• Lack of Infrastructure - During any 90 day period from January 1, 2013 to July 1, 2014 (the beginning of the year that is 2 years before the payment adjustment year to July 1 of the year preceding the payment adjustment year), the EP was located in an area without sufficient Internet access to comply with the Meaningful Use objectives requiring Internet connectivity, and faced insurmountable barriers to obtaining such Internet connectivity.
  

• Unforeseen and/or Uncontrollable Circumstances - During the 1 or 2 calendar years (2013 and 2014) preceding the payment adjustment year (2015), the EP faced extreme and uncontrollable circumstances that prevented the EP from becoming a meaningful EHR user. Some of these circumstances include:

• Weather disaster
• Unable to obtain data necessary to attest to Meaningful Use because the medical practice closed or otherwise went out of business
• Bankruptcy or debt restructuring
  

• Lack of control over the availability of Certified EHR Technology - EPs who had difficulty in meeting Meaningful Use during the period that begins 2 calendar years before the payment adjustment year through the Application deadline (January 1, 2013 -July 1, 2014) must demonstrate that:

• EP practices at multiple locations, and
  
• is unable to control the availability of Certified EHR Technology at one such practice location or a combination of practice locations, and
  
• where the location or locations constitute more than 50 percent of patient encounters.

• Lack of Face-to-Face Interaction - EPs who had difficulty in meeting Meaningful Use during the period that begins 2 calendar years before the payment adjustment year through the Application deadline (January 1, 2013 -July 1, 2014). 

• This exception is only available if the EP can demonstrate: (1) lack of face to face interactions, and (2) lack of need to follow up with patients.

• The EP must demonstrate (a) either a complete lack of face-to-face interactions and follow-up or (b) that the cases of face-to-face interaction and follow-up are extremely rare and not part of normal scope of practice for that EP.
  

• 2014 EHR Vendor Issues - During the fiscal year (2014) preceding the payment adjustment year (2015), the EP's EHR vendor was unable to obtain 2014 certification or the EP was unable to implement Meaningful Use due to 2014 EHR certification delays.
  

• EPs that successfully met Meaningful Use in 2013 will be excluded from the payment adjustment and do not need to submit a Hardship Exception Application for Payment Year 2015.

• Providers that are classified in the Medicare Provider Enrollment, Chain and Ownership System (PECOS) as having one of the following 5 specialty codes as their primary area of practice DO NOT need to submit the application because they will be granted a Hardship Exception and are automatically exempt from the 2015 payment adjustment based on the data in PECOS:

• Diagnostic Radiology (30)
• Nuclear Medicine (36)
• Interventional Radiology (94)
• Anesthesiology(05)
• Pathology (22) 

• New EPs enrolling in the Medicare program, DO NOT need to submit the application because they will be granted a Hardship Exception and are automatically exempt from the 2015 payment adjustment based on the data in PECOS.

• Hospital-based EPs for 2012 or 2013, DO NOT need to submit the application because they will be granted a Hardship Exception and are automatically exempt from the 2015 payment adjustment based on the data in PECOS.

During this [2006 - 2010] period, Hinchy filled all of her prescriptions, including oral birth control pills, at a Walgreen pharmacy. At some point in 2009, Peterson began dating Walgreen pharmacist Audra Withers. In August 2009, Hinchy became pregnant with Peterson's child. On an unknown date, Peterson learned that he had contracted genital herpes. Hinchy gave birth to a son on May 22, 2010.

