Sheldon v. Kettering Health Network , 2015 Ohio 3268 ( 2015 )

[Cite as Sheldon v. Kettering Health Network, 2015-Ohio-3268.]
IN THE COURT OF APPEALS OF OHIO
SECOND APPELLATE DISTRICT
MONTGOMERY COUNTY
VICKI SHELDON, et al. :
: Appellate Case No. 26432
Plaintiff-Appellants :
: Trial Court Case No. 14-CV-3304
v. :
: (Civil Appeal from
KETTERING HEALTH : Common Pleas Court)
NETWORK, et al. :
:
Defendants-Appellees :
...........
OPINION
Rendered on the 14th day of August, 2015.
...........
ROBERT F. CROSKERY, Atty. Reg. No. 0064802, Croskery Law Offices, 810 Sycamore
Street, 2nd Floor, Cincinnati, Ohio 45202
Attorney for Plaintiffs-Appellants, Vicki Sheldon, T.D., and Haley Dercola
DOREEN CANTON, Atty. Reg. No. 0040394, and EVAN T. PRIESTLE, Atty. Reg. No.
0089889, Taft Stettinius & Hollister LLP, 425 Walnut Street, Suite 1800, Cincinnati, Ohio
45202-3957
Attorneys for Defendant-Appellee, Kettering Adventist Healthcare
J. STEVEN JUSTICE, Atty. Reg. No. 0063719, and GLEN McMURRY, Atty. Reg. No.
82600, 210 West Main Street, Troy, Ohio 45373
Attorneys for Defendant-Appellee, Duane Sheldon
.............
-2-
HALL, J.
{¶ 1} Plaintiffs-appellants Vicki Sheldon and Haley Dercola appeal from the trial
court’s Civ.R. 12(B)(6) dismissal of their complaint against defendant-appellee Kettering
Adventist Healthcare d/b/a Kettering Health Network (“KHN”).1 The complaint alleged
common-law tort claims for invasion of privacy, negligence, negligence per se, negligent
training, negligent supervision, intentional infliction of emotional distress, and breach of
fiduciary duty.2 The claims stemmed from KHN’s alleged failure to protect the privacy of
the plaintiffs’ electronic medical information and the improper accessing and disclosure of
that information by KHN administrator Duane Sheldon, the former spouse of Vicki
Sheldon.
{¶ 2} KHN responded to the complaint by seeking dismissal under Civ.R. 12(B)(6).
In support, KHN argued that each of the tort claims was based on alleged violations of the
federal Health Insurance Portability and Accountability Act (“HIPAA”). KHN noted that
HIPAA did not provide a private right of action to enforce its terms. Therefore, KHN
reasoned that the plaintiffs could not assert common-law tort claims essentially alleging
HIPAA violations. KHN argued that the “[p]laintiffs should not be permitted to circumvent
the bar on private enforcement of HIPAA violations by merely masking alleged HIPAA
1
Dercola filed suit in her own name and as parent and legal guardian of her minor child,
T.D. In addition to KHN, the complaint named Sheldon’s former husband, Duane
Sheldon, as a defendant. The claims against Duane Sheldon were voluntarily dismissed,
however, after the trial court granted KHN’s Civ.R. 12(B)(6) motion.
2
The complaint also alleged violations of the Fair Credit Reporting Act and the Fair Debt
Collection Practices Act. Those claims were voluntarily dismissed below and are not at
issue on appeal.
-3-
violations as common-law torts.” (Doc. #14 at 9). Alternatively, KHN argued that the
plaintiffs had failed to plead facts establishing the elements for their alleged claims for
invasion of privacy, negligent training, negligent supervision, and intentional infliction of
emotional distress. The plaintiffs responded by arguing, among other things, that nothing
prohibited them from “pursuing common law claims based on violations of their privacy
just because such claims overlap with HIPAA violations.” (Doc. #18 at 2). They also
asserted that their tort claims had been pled sufficiently. (Id. at 8-13). The plaintiffs
additionally moved for leave to file a first amended complaint, seeking to clarify that they
were alleging tortious conduct apart from HIPAA. (Doc. #27).
{¶ 3} The trial court sustained KHN’s Civ.R. 12(B)(6) motion in an October 21,
2014 decision and entry. (Doc. #32). After reviewing the plaintiffs’ complaint, the trial court
concluded that each of their tort claims was based on an alleged HIPAA violation.
Because HIPAA does not provide a private right of action, the trial court concluded that
the plaintiffs could not state a claim for relief. (Id.). The decision did not address KMH’s
alternative arguments to dismiss some of plaintiff’s claims. The trial court’s ruling also did
not explicitly address the plaintiffs’ motion for leave to amend their complaint. The trial
court subsequently dismissed that motion, as moot, based on its sustaining of KHN’s
Civ.R. 12(B)(6) motion.
{¶ 4} In their first assignment of error, the plaintiffs contend the trial court erred in
dismissing their common-law claims against KHN. While conceding that HIPAA itself
does not provide a private right of action to enforce its terms, the plaintiffs insist that the
statute also does not preclude their common-law tort claims, which, they argue, point to
HIPAA and other sources for a standard of care. In response, KHN argues, as it did
-4-
below, that the plaintiffs cannot maintain common-law tort claims based on, and resulting
from, alleged HIPAA violations. In a second assignment of error, the plaintiffs contend the
trial court erred in not allowing them to amend their complaint to make clear that they were
not seeking recovery under HIPAA and that they were relying on the statute, at most, to
establish a standard of care.
{¶ 5} We begin our review with the standards applicable to a Civ.R. 12(B)(6)
motion. A motion to dismiss a complaint for failure to state a claim upon which relief can
be granted, pursuant to Civ.R.12(B)(6), tests the sufficiency of a complaint. For a
defendant to prevail, it must appear beyond doubt from the complaint that the plaintiff can
prove no set of facts entitling him to relief. O’Brien v. University Community Tenants
Union, Inc., 42 Ohio St. 2d 242, 245, 327 N.E.2d 753 (1975). A court must construe the
complaint in the light most favorable to the plaintiff, presume all of the factual allegations
to be true, and make all reasonable inferences in the plaintiff’s favor. Mitchell v. Lawson
Milk Co., 40 Ohio St. 3d 190, 192, 532 N.E.2d 753 (1988). We conduct a de novo review of
a dismissal under Civ.R. 12(B)(6). Grover v. Bartsch, 170 Ohio App. 3d 188,
2006-Ohio-6115, 866 N.E.2d 547, ¶ 16 (2d Dist.).
