Most law firms don’t publish stories about cases they lost. We’re publishing this one anyway, because the loss says something about where Indiana privacy law stands right now. We also believe the patients we represented deserved better than what the law currently allows.
What Happened: Privacy Violations by a Physician
An employee at a hospital met women socially, then went back to work and looked up their medical records and personal information, despite having no professional reason to do so.
When the hospital was notified of suspicious behavior — both by a former patient and by the hospital’s monitoring software — they marked the suspicious accesses as false positives.
The Legal Problem: Indiana’s Privacy Law Wasn’t Built for Electronic Records
This seems like a clear violation of privacy. But here’s where the case got complicated, and where it exposed something bigger than one physician’s conduct.
Indiana law recognizes a claim for intrusion into someone’s private affairs, but only if the intrusion is physical. If someone breaks into your home and goes through a paper file, that’s actionable. If a hospital employee scrolls through the same information in an electronic chart, Indiana’s current legal standard says that’s not a physical intrusion, so it doesn’t qualify for that claim at all.
That rule traces to a 1991 Indiana Supreme Court opinion, decades before electronic health records existed. This opinion says:
“When the invasion of a plaintiff’s right to privacy takes the form of intrusion, it consists of an intrusion upon the plaintiff’s physical solitude or seclusion as by invading his home or conducting an illegal search.”
There were two ways to read that sentence: as a rule limiting all intrusion claims to physical intrusions, or as language specific to the facts of that one case. Indiana courts have consistently read it as the former, which they did in our case, as well. Indiana is currently the only state in the country with this rule.
Ladendorf Fregiatio & Bigler alongside Eggeson Privacy Law appealed our case on this exact issue, arguing the law should either return to its earlier, broader form or expand to cover electronically stored private information. The Indiana Court of Appeals acknowledged the strength of the argument, but declined to be the court to change it:
“The Plaintiffs offer persuasive arguments for recognizing the tort of intrusion into emotional solace. Neither the Restatement (Second) of Torts nor Prosser and Keeton on Torts limits intrusion to physical invasions. Even still, for two reasons, we believe that any recognition of this tort in Indiana must come from our Supreme Court or the legislature.”
We petitioned the Indiana Supreme Court to take the case and settle the question. The Court declined to hear it, which leaves the physical-intrusion rule in place for now.
Where The Case Stands Now
With the primary intrusion claim foreclosed, and negligence claims against the hospital dismissed before trial because of Indiana’s laws around compensation for emotional distress, what remained were claims for intentional or reckless infliction of emotional distress and whether the hospital could be held vicariously liable for the physician’s conduct. We pursued these claims, but the jury came back in favor of the hospital. The case is now on appeal for a second time.
Why We Took the Case Anyway
We knew going in that Indiana law wasn’t built to protect what happened to our clients. We took the case because a legal standard written in 1991, for a world without electronic health records, shouldn’t be the reason 46 people’s privacy violations go unaddressed. We still believe that and are still arguing it.
If your medical records were accessed or shared without your permission, the law in this area is more complicated than it should be, but you still have options.
Learn more about medical privacy violations here, and if you’ve been a victim of privacy invasions, reach out today for a free consultation.