WYATT LEDFORD v. UOFL HEALTH-LOUISVILLE, INC.; JESSICA DAWN CAMPBELL; MARTHA MATHER; AND UOFL HEALTH, INC.
NO. 2024-CA-0022-MR
Commonwealth of Kentucky Court of Appeals
JANUARY 31, 2025
RENDERED: JANUARY 31, 2025; 10:00 A.M.
TO BE PUBLISHED
HONORABLE PATRICIA MORRIS, JUDGE
ACTION NO. 21-CI-006141
OPINION
REVERSING AND REMANDING
** ** ** ** **
BEFORE: CETRULO, COMBS, AND A. JONES, JUDGES.
JONES, A., JUDGE: The Appellant, Wyatt Ledford, brings this appeal from the Jefferson Circuit Court‘s order dismissing his common law invasion of privacy and negligence claims against UofL Health-Louisville, Inc., Jessica Dawn Campbell, Martha Mather, and UofL Health, Inc. (collectively referred to herein as “Appellees“) with prejudice. The circuit court determined that the claims were
I. BACKGROUND
Peace Hospital (“Peace“) is a private, not-for-profit behavioral health care hospital owned and operated by UofL Health. Mr. Ledford, a transgender man, was employed at Peace from August 2018 until October 30, 2020.1 During this period, Mr. Ledford also volunteered at Peace, leading group therapy sessions twice weekly.
In October 2020, after the death of a family member, Mr. Ledford began experiencing suicidal ideations. On October 21, 2020, a friend took Mr. Ledford to Norton‘s Hospital in Louisville, Kentucky, where he was admitted as a psychiatric patient. Dissatisfied with his care, Mr. Ledford discharged himself on October 24, 2020, and sought treatment at Baptist Healthcare East (“Baptist“). Baptist determined Mr. Ledford needed psychiatric admission, but it lacked available beds. Baptist staff advised Mr. Ledford that Peace was the only nearby facility that could meet his care needs.
Eighteen hours later, Mr. Ledford was assigned to a room on the 1-Lourdes Unit, where he routinely worked as a therapist. Concerned about professional boundaries, Mr. Ledford requested placement in another unit, but Peace staff refused to accommodate his request at that time. As a result, Mr. Ledford was admitted to the 1-Lourdes Unit and attended group therapy alongside patients he had previously led in a professional capacity just a few days prior.
On October 26, 2020, Lead Clinician Mаry Skaggs informed Mr. Ledford that he was being transferred to the 2-East Unit. Two days later, Peace staff allegedly told Mr. Ledford that his medical records had been improperly accessed by employees outside his treatment team. Mr. Ledford asserts that his records contained sensitive information about his mental health and past traumas, and that their unauthorized access by his co-workers caused him significant distress.
After resigning, Mr. Ledford was allegedly informed that numerous Peace employees outside his care team accessed and printed his medical records, further compounding his distress. For example, Mr. Ledford asserts that four days after his discharge, Jessica Dawn Campbell, Peace‘s Director of Patient Intake and Mr. Ledford‘s supervisor, printed Mr. Ledford‘s Peace Needs Assessment on several occasions. He further alleges that over the coming days, he learned that his electronic medical records had been accessed numerous times from locations outside the units he was assigned during his stay such as private offices, a pediatric unit, and a unit for the severely mentally ill.
On October 27, 2021, Mr. Ledford filed a complaint against Peace and two of its personnel, Martha Mather and Jessica Dawn Campbell.2 In Paragraph
I. Invasion of Privacy arising from Unauthorized Access of Plaintiff‘s Medical Records
- Plaintiff incorporates all preceding paragraphs as if fully set forth herein.
- Plaintiff‘s privacy was unreasonably intruded upon when employees and agents of UofL Health accessed Plaintiff‘s protected health information without permission.
- The unauthorized intrusion upon Plaintiff‘s protected health information was highly offensive to Plaintiff and a reasonable person would find such intrusion to be highly offensive.
- Defendants, through their actions described herein, invaded Mr. Ledford‘s well-established right to privacy.
- Plaintiff was directly injured by Defendants’ unauthorized intrusion upon his protected health information and medical records and Plaintiff‘s injury was foreseeable. There exists a causal connection between Plaintiff‘s injury and Defendants’ actions.
- As a direct and proximate cause of Defendants’ actions described herein, Plaintiff has suffered from a loss of income and benefits, emotional stress, and mental anxiety, for all of which he should be compensated.
