-providr ed laptop to send her emails and that emailing students was an act authorized by the school. M-This court observed that, if some of an employee’s actions were authorized, the question of whether the unauthorized acts were within the scope of employment is one for the jury. Id. at 702. We noted that, simply because the teacher used the school’s equipment and facilities to initiate a relationship with Doe,
[26] We find the reasoning in Doe persuasive in light of the particular facts and circumstances of this case. DeBow accessed Robbins’s medical records while at work. However, like in Doe, the fact that DeBow used the access provided to her to obtain Robbins’s medical information does not necessarily mean that her acts were within her scope of employment. Id.
[27] Importantly, in signing the Indiana University Department of Medicine Commitment of Confidentiality Agreement, DeBow agreed that she would “only access, use (read, add, change, or' delete),' or disclose information for which [she had] a business reason and [was ] authorized to do so” and that “[a]t no time [would she] access, use, or disclose confidential or sensitive information to any person or third party for a personal, unauthorized, unethical, or illegal reason.” Appellant’s Appendix at 49 (emphases added). The designated evidence thus establishes that, while DeBow’s employer authorized her to access patient information for business reasons, she was expressly not authorized to access, use, or disclose the information for. personal, unauthorized, unethical, or illegal reasons. Indeed, De-Bow stated in her affidavit, which was designated by the Trustees, that she accessed Robbins’s medical records “for personal reasons and not as part of [her] employment by Indiana University.” Id. at 57. DeBow also stated that she “was acting on [her] own initiative and not within thé scope of [her] employment when [she] accessed and published [] Robbins’ records,” that she “was not involved in any way in the provision of medical care” to Robbins, and that she “knew it was against [her] employer’s policies and rules and [her] acts were not part of [her] job.” Id.
[28] The affidavit of an administrative supervisor in the gastroenterology department, also designated by, the Trustees, stated that, when DeBow was asked about improperly accessing Robbins’s health records, DeBow “admitted that there was no legitimate business reason for her to access the records and explained that her sole motivation was that ... [she] desired revenge.” Id. at 54. Robbins does not point to .designated evidence opposing these statements. Robbins does not claim that DeBow accessed her records for business reasons. The Trustees’ designated evidence establishes that Robbins was not a patient of the School of Medicine’s Gas-troenterology Department, unlike in Walgreen where the person whose information was accessed was a Walgreen customer. In her amended complaint, which was designated by the Trustees, Robbins claimed that DeBow “had no reason to access [her] and her children’s health care records” and that DeBow “was, not involved in any way with providing. any heath [sic] care or treatment of Robbins or her children.” Id. at 36.
[29] DeBow of- her own initiative and unrelated to any business function of her employment or her employer, accessed and disclosed the private medical 'records of Robbins. This disclosure was unautho
[30] Walgreen does not require a different'outcome. Some of the pharmacist’s actions in 'Walgreen were authorized, such as handling prescriptions for Walgreen customers, reviewing prescription histories, ' and making prescription-related printouts. The Walgreen opinion did not discuss whether the pharmacist signed an agreement explicitly limiting her access to customer records and forbidding the use of records for personal reasons. As revealed by the confidentiality agreement arid other designated evidence discussed above, none of DeBow’s conduct, including accessing and disclosing Robbins’s medical records for personal reasons, was authorized by her employer.
[31] We conclude that the Trustees designated evidence making a prima facie showing that DeBow’s wrongful acts were not committed within the scope of employment, that Robbins did not set forth designated facts showing there is a genuine issue for trial, and thus that the Trustees established that they as DeBow’s employer may not be held vicariously liable for De-Bow’s actions under the doctrine of re-spondeat superior. Accordingly, we affirm the entry of summary judgment in favor of the Trustees as to Robbins’s claim of invasion of privacy by public disclosure of private facts and her claim of intentional infliction of emotional distress.
II.
[32] The next issue is whether the trial court erred in granting summary judgment in favor of the Trustees on the issue of negligent hiring.
[33] Indiana recognizes the tort of negligent hiring and retention of an employee. Konkle v. Henson,
A master is under a duty .to exercise reasonable care so to control his servant while acting outside the scope of his employment as to prevent him from intentionally harming others or from so conducting himself as to create an unreasonable risk of bodily harm to them, if
■(a) the servant
(i) is upon ‘the premises in possession of the blaster or upon which the servant is privileged to enter only as his servant, or '
(ii) is using a chattel of the master, and
*12 (b) the master
(i) knows or has reason to know that he has the ability to control his servant, and
(ii) knows or should know of the necessity and opportunity for exercising such control;'
[34] In addition, there are general rules and concepts surrounding the imposition of a duty that must also be satisfied. Clark v. Aris, Inc.,
[35] Sandage v. Board of Commissioners of Vanderburgh County,
[36] Here, as in Sandage and Clark, DeBow’s employment did not put her in contact with the victim, who was not a department of gastroenterology patient. DeBow was not authorized to access Robbins’s electronic medical records when she was not a patient of DeBow’s employer, and DeBow’s violation of medical confidentiality did not constitute a recurrence of criminal behavior for which DeBow had earlier been convicted. Specifically, there were no prior reports of DeBow accessing and publishing any other patient’s confidential medical records. Under these circumstances, Robbins was not a reasonably foreseeable victim and DeBow’s internet posting of information that humiliated Robbins was not a reasonably foreseeable harm.. The trial court did not err in granting summary judgment in favor of the Trustees on the negligent hiring issue.
