[Cite as Keyse v. Cleveland Clinic Found., 2024-Ohio-2806.]

COURT OF APPEALS OF OHIO

EIGHTH APPELLATE DISTRICT

COUNTY OF CUYAHOGA

KATHLEEN KEYSE, :

Plaintiff-Appellant, :

No. 113264

v. :

CLEVELAND CLINIC FOUNDATION, :

Defendant-Appellee. :

JOURNAL ENTRY AND OPINION

JUDGMENT: AFFIRMED

RELEASED AND JOURNALIZED: July 25, 2024

Civil Appeal from the Cuyahoga County Court of Common Pleas

Case No. CV-22-961897

Appearances:

Mishkind Kulwicki Law Co., L.P.A., and David A. 

Kulwicki; Flowers & Grube, Paul W. Flowers, and Louis E. 

Grube, for appellant. 

Tucker Ellis LLP, Susan M. Audey, Elisabeth C. Arko, 

Edward E. Taber, and Kelli R. Novak, for appellee. 

KATHLEEN ANN KEOUGH, A.J.:

Plaintiff-appellant, Kathleen Keyse (“Keyse”), appeals from the trial 

court’s judgment granting the motion for summary judgment of defendant-appellee, 

Cleveland Clinic Foundation (“Cleveland Clinic”). We affirm. 
I. Background

Keyse, in a refiled action, sued Cleveland Clinic in April 2022, 

asserting claims for (1) breach of fiduciary duty; (2) violation of right to privacy; (3) 

fraud; and (4) punitive damages. The gist of Keyse’s complaint was that one of 

Cleveland Clinic’s employees, Diane Shepherd (“Shepherd”), who is Keyse’s sister, 

electronically accessed Keyse’s medical information on several occasions between 

June and October 2020 without a business reason to do so. In short, Keyes alleged 

that Shepherd “snooped” into Keyse’s medical records for her own personal reasons. 

In her deposition, Shepherd admitted that she improperly accessed Keyse’s 

electronic medical record but said she never disclosed the information to anyone 

else. Shepherd also said that Cleveland Clinic sanctioned her for her improper 

conduct by issuing her a final written warning and putting her on probation for two 

years. 

After discovery, Cleveland Clinic moved for summary judgment on all 

of Keyse’s claims. The trial court denied the motion as to all claims except Keyse’s 

claim for punitive damages, which the trial court found Keyse had withdrawn.

The case progressed and the parties prepared for trial. On the eve of 

trial, Keyse withdrew her claims for breach of fiduciary duty and fraud, leaving only 

her medical-privacy claim, which Keyse’s counsel acknowledged in an email to 

Cleveland Clinic counsel was a Biddle claim.1

1 As will be discussed in more detail below, in Biddle v. Warren Gen. Hosp., 86 

Ohio St.3d 395 (1999), the Ohio Supreme Court recognized a separate tort for the 

unauthorized disclosure of confidential medical information. Such a claim is now known 
Cleveland Clinic then filed seven motions in limine to exclude at trial:

(1) evidence of Keyse’s alleged emotional damages; (2) any allegations of disclosure 

of medical information to a third party; (3) reference to other reported 

impermissible access events involving other patients; (4) Keyse’s vicarious liability 

argument as to Shepherd; (5) evidence of Keyse’s withdrawn claims and prayer for 

punitive damages; (6) to enforce Ohio’s statutory damages cap; and (7) preclude 

argument on expert issues not supported by an expert witness. The trial court 

granted all seven motions. 

Cleveland Clinic then moved for summary judgment on Keyse’s 

Biddle claim, her sole remaining claim for trial. Keyse opposed the motion. The 

trial court subsequently granted the motion, finding that Keyes “failed to present 

any evidence of a disclosure of [her] nonpublic medical information to a third party, 

as required by Biddle. Therefore, the court finds that [Keyse’s] claim fails as a matter 

of law and [Cleveland Clinic] is entitled to judgment in its favor.” This appeal 

followed. 