- Plaintiff incorporates all preceding paragraphs as if fully set forth herein.
- UofL Health owed Plaintiff a duty to protect Plaintiff‘s protected health information and medical records from unauthorized disclosure.
- During the times relevant to the allegations in the Complaint, UofL Health failed to maintain and enforce an adequate and effective policy prohibiting and addressing employees’ unauthorized access to Mr. Ledford‘s protected health information and medical records.
- As a result of UofL Health‘s failure to protect Plaintiff‘s medical records from unauthorized disclosure, Plaintiff‘s highly sensitive healthcare records were inappropriately accessed by his colleagues at Peace, causing Plaintiff to suffer severe, documented, emotional distress.
- As a direct and proximate result of UofL Health‘s breach of its duties, Plaintiff suffered severe injury.
- UofL Health‘s conduct was willful, wanton, and/or wreckless [sic], and as a result, Plaintiff should recover punitive damages from UofL Health.
III. Negligence of Martha Mather
- Plaintiff incorporates all preceding paragraphs as if fully set forth herein.
- Ms. Mather owed Plaintiff a duty to protect Plaintiff‘s protected health information and medical records from unauthorized disclosure.
During the times relevant to the allegations in the Complaint, Ms. Mather failed to maintain and enforce an adequate and effective policy prohibiting and addressing employees’ unauthorized access to Mr. Ledford‘s protected health information and medical records. - As a result of Ms. Mather‘s failure to protect Plaintiff‘s medical records from unauthorized disclosure, Plaintiff‘s highly sensitive healthcare records were inappropriately accessed by his colleagues at Peace, causing Plaintiff to suffer severe, documented, emotional distress.
- As a direct and proximate result of Ms. Mather‘s breach of her duties, Plaintiff suffered severe injury.
- Ms. Mather‘s conduct was willful, wanton, and/or reckless, and as a result, Plaintiff should recover punitive damages from Ms. Mathers [sic].
Appellees filed an answer to Mr. Ledford‘s complaint denying liability and asserting a number of affirmative defenses. Later, Appellees filed a joint motion for judgment on the pleadings pursuant to CR3 12.03. In their supporting memorandum, Appellees argued that regardless of the factual validity of Mr. Ledford‘s allegations, his claims were preempted by HIPAA. Mr. Ledford responded that his common law invasion of privacy and negligence claims were not contrary to HIPAA and therefore not preempted. Relying on Doe v. Ashland Hospital Corporation, No. 2021-CA-0466-MR, 2022 WL 815221 (Ky. App. Mar.
Its order provides:
For the same reasons [as set forth in Doe v. Ashland, supra] HIPAA preempts Mr. Ledford‘s claims. The allegations associated with his claims all speak to protections against unauthorized access to medical records, which is expressly addressed by HIPAA. To this end, the common law torts Mr. Ledford pursues are not “more stringent” than the standards established under HIPAA as determined by [Doe v. Ashland]. Ultimately, and like Doe [v. Ashland], [Mr. Ledford‘s] tort claims cannot circumvent the effects of preclusion, as harsh as they are. Despite this conclusion, assuming Mr. Ledford‘s allegations of unauthorized access could be substantiated, it would be reprehensiblе. One of the underlying policy considerations of HIPAA is maintaining physician patient confidentiality, which is a cornerstone medical treatment, especially that addressing mental health.
12/23/2023 Order at p. 4-5.
This appeal followed.
II. STANDARD OF REVIEW
As noted, the circuit court dismissed Mr. Ledford‘s claims pursuant to CR 12.03. It provides:
After the pleadings are closed but within such time as not to delay the trial, any party may move for judgment on the pleadings. If, on such motion, matters outside the pleading are presented to and not excluded by the court,
the motion shall be treated as one for summary judgment and disposed of as provided for in Rule 56, and all parties shall be given reasonable оpportunity to present all materials made pertinent to such a motion by Rule 56.
Id.
“When a party moves for judgment on the pleadings, he admits for the purposes of his motion not only the truth of all of his adversary‘s well-pleaded allegations of fact and fair inferences therefrom, but also the untruth of all of his own allegations which have been denied by his adversary.”4 Archer v. Citizens Fidelity Bank & Tr. Co., 365 S.W.2d 727, 729 (Ky. 1962). As a result, “the circuit court is not required to make any factual determination; rather, the question is purely a matter of law.” James v. Wilson, 95 S.W.3d 875, 883-84 (Ky. App. 2002). “We review [the circuit court‘s ruling on] a judgment on the pleadings de novo.” Scott v. Forcht Bank, NA, 521 S.W.3d 591, 594 (Ky. App. 2017).