{¶ 6} With the foregoing standards in mind, we turn to the complaint in this case. It
contains the following factual allegations:
6. Defendant KHN uses a system of software for storing, maintaining,
accessing, and protecting electronic medical information. The system is
known as “EPIC.” When properly used, the system protects medical
information from being accessed by unapproved personnel to comply with
the federal law Health Insurance Portability and Accountability Act,
-5-
otherwise known as “HIPAA.”
7. The “EPIC” System uses reports to ensure that electronic medical
information is safely protected and remains private. Through a series of
reports, known as “CLARITY” reports, the hospital or authorized medical
information custodian has the ability to ensure that records are not being
improperly accessed through, but not limited to, the following reports: * * *
[The complaint lists numerous different types of reports that allegedly can
be produced to help detect possible security or privacy breaches]. The
cumulative effect of the regular running and monitoring of these Epic Clarity
reports is to detect and deter improper access. When routinely run and
monitored, the Epic Clarity reports provide early detection of privacy
breaches of EHRs.
8. Under the HIPAA Security Rule, a covered entity must identify and
analyze potential risks to electronic private health information, and it must
implement security measures that reduce risks and vulnerabilities to a
reasonable level. Epic reports should be run and reviewed on a consistent
and recurring basis, no less than monthly, and preferably weekly, in order to
adequately monitor, ensure and protect the privacy of health information to
meet the HIPAA Risk Analysis and Management Process. When used
properly and effectively, EPIC Software and CLARITY Reports provide
auditing and monitoring protection for electronic health information.
9. Defendant D. SHELDON, an administrator for KPN under the KHN, had
access to the EPIC system but was not authorized to access the health
-6-
records of the Plaintiffs. Defendant D. Sheldon improperly accessed the
health records of Plaintiffs on multiple occasions over a period of at least 15
months, as Defendant KHN failed to take reasonable steps under EPIC and
CLARITY to detect his unauthorized access or otherwise to protect such
information.
10. Duane Sheldon, as administrator, commenced at least one extramarital
affair with certain others in the Kettering Health Network. In order to
enhance his affair, Duane Sheldon improperly accessed extremely
sensitive medical information belonging to Vicki Sheldon, and shared such
information with his paramour, who is an employee of KPN who reported to
D. Sheldon.
11. In addition, upon information and belief, Duane Sheldon and other
parties in his department created one or more fictitious names that do not
represent real parties or real users of health information to improperly
access protected health information.
12. These fictitious names accessed Plaintiffs’ protected health information.
13. In addition, there were significant other breach incidents by D.
SHELDON and his accomplices of Vicki Sheldon’s protected health
information, and also to the protected health information of H. DERCOLA
and [T.D.].
14. The breach of such information would have been prevented (or greatly
minimized) had Defendant KHN been taking the reasonable and normal
steps to protect Plaintiff’s health information by running weekly or at least
-7-
monthly EPIC CLARITY reports, and monitoring those reports.
15. Defendant KHN eventually revealed to Plaintiffs that there had been
multiple breaches of their private and protected health information, in
violation of the Health Information Technology for Economic and Clinical
Health Act (“the HITECH Act”) however, when Plaintiffs requested proper
information from the “EPIC” and “CLARITY” reports to examine the nature
of the actual breaches, KHN refused to provide them. In fact, Plaintiffs,
through counsel, on multiple occasions asked for copies of the “EPIC”
reports, by name, that would have shown the exact nature of the privacy
breaches, and Defendant refused to provide them and/or stated that such
reports did not exist.
16. Instead, Defendant Kettering Health Network provided a “Homegrown”
Report (a report designed by KHN employees to control what information to
provide) that is inadequate, and then proceeded to provide false and
malicious information regarding the parties that are listed on the
“Homegrown” Report.
(Doc. #1 at 2-5).3
{¶ 7} In short, paragraphs six through eight provide background factual
information about KHN’s use of the EPIC system and CLARITY reports to comply with
HIPAA’s security rule regarding the protection of electronic health information and the
detection of breaches. Paragraph nine alleges that KHN administrator Duane Sheldon
3
Although the complaint contains two additional paragraphs of factual allegations after
paragraph sixteen, those allegations involve other causes of action that the plaintiffs
voluntarily dismissed below.
-8-
gained unauthorized access to plaintiffs’ health records due to KHN’s failure to take
reasonable steps, under EPIC and CLARITY, to protect the information or detect his
actions. Paragraph ten alleges that the information he “improperly accessed” was shared
with a subordinate KHN employee with whom he was having an affair. Paragraphs eleven
and twelve allege that he and others created “fictitious names that do not represent real
parties,” which were used to improperly access health information. Paragraph thirteen
alleges other breaches of plaintiffs’ health information by Duane Sheldon. Paragraph
fourteen alleges that the breaches would have been prevented or minimized if KHN had
taken reasonable steps to protect the information by running and monitoring CLARITY
reports. Paragraph fifteen alleges that KHN eventually disclosed the breaches to the
plaintiffs but refused to provide them with pertinent CLARITY reports. Paragraph fifteen
also mentions “the HITECH Act,” which amended HIPAA in 2009. Paragraph sixteen
alleges that KHN provided the plaintiffs with a different, inadequate report prepared by
KHN employees that contained false and malicious information.
{¶ 8} We discern at least two types of tortious activity alleged by the plaintiffs: (1)
Duane Sheldon’s intentional improper accessing and sharing of their health information
and (2) KHN’s alleged failure to take reasonable steps to protect that information and to
detect Duane Sheldon’s breaches. We note that the factual allegations about Duane
Sheldon’s conduct do not necessarily appear to depend on an alleged HIPAA violation.
The statute is invoked only in connection with the plaintiffs’ factual allegations about KHN
failing to take reasonable steps to protect their health information and to detect his
breaches. In particular, the plaintiffs allege that KHN failed to regularly run and monitor
CLARITY reports, which they allege was required by HIPAA.
-9-
{¶ 9} Based on the foregoing allegations, the plaintiffs argue they asserted
common-law causes of action against Duane Sheldon individually for invasion of privacy,
negligence, intentional infliction of emotional distress, and breach of fiduciary duty. We
agree with the trial court that the complaint fairly can be read as alleging common-law
claims against Duane Sheldon for improperly accessing and sharing the plaintiffs’ health
information, regardless of HIPAA’s prohibition to the contrary. The trial court reached the
same conclusion in an October 21, 2014 decision and entry denying Duane Sheldon’s
Civ.R. 12(B)(6) motion to dismiss.4 (Doc. #34).
