Pharmacist’s snooping is a prescription for trouble

A $1.8 million verdict for an Indiana pharmacy customer is too bitter a pill for the nation’s largest drugstore chain to swallow. The company is appealing the jury award issued after a pharmacist accessed a customer’s records then shared them with her spouse, who also is the customer’s ex-boyfriend and father of her child.

Walgreen Co. argues that Abigail E. Hinchy’s case is so error-ridden that it never should have gone to the jury. But it did, and jurors in July 2013 rendered the judgment after a trial before Marion Superior Judge David J. Dreyer. The jury found the Walgreen defendants 80 percent responsible, setting the judgment against them at $1.4 million, almost entirely for loss of privacy.

Hinchy, of Crown Point, sued the chain after her ex-boyfriend, Davion Peterson, sent Hinchy a text telling her he was looking at her pharmacy records. He later married Audra (Withers) Peterson, who at the time was a pharmacist at Walgreen in Indianapolis.

The novel judgment found defendants liable for negligent supervision and retention, invasion of privacy, and on the basis of respondeat superior. During oral arguments Oct. 14 before a panel of the Indiana Court of Appeals, judges hinted at what could be a larger privacy issue for pharmacies while also questioning the amount of the judgment. The case is Walgreen Co., et al. v. Hinchy, 49A02-1311-CT-950.

Maggie Smith of Frost Brown Todd LLP argued on behalf of Walgreen that the case should have been decided for the company at summary judgment. The panel of judges – James Kirsch, Margret Robb and presiding Judge John Baker – appeared uninterested in that issue, but Smith argued that a litany of problems with the trial tips the scale against the usual deference to a jury.

“This is one of those instances where there are so many errors at so many different stages that the jury’s verdict simply cannot be trusted,” Smith argued.

But attorney Neal Eggeson Jr., representing Hinchy, defended the judgment and said it fell in line with respondeat superior precedent examining whether what the employee did was in the same general nature of normally authorized job duties.

“Generally, this pharmacist was on shift, she was generally authorized to use the Walgreen computer system to access patient information,” Eggeson argued. “Most importantly, Abigail Hinchy was one of the general class of people over whom (Audra Peterson) owed a duty of privacy protection.”

Eggeson told judges that the day Hinchy learned her information had been compromised, she called the Walgreen store where her records had been improperly accessed. It was after hours, so her call was routed to a 24-hour store, where Eggeson said she was told that pharmacists can’t track on a store level who has accessed personal prescription information. Eggeson said this call should have put Walgreen on notice, and that Audra Peterson again accessed Hinchy’s records the following day.

“If Walgreen had had a tracking system in place, they would have known within seconds exactly which pharmacist it was,” Eggeson said. He also provided expert testimony that Kroger pharmacies have had tracking systems in place for decades; Walgreen put on expert testimony that tracking pharmacists’ access to prescription data isn’t done.

“The jury came down on our side of that issue,” Eggeson said.

Smith told the panel that Walgreen cannot be liable under respondeat superior because what Audra Peterson did was not an authorized job duty. She said the Court of Appeals and Supreme Court have both held this to be the standard, a point that Kirsch tested.

If a truck driver speeds, that’s not an authorized action either, but the company is still liable for the accident that results, he hypothesized. “In virtually every respondeat superior, we have that – somebody goes beyond the interest of their employer.”

But Smith countered that this is precisely why so many cases against employers are dismissed at the summary judgment stage.

Eggeson said parties had jockeyed over the application of respondeat superior in this case, but he told the panel, “Any case involving an intentional or criminal act by an employee automatically goes out the window under Walgreen’s formulation of the standard.”

Smith also argued the jury damages award could not be justified and suggested it was the result of a juror wanting to punish Walgreen for not firing Audra Peterson after the incident, something she said the company was not required to do. Walgreen didn’t terminate the pharmacist because she had been a model employee before accessing the patient’s information, and the pharmacist was disciplined and warned that any other such violations would result in termination, Smith explained.

“Prior to this incident, Audra had never done anything wrong,” Smith said.

But Robb interjected, “Maybe she’s looked at 100 people’s records, but if you don’t keep track of it, and you don’t log it, and it doesn’t require a password, how does Walgreen know that?”

Smith replied that nothing in the record indicated other breaches, to which Robb replied, “There is a difference between saying it never happened, and the record is silent if it happened.”

Smith said Audra Peterson’s actions were “a serious lapse of judgment. … They disciplined her, and they took steps to make sure this didn’t happen again.”

All but about $45,000 of the damages award for Hinchy is based on public disclosure of private information, including Hinchy’s prescriptions for birth control and to treat a sexually transmitted disease. The information was released to her ex-boyfriend, the one person to whom she specifically didn’t want the information released, Eggeson said, and he noted that it was then released to others.

But Baker seemed troubled by the damages award.

“I thought there were verdicts against people for not having disclosed (STDs),” Baker said. “If somebody else disclosed it, you win the lottery … but if you didn’t disclose it, you pay heavily. That makes sense?”

Eggeson argued the damages award wasn’t properly before the court because Walgreen had not objected to a jury instruction on the loss of privacy.

“Loss of privacy is itself compensable in exactly the same way that loss of reputation is in defamation cases,” he said.

But Smith countered that the jury was improperly instructed on damages that could apply to Hinchy’s invasion of privacy claim.

“If this court concludes that the invasion of privacy claim should never have gone to the jury,” she said, “the damage award falls apart.”

Eggeson said after oral argument that the trial court verdict represented an expansion of caselaw under the Health Insurance Portability and Accountability Act.

“What is novel is the notion that you can sue for a HIPPA violation at all” for loss of privacy, he said. “We now have a seven-figure verdict against a nationally recognized chain.”•