III. ANALYSIS
HIPAA,
HIPAA is silent with respect to private enforcement. And it is firmly settled that there is no private cause of action under HIPAA, either express or implied. Faber v. Ciox Health, LLC, 944 F.3d 593, 596-97 (6th Cir. 2019). However, the fact that HIPAA does not provide for a private right of action does not mean that HIPAA necessarily prohibits common law tort claims based on the
The Supremacy Clause of thе United States Constitution grants Congress the power to preempt state law. Lafferty Enterprises, Inc. v. Commonwealth, 572 S.W.3d 85, 91 (Ky. App. 2019). There are three ways state law can be preempted by the Supremacy Clause: (1) where federal law expressly preempts state law (express preemption); (2) where federal law has occupied the entire field (field preemption); or (3) where there is a conflict between federal law and state law (conflict preemption). Commonwealth ex rel. Cowan v. Telcom Directories, Inc., 806 S.W.2d 638, 640 (Ky. 1991).
“[B]oth the HIPAA statute and its regulations use preemptive language[.]” Murphy v. Dulay, 768 F.3d 1360, 1367 (11th Cir. 2014) (citation omitted). When determining whether a federal statute‘s preemption clause expressly preempts state law, “we focus on the plain wording of the clause,” which necessarily contains “the best evidence of Congress’ preemptive intent.” Chamber of Commerce of U.S. v. Whiting, 563 U.S. 582, 594, 131 S. Ct. 1968, 1977, 179 L.
As noted, HIPAA itself contains an express preemption clause. It provides:
(1) General rule
Except as provided in paragraph (2), a provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of this title, shall supersede any contrary provision of State law, including a provision of State law thаt requires medical or health plan records (including billing information) to be maintained or transmitted in written rather than electronic form.
(2) Exceptions
A provision or requirement under this part, or a standard or implementation specification adopted or established under sections 1320d-1 through 1320d-3 of this title, shall not supersede a contrary provision of State law, if the provision of State law--
(A) is a provision the Secretary determines--
(i) is necessary--
(I) to prevent fraud and abuse;
(II) to ensure appropriate State regulation of insurance and health plans;
(III) for State reporting on health care delivery or costs; or
(IV) for other purposes; or
(ii) addresses controlled substances; or
(B) subject to section 264(c)(2) of the Health Insurance Portability and Accountability Act оf 1996, relates to the privacy of individually identifiable health information.
(b) Public health
Nothing in this part shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention.
(c) State regulatory reporting
Nothing in this part shall limit the ability of a State to require a health plan to report, or to provide access to, information for management audits, financial audits, program monitoring and evaluation, facility licensure or certification, or individual licensure or certification.
In sum, HIPAA and its regulations preempt a state law, including the common law, if there is a conflict between HIPAA and state law and the state law is not more stringent than the HIPAA regulation. Thus, the first task in a HIPAA preemption case is to determine whether the state law at issue is actually contrary to HIPAA. If the state law is not contrary to HIPAA, there is no need for further analysis. The two laws can coexist in harmony. If the state law is contrary to HIPAA, then, and, only then, must one consider whether the state law is more stringent. The regulations provide that a state law is “contrary” to HIPAA when (1) it is “impossible to comply with both the State and Federal requirements“; or (2) “state law stands as an obstacle to the accomplishment and execution” of the act.
In Doe v. Ashland, supra, relied on by the circuit court and now the Appellees, the court jumped to the “more stringent” requirement without considering whether the common law causes of action before it were actually contrary to HIPAA. As explained above, however, whether the state law is contrary to HIPAA is the threshold determination. State laws that are not contrary to HIPAA are not preempted. If, and only if, a state law is contrary to HIPAA must a court then consider whether the state law is more stringent. In affirming the
Therefore, before we examine the intricacies of Mr. Ledford‘s individual common law claims, we will briefly address Appellee‘s overarching argument that any common law tort predicated on the dissemination of HIPAA proteсted information must be preempted. Appellees reason that because Congress did not create a private right of action for HIPAA violations, their intent must have been to bar all such actions in favor of governmental enforcement.9 Appellees’ argument employs flawed reasoning, conflating the absence of a private right of action under HIPAA with an intent to bar all related private claims.
