• OCR notified APDerm in November 2011 that it would launch its investigation. But, this settlement was not announced until December 2013, a full 2 years after the launch date. One has to wonder how many other investigations and settlements are currently pending.

• Neither the Press Release nor the Resolution Agreement provided details on the specifics of APDerm disclosing ePHI "by providing an unauthorized individual access to said ePHI for a purpose not permitted by the Privacy Rule." But, covered entities and their business associates should take this opportunity to carefully review the roles and responsibilities of their workforce members to ensure that only authorized individuals have access to ePHI.

• The OCR appears to be adopting the approach taken by the SEC, where it is requiring that any submissions being made to OCR are signed and attested to by an officer of the company. This has the potential to expand the scope of liability for the attesting officer for any false statements made in the reports to OCR.
  

• This is yet another case where a breach could have been prevented if the portable media device was encrypted. Covered entities, their business associates and the subcontractors of such business associates need to carefully evaluate their existing policies and, to the extent possible, implement encryption for all portable media devices, including thumb drives and laptops.
  

Today, we take action against two companies that collected names, addresses, Social Security numbers, driver's licenses, and other proprietary information (PI) belonging to low-income Americans and stored them on unprotected Internet servers that anyone in the world could access with a search engine and basic manipulation. The companies stored such consumer PI in two publicly accessible folders on the Internet without password protection or encryption. By not employing appropriate or even reasonable    security measures, the companies exposed their customers to an unacceptable risk of identity theft and other serious consumer harms.[4]

The Companies' privacy policies assure those persons submitting"[c]ustomer specific information" through their website that they will protect that information and, in fact, inform such applicants that"[b]y providing us with your information, you acknowledge that you have read this privacy policy, understand it, agree to its terms and consent to the transfer of such information outside your resident jurisdiction.[11]

• Storing the information in plain text thereby enabling it to be read by search engines - "the PI hosted by Vcare on its server was widely available on public websites online through a simple Google search," at least two applications were cached by the Google search engine, and these applications remained cached until the FCC contacted Google to have them removed.[14]

• Failing to properly secure the server directories storing the PI and using applicant names in the URLs -

• "The Companies knew or should have known that the use of random URLs without more (e.g., encryption) to protect applicant records provided inadequate security and left the documents vulnerable to exposure via search engines-which operate by visiting websites, indexing all or much of the content available on them, and then delivering links to the indexed results to anyone that queries the engine."[15]

• "[T]he Companies' URL naming convention for one of the folders containing PI that was stored on Vcare's server also exposed the names of the applicants or customers directly in the URL, further demonstrating the lack of security of the records."[16]

• Failing to use encryption - "We do not hold here that encryption without more would satisfy a carrier's duty under Section 201(b); however, given the state of technology, we believe the lack of encryption clearly evidences the unjust and unreasonable nature of the Companies' data security practices."[17]

During this [2006 - 2010] period, Hinchy filled all of her prescriptions, including oral birth control pills, at a Walgreen pharmacy. At some point in 2009, Peterson began dating Walgreen pharmacist Audra Withers. In August 2009, Hinchy became pregnant with Peterson's child. On an unknown date, Peterson learned that he had contracted genital herpes. Hinchy gave birth to a son on May 22, 2010.

At some point during the week of May 26, 2010, Peterson mailed a letter to Withers informing her about the baby and about the possibility that he may have exposed her to genital herpes. Withers became terrified about the possibility of contracting a sexually transmitted disease. Consequently, during her shift and while at work, Withers looked up Hinchy's prescription profile in the Walgreen computer system to see if she could find any information about Hinchy's sexually transmitted disease. The next day, Withers again looked up Hinchy's profile to confirm that she had spelled it correctly the day before.[4]

When Withers was confronted about the situation, she admitted that she had accessed Hinchy's prescription profile for personal reasons. On April 15, 2011, Loss Prevention Detective Michael Bryant confirmed to Hinchy that (1) a HIPAA/privacy violation had occurred, (2) Withers had viewed Hinchy's prescription information without consent and for personal purposes, and (3) Walgreen could not confirm that Withers had revealed that information to a third party. As a result of Walgreen's investigation, Withers received a written warning and was required to retake a computer training program regarding HIPAA.[6]

Ms. Hinchy filed suit against both Walgreens and Ms. Withers on August 1, 2011. Against Ms. Withers, Ms. Hinchy filed claims of:

(1) negligence/professional malpractice,
(2) invasion of privacy/public disclosure of private facts, and
(3) invasion of privacy/intrusion.

Against Walgreens, Ms. Hinchy filed claims:

(1) seeking liability for the counts she filed against Withers by way of respondeat superior,
(2) direct claims for:
(a) negligent training,
(b) negligent supervision,
(c) negligent retention, and
(d) negligence/professional malpractice.

Walgreens appealed the jury verdict on a number of grounds, but this discussion will only focus on the Appellate Court's discussion of the underlying liability, the respondeat superior claim, and the amount of damages.

Underlying Liability

The Appellate Court first looked at "the tort of negligence by virtue of professional malpractice of a pharmacist. Negligence is comprised of three elements: (1) a duty on the part of the defendant to the plaintiff; (2) a breach of that duty; and (3) an injury to the plaintiff resulting from the breach."[7] The Court found that Ms. Withers had a duty under Indiana law to keep the medical information she learned confidential. Ms. Withers breached that duty when she disclosed the information to Mr. Peterson. Ms. Hinchy further testified that, among other things, she suffered a number of emotional damages which impacted her ability to care for her child, she was humiliated, that she had a general distrust of healthcare providers, and that she was now taking a stronger anti-depressant.[8] As such, the Appellate Court found that Ms. Withers was negligent by virtue of professional malpractice.

