Is a pharmacy liable when an employee releases private health information about a patient?
Issue of The Case
A pharmacy clerk, estranged from her husband, uses her access to a patient’s health information available in the pharmacy records to obtain and release to her husband health information about this patient, his new girlfriend. Is there liability for the employer under the legal doctrine in use in this mid-Atlantic state known as respondeat superior? This doctrine states that an innocent employer who contributed in no way to the damages will be held vicariously liable for the acts of employees committed within the scope of their employment.
Facts of The Case
A patient at the pharmacy customarily used the drivethrough window for convenience in dropping off and picking up her medications. One of the clerks in the pharmacy was often assigned to serve those patients using the drive-through and this brought her in contact with the patient. The clerk had separated from her husband earlier in the year and her husband was seeing a woman who happened to use the drive-through window.
After meeting the patient and making the connection in her mind as to who she was, the clerk telephoned her husband and “insulted, defamed, and threatened to assault the patient.” It was also alleged that the clerk disclosed to her husband Health Insurance Portability and Accountability Act (HIPAA)-protected health information about the patient’s health conditions. Finally, when the clerk encountered the patient in a grocery store, she confronted her, leading to the arrest of the clerk.
The patient filed suit, naming as defendants both the clerk and the pharmacy chain that employed the clerk. In the action against the clerk, a variety of 5 legal theories leading to liability were advanced—battery, breach of confidentiality, invasion of privacy, intentional infliction of emotional distress, and negligent infliction of emotional distress. The claims against the pharmacy were 2-fold: first, that the pharmacy had failed in its duty to supervise the clerk because it failed to take steps to prevent the disclosure of HIPAA-protected confidential health information; and second, under the theory of respondeat superior, the employer should be held liable for acts of the employee who was acting within the scope of her employment.
The pharmacy chain presented the judge with a motion to dismiss both claims against it.
The Court’s Ruling
The court dismissed 1 claim but not the other. The argument about negligent supervision of the employee that led to disclosure of the protected health information survived to be heard at trial. The basis for the other claim, respondeat superior, was deemed inadequate and that was dismissed.
The Court’s Reasoning
The court reviewed the law of that state on the point about negligent supervision, concluding that the rule is this: “An employer is liable for negligent…supervision where the employer is negligent in giving improper or ambiguous orders or in failing to make proper regulations… or in the supervision of the employee’s activities.” Concluding that there was at least a possibility that the plaintiff might prevail on that point, the court refused to dismiss that claim.
However, turning to the patient’s second claim against the pharmacy, the court noted that for the doctrine of respondeat superior to apply to create liability for the employer, there must be a “tortuous act of an employee…performed within the scope of employment.” The crucial element here was the scope of employment. Delving further into that, the court described the law on point this way: “Conduct is within the scope of employment if it (I) is of the type the employee was hired to perform; (II) takes place within the authorized time and space limits; and (III) is at least partly motivated by a purpose to serve the employer.” Usually these are questions for the jury but occasionally judges will decide the matter if it is clear-cut.
The judge in this case concluded that the clerk’s actions were motivated by purely personal conflict between herself, her estranged husband, and his current girlfriend. Her actions had no connection with an attempt to serve the employer, so the judge ruled that the doctrine of respondeat superior was unavailable for the plaintiff to use against the pharmacy chain. Accordingly, the second claim was dismissed.
It should be noted that under the doctrine of respondeat superior, there can be liability for a totally innocent employer who in no way contributed to the damages being alleged. But in order for that legal theory to be available to be used in a lawsuit to reach the presumably greater assets of the employer, the employee must have acted within the scope of employment. That element of the doctrine was missing in this case. PT
Dr. Fink is professor of pharmacy law and policy at the University of Kentucky College of Pharmacy in Lexington, Kentucky.