A Hospital Mailed a Patient’s Confidential Diagnosis to a Rando. You’ll Never Guess What Happened Next–ZD v. Community Health

November 25, 2022 · by · in Privacy/Security

The facts in this case are so bizarre and outrageous that I had to read them several times:

On September 30, 2018, Z.D. underwent an examination and medical testing in the emergency department of a Community facility in Indianapolis. Afterward, Community was unable to contact Z.D. via telephone to notify her of her test results. So on October 5, the emergency department’s patient resource coordinator wrote a letter to Z.D. that was printed on Community letterhead and included her diagnosis and suggested treatment. The letter was placed in an envelope bearing Community’s preprinted return address and the handwritten mailing address of Jonae Kendrick, who was a classmate of Z.D.’s high-school-aged daughter. Kendrick received the envelope in the mail, opened it, and posted the letter on Facebook, where it was seen by multiple third parties, including Z.D.’s daughter. Z.D. learned about her diagnosis from her daughter, and she paid Kendrick $100 in exchange for the letter, which was removed from Facebook…Z.D. stated that her daughter and Kendrick were “just facebook friends. I don’t think they ever hung out or anything.”

Say what? How does this even happen? I have so many questions:

  • How did ZD get medical treatment without providing a working phone number or proper mailing address? Normally hospitals are pretty adamant about identifying patients to ensure they get paid.
  • What did the patient resource coordinator think was the relationship between ZD and Jonae? It won’t likely affect the legal conclusion, but perhaps the worker (apparently incorrectly) thought they had some kind of special and trusted relationship?
  • Why would any healthcare worker think it’s appropriate to send a diagnosis to anyone other than the patient or a person designated by the patient?
  • Why did Jonae post ZD’s confidential diagnosis on Facebook? Who does that?
  • Why did ZD have to pay Jonae $100 to get the diagnosis letter intended for ZD? Again, who does that?

The opinion doesn’t specify ZD’s diagnosis and why disclosure was so problematic, though the opinion does have an unexpected reference to the law of loathsome diseases. Whatever the diagnosis was, ZD reported her consequences from the Facebook posting included:

  • her fiancé broke up with her
  • her fiancé “kicked her out of his house”
  • she suffered a depression
  • she had to leave her job
  • she lost several clients for her business

There were two obvious breakdowns that led to this bizarre and highly unfortunate set of events: (1) the hospital sending confidential medical information to a non-patient, and (2) the letter recipient publicizing the confidential medical information. Both the hospital and Jonae sound like they should be on the hook legally.

The opinion doesn’t mention any legal consequences for Jonae. The trial court thought Jonae violated 18 U.S.C. §§ 1702 (obstruction of correspondence) & 1708 (theft or receipt of stolen mail), but the appellate court casts doubt on that because the hospital directed the correspondence to Jonae. The appeals court raises the question, but doesn’t answer, what liability Jonae might face for publicly posting the letter to Facebook. I can think of a few potential privacy claims.

Meanwhile, instead of the hospital accepting the blame it deserves, it finger-points at Jonae as the real malefactor that broke the proximate causation chain. Seriously? The victim has already suffered enough, and the hospital is digging in its heels???

In this ruling, the appeals court holds:

  • ZD may take her public disclosure of private facts claim to a jury.
  • ZD cannot get emotional distress damages from her negligence claim (but perhaps from other claims).
  • The hospital is potentially a proximate cause of ZD’s injuries, so a jury can decide to award ZD pecuniary damages.

I cannot imagine the hospital will let a jury decide this case. If I were on that jury, I would be OUTRAGED.

Case Citation: Z.D. v. Community Health Network, Inc., 197 N.E.3d 330 (Oct. 6, 2022).

UPDATE: Z.D. v. Community Health Network, Inc., 2023 WL 6209571 (Indiana Sup. Ct. Sept. 15, 2023). Incredibly, the hospital still hasn’t settled. The Supreme Court sends the case to trial:

We first hold Community is not entitled to summary judgment on Z.D.’s public-disclosure claim. In reaching that conclusion, we clarify that plaintiffs can recover damages for emotional distress upon satisfying the public-disclosure tort’s elements—none of which require a showing of intentionality. And we further clarify that disclosure to one person can, depending on the surrounding facts and circumstances, satisfy the tort’s publicity element. We then hold Community is entitled to partial summary judgment on Z.D.’s negligence claim. To that end, we decline to exempt negligence-based medical privacy breaches from our modified impact rule’s physical-impact requirement, entitling Community to summary judgment on Z.D.’s negligence claim for her alleged emotional-distress damages. But we find genuine issues of material fact remain as to whether Z.D. can recover her alleged pecuniary damages and whether Community was the proximate cause of those damages.