Patient’s claim her x-rays were wrongly shared reinstated

A Lake County woman whose medical records were unknowingly shared with her employer by a Community Hospital worker in Munster who took her x-rays has won a reversal of her dismissed complaint against the hospital.

Amanda Henry, who received medical treatment in March 2018 at Community Hospital in Munster, was required to have x-rays taken as part of her treatment. A few days after the x-rays were taken, Henry’s employer showed her digital images of her x-rays on the employer’s cell phone. Her employer, who is married to the radiologic technician who performed Henry’s imaging, had received the digital images from the spouse.

Henry then sued Community Healthcare System Community Hospital, arguing that Community owed a duty to protect the privacy, security and confidentiality of health records generated or maintained by providers within its network, and that Henry suffered damages for which Community is liable as a result of its employee’s actions.

A trial court dismissed her complaint, finding that because the motion to dismiss was filed after the pleadings were closed, the motion should be treated as a motion for judgment on the pleadings pursuant to Trial Rule 12(C). Henry appealed, arguing that the Health Insurance Portability and Accountability Act may be used to establish the standard of care in a common law negligence action.

The appellate court reversed in Amanda Henry v. Community Healthcare System Community Hospital, 19A-CT-01256, noting an “age-old recognition that medical providers owe a duty of confidentiality to their patients.”

“We have little trouble concluding … that there is — and, in modern times, always has been — a common law duty of confidentiality owed by medical providers to their patients,” Judge John Baker wrote for the court. “And it is necessarily true that if a duty exists, a breach of that duty is also possible.

“Having found that a common law duty exists, we have little trouble agreeing with a sister court that ‘HIPAA and its implementing regulations may be utilized to inform the standard of care’ in tort claims related to alleged breaches of the duty of confidentiality owed by medical providers to their patients,” Baker continued, citing to a Connecticut Supreme Court ruling.

It concluded that under Indiana’s liberal notice pleading standard, Henry’s complaint included the operative facts necessary to make a negligence-based claim against Community. Specifically, the court wrote, the complaint alleged a duty to protect the privacy, security and confidentiality of her health records, a breach of that duty by Community’s employee when the employee shared Henry’s x-rays with the employee’s spouse, and resulting damages, if any.

“Under these circumstances, it was erroneous to grant Community’s motion for judgment on the pleadings because it is not clear from the face of the complaint that under no circumstances could relief be granted,” the panel concluded. Judgment was therefore remanded for further proceedings in Lake Superior Court.