At some point during the week of May 26, 2010, Peterson mailed a letter to Withers informing her about the baby and about the possibility that he may have exposed her to genital herpes. Withers became terrified about the possibility of contracting a sexually transmitted disease. Consequently, during her shift and while at work, Withers looked up Hinchy's prescription profile in the Walgreen computer system to see if she could find any information about Hinchy's sexually transmitted disease. The next day, Withers again looked up Hinchy's profile to confirm that she had spelled it correctly the day before.[4]

When Withers was confronted about the situation, she admitted that she had accessed Hinchy's prescription profile for personal reasons. On April 15, 2011, Loss Prevention Detective Michael Bryant confirmed to Hinchy that (1) a HIPAA/privacy violation had occurred, (2) Withers had viewed Hinchy's prescription information without consent and for personal purposes, and (3) Walgreen could not confirm that Withers had revealed that information to a third party. As a result of Walgreen's investigation, Withers received a written warning and was required to retake a computer training program regarding HIPAA.[6]

Ms. Hinchy filed suit against both Walgreens and Ms. Withers on August 1, 2011. Against Ms. Withers, Ms. Hinchy filed claims of:

(1) negligence/professional malpractice,
(2) invasion of privacy/public disclosure of private facts, and
(3) invasion of privacy/intrusion.

Against Walgreens, Ms. Hinchy filed claims:

(1) seeking liability for the counts she filed against Withers by way of respondeat superior,
(2) direct claims for:
(a) negligent training,
(b) negligent supervision,
(c) negligent retention, and
(d) negligence/professional malpractice.

Walgreens appealed the jury verdict on a number of grounds, but this discussion will only focus on the Appellate Court's discussion of the underlying liability, the respondeat superior claim, and the amount of damages.

Underlying Liability

The Appellate Court first looked at "the tort of negligence by virtue of professional malpractice of a pharmacist. Negligence is comprised of three elements: (1) a duty on the part of the defendant to the plaintiff; (2) a breach of that duty; and (3) an injury to the plaintiff resulting from the breach."[7] The Court found that Ms. Withers had a duty under Indiana law to keep the medical information she learned confidential. Ms. Withers breached that duty when she disclosed the information to Mr. Peterson. Ms. Hinchy further testified that, among other things, she suffered a number of emotional damages which impacted her ability to care for her child, she was humiliated, that she had a general distrust of healthcare providers, and that she was now taking a stronger anti-depressant.[8] As such, the Appellate Court found that Ms. Withers was negligent by virtue of professional malpractice.

Respondeat Superior and Having the Ability to Track Access

The doctrine of respondeat superior allows for vicarious liability to be imposed on an employer "where the employee has inflicted harm while acting within the scope of employment."[9] As the Appellate Court explained:

To fall within the scope of employment, the injurious act must be incidental to the conduct authorized or it must, to an appreciable extent, further the employer's business. An act is incidental to authorized conduct when it is subordinate to or pertinent to an act which the servant is employed to perform, or when it is done to an appreciable extent, to further his employer's business. . . . An employer is not held liable under the doctrine of respondeat superior because it did anything wrong, but rather because of the employer's relationship to the wrongdoer. . . . Furthermore, conduct is within the scope of employment when it is of the same general nature as that authorized, or incidental to the conduct authorized.[10]

In this case, the jury determined that Ms. Wither's actions were within the scope of employment because they "were of the same general nature as those authorized, or incidental to the actions that were authorized, by Walgreen. Specifically, Withers was authorized to use the Walgreen computer system and printer, handle prescriptions for Walgreen customers, look up customer information on the Walgreen computer system, review patient prescription histories, and make prescription-related printouts. Withers was at work, on the job, and using Walgreen equipment when the actions at issue occurred."[11] This issue of whether the actions were within the scope of employment is for the jury to determine and the Appellate Court declined to disturb the jury's decision.

