-1- 

### STATE OF MICHIGAN

COURT OF APPEALS

ANGELA RENEE WARE,

Plaintiff-Appellee, UNPUBLISHED November 4, 2014

V No. 307886
Kalamazoo Circuit Court BRONSON METHODIST HOSPITAL, LC No. 2010-000635-NZ

Defendant-Appellant,
and

PATRICIA MARIE WARK,

Defendant.

Before: R ONAYNE K RAUSE , P.J., and H OEKSTRA and W HITBECK , JJ.

R ONAYNE K RAUSE
, P.J. ( dissenting ).

Defendant Patricia Wark, a nurse employed by defendant Bronson Methodist Hospital, repeatedly accessed the confidential medi cal record of plaintiff Angela Renee Kratzer (formerly Angela Renee Ware), a Bronson Hospital patient. The Hospital admits that Wark was not one of Kratzer’s healthcare providers and s hould not have viewed Kratzer’s records. The Hospital further concedes that when admitted to the Hospital, Kratzer feared Wark would attempt to read her medical re cord, warned the Hospital of th is possibility, and specifically directed the Hospital not to “share” her health information with Wark.

When Wark disclosed the illegally accessed confidential information in a child custody proceeding, Kratzer sued Wark and the Hospital. As to the Hospital, Kratzer’s complaint sets forth several liability theories. One theory focuses on the Hospital’s policies and procedures addressing the confidentiality of medical inform ation. Kratzer’s complaint avers that the Hospital negligently failed to adopt “appropriate policies and procedures for safeguarding, protecting, and ensuring the conf identiality of a patient’s protected health information from unauthorized access,” and ra ised several other claims related to the Hospital’s medical record access policies. One issue presented is whether Kratzer’s policy and procedure claims sound in negligence or in medical malpractice.-2- The majority holds that “[t]o determine wh ether the Hospital’s pol icies and procedures were appropriate, the jury would necessarily ha ve to balance what information doctors, nurses, and medical staff require to make medical decisions against the patients’ rights to confidentiality
under various laws.” Ante at 10. According to the majority, “[a] jury cannot determine whether an employee will need health information to do his or her job without knowing and understanding what information several types of hospital employee – doctors, nurses, and other medical staff—reasonably require to make medical decision.” Id . Thus, the majority concludes, Kratzer’s claim concerning hospital policies sounds in medical malpractice rather than in negligence.

I respectfully dissent. In my view, design ing policies and procedures that adequately safeguard a patient’s right to c onfidentiality does not require an exercise of medical judgment. Contrary to the majority’s view, no standards of medical care dictate the privacy rights of hospital patients. Rather, the questions presente d are legal, technological , and administrative. Clearly, expert testimony is necessary. However, the expert testimony critical to Kratzer’s case has nothing to do with the medical standards of care expected of health care professionals. Accordingly, I would hold that a jury should de cide Kratzer’s policy a nd procedure claims.

I would not have addressed th e Hospital’s statute of frauds argument regarding plaintiff’s breach of implied contract claim for the first tim e on appeal, but the majority’s recitation of MCL 566.132 is accurate. I respectfully disagree w ith the majority’s c onclusion that any of plaintiff’s claims sound in medical malpractice.

In Bryant v Oakpointe Villa , 471 Mich 411, 422; 684 NW2d 864 (2004), our Supreme Court set forth the two “defining characteris tics” of a medical ma lpractice clam:

First, medical malpractice can occur only “‘within the course of a professional relationship.’” [ Dorris v Detroit Osteopathic Hosp Corp , 460 Mich 26, 45; 594 NW2d 455 (1999) (internal quotation omitte d)]. Second, claims of medical malpractice necessarily “raise questi ons involving medical judgment.” Id . at 46. Claims of ordinary negligence, by contra st, “raise issues that are within the common knowledge and experience of the [fact-finder].” Id . Therefore, a court must ask two fundamental questions in determining whether a claim sounds in ordinary negligence or medical malpractice: (1) whether the claim pertains to an
action that occurred within the course of a professional re lationship; and (2) whether the claim raises questions of medical judgment beyond the realm of common knowledge and experience. If both these questions are answered in the affirmative, the action is subject to th e procedural and substantive requirements that govern medical malpractice actions.

Clearly and undisputedly, the relationship here wa s professional. However, protecting private
client information is inherent in almost any professional relationship a nd a great many ordinary business relationships as well. The fact that th e information happened to be medical in nature has no bearing on the essentially administrative j udgment necessary to protect it, either in the abstract or, as here, from an antic ipated and specific known threat. Bryant ’s second inquiry-3- directs us to examine “whether the claim raises questions of medical j udgment requiring expert testimony or, on the other hand, whether it alleges facts within the realm of a jury’s common knowledge and experience.” Id. at 423. “If the reasonableness of the health car e professionals’ action can be evaluated by lay ju rors, on the basis of their comm on knowledge and experience, it is ordinary negligence. If, on the other hand, the reasonableness of the action can be evaluated by a jury only after having been presented the standards of care pertaining to the medical issue before the jury explained by experts, a medical malpractice claim is involved.” Id . Simply put, there is nothing medical about the protection of confidential client/pa tient information.