{¶ 10} An important issue for purposes of KHN’s appeal is whether the plaintiffs
are seeking to hold KHN liable on a respondeat-superior basis for Duane Sheldon’s
allegedly tortious actions. Although the original complaint is perhaps unclear, the plaintiffs
clarified the uncertainty in their proposed amended complaint that they filed before the
trial court granted KHN’s Civ.R. 12(B)(6) motion. Therein, the plaintiffs proposed to allege
that Duane Sheldon was a high-ranking administrator for KHN and added the allegation
that “KHN is responsible for Defendant D. SHELDON’s actions on the grounds of
respondeat superior, as his access of the health information, although improper, was
within the scope of his duties as a high level administrator at KHN.” (Doc. #27, Plaintiffs’
proposed first amended complaint at ¶ 20). We therefore generously construe the original
complaint to mean that plaintiffs in fact are attempting to hold KHN vicariously liable for
Duane Sheldon’s actions, which allegedly constituted several torts. Consequently we
4
We recognize that the plaintiffs voluntarily dismissed their claims against Duane
Sheldon after the trial court granted KHN’s Civ.R. 12(B)(6) motion. We nevertheless find a
discussion of those claims pertinent to our analysis of KHN’s Civ.R. 12(B)(6) motion and
the plaintiffs’ motion for leave to amend their complaint.
-10-
must determine whether the allegation of respondeat-superior liability could survive
dismissal under Civ.R. 12(B)(6). If so, the trial court should either have so construed the
original complaint or permitted the plaintiffs’ proposed amendment in that regard.
{¶ 11} The existing complaint alleges that Duane Sheldon, a KHN administrator,
“was not authorized to access the health records of the Plaintiffs” and KHN failed to
“detect his unauthorized access” (Complaint at ¶ 9). It also alleges that “Duane Sheldon
improperly accessed extremely sensitive medical information” (Id. at ¶ 10) and shared
that information with another KHN employee. He did this by creating “one or more
fictitious names * * * to improperly access protected health information.” (Id. at ¶ 11). The
complaint alleges that Sheldon’s actions were “malicious and reckless.” (Id. at ¶ 22). The
proposed amended complaint, which expands on the respondeat superior allegation,
contains the same language as in the original and additionally alleges that Duane
Sheldon violated the plaintiffs’ privacy by “wrongfully intruding into [plaintiffs’] records and
wrongfully publishing such information to third parties.” (Proposed Amended Comp. at ¶
22). The plaintiffs’ clarification also alleges that “his access of the health information,
although improper, was within the scope of his duties as a high level administrator at
KHN.” (Id. at ¶ 20).
{¶ 12} “It is well-established that in order for an employer to be liable under the
doctrine of respondeat superior, the tort of the employee must be committed within the
scope of employment. Moreover, where the tort is intentional * * * the behavior giving rise
to the tort must be ‘calculated to facilitate or promote the business for which the servant
was employed * * *.’” Byrd v. Faber, 57 Ohio St. 3d 56, 58, 565 N.E.2d 584 (1991), quoting
Little Miami R.R. Co. v. Wetmore, 19 Ohio St. 110, 132 (1869). An intentional and willful
-11-
act committed by an employee “to vent his own spleen or malevolence against the injured
person, is a clear departure from his employment” and will not support
respondeat-superior liability. Id. at 59. In Byrd, the Ohio Supreme Court found Civ.R.
12(B)(6) dismissal appropriate where the plaintiff attempted to use respondeat superior to
hold a religious organization liable for a sexual assault by a pastor against a parishioner.
{¶ 13} We reach the same conclusion here, where the complaint alleges that
Duane Sheldon intentionally and improperly gained unauthorized access to the plaintiffs’
health records for personal reasons in furtherance of an affair. Even construing the
complaint, or the proposed amended complaint, most strongly in the plaintiffs’ favor, they
can prove no set of facts entitling them to relief against KHN on a respondeat-superior
basis for Duane Sheldon’s alleged behavior. As a result, KHN was entitled to dismissal
under Civ.R. 12(B)(6) insofar as the plaintiffs sought to hold KHN vicariously liable for
Duane Sheldon’s improper accessing and sharing of their health information, and the trial
court did not err in refusing to allow the plaintiffs to amend their complaint to make the
respondeat-superior theory more clear.
{¶ 14} We note that a court of appeals in our neighbor state of Indiana has reached
an apparent contrary conclusion. In Walgreen Co. v. Hinchy, 21 N.E.3d 99 (Ind. Ct. Appl.
2014), Audra Withers was a Walgreen’s pharmacist who was involved in a relationship
with plaintiff Hinchy’s former boyfriend. Withers accessed Hinchy’s prescription profile to
find any information about plaintiff’s potential STD. The boyfriend, to whom the accessed
private information was apparently disclosed, contacted Hinchy a few days later claiming
he had a print out of her drug information. A jury awarded $1.8 million in damages and
determined Walgreen’s and Withers were 80 percent responsible. Upon review, the court
-12-
of appeals cited portions of the Restatement (Third) of Agency, § 7.07 (2006), including
that “[a]n employee’s act is not within the scope of employment when it occurs within an
independent course of conduct not intended by the employee to serve any purpose of the
employer.” Id. at § 707(2). It also referred to Ingram v. City of Indianapolis, 759 N.E.2d
1144 (Ind.Ct.App.2001), for the proposition that when some of the employee’s acts are of
the same nature as those authorized by the employer and some not, whether the
employee is acting within the scope of employment is a question of fact to be determined
by the jury. The court concluded that whether “Withers was acting in the scope of her
employment was properly determined by the jury rather than as a matter of law by the trial
court.” Hinchy at 108.
