Indiana’s high court to consider privacy in ‘bizarre’ Community Health case

Who is responsible when a hospital sends a patient’s diagnosis to the wrong person and that person immediately posts the information on Facebook for hundreds to see?

It’s a real-life situation that led an Indianapolis woman to sue Community Health Network.

The case has made its way to the Indiana Supreme Court, which will hear arguments on Thursday. The high court’s decision could set new legal standards on liability in medical privacy cases.

The woman at the center of the case accuses the hospital of breach of duty, distributing private health information to unauthorized persons, and negligence in training and supervising employees.

Zakiyyah Darden claims that public disclosure of her medical information turned her life upside down. In court filings, she says her fiancé broke off their engagement after finding out about her diagnosis and kicked her out of his house. Her co-workers and supervisor at her warehouse job made comments, causing her to leave her job. She also lost several clients at her hairdressing business.

It’s unclear what her diagnosis or test results showed; that information has been redacted from court filings. The 2018 Facebook post has since been removed.

For three years, the case has advanced in fits and starts through the Indiana court system. At stake are damages potentially worth millions of dollars and additional scrutiny of how health providers protect patient information.

Community Health declined to comment to IBJ. But in court filings, the Indianapolis-based hospital system argued that, although its employee “inadvertently” mailed a letter containing Darden’s health information to a third party, that third party’s posting of the letter on Facebook was an “unforeseeable, criminal act that breaks the chain of proximate causation and absolves Community of liability.”

The case is also sure to grab public attention in an age of growing concern over medical privacy and the possibility of strangers getting a hold of sensitive health information.

“We all understand how traumatizing it would be to have your deepest, darkest secrets bandied about as fodder for gossip by people who may not like you,” said Neal Eggeson, an Indianapolis attorney who specializes in medical privacy and is representing Darden in her suit against Community. “We aren’t talking about frivolous lawsuits here. We’re talking about real harms that you and I and everyone can really understand.”

Darden declined an interview with IBJ.

A wide range of groups—including the Indiana Hospital Association, the Indiana Legal Foundation and the Defense Trial Counsel of Indiana—is watching closely to see how the court rules.

And some outside legal observers around the country have taken notice and weighed in.

“The facts in this case are so bizarre and outrageous that I had to read them several times,” Eric Goldman, a law professor at Santa Clara University in California, blogged. “I cannot imagine the hospital will let a jury decide this case. If I were on that jury, I would be outraged.”

‘So bizarrely specific’

Although the legal issues are complex, the facts seem straightforward. On Sept. 30, 2018, Darden underwent an examination and medical testing in the emergency department of Community Hospital East for an undisclosed condition.

Afterward, hospital workers were unable to contact her by telephone to notify her of her test results. So, five days after Darden’s visit to the hospital, the emergency department’s patient resource coordinator wrote a letter to her that was printed on Community letterhead that included her diagnosis and suggested treatment.

For reasons that remain unclear, the letter was placed in an envelope and hand-addressed to a third party, a Warren Central High School student who was a classmate of Darden’s daughter.

According to multiple court documents, the teenager received the envelope in the mail, opened it and posted an image of the letter on Facebook—including Darden’s clearly visible name—where it was seen by multiple people, including Darden’s daughter. Darden actually learned about her diagnosis from her daughter and paid the student $100 to obtain the letter, which was removed from Facebook.

In its court filings, Community did not say why the employee sent the letter to a classmate of Darden’s daughter.

Eggeson, Darden’s lawyer, said he doubts it was a random accident.

“It seems almost impossible, statistically, that this was an accident,” Eggeson told IBJ. “It’s a hand-addressed envelope. It goes to a completely unrelated teenager with a different name. But that teenager happens to be a classmate of the patient’s daughter. I mean, it’s so bizarrely specific that it sort of smacks of intentional, but if it’s intentional, we sure don’t know why.”

He said he hasn’t interviewed the hospital worker who addressed the envelope. Nor does he plan to file a tort complaint against the then-student who posted the private medical information on social media.

The lawsuit does not address why the student posted the information publicly.

Suit filed

In January 2020, Darden filed a complaint in Marion Superior Court against Community Health alleging that its employee distributed her “extremely sensitive and private health information” to an unauthorized person and the general public, and as a result, she “suffered extensive injuries.”

“My reputation was ruined all around,” Darden said in later court filings. “My children got made fun of at school because their friends saw the Facebook post. It’s hard to describe where it starts and stops. The mental, psychological and emotional problems were deep and painful.”

She asked for damages for loss of privacy, lost income, rent expenses, and emotional and mental distress.

Community Health responded by filing a motion to dismiss the case. When that was denied, the health care system filed a motion for summary judgment, asking the judge to rule in its favor without a full trial. Community maintained that it wasn’t liable for Darden’s injuries. The teenager who posted the information—not Community—“caused plaintiff’s purported injuries, thereby negating the element of causation,” the hospital system wrote in its motion.

