Yath v. Fairview Clinics, N.P.

Brief Fact Summary.

The Plaintiff, Candace Yath, went to the Fairview Cedar Ridge Clinic (Fairview) (Defendant) for a medical appointment so she could be tested for sexually transmitted diseases.  Navy Tek (Defendant) was the medical assistant who saw Plaintiff at the clinic and was related to Plaintiff’s husband.  Defendant read Plaintiff’s medical file and learned that she had a sexually transmitted disease and a new sex partner other than her husband.  Defendant shared this information with another employee who then shared it with others, including Plaintiff’s husband, who she was separated from.  Someone then created a MySpace.com webpage posting the information on the Internet.  Under various legal theories, Plaintiff brought suit against Defendant and the persons allegedly involved.

Synopsis of Rule of Law.

(1)  An Internet posting of private, personal medical information on a social media website constitutes “publicity” for the purposes of an invasion of privacy action. (2)  A state statute that authorizes a private action for the improper release of medical records is not preempted by the federal Health Insurance Portability and Accountability Act.

Facts.

Candace Yath (Plaintiff) was a patient at Fairview Cedar Ridge Clinic (Defendant) where she went for an appointment.  She told the doctor she had a new sex partner and wanted to be tested for sexually transmitted diseases.  In violation of Fairview’s (Defendant) policy, Navy Tek (Defendant), a medical assistant employed at Fairview and related to Plaintiff’s husband, read Plaintiff’s file and found out Plaintiff’s appointment was to be screened for sexually transmitted diseases because of having a new sex partner, and that she was afterward diagnosed with a sexually transmitted disease.  Tek (Defendant) then sent an e-mail to Net Phat (Defendant) who was related to both Tek (Defendant) and Plaintiff by marriage, and who worked at Fairview as a medical records coder.  With no authorization, Phat (Defendant) used her position to gain access to Plaintiff’s medical record and then shared the information with others, including Plaintiff’s husband, who she was separated from.
  When Plaintiff learned that Tek (Defendant) had read her medical file and also shared the information with Phat (Defendant), she contacted the hospital (Defendant), which conducted an investigation.  The results confirmed both the wrongful access to Plaintiff’s medical file and the disclosure that followed of her personal information.  Eventually it was discovered that Tek’s (Defendant) sister, Molyka Mao (Defendant), had created a disparaging Internet webpage at MySpace.com using the name “Rotten Candy” with information posted that Tek (Defendant) obtained from Plaintiff’s medical file.  A photograph of Plaintiff was included on the webpage which stated that “Rotten Candy” has a sexually transmitted disease, that she recently cheated on her husband, and that she was addicted to plastic surgery.  The page listed six “friends” which indicated at least those six people had viewed the page.
  Plaintiff sued Defendants Tek, Mao, Phat and Fairview on a variety of theories.  She sued all of them directly for invasion of her privacy and all except Mao for breach of a confidential relationship.  She sued Defendants Tek, Mao and Phat for intentional infliction of emotional distress.  Plaintiff sued Fairview for negligent infliction of emotional stress.  In addition, she sued all the defendants directly for violating a state statute when they disclosed information obtained from her medical file.  Eventually, the district court granted summary judgment in the defendant’s favor, specifically on the issues of invasion of privacy and whether the state statute was preempted by the Health Insurance Portability and Accountability Act (HIPAA).

Issue.

(1)  Does an Internet posting of private, personal medical information on a social media website, constitute “publicity” for the purposes of an invasion of privacy action? (2)  Is a state statute that authorizes a private action for the improper release of medical records preempted by the federal Health Insurance Portability and Accountability Act?

Held.