{¶ 15} We do not believe Ohio law is so generous. We have previously said “a
servant’s conduct is within the scope of his employment if it is of the kind which he is
employed to perform, occurs substantially within the authorized limits of time and space,
and is actuated, at least in part, by a purpose to serve the master.” Cooke v. Montgomery
Cty., 158 Ohio App. 3d 139, 2004-Ohio-3780, 814 N.E.2d 505, ¶ 20 (2d Dist.). The
“purpose to serve the master” ingredient has been used by several other Ohio courts of
appeal. The Ohio Supreme Court’s formulation of the requirement is that “an employer is
not liable for independent self-serving acts of his employees which in no way facilitate or
promote his business.” Byrd at 59. This purpose-to-serve-the-master aspect does not
appear in Indiana discussions of their analysis of scope of employment. Here, however,
the undisputed facts for purposes of KHN’s motion are as alleged in the complaint about
Duane Sheldon’s “unauthorized” and “improper” access of health information by the
creation of “fictitious names,” and his “shar[ing] such information with his paramour” “in
-13-
order to enhance his affair.” We see no part of that activity that has a purpose to serve
KHN. Accordingly, under Ohio law, Sheldon was not acting within the scope of
employment and, therefore, the plaintiffs can prove no set of facts entitling them to relief
on a respondeat-superior claim.5
{¶ 16} We turn now to the factual allegations in the complaint regarding KHN’s
own failure to take reasonable steps, as alleged to be required under HIPAA, to protect
the plaintiffs’ health information and to detect Duane Sheldon’s breaches. As noted
above, the plaintiffs’ allegations are grounded in the notion that KHN failed to regularly
run and monitor the EPIC system CLARITY reports in violation of HIPAA. According to the
complaint, “the system protects medical information from being accessed by unapproved
personnel to comply with the federal law * * * known as ‘HIPAA.’” (Doc. #1 at ¶ 6). “[T]he
cumulative effect of the regular running of these Epic Clarity reports is to detect and deter
improper access.” (Id. at ¶ 7). “Epic reports should be run and reviewed on a consistent
and recurring basis * * * to meet the HIPAA Risk Analysis and Management Process.” (Id.
at ¶ 8).
{¶ 17} Based on the plaintiffs’ own specifically-titled headings of the complaint’s
stated causes of action, they intended to assert common-law causes of action against
5
We note that the proposed amended complaint alleges that “KNH is responsible for
Defendant D. Sheldon’s actions on the ground of respondeat superior, as his access of
the health information, although improper, was within the scope of his duties as a high
level administrator at KHN.” (Proposed Amended Comp. at ¶ 20). We make two
observations in response. First, “[u]nsupported conclusions of a complaint are not
considered admitted * * * and are not sufficient to withstand a motion to dismiss.” State ex
rel. Hickman v. Capots, 45 Ohio St. 3d 324, 544 N.E.2d 639 (1989). Thus, alleging the
conclusion that his access to records was within the scope of his duties does not
contradict the numerous factual allegations that his access to these records was
unauthorized and improper. Second, the fact that Duane Sheldon’s position may have
entailed access to all the records of the entire hospital does not make his access of his
ex-wife’s records an authorized intrusion within the scope of employment.
-14-
KHN for invasion of privacy, negligence, negligence per se, negligent training, negligent
supervision, intentional infliction of emotional distress, and breach of fiduciary duty. The
trial court found these claims subject to Civ.R. 12(B)(6) dismissal because they all
essentially alleged violations of HIPAA, or were “HIPAA based,” and the statute does not
provide a private right of action. (Doc. #32 at 4-5).
{¶ 18} As a preliminary matter, it is beyond dispute that HIPAA itself does not
create an express or implied private right of action for violations of its provisions. See,
e.g., Acara v. Banks, 470 F.3d 569, 571 (5th Cir.2006). The cases supporting this holding
are legion, and the plaintiffs agree HIPAA provides no private action. Despite the fact that
plaintiffs argue that they have asserted common-law claims and not a statutory HIPAA
claim, unquestionably the complaint is grounded in the notion that KHN’s actions were
wrongful because they failed to take steps, consistent with HIPAA, that would have
prevented or reduced the risk of disclosure. Nevertheless, at this stage of the litigation we
are required to interpret the complaint broadly to determine whether the allegations assert
common-law tort claims independent from HIPAA. Thus, the absence of a private right of
action under HIPAA does not necessarily resolve the issues before us. For that reason,
we find some of the case law cited by KHN to be of little assistance. The Ohio case law
upon which KHN relies does not decide whether a plaintiff can bring a common-law tort
claim that might also involve a HIPAA violation for which no private statutory right of
action exists. KHN cites OhioHealth Corp. v. Ryan, 10th Dist. Franklin No. 10AP-937,
2012-Ohio-60, which states: “HIPAA does not allow a private cause of action, according
to Ohio law.” Id. at ¶ 18, citing Henry v. Ohio Victims of Crime Compensation Program,
S.D.Ohio No. 2:07–cv–0052, 2007 WL 682427 (Feb. 28, 2007); see also Shepherd v.
-15-
Sheldon, N.D.Ohio No. 1:11 CV 127, 2011 WL 2971965 (July 21, 2011); Siegler v. Ohio
State Univ., S.D.Ohio No. 2:11–cv–170, 2011 WL 1990570 (May 23, 2011); and Wood v.
Byer, N.D.Ohio No. 5:06CV137, 2006 WL 3304053 (Aug. 9, 2006).
{¶ 19} The Ohio federal cases cited in OhioHealth Corp. v. Ryan stand for the
undisputed proposition that Congress did not create a private, statutory right of action to
enforce HIPAA’s terms.6 KHN also cites Boddie v. Van Steyn, 10th Dist. Franklin No.
13AP-623, 2014-Ohio-1069. The only cause of action at issue there was a recognized tort
claim for breach of physician-patient confidentiality. The Tenth District held that the claim
failed for reasons having nothing to do with HIPAA, which was mentioned in passing in
the final paragraph.
{¶ 20} Contrary to the language in OhioHealth Corp. v. Ryan upon which KHN
relies, we find it imprecise to say that HIPAA “does not allow a private cause of action.”
What we should determine is whether HIPAA prohibits common-law tort claims based on
the wrongful release of confidential medical information unrelated to and independent
from HIPAA itself. Indeed, the State of Ohio has recognized an independent tort for the
“unauthorized, unprivileged disclosure to a third party of nonpublic medical information[.]”
Biddle v. Warren Gen. Hosp., 86 Ohio St. 3d 395, 401, 715 N.E.2d 518 (1999), paragraph
6
In Henry, the court noted that the plaintiff’s claims actually appeared to be brought
under HIPAA, which lacks a private right of action. In Shepherd, the plaintiffs admitted
that they did not allege a claim under HIPAA or any tort claims at all. Although HIPAA had
nothing to do with the case, the court recognized in a footnote that it does not create a
private right of action. In Siegler, the court held that no claim could be brought “under
HIPAA” because it lacked a private right of action and that any common law claim would
be barred by the Eleventh Amendment, which is not at issue in the present case. Finally,
in Wood, the plaintiff actually attempted to bring a claim under HIPAA itself. The court
rejected the attempt because “HIPAA does not provide a private cause of action[.]”
Although we do not disagree with any of the foregoing findings, none of them address the
issue before us.
-16-
one of the syllabus. Biddle, however, was decided before HIPAA’s privacy-rule
regulations were published on December 28, 2000 and before its security-rule regulations
took effect on April 21, 2003. Therefore, we must first determine whether Biddle’s
common-law right of action recognized in 1999 survives HIPAA.
