IN Supreme Court finds hospital entitled to partial summary judgment on negligence claim, but not public disclosure, after patient’s diagnosis was posted to social media

IL file photo

A hospital sued after a woman’s diagnosis was mailed to the wrong person and subsequently posted to social media secured a partial victory at the Indiana Supreme Court, which upheld partial summary judgment on a negligence claim but reversed summary judgment on a public disclosure claim.

Chief Justice Loretta Rush wrote the opinion Monday in Z.D. v. Community Health Network, Inc., 23S-CT-116, with Justices Mark Massa and Christopher Goff concurring. Justice Geoffrey Slaughter concurred and dissented in part while Justice Derek Molter did not participate.

The case began in September 2018, when Z.D. received medical care at one of Community Health Network’s emergency departments.

After her visit, an employee called Z.D. to discuss her health matter but was unable to reach her. The employee thus prepared a letter documenting Z.D.’s private health information that included her recent diagnosis and suggested treatment.

The letter was addressed to Z.D., but it was placed in an envelope addressed in handwriting to the wrong person.

The person who received the letter was Jonae Kendrick, a classmate of Z.D.’s daughter. Kendrick took a picture of the one-page letter and posted it on her Facebook page and attempted to tag Z.D. in the post.

Z.D.’s daughter saw the post and notified her mother. Z.D. had to pay Kendrick $100 for the letter to be returned, and the post was eventually taken down.

Z.D. later sued Community, alleging it was directly responsible for its negligent training, supervision and retention of employees and was vicariously liable for its employee’s unauthorized disclosure of her private health information. She also claimed the hospital was directly or vicariously liable for negligently maintaining the confidentiality of her private information.

Community moved for summary judgment on each of her claims, alleging that it was not the proximate cause of her damages and that she could not recover emotional-distress damages in her negligence claim due to the modified impact rule’s direct physical-impact requirement.

It also alleged that her claim for negligent training, supervision and retention failed as a matter of law because the employee acted within the scope of employment.

Finally, to the extend Z.D. raised a claim for public disclosure of private facts, the hospital argued the tort was not cognizable in Indiana and if it was, Community negated the publicity element.

The Marion Superior Court granted summary judgment to Community on each of Z.D.’s claims, although it did not address Z.D.’s alleged pecuniary damages, nor did it analyze her public disclosure claim.

The Court of Appeals of Indiana partially reversed last October, finding genuine issues of material fact remained.

At the Supreme Court, the justices first addressed Z.D.’s public disclosure claim.

Finding Community was not entitled to summary judgment on that claim, Rush cited Cmty. Health Network, Inc. v. McKenzie, 185 N.E.3d 368 (Ind. 2022), which explicitly adopted the elements of the public-disclosure tort under the Restatement (Second) of Torts § 652D.

Frequently citing to McKenzie, the justices held that Indiana’s public-disclosure tort is not an intentional tort.

“Hoosiers’ private information warrants protection from intentional exploitation and inadvertent exposure alike. Accordingly, individuals and entities, including healthcare providers, must do their part to safeguard private information,” Rush wrote. “If they do, their potential for liability is greatly minimized; but if they don’t, and the four elements of the public-disclosure tort are met, affected individuals deserve to be made whole and reclaim the inherent value of their privacy. So, because Z.D. was not required to allege that Community’s wrongful disclosure of her private information was intentional, Community is not entitled to summary judgment on that basis.”

The high court also found that recovery for emotional distress is available in a public-disclosure claim.

“A public-disclosure claim is not a negligence claim, and it does not transform into one merely because a negligent act or omission occurs,” Rush wrote. “… Accordingly, the modified impact rule straightforwardly does not apply to public-disclosure claims. … In the context of a public-disclosure claim, it is inherently plausible — if not inevitable — the affected individual will suffer emotional distress when their intimate details are shared with the public.”

The court further found that Community has not negated the publicity element of Z.D.’s public-disclosure claim.

“When, as here, a private matter is disclosed to the wrong person, the mere possibility that the information can be given unwanted and unreasonable publicity does not necessarily render it sure to become public knowledge. But at the summary judgment stage, we must construe all inferences and doubts as to material factual issues in a manner favorable to the nonmovant, which is Z.D.,” Rush wrote. “And in doing so, we find the record supports conflicting inferences as to whether Community’s disclosure of Z.D.’s private health information to Kendrick was communicated in a way that it would reach a large enough number of people such that it was sure to become public knowledge.”

But turning to negligence, the high court ruled partially in Community’s favor.

“Not all private health information is alike. Some reveals intimate moments about one’s life; others, however, are innocuous and mundane,” Rush wrote. “Accordingly, the likelihood that a patient will suffer emotional distress following the mere mishandling of private information — standing alone — is, at best, uncertain.

“At the same time, we share Z.D.’s sentiment that because private health information is entitled to protection, healthcare providers must do their part to enforce security measures that prevent breaches,” the chief continued. “And we also recognize technological innovations implemented in the healthcare industry have facilitated increased access to and the sharing of private health information, further implicating its protected status.

“… In short, plaintiffs like Z.D. may assert negligence-based claims when their private information is mishandled, but the modified impact rule precludes recovery for emotional distress unless the plaintiff sustained a direct physical impact from the negligence. Here, the designated evidence reveals Z.D. suffered emotional distress as a result of Community’s alleged failure to maintain the confidentiality of her private information. Because this alleged negligence did not produce a direct physical impact, the modified impact rule precludes Z.D. from recovering emotional-distress damages.”

In a partial dissent, Slaughter agreed with the majority that the hospital is entitled to partial summary judgment on Z.D.’s negligence claim. He also agreed that the modified-impact rule prevents Z.D. from recovering emotional distress damages, but that her claim remains for pecuniary damages.

But he disagreed that Z.D. survives summary judgment on her public-disclosure claim, arguing that the majority misapplied McKenzie.

“I would affirm the trial court’s grant of summary judgment for Community on this claim because Z.D. fails the claim’s publicity element,” he wrote.

The case was remanded for further proceedings.