Conclusion
[37] , For the foregoing reasons, the trial court did not err in granting summary judgment in favor of the Trustees and Ciarían.
[38] Affirmed.
Notes
. The Trustees maintain that the tort of invasion of privacy by public disclosure of private facts' is not á valid cause of action in Indiana. There is some support for this position. See Doe v. Methodist Hosp.,
. Because Ciarían did not hire DeBow, the trial court did not err in granting summary judgment in favor of Clárian on the negligent hiring issue.
Concurrence Opinion
concurring in part and concurring in result in part.
[39] I fully concur in the majority’s affirmance of summary judgment in favor of Ciarían and in favor of the Trustees on Robbins’s negligent hiring and intentional infliction of emotional distress claims. I would also affirm summary judgment in favor of the Trustees on Robbins’s claim for invasion of privacy by the public disclosure .of private facts, but I would do so on the-basis that the Trustees cannot be held vicariously liable for a nonexistent tort. Whether Indiana, recognizes this tort is technically an open question, but for all practical purposes the answer is currently no.
[40] In Doe v. Methodist Hospital,
[41] In sum, since Felsher was decided in 2001, our state’s highest court has acted as if public disclosure of private facts is not a valid cause of action in Indiana, even though a majority of the court has not so held. Although neither Doe nor Felsher is binding precedent on this point, I am not inclined to rock this particular boat. Consequently, I would affirm summary judgment in favor of the Trustees on Robbins’s invasion of privacy claim on the basis that they cannot be held vicariously liable for a nonexistent tort.
[42] Nevertheless, I respectfully urge our supreme court to revisit its pronouncements in Doe and Felsher in light of the exponential increase in the amount and sensitivity of personal information that has become available online since those cases were decided and the corresponding increase in the speed and ease with which that information may be broadcast to the public. It is difficult to overstate the extent to which we have surrendered, by choice or compulsion, the most intimate details of our lives to the digital domain. Many Hoosiers are paid (or, as in the case of state employees, must be paid) online. And many Hoosiers bank, shop, conduct business, pay taxes, engage in social and political activity, seek medical and legal advice, and (pursuant to federal law) have their health records stored online. Although much of this information is expected and intended to be disseminated to a wide audience (family vacation photos, job résumés), much is expected, and intended to be kept under the electronic equivalent
[43] Assuming - for argument’s sake that the tort is'in fact alive and well in Indiana, I would agree with the majority that DeBow’s acquisition and disclosure of Robbins’s medical information for purely personal reasons was not -within the scope of her employment and therefore the Trustees may not be held vicariously liable under a respondeat superior theory. I would not find the Confidential Agreement to be dispositive in this regard, however,, and I would note that other courts have recognized that direct liability may arise in similar situations. See, e.g,, Doe v, Guthrie Clinic, Ltd.,
. Unlike the Trustees in this case, the employer in Walgreen, 21 N.E.3d 99, did not properly raise the issue on appeal, and this Court declined to address it. Id. at 112 n. 2.
. Disappointingly, Robbins fails to acknowledge either Felsher or Cheng in her reply 1 brief.
. One basis for the Doe plurality’s refusal to recognize the tort was its "potential conflict with the libel provision of the Indiana Bill of Rights: 'In all prosecutions for libel, the ’truth of the matters alleged to be’libelous may be given in justification.’ ” 690 N.E.2d at< 687 (quoting Ind, Const, art. 1, § 10). I find greater merit in Justice Dickson’s view that “our constitution provides a strong basis for continuing to recognize this tort”:
[A] primary harm that can, result from a public disclosure of private facts is an injury to a person’s reputation. The Indiana Constitution provides express recognition of an individual’s interest in reputation and accords it specific protection. Bals v. Verduzco,600 N.E.2d 1353 , 1355 (Ind.1992). It expresses distinct protection for personal reputation: "[Ejvery person, for injury done to. him in his person, property, or reputation, shall have remedy by due course of law.” Ind. Const, art. 1, § 12 (emphasis added). Furthermore, the provision protecting the "right to speak, write, or print, freely, on' any subject whatever” is expressly qualified by the limitation "but for the abuse of that right, every person shall be responsible.” Ind. Const, art. 1, § 9. While the framers were concerned that the defense of truth be permitted in prosecutions for libel, e.g., defamatory falsehoods, it does not follow that they would have intended to prohibit accountability for harm resulting from the unwarranted public disclosure of private facts, albeit truthful disclosures.
Id. at 695 (footnote omitted) (Dickson, J., concurring in result)..