Court Opinion

ID: 9897206
Source: CourtListenerOpinion
Date Created: 2023-11-14 19:08:37.569107+00
Date Added: 2024-06-11T09:13:55.042415
License: Public Domain

FILED
                                                                      Sep 25 2023, 1:39 pm

                                                                           CLERK
                                                                       Indiana Supreme Court
                                                                          Court of Appeals
                                                                            and Tax Court

                               IN THE

       Indiana Supreme Court
                  Supreme Court Case No. 23S-CT-116

                                  Z.D.,
                                 Appellant

                                    –v–

            Community Health Network, Inc.,
                                  Appellee

           Argued: June 22, 2023 | Decided: September 25, 2023

                  Appeal from the Marion Superior Court
                         No. 49D11-2001-CT-3587
                    The Honorable Marc T. Rothenberg

        On Petition to Transfer from the Indiana Court of Appeals
                              No. 22A-CT-644

                      Opinion by Chief Justice Rush
                      Justices Massa and Goff concur.
Justice Slaughter concurs in part and dissents in part with separate opinion.
                      Justice Molter not participating.
Rush, Chief Justice.

   Private health information often includes highly sensitive details about
an individual’s personal life. When this information is shared with
healthcare providers, they are responsible for implementing protective
measures to prevent breaches and unauthorized disclosures. If an
unauthorized disclosure occurs, affected patients may seek relief under
various tort theories. But not all torts permit the same recovery. This is
especially true when a patient seeks relief under an invasion of privacy
claim and a negligence claim.

   Here, a hospital mailed a letter containing a patient’s intensely private
health matter to a teenage acquaintance of the patient’s daughter, and that
teenager posted the letter to Facebook. Seeking recovery for emotional
distress and other damages, the patient sued the hospital contending it (1)
invaded her privacy by publicly disclosing her private information and (2)
negligently failed to maintain the confidentiality of her information. The
hospital moved for summary judgment, which the trial court granted.

   We affirm in part and reverse in part. We first conclude the hospital is
not entitled to summary judgment on the patient’s privacy claim because
the hospital did not negate the public-disclosure tort’s publicity element.
Specifically, a genuine issue of material fact remains as to whether the
information was communicated in a way that it would reach a large
enough number of people such that it was sure to become public
knowledge. We then conclude the hospital is entitled to partial summary
judgment on the patient’s negligence claim. Although the patient is barred
from recovering damages for emotional distress on this claim, we find
genuine issues of material fact remain as to whether her pecuniary
damages are recoverable and whether the hospital was the proximate
cause of those damages.

Facts and Procedural History
  In September 2018, Z.D. received medical care at one of Community
Health Network’s emergency departments. Following her visit, a
Community employee called Z.D. to discuss her health matters. Unable to

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023    Page 2 of 18
reach her, the employee prepared a letter documenting Z.D.’s private
health information, which included her recent diagnosis and suggested
treatment. Although the letter was addressed to Z.D., it was placed in an
envelope addressed in handwriting to the wrong person and mailed to
that person.

   As it turns out, that person—Jonae Kendrick—was a teenager who
attended or had recently attended the same high school as Z.D.’s
daughter. When Kendrick received the envelope, she opened it, took a
picture of the one-page letter, posted it on her Facebook page, and
attempted to “tag” Z.D. in the post. Z.D.’s daughter, who was Facebook
friends with Kendrick, saw the post and notified her mother. Z.D.’s
daughter asked Kendrick to remove the post, but she declined. Z.D. then
contacted Kendrick and asked her to return the letter in exchange for $100,
which she accepted. Eventually the post was removed from Facebook.

   Based on these events, Z.D. sued Community. She alleged Community
was (1) directly responsible for its negligent training, supervision, and
retention of employees; (2) vicariously liable for its employee’s
unauthorized disclosure of Z.D.’s private health information; and (3)
directly or vicariously liable for negligently maintaining the
confidentiality of her private information. Based on those allegations, Z.D.
sought damages for emotional distress, loss of privacy, loss of income,
reputational damage, and cost of rent because she had to move out of her
fiancé’s home and rent her own apartment due to the strain the disclosure
of her diagnosis put on their relationship.