“Ordinarily, the mere existence of a federal regulatory or enforcement scheme . . . does not by itself imply pre-emption of state remedies.” English v. General Elec. Co., 496 U.S. 72, 87, 110 S. Ct. 2270, 2279, 110 L. Ed. 2d 65 (1990). Thus, we cannot conclude that the merе existence of a private enforcement mechanism means that private enforcement is contrary to HIPAA. After reviewing HIPAA‘s legislative history, the Supreme Court of Connecticut actually held the opposite was true. Byrne v. Avery Center for Obstetrics and Gynecology, P.C.,
[O]ne commenter during the rulemaking process had “raised the issue of whether a private right of action is a greater penalty, since the prоposed federal rule has no comparable remedy. Standards for Privacy of Individually Identifiable Health Information, 65 Fed.Reg. 82,462, 82,582 (December 28, 2000). In its administrative commentary to the final rule as promulgated in the Federal Register, the department responded to this question by stating, inter alia, that ”the fact that a state law allows an individual to file [a civil action] to protect privacy does not conflict with the HIPAA penalty provisions,” namely, fines and imprisonment. (Emphasis added.) Id. This agency commentary on final rules in the Federal Register is significant evidence of regulatory intent.
Id.
Like the Byrne court, we find HIPAA‘s legislative history supports the conclusion that HIPAA itself was not intended to bar all state common law causes of action premised on the wrongful disclosure of medical information protected by HIPAA. See also Menorah Park Center for Senior Living v. Rolston, 173 N.E.3d 432, 441 (Ohio 2020) (“In a situation in which state law provides a patient the potential personal recovery of damages, it is not impossible for the covered entity to comply with both HIPAA and the state law[.]“); Lawson v.
Based on the statutory language and legislative history of HIPAA, we are firmly convinced that HIPAA does not categorically bar all state law claims seeking redress for the wrongful disclosure of HIPAA protected information. To the extent that Doe v. Ashland, supra, implicitly reached the opposite conclusion, we decline to follow suit. We are at liberty to do so because Doe v. Ashland was designated “not to be published.” RAP10 41(A) (“‘Not To Be Published’ opinions of the Supreme Court and the Court of Appeals are not binding precedent and citation of these opinions is disfavored.“); Johnson v. Commonwealth, 659 S.W.3d
We must now examine Mr. Ledford‘s specific claims to determine if the claims themselves are contrary to HIPAA. We begin with invasion of privacy, a somewhat amorphous tort. As early as 1867, Kentucky courts began to grapple with the concept of an individual right of privacy existing apart from one‘s property rights. See Grigsby v. Breckinridge, 65 Ky. 480, 497 (Ky. 1867); see also W. Thomas Bunch, Kentucky‘s Invasion of Privacy Tort – A Reappraisal, 56 KY. L.J. 261 (1968). However, at that time, an independent tort specifically for invasion of privacy had not yet been established. For the next fifty years, our courts flirted with the notion of invasion of privacy without actually firmly holding such a tort existed. Bunch, supra, at 261-65. In 1927, however, the Court of Appeals11 decided Brents v. Morgan, 299 S.W. 967 (Ky. 1927), explicitly holding for the first time that “there is a right of privacy, and that the unwarranted invasion of such right may be made the subject of an action in tort to recover damages for such unwarranted invasion.” Id. at 971.
Despite having been firmly established, the tort remained difficult to preсisely define. Then, in 1981, the Kentucky Supreme Court adopted the general
Appellees have not cited any compelling authority that convinces us that Kentucky‘s common law tort for invasion of privacy is contrary to HIPAA, even where the privacy interest at stake concerns one‘s private medical information. Indeed, it seems to us that Kentucky‘s сommon law tort for invasion of privacy is consistent with HIPAA insomuch as it would prevent disclosure of
In sum, we hold that Mr. Ledford‘s common law invasion of privacy claim is not contrary to HIPAA. It is not impossible for Appellees to comply with both Kentucky‘s common law privacy standards and HIPAA. Likewise, Kentucky‘s common law – at least as it relates to privacy – does not create an obstacle to the accomplishment and execution of HIPAA and its objectives. In fact, as HIPAA‘s legislative history indicates, state privacy laws serve similar objectives as HIPAA.