(Ross, J.)  (1)  Yes.  An Internet posting of private, personal medical information on a social media website, constitutes “publicity” for the purposes of an invasion of privacy action. The tort of invasion of privacy is recognized by the court on three alternative theories:  intrusion of seclusion, appropriation of a name or likeness of another, and publication of private facts.  Plaintiff’s invasion-of-publicity claim is based on the publication of private facts, so the claim can only survive summary judgment if there is evidence in the record that (1) a defendant gave “publicity” to a matter concerning Plaintiff’s private life, (2) the publicity of the private information would be highly offensive to a reasonable person, and (3) the matter is not of legitimate concern to the public.  Plaintiff was unable to prove that a sufficient number of people had seen the webpage, and therefore the district court held that her private information was not given “publicity” within the meaning of the tort of invasion of privacy.  A different legal conclusion is reached by this court.  In an invasion of privacy claim, the publicity element is satisfied when private information is posted on an Internet website that is accessible by the public.  Plaintiff’s information posted on the MySpace.com webpage survives the “publicity” challenge.  The reasoning that led the court to hold the position that posting information on a publicly accessible webpage constitutes publicity is not eroded by the fact that the Internet immensely increases both the amount of information available to the public and the number of sources offering information.  It is a fact that mass communication is no longer limited to a small handful of commercial vendors and that we live with much greater access to information than in the era when the tort of invasion of privacy developed.  This astonishing advancement in communication argues for, not against, a holding that the posting on MySpace.com constitutes publicity.  While some public webpages may not get much attention, the unrestricted MySpace.com webpage posting likewise constitutes publicity.  Plaintiff’s claim of invasion of privacy fails because she did not succeed in producing any evidence on an essential element of her claim, specifically that any of the defendants that survived on appeal were involved in creating or sustaining the disparaging MySpace.com webpage.  Affirmed.
(2)  No.  A state statute that authorizes a private action for the improper release of medical records is not preempted by the federal Health Insurance Portability and Accountability Act (HIPPA).  Fairview (Defendant) argued that the state statute section is “contrary” to HIPAA because the section provides for a private cause of action for the wrongful disclosure of a person’s medical records, but HIPAA does not.  However, just because a distinction exists, does not make the state statute provision “contrary” to HIPAA.  A state law is “contrary” to HIPAA if a health care provider “would find it impossible to comply with both the state and federal requirements” or if the state law is “an obstacle to the accomplishment and execution of the full purposes” of HIPAA.  [45 C.F.R. § 160.202.]  It would not be impossible for Fairview (Defendant) or Phat (Defendant) to comply with both HIPAA and the state statute section because both laws, in complementary rather than contradictory fashion, discourage a person from wrongfully disclosing information obtained from another person’s health record.  Both laws have similar goals.  Both laws protect the privacy of an individual’s health care information.  The difference in remedy is functional only, in that a HIPAA violation makes a person subject to criminal penalties while the state statute section exposes a person to compensatory damages in a civil action.  Although under the two laws the penalties are different, compliance with the state statute section does not exclude compliance with HIPAA.
  The state statute section also is not “an obstacle to the accomplishment and execution of the full purposes” of HIPAA.  The stated purpose of HIPAA is to improve the Medicare and Medicaid programs and “the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.”  To accomplish that purpose, entities that maintain or transmit health care information are required by HIPAA to establish safeguards “to ensure the integrity and confidentiality” of a person’s health care information and “to protect against any reasonably anticipated unauthorized uses or disclosures of the information.”  [42 U.S.C. § 1320d-2(d)(2).]  If a person wrongfully discloses health care information, that person may be subject to criminal penalties including fines or imprisonment.  Instead of creating an “obstacle” to HIPPA, the state statute section supports at least one of HIPAA’s goals by establishing another reason not to wrongfully disclose a patient’s health care record.  The state statute section is not a contrary state law preempted by HIPAA.  The district court’s preemption decision is reversed and remanded.

Discussion.

Contrary to arguments of the defendants, the posting of personal private medical information on an Internet website is sufficient for the “publicity” prong of the invasion of privacy test, no matter how limited the site or webpage may be.  Similarly, the trial court erred in that the state medical privacy statute was not preempted by HIPPA, which permitted another cause of action for unlawful disclosure of personal information.  Although Plaintiff failed for other reasons, by giving her an avenue to continue her cause of action for the outrageous conduct of the hospital employees and others, the right of privacy and the ability to bring private actions for disclosure was upheld.