Attorney General Todd Rokita has dropped his lawsuit against IU Health, originally waged in the wake of the media firestorm over an anecdote one of the system’s doctors shared with IndyStar about a 10-year-old rape victim who traveled to Indiana for an abortion.
Rokita filed the lawsuit in September of last year, alleging IU Health violated HIPPA and the Indiana Deceptive Consumer Sales Act by failing to protect the child’s health information. Earlier in the year, Indiana’s medical licensing board decided obstetrician-gynecologist Caitlin Bernard violated privacy laws in the case, though experts in the medical field disagreed. IU Health’s own internal investigation found Bernard did not violate privacy laws.
The federal court in the Southern District of Indiana initally granted IU Health’s motion to dismiss the case in June this year. Justifying the lawsuit, the state argued that the hospital’s alleged conduct had ramifications for the medical privacy interests of Indiana residents as well as for hospital employees seeking to avoid violating HIPAA. The district court said it remained “unconvinced” that HIPAA was designed to encompass those interests or that Indiana residents were “threatened or adversely affected,” as is necessary for a state attorney general to bring suit.
Judge Matthew Brookman wrote that the state did not specify what IU Health policies were deficient, and that the state’s arguments rely on “speculative theories and assumptions in substitution of facts.”
“Broad conclusions that IUH has violated HIPAA are patently insufficient,” he wrote. “The Court will not stretch the facts to fit the theory advanced by the State. Here, there are no factual allegations from which the Court can reasonably infer that IUH’s policies, or lack thereof, have created an identifiable impending or ongoing threat to Indiana residents’ privacy interests.”
Rokita filed an amended complaint a month later. During the discovery process, Rokita’s office wrote in the state’s filing last week, the state decided that the actions IU Health has taken since July 1, 2022 ― the day the 10-year-old’s story was published on IndyStar’s website ― satisfy the initial complaints.
Those actions include:
- Continuing to train employees not to talk about patients in public spaces.
- Informing employees that if they are contacted by a reporter, they must inform the Public Relations or communications departments before responding.
- Training employees on “Protected Health Information,” including scenarios similar to the one in question, where a name isn’t given but certain details may tie back to the patient.
In a statement Monday, Rokita said he filed suit specifically to obtain this information.
“We are pleased the information this office sought over two years ago has finally been provided and the necessary steps have been taken to accurately and consistently train their workforce to protect patients and their health care workers,” he wrote.
However, in a statement, IU Health says it is “disheartened” that the state is implying these were “corrective” actions taken by IU Health in response to these events, rather than practices they’ve always had.
“IU Health has and will continue to maintain its robust HIPAA compliance policies and training for its team members, as it has for years,” the statement reads. “While we are pleased the Indiana Attorney General’s office voluntarily moved to dismiss the case, we are disappointed the state’s limited taxpayer resources were put toward this matter after the first complaint was dismissed by the Court on the merits.”
Contact IndyStar state government and politics reporter Kayla Dwyer at kdwyer@indystar.com or follow her on Twitter @kayla_dwyer17.
link