Dawn Marie Leach v. Iowa Board of Nursing

IN THE COURT OF APPEALS OF IOWA

No. 18-1705 Filed August 7, 2019

DAWN MARIE LEACH, Plaintiff-Appellant,

vs.

IOWA BOARD OF NURSING, Defendant-Appellee. ________________________________________________________________

Appeal from the Iowa District Court for Polk County, Michael D. Huppert, Judge.

A nurse appeals from the district court’s dismissal of her petition for judicial review challenging the Iowa Board of Nursing’s conclusion she violated the confidentiality or privacy rights of a patient and imposition of a citation and warning. AFFIRMED.

David L. Brown and Tyler R. Smith of Hansen, McClintock & Riley, Des Moines, for appellant.

Thomas J. Miller, Attorney General, and Tessa Register, Assistant Attorney General, for appellee.

Considered by Potterfield, P.J., and Doyle and Tabor, JJ.

2 POTTERFIELD, Presiding Judge.

Nurse Dawn Leach appeals from the district court’s dismissal of her petition for judicial review challenging the Iowa Board of Nursing’s conclusion she violated the confidentiality or privacy rights of a patient and imposition of a citation and warning. Leach maintains the district court erred in dismissing her petition for judicial review because the Board’s conclusion is “[b]ased upon an irrational, illogical, or wholly unjustifiable application of law to fact that has clearly been vested by a provision of law in the discretion of the agency,” Iowa Code § 17A.19(10)(m), and is “not supported by substantial evidence in the record before the court when that record is viewed as a whole,” Id. § 17A.19(10)(f).1 I. Background Facts and Proceedings.

Leach was employed by Unity Point Health Finley Hospital (Finley) to work as a nurse in the intensive care unit (ICU). On eleven dates during December 2015, Leach remotely accessed patient census lists while she was not working. The census lists contained private health information, such as patient names, ages, diagnosis, unit, diet order, medications, and primary insurer.

Finley learned of the access in January 2016 and questioned Leach about it. Leach admitted she accessed the lists, stating she did so in order to check ICU capacity to determine whether it was likely she would be required to work

1 As she did at the district court, Leach also includes a laundry list of other grounds she alleges requires reversal under Iowa Code section 17A.19(10). The district court concluded the other grounds were waived for lack of authority or argument supporting them. Insofar as the district court did not consider and rule upon the other grounds pursuant to section 17A.19(10), these claims have not been preserved for our review. See Garwick v. Iowa Dep’t of Transp., 611 N.W.2d 286, 288 (Iowa 2000) (finding an issue not preserved for review when the plaintiff failed to raise the issue with enough specificity to the district court on judicial review and noting, “[Plaintiff’s] allegation in his petition for judicial review is far too unspecific to preserve a . . . challenge”).

3 her assigned shifts.2 Leach was advised that checking the list was in violation the hospital’s information security policies that prevented remote access into the hospital’s system without authorization—which Leach did not have—and when not necessary to complete her job responsibilities. Finley issued Leach an employee disciplinary notice on January 20; she was suspended for two twelvehour shifts and required to repeat the HIPAA NetLearning module.

Leach’s supervisor filed a complaint with the Board, and, after an investigation, the Board found probable cause to file a notice of hearing and statement of charges against Leach. It was alleged Leach violated the confidentiality or privacy rights of the patient or client, in violation of Iowa Code section 147.55(3) (2015) and Iowa Administrative Code rule 655-4.6(4)(h).

A contested hearing took place in January 2018. The Board made the following finding of facts:

[Leach] accessed the patient lists for the sole purpose of determining the ICU’s census so she could determine whether she would [be] working her assigned shift the following day or placed on call. [She] did not use the information from the patient lists for any other purpose, and she did not share the information with anyone. [Leach] denies that she looked at any information other than the number of patients. .... . . . [Leach] was not authorized to access Finley patient lists from remote locations, and she did not need the patient list information in order to perform her duties as an ICU nurse at Finley.

2 According to the finding of facts made by the Board: The nurses’ work schedule was established in six week blocks and was published to the nurses at least two weeks prior. Nurses could also sign up to work an “as needed” shift. Four nurses were assigned to each shift, but the ICU also had a rotating “low census” list. If the patient census in the ICU was low, then the first person on the “low census” list would be put [on] call and would not have to work that shift. Nurses could call the charge nurse on the unit to find out if they would be needed for their assigned shift.

4 The Board found a preponderance of the evidence supported that Leach committed unethical conduct by violating the confidentiality or privacy rights of patients in accessing protected health information on the census lists without the need to do so. The Board imposed a citation and a warning as discipline.

Leach filed an application for rehearing with the Board, claiming the Board’s finding of a violation was “[u]nsupported by the evidence presented at the hearing” and “[i]nconsistent with the Board’s factual findings.” The Board denied the application, reiterating that accessing the protected health information without a legitimate or proper reason was sufficient to find Leach violated the confidentiality or privacy rights of the patient. Additionally, the Board stated it

fully considered the circumstances of the violation (i.e. that [Leach] did not understand that her actions violated patient confidentiality, that she did not disclose the information to anyone else, and that the hospital determined her actions were not a reportable HIPAA “breach”) when it chose to impose the least severe sanction—a citation and a warning.

