## Facts

- Candace Yath sought sexually transmitted disease testing at a clinic and was diagnosed with an STD.
- A clinic medical assistant, without authorization and contrary to policy, accessed Yath’s electronic medical record and learned details about the STD testing and diagnosis.
- The medical assistant emailed the information to a clinic medical-records coder, who also accessed the record without authorization and disclosed the information to others, including Yath’s estranged husband.
- The clinic investigated, confirmed unauthorized access and disclosure, and terminated the medical assistant.
- A publicly accessible social-networking page appeared using Yath’s photo and statements implying she had an STD and engaged in marital infidelity, along with other disparaging content.
- Evidence linked the page’s creation to a workplace connected to the medical assistant’s sister, but there was no direct evidence that the clinic or the coder created or posted the page.

## Issues

1. Whether posting private medical information on a publicly accessible social-networking page can satisfy the “publicity” element of the tort of public disclosure of private facts.
2. Whether the clinic could be held vicariously liable for employees’ intentional, unauthorized access and disclosure of medical information.
3. Whether HIPAA preempts Minnesota Statutes § 144.335, thereby barring a private damages claim under that statute for improper disclosure of medical records.
4. Whether the trial court abused its discretion by denying sanctions for alleged spoliation of electronic evidence.
5. Whether a negligent infliction of emotional distress claim can proceed absent a viable underlying tort or other required showing.

## Decision

- The court affirmed in part, reversed in part, and remanded.
- A public Internet posting of private medical information can constitute “publicity” for purposes of the public-disclosure privacy tort.
- Summary judgment dismissing the privacy-tort claim against the clinic and the coder was affirmed because the plaintiff produced no admissible evidence tying either to creating or posting the social-networking page.
- The clinic was not vicariously liable for the employees’ intentional misconduct because it was outside the scope of employment and not reasonably foreseeable.
- The trial court’s HIPAA preemption ruling was reversed; the state-law claim under Minn. Stat. § 144.335 was reinstated and remanded.
- Summary judgment on negligent infliction of emotional distress was affirmed because the claim lacked a viable underlying tort or other basis under Minnesota law.
- Denial of spoliation sanctions was affirmed due to insufficient proof of intentional destruction of evidence to thwart litigation.

## Legal Principles

- Public disclosure of private facts requires “publicity,” meaning dissemination to the public at large or to so many people that the matter is substantially certain to become public knowledge; a publicly accessible social-media webpage can meet this element.
- Liability for public disclosure requires evidence connecting the defendant to the act of public dissemination; proof of unauthorized access or limited disclosure, without proof of an Internet posting by the defendant, is insufficient.
- An employer is vicariously liable for an employee’s tort only if the conduct is within the scope of employment and reasonably foreseeable; intentional misuse of confidential records for personal reasons, contrary to policy, is outside scope and not foreseeable.
- HIPAA’s preemption framework permits more stringent state privacy protections that do not conflict with federal requirements; HIPAA does not bar a state statute providing a private damages remedy for improper disclosure of medical records.
- Negligent infliction of emotional distress generally requires an underlying actionable tort or satisfaction of strict alternative requirements; it fails when the predicate tort claim fails.
- Spoliation sanctions require an adequate showing of willful destruction of evidence for improper purposes; absent such proof, denial of sanctions is within the trial court’s discretion.

## Conclusion

The court recognized that publicly accessible social-media postings can satisfy the “publicity” element of public disclosure of private facts, but it upheld dismissal of the privacy claim against the clinic and coder due to lack of evidence linking them to the online posting, rejected vicarious liability for employees’ intentional record misuse, and held that HIPAA does not preempt Minnesota’s medical-records statute allowing private damages for improper disclosure.


Yath v. Fairview Clinics, N.P., 767 N.W.2d 34 (Minn. Ct. App. 2009)