Jane Doe v. Ashland Hospital Corporation

RENDERED: MARCH 18, 2022; 10:00 A.M. NOT TO BE PUBLISHED

Commonwealth of Kentucky Court of Appeals

NO. 2021-CA-0466-MR

JANE DOE APPELLANT

APPEAL FROM BOYD CIRCUIT COURT v. HONORABLE GEORGE W. DAVIS III, JUDGE ACTION NO. 20-CI-00971

ASHLAND HOSPITAL CORPORATION AND SHELLY JEAN DAVIS BAIER APPELLEES

OPINION AFFIRMING

** ** ** ** ** BEFORE: LAMBERT, MAZE, AND L. THOMPSON, JUDGES. MAZE, JUDGE: Jane Doe (Doe) appeals from an order of the Boyd Circuit Court dismissing her claims against Ashland Hospital Corporation, d/b/a King’s Daughters Medical Center (KDMC) and Shelly Jean Davis Baier (Baier). On appeal, Doe makes four arguments: 1) the trial court’s order dismissing should be reversed because there were sufficient facts presented as to the allegations of her

-1-amended complaint separate from HIPAA1 to survive dismissal; 2) the trial court should be reversed because there are other independent claims upon which relief could have been granted other than a direct HIPAA violation; 3) the trial court should be reversed as to Doe’s claim for invasion of privacy on the grounds that sufficient facts were presented in support of each element of that claim; and 4) the trial court should be reversed as to the dismissal of Doe’s remaining claims because relief may be granted as to those claims. The Court having found no reversible error in the Boyd Circuit Court’s order dismissing, we affirm.

As a minor, Doe was sexually assaulted by an adult male babysitter. He was convicted of that offense. At trial, his defense counsel put on evidence in the form of Doe’s medical records to demonstrate that there was no physical evidence of rape. Those records were not obtained by subpoena or search warrant.

Baier is the mother of Doe’s assailant. She is also an employee of KDMC. Doe was treated at that facility between April 13, 2018 and April 30, 2018. It has been alleged that Doe’s medical records from that period were procured by Baier and transmitted to her son’s defense counsel. An action was filed in the trial court in which Doe asserted causes of action for invasion of privacy, negligent hiring, training, retention and supervision, negligence, negligence per se, breach of fiduciary duty, gross negligence, breach of expressed

1 Health Insurance Portability and Accountability Act of 1996.

-2-or implied contract, identity theft, and intentional infliction of emotional distress. Both Baier and KDMC filed motions to dismiss and Doe responded.

On April 6, 2021, the trial court entered an order sustaining those motions dismissing Doe’s claims in their entirety. The trial court concluded that “Plaintiff’s claims are merely an attempt to strap Common Law claims onto the back of prohibited behavior under the Federal HIPPA [sic] statute.” The trial court found that, as a matter of law, HIPAA does not create a private cause of action. The trial court concluded that Doe’s claims were preempted by the application of HIPAA since the Kentucky common law claims pled did not provide for a more stringent standard than that set forth in HIPAA.

A motion to dismiss for failure to state a claim upon which relief may be granted is only appropriate where “it appears the pleading party would not be entitled to relief under any set of facts which could be proved[.]” Pari-Mutuel Clerk’s Union of Kentucky Local 541, SEIU, AFL-CIO v. Kentucky Jockey Club, 551 S.W.2d 801, 803 (Ky. 1977). As such, this Court’s review is de novo. Fox v. Grayson, 317 S.W.3d 1, 7 (Ky. 2010).

The trial court set forth two bases for its order dismissing. First, the trial court concluded that “HIPAA does not create a civil cause of action under state or federal law.” As noted in Caldwell v. Chauvin, 464 S.W.3d 139, 148 (Ky. 2015), the Secretary of the United States Department of Health and Human

-3-Services (HHS) was charged with promulgating privacy regulations to promote the purpose of HIPAA. 45 C.F.R.2 §§ 160-164 outlines the responsibility of a “covered entity” for an individual’s “protected health information.” In 45 C.F.R. § 160.306 an administrative remedy is set forth for any breach of that responsibility, providing for civil penalties against the “covered entity.” However, both state and federal courts have consistently held that there is no private cause of action for such conduct.

In Young v. Carran, 289 S.W.3d 586, 588-89 (Ky. App. 2008), the Court specifically held that there is no private cause of action for a violation of HIPAA under KRS3 446.070, the statute codifying “negligence per se.” Yeager v. Dickerson, 391 S.W.3d 388, 393 (Ky. App. 2013).

The second reason set forth in support of the trial court’s order is that “HIPAA preempts state law unless the state enacts more stringent measures.” 45 C.F.R. § 160.203 states that “[a] standard, requirement, or implementation specification adopted under this subchapter that is contrary to a provision of State law, preempts the provision of State law.” The rule then sets forth several exceptions including subsection (2)(b), which specifies that a provision is not preempted where it “relates to the privacy of individually identifiable health

2 Code of Federal Regulations. 3 Kentucky Revised Statutes.

-4-information and is more stringent than a standard, requirement, or implementation specification adopted under subpart E of part 164 of this subchapter.”

