FILED
Oct 08 2019, 8:33 am
CLERK
Indiana Supreme Court
Court of Appeals
and Tax Court
ATTORNEY FOR APPELLANT ATTORNEYS FOR APPELLEE
Neal F. Eggeson, Jr. Sharon L. Stanzione
Eggeson Privacy Law Alan M. Kus
Fishers, Indiana Johnson & Bell, P.C.
Crown Point, Indiana
IN THE
COURT OF APPEALS OF INDIANA
Amanda Henry, October 8, 2019
Appellant-Plaintiff, Court of Appeals Case No.
19A-CT-1256
v. Appeal from the Lake Superior
Court
Community Healthcare System The Honorable John M. Sedia,
Community Hospital, Judge
Appellee-Defendant Trial Court Cause No.
45D01-1811-CT-803
Baker, Judge.
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 1 of 9
[1] Amanda Henry appeals the trial court’s order dismissing the complaint she filed
against Community Healthcare System Community Hospital (Community)
after a Community employee allegedly provided Henry’s medical records to the
employee’s spouse, who happened to be Henry’s employer. Henry argues that
(1) while HIPAA does not contain a private right of action, it can form the basis
of a duty and/or standard of care; (2) the trial court erroneously found that
Indiana does not recognize the tort of public disclosure of private information;
and (3) dismissal was improper where there were multiple viable negligence-
based claims implicated by the complaint. Finding that Henry has one or more
claims that should have survived dismissal, we reverse and remand for further
proceedings.
Facts 1
[2] On March 1, 2018, Henry received medical treatment at Community Hospital
in Munster. As part of her treatment, she underwent radiographic imaging.
Three days later, Henry’s employer showed her digital images of her X-rays on
the employer’s cell phone. Henry later learned that her employer is married to
the radiologic technician who performed her radiographic imaging.
[3] On October 24, 2018, Henry filed a complaint against Community. The
relevant portions of the complaint read as follows:
1
We held oral argument in Indianapolis on September 23, 2019. We thank counsel for both parties for their
truly superb oral and written presentations.
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 2 of 9
3. On March 1, 2018, plaintiff received medical care at
Community.
4. Community owes a duty to protect the privacy, security,
and confidentiality of health records generated or
maintained by providers within its network.
5. At some point between March 1, 2018 and March 4, 2018,
a Community workforce member shared plaintiff’s
protected health information with the workforce member’s
spouse.
6. On March 4, 2018, the workforce member’s spouse
showed plaintiff digital images (contained in the spouse’s
cellular telephone) of plaintiff’s March 1, 2018 x-ray films.
***
11. As a direct and proximate result of the above-described
acts of Community and of Community’s workforce
member, plaintiff has suffered damages for which
Community is liable.
Appellant’s App. Vol. II p. 10-11 (emphases omitted). Community filed an
answer denying the allegations.
[4] On April 17, 2019, Community moved to dismiss the complaint pursuant to
Indiana Trial Rule 12(B)(6). Henry responded the same day. The trial court
held a hearing on the motion to dismiss on June 3, 2019, and entered an order
dismissing the complaint the next day. The trial court found that because the
motion to dismiss was filed after the pleadings were closed, the motion should
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 3 of 9
be treated as a motion for judgment on the pleadings pursuant to Trial Rule
12(C). In relevant part, the trial court found as follows:
Here, the question is quite simple: Does Henry have a right of
action against Community on the facts she alleges?
It has long been held that no private action exists under HIPAA,
found at 42 U.S.C. § 1320(d), and its implementing regulations[.]
As to Henry’s claim under the Public Disclosure Privacy Act, the
very recent case of [F.B.C. v. MDwise, Inc., 122 N.E.3d 834 (Ind.
