Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

As previously <a href="https://www.dataprivacymonitor.com/hipaahitech/hipaa-violation-results-in-144-million-jury-verdict-against-walgreens-pharmacist/">reported</a>, an Indiana jury awarded $1.44 million to a Walgreens customer based on allegations that the customer’s pharmacist accessed, reviewed and shared the customer’s prescription history with others who then used the information to intimidate and harass the customer. The facts of the case involved a love triangle between the pharmacist, her husband and her husband’s ex-girlfriend. When the pharmacist learned that ex-girlfriend gave birth to a child fathered by her husband, the pharmacist allegedly accessed the ex-girlfriend’s prescription information and shared the information with her husband, who then used the information to intimidate the ex-girlfriend when she began demanding child support payments. In response to the incident, Walgreens gave the pharmacist a written warning and required her to take additional HIPAA training. 

Walgreens subsequently appealed the jury’s verdict, arguing for reversal on several grounds, including (1) that the court erred in denying summary judgment to Walgreens because the pharmacist acted beyond the scope of her employment; and (2) that the verdict amount was excessive and unsupported because the customer did not suffer a resulting physical injury, the customer had no lost wages as a result of the incident and the customer did not offer testimony from a medical professional in support of her claim of emotional distress. 

The Indiana Court of Appeals rejected the arguments put forward by Walgreens. In regard to the question of scope of employment, the court affirmed that the determination of whether specific actions were “of the same general nature as those authorized, or incidental to the actions that were authorized,” is a question of fact for the jury. In this case, because Walgreens authorized the pharmacist to use its computer system, handle customer requests for prescriptions, and look up and print out customer information on its system, it was not an error to determine that the pharmacist’s actions in this case were within the scope of her employment. According to the court, “much of [the pharmacist’s] conduct was of the same general nature as her ordinary job duties, and much of her conduct was of the same general nature authorized by her employer.” In regard to the question of excessiveness of the verdict, the court viewed Walgreens’ arguments as “a request that we reweigh the evidence,” which the court refused to do. Walgreens has stated its intention to continue its appeal to the next level. 

This is the first known decision by a court of appeals approving a jury verdict based upon a violation of HIPAA by a pharmacist or any other health professional. The decision is consistent with the growing trend in <a href="https://www.dataprivacymonitor.com/hipaahitech/connecticut-supreme-court-recognizes-right-to-sue-for-negligence-using-hipaa-as-standard-of-care/">courts nationwide</a> to hold employers liable under the common law for their employees’ violation of federal privacy law. The court’s broad definition of the scope of employment makes it more difficult for employers to avoid liability for employees’ violation of HIPAA. However, employers should maintain current policies reinforcing their employees’ obligations to maintain confidentiality of personal health information, including a policy regarding additional security measures for computers and a policy related to social media. Employers should also train their employees regularly regarding their legal obligations to protect personal health information. 

Additionally, this decision may support the need for employers to reinforce to their employees – from the office workers involved in billing to the pharmacists and doctors providing direct care – the severity of penalties for violating patient privacy laws. It’s always dangerous to speculate, but one must wonder what role Walgreens’ choice of discipline had upon the jury’s deliberation. Were a written warning and HIPAA training a sufficient response to a pharmacist’s intentional review and disclosure of highly sensitive sexual and reproductive health information? If employers are going to be held responsible for an employee’s intentional (and possibly criminal) breach of a patient’s confidentiality, employers need to ensure that they maintain consistent and sufficiently severe consequences for employees who engage in such behavior.

Pharmacists and Health Professionals Beware: Indiana Court of Appeals Upholds $1.44 Million Jury Verdict Resulting From HIPAA Violation