Doe has asserted three Kentucky statutes in support of her argument that the claims set forth in her amended complaint were not preempted by HIPAA and its associated regulations. However, the statutes in question, to the extent they may apply, are not “more stringent” than those imposed in support of HIPAA and its purposes. KRS 210.235 applies to mental health records maintained by the Cabinet for Health and Family Services. Although it contains a general prohibition on disclosure of such records, it also contains certain exceptions, including one for court proceedings. KRS 422.317 requires a licensed hospital to provide a patient with a free copy of his or her medical records upon request. KRS 422.315 grants that patient and any other person or entity acting on his or her behalf standing to apply for a protective order in a court proceeding where medical records have been “copied and delivered pursuant to KRS 422.300 to 422.330[.]” In Young, similar arguments were made on appeal regarding KRS 210.235 and KRS 422.317, but were not raised in the trial court and were therefore not considered on appeal. 289 S.W.3d 589. However, as provided in 902 KAR4 20:016(e), HIPAA supplies the standard to be applied to disclosure of protected health information by a covered

4 Kentucky Administrative Regulations.

-5-entity. As such, these Kentucky statutes may not be used as an independent basis to support Doe’s claims.

This Court holds that the trial court’s findings and conclusions are dispositive as to all of Appellant’s claims. However, since she has made additional arguments specifically addressing her claims for invasion of privacy and negligent hiring, we will address those briefly.

Even if her claim for invasion of privacy was not preempted, it was simply not pled as being anything other than a HIPAA violation. It appears that Appellant has pled that there was an unreasonable intrusion upon her seclusion and that the private information so obtained was publicly disclosed. McCall v. Courier-Journal and Louisville Times Co., 623 S.W.2d 882, 887 (Ky. 1981). However, she repeatedly alleged in her amended complaint that Baier procured and produced the information outside of her employment. As held in Osborne v. Payne, 31 S.W.3d 911, 915 (Ky. 2000), there can be no claim for respondeat superior liability where an employee engages in wrongful conduct while he or she is not acting to advance the cause of his or her employer. Thus, Appellant’s claim for invasion of privacy against KDMC cannot survive independently of the HIPAA violation.

Appellant contends that her claim that Baier was negligently hired, trained, supervised, and retained may survive separately from the HIPAA violation

-6-because KDMC did not have policies and procedures in place to protect a patient from this kind of disclosure. In support of that argument, she cites Doe v. St. Joseph Health System, No. 2017-CA-000794-MR, 2018 WL 6600230 (Ky. App. Dec. 14, 2018), in which the Court held that a separate claim for the employer’s own negligence in hiring may survive without respondeat superior liability. However, that case did not specifically address the issue of preemption.

In Section II of her amended complaint, Doe sets out her cause of action against KDMC for negligent hiring, training, retention, and supervision. She asserts that because of her “special relationship” to Baier and KDMC, the latter had a duty to not employ, retain, and/or train Baier because of her “dangerous propensities and violations of policy and obvious actions.” She also alleges that KDMC “knew or reasonably should have known” upon investigation of Baier prior to her employment. She states that KDMC also knew or should have known of her own vulnerability as a minor as well as a rape victim. She further asserts that she was “informed and believes” that KDMC had no “system or procedure” in place to “investigate supervise, monitor, or train to prevent the unauthorized” use of her medical records for “exploitation.” Doe also concludes that KDMC had been placed on notice by third parties that “Baier, had engaged in dangerous and inappropriate conduct both before and during her employment,” and therefore could be expected to do so again.

-7-

As argued by KDMC in its brief, “HIPAA preemption encompasses more than unauthorized disclosure of protected health information.” It also addresses such issues as the security of electronic information systems, required training for the employees of covered entities and the utilization of policies and procedures to provide HIPAA compliant system. 45 C.F.R. §§ 164.103-318. Moreover, that system is subject to oversight by the Secretary of Health and Human Services. 45 C.F.R. § 160.306. Thus, once again, the HIPAA standards are the more “stringent” and state law claims such as those presented herein are preempted.

Although the disclosure herein was undoubtedly reprehensible it is not actionable as a matter of law. While the Court finds the result of its ruling herein to be unfortunate, it is constrained to follow the law.

Accordingly, we affirm the order of the Boyd Circuit Court.

ALL CONCUR.

-8-

BRIEF FOR APPELLANT: BRIEF FOR APPELLEE ASHLAND HOSPITAL Brandon M. Music CORPORATION: Grayson, Kentucky W. Mitchell Hall, Jr. Olivia H. Gilkison Ashland, Kentucky

BRIEF FOR APPELLEE SHELLY JEAN DAVIS BAIER:

David F. Latherow Ashland, Kentucky

-9-