Another important issue in this case is Walgreen's ability to track who accessed a patient's record and the actions that Walgreen took after it learned from Ms. Hinchy that someone had improperly accessed her record. The issue was raised during oral arguments before the Indiana Court of Appeals when the Court and counsel were discussing the issue of respondeat superior, how it relates to other claims (e.g., negligent training) as well as the disciplinary actions Walgreen took after it found out what happened.[12]

Ms. Maggie Smith, counsel for Walgreen noted that prior to this issue, Ms. Wither's had not violated Walgreen's policies. But, the Court challenged this assertion because Walgreen had acknowledged that the Company did not have any way of knowing since the Company had no means to track access. Ms. Smith specifically asserted that other pharmacies did not have the means to track access and therefore Walgreen could not be negligent for failing to do something that is not done in the community. Ms. Smith noted that, "the jury found that the discipline imposed by Walgreen was inadequate. But, there is nothing in negligent retention or supervision jurisprudence that says that the action that you take after learning an employee has acted incorrectly is to fire that employee. Instead what happened here is [that Walgreen took certain disciplinary actions against Ms. Withers.] They took steps to make sure this didn't happen again. They didn't fire her and one of the jurors felt that that's what they should have done."[13]

Mr. Neal Eggeson, counsel for Ms. Hinchy, noted that whether access tracking systems were in place at pharmacies was a dispute between the experts. Mr. Eggeson specifically note that, Curtis Baldwin, the expert that he presented, "said not only is tracking systems something that he's been using at Kroger for 30 years, this is something that he does everyday. The expert that [Walgreen] hired from Perdue, on the other hand, suggests that, to his knowledge, even though he has not worked in any pharmacies, he does not know of any tracking system by any pharmacy. That was a disputed fact and the jury came down on [Ms. Hinchy's] side on that issue."[14]

Amount of Damages

The amount of damages has garnered a significant amount of attention. In its appeal, Walgreen argued "that the damages award was excessive and based on improper factors."[15] Appellate Courts do have the power to set aside jury verdicts if they are excessive. "Where a damage award is so outrageous as to indicate the jury was motivated by passion, prejudice, partiality, or the consideration of improper evidence, [Courts will] find the award excessive."[16] To support that the award was excessive, Walgreen argued that, "(1) Hinchy does not have a physical injury or condition resulting from the breach, (2) Hinchy has had no lost wages as a result of the breach, and (3) Hinchy did not offer any testimony from a medical professional or counselor supporting her claim of emotional distress."[17] Interestingly, some of these damages types have been cited by courts in other jurisdictions as grounds for dismissing data breach class actions, arguing that, because plaintiffs failed to demonstrate 'damages,' they lacked standing to bring their claim(s).

But, as the Court here explained, Walgreen's argument amounted to "a request that [the Court] reweigh the evidence, a practice in which we do not engage when evaluating a damages award. We find that the evidence in the record supporting the award is sufficient to affirm it."[18] The Appellate Court identified the following evidence in support of the damages award:

• Withers gained information about Hinchy's private health information, including her social security number, and then shared that information with Peterson, who then shared the information with at least three other people

• Hinchy's father learned about Hinchy's use of birth control, that Hinchy had herpes, and that Hinchy had stopped taking birth control shortly before becoming pregnant.

• Hinchy testified that she experienced mental distress, humiliation, and anguish as a result of the breach. She stated that she was upset, crying, and feeling "completely freaked out . . . ." She felt "violated," "shocked," and "confused."

• The disclosure led to Peterson berating Hinchy for "getting pregnant on purpose" and eventually extorting Hinchy by threatening to release the details of her prescription usage to her family unless she abandoned her paternity lawsuit.

• Hinchy testified that she experienced uncontrollable crying that affected her ability to care for her child, going to a counselor to address the emotional toll of the privacy breach, experiencing a general distrust of all healthcare providers, and feeling a persistent and continuous loss of "peace of mind."

• Hinchy also testified that she now takes Celexa, an anti-depressant, which costs $75 per month. Before the breach, she had taken a weaker anti-depressant intermittently, and had not taken it for more than one year before the breach.[19]

The Appellate Court declined to disturb the awarded damages.

Walgreen's Petition for Rehearing

Subsequent to the first decision from the Appellate Court, Walgreen petitioned for a rehearing from the Court of Appeals of Indiana. On January 15, 2015, the Court denied the petition. As a result, the jury's decision and that of the Appellate Court upholding the decision stands.