$1.44M HIPAA award upheld after Walgreen pharmacist shared patient data

By Tim Evans for INDYSTAR

The Indiana Court of Appeals on Friday upheld a $1.4 million verdict against Walgreen Co. and one of its pharmacists who shared confidential medical information about a client that had once dated her husband.

The order is the first published appellate court decision in the nation in which a health-care provider has been held liable for violations of the Health Insurance Portability and Accountability Act committed by an employee, according to Indianapolis attorney Neal F. Eggeson Jr., who represented the victim.

Eggeson and other legal experts said the order creates an important legal precedent that could be cited in future lawsuits — and inform other rulings — regarding HIPAA violations in Indiana and other states.

“By choosing to appeal,” Eggeson said, “Walgreen has now created a precedent … confirming that privacy breach victims may hold employers accountable for the HIPAA violations of their employees.”

A Walgreen spokesman said the company disagrees with the ruling and plans to appeal.

Regardless of the outcome of that appeal, Friday’s ruling sends a strong message to heath-care providers and patients, said David Orentlicher, co-director of the William S. and Christine S. Hall Center for Law and Health at the Indiana University Robert H. McKinney School of Law in Indianapolis.

“The court makes it clear that the issue of confidentiality will be taken seriously,” he explained. “It is an important message for doctors, health-care providers and patients to know.”

Orentlich said confidentiality is an important part of health care.

If patients don’t feel confident their sensitive — and sometimes potentially stigmatizing — medical information will be kept confidential, Orentlicher said they may not seek the treatment they need.

A Walgreen spokesman said the company takes “seriously our responsibility to safeguard the privacy of medical records in our possession.”

“The pharmacist in this case admitted she was aware of our strict privacy policy and knew she was violating it,” James W. Graham said in a statement from Walgreen. “We believe it is a misapplication of the law to hold an employer liable for the actions of one employee who knowingly violates company policy. We intend to appeal the ruling.”

Friday’s decision came after Walgreen asked the Court of Appeals to throw out a July 2013 verdict by a Marion Superior Court jury that awarded Abigail Hinchy $1.44 million in damages for the pharmacist’s violation of HIPAA’s patient privacy provisions.

In the unanimous decision written by Court of Appeals Judge John Baker, the three-member panel noted pharmacist Audra Withers violated “one of her most sacred duties by viewing the prescription records of a customer and divulging the information she learned from those records to the client’s ex-boyfriend.”

In its appeal, Walgreen argue the trial court erred when it did not release Walgreen from liability for the unauthorized actions of Withers. But the appellate judges disagreed, finding “the trial court properly permitted the jury to consider Walgreen’s liability.”

Orentlicher said the issue of “vicarious liability” on the part of an employer such as Walgreen is likely to be at the heart of the pharmacy giant’s expected appeal to the Indiana Supreme Court.

“The question is: How strict is that liability if the employer was not negligent?” he said. “Sometimes courts do hold employers accountable, even if the employer didn’t do anything wrong, due to the employer’s relationship with the wrong-doer.”

The lawsuit originally filed in Marion Superior Court spun out of a tangled relationship between the pharmacist, her then-husband and Hinchy, who was the man’s ex-girlfriend.

The lawsuit alleged Withers, a pharmacist at the Walgreens at 6269 W. 38th St. in Indianapolis, improperly reviewed the prescription history of Hinchy, who lived in Crown Point, and divulged that confidential information. The pharmacist’s husband had previously fathered a child with Hinchy.

During the 2013 trial, evidence revealed that in 2010, Withers improperly reviewed Hinchy’s private health information, including her social security number, and then shared that information with her husband, who then shared the information with at least three other people. Court records show the husband threatened to use the medical information against Hinchy in a paternity lawsuit.

After learning that Withers had shared confidential medical information, Hinchy complained to Walgreen officials. When confronted by her employer, court documents show, the pharmacist “admitted that she had accessed Hinchy’s prescription files for personal reasons.”

Court records show Withers received a written warning for her unethical actions and was required to retake a computer training program regarding HIPAA rules.

Walgreen has paid the $1.44 million judgment into a court account, but Hinchy’s attorney said it is being held by the court until the case is finally resolved.

“She is more than a little relieved,” Eggeson said, “to see some light at the end of this tunnel after so many years.”