    Community moved for summary judgment on each of Z.D.’s claims,
raising the following arguments: (1) it was not the proximate cause of her
damages; (2) she could not recover emotional-distress damages in her
negligence claim due to the modified impact rule’s direct physical-impact
requirement; (3) her claim for negligent training, supervision, and
retention failed as a matter of law because the employee acted within the
scope of employment; and (4) to the extent she pled a claim for public
disclosure of private facts, the tort was not cognizable in Indiana but, even
if it was, Community negated the publicity element.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023    Page 3 of 18
   In response, Z.D. argued summary judgment was inappropriate. For
the negligence claims, Z.D. maintained an unresolved question of fact
remained as to whether Community was the proximate cause of her
alleged damages, and even if the modified impact rule applied, claims for
negligence-based medical privacy breaches should be exempt from its
application. Z.D. also argued that she properly raised a public-disclosure
claim, the tort is cognizable in Indiana, and Community did not negate the
publicity element.

  Following a hearing, the trial court granted summary judgment to
Community on each of Z.D.’s claims. The court found Community was
entitled to summary judgment on Z.D.’s claim for negligent training,
supervision, and retention because it was undisputed that the employee’s
misconduct arose within the scope of employment. The trial court then
reasoned that Z.D.’s remaining two claims, which it believed “seek to hold
Community liable for negligence, indirectly or directly,” failed as a matter
of law because (1) Z.D.’s emotional-distress damages were not recoverable
due to the modified impact rule; and (2) even if they were recoverable,
Community’s disclosure of her private information was not the proximate
cause of her alleged damages. The trial court did not address Z.D.’s
alleged pecuniary damages. And it also did not analyze Z.D.’s public-
disclosure claim because, in the court’s view, such a claim had not been
brought. Z.D. appealed, raising several issues.

   The Court of Appeals affirmed in part and reversed in part. Z.D. v.
Cmty. Health Network, Inc., 197 N.E.3d 330, 334 (Ind. Ct. App. 2022). It
affirmed the trial court’s grant of summary judgment on Z.D.’s claim for
negligent retention and supervision. Id. at 335–36. But it only partially
affirmed the court’s grant of summary judgment on Z.D.’s other
negligence claim, finding that although her emotional-distress damages
were not recoverable due to the modified impact rule, issues of fact
remained as to whether she could recover her alleged pecuniary damages
and whether Community was the proximate cause of those damages. Id. at
339–43. And finally, it reversed the court’s grant of summary judgment on
Z.D.’s claim for public disclosure of private facts, finding the claim
adequately pled and that Community did not negate the tort’s publicity
element. Id. at 336–39.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023   Page 4 of 18
  Both parties petitioned for transfer, which we granted, vacating the
Court of Appeals’ opinion. 1 Ind. Appellate Rule 58(A).

Standard of Review
   We review the trial court’s summary judgment decision de novo. U.S.
Automatic Sprinkler Corp. v. Erie Ins. Exch., 204 N.E.3d 215, 220 (Ind. 2023).
Community is entitled to summary judgment if the designated evidence
shows there is no genuine issue of material fact and that it is entitled to
judgment as a matter of law. See Ind. Trial Rule 56(C). A genuine issue of
material fact exists when there is “contrary evidence showing differing
accounts of the truth,” or when “conflicting reasonable inferences” may be
drawn from the parties’ consistent accounts and resolution of that conflict
will affect the outcome of a claim. Wilkes v. Celadon Grp., Inc., 177 N.E.3d
786, 789 (Ind. 2021); see also Lyons v. Richmond Cmty. Sch. Corp., 19 N.E.3d
254, 259 (Ind. 2014). To the extent we “have any doubts concerning the
existence of a genuine issue of material fact, we must resolve those doubts
in favor of the nonmoving party.” Reed v. Reid, 980 N.E.2d 277, 303 (Ind.
2012). Indeed, it is well settled that “Indiana consciously errs on the side
of letting marginal cases proceed to trial on the merits, rather than risk
short-circuiting meritorious claims.” Hughley v. State, 15 N.E.3d 1000, 1004
(Ind. 2014).

