Baker, J.
Amanda Henry appeals the trial court’s order dismissing the complaint she filed against Community Healthcare System Community Hospital (Community) after a Community employee allegedly provided Henry’s medical records to the employee’s spouse, who happened to be Henry’s employer. Henry argues that (1) while HIPAA does not contain a private right of action, it can form the basis of a duty and/or standard of care; (2) the trial court erroneously found that Indiana does not recognize the tort of public disclosure of private information; and (3) dismissal was improper where there were multiple viable negligence-based claims implicated by the complaint. Finding that Henry has one or more claims that should have survived dismissal, we reverse and remand for further proceedings.
….
Community attempts to frame this case under the Health Insurance Portability and Accountability Act (HIPAA) and the Indiana Access to Health Care Records Statute (IAHRS), arguing that there is no private right of action under either statute. This framing is a red herring, however, inasmuch as Henry agrees that there is no private right of action and is not attempting to assert one.
Instead, Henry argues that HIPAA may be used to establish the standard of care in a common law negligence action. To ensure that litigants are not enabled to make an end-run around the lack of a private right of action under HIPAA, Community argues that there must first be a common law duty. We agree.
There is an age-old recognition that medical providers owe a duty of confidentiality to their patients. While this duty is now codified by statute in Indiana, that does not change the historical recognition of the duty at common law….
We have little trouble concluding, based on the above authority, that there is— and, in modern times, always has been—a common law duty of confidentiality owed by medical providers to their patients. And it is necessarily true that if a duty exists, a breach of that duty is also possible. Indeed, this Court has more than once considered a claim that a medical provider negligently or recklessly disseminated a patient’s confidential information, finding that such a claim sounds in ordinary negligence rather than in medical malpractice….
Having found that a common law duty exists, we have little trouble agreeing with a sister court that “HIPAA and its implementing regulations may be utilized to inform the standard of care” in tort claims related to alleged breaches of the duty of confidentiality owed by medical providers to their patients. Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 102 A.3d 32, 49 (Conn. 2014).
Under Indiana’s liberal notice pleading standard, we find that Henry’s complaint includes the operative facts necessary to make a negligence-based claim against Community. See ARC Constr. Mgmt., LLC v. Zelenak, 962 N.E.2d 692, 697 (Ind. Ct. App. 2012) (holding that “[u]nder Indiana’s notice pleading system, a pleading need not adopt a specific legal theory of recovery to be adhered to throughout the case”). Specifically, the complaint alleged a duty to protect the privacy, security, and confidentiality of her health records, a breach of that duty by Community’s employee when the employee shared Henry’s x-rays with employee’s spouse, and resulting damages, if any. Under these circumstances, it was erroneous to grant Community’s motion for judgment on the pleadings because it is not clear from the face of the complaint that under no circumstances could relief be granted. [Footnotes omitted.]
The judgment of the trial court is reversed and remanded for further proceedings.
Kirsch, J., and Crone, J., concur.