The majority declares that “ multiple medical standards of care” f actor into the creation of confidentiality policies, ante at 10, emphasis in original, but supports this sweeping, conclusory statement with neither analysis nor examples. In my view, a single standard of care bears relevance to hospital confidentiality policies, and a lay jury can easily evaluate that standard
without assistance from medical ex perts. In a nutshell, that sta ndard provides that patients have a right to keep confidential the details of their medical care and treatment. Perhaps this right of confidentiality dates back to adoption of The Hi ppocratic Oath, a provision of which provides: “I will respect the privacy of my patients, for their problems are not disclosed to me that the world may know.” Stedman ’ s Medical Dictionary (28 th ed), pp 890-891.

The Michigan Supreme Court recognized this fundamental principle more than 130 years ago in DeMay v Roberts

, 46 Mich 160; 9 NW 146 (1881). In that case, Dr. DeMay brought “an unprofessional young unmarried man” with him to “t he childbed” of Mrs. Roberts. Dr. DeMay’s companion “could hear at least, if not see al l that was said and done” during the ensuing
childbirth. Id . at 165. The Supreme Court found that a violation of Mrs. Robert’s right to privacy permitting the recovery of “substantial damages,” declaring:

It would be shocking to our sense of right , justice and propriety to doubt even but
that for such an act the law would afford an ample remedy. To the plaintiff the
occasion was a most sacred one and no one had a right to intrude unless invited or because of some real and pressing necessity which it is not pretended existed in this case. The plaintiff had a legal right to the privacy of her apartment at such a time, and the law secures to her this right by requiring others to observe it, and to
abstain from its violation. Id . at 165-166.

The standard of care articulated in DeMay is easily understood by laypersons. It does not differ among obstetricians, anesthesio logists, or pediatricians. In fact, since this standard of care does not involve medical expertise but privacy con cerns in general, it also applies to any other setting in which privacy rights are implicated , such as an attorney/client relationship. 1 For the present case it is important to note that just be cause the privacy issue arose in a medical setting
over medical information does not mean medical experts are required. Private medical

1 The phrase ‘standard of care’ can apply to a vari ety of concepts. In this case, the majority refers to a medical standard of care. However, since this case involves not a medical issue but a privacy issue, the phrase ‘standard of care’ refers not to anything medical, but to the standard of care involving the duty to ensure the privacy of a patient’s confidential information.-4- information must be kept private. Numerous statutes incorporate this basic axiom. See MCL 333.26261 et seq (The Medical Records Act), MCL 330.1748 (mental health records), MCL 333.20170 (Public Health Code, medical records access and compliance), MCL 333.20201 (Public Health Code, patient rights), MCL 333.21515 (Menta l Health Code, confidentiality of records), Michigan Administrative Code 324.1028 (minimum standards for hospitals).

Legal necessities sometimes intrude on a pa tient’s right to privacy. For example, a patient’s receipt of insurance benefits may be conditioned on a waiver of some aspects of the physician-patient relationship. Similarly, a plainti ff in a personal injury case may be required to waive the patient/physician privileg e to recover damages for injur y. Such waivers are exceptions to the rule of confidentiality and must be take n into account in privacy policies. However, the relationships giving rise to waiver s are of no moment here, because the standard of care owed to Kratzer does not implicate any waiver. That standard required the Hospital to maintain her records in a manner that prevented access to unpriv ileged parties, particul arly Wark. How that standard should have been implem ented implicates practical ques tions such as the design of a computer records system. 2 However, it has nothing to do with a standard of care regarding anything other than privacy.

Nor does an analysis of medical record polic ies and procedures call for the exercise of medical judgment. The duty to protect medical records from prying eyes may have originated with Hippocrates, but it is now clearly elucidated in HIPAA regulations compelling a hospital to:

(1) Ensure the confidentiality, integr ity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.

(2) Protect against any reasonably anticipated threats or hazards to the security or integrity of such information .

(3) Protect against any reasonably antici pated uses or disc losures of such information that are not permitted or requi red under subpart E of this part.

(4) Ensure compliance with this subpar t by its workforce. 45 CFR § 164.306.

2 This Court’s internal docketing and case manage ment system locks certain users out of data available to other users. For example, judge s cannot access portions of the system used by the clerk’s office. Research attorneys cannot access aspects of the system available to judges. How the system creates its pathways and blockade s is beyond my understanding. However, it most certainly does not involve a legal standard of care. This Court’s programmers incorporated policy and decisions giving rise to the confidentiality rules with computer technology. Similarly, a hospital privacy policy should marry legal rules and regulations with te chnological know-how.
Medical standards of care ar e not part of this mix.-5- Notably, the regulations contemplat e that a hospital must protect against “reasonably anticipated threats” to the security of electronically stored health care information. HIPAA permits covered hospitals some leeway in designing their policies:

(b) Flexibility of approach.

(1) Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications as specified in this subpart.