Ct. App. Apr. 16, 2019), trans. pending,] held:
. . . [t]he tort of Disclosure has not yet been
recognized in Indiana. . . . In Doe v. Methodist
Hospital, the Indiana Supreme Court declined to
adopt [the tort of private disclosure of public facts
(“Disclosure”)], which is a sub-tort of invasion of
privacy, as an actionable claim. 690 N.E.2d 681,
693 (Ind. 1997). The Court recognized that while
neighboring states have adopted a more liberal
Disclosure standard, it was not persuaded to adopt
Disclosure as a cognizable claim in Indiana. Id. at
692-93. See also Felsher v. University of Evansville, 755
N.E.2d 589, 593 (Ind. 2001).
It is therefore ordered, adjudged and decreed by the Court as
follows:
1. The Motion to Dismiss of [Community] is granted.
2. This case is ordered dismissed with prejudice.
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 4 of 9
Appealed Order p. 2-3 (emphasis and citation in original omitted). Henry now
appeals.
Discussion and Decision
[5] As noted above, the trial court treated Community’s motion to dismiss as a
motion for judgment on the pleadings pursuant to Indiana Trial Rule 12(C).2
We apply a de novo standard of review to a ruling on a motion for judgment on
the pleadings. Murray v. City of Lawrenceburg, 925 N.E.2d 728, 731 (Ind. 2010).
When evaluating such a motion, we must accept as true the well-pleaded
material facts alleged in the complaint. Consol. Ins. Co. v. Nat’l Water Servs.,
LLC, 994 N.E.2d 1192, 1196 (Ind. Ct. App. 2013). A Rule 12(C) motion is
granted only where it is clear from the face of the complaint that under no
circumstances could relief be granted. Id. A complaint will withstand a motion
for judgment on the pleadings if it states any set of allegations, no matter how
inartfully pleaded, upon which the trial court could have granted relief. Tony v.
Elkhart Cty., 851 N.E.2d 1032, 1035 (Ind. Ct. App. 2006).
[6] Community attempts to frame this case under the Health Insurance Portability
and Accountability Act (HIPAA) and the Indiana Access to Health Care
Records Statute (IAHRS), arguing that there is no private right of action under
2
Henry argues that nothing in the rules provides for this procedure. She maintains that the motion to
dismiss should have been denied as untimely and that Community should have then had to file a motion for
judgment on the pleadings. As everyone would have ended up in the same place had that occurred, we will
join the trial court in considering the matter as a ruling on a motion for judgment on the pleadings for the
sake of judicial economy and efficiency.
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 5 of 9
either statute. This framing is a red herring, however, inasmuch as Henry
agrees that there is no private right of action and is not attempting to assert one.
[7] Instead, Henry argues that HIPAA may be used to establish the standard of
care in a common law negligence action. To ensure that litigants are not
enabled to make an end-run around the lack of a private right of action under
HIPAA, Community argues that there must first be a common law duty. We
agree.
[8] There is an age-old recognition that medical providers owe a duty of
confidentiality to their patients. While this duty is now codified by statute in
Indiana, that does not change the historical recognition of the duty at common
law.3 See Schlarb v. Henderson, 211 Ind. 1, 4, 4 N.E.2d 205, 206 (1936)
(acknowledging, in the context of doctor-patient privilege, that there was a
“common-law rule before the statute” to ensure open communication “without
the danger of publicity concerning such private and intimate affairs”); Springer v.
Byram, 137 Ind. 15, 36 N.E. 361, 363 (1894) (observing that communications
made by a patient to a doctor are “intended to be private and confidential, and
can never be divulged without the consent of the patient”). This common law
duty finds support in the ethical rules governing the medical profession. See
3
We acknowledge the caselaw providing that, in the context of the doctor-patient privilege in our judicial
system, the privilege did not exist at common law and is, instead, a statutory creation of the legislature. E.g.,
Terre Haute Reg’l Hosp., Inc. v. Trueblood, 600 N.E.2d 1358 (Ind. 1992). But we do not believe that the
existence of this privilege in the context of our judicial system has any bearing on the historical duty of
confidentiality owed by medical providers to their patients.