II. Law and Analysis

A. Summary Judgment

In her first assignment of error, Keyse contends that the trial court 

erred in granting Cleveland Clinic’s motion for summary judgment. 

as a Biddle claim. In his April 12, 2023 email to Cleveland Clinic’s counsel, Keyse’s 

counsel wrote, “This email will confirm that I will only be pursuing the Biddle claim at 

trial.” 
We review summary judgment rulings de novo, applying the same 

standard as the trial court. Grafton v. Ohio Edison Co., 77 Ohio St.3d 102, 106 

(1996). We accord no deference to the trial court’s decision and conduct an 

independent review of the record to determine whether summary judgment is 

appropriate. Brewer v. Cleveland Bd. of Edn., 122 Ohio App.3d 378, 383 (8th Dist.

1997). 

Under Civ.R. 56(C), summary judgment is appropriate when no 

genuine issue exists as to any material fact and, viewing the evidence most strongly 

in favor of the nonmoving party, reasonable minds can only reach a conclusion that 

is adverse to the nonmoving party. The party moving for summary judgment has 

the initial burden of identifying specific facts in the record that demonstrate an 

entitlement to summary judgment. Dresher v. Burt, 75 Ohio St.3d 280, 292-293 

(1996). If the movant fails to meet this burden, summary judgment is not 

appropriate. Id. If the moving party meets this burden, the burden shifts to the 

nonmoving party to point to specific facts in the record that demonstrate the 

existence of a genuine issue of material fact for trial. Id. 

“In general, a person’s medical records are confidential. Numerous 

state and federal laws recognize and protect an individual’s interest in ensuring that 

his or her medical information remains so.” Hageman v. Southwest Gen. Health 

Ctr., 2008-Ohio-3343, ¶ 9. The Ohio Supreme Court explicitly recognized and 

applied this principle of confidentiality in Biddle, 86 Ohio St.3d 395, where it 

“recognized that the breach of patient confidentiality is a palpable wrong” but that 
“such an injury is difficult to remedy appropriately.” Id. at ¶ 10. Finding the various 

methods that courts had developed to address such claims (including theories like 

invasion of privacy, defamation, breach of contract, and others) to be ill-suited for 

addressing a breach-of-confidence situation, the Biddle Court recognized a separate 

tort for breach of confidentiality related to medical information. Id. at ¶ 11.2 

The Court defined the boundaries of the new tort by recognizing two 

related causes of action: one against physicians and hospitals that disclose 

confidential medical information to a third party without authorization or privilege 

to do so, and one against third parties who induce physicians or hospitals to disclose 

such information. Id., citing Biddle at paragraphs one and three of the syllabus. 

Setting forth the elements of the claim, the Biddle Court stated, “in 

Ohio, an independent tort exists for the unauthorized, unprivileged disclosure to a 

third party of nonpublic medical information that a physician or hospital has 

2 In establishing the tort, the Ohio Supreme Court made clear that other common 

law claims are not available where a Biddle claim exists: 

As to appellees’ continued insistence that they be entitled to pursue other 

theories of liability, we agree with the reasoning of the appellate court that 

these other theories are either unavailable, inapplicable because of their 

respective doctrinal limitations, or subsumed by the tort of breach of 

confidence [i.e., a Biddle claim]. Indeed, it is the very awkwardness of the 

traditional causes of action that justifies the recognition of the tort for 

breach of confidence in the first place. 

Biddle at 408-409. See also Sheldon v. Kettering Health Network, 2015-Ohio-3268, ¶ 29 

(2d Dist.) (“Although case law delineating the parameters of a Biddle claim is still 

developing, the consolidation of other common law theories of recovery into that tort is 

certain.”). 
learned within a physician-patient relationship.” Biddle at paragraph one of the 

syllabus. 