It added that, with respect to Darden’s claim that Community was negligent in training and supervising its employees, there was no evidence the employee acted outside the scope of her employment, which it said was the legal standard.

“At best, a Community employee inadvertently mailed the letter to the wrong person,” Community’s motion said. “In doing so, she was clearly acting within the scope of her employment.”

Community added that Darden could not recover emotional-distress damages under a so-called negligence argument and that any claim for public disclosure of private facts was invalid because that was not recognized under Indiana law.

Foreseeable?

On March 22, 2022, Marion Superior Judge Marc T. Rothenberg granted Community’s motion for summary judgment, finding that, because Darden did not suffer a physical injury or a direct impact—but, rather, only mental or emotional distress—Community was not liable for negligence.

He added there was no evidence that Community expected the letter to be widely shared on social media and that its actions were not the proximate cause of Darden’s damage.

“The court finds, as a matter of law, the injury claimed was not foreseeable under the circumstances,” he wrote. “The court also finds, as a matter of law, that imposing liability on Community for [the teenager’s] alleged actions would not be justified.”

Eggeson appealed the case to the Indiana Court of Appeals, saying his client was entitled to state her case to a jury. In a 46-page motion, he argued that the trial court’s decision unfairly meant that victims of medical-privacy breaches have no recourse under Indiana law.

He also asked whether it was reasonably foreseeable that a teenager might share “juicy, inflammatory medical information” about a classmate’s mother on Facebook.

“Community set in motion the chain of events that resulted in the widespread dissemination of Ms. Darden’s health information,” he wrote. “If Community wishes to blame someone else for that dissemination, it is welcome to make that argument to the jury. For the trial court to seize that decision for itself is a bridge too far.”

Like many litigators, Eggeson likes presenting his cases to juries—and he has a track record of winning some big privacy cases.

In 2010, a Monroe County jury awarded one of Eggeson’s clients $1.25 million after determining that a Bloomington health care provider, IMA Inc., improperly passed along information to a collections firm that the patient was HIV-positive. The firm then included that information in court documents, including the patient’s full name, home address, date of birth and Social Security number.

And in 2014, a Marion County jury awarded another client $1.4 million after finding that pharmacy giant Walgreens was liable for a pharmacist’s unauthorized breach of private prescription data. The client later learned the information had been provided to the father of her child.

Weighing in

Shortly after Eggeson filed his appeal, the Indiana Supreme Court issued a ruling in a separate case (also involving Community Health) that found a hospital is not liable when one of its ex-employees compromises confidential health records of several former patients and another former employee in a family feud.

The Supreme Court said that emotional-distress damages are recoverable only if the plaintiff suffered a physical impact (the so-called “modified-impact rule”) or if the plaintiff observed a loved one’s death or serious injury through negligence (the so-called “bystander rule”).

The Appeals Court took note of that and said in a ruling issued last fall that Darden did not suffer a physical impact or perceive a physical injury to a loved one. The Appeals Court ruled that Darden may not recover emotional-distress damages for neglect and upheld the trial judge’s ruling on that issue.

But the Appeals Court ruled that Darden was entitled to a trial on her claims for monetary damages resulting from Community’s alleged negligence.

And in an unusual addition, the Appeals Court wrote in a footnote: “We respectfully urge our Supreme Court to revisit the modified impact rule and the bystander rule and the rationale for their continued existence. If we trust jurors to determine whether criminal defendants should live or die in death penalty cases and to fairly assess plaintiffs’ emotional distress damages in defamation cases, then surely we may trust them to fairly assess plaintiffs’ emotional distress damages in cases involving breaches of medical privacy.”

Several influential groups weighed in—some urging the Indiana Supreme Court to take the case and others in opposition.

The Indiana Hospital Association filed a brief last November, in support of Darden’s appeal. It said the state’s health care providers wanted clear guidance over potential torts arising from public disclosure of private facts. It added that hospitals should not be held liable “for the limitless and intervening conduct of unrelated parties over which they have no control.”

The Defense Trial Counsel of Indiana, an association of Indiana lawyers who defend clients in civil litigation, asked the Supreme Court not to take the case, saying that eliminating the modified-impact rule would expose all kinds of entities that handle private information to liability for “the unforeseeable actions of unrelated individuals.”

The not-for-profit Indiana Legal Foundation also opposed the case being taken up by the Supreme Court. It argued, in a motion, it wanted to ensure that Hoosier businesses and governmental entities are not subjected to “unlimited, uncapped emotional distress damages” that are subject to abuse and incapable of being predicted or budgeted.

In a three-sentence order on May 4, the Indiana Supreme Court agreed to take Darden’s case. Oral arguments are set for Thursday.•