IN THE COURT OF APPEALS OF IOWA
No. 18-1705
Filed August 7, 2019
DAWN MARIE LEACH,
Plaintiff-Appellant,
vs.
IOWA BOARD OF NURSING,
Defendant-Appellee.
________________________________________________________________
Appeal from the Iowa District Court for Polk County, Michael D. Huppert,
Judge.
A nurse appeals from the district court’s dismissal of her petition for
judicial review challenging the Iowa Board of Nursing’s conclusion she violated
the confidentiality or privacy rights of a patient and imposition of a citation and
warning. AFFIRMED.
David L. Brown and Tyler R. Smith of Hansen, McClintock & Riley, Des
Moines, for appellant.
Thomas J. Miller, Attorney General, and Tessa Register, Assistant
Attorney General, for appellee.
Considered by Potterfield, P.J., and Doyle and Tabor, JJ.
2
POTTERFIELD, Presiding Judge.
Nurse Dawn Leach appeals from the district court’s dismissal of her
petition for judicial review challenging the Iowa Board of Nursing’s conclusion she
violated the confidentiality or privacy rights of a patient and imposition of a
citation and warning. Leach maintains the district court erred in dismissing her
petition for judicial review because the Board’s conclusion is “[b]ased upon an
irrational, illogical, or wholly unjustifiable application of law to fact that has clearly
been vested by a provision of law in the discretion of the agency,” Iowa Code
§ 17A.19(10)(m), and is “not supported by substantial evidence in the record
before the court when that record is viewed as a whole,” Id. § 17A.19(10)(f).1
I. Background Facts and Proceedings.
Leach was employed by Unity Point Health Finley Hospital (Finley) to work
as a nurse in the intensive care unit (ICU). On eleven dates during December
2015, Leach remotely accessed patient census lists while she was not working.
The census lists contained private health information, such as patient names,
ages, diagnosis, unit, diet order, medications, and primary insurer.
Finley learned of the access in January 2016 and questioned Leach about
it. Leach admitted she accessed the lists, stating she did so in order to check
ICU capacity to determine whether it was likely she would be required to work
1
As she did at the district court, Leach also includes a laundry list of other grounds she
alleges requires reversal under Iowa Code section 17A.19(10). The district court
concluded the other grounds were waived for lack of authority or argument supporting
them. Insofar as the district court did not consider and rule upon the other grounds
pursuant to section 17A.19(10), these claims have not been preserved for our review.
See Garwick v. Iowa Dep’t of Transp., 611 N.W.2d 286, 288 (Iowa 2000) (finding an
issue not preserved for review when the plaintiff failed to raise the issue with enough
specificity to the district court on judicial review and noting, “[Plaintiff’s] allegation in his
petition for judicial review is far too unspecific to preserve a . . . challenge”).
3
her assigned shifts.2 Leach was advised that checking the list was in violation
the hospital’s information security policies that prevented remote access into the
hospital’s system without authorization—which Leach did not have—and when
not necessary to complete her job responsibilities. Finley issued Leach an
employee disciplinary notice on January 20; she was suspended for two twelve-
hour shifts and required to repeat the HIPAA NetLearning module.
Leach’s supervisor filed a complaint with the Board, and, after an
investigation, the Board found probable cause to file a notice of hearing and
statement of charges against Leach. It was alleged Leach violated the
confidentiality or privacy rights of the patient or client, in violation of Iowa Code
section 147.55(3) (2015) and Iowa Administrative Code rule 655-4.6(4)(h).
A contested hearing took place in January 2018. The Board made the
following finding of facts:
[Leach] accessed the patient lists for the sole purpose of
determining the ICU’s census so she could determine whether she
would [be] working her assigned shift the following day or placed on
call. [She] did not use the information from the patient lists for any
other purpose, and she did not share the information with anyone.
[Leach] denies that she looked at any information other than the
number of patients.
....
. . . [Leach] was not authorized to access Finley patient lists from
remote locations, and she did not need the patient list information in
order to perform her duties as an ICU nurse at Finley.
2
According to the finding of facts made by the Board:
The nurses’ work schedule was established in six week blocks and was
published to the nurses at least two weeks prior. Nurses could also sign
up to work an “as needed” shift. Four nurses were assigned to each shift,
but the ICU also had a rotating “low census” list. If the patient census in
the ICU was low, then the first person on the “low census” list would be
put [on] call and would not have to work that shift. Nurses could call the
charge nurse on the unit to find out if they would be needed for their
assigned shift.
4
The Board found a preponderance of the evidence supported that Leach
committed unethical conduct by violating the confidentiality or privacy rights of
patients in accessing protected health information on the census lists without the
need to do so. The Board imposed a citation and a warning as discipline.
Leach filed an application for rehearing with the Board, claiming the
Board’s finding of a violation was “[u]nsupported by the evidence presented at
the hearing” and “[i]nconsistent with the Board’s factual findings.” The Board
denied the application, reiterating that accessing the protected health information
without a legitimate or proper reason was sufficient to find Leach violated the
confidentiality or privacy rights of the patient. Additionally, the Board stated it
fully considered the circumstances of the violation (i.e. that [Leach]
did not understand that her actions violated patient confidentiality,
that she did not disclose the information to anyone else, and that
the hospital determined her actions were not a reportable HIPAA
“breach”) when it chose to impose the least severe sanction—a
citation and a warning.
