The Court of Appeals in Indiana has upheld a $1.4 million dollar verdict against the Walgreens Company. This decision sets a troubling precedent for employers who work in the health care industry, as it holds the company responsible for a HIPAA violation committed by an employee.
The trouble began when Walgreens pharmacist Audra Withers accessed the confidential prescription records of a client named Abigail Hinchy. Withers was not specifically authorized to access the personal records. Moreover, her subsequent sharing of that information with her husband constituted a clear violation of Hinchy’s rights to privacy under HIPAA.
The story becomes even more tangled because at the time, Withers was married to Davion Peterson. Peterson happened to be the ex-boyfriend of Abigail Hinchy, and the two had a child together. Apparently, Withers accessed Hinchy’s prescription records to prove that Hinchy had not filled her birth control prescription during the time when she became pregnant with Peterson’s child.
Peterson and Hinchy had an argument during which he informed her that he had information that she had deliberately not filled her birth control prescription during the time in which she conceived their child. Upon investigation, Hinchy discovered that her pharmacist was married to her ex-boyfriend, and she accused Walgreens and Withers of violating her HIPAA rights.
Walgreens officials confronted Withers, who admitted she had wrongfully accessed and shared the records. She was disciplined and required to repeat HIPAA training while Hinchy sued Walgreens and the pharmacist.
The court found in Hinchy’s favor, holding both the individual and the company at fault. Walgreens appealed, believing that they should not be held accountable for the actions of an employee who knowingly and willfully violated company policy. That appeal has now been lost, and Walgreens has placed a $1.4 million deposit into the court account. However, it seems certain that the company will file another appeal.
When it comes to an employee’s violation of HIPAA regulations, it isn’t always clear what sort of responsibility the employer bears. Whatever decision is ultimately reached in this case, it is likely to set a precedent for further HIPAA related lawsuits.