Court Opinion

ID: 6326839
Source: CourtListenerOpinion
Date Created: 2022-03-25 14:05:53.65942+00
Date Added: 2024-06-11T09:22:17.612379
License: Public Domain

RENDERED: MARCH 18, 2022; 10:00 A.M.
                        NOT TO BE PUBLISHED

                 Commonwealth of Kentucky
                           Court of Appeals

                              NO. 2021-CA-0466-MR

JANE DOE                                                             APPELLANT

                   APPEAL FROM BOYD CIRCUIT COURT
v.               HONORABLE GEORGE W. DAVIS III, JUDGE
                        ACTION NO. 20-CI-00971

ASHLAND HOSPITAL CORPORATION
AND SHELLY JEAN DAVIS BAIER                                           APPELLEES

                                    OPINION
                                   AFFIRMING

                                   ** ** ** ** **

BEFORE: LAMBERT, MAZE, AND L. THOMPSON, JUDGES.

MAZE, JUDGE: Jane Doe (Doe) appeals from an order of the Boyd Circuit Court

dismissing her claims against Ashland Hospital Corporation, d/b/a King’s

Daughters Medical Center (KDMC) and Shelly Jean Davis Baier (Baier). On

appeal, Doe makes four arguments: 1) the trial court’s order dismissing should be

reversed because there were sufficient facts presented as to the allegations of her

                                         -1-
amended complaint separate from HIPAA1 to survive dismissal; 2) the trial court

should be reversed because there are other independent claims upon which relief

could have been granted other than a direct HIPAA violation; 3) the trial court

should be reversed as to Doe’s claim for invasion of privacy on the grounds that

sufficient facts were presented in support of each element of that claim; and 4) the

trial court should be reversed as to the dismissal of Doe’s remaining claims

because relief may be granted as to those claims. The Court having found no

reversible error in the Boyd Circuit Court’s order dismissing, we affirm.

                 As a minor, Doe was sexually assaulted by an adult male babysitter.

He was convicted of that offense. At trial, his defense counsel put on evidence in

the form of Doe’s medical records to demonstrate that there was no physical

evidence of rape. Those records were not obtained by subpoena or search warrant.

                 Baier is the mother of Doe’s assailant. She is also an employee of

KDMC. Doe was treated at that facility between April 13, 2018 and April 30,

2018. It has been alleged that Doe’s medical records from that period were

procured by Baier and transmitted to her son’s defense counsel. An action was

filed in the trial court in which Doe asserted causes of action for invasion of

privacy, negligent hiring, training, retention and supervision, negligence,

negligence per se, breach of fiduciary duty, gross negligence, breach of expressed

1
    Health Insurance Portability and Accountability Act of 1996.

                                                -2-
or implied contract, identity theft, and intentional infliction of emotional distress.

Both Baier and KDMC filed motions to dismiss and Doe responded.

             On April 6, 2021, the trial court entered an order sustaining those

motions dismissing Doe’s claims in their entirety. The trial court concluded that

“Plaintiff’s claims are merely an attempt to strap Common Law claims onto the

back of prohibited behavior under the Federal HIPPA [sic] statute.” The trial court

found that, as a matter of law, HIPAA does not create a private cause of action.

The trial court concluded that Doe’s claims were preempted by the application of

HIPAA since the Kentucky common law claims pled did not provide for a more

stringent standard than that set forth in HIPAA.

             A motion to dismiss for failure to state a claim upon which relief may

be granted is only appropriate where “it appears the pleading party would not be

entitled to relief under any set of facts which could be proved[.]” Pari-Mutuel

Clerk’s Union of Kentucky Local 541, SEIU, AFL-CIO v. Kentucky Jockey Club,

551 S.W.2d 801, 803 (Ky. 1977). As such, this Court’s review is de novo. Fox v.

Grayson, 317 S.W.3d 1, 7 (Ky. 2010).

             The trial court set forth two bases for its order dismissing. First, the

trial court concluded that “HIPAA does not create a civil cause of action under

state or federal law.” As noted in Caldwell v. Chauvin, 464 S.W.3d 139, 148 (Ky.

2015), the Secretary of the United States Department of Health and Human

                                          -3-
Services (HHS) was charged with promulgating privacy regulations to promote the

purpose of HIPAA. 45 C.F.R.2 §§ 160-164 outlines the responsibility of a

“covered entity” for an individual’s “protected health information.” In 45 C.F.R. §

160.306 an administrative remedy is set forth for any breach of that responsibility,

providing for civil penalties against the “covered entity.” However, both state and

federal courts have consistently held that there is no private cause of action for

such conduct.

                In Young v. Carran, 289 S.W.3d 586, 588-89 (Ky. App. 2008), the

Court specifically held that there is no private cause of action for a violation of

HIPAA under KRS3 446.070, the statute codifying “negligence per se.” Yeager v.

Dickerson, 391 S.W.3d 388, 393 (Ky. App. 2013).

                The second reason set forth in support of the trial court’s order is that

“HIPAA preempts state law unless the state enacts more stringent measures.” 45

C.F.R. § 160.203 states that “[a] standard, requirement, or implementation

specification adopted under this subchapter that is contrary to a provision of State

law, preempts the provision of State law.” The rule then sets forth several

exceptions including subsection (2)(b), which specifies that a provision is not

preempted where it “relates to the privacy of individually identifiable health

2
    Code of Federal Regulations.
3
    Kentucky Revised Statutes.

                                            -4-
information and is more stringent than a standard, requirement, or implementation

specification adopted under subpart E of part 164 of this subchapter.”