Discussion and Decision
  Tort law encompasses a “series of causes of action.” Kenneth S.
Abraham & G. Edward White, Conceptualizing Tort Law: The Continuous

1We summarily affirm the Court of Appeals’ following holdings: (1) Community is entitled to
summary judgment on Z.D.’s claim alleging Community is liable for its negligent training,
retention, and supervision of employees; (2) Z.D.’s allegations, particularly those found in
Count I of her complaint, pled all the facts necessary to support a public-disclosure claim; and
(3) Community failed to establish that “only a single inference or conclusion regarding
proximate cause and intervening cause could be drawn based on the designated evidence.”
See App. R. 58(A)(2); Z.D., 197 N.E.3d at 336, 338, 341–43.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023                    Page 5 of 18
(And Continuing) Struggle, 80 Md. L. Rev. 293, 343 (2021). Some are used
alternatively as “different means of obtaining the same relief for the same
harm,” while others are used independently to pursue recovery for
distinct harms or when “various theories of recovery require . . . differing
standards of conduct.” 1A C.J.S. Actions § 174 (2023). Though Z.D.’s two
claims before us—one alleging invasion of privacy premised on the public
disclosure of private facts and the other alleging negligence—stem from
the same general incident, each constitutes a separate cause of action.

  And here, these independent claims compel independent inquiries.
Z.D.’s public-disclosure claim requires us to consider whether
Community’s disclosure of her private information must be intentional,
whether damages for emotional distress are recoverable in the absence of
an intentional disclosure, and the precise contours of the tort’s publicity
element. Z.D.’s negligence claim requires a different consideration—
namely, whether to exempt negligence-based medical privacy breaches
from the modified impact rule’s physical-impact requirement.

   We first hold Community is not entitled to summary judgment on
Z.D.’s public-disclosure claim. In reaching that conclusion, we clarify that
plaintiffs can recover damages for emotional distress upon satisfying the
public-disclosure tort’s elements—none of which require a showing of
intentionality. And we further clarify that disclosure to one person can,
depending on the surrounding facts and circumstances, satisfy the tort’s
publicity element. We then hold Community is entitled to partial
summary judgment on Z.D.’s negligence claim. To that end, we decline to
exempt negligence-based medical privacy breaches from our modified
impact rule’s physical-impact requirement, entitling Community to
summary judgment on Z.D.’s negligence claim for her alleged emotional-
distress damages. But we find genuine issues of material fact remain as to
whether Z.D. can recover her alleged pecuniary damages and whether
Community was the proximate cause of those damages. We thus affirm in
part and reverse in part.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023   Page 6 of 18
I. Community is not entitled to summary judgment
   on Z.D.’s public-disclosure claim.
   As we explained last year, Hoosiers may seek relief through an
invasion of privacy claim premised on the public disclosure of private
facts when, like here, their private information is wrongly disclosed. Cmty.
Health Network, Inc. v. McKenzie, 185 N.E.3d 368, 380–82 (Ind. 2022).
However, this privacy tort is not designed to rectify all unauthorized
disclosures of private information. Instead, a public-disclosure claim is
actionable only upon satisfying four elements: the information disclosed
was private; the information was “communicated in a way that either
reaches or is sure to reach the public in general or a large enough number
of persons such that the matter is sure to become public knowledge”; the
information would be highly offensive to a reasonable person; and the
information was not of legitimate public concern. Id. at 382.

   Here, it is undisputed that Z.D. has satisfied three of these elements for
summary judgment purposes. Community disclosed Z.D.’s private health
information, the nature of that information would be highly offensive to a
reasonable person, and the information was not of legitimate public
concern. Yet, Community contends Z.D.’s claim fails as a matter of law for
three reasons: (1) the public-disclosure tort is an intentional tort, and there
is no genuine issue of material fact suggesting the disclosure of her private
information was intentional; (2) if the public-disclosure tort permits relief
for unintentional disclosures, her alleged emotional-distress damages are
barred by the modified impact rule; and (3) there is no genuine issue of
material fact that the disclosure was made to the public or was sure to
reach either the public in general or a large enough number of people such
that the information would become public knowledge. We disagree with
each contention.

    A. Indiana’s public-disclosure tort is not an intentional
       tort.
   In McKenzie, we “explicitly” adopted the elements of the public-
disclosure tort under the Restatement (Second) of Torts § 652D. 185 N.E.3d
at 382. And Section 652D’s plain language reveals that intent is not an

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023     Page 7 of 18
element. Restatement (Second) of Torts § 652D (Am. L. Inst. 1977); cf. id. §
652B (requiring intent as an element of the claim for invasion of privacy
by intrusion upon seclusion). Community acknowledges that “McKenzie
didn’t expressly state disclosure was an ‘intentional’ tort,” but it urges us
to recognize it as such now. We decline to do so for several reasons.