Respondeat Superior and Having the Ability to Track Access

The doctrine of respondeat superior allows for vicarious liability to be imposed on an employer "where the employee has inflicted harm while acting within the scope of employment."[9] As the Appellate Court explained:

To fall within the scope of employment, the injurious act must be incidental to the conduct authorized or it must, to an appreciable extent, further the employer's business. An act is incidental to authorized conduct when it is subordinate to or pertinent to an act which the servant is employed to perform, or when it is done to an appreciable extent, to further his employer's business. . . . An employer is not held liable under the doctrine of respondeat superior because it did anything wrong, but rather because of the employer's relationship to the wrongdoer. . . . Furthermore, conduct is within the scope of employment when it is of the same general nature as that authorized, or incidental to the conduct authorized.[10]

In this case, the jury determined that Ms. Wither's actions were within the scope of employment because they "were of the same general nature as those authorized, or incidental to the actions that were authorized, by Walgreen. Specifically, Withers was authorized to use the Walgreen computer system and printer, handle prescriptions for Walgreen customers, look up customer information on the Walgreen computer system, review patient prescription histories, and make prescription-related printouts. Withers was at work, on the job, and using Walgreen equipment when the actions at issue occurred."[11] This issue of whether the actions were within the scope of employment is for the jury to determine and the Appellate Court declined to disturb the jury's decision.

Another important issue in this case is Walgreen's ability to track who accessed a patient's record and the actions that Walgreen took after it learned from Ms. Hinchy that someone had improperly accessed her record. The issue was raised during oral arguments before the Indiana Court of Appeals when the Court and counsel were discussing the issue of respondeat superior, how it relates to other claims (e.g., negligent training) as well as the disciplinary actions Walgreen took after it found out what happened.[12]

Ms. Maggie Smith, counsel for Walgreen noted that prior to this issue, Ms. Wither's had not violated Walgreen's policies. But, the Court challenged this assertion because Walgreen had acknowledged that the Company did not have any way of knowing since the Company had no means to track access. Ms. Smith specifically asserted that other pharmacies did not have the means to track access and therefore Walgreen could not be negligent for failing to do something that is not done in the community. Ms. Smith noted that, "the jury found that the discipline imposed by Walgreen was inadequate. But, there is nothing in negligent retention or supervision jurisprudence that says that the action that you take after learning an employee has acted incorrectly is to fire that employee. Instead what happened here is [that Walgreen took certain disciplinary actions against Ms. Withers.] They took steps to make sure this didn't happen again. They didn't fire her and one of the jurors felt that that's what they should have done."[13]

Mr. Neal Eggeson, counsel for Ms. Hinchy, noted that whether access tracking systems were in place at pharmacies was a dispute between the experts. Mr. Eggeson specifically note that, Curtis Baldwin, the expert that he presented, "said not only is tracking systems something that he's been using at Kroger for 30 years, this is something that he does everyday. The expert that [Walgreen] hired from Perdue, on the other hand, suggests that, to his knowledge, even though he has not worked in any pharmacies, he does not know of any tracking system by any pharmacy. That was a disputed fact and the jury came down on [Ms. Hinchy's] side on that issue."[14]

Amount of Damages

The amount of damages has garnered a significant amount of attention. In its appeal, Walgreen argued "that the damages award was excessive and based on improper factors."[15] Appellate Courts do have the power to set aside jury verdicts if they are excessive. "Where a damage award is so outrageous as to indicate the jury was motivated by passion, prejudice, partiality, or the consideration of improper evidence, [Courts will] find the award excessive."[16] To support that the award was excessive, Walgreen argued that, "(1) Hinchy does not have a physical injury or condition resulting from the breach, (2) Hinchy has had no lost wages as a result of the breach, and (3) Hinchy did not offer any testimony from a medical professional or counselor supporting her claim of emotional distress."[17] Interestingly, some of these damages types have been cited by courts in other jurisdictions as grounds for dismissing data breach class actions, arguing that, because plaintiffs failed to demonstrate 'damages,' they lacked standing to bring their claim(s).

But, as the Court here explained, Walgreen's argument amounted to "a request that [the Court] reweigh the evidence, a practice in which we do not engage when evaluating a damages award. We find that the evidence in the record supporting the award is sufficient to affirm it."[18] The Appellate Court identified the following evidence in support of the damages award:

• Withers gained information about Hinchy's private health information, including her social security number, and then shared that information with Peterson, who then shared the information with at least three other people

• Hinchy's father learned about Hinchy's use of birth control, that Hinchy had herpes, and that Hinchy had stopped taking birth control shortly before becoming pregnant.

• Hinchy testified that she experienced mental distress, humiliation, and anguish as a result of the breach. She stated that she was upset, crying, and feeling "completely freaked out . . . ." She felt "violated," "shocked," and "confused."

• The disclosure led to Peterson berating Hinchy for "getting pregnant on purpose" and eventually extorting Hinchy by threatening to release the details of her prescription usage to her family unless she abandoned her paternity lawsuit.

• Hinchy testified that she experienced uncontrollable crying that affected her ability to care for her child, going to a counselor to address the emotional toll of the privacy breach, experiencing a general distrust of all healthcare providers, and feeling a persistent and continuous loss of "peace of mind."

• Hinchy also testified that she now takes Celexa, an anti-depressant, which costs $75 per month. Before the breach, she had taken a weaker anti-depressant intermittently, and had not taken it for more than one year before the breach.[19]

The Appellate Court declined to disturb the awarded damages.

Walgreen's Petition for Rehearing

Subsequent to the first decision from the Appellate Court, Walgreen petitioned for a rehearing from the Court of Appeals of Indiana. On January 15, 2015, the Court denied the petition. As a result, the jury's decision and that of the Appellate Court upholding the decision stands.