13

By Marilyn Odendahl
The Indiana Citizen
August 13, 2024

Claiming a “win for patient privacy,” Indiana Attorney General Todd Rokita’s office has dropped its lawsuit against Indiana University Health, but a federal court had already tossed the case in June, finding the state’s arguments “relied on speculative theories and assumptions in substitution of facts.”

The attorney general’s office had filed the case – State of Indiana Ex Rel Rokita v. Indiana University Health, Inc., et al., 1:23-cv-1665 – on behalf of the state in September 2023 in the Southern Indiana District Court. The lawsuit alleged IU Health had violated Health Insurance Portability and Accountability Act (HIPAA) and the Indiana Deceptive Consumer Sales Act in its handling of patient information regarding the abortion care provided by Dr. Caitlin Bernard to a 10-year-old rape victim from Ohio in June 2022.

Bernard was the focus of a media firestorm, after she confirmed to The Indianapolis Star that she had treated the 10-year-old. The young girl had to come to Indiana because she could not get care in her home state, after Ohio enacted severe abortion restrictions in the wake of the U.S. Supreme Court’s Dobbs decision, which overturned nearly 50 years of precedent and found women do not have a constitutional right to terminate their pregnancies.

Rokita’s office filed a complaint in November 2022 against Bernard with the Indiana Medical Licensing Board. After a 15-hour hearing, the board found Bernard had violated the rape victim’s privacy and fined her $3,000.

In its complaint against IU Health, the state asserted the hospital administrators violated HIPAA by emailing “statements to multiple media outlets,” saying that IU Health had conducted a review of Bernard’s conduct and found she had complied with privacy laws. Also, the state noted that after Bernard was reprimanded by the medical licensing board, IU Health said it did not agree with the board’s decision and that it stood by its assessment that Bernard was compliant with the laws protecting patient privacy.

“Rather than protecting the patient, the hospital chose to protect the doctor, and itself,” the state argued.

Rokita, himself, talked about Bernard on national television and social media in the summer of 2022, revealing his office was investigating her conduct. He subsequently faced disciplinary charges and was publicly reprimanded by the Indiana Supreme Court for making public statements that he knew would prejudice the proceedings against Bernard and for taking actions meant only to harass Bernard.

On Monday, Rokita announced his office had filed a notice on Aug. 7 with the federal court voluntarily dismissing the case against IU Health. In a lengthy statement, the attorney general said IU Health’s statement that Bernard had done nothing wrong prompted his office to examine the training the medical provider was giving its employees on patient privacy. Moreover, Rokita’s statement said, IU Health officials refused to answer questions, so his office “had no choice but to file a lawsuit to require their cooperation and answers.”

Rokita claimed victory through the notice of voluntary dismissal. His office stated in the filing that IU Health had undertaken a series of actions as a result of the litigation to reinforce patient privacy protocols with the hospital’s employees.

However, IU Health, in a public statement, denied the state’s lawsuit had uncovered any deficiencies in compliance with privacy laws. The medical provider said not only was it continuing to train employees as it always had, but that the lawsuit was a waste of public money.

“IU Health did not violate HIPAA and the Attorney General’s complaints were properly dismissed; however, we are disheartened by the suggestions made in the Indiana Attorney General’s Notice of Dismissal that implied corrective action was required by IU Health,” the statement released from Indiana University Health said. “IU Health has and will continue to maintain its robust HIPAA compliance policies and training for its team members, as it has for years. While we are pleased the Indiana Attorney General’s office voluntarily moved to dismiss the case, we are disappointed the state’s limited taxpayer resources were put toward this matter after the first complaint was dismissed by the Court on the merits.”

Wading into ‘unchartered territory’

Not addressed by Rokita in his statement is the district court’s order in June granting the defendants’ motion to dismiss the lawsuit. Judge Matthew Brookman of the Southern Indiana District Court gave the state one last opportunity to keep the case alive by allowing the attorney general’s office to submit an amended complaint by July 22.

Although the state did file an amended complaint, it filed a few weeks later to voluntarily end the case.