{¶ 21} Arguing that HIPAA “does not allow” such a common-law tort claim is
another way of saying that it preempts one. “It is well settled that the Supremacy Clause
of the federal Constitution grants Congress the power to preempt state law.” Leppla v.
Sprintcom, Inc., 156 Ohio App. 3d 498, 2004-Ohio-1309, 806 N.E.2d 1019, ¶ 11 (2d
Dist.), citing Minton v. Honda of Am. Mfg., Inc, 80 Ohio St. 3d 62, 68, 684 N.E.2d 648
(1997), abrogated on other grounds by Geier v. Am. Honda Motor Co., Inc., 529 U.S. 861,
120 S. Ct. 1913, 146 L. Ed. 2d 914 (2000). The Ohio Supreme Court has “recognized three
ways state law can be preempted by the Supremacy Clause: (1) where federal law
expressly preempts state law (express preemption); (2) where federal law has occupied
the entire field (field preemption); or (3) where there is a conflict between federal law and
state law (conflict preemption).” Id. at ¶12, citing Minton at 69.
{¶ 22} “In the case of field preemption, ‘state law is pre-empted where it regulates
conduct in a field that Congress intended the Federal Government to occupy
exclusively.’ ” Id. “In the case of conflict preemption, state law is preempted ‘where it is
impossible for a private party to comply with both state and federal requirements,’ or
‘where state law stands as an obstacle to the accomplishment and execution of the full
purposes and objectives of Congress.’” (Citations omitted). Id.
{¶ 23} HIPAA is a combination of the statute and the regulations adopted under its
authority. The HIPAA statute states that it “shall supersede any contrary provision of State
-17-
law.” 42 U.S.C. § 1320d–7(a)(1); see also 45 C.F.R. § 160.203. But the statute
specifically directs that any regulations shall not supersede state law that is “more
stringent” than the requirements under HIPAA. Section 264(c)(2) of Public Law 104-191.
The regulations provide that state law is “contrary” to HIPAA when (1) it is “impossible to
comply with both the State and Federal requirements;” or (2) “state law stands as an
obstacle to the accomplishment and execution” of the act. 45 C.F.R. § 160.202. The
“more stringent” exception is adopted in 45 C.F.R. § 160.203(b). The regulations also
explain that a state law is “more stringent” than HIPAA if the state law provides greater
privacy protection, provides the patient greater rights of access or access to more
information than HIPAA, or narrows the scope or duration of the use or disclosure of
information HIPAA would allow. 45 C.F.R. § 160.202. Significantly, “State law means a
constitution, statute, regulation, rule, common law, or other State action having the force
and effect of law.” (Emphasis added). Id.
{¶ 24} Upon review, we conclude that HIPAA does not preempt the Ohio
independent tort recognized by the Ohio Supreme Court in Biddle “for the unauthorized,
unprivileged disclosure to a third party of nonpublic medical information that a physician
or hospital has learned within a physician-patient relationship.” Biddle, at paragraph one
of the syllabus. However, we further conclude that federal regulations—as opposed to an
Ohio statute that sets forth a positive and definite standard of care—cannot be used as a
basis for negligence per se under Ohio law. Additionally, in our view utilization of HIPAA
as an ordinary negligence “standard of care” is tantamount to authorizing a prohibited
private right of action for violation of HIPAA itself, and moreover, in specific regard to
plaintiffs’ allegation that monitoring access to medical records was too infrequent, HIPAA
-18-
does not provide a standard of care as to the frequency of review of information-system
activity.
{¶ 25} We determine that a Biddle claim is not preempted because we fail to see
how such a claim conflicts with HIPAA unless the alleged claim asserts recovery for
release of information that HIPAA specifically allows. And although Congress has
provided for enforcement of HIPAA by the Secretary of Health and Human Services, 42
U.S.C.S. §§ 1320d–5, 1320d–6, and more recently, by State Attorneys General, see 42
U.S.C.S. § 1320d–5(d), the allowance of recovery of an individual’s damages does not
interfere with government enforcement. Therefore, we do not find it is impossible to
comply with HIPAA and with state law to the extent we have indicated, and state law is not
an obstacle to the accomplishment of HIPAA’s purposes. We believe a Biddle claim
enhances the protection of confidentiality of medical information.
{¶ 26} Despite our agreement that a cause of action still exists for “unauthorized,
unprivileged disclosure to a third party of nonpublic medical information that a physician
or hospital has learned within a physician-patient relationship,” Biddle, at paragraph one
of the syllabus, plaintiffs have not alleged a set of facts that would entitle them to relief
under Biddle. Initially we note that none of the titles for the causes of action in the
complaint refer to a Biddle-type independent cause of action. The only references to
Biddle in the plaintiffs’ various filings and briefs, both here and in the trial court, are
references to the Biddle case in arguments associated only with the alleged
breach-of-fiduciary-duty claim. In fact, the plaintiffs appear to equate their fiduciary-duty
claim with a Biddle claim, arguing: “KHN breached its fiduciary duty of confidentiality as
set forth in Biddle by disclosing information to unauthorized employees.” (Appellants’ brief
-19-
at 10.) But the plaintiffs’ allegations fall short of raising such a claim. As applied to KHN,
we conclude, and the hospital does not appear to dispute, that Sheldon’s alleged actions
were “unauthorized.” He may have had authority to access any hospital medical record
for a legitimate administrative purpose, but not for personal spying on his former spouse
or his sharing of that information with a co-worker. It likewise appears the allegations in
the complaint are sufficient to conclude that his access and subsequent disclosure were
“unprivileged.” The crux of the issue is whether Sheldon’s alleged acts amount to
“disclosure” by KHN or “disclosure” for which the hospital may be held legally responsible.
We note that the allegations fail to allege that KHN actively or intentionally disclosed
anything.
{¶ 27} Biddle itself dealt with deliberate intentional disclosure of patient
information by a hospital to a law firm to screen patients for SSI eligibility to see if that
source could pay patients’ outstanding hospital bills. The attorneys were to be paid a
contingency for patients where an SSI claim paid the hospital. For “two and one-half
years, the hospital released all of its patient registration forms to the law firm without
obtaining any prior consent or authorization from its patients to do so, and without
prescreening or sorting them in any way.” Biddle at 395. Under any set of circumstances,
pre- or post-HIPAA, with or without reference to HIPAA regulations, the intentional,
unauthorized disclosures in Biddle should be actionable. Accordingly, we conclude that
the independent tort recognized in Biddle is still viable after HIPAA although the
parameters of such a claim may have been impacted by HIPAA preemption.