(2) In deciding which security measures to use, a covered entity or business
associate must take into acc ount the following factors:

(i) The size, complexity, and capabilities of the covered entity or business
associate.

(ii) The covered entity's or the busine ss associate's technical infrastructure, hardware, and software s ecurity capabilities.

(iii) The costs of security measures.

(iv) The probability and critic ality of potential risks to electronic protected health information. 45 C.F.R. § 164.306.

I find nothing in these criteria related to the intr icacies of medical practic e or the exercise of medical judgment. Indeed, Hospit al patients are informed when they consent to treatment that the Hospital’s privacy policy at taches to their he althcare information, that “[a]ll Bronson affiliated providers . . . are required by law to maintain the privacy of [patients’] health information,” and that their information may only be provided to others to facilitate treatment or to pay insurance claims. Dr awing on their common knowledge and experience, lay people readily understand these uncomplicated statements. Kratzer alleges that gaps in the Hospital’s privacy policies permitted an unpr ivileged interloper to easily acc ess confidential information. Unlike the majority, I believe that the resolu tion of this claim likel y requires input from computer experts, lawyers, and/or hospital admi nistrators. However, jurors have no need of expert testimony concerning standards of medical care to determine whether the Hospital’s privacy policies adequately protected patients such as Kratzer. Indeed, the majority’s failure to identify what medical specialist must sign th e relevant affidavit of merit under MCL 600.2169(1) reveals the inadequacies of the majority’s analysis.

I would agree with the majority’s observati on that determining who has a need to view any given patient’s medical information at any given time may entail some degree of medical judgment, if that necessity was assessed within th e context of actual medica l care or treatment. In context, however, that is a straw man argument. There is absolutely no dispute here that Wark had no need to view plaintiff’s information and was in no way involved in plaintiff’s care or treatment. The gravamen of pl aintiff’s complaint is not an a ssertion that the Hospital should
have selected a different cons tellation of individuals who should have been authorized to view her medical information, but rather that the Ho spital failed to ensure that those who were-6- actually not authorized had no access. Indeed, five out of the seven duties pl aintiff asserts were
breached explicitly refer to access which was unauthorized , not merely inappropriate. The other two assert that the Hospital failed to limit disc losures to those who needed the information, which, again, Wark undisputedly did not.

Had Wark actually been involved in any way in plaintiff’s care or treatment, and had plaintiff asserted that Wark wa s but should not have been author ized to view he r records, the majority’s logic would be enti rely appropriate. It is obvious ly a matter of medical judgment whether an actual provider of ca re or treatment needs to know a ny particular information about a patient. However, there is no medical judgment necessary to determine that medical records are private. Likewise, there is no medical judgm ent necessary to know that someone totally uninvolved with a given patient does not need to know anything about that patient, at least until such time as they become involved. By way of an analogy, a clerk hired by a lawyer has no need to pry into confidential client files being kept by another lawyer down the hall, and there is no particular legal training necessa ry to draw that conclusion. The concepts of privacy and the
failure to maintain it are certa inly “within the common knowledge and experience” of jurors.

The determination of what a care or trea tment provider needs to know about a patient may be medical, but the implementation of ex cluding all others from access is simply administrative. Expert testimony may be required, but in this day and age the expert is more likely to be a computer expert, r ecords auditor, or even a lawyer . The majority concludes that whether the Hospital failed to follow its own pro cedures requires no medical testimony; I agree, however by the same logic, whether those pro cedures were effective at accomplishing their purported goals also requires no medical testim ony. It likewise requires no medical judgment to act on an advance warning of a known threat or to implement a training program in either privacy concepts in general or whatever acce ss control system the Hospital has in place—or, indeed, whether to have training or an access control system at all.

The majority complains that it “cannot fat hom how the Hospital – or any hospital—could formulate a privacy policy wit hout substantial, direct input from doctors, nurses and medical staff.” Neither can I. But inviting “substantial, direct input” from medica l professionals is a far cry from constructing a medical confidentiality po licy predicated on medical standards of care. The medical record confidentiality standard of care is in the firs t instance dictated by the Health Insurance Portability an d Accountability Act, and in the second instance by technological and practical considerations. Standards of care flow ing from approaches to patient treatment simply have no bearing on the central prin ciple animating confidentiality policies – a patient has a right to keep her private medical information private. Despite the majority’s insistence that “the standard of care pertaining to me dical issues” must inform a confidentiality policy, the majority has not provided even a single exam ple of why this must be so. Nor has the majority elucidated how the steps involved in developing a confid entiality policy meeting le gal requirements would fall outside the common understanding of lay jurors. Perhaps most tellingly, the majority offers no explanation of how a plethor a of medical standards of car e, involving judgments from anesthesia choices to x-ray protocols, could, shoul d, or ever actually have factored into a single hospital privacy policy.-7- I would hold that none of plain tiff’s claims, at least as they are presented in this matter, raise issues of medical judgment. To the extent the trial court denied summary disposition on the
basis that the case does not sound in medical malpra ctice, I would affirm.

/s/ Amy Ronayne Krause