Keyse contends that Cleveland Clinic admitted that Shepherd 

improperly accessed her electronic medical records on several occasions and that

Shepherd’s unauthorized access constitutes an unprivileged disclosure to a third

party under Biddle sufficient to justify a denial of summary judgment and, therefore, 

a reversal of the trial court’s judgment. (Appellant’s brief, p. 14.) She also contends 

that summary judgment should have been denied because reasonable jurors could 

conclude that Cleveland Clinic was obligated under the federal Health Insurance 

Portability and Accountability Act of 1996 (“HIPAA”), which prevents healthcare 

providers from disclosing health information except in certain specific 

circumstances, to undertake more efforts to protect her from Shepherd’s 

unauthorized access to her confidential medical records. (Appellant’s brief, p. 15.) 

Cleveland Clinic, on the other hand, argues that the trial court 

properly granted summary judgment in its favor because (1) a Biddle claim requires 

disclosure to an “outside” third party, which Cleveland Clinic asserts means an entity 

or person outside the walls of the hospital, which did not happen in this case; (2) in 

any event, Cleveland Clinic made no intentional or unintentional disclosure of any 

kind; rather, Shepherd improperly accessed Keyse’s confidential medical 

information for a nonbusiness use; and (3) the narrowly tailored medical-privacy 

claim under Biddle exists independent of HIPAA and although HIPAA may provide 

guidance to courts regarding the contours of a Biddle claim, it does not expand 
Biddle so that an alleged regulatory violation of HIPAA is actionable under a breachof-confidence claim under Biddle. (Appellee’s brief, p. 13, 15, 17.) 

Keyse responds that Shepherd was the “third party” to which her 

nonpublic medical information was disclosed because 

“disclosure to a third party” as used in the Biddle syllabus most aptly 

and reasonably should be interpreted to apply to a hospital’s 

impermissible disclosure to any person, employee or not, who has no 

legitimate business or medical reason for having access to the patient’s 

confidential information. 

(Appellant’s reply brief, p. 3.) She contends that the trial court should therefore have 

denied summary judgment because there are disputed issues of fact over whether 

Shepherd qualifies as a third party under Biddle. 

We need not resolve the issue of whether Shepherd qualifies in these 

circumstances as a third party under Biddle or whether disclosure must be outside 

the walls of the entity holding the information because our review of the record 

demonstrates that Cleveland Clinic made no disclosure whatsoever of Keyse’s 

confidential medical information and, therefore, Keyse’s Biddle claim fails as a 

matter of law. 

The breach of confidence tort recognized in Biddle requires “the 

unauthorized, unprivileged disclosure to a third party of nonpublic medical 

information that a physician or hospital has learned within a physician-patient 

relationship.” Biddle, 86 Ohio St.3d at 523. A Biddle claim therefore requires a 

disclosure. According to Black’s Law Dictionary, “disclosure” is “[t]he act or process 

of making known something that was previously unknown.” Black’s Law 
Dictionary (11th Ed. 2019). But Cleveland Clinic did not do any act, either 

intentionally or unintentionally, that made Keyse’s medical information known to 

anyone. Rather, as Shepherd admitted in her deposition, she improperly accessed 

her sister’s confidential medical information entirely on her own without 

authorization to do so. 

Ohio courts and federal courts interpreting Biddle claims under Ohio 

law have refused to allow plaintiffs to pursue Biddle claims where third parties 

wrongfully intercepted or accessed the plaintiffs’ privileged medical information and 

the defendants did not disseminate or disclose the information either intentionally 

or unintentionally. For example, in Scott v. Ohio Dept. of Rehab. & Corr., 2013-

Ohio-4383 (10th Dist.), ten inmates at the Mansfield Correctional Institution filed 

suit against the Ohio Department of Rehabilitation and Correction (“ODRC”) 

asserting a Biddle claim after their names and HIV-positive medical status were 

listed on pharmacy documents that were left in trash cans that were accessible to 

other inmates who found the documents and then disseminated them to the general 

inmate population, to the detriment of the plaintiffs. Id. at ¶ 8. Recognizing “the 

known propensity of some inmates to ingeniously and maliciously exploit any 

opportunity for leverage over staff or fellow inmates,” id. at ¶ 30, the appellate court 

affirmed the trial court’s grant of summary judgment to ODRC on the inmates’ 