{¶ 28} We note that recognition of a Biddle claim post-HIPAA presents a
seemingly unsolvable conundrum. In many cases, as here, whether a release of
-20-
information is “unauthorized” will not be in question. However, if the validity of
authorization is disputed, the parties very well might refer to the specific authorization
provisions of the HIPAA privacy rules for guidance. If authorization under Ohio medical
privacy law or rules is more relaxed than HIPAA, then Ohio’s less-stringent authorization
provisions are not effective because they are preempted by HIPAA. But one could argue
that using HIPAA-specific authorization regulations to determine whether release is
“unauthorized” allows for the enforcement of HIPAA regulations, which is arguably
contrary to the overwhelming conclusion that HIPAA does not provide a private right of
action. Because authorization of the release is not in question here, we need not resolve
this problem.
{¶ 29} Although case law delineating the parameters of a Biddle claim is still
developing, the consolidation of other theories of recovery into that recognized tort is
certain. In Biddle, as here, the plaintiffs alleged claims for invasion of privacy, intentional
infliction of emotional distress, and negligence. The Biddle court reasoned: “[A]s to
appellees’ continued insistence that they be entitled to pursue other theories of liability,
we agree with the reasoning of the appellate court that these other theories are either
unavailable, inapplicable because of their respective doctrinal limitations, or subsumed
by the tort of breach of confidence [i.e., a Biddle claim]. Indeed, it is the very awkwardness
of the traditional causes of action that justifies the recognition of the tort for breach of
confidence in the first place.” Biddle at 408-409; see also Norris v. Smart Document
Solutions, LLC, 483 Fed. Appx. 247, 248–49 (6th Cir.2012) (recognizing that a Biddle
claim is “its own independent tort [which] forecloses an argument that [plaintiff’s] action
should be understood as one for the long-recognized tort of wrongful taking of personal
-21-
property” known as conversion). Although breach of fiduciary duty is not mentioned as
subsumed in Biddle, or as foreclosed as in Norris, we determine that the plaintiffs’ alleged
seventh count for breach of fiduciary duty is subsumed along with the other theories,
particularly when appellant contends that “KHN breached its fiduciary duty of
confidentiality as set forth in Biddle by disclosing information to unauthorized employees.”
(Appellants’ Brief at 10).
{¶ 30} In any event, we decline to recognize the plaintiffs’ alleged “Third Count:
Negligence Per Se,” which undoubtedly is “HIPAA based,”7 for three separate reasons.
First, to the extent that HIPAA universally has been held not to authorize a private right of
action, to permit HIPAA regulations to define per se the duty and liability for breach is no
less than a private action to enforce HIPAA, which is precluded. Second, in Chambers v.
St. Mary’s School, 82 Ohio St. 3d 563, 697 N.E.2d 198 (1998), the Ohio Supreme Court
held that “[t]he violation of an administrative rule does not constitute negligence per se;
however such a violation may be admissible as evidence of negligence.” Id. at syllabus.
Therefore, under Ohio case law the HIPAA administrative rules that appellants argue are
applicable cannot be the basis of a negligence per se theory of recovery. Third, critical
allegations in the complaint state that “Epic reports should be run and reviewed on a
consistent and recurring basis, no less than monthly, and preferably weekly, in order to
adequately monitor, ensure and protect the privacy of health information to meet the
HIPAA Risk Analysis and Management Process.” (Complaint at ¶ 8) These allegations
suggest that had KHN audited its records more frequently it would have discovered
7
The negligence per se count of the complaint says only that KHN “violated standards for
protecting electronic health information” without reference to HIPAA or any specific
statute or regulation to support negligence per se. In their brief, the plaintiffs’ argument
makes clear that this claim is referring to “HIPAA requirements.” (Appellant’s Brief at 13).
-22-
Duane Sheldon’s intrusion sooner (although, significantly, after he already had accessed
the plaintiffs’ records at least once). This allegation implies that HIPAA presents some
“standard” for when and how information security audits should be performed. We have
not found any such regulation. We note that 45 C.F.R. § 164.312(b) provides for a
hospital to “[i]mplement hardware, software, and/or procedural mechanisms that record
and examine activity in information systems that contain or use electronic protected
health information.” Another regulation, 45 C.F.R. §164.530(i)(1), provides that “policies
and procedures must be reasonably designed, taking into account the size of and the
type of activities related to protected health information undertaken by the covered entity,
to ensure such compliance.” These regulations are flexibly designed to accommodate the
vast array of medical providers. The regulations do require auditing of record access, but
they do not provide a “standard” for how frequently to do so. In this regard, the regulations
do not set forth “a positive and definite standard of care * * * whereby a jury may
determine whether there has been a violation thereof by finding a single issue of fact.”
Eisenhuth v. Moneyhon, 161 Ohio St. 367, 374, 119 N.E.2d 440 (1954). Accordingly, the
regulations at issue are insufficient to support negligence per se liability.
{¶ 31} The remaining question about the trial court’s dismissal of the planitiffs’
“HIPAA-based” claims is whether, based on the alleged facts and reasonable inferences,
it is beyond doubt that the plaintiffs are not entitled to relief on the claim for breach of
confidentiality of medical information. In Scott v. Ohio Dep't of Rehab. & Corr.,
2013-Ohio-4383, 999 N.E.2d 231 (10th Dist.), inmates at Madison Correctional
institution, six of whom were HIV positive and the remainder of whom were “chronic care”
patients, alleged that their confidential medical records were released to the general
-23-
prison population. The pharmacy at the prison periodically produced HIV and
chronic-care lists of inmates. Old lists were discarded in pharmacy trash, which was
bagged and placed outside the pharmacy door. An inmate worker would then collect the
trash for deposit in a dumpster in another controlled-access area. Records came into
possession of inmates and eventually became accessible to the general prison
population. The court of claims determined that the circumstances under which the
medical information was disclosed did not meet the elements of Biddle, supra.
{¶ 32} The Tenth District Court of Appeals analyzed the Biddle issue as whether
disclosure must be intentional or willful. Upon review, it stated:
Biddle itself is certainly premised on facts that involved a deliberate
and intentional disclosure, but in creating this new tort under Ohio law, the
Supreme Court relied on some authorities involving negligence fact
patterns. [Citation and summary omitted]. We are therefore unwilling to
accept ODRC’s proposal that “unauthorized” disclosure under Biddle
equates to “intentional” disclosure. Ultimately, however, considering the
matter as one of first impression, we find that under the circumstances
outlined in the facts given above, supervised inmate access to trash
containing unshredded medical documents does not constitute “disclosure”
for purposes of the tort of unauthorized disclosure of medical information as
defined by Biddle. * * *
Without precluding that an inadvertent disclosure might, under
different facts, fulfill the elements of Biddle, the present case does not.