   Among courts that have addressed this issue, Community contends
“most courts” limit the availability of a public-disclosure claim to
intentional disclosures. To be sure, we oftentimes find how other
jurisdictions treat a particular issue instructive, especially when the issue
involves a state common law matter. See Automatic Sprinkler, 204 N.E.3d at
226. Our review reveals that only a handful of jurisdictions have directly
addressed whether a showing of intent is required; and they are, at most,
split on the issue. See, e.g., Doe v. Henry Ford Health Sys., 865 N.W.2d 915,
919–20 (Mich. Ct. App. 2014) (requiring a showing of intent). But see, e.g.,
Greenwood v. Taft, Stettinius & Hollister, 663 N.E.2d 1030, 1035 n.8 (Ohio Ct.
App. 1995) (following the Restatement, which does not require a showing
of intent). More tellingly, the states that require a showing of intent
provide no explanation or analysis for imposing this additional element.
See, e.g., Doe, 865 N.W.2d at 920 (summarily concluding that the tort
requires a showing of intent). We thus find little to no persuasive value in
following the few states that treat their public-disclosure tort as an
intentional tort.

   In our view, we find it more instructive to consider whether imposing
an intent requirement comports with the public-disclosure tort’s purpose.
As we observed in McKenzie, in our digital age, “private information is
more easily accessed and disseminated—particularly in ways that can
reach a large audience.” 185 N.E.3d at 381. Given that recognition, we
expressed that the public-disclosure tort “offers a meaningful way to deter
unauthorized disclosures of private information” and noted “when
deterrence or other preventative measures fail, it can provide victims with
meaningful redress.” Id. at 381–82. According to Community, this purpose
“is not served when the alleged disclosure was unintentional.” Amicus
curiae the Indiana Hospital Association likewise asserts it would be
“imprudent” to expose hospitals to liability for unintentional disclosures
because “there is already a clear and known regulatory structure,”

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023     Page 8 of 18
captured under federal law, to ensure private health information is
“appropriately protected.” We view the matter differently.

   The public-disclosure tort embodies dual imperatives, neither of which
are served by imposing an intent requirement. First, from individuals and
entities alike, the tort demands protection for private information. This
imperative is premised on the understanding that, although information
today is widely accessible and shareable, we need not abandon our
commitment to protecting privacy. To reinforce that commitment, the
public-disclosure tort serves to deter the unauthorized disclosure of
private information. Such deterrence may be achieved by implementing
protective measures, including enforcing privacy policies and security
systems, as well as through adhering to state and federal regulations
governing how private information is maintained. These measures foster
greater protection for private information, which, in turn, minimizes the
potential for liability stemming from an unauthorized disclosure. But, as
this case exemplifies, such measures may fall short.

   This reality leads to the second imperative: when failures occur, injured
individuals deserve a remedy. See Samuel D. Warren & Louis D. Brandeis,
The Right to Privacy, 4 Harv. L. Rev. 193, 213–15 (1890). Protective
measures may fail due to intentional exploitation but also due to reckless
or negligent conduct. Whatever the source, once a private matter becomes
public knowledge, the prospect of injury is not only real and foreseeable
but also personal. And, importantly, unlike sources of federal and state
law governing regulation of private information, the public-disclosure tort
affords individuals the opportunity to pursue relief for their damages. See
Joshua D.W. Collins, Toothless HIPAA: Searching for a Private Right of Action
to Remedy Privacy Rule Violations, 60 Vand. L. Rev. 199, 201–02, 224–25
(2007). Neither the prospect nor magnitude of harm depends on whether
the disclosure was intentional or not—it merely depends on the nature of
the matter disclosed and the magnitude of the disclosure. We thus find no
basis for limiting the availability of the public-disclosure tort to only
intentional disclosures of private information.

   At the same time, we are mindful that seamless access to private
information in the healthcare industry facilitates the efficacy of medical

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023    Page 9 of 18
care. But as we cautioned last year, this access comes with “great
responsibility.” McKenzie, 185 N.E.3d at 373. Hoosiers’ private information
warrants protection from intentional exploitation and inadvertent
exposure alike. Accordingly, individuals and entities, including healthcare
providers, must do their part to safeguard private information. If they do,
their potential for liability is greatly minimized; but if they don’t, and the
four elements of the public-disclosure tort are met, affected individuals
deserve to be made whole and reclaim the inherent value of their privacy.
So, because Z.D. was not required to allege that Community’s wrongful
disclosure of her private information was intentional, Community is not
entitled to summary judgment on that basis. We now turn to
Community’s second argument as to why it is entitled to summary
judgment.