Leach filed a petition for judicial review, urging the district court to reverse
the Board’s ruling. She maintained that because the Board never made a finding
she read or shared any of the protected health information contained on the
census lists, the Board’s finding of a violation was irrational, illogical, or wholly
unjustifiable. She also claimed there was not substantial evidence to find she
viewed any protected health information.
The district court determined there was no real argument regarding
substantial evidence “in light of the agreement of the parties as to the operative
facts.” The court also found that the Board’s determination Leach had violated
the rule was not irrational, illogical, or wholly unjustifiable, as “[t]he mere access
5
of the information is what constituted grounds for discipline; the viewing or
examination of that information was not required.”
Leach appeals.
II. Standard of Review.
“A court’s review of agency action is severely circumscribed. The
administrative process presupposes that judgment calls are to be left to the
agency.” Burns v. Bd. of Nursing, 495 N.W.2d 698, 699 (Iowa 1993). “Thus the
court may reverse, modify, or grant other appropriate relief only if agency action
is affected by error of law, is unsupported by substantial evidence in the record,
or is characterized by abuse of discretion.” Id.
III. Discussion.
Iowa Code section 147.55(3) allows the Board to discipline a licensed
nurse “when the licensee is guilty of . . . engaging in unethical conduct or practice
harmful or detrimental to the public. Proof of actual injury need not be
established.” Iowa Code § 147.55(3). Iowa Administrative Code rule 655-
4.6(4)(h) further defines behavior that “constitutes unethical conduct or practice
harmful or detrimental to the public” and includes, “Violating the confidentiality or
privacy rights of the patient or client.”
On judicial review, Leach emphasizes that the Board never made a finding
she read any of the protected health information she accessed on the census
lists and maintains there is not substantial evidence to make such a finding. See
Iowa Code § 17A.19(10)(f). Additionally, she claims that concluding she violated
the confidentiality or privacy rights of a patient without a finding she read the
protected health information she accessed is irrational, illogical, or wholly
6
unjustifiable. See id. § 17A.19(10)(m). Leach’s claim boils down to an argument
that accessing—without reading or sharing—of a patient’s protected health
information is not sufficient conduct to find a violation of a patient’s confidentiality
or privacy rights. She relies on this court’s ruling in Hoffman v. Iowa Bd. of
Nursing, No. 05-1403, 2006 WL 2421643 (Iowa Ct. App. Aug. 23, 2006), to
support her argument.
In Hoffman, the Board cited a nurse for violating patient confidentiality
when she and her young children helped the doctor she worked for copy patient
records in order for the doctor to take them to his new practice. 2006 WL
2421643, at *1. “Hoffman’s children, ages eleven and thirteen, assisted in the
copying process by pressing the ‘start’ button on the copy machine and by
monitoring the copying process to make sure only one page went through the
machine at a time.” Id. The Board found Hoffman violated section 147.55(3) and
rule 655-4.6(4)(h) “by allowing ‘her children to participate in copying confidential
patient records’” and noted the “presence and participation of the children still
violated patient confidentiality by giving them access to confidential information,
including but not limited to the names of the patients.” Id. Our court reversed,
stating:
The only persons to whom improper access to confidential records
was even arguably given were the children. There is no finding by
the agency that the children read any of the information contained
within the medical records, or even the names on the files. They
simply pressed the “start” button on the copy machine and were
supervised throughout the process. The copying was done at the
direction of Dr. Sterrett and the children were paid for their
participation. Finding a violation of patient confidentiality under
these facts is unreasonable, arbitrary, capricious, and an abuse of
discretion
7
Id. at *2.
The two sets of facts are distinguishable. In Hoffman, our court
questioned whether the children’s presence in the same room as and limited role
in helping copy the paper files—pressing the start button and watching to ensure
only one page went through the machine at a time—constituted “access” to
patient records. Id. Here, Leach admits that she repeatedly accessed the
census list, which contained numerous forms of protected health information.
Leach denies reading the parts of the list containing the protected information,
but she does not deny that she accessed the information and that the information
was not necessary for her to complete her job duties. Accessing the unneeded
confidential information is a violation of hospital policies put in place to protect
patient confidentiality, which Leach knew or should have known about.
The Board is vested with rulemaking and interpretative authority. See
Iowa Code § 147.76 (“The boards for the various professions shall adopt all
necessary and proper rules to administer and interpret this chapter . . .”); see
also Iowa Med. Soc’y v. Iowa Bd. of Nursing, 831 N.W.2d 826, 838 (Iowa 2013)
(“The legislature has clearly vested the nursing board with rulemaking and
interpretative authority . . . .”). Therefore, “[w]e are required to view the nursing
board’s [application of law to fact] through the prism of our deferential standard of
review.” Iowa Med., 831 N.W.2d at 840. In doing so, we cannot say the Board’s
determination is irrational, illogical, or wholly unjustifiable when it found
purposefully accessing confidential patient information that is not needed to
perform one’s job duties—without further action—constitutes a violation of patient
confidentiality rights.
8
We affirm the district court’s dismissal of Leach’s petition for judicial
review.
AFFIRMED.