Indiana HIPAA Privacy Breach Award of $1.44M Upheld

by | Nov 15, 2014

An appeal against the $1.44 million award for damages by Walgreen Co. has been lost. The group was  it was ordered to pay the fine after a HIPAA Privacy Rule breach lead to confidential patient PHI being shared with unauthorized people.

This is the first time that the action of an staff member has resulted in a healthcare provider being held liable for a violation of the Health Insurance Portability and Accountability Act. The Indiana appellate court ruling could well set a legal precedent in cases where employees have violated HIPAA regulations and sensitive patient data has been given to  third parties.

In July 2013, a Marion Superior Court jury awarded $1.44M in damages to Abigail Hinchy after a Walgreen pharmacist publicly shared PHI with a third party about a client who had dated her husband.

A pharmacist at Walgreens at 6269 W. 38th St. in Indianapolis improperly accessed Hinchy’s prescription records. Hinchy had once dated her husband and had his child and the pharmacist knowingly accessed her prescription history and personal information and shared that information. The pharmacist’s husband was given Abigail’s PHI and he threatened to use that data in a paternity case. He also subsequently shared the information he had gained with a minimum of three other people.

When Abigail Hinchy was later told of what had happened and she made a complaint to Walgreen. They spoke to the pharmacist who came clean about accessing the files for personal reasons and she received a written warning for unethical actions and was made to attend a training program on HIPAA rules and regulations.

The court unanimously ruled that the pharmacist had breached “one of her most sacred duties by viewing the prescription records of a customer and divulging the information she learned from those records to the client’s ex-boyfriend.” The jury ruled that Walgreen Co. was liable.

Walgreen Co. has paid the damages although the funds are being held by the courts pending the result of the appeals process. They will not be handed over until the case has been finally resolved.

The appellate judges heard the appeal in which Walgreen argued that the court should have released it from liability, however the previous court ruling was upheld and unanimously agreed that “the trial court properly permitted the jury to consider Walgreen’s liability.” Walgreen Co. has the right to appeal and will be exercising it.

Legal experts are debating the implications of the ruling. The ruling could well set a legal precedent and the case may well be cited in future lawsuits where staff members have violated HIPAA regulations; even if the employer has not as there is vicarious liability on the part of the employer.

In the appeal, Walgreen Co. should concentrate on the extent to which they can be held liable for the actions of a staff member when the company had not acted in a negligent manner.

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy