Labor & Employment Law Update

Last week the Indiana Court of Appeals reaffirmed its earlier decision holding an employer liable for its employee’s breach of its privacy policy. After the employee’s husband divulged he had fathered a child with another woman and contracted herpes, the employee searched her employer’s database and accessed the other woman’s prescription records. Of course the employer had a strict confidentiality policy in place. In fact the employee admitted she knew accessing patient information for personal reasons violated company policy. Why then is the company on the hook for more than a million dollars? The answer: Respondeat Superior.

Under the common law doctrine of respondeat superior, which is recognized in all fifty states, an employer is liable for wrongful acts its employees commit within the scope of their employment. When wrongs are committed during the course of employment, the employer is vicarious liable. In other words, the employer is liable by virtue of its relationship to the wrong-doer, not because the employer itself did anything wrong. In this case, the employee’s regular job duties included accessing patients’ prescription records. Though she had no job-related reason to access this particular patient’s records, the court found there was sufficient evidence tying her actions to her job duties, so it allowed the jury to decide whether she was acting within the scope of her employment when she violated the patient’s privacy. The jury concluded she was. As a result, both the employee and her employer are liable.

So, what can a prudent employer do to protect itself? Well-drafted, clearly-defined policies remain the frontline defense. Despite the large jury verdict, this case really was a close call. The company’s policy left no doubt the employee knew her actions were inappropriate. In light of this, a different jury could have reached a different result.

Comprehensive and recurring training is a crucial next step. Even the best-crafted written policy is easily tossed into a drawer and forgotten. The more often you reinforce the rules, the less likely your employees will break them.

Finally, consistent enforcement is vital. Even an employer with well-drafted policies and comprehensive training can find itself facing possible respondeat superior liability. An employer that is also able to prove “we do not tolerate violations of this policy” is much more likely to convince a jury that its rogue employee was not acting within the scope of her employment. Notably, this employer chose to discipline, but not fire the employee. Might the outcome have been different had they fired her straightaway? It is impossible to know for sure, but firing her immediately upon confirming her breach would have strengthened the employer’s argument that it does not tolerate breaches of patient privacy.