This, of course, is not to say that Mr. Ledford will ultimately prevail on his invasion of privacy claim. Whether he will be able to do so is highly dependent on by whom, under what circumstances, and for what purposes his
This brings us to Mr. Ledford‘s negligence claim. We note at the outset that whether Kentucky‘s common law provides a remedy for a health care provider‘s breach of its duty of confidentiality is not an issue presented in this appeal. Thus, assuming, without deciding, that Kentucky‘s common law recognizes a negligence cause of action arising from health care providers’ breaches of patient privacy, we now undertake to consider whether such a cause of action is contrary to HIPAA. Again, the answer is no.
To prevail on a negligence claim under Kentucky law, the рlaintiff must prove that the defendant 1) owed the plaintiff a duty of care, 2) the defendant breached the standard of care by which his or her duty is measured, and 3) that the breach was the legal causation of the consequent injury. Pathways, Inc. v. Hammons, 113 S.W.3d 85, 88-89 (Ky. 2003). With some exceptions, Kentucky courts generally adhere to the “universal duty of care”13 standard which is a general obligation to exercise ordinary care to prevent foreseeable harm. Morgan v. Scott, 291 S.W.3d 622, 631 (Ky. 2009) (“[W]e remain committed to the
When discussing duty and breach of the standard of care, it is important to distinguish between ordinary, common law negligence claims and negligence per se claims. Mr. Ledford is pursuing an ordinary, common law negligence claim, not a negligence per se claim predicated solely on Appellees’ violation of HIPAA. This is a significant distinction.
There is a difference between using a statute to establish the standard of care in an ordinary negligence claim and using the violation of a statute to establish the duty and breach of duty in a negligence per se claim. Negligence per se uses a statutory violation to establish duty and breach of duty. Rayfield v. S.C. Dep‘t of Corr., 297 S.C. 95, 374 S.E.2d 910, 914-15 (S.C. Ct. App. 1988). In contrast, if a statute is used to establish[] a standard of care, there must be some independent duty because “[o]nly when there is a duty would a standard of care need to be established.” Doe ex rel. Doe v. Wal-Mart Stores, Inc., 393 S.C. 240, 711 S.E.2d 908, 912 (2011).
J.R. v. Walgreens Boots All., Inc., 470 F. Supp. 3d 534, 554 (D.S.C. 2020), aff‘d, 2021 WL 4859603 (4th Cir. Oct. 19, 2021).
For example, in T & M Jewelry, Inc. v. Hicks ex rel. Hicks, 189 S.W.3d 526 (Ky. 2006), the Kentucky Supreme Court addressed negligence claims arising from the sale of a handgun to an 18-year-old by a federally licensed gun dealer, The Castle. After purchasing the handgun, the buyer accidentally shot his girlfriend, Jennifer Hicks. The court upheld summary judgment against the negligence per se claims, citing the lack of a private civil remedy under the Federal Gun Control Act. However, it allowed common law negligence claims to proceed,
The fact that Mr. Ledford‘s private information may be protected under HIPAA does not mean he has attempted to plead a private right of action under HIPAA. Though Mr. Ledford‘s privacy interests in his medical records may overlap with the rights assured by HIPAA, HIPAA does not subsume all other legal authority relating to the right to privacy merely because the privacy violated relates to medical information. And, having reviewed Kentucky‘s negligence law, we do not see how such an action, if authorized under Kentucky‘s common law, would be in any way contrary to HIPAA. Henry v. Community Healthcare System Community Hospital, 134 N.E.3d 435, 437 (Ind. Ct. App. 2019).
In conclusion, we hold that neither Mr. Ledford‘s Kentucky common law claim for invasion of privacy, nor his negligence claim, is preempted by HIPAA. Our opinion in this regard should not be construed as a determination that Mr. Ledford‘s invasion of privacy claim will ultimately prevail or that a negligence claim for the disclosure of confidential medical information exists in Kentucky. As to the former, the factual record is not sufficiently developed; and as for the latter, that issue has not been raised or briefed by the parties. Our opinion today is simply that to the extent such claims exist and are factually viable, they are not prеempted by HIPAA.
For the reasons set forth above, we reverse the Jefferson Circuit Court‘s December 30, 2023 order dismissing Mr. Ledford‘s claims with prejudice and remand this matter for further proceedings.
ALL CONCUR.
BRIEFS AND ORAL ARGUMENT FOR APPELLANT:
P. Stewart Abney
Louisville, Kentucky
BRIEF FOR APPELLEES:
Chelsea Granville Reed
Brent R. Baughman
Aaron W. Marcus
Ryne E. Tipton
Louisville, Kentucky
ORAL ARGUMENT FOR APPELLEE:
Brent R. Baughman
Louisville, Kentucky