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 6 of 9
Canfield v. Sandock, 563 N.E.2d 526, 529 and 529 n.2 (Ind. 1990) (observing that
“the ethical rules of the medical profession . . . prohibit disclosure of
confidential information in non-judicial settings” and that the “Hippocratic
Oath imposes on physicians a duty to maintain confidences acquired in their
professional capacity”); see also Am. Med. Ass’n, Code of Medical Ethics
Opinion 3.2.1, https://www.ama-assn.org/delivering-
care/ethics/confidentiality (stating that physicians “have an ethical obligation
to preserve the confidentiality of information gathered in association with the
care of the patient”); Vargas v. Shepherd, 903 N.E.2d 1026, 1031-32 (Ind. Ct.
App. 2009) (acknowledging argument that medical providers assume a duty to
abide by ethical guidelines, including obtaining patient consent before
disclosing any medical information, and assuming without deciding that such a
duty exists).
[9] We have little trouble concluding, based on the above authority, that there is—
and, in modern times, always has been—a common law duty of confidentiality
owed by medical providers to their patients. And it is necessarily true that if a
duty exists, a breach of that duty is also possible. Indeed, this Court has more
than once considered a claim that a medical provider negligently or recklessly
disseminated a patient’s confidential information, finding that such a claim
sounds in ordinary negligence rather than in medical malpractice. G.F. v. St.
Catherine Hosp., Inc., 124 N.E.3d 76, 86-88 (Ind. Ct. App. 2019), trans. denied;
H.D. v. BHC Meadows Hosp., Inc., 884 N.E.2d 849, 855-56 (Ind. Ct. App. 2008);
see also Reply Br. p. 15 n.4 (citing to multiple cases from other states showing
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 7 of 9
that torts related to medical privacy breaches are well established based on an
underpinning of the public policy goal of protecting physician-patient
communications).
[10] Having found that a common law duty exists, we have little trouble agreeing
with a sister court that “HIPAA and its implementing regulations may be
utilized to inform the standard of care” in tort claims related to alleged breaches
of the duty of confidentiality owed by medical providers to their patients. Byrne
v. Avery Ctr. for Obstetrics & Gynecology, P.C., 102 A.3d 32, 49 (Conn. 2014).
[11] Under Indiana’s liberal notice pleading standard, we find that Henry’s
complaint includes the operative facts necessary to make a negligence-based
claim against Community. See ARC Constr. Mgmt., LLC v. Zelenak, 962 N.E.2d
692, 697 (Ind. Ct. App. 2012) (holding that “[u]nder Indiana’s notice pleading
system, a pleading need not adopt a specific legal theory of recovery to be
adhered to throughout the case”). Specifically, the complaint alleged a duty to
protect the privacy, security, and confidentiality of her health records, a breach
of that duty by Community’s employee when the employee shared Henry’s x-
rays with employee’s spouse, and resulting damages, if any. Under these
circumstances, it was erroneous to grant Community’s motion for judgment on
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 8 of 9
the pleadings because it is not clear from the face of the complaint that under no
circumstances could relief be granted.4, 5
[12] The judgment of the trial court is reversed and remanded for further
proceedings.
Kirsch, J., and Crone, J., concur.
4
Because we find that the complaint survives dismissal based on medical providers’ common law duty of
confidentiality, we need not and will not discuss Henry’s other claims implicated by the complaint, including
public disclosure of private facts and other negligence-based claims. On remand, Henry is free to pursue
whichever theories of the case she chooses so long as they stem from the operative facts pleaded in her
complaint.
5
If this litigation continues, at some point, Henry will have to show that she sustained damages as a result of
the alleged breach of confidentiality, whether in the context of a negligence-based claim or an invasion of
privacy claim. We note that the Restatement (Second) of Torts indicates that, for an invasion of privacy
claim, damages can include (1) the harm to the plaintiff’s privacy interest itself; (2) the plaintiff’s mental
distress; and (3) special damages. Restatement (Second) of Torts § 652H.
If, in the context of a negligence-based claim, Henry cannot prove damages, we note that the Vargas Court, in
similar circumstances, explained that the appropriate remedy would be “a complaint to the medical licensing
board or professional organization.” 903 N.E.2d at 1032.
Court of Appeals of Indiana | Opinion 19A-CT-1256 | October 8, 2019 Page 9 of 9