   B. Recovery for emotional distress is available in a public-
      disclosure claim.
   Under our common law, certain damages may not be recoverable in
certain tort claims. See, e.g., Residences at Ivy Quad Unit Owners Ass’n v. Ivy
Quad Dev., LLC, 179 N.E.3d 977, 983 (Ind. 2022) (explaining that recovery
for economic loss is generally unavailable in a negligence action due to
Indiana’s economic loss doctrine). This limiting principle is especially true
when a plaintiff seeks to recover emotional-distress damages in a
negligence action, which triggers our modified impact rule. In relevant
part, that rule precludes such recovery unless the plaintiff sustains a
“direct physical impact” from the alleged negligence. Spangler v. Bechtel,
958 N.E.2d 458, 466–67 (Ind. 2011). Community acknowledges a public-
disclosure claim is distinct from a negligence claim and concedes that, in
light of the Restatement (Second) of Torts § 652H, the former explicitly
permits recovery for emotional-distress damages. But Community
suggests the modified impact rule should apply if, as we concluded
above, the public-disclosure tort permits recovery for unintentional
disclosures. We disagree.

   A public-disclosure claim is not a negligence claim, and it does not
transform into one merely because a negligent act or omission occurs.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023     Page 10 of 18
Compare Restatement (Second) of Torts §§ 297–309 (characterizing the
types of negligent acts), with Restatement (Second) of Torts § 652A
(characterizing the types of invasions of privacy). Accordingly, the
modified impact rule straightforwardly does not apply to public-
disclosure claims. And this makes sense, as “the impact doctrine . . .
generally is inapplicable to recognized torts in which damages often are
predominantly emotional, such as defamation or invasion of privacy.”
Kush v. Lloyd, 616 So. 2d 415, 422 (Fla. 1992). In the context of a public-
disclosure claim, it is inherently plausible—if not inevitable—the affected
individual will suffer emotional distress when their intimate details are
shared with the public. As noted above, this sentiment is explicitly
embodied in Section 652H, which provides that plaintiffs who prevail in a
public-disclosure claim can recover various damages, including those “for
emotional distress.” Restatement (Second) of Torts § 652H cmt. b.

   We clarify that, upon satisfying the public-disclosure tort’s elements,
plaintiffs may recover emotional-distress damages. Thus, Community is
not entitled to summary judgment on Z.D.’s public-disclosure claim on
the grounds that she is barred from recovering these damages. We now
turn to Community’s final argument as to why it is entitled to summary
judgment.

   C. Community has not negated the publicity element of
      Z.D.’s public-disclosure claim.
   In McKenzie, we adopted the publicity element of the public-disclosure
tort as articulated in the Restatement (Second) of Torts § 652D. 185 N.E.3d
at 382. A matter is given unreasonable publicity when it is “made public,
by communicating it to the public at large, or to so many persons that the
matter must be regarded as substantially certain to become one of public
knowledge.” Restatement (Second) of Torts § 652D cmt. a. Notably,
Section 652D emphasizes the distinction between publication and
publicity, explaining the “difference is not one of the means of
communication, which may be oral, written or by any other means” but
rather “one of a communication that reaches, or is sure to reach, the
public.” Id.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023   Page 11 of 18
   Community contends it has negated the publicity element because its
employee disclosed Z.D.’s private information to only one individual. But
Z.D. maintains the dispositive consideration is the “end result” of that
disclosure—not necessarily the reach of the initial disclosure. Both
perspectives miss the mark. And, ultimately, resolution of this issue turns
on our standard of review.

   To be entitled to summary judgment, Community must demonstrate
the absence of any genuine issue of material fact that it communicated
Z.D.’s information in a way that (1) did not reach the public or a large
number of people such that the matter was sure to become public
knowledge; and (2) was not sure—that is, not probable—to reach the
public or a large number of people such that the matter was sure to
become public knowledge.

   Citing McKenzie, Community asserts it has negated the publicity
element because “disclosure to one person simply is not actionable as a
matter of law.” Community is mistaken. Indeed, we recognized in
McKenzie that “[t]he facts and circumstances of each case must be taken
into consideration in determining whether the communication gave
sufficient ‘publicity’ to support a public-disclosure claim.” 185 N.E.3d at
382. And while we observed that “communication to a small group of
persons is generally not actionable,” we held the particular claim in that
case failed because the record was “devoid of evidence” the information
was disclosed “to, or in a way that was sure to reach, the public or a large
number of people.” Id. at 383 (emphasis added). Thus, contrary to
Community’s assertion, disclosure to one person may, based on the facts
and circumstances in a particular case, satisfy the publicity element. See id.
at 382; see also Karch v. BayBank FSB, 794 A.2d 763, 774 (N.H. 2002);
Shattuck-Owen v. Snowbird Corp., 16 P.3d 555, 559 (Utah 2000); Robert C.
Ozer, P.C. v. Borquez, 940 P.2d 371, 377 n.7 (Colo. 1997).