 “This is a win for patients, but also for the group’s 36,000 health care providers who can now trust they’ve received accurate training that is consistent with HIPAA privacy laws and Indiana patient confidentiality rules,” Rokita said in his statement announcing the voluntary dismissal. “One of my office’s main priorities is to protect patient privacy because when it’s not, we no longer have reliable, honest healthcare.”

However, the Southern Indiana District Court was not convinced by any of the state’s arguments. The court did not agree that the state was seeking to protect Hoosiers’ interests, and the court was unconvinced that IU Health did not have policies to safeguard patient privacy or did not train its workforce on how to protect patient health information.

“Again, to construct a threat against Indiana residents’ privacy interests, the State relies on speculative theories and assumptions in substitution of facts,” Brookman wrote in his order granting the defendants’ motion for dismissal. “The Court is not required to make assumptions about how IUH’s conduct might impact Indiana residents. It is the State’s obligation, at the outset, to demonstrate that Indiana residents’ privacy interests are threatened by IUH’s conduct. The State’s Complaint simply does not delineate what affect IUH’s public statements have had on IUH’s workforce and its compliance with or understanding of HIPAA.”

Rokita’s office argued that Indiana was able to file a HIPAA lawsuit even though the privacy allegedly violated by IU Health was that of an Ohio patient. Indiana has grounds to file the privacy complaint, the attorney general’s office asserted, because Hoosiers have an interest in protecting their personal health information.

The district court noted it could not find and none of the parties in the case cited to any other HIPAA lawsuit brought by a state that did not have a resident affected by an alleged patient privacy violation. Instead, the district court pointed out, U.S. Supreme Court precedent has established that the interests of a state’s residents are threatened when the harm is identifiable and impending and a court must intervene.

“In each case, the plaintiff-state provided specific factual allegations to demonstrate a causal relationship between the anticipated or ongoing injury to residents’ interests and the defendant’s alleged misconduct,” Brookman wrote. “Here, the State asked the Court to wade into unchartered territory to determine whether a suit can be brought where there has been no tangible effect on a resident’s privacy interests.”

Potential to restart litigation

Rokita’s office asserted in its notice of dismissal that it filed the lawsuit because the state has a long and important interest in protecting the health and welfare of Hoosiers, including the safeguarding of their medical privacy.

“The State’s protective and regulatory oversight authority includes guarding the crucial role that confidentiality plays between a physician and his or her patient because it is confidentiality and privacy between a healthcare provider and a patient that creates the trust necessary for healthcare standards to be maintained and improved over time.”

Separately, Rokita issued an opinion in April that the terminated pregnancy reports filed by physicians after they perform an abortion are public record. The Indiana Department of Health started withholding the reports, fearing the women getting abortion care could be identified by the information in the TPRs, since so few abortions are being performed now that the state’s near-total abortion ban has taken effect.

Bernard and a colleague, Dr. Caroline Rouse, intervened in a lawsuit that is seeking the release of the TPRs. They asserted that the information contained in those reports includes the same kind of patient details that resulted in Bernard’s reprimand.

In his statement, Rokita noted his office voluntarily dismissed the lawsuit “without prejudice,” which leaves open the option of restarting the litigation against IU Health. The state expects medical providers to continue training their physicians and staff to protect patient privacy, he said.

Destiny Wells, Democratic candidate for Indiana attorney general, criticized Rokita for filing the lawsuit, claiming it was a “witch hunt” that wasted money.

“Rokita’s litigation against Dr. Bernard and IU Health was nothing but a baseless witch hunt on taxpayers’ dimes,” Wells said. “Rokita’s ruthless crusade against healthcare professionals is a weird obsession with the doctor-patient relationship and proves to do nothing for Hoosiers except open the door to government intrusion.”

Dwight Adams, an editor and writer based in Indianapolis, edited this article. He has been a content editor, copy editor and digital producer at The Indianapolis Star and IndyStar.com, and a planner for other papers, including the Louisville Courier Journal.

The Indiana Citizen is a nonpartisan, nonprofit platform dedicated to increasing the number of informed and engaged Hoosier citizens. We are operated by the Indiana Citizen Education Foundation, Inc., a 501(c)(3) public charity. For questions about the story, contact Marilyn Odendahl at marilyn.odendahl@indianacitizen.org.