Scott at ¶¶ 29-30.
-24-
{¶ 33} Here, at best, the plaintiffs’ claim against KHN is predicated upon KHN’s
alleged failure to earlier detect Sheldon’s intentional, unauthorized access through
procedures required by HIPAA. Consistent with Scott, we determine that the facts alleged
do not constitute “disclosure” for purposes of a Biddle breach-of-confidentiality claim.
Therefore, we affirm the trial court’s dismissal of the claims albeit as a result of a
somewhat different analysis.
{¶ 34} Despite preemption and the lack of a private right of action, we are aware of
three states that have expressed approval of the use of HIPAA regulations as a standard
of care. Byrne v. Avery Center for Obstetrics and Gynecology, P.C., 314 Conn. 433, 102
A.3d 32 (2014), R. K. v. St. Mary’s Med. Ctr., Inc., 229 W. Va. 712, 735 S.E.2d 715 (W.
Va. 2012), and Acosta v. Byrum, 180 N.C. App. 562, 568, 638 S.E.2d 246 (N.C. Ct. App.
2006). However, each is dependent on the nuances of applicable state law, the claims
pursued, and the unique facts presented. In Byrne, the court analyzed state law claims of
negligence and negligent infliction of emotional distress resulting from production of
records in response to a subpoena without notifying the patient which, for non-judicial
subpoenas, is required by HIPAA. The court stated “HIPAA may inform the applicable
standard of care in certain circumstances.” Id. at 435. We perceive the issue in Byrne to
be more of whether the release was “authorized” not whether the defendant was
responsible for its disclosure. In R.K., plaintiff’s various state negligent, intentional
conduct, and breach of confidentiality claims were asserted without specific HIPAA
labeling against a hospital whose employees accessed plaintiff’s psychiatric records and
disclosed information to his estranged wife. Although reference was made with approval
to other cases which addressed use of HIPAA as a standard of care, the holding was “we
-25-
now hold that common-law tort claims based upon the wrongful disclosure of medical or
personal health information are not preempted by [HIPAA].” Id. at 724. In Acosta a
physician gave a subordinate his medical access code, which would be contrary to
HIPAA. The subordinate retrieved the plaintiff’s psychiatric records. The plaintiff brought
claims for invasion of privacy and for intentional and negligent infliction of emotional
distress alleging the sharing of the access code violated regulations of “University Health
Systems, Roanoke Chowan Hospital, and [HIPAA].” The Acosta court determined plaintiff
sufficiently pled causes of action separately from the HIPAA violation, although it also
concluded that plaintiff did not bring a HIPAA claim but that HIPAA was only applicable as
“evidence of a the duty of care owed by Dr. Faber.” To the extent that these cases from
other jurisdictions are not binding or that they are distinguishable we choose not to follow
them.
{¶ 35} The first assignment of error is overruled.
{¶ 36} In an alternative argument, KHN maintains that several of the plaintiffs’
claims were subject to dismissal because they were not adequately pled. This argument
pertains to the claims against KHN for invasion of privacy, negligent training, negligent
supervision, and intentional infliction of emotional distress. Although KHN raised this
argument below, the trial court had no occasion to address it upon finding the claims
subject to dismissal on HIPAA-based grounds. Although we have determined that
plaintiffs have failed to state a breach of privacy claim, and that the other claims are
consolidated therein, including perhaps all these claims subject to alternative arguments,
we recognize the import of our holding and therefore address whether the referenced
-26-
causes of action, if separate, were adequately pled to survive Civ.R. 12(B)(6) dismissal.8
{¶ 37} With regard to the claims against KHN for invasion of privacy, negligent
training, negligent supervision, and intentional infliction of emotional distress, KHN
argues:
The common elements among each of these causes of action
require that KHN must have acted intentionally or failed to act with
knowledge of the underlying tortfeasors’ actions. Plaintiffs-Appellants’
Complaint is void of any allegation that KHN acted intentionally to cause
Plaintiffs-Appellants harm or that KHN knew that certain employees were
accessing medical information without authorization and failed to act. As
stated above, Plaintiffs-Appellants’ tort allegations against KHN are based
upon KHN’s alleged failure to run certain “CLARITY” reports with sufficient
frequency. Even assuming that KHN was required to run these reports with
the frequency alleged by Plaintiffs-Appellants and that KHN failed to do so,
that does not demonstrate that KHN acted intentionally nor does it
demonstrate that KHN knew its employees were accessing medical
information without authorization.
(Appellee’s brief at 17).
{¶ 38} Upon review, we agree with KHN that two of the causes of action at issue,
8
Ordinarily, we might be inclined to allow the trial court to address an unresolved issue in
the first instance if we were to remand. We need not do so, however, with regard to KHN’s
argument about the adequacy of the plaintiffs’ pleading. That issue, which was raised by
KHN but not addressed by the trial court below, involves a question of law that we review
de novo. Jones v. Xenia, 2d Dist. Greene No. 2011 CA 27, 2011-Ohio-5545, ¶ 9. That
being so, we see no purpose in remanding for the trial court to opine on the issue.
-27-
namely invasion of privacy and intentional infliction of emotional distress, fail to state a
claim upon which relief can be granted because they do not allege KHN acted
intentionally. The plaintiffs’ brief makes clear that they are alleging “wrongful intrusion”
invasion of privacy. 9 This theory requires proof of an intentional intrusion upon the
solitude or seclusion of another or his private affairs or concerns. King v. Cashland, Inc.,
2d Dist. Montgomery No. 18208, 2000 WL 1232768, *3 (Sept. 1, 2000); Havens-Tobias v.
Eagle, 2d Dist. Montgomery No. 19562, 2003-Ohio-1561, ¶ 26.10 The plaintiffs’ complaint
alleges no such intentional intrusion on the part of KHN. Rather, it alleges that KHN
negligently failed to protect the privacy of the plaintiffs’ electronic medical information by
not taking reasonable steps to protect the information by running and monitoring
CLARITY reports. Although the complaint does allege intentional intrusions by defendant
Duane Sheldon, we determined above that the nature of his conduct precludes
respondeat-superior liability.
{¶ 39} We reach the same conclusion with regard to intentional infliction of
emotional distress, which requires a showing that the actor intended to cause emotional
distress or knew, or should have known, that his actions would result in severe emotional
9
The Ohio Supreme Court has recognized four types of invasion-of-privacy claims: (1)
unwarranted appropriation or exploitation of one’s personality, (2) publicizing of one’s
private affairs, (3) wrongful intrusion into one’s private activities, and (4) false-light
invasion of privacy. Welling v. Weinfeld, 113 Ohio St. 3d 464, 2007-Ohio-2451, 866
N.E.2d 1051.
