Recently, an Indiana jury awarded a plaintiff $1.8 million in damages after a Walgreens pharmacist inappropriately used her position to find and share the plaintiff’s protected health information (“PHI”). ^[1] As health care providers know, the Health Insurance Portability and Accountability Act (“HIPAA”) provides both civil and criminal penalties for improper disclosure of medical information but it does not create a state-based private cause of action for violation of its provisions. Thus, when someone’s PHI is inappropriately shared or disclosed by a health care provider, the individual does not have personal legal recourse against the offending party. The recent Indiana case (herein “Walgreens Co.”) illustrates, however, that HIPAA still has a significant role in state court suits alleging negligence and professional liability as it relates to confidentiality.

In Walgreens Co., the store’s pharmacist looked up the medical records of her husband’s ex-girlfriend, whom she suspected was responsible for passing a sexually transmitted disease to her husband. The pharmacist then relayed the PHI to her husband, who, in turn, confronted the ex-girlfriend about the newly-learned information. The ex-girlfriend filed suit against both the pharmacist and Walgreens in Indiana Superior Court claiming that Walgreen Co. owed a non-delegable duty to its customers to (1) protect the privacy and confidentiality of its customers’ pharmaceutical information and prescription history, and (2) properly train and supervise its employees in the protection of customer privacy and confidentiality. Plaintiff further alleged that by and through its employee, Walgreens breached its statutory and common law duties of confidentiality and privacy and, as a result, she suffered damages.

Walgreens Co. argued that the pharmacist’s actions were outside of her job duties and, because of this, the company should not be responsible for the breach. The Court granted a Summary Judgment Motion in Walgreens’ favor based on the negligent training claim, but the rest of the claims proceeded to trial.

It is important to understand how HIPAA was used in this case. The Plaintiff did not sue Walgreens Co. for violating HIPAA (as that is not permitted by the federal statute), but rather sued Walgreens Co. under state law for negligence, invasion of privacy, and breach of fiduciary duties, using HIPAA to establish the acceptable standard of care for privacy protection. The jury obviously appreciated the Plaintiff’s method of redress.

Whether and to what extent HIPAA can be used in state law actions varies state to state. Providers should be aware, however, that breaches of privacy and confidentiality may result in more than a slap on the wrist from private individuals. After all, individuals entrust health professionals to deliver services, including medical record keeping, within the standard of care.

_{[1] Hinchy v. Walgreen Co., et al., No. 49D06 11 08 CT029165 (Marion Co. Sup. Ct., Ind., filed August, 1, 2011).}