   Here, the undisputed evidence reveals the misaddressed envelope
containing Z.D.’s private information was limited, reaching only
Kendrick’s household. Accordingly, Community has demonstrated as a
matter of law the disclosure itself did not reach the public. But this finding
is not dispositive of whether Community demonstrated the disclosure

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023    Page 12 of 18
was not communicated in a way that it would reach a large enough
number of people such that the information was sure to become public
knowledge. Making that determination requires inquiry into the
designated evidence related to the employee’s disclosure, including the
medium used to communicate the information and any details probative
of a relationship between Community’s employee, Kendrick, and Z.D. See
David A. Elder, Privacy Torts § 3.3 (2022) (“The cases uniformly hold that
the publicity requirement is met only if said publicization is attributable to
the defendant—i.e., defendant must have caused, precipitated or
permitted the publicity.”)

   Community points to evidence indicating that, apart from this incident,
Z.D. has no connection to Kendrick. Community further highlights
evidence revealing that Z.D. believed someone made a “mistake” in
misaddressing the letter. But a full review of this record reveals that
conflicting inferences can be drawn as to whether Z.D.’s information was
communicated in such a way that it was sure to become public
knowledge.

   Community’s employee not only misaddressed the envelope
containing Z.D.’s private health information, but she handwrote the
address. Though doing so could have been quite simple, Community
designated no evidence establishing the employee was completely
unconnected to Z.D. or Kendrick, or that addressing an envelope in
handwriting is consistent with ordinary practices at the hospital. Further,
the employee did not address and send Z.D.’s private information to a
complete stranger to Z.D.’s family; it was sent to Kendrick, a teenager who
either attended or had recently attended the same high school as Z.D.’s
daughter. The teens were also Facebook friends, and Kendrick even
attempted to “tag” Z.D. in her Facebook post. Again, Community
designated no evidence establishing that its employee was wholly
unaware of these connections or that Kendrick was wholly unfamiliar
with Z.D. Simply put, without any evidence providing insight into the
employee’s or Kendrick’s actions, we simply do not know if the
misaddressed envelope was merely accidental or rather oriented (if not
orchestrated) for further dissemination—both inferences are plausible on
this record.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023   Page 13 of 18
   When, as here, a private matter is disclosed to the wrong person, the
mere possibility that the information can be given unwanted and
unreasonable publicity does not necessarily render it sure to become
public knowledge. But at the summary judgment stage, we must construe
all inferences and doubts as to material factual issues in a manner
favorable to the nonmovant, which is Z.D. And in doing so, we find the
record supports conflicting inferences as to whether Community’s
disclosure of Z.D.’s private health information to Kendrick was
communicated in a way that it would reach a large enough number of
people such that it was sure to become public knowledge. As a result,
Community is not entitled to summary judgment on Z.D.’s public-
disclosure claim.

  We now turn to whether Community is entitled to summary judgment
on Z.D.’s negligence claim, which demands a separate inquiry.

II. Community is entitled to partial summary
    judgment on Z.D.’s negligence claim.
   For decades, the impact doctrine controlled whether a plaintiff could
recover damages for emotional distress in a negligence action. See
Shuamber v. Henderson, 579 N.E.2d 452, 454 (Ind. 1991). Under this
doctrine, a plaintiff could recover emotional-distress damages only when
their distress was accompanied by and resulted from a physical injury
caused by an impact. Id. We later “modified” the impact doctrine by
discarding the physical-injury requirement. Id. at 456. Under our modified
impact rule, a plaintiff may recover damages for emotional distress if they
sustain a “direct physical impact” from the negligence. See, e.g., Atl. Coast
Airlines v. Cook, 857 N.E.2d 989, 991, 996 (Ind. 2006).