Leach filed a petition for judicial review, urging the district court to reverse the Board’s ruling. She maintained that because the Board never made a finding she read or shared any of the protected health information contained on the census lists, the Board’s finding of a violation was irrational, illogical, or wholly unjustifiable. She also claimed there was not substantial evidence to find she viewed any protected health information.

The district court determined there was no real argument regarding substantial evidence “in light of the agreement of the parties as to the operative facts.” The court also found that the Board’s determination Leach had violated the rule was not irrational, illogical, or wholly unjustifiable, as “[t]he mere access

5 of the information is what constituted grounds for discipline; the viewing or examination of that information was not required.”

Leach appeals. II. Standard of Review.

“A court’s review of agency action is severely circumscribed. The administrative process presupposes that judgment calls are to be left to the agency.” Burns v. Bd. of Nursing, 495 N.W.2d 698, 699 (Iowa 1993). “Thus the court may reverse, modify, or grant other appropriate relief only if agency action is affected by error of law, is unsupported by substantial evidence in the record, or is characterized by abuse of discretion.” Id. III. Discussion.

Iowa Code section 147.55(3) allows the Board to discipline a licensed nurse “when the licensee is guilty of . . . engaging in unethical conduct or practice harmful or detrimental to the public. Proof of actual injury need not be established.” Iowa Code § 147.55(3). Iowa Administrative Code rule 655-4.6(4)(h) further defines behavior that “constitutes unethical conduct or practice harmful or detrimental to the public” and includes, “Violating the confidentiality or privacy rights of the patient or client.”

On judicial review, Leach emphasizes that the Board never made a finding she read any of the protected health information she accessed on the census lists and maintains there is not substantial evidence to make such a finding. See Iowa Code § 17A.19(10)(f). Additionally, she claims that concluding she violated the confidentiality or privacy rights of a patient without a finding she read the protected health information she accessed is irrational, illogical, or wholly

6 unjustifiable. See id. § 17A.19(10)(m). Leach’s claim boils down to an argument that accessing—without reading or sharing—of a patient’s protected health information is not sufficient conduct to find a violation of a patient’s confidentiality or privacy rights. She relies on this court’s ruling in Hoffman v. Iowa Bd. of Nursing, No. 05-1403, 2006 WL 2421643 (Iowa Ct. App. Aug. 23, 2006), to support her argument.

In Hoffman, the Board cited a nurse for violating patient confidentiality when she and her young children helped the doctor she worked for copy patient records in order for the doctor to take them to his new practice. 2006 WL 2421643, at *1. “Hoffman’s children, ages eleven and thirteen, assisted in the copying process by pressing the ‘start’ button on the copy machine and by monitoring the copying process to make sure only one page went through the machine at a time.” Id. The Board found Hoffman violated section 147.55(3) and rule 655-4.6(4)(h) “by allowing ‘her children to participate in copying confidential patient records’” and noted the “presence and participation of the children still violated patient confidentiality by giving them access to confidential information, including but not limited to the names of the patients.” Id. Our court reversed, stating:

The only persons to whom improper access to confidential records was even arguably given were the children. There is no finding by the agency that the children read any of the information contained within the medical records, or even the names on the files. They simply pressed the “start” button on the copy machine and were supervised throughout the process. The copying was done at the direction of Dr. Sterrett and the children were paid for their participation. Finding a violation of patient confidentiality under these facts is unreasonable, arbitrary, capricious, and an abuse of discretion

7 Id. at *2.

The two sets of facts are distinguishable. In Hoffman, our court questioned whether the children’s presence in the same room as and limited role in helping copy the paper files—pressing the start button and watching to ensure only one page went through the machine at a time—constituted “access” to patient records. Id. Here, Leach admits that she repeatedly accessed the census list, which contained numerous forms of protected health information. Leach denies reading the parts of the list containing the protected information, but she does not deny that she accessed the information and that the information was not necessary for her to complete her job duties. Accessing the unneeded confidential information is a violation of hospital policies put in place to protect patient confidentiality, which Leach knew or should have known about.

The Board is vested with rulemaking and interpretative authority. See Iowa Code § 147.76 (“The boards for the various professions shall adopt all necessary and proper rules to administer and interpret this chapter . . .”); see also Iowa Med. Soc’y v. Iowa Bd. of Nursing, 831 N.W.2d 826, 838 (Iowa 2013) (“The legislature has clearly vested the nursing board with rulemaking and interpretative authority . . . .”). Therefore, “[w]e are required to view the nursing board’s [application of law to fact] through the prism of our deferential standard of review.” Iowa Med., 831 N.W.2d at 840. In doing so, we cannot say the Board’s determination is irrational, illogical, or wholly unjustifiable when it found purposefully accessing confidential patient information that is not needed to perform one’s job duties—without further action—constitutes a violation of patient confidentiality rights.

We affirm the district court’s dismissal of Leach’s petition for judicial review.

AFFIRMED.