IN Supreme Court rules for Community Health in dispute over family records

Editor’s note: This article has been updated.

The Indiana Supreme Court has ultimately found a hospital is not liable after one of its ex-employees compromised confidential health records of several former patients and another former employee in a family feud.

In November 2020, the high court granted transfer in Community Health Network, Inc. v. Heather McKenzie, et al., 20S-CT-648.

In that case, Katrina Gray, then a medical records coordinator with Community Health Network, was placed on administrative leave and ultimately fired after she accessed her ex-daughter-in-law Heather McKenzie’s medical records and those of her family members.

Gray and McKenzie had previously worked together at Indiana Orthopedic Center, where Gray was McKenzie’s direct supervisor. Gray also set up McKenzie with her stepson, and the two eventually married and had children.

But around 2010, McKenzie’s relationship with the Gray family quickly deteriorated. Heather was fired from IOC, which she attributed to Gray, and she divorced Gray’s stepson.

Meanwhile, Gray was hired and trained as a medical records coordinator after Community Health was acquired by IOC. In that role, she was provided access to Epic, an electronic medical records system, and authorized to schedule appointments and release records of the patients only within the IOC.

Following an anonymous report that Gray had accessed a personal chart in violation of Community’s policies and employee conduct rules, an investigation revealed that Gray had accessed her own chart as well as the confidential health records of McKenzie, her new husband, the children and others.

McKenzie and other plaintiffs sued Community Health, bringing claims of vicarious liability under the doctrine of respondeat superior and negligent training, supervision and retention against Community, as well as claims of negligence and invasion of privacy/intrusion against the former employee.

The Marion Superior Court denied Community’s Trial Rule 12(B)(1) motion to dismiss the complaint and motion for summary judgment. An interlocutory appeal was granted and the Court of Appeals of Indiana reversed in part, remanding with instructions for the trial court to grant summary judgment in favor of Community on the invasion of privacy/intrusion claim.

At the threshold, the justices concluded that the trial court did not err in denying Community’s motion to dismiss for lack of subject-matter jurisdiction. But the high court determined that Community is entitled to summary judgment because it negated a required element on each claim.

Justices concluded that the Medical Malpractice Act does not apply to the plaintiffs’ claims against Community relating to Gray’s unauthorized access and disclosure of electronic medical records.

“Although this case presents a close call, on this record we conclude that Community’s internal business decisions and access protocols for medical records are not professional services provided to a patient,” Chief Justice Loretta Rush wrote for the unanimous panel.

It further found that the alleged misconduct was also unrelated to either the promotion of a patient’s health or the provider’s exercise of professional expertise, skill or judgment.

Turning to Community’s negation of a required element on each of the claims, the justices first found that an employee’s conduct may fall within the scope of employment even though it is unauthorized and violates an agreed-to policy. It also found genuine issues of material fact existed on the scope-of-employment issue.

“As such, both theories under which Plaintiffs seek to hold Community liable —negligent training, supervision, and retention and the doctrine of respondeat superior — can survive summary judgment. But this conclusion does not foreclose summary judgment to Community on different grounds,” Rush wrote.

The high court further held that Community was entitled to summary judgment on the claim for vicarious liability based on Gray’s alleged negligence and on the claim for negligent hiring, retention and supervision.

Lastly, it found that Indiana recognizes a tort claim for the public disclosure of private facts, but the undisputed evidence negates the tort’s publicity element.

“We affirm the trial court’s denial of Community’s motion to dismiss for lack of subject-matter jurisdiction because Plaintiffs’ claims are not subject to Indiana’s Medical Malpractice Act. But we reverse the denial of Community’s motion for summary judgment because Community has affirmatively negated a required element on each of the claims against it,” Rush wrote. “We thus remand to the trial court with instructions to enter judgment in favor of Community on all claims.”