10
We recognize that in Prince v. St. Francis-St. George Hosp., Inc., 20 Ohio App. 3d 4,
484 N.E.2d 265 (1st Dist.1985), the First District opined that invasion of privacy may be
supported by negligent as well as intentional acts where a physician improperly mailed a
medical-claim form containing a confidential diagnosis for Mrs. Prince to a co-worker of
her husband. Invasion of privacy could exist “whether [the physician’s] potential ultimate
liability is predicated on his intentional acts (preparing and mailing the telltale material), or
upon the negligence of those acts.” Id. at 7.
 -28-
distress. Ratcliff v. Seitz, 2d Dist. Miami No. 2014-CA-9, 2014-Ohio-4412, ¶ 47 (citing
cases). Here we fail to see how the plaintiffs can prove a set of facts establishing KHN’s
intentional infliction of emotional distress based on KHN’s allegedly negligent failure to
run and monitor CLARITY reports. Once again, although Duane Sheldon allegedly acted
intentionally, the facts in the complaint do not support respondeat-superior liability.
{¶ 40} The trial court also did not err in refusing to allow the plaintiffs to amend their
complaint concerning their claims for invasion of privacy and intentional infliction of
emotional distress. If these claims are subsumed into the breach of confidentiality claim,
as we have held, then amendment would not change their consolidation and would not
change viability. Moreover, having reviewed the plaintiffs’ proposed amended complaint,
we note that it did not remedy the lack of allegedly intentional misconduct on the part of
KHN. Therefore, the proposed amendment would have been futile with respect to the
claims for invasion of privacy and intentional infliction of emotional distress. See Cruz v.
Kettering Health Network, 2d Dist. Montgomery No. 24465, 2012-Ohio-24, ¶ 34
(recognizing that leave to amend a complaint may be denied when the proposed
amendment would be futile).
{¶ 41} We reach a similar result concerning the plaintiffs’ claims for negligent
training and negligent supervision. The elements of a negligent supervision claim
essentially are the same as those required to prove negligent hiring. Browning v. Ohio
State Hwy. Patrol, 151 Ohio App. 3d 798, 2003-Ohio-1108, 786 N.E.2d 94, ¶ 67 (10th
Dist.). Likewise, other courts have recognized that the elements of negligent training are
also the same. Ford v. Brooks, 10th Dist. Franklin No. 11AP-664, 2012-Ohio-943, ¶ 22,
citing Jarvis v. Securitas Sec. Servs. USA, Inc., D.Md. No. 11–cv–00654–AW (Feb. 16,
-29-
2012). They are: “(1) the existence of an employment relationship; (2) the employee’s
incompetence; (3) the employer’s actual or constructive knowledge of such
incompetence; (4) the employee’s act or omission causing the plaintiff’s injuries; and (5)
the employer’s negligence in hiring or retaining [or training or supervising] the employee
as the proximate cause of plaintiff’s injuries.” Evans v. Ohio State Univ., 112 Ohio App. 3d
724, 739, 680 N.E.2d 161 (10th Dist. 1996).
{¶ 42} KHN correctly notes that these claims require proof that it had actual or
constructive knowledge of Duane Sheldon’s incompetent behavior. The relevant behavior
here involved his allegedly unauthorized and improper accessing and sharing of the
plaintiffs’ electronic health information. Nothing in the complaint suggests that KHN had
actual knowledge of this behavior. The complaint alleges the manner in which KHN could
be deemed to have constructive knowledge of Sheldon’s access and that is to monitor the
EPIC system CLARITY reports to comply with HIPAA security rules. We agree with the
trial court that the manner alleged in the complaint for KHN to have discovered Sheldon’s
unauthorized access is definitively HIPAA-based. Because we believe allowing such a
claim to proceed effectively would allow a private action for damages predicated on
HIPAA requirements, recovery based on that part of the complaint is prohibited. We have
not found, and the plaintiffs have not cited, an Ohio case supporting a cause of action
based on negligent failure to follow HIPAA regulations. We conclude that the trial court
correctly dismissed these claims.
{¶ 43} We again acknowledge that the plaintiffs moved to amend their complaint,
but the proposed amendments would not have cured the fatal deficiencies. The proposed
amended complaint retained virtually every allegation found in the original, including the
-30-
allegations that KHN was negligent in failing adequately to monitor the CLARITY reports
from the EPIC system as required by HIPAA. The only proposed changes of substance
that could relate to the negligent training or supervision claims are the addition of the
following allegations:
9. Although it is not mandated that the EPIC system be used by any
controlling authority, it is clear that the standard of care established by
HIPAA is that a health entity must take reasonable and prudent steps to
safeguard patient information.
10. Complete and apart from any standard of care, KHN has a common law
duty to safeguard patient confidential health information.
***
12. Defendant KHN, complete and apart from its duty of care established by
HIPAA, failed to take reasonable care to safeguard patient health
information.
***
49. In asserting the above common law claims, Plaintiffs disclaim any
attempt at enforcing “HIPAA”. They do not seek civil or criminal penalties
against KHN for “HIPAA violations”; rather they seek common law remedies
to themselves for damages, as contained in the prayer for relief.
{¶ 44} Paragraphs 9 and 10 allege only the existence of a common-law duty to
protect patient health information. That is not in dispute. Paragraph 12 merely alleges, in
conclusory fashion, that KHN was negligent. But the only factual allegations to support
that bare conclusion are all the factual allegations about Duane Sheldon’s intrusion and
-31-
the HIPAA-induced monitoring KHN allegedly should have done to detect his access.
Those factual assertions remain intact in the proposed amended complaint. Finally,
paragraph 49 is no more than an attempt by the plaintiffs to distance themselves from
what they now recognize is a prohibited HIPAA claim when the bulk of their factual
assertions—most importantly with regard to the HIPAA obligations related to monitoring
the EPIC CLARITY reports to discover Sheldon’s intrusion—remain unchanged. We
reiterate that the proposed amended complaint would not cure the infirmities we have
addressed.
{¶ 45} Based on the reasoning set forth above the assignments of error are
overruled and the trial court’s judgment is affirmed.
.............
DONOVAN, J., and WELBAUM, J., concur.
Copies mailed to:
Robert F. Croskery
Doreen Canton
Evan T. Priestle
J. Steven Justice
Glen McMurry
Hon. Timothy N. O’Connell