Pharmacist Costs Walgreens $1.4 Million for Violating HIPAA

Walgreens will appeal a $1.4 million verdict after 1 of its pharmacists in Indiana violated the Health Insurance Portability and Accountability Act (HIPAA) when she reviewed prescription records of a woman who once dated her husband.

According to the Indy Star, the situation is unique in that it is the first published appellate court decision in the United States where a health care provider is being held liable for a HIPAA violation committed by an employee.

Walgreens is planning to appeal the ruling delivered by the Indiana Court of Appeals, as the company has argued that it is not fair for it to be held liable for an employee who knew she was violating company policy but nonetheless improperly reviewed and divulged a patient’s personal information.

“The pharmacist in this case admitted she was aware of our strict privacy policy and knew she was violating it," said James W. Graham in a statement from Walgreens. “We believe it is a misapplication of the law to hold an employer liable for the actions of 1 employee who knowingly violates company policy.”

However, others argued Walgreens could be held “vicariously” liable for their employees.

"The question is: How strict is that liability if the employer was not negligent?" asked David Orentlicher, co-director of the William S. and Christine S. Hall Center for Law and Health at the Indiana University Robert H. McKinney School of Law in Indianapolis, in the Indy Star. "Sometimes courts do hold employers accountable, even if the employer