Biddle claim, finding that “supervised inmate access to trash containing unshredded 

medical documents does not constitute ‘disclosure’ for purposes of the tort of 

unauthorized disclosure of medical information as defined by Biddle.” Id. at ¶ 29. 
Likewise, in Foster v. Health Recovery Servs., 493 F.Supp.3d 622 

(S.D.Ohio 2020), the defendant learned that its network had been breached when 

an unauthorized IP address remotely accessed its computer network and obtained

the personal information of its clients, including the plaintiff. The plaintiff filed a 

Biddle claim based on the unauthorized disclosure of his health information to third 

parties. Id. at 629. The Foster Court found that the plaintiff’s allegations were 

insufficient to state a Biddle claim because the “[d]efendant did not commit an 

intentional or unintentional act of disclosure. Instead, what is alleged is that a third 

party has exploited [d]efendant’s security weakness to access the information 

without [d]efendant’s authorization.” Id. at 636. 

In Tucker v. Marietta Area Health Care, Inc., S.D.Ohio Nos. 2:22-cv184, 2:22-cv-221, and 2:22-cv-385, 2023 U.S. Dist. LEXIS 13974 (Jan. 26, 2023), 

the defendant, a regional medical services business, was the target of a cyberattack 

during which the hacker gained access to defendant’s computer system and acquired 

the protected health information of defendant’s current and former patients. Id. at 

*2. The plaintiff sued, asserting various common law claims against the defendant. 

The defendant filed a motion to dismiss all of the plaintiff’s claims, arguing that they 

were preempted under Biddle. The district court disagreed, finding that “Biddle

applies only when a defendant has made a disclosure.” Id. at *8. The court reasoned 

that because the case involved unauthorized access to the plaintiff’s medical 

information by a third party, and not a disclosure by the defendant, Biddle did not 

apply. Id. 
Similarly, in Sheldon v. Kettering Health Network, 2015-Ohio-3268

(2d Dist.), the court found that “the facts alleged [did] not constitute a ‘disclosure’

for purposes of a Biddle breach-of-confidentiality claim” against the defendant 

health care organization where one of the defendant’s employees “intentionally and 

improperly” accessed the defendant’s software system to obtain his ex-wife’s 

electronic medical information and then shared that information with his lover, who 

was also a co-worker. Id. at ¶ 13, 33. The court found that the employee’s actions 

were clearly “unauthorized” because although he “may have had authority to access 

any hospital medical record for a legitimate administrative purpose,” he did not have 

authority to access the defendant’s software “for personal spying on his former 

spouse or his sharing of that information with a co-worker.” Id. at ¶ 26. 

Accordingly, because the facts did not constitute a “disclosure” by the health care 

organization, but rather the deliberate, unauthorized access to the information by 

an employee, the court affirmed the trial court’s dismissal of the plaintiff’s claims. 

Id. 

Finally, in Kennedy v. Corrado, Hamilton C.P. No. A1900656, 2019 

Ohio Misc. LEXIS 7130 (May 30, 2019), the trial court found that allegations that an 

employee of the defendant healthcare organization accessed the plaintiff’s medical 

records without authorization to do so and then shared those records with others 

did not constitute a “disclosure” by the healthcare organization for purposes of a 

Biddle claim and dismissed the plaintiff’s claim. Id. at *4. 
Contrary to Keyse’s argument that these cases are “inapposite” to the 

facts of this case, we find them directly on point. Just as in Scott, Sheldon, Tucker, 

Foster, and Kennedy, this case involves the deliberate unauthorized access of the 

plaintiff’s medical information by a third party. There are no facts suggesting that 

