## Facts

- A hospital employed Misty Young as a phlebotomist with access to patient lab information.
- Young received HIPAA and confidentiality training, signed confidentiality and conduct policies, and understood patient information could be shared only with authorized caregivers.
- While working, Young saw a faxed lab result indicating Suzanne Bagent was pregnant.
- Later the same day, while off duty, out of uniform, and away from the hospital, Young met Bagent’s sister (Young’s close friend) at a bar/restaurant.
- In a private social conversation, Young told the sister that Bagent was pregnant; the sister did not already know, and Young apologized, stating she was not allowed to disclose it.
- After Bagent complained to hospital leadership, Young was forced to resign.
- Bagent sued Young and the hospital for privacy-related torts, alleging the hospital was vicariously liable solely under respondeat superior.
- The trial court granted summary judgment for the hospital; the appellate court reversed; the Illinois Supreme Court allowed the hospital’s appeal.

## Issues

1. Whether a hospital may be held vicariously liable under respondeat superior for an employee’s unauthorized disclosure of a patient’s confidential medical information made off duty, off premises, and in a purely social setting.
2. Whether the disclosure was within the employee’s scope of employment under Illinois law.

## Decision

- The Illinois Supreme Court reversed the appellate court and reinstated summary judgment for the hospital.
- The court held that, as a matter of law, the employee’s disclosure was outside the scope of employment.
- The case was remanded for further proceedings consistent with the holding that the hospital was not vicariously liable on a respondeat superior theory for the disclosure.

## Legal Principles

- Under Illinois law, employee conduct is within the scope of employment only if:
  - it is of the kind the employee is employed to perform;
  - it occurs substantially within authorized time and space limits; and
  - it is actuated, at least in part, by a purpose to serve the employer.
- An employee’s personal “frolic” or marked deviation from assigned duties falls outside the scope of employment.
- Access to information through employment does not, by itself, make a later disclosure within the scope of employment when the disclosure is unauthorized and contrary to employer policy.
- General foreseeability that employees might misuse confidential information is insufficient to impose respondeat superior liability absent conduct occurring in the course of employment and at least partly to serve the employer.

## Conclusion

Because the disclosure occurred off duty and off premises, in a purely social conversation, in direct violation of confidentiality policies, and with no purpose to serve the hospital, the employee acted outside the scope of employment; the hospital therefore was not vicariously liable under respondeat superior.


Bagent v. Blessing Care Corp., 862 N.E.2d 985 (Ill. 2007)