Walgreens, pharmacist liable for HIPAA violation

An Indiana appeals court recently upheld a $1.4 million verdict against Walgreens and one of its pharmacists who shared a customer’s confidential medical information.

According to published reports, pharmacist Audra Withers accessed the medical records of a female customer who had a child with Withers' husband. She admitted sharing that information with her husband and at least three other people.

Click Here to See What a Texas Hospital is Doing to Reduce Medication Errors

After the customer complained to Walgreens, Withers received a written warning and was ordered to retake a Health Insurance Portability and Accountability Act (HIPAA) training program.

In 2013, a Florida jury awarded the customer $1.44 million; despite Walgreens’ contention that Withers willfully violated company policy and should be solely responsible for the HIPAA breach.

According to Indianapolis attorney Neal F. Eggeson Jr., who represented the customer, the order is the first appellate court decision in which a healthcare provider was held liable for HIPAA violations committed by an employee.

"By choosing to appeal, Walgreens has now created a precedent ... confirming that privacy breach victims may hold employers accountable for the HIPAA violations of their employees," Eggeson told the Indianapolis Star.

A Walgreens spokesperson, James W. Graham, said the company plans to appeal the decision. "The pharmacist in this case admitted she was aware of our strict privacy policy and knew she was violating it," Graham said. "We believe it is a misapplication of the law to hold an employer liable for the actions of one employee who knowingly violates company policy. We intend to appeal the ruling.” 

Correction: The original version of this story gave wrong information. The pharmacists' husband fathered a child with a female customer.