                Doe has asserted three Kentucky statutes in support of her argument

that the claims set forth in her amended complaint were not preempted by HIPAA

and its associated regulations. However, the statutes in question, to the extent they

may apply, are not “more stringent” than those imposed in support of HIPAA and

its purposes. KRS 210.235 applies to mental health records maintained by the

Cabinet for Health and Family Services. Although it contains a general prohibition

on disclosure of such records, it also contains certain exceptions, including one for

court proceedings. KRS 422.317 requires a licensed hospital to provide a patient

with a free copy of his or her medical records upon request. KRS 422.315 grants

that patient and any other person or entity acting on his or her behalf standing to

apply for a protective order in a court proceeding where medical records have been

“copied and delivered pursuant to KRS 422.300 to 422.330[.]” In Young, similar

arguments were made on appeal regarding KRS 210.235 and KRS 422.317, but

were not raised in the trial court and were therefore not considered on appeal. 289

S.W.3d 589. However, as provided in 902 KAR4 20:016(e), HIPAA supplies the

standard to be applied to disclosure of protected health information by a covered

4
    Kentucky Administrative Regulations.

                                           -5-
entity. As such, these Kentucky statutes may not be used as an independent basis

to support Doe’s claims.

             This Court holds that the trial court’s findings and conclusions are

dispositive as to all of Appellant’s claims. However, since she has made additional

arguments specifically addressing her claims for invasion of privacy and negligent

hiring, we will address those briefly.

             Even if her claim for invasion of privacy was not preempted, it was

simply not pled as being anything other than a HIPAA violation. It appears that

Appellant has pled that there was an unreasonable intrusion upon her seclusion and

that the private information so obtained was publicly disclosed. McCall v.

Courier-Journal and Louisville Times Co., 623 S.W.2d 882, 887 (Ky. 1981).

However, she repeatedly alleged in her amended complaint that Baier procured and

produced the information outside of her employment. As held in Osborne v.

Payne, 31 S.W.3d 911, 915 (Ky. 2000), there can be no claim for respondeat

superior liability where an employee engages in wrongful conduct while he or she

is not acting to advance the cause of his or her employer. Thus, Appellant’s claim

for invasion of privacy against KDMC cannot survive independently of the HIPAA

violation.

             Appellant contends that her claim that Baier was negligently hired,

trained, supervised, and retained may survive separately from the HIPAA violation

                                         -6-
because KDMC did not have policies and procedures in place to protect a patient

from this kind of disclosure. In support of that argument, she cites Doe v. St.

Joseph Health System, No. 2017-CA-000794-MR, 2018 WL 6600230 (Ky. App.

Dec. 14, 2018), in which the Court held that a separate claim for the employer’s

own negligence in hiring may survive without respondeat superior liability.

However, that case did not specifically address the issue of preemption.

             In Section II of her amended complaint, Doe sets out her cause of

action against KDMC for negligent hiring, training, retention, and supervision.

She asserts that because of her “special relationship” to Baier and KDMC, the

latter had a duty to not employ, retain, and/or train Baier because of her

“dangerous propensities and violations of policy and obvious actions.” She also

alleges that KDMC “knew or reasonably should have known” upon investigation

of Baier prior to her employment. She states that KDMC also knew or should have

known of her own vulnerability as a minor as well as a rape victim. She further

asserts that she was “informed and believes” that KDMC had no “system or

procedure” in place to “investigate supervise, monitor, or train to prevent the

unauthorized” use of her medical records for “exploitation.” Doe also concludes

that KDMC had been placed on notice by third parties that “Baier, had engaged in

dangerous and inappropriate conduct both before and during her employment,” and

therefore could be expected to do so again.

                                         -7-
             As argued by KDMC in its brief, “HIPAA preemption encompasses

more than unauthorized disclosure of protected health information.” It also

addresses such issues as the security of electronic information systems, required

training for the employees of covered entities and the utilization of policies and

procedures to provide HIPAA compliant system. 45 C.F.R. §§ 164.103-318.

Moreover, that system is subject to oversight by the Secretary of Health and

Human Services. 45 C.F.R. § 160.306. Thus, once again, the HIPAA standards are

the more “stringent” and state law claims such as those presented herein are

preempted.

             Although the disclosure herein was undoubtedly reprehensible it is not

actionable as a matter of law. While the Court finds the result of its ruling herein

to be unfortunate, it is constrained to follow the law.

             Accordingly, we affirm the order of the Boyd Circuit Court.

             ALL CONCUR.

                                          -8-
BRIEF FOR APPELLANT:    BRIEF FOR APPELLEE
                        ASHLAND HOSPITAL
Brandon M. Music        CORPORATION:
Grayson, Kentucky
                        W. Mitchell Hall, Jr.
                        Olivia H. Gilkison
                        Ashland, Kentucky

                        BRIEF FOR APPELLEE
                        SHELLY JEAN DAVIS BAIER:

                        David F. Latherow
                        Ashland, Kentucky

                       -9-