   Community contends that because Z.D. did not sustain a direct
physical impact from its alleged negligent handling of her private health
information, the modified impact rule bars her from recovering
emotional-distress damages. Mindful of the modified impact rule, Z.D.
urges us to altogether exempt negligence-based medical privacy breaches
from the rule’s physical-impact requirement. We decline to do so. In
reaching that conclusion, we consider the purpose of imposing this

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023   Page 14 of 18
requirement under our common law. See Automatic Sprinkler, 204 N.E.3d at
225. And we then consider whether “new conditions have emerged” that
undermine the purpose of this requirement as applied in the context of
medical-privacy breaches. Id.

   The physical-impact requirement is neither arbitrary nor terribly
austere. See Atl. Coast, 857 N.E.2d at 996. Indeed, it is not uncommon for
plaintiffs to recover emotional-distress damages following negligent acts
or omissions. Bader v. Johnson, 732 N.E.2d 1212, 1221–22 (Ind. 2000)
(collecting cases). But emotional distress is not a natural or foreseeable
consequence of all negligent acts and omissions. Premised on this
recognition, the physical-impact requirement properly limits recovery of
such damages to situations when there is a direct, but also physical, nexus
between the negligence and the resulting distress—this way, the distress is
readily ascertainable. And physical impacts of a “slight” or even a
“tenuous” nature can satisfy this requirement. Id.; cf. Munsell v. Hambright,
776 N.E.2d 1272, 1280 (Ind. Ct. App. 2002), trans. denied. Ultimately,
whether a particular physical impact will suffice depends on the facts and
circumstances of a particular case. See Atl. Coast, 857 N.E.2d at 996
(collecting cases).

   Absent incidents of medical malpractice, see, e.g., Keim v. Potter, 783
N.E.2d 731, 735 (Ind. Ct. App. 2003), which did not occur here, Z.D. fairly
observes that patients will rarely, if ever, sustain a direct physical impact
from the mishandling of their private health information. Yet, exempting a
general class of negligent conduct from the physical-impact requirement
presupposes emotional distress is a readily foreseeable and ascertainable
consequence of that conduct. And we simply find no basis for reaching
such a conclusion under these circumstances. Not all private health
information is alike. Some reveals intimate moments about one’s life;
others, however, are innocuous and mundane. Accordingly, the likelihood
that a patient will suffer emotional distress following the mere
mishandling of private information—standing alone—is, at best,
uncertain.

   At the same time, we share Z.D.’s sentiment that because private health
information is entitled to protection, healthcare providers must do their

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023   Page 15 of 18
part to enforce security measures that prevent breaches. And we also
recognize technological innovations implemented in the healthcare
industry have facilitated increased access to and the sharing of private
health information, further implicating its protected status. But, in our
view, the foreseeability and legitimacy of emotional distress following the
negligent maintenance of private information fundamentally depends on
the nature of the information involved and the magnitude of the
mishandling. And, as discussed above, our tort law provides a path for
recovery under such heightened circumstances through a public-
disclosure claim.

   A negligence action is not the superior path for rectifying an invasion of
privacy—an invasion of privacy claim is. And Z.D.’s request that we
exempt an entire category of negligent conduct from the rule’s physical-
impact requirement would not only perpetuate conflation of distinct
claims for relief but also effectively nullify the crucial function the public-
disclosure tort plays under our common law. Indeed, this tort
incorporates certain, necessary restraints, particularly the highly offensive
and publicity elements, to provide relief to those who suffer an invasion of
privacy without exposing individuals and entities to inordinate liability
each time someone’s privacy is compromised. By contrast, general
negligence-based claims incorporate no such restraints. So, if we granted
Z.D.’s request, plaintiffs could seek emotional-distress damages following
any breach or disclosure of private information—irrespective of both the
magnitude of the disclosure and the relative sensitivity of the information
disclosed. In all, Z.D.’s concerns are well taken, but they are better suited
for the General Assembly’s deliberation.

   In short, plaintiffs like Z.D. may assert negligence-based claims when
their private information is mishandled, but the modified impact rule
precludes recovery for emotional distress unless the plaintiff sustained a
direct physical impact from the negligence. Here, the designated evidence
reveals Z.D. suffered emotional distress as a result of Community’s
alleged failure to maintain the confidentiality of her private information.
Because this alleged negligence did not produce a direct physical impact,
the modified impact rule precludes Z.D. from recovering emotional-
distress damages.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023    Page 16 of 18
   But Z.D. also seeks recovery for loss of income and rental expenses,
which are pecuniary damages—not emotional-distress damages. 2 The trial
court did not address these damages in rendering its judgment, and
Community does not designate any evidence demonstrating that Z.D. is
barred from recovering them. For this reason and because genuine issues
of material fact remain as to whether Community was the proximate
cause of these damages, Community is entitled to only partial summary
judgment on Z.D.’s negligence claim.

