A HIPAA violation, a $1.8 million verdict, and three takeaways

Ken BakerThe second tenet of the APhA Code of Ethics states, “A pharmacist promotes the good of every patient in a caring, compassionate, and confidential manner.” It sounds easy. It evokes an immediate response from each pharmacist and pharmacy technician: “I wouldn’t violate that, no matter what.”

But a pharmacist in Indiana admitted that that’s what she did, when she obtained access to a patient’s confidential information. The records the pharmacist opened were those of the former girlfriend of the pharmacist’s husband. The former girlfriend had a child. She claimed that the pharmacist’s husband was the father. and she was demanding that he pay child support. The pharmacist denied that she gave her husband the patient records, but apparently he knew their contents, as evidenced by e-mails he sent to the former girlfriend.¹

The former girlfriend sued the pharmacist and the pharmacy chain. After a jury trial, a verdict for the former girlfriend was entered for $1.8 million. The jury found that the pharmacy chain and the pharmacist were jointly responsible for 80% of the verdict, and the pharmacist’s husband was responsible for the remaining 20%.

See also: The ethical virtues of loyalty and trustworthiness in pharmacy

Lawsuit and verdict

The pharmacy chain appealed to the Indiana Court of Appeals, saying that it should not be held responsible. The pharmacy’s argument amounted to a demand that the pharmacist alone should be responsible for $1.44 million.

Normally, a company is responsible for the acts of its employees under the legal doctrine of “Respondeat superior” (“Let the master answer”), meaning that the master is responsible for injuries caused by the servant. There are exceptions, however, and these were the basis of the pharmacy chain’s appeal. The pharmacist, the pharmacy argued, was doing something she was forbidden to do by law and company rules.¹

The Court of Appeals did not agree with the pharmacy’s argument and upheld the lower court verdict against both the pharmacist and the pharmacy jointly.¹ The pharmacy can appeal to the Indiana Supreme Court to reverse this judgment, and we may see a new final chapter.

See also: Professional liability insurance: A short primer

Lessons to consider

Even before the Indiana Supreme Court gives a final verdict, there are three lessons we should consider.

The first is obvious. Pharmacists and pharmacy technicians are professionals, sworn to uphold their legal and ethical duties. Regardless of external factors and personal need, the patient’s rights must remain paramount. Legally and ethically, a patient’s records may be used only for the benefit of the patient.

Second, a HIPAA violation may amount to malpractice. A violation can be as dangerous and as costly as a misfilled prescription. Under federal law, patients cannot directly sue under HIPAA. There is no “right of private action” by the law. HIPAA can, however, be evidence of the pharmacist’s standard of practice. A violation of HIPAA is negligence and may be used to establish duty. Violation of duty along, with an injury caused by that violation, may amount to malpractice.

Third, if the pharmacy chain prevails on the question of the exception to the employer’s vicarious liability, the pharmacist will owe the entire amount of the verdict. An individual professional liability policy, which is always secondary to the employer’s insurance, may make the difference between a paid judgment and bankruptcy for any pharmacist or technician involved. An individual policy is often called a “just-in-case policy” for a reason.²

Endnotes

1. Walgreen v Hinchy, 21 NE 3d 99, (Ind. Ct. Appeals 2014). Also see Indianapolis Star online, “$1.44 M HIPAA award upheld after Walgreen pharmacist shared patient data,” Nov 17, 2014. http://bit.ly/dataverdict, accessed 5/5/2015.

2.The reader should know that the author of this article is a former general counsel and senior vice president of Pharmacists Mutual Insurance Company, which writes and sells individual professional liability policies. He is now retired from Pharmacists Mutual, but continues to consult with the company.