Lawsuit over medical records reinstated

Listen to this article

A state appeals court has reinstated part of a lawsuit accusing a nurse of improperly accessing medical records.

Plaintiffs Mary M. Hurley and Daniel M. Hurley, and their three children, sued Rochester General Hospital (RGH), Rochester Regional Health Aco Inc. (RRH), Greater Rochester Independent Practice Assoc. Inc. (GRIPA), and nurse Christine M. Smith.

The Hurleys are represented by Rochester attorney Derrick A. Spatorico.

According to the complaint, Smith, a nurse at RGH, improperly accessed the Hurley’s medical records due to the failure of RGH, RRH and GRIPA to secure the records.

Cariola granted a defense motion to dismiss the complaint because Smith was not employed by either of those organizations and the accessing of the records was not done in the scope of her duties as an employee by them.

According to the complaint, Smith reviewed about 670 confidential medical records of Mary Hurley on 36 separate days from Oct. 7, 2017, through April 26, 2022.

The suit also claims Smith reviewed the confidential medical records of Daniel Hurley on March 11, 2018, and April 4, 2020.

And the suit claims that Smith accessed the confidential medical records of the Hurley’s children on 10 dates between May 5, 2018, and May 18,2021.

“Smith did not possess any legitimate reason or basis for accessing and reviewing the confidential medical records of (the Hurley family) for which she was not in any way directly or indirectly involved in their treatment or the processing of any medical insurance claims by them,” according to the complaint.

In June 2022, the Hurleys received letters from Rochester Regional Health.

“As part of a recent audit we found questionable access into your medical record by our employee,” Elizabeth Wild, senior manager of privacy, wrote to Mary Hurley.

“You contacted my office after the employee reached out to you regarding the investigation. Although the employee stated that she had accessed your medical record per your request, you stated that you had not made such a request,” Wild wrote.

“As a result of this incident, we have taken the appropriate level of disciplinary action with the employee,” Wild wrote.

A similar letter was sent to Daniel Hurley regarding the improper review of his records and the records of the children.

The plaintiffs appealed Cariola’s October 2023 order that granted a defense motion to dismiss the complaint.

In a recent decision, the Appellate Division of state Supreme Court, Fourth Department unanimously modified Cariola’s decision and reinstated the negligence claim.

“We agree with plaintiffs in part,” the Fourth Department wrote.

“On a motion to dismiss, a court must accept the plaintiff’s allegations as true and determine whether they fit into any cognizable legal theory,” the court wrote.

“Affidavits submitted by a plaintiff may also be considered to remedy any defects in the complaint,” the court wrote.

But affidavits submitted by the defense “rarely warrant dismissal of the complaint unless they conclusively establish that the plaintiff has no cause of action,” the court wrote.

A medical corporation may be liable for failing to establish adequate policies and procedures to safeguard the confidentiality of patient information, or to train employees to perform their duties under those policies and procedures, according to the decision.

“These potential claims provide the requisite incentive for medical providers to put in place appropriate safeguards to ensure protection of a patient’s confidential information,” the court wrote.

The suit claims Smith impermissibly accessed the records and the duty to properly safeguard or monitor access to those records was breached.

“Accepting as true the allegations in the complaint and the averments in the affidavits submitted in opposition to the motion, we conclude that plaintiffs have sufficiently alleged a negligence claim,” the court wrote.

“We therefore conclude that the court erred in granting the motion with respect to the negligence claim against defendants, and we modify the order accordingly,” the panel wrote.

But the court agreed that Cariola properly granted the motion with respect to the implied contract claim against defendants.

In a separate complaint, seeking class-action status, GRIPA is being sued because thousands of patients had their personal information compromised in a breach of the organization’s computer system.

GRIPA is partnership between the eight affiliate hospitals of Rochester Regional Health and more than 1,500 physicians in western New York, the Finger Lakes region, and St. Lawrence County.

In that case, “unauthorized third-party cybercriminals” accessed the information of patients stored on the GRIPA’s computer network with the intention of misusing the information, “including marketing and selling” the information, according to the suit.

GRIPA officials said their organization was among 2,500 entities that were targeted by a simultaneous cyberattack.

[email protected] / (585) 232-2035