Conclusion
   Community is not entitled to summary judgment on Z.D.’s public-
disclosure claim because it has not negated the publicity element.
However, Community is entitled to partial summary judgment on Z.D.’s
negligence claim. Though Z.D. cannot recover emotional-distress damages
resulting from Community’s alleged negligence due to the modified
impact rule, genuine issues of material fact remain regarding whether she
can recover her alleged pecuniary damages and whether Community was
the proximate cause of those damages. We therefore affirm in part, reverse
in part, and remand for proceedings consistent with this opinion. 3

Massa and Goff, JJ., concur.
Slaughter, J., concurs in part and dissents in part with separate
opinion.
Molter, J., not participating.

2Aside from these damages, Z.D. additionally seeks to recover for loss of privacy in her
negligence action and contends these damages are distinct from emotional-distress damages.
But the record confirms Z.D.’s alleged loss of privacy is indistinguishable from emotional
distress, as she equates her loss of privacy with an “emotional injur[y]” that resulted in
“depression.”
3We thank amici—Indiana Legal Foundation, Defense Trial Counsel of Indiana, and Indiana
Hospital Association—for their helpful briefs.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023               Page 17 of 18
ATTORNEYS FOR APPELLANT
Neal F. Eggeson, Jr.
Eggeson Privacy Law
Fishers, Indiana

Bradley C. Lohmeier
Lohmeier Law LLC
Indianapolis, Indiana

ATTORNEYS FOR APPELLEE
Jenny R. Buchheit
Sean T. Dewey
Alexandria H. Pittman
Ice Miller LLP
Indianapolis, Indiana

ATTORNEYS FOR AMICUS CURIAE INDIANA LEGAL
FOUNDATION, INC.
Bryan H. Babb
Seema R. Shah
Bose McKinney & Evans LLP
Indianapolis, Indiana

ATTORNEYS FOR AMICUS CURIAE DEFENSE TRIAL COUNSEL OF
INDIANA
Peter H. Pogue
Michael F. Mullen
Schultz & Pogue LLC
Indianapolis, Indiana

Lucy R. Dollens
Quarles & Brady LLP
Indianapolis, Indiana

ATTORNEYS FOR AMICUS CURIAE INDIANA HOSPITAL
ASSOCIATION
Andrew B. Howk
Angela M. Smith
Matthew M. Schappa
Hall Render Killian Heath & Lyman
Indianapolis, Indiana

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023   Page 18 of 18
Slaughter, J., concurring in part, dissenting in part.

    I concur with Part II of the Court’s opinion, which affirms partial
summary judgment for Community Health Network on Z.D.’s negligence
claim. I agree that our modified-impact rule prevents Z.D. from
recovering emotional-distress damages, but that her claim remains for
pecuniary damages.

   In contrast to Part II, I respectfully dissent from Part I, which holds
that Z.D. survives summary judgment on her public-disclosure claim. I
would affirm the trial court’s grant of summary judgment for Community
on this claim because Z.D. fails the claim’s publicity element. Last year, in
Community Health Network, Inc. v. McKenzie, 185 N.E.3d 368 (Ind. 2022), we
expressly adopted section 652D of the Second Restatement of Torts. Id. at
382. That section establishes four elements to the disclosure tort, one of
which is publicity. Ibid. The Restatement defines publicity as the
dissemination of information in a way that “the matter is made public, by
communicating it to the public at large, or to so many persons that the
matter must be regarded as substantially certain to become one of public
knowledge.” Restatement (Second) of Torts § 652D cmt. a (1977).

     The Court today reaffirms McKenzie’s adoption of section 652D. But it
holds that communication to just one person may still amount to publicity
if it is sure to reach the public or many people. Ante, at 12. Respectfully,
the Court misapplies McKenzie and the Restatement. Under these
authorities, Community’s transmission, by letter, of Z.D.’s medical
information to one wrong addressee was not “to the public at large, or to
so many persons” that the transmission itself can be blamed for her
information becoming “public knowledge”. The transmission of Z.D.’s
confidential information, by mail, to a single recipient does not amount to
publicity as a matter of law. On this record, I would affirm the trial court’s
judgment.

    For these reasons, I concur in part and dissent in part.

Indiana Supreme Court | Case No. 23S-CT-116 | September 25, 2023     Page 1 of 1