An appeal against the $1.44 million award for damages by Walgreen Co. has been lost. The group was it was ordered to pay the fine after a HIPAA Privacy Rule breach lead to confidential patient PHI being shared with unauthorized people.
This is the first time that the action of an staff member has resulted in a healthcare provider being held liable for a violation of the Health Insurance Portability and Accountability Act. The Indiana appellate court ruling could well set a legal precedent in cases where employees have violated HIPAA regulations and sensitive patient data has been given to third parties.
In July 2013, a Marion Superior Court jury awarded $1.44M in damages to Abigail Hinchy after a Walgreen pharmacist publicly shared PHI with a third party about a client who had dated her husband.
A pharmacist at Walgreens at 6269 W. 38th St. in Indianapolis improperly accessed Hinchy’s prescription records. Hinchy had once dated her husband and had his child and the pharmacist knowingly accessed her prescription history and personal information and shared that information. The pharmacist’s husband was given Abigail’s PHI and he threatened to use that data in a paternity case. He also subsequently shared the information he had gained with a minimum of three other people.
When Abigail Hinchy was later told of what had happened and she made a complaint to Walgreen. They spoke to the pharmacist who came clean about accessing the files for personal reasons and she received a written warning for unethical actions and was made to attend a training program on HIPAA rules and regulations.
The court unanimously ruled that the pharmacist had breached “one of her most sacred duties by viewing the prescription records of a customer and divulging the information she learned from those records to the client’s ex-boyfriend.” The jury ruled that Walgreen Co. was liable.
Walgreen Co. has paid the damages although the funds are being held by the courts pending the result of the appeals process. They will not be handed over until the case has been finally resolved.
The appellate judges heard the appeal in which Walgreen argued that the court should have released it from liability, however the previous court ruling was upheld and unanimously agreed that “the trial court properly permitted the jury to consider Walgreen’s liability.” Walgreen Co. has the right to appeal and will be exercising it.
Legal experts are debating the implications of the ruling. The ruling could well set a legal precedent and the case may well be cited in future lawsuits where staff members have violated HIPAA regulations; even if the employer has not as there is vicarious liability on the part of the employer.
In the appeal, Walgreen Co. should concentrate on the extent to which they can be held liable for the actions of a staff member when the company had not acted in a negligent manner.