Cleveland Clinic either intentionally or unintentionally disclosed Keyse’s 

confidential medical information to Shepherd. Instead, the evidence is clear that 

Shepherd acted willfully, improperly, and entirely on her own to gain access to 

Keyse’s confidential medical information. Although as a Cleveland Clinic employee 

Shepherd was authorized to access Keyse’s medical records for a legitimate business 

purpose, she was not authorized to access them for her own personal reasons, which 

she admitted she did when she “snooped” into Keyse’s records. Accordingly, just as 

in the preceding cases, Shepherd’s unauthorized, intentional, deliberate “snooping”

into her sister’s records does not constitute a “disclosure” by Cleveland Clinic under 

Biddle. Because there is no evidence that the Cleveland Clinic disclosed Keyse’s 

medical information to anyone, Keyse cannot prove an essential element of her 

Biddle claim and, therefore, the trial court properly granted Cleveland Clinic’s 

motion for summary judgment on her claim. 

Any argument by Keyse that the trial court should have denied 

summary judgment because a jury could reasonably conclude that Cleveland Clinic 

should have done more under HIPAA to protect the release of her information to 

Shepherd is wholly without merit. Although HIPAA may provide guidance for 

establishing Biddle liability, “it is well-settled that a HIPAA violation does not create 
a private cause of action for the party whose information has been released.” 

Menorah Park Ctr. for Senior Living v. Rolston, 2020-Ohio-6658, ¶ 36. Thus, 

allowing the jury to consider Cleveland Clinic’s compliance with HIPAA despite the 

failure of Keyse’s Biddle claim would in effect create a private cause of action for 

Keyse under HIPAA, something the law clearly does not allow. 

The first assignment of error is overruled. 

B. Motions in Limine

In her second assignment of error, Keyse contends that the trial court 

abused its discretion in granting Cleveland Clinic’s motions in limine. 

“It is well-settled that the granting or denial of a motion in limine is a 

tentative, interlocutory precautionary ruling reflecting the trial court’s anticipatory 

treatment of an evidentiary issue which the trial court may change at trial when the 

disputed evidence appears in context.” State v. Taylor, 2004-Ohio-3115, ¶ 6 (8th 

Dist.), citing State v. Grubb, 28 Ohio St.3d 199, 201 (1986). “‘A preliminary ruling 

has no effect until it is acted upon at trial’” and hence, is not a final appealable order. 

Liebe v. Admin., 2014-Ohio-1834, ¶ 9 (8th Dist.), quoting State v. Kulasa, 2012-

Ohio-6021, ¶ 20 (10th Dist.). 

Cleveland Clinic contends that it would be premature for this court to 

address Keyse’s arguments regarding the motions in limine because the trial court’s 

rulings were conditional, interlocutory rulings that were not decided in the context 

of a full trial and, thus, for us to address Keyse’s arguments regarding the motions 

in limine would be “tantamount to giving advisory opinions on questions not 
properly before this court.” (Appellee’s brief, p. 36.) Once a final judgment is 

rendered, however, all interlocutory orders are merged into the final judgment of 

the trial court and become appealable. Marc Glassman, Inc. v. Fagan, 2006-Ohio5577, ¶ 11 (8th Dist.). 

Nevertheless, this assignment is error is rendered moot by our 

disposition of the first assignment of error affirming the trial court’s grant of 

summary judgment to Cleveland Clinic. Accordingly, the second assignment of 

error is overruled. See App.R. 12(A)(1)(c). 

Judgment affirmed. 

It is ordered that appellee recover from appellant costs herein taxed.

The court finds there were reasonable grounds for this appeal.

It is ordered that a special mandate be sent to said court to carry this judgment 

into execution.

A certified copy of this entry shall constitute the mandate pursuant to Rule 27 

of the Rules of Appellate Procedure.

KATHLEEN ANN KEOUGH, ADMINISTRATIVE JUDGE

EILEEN A. GALLAGHER, J., and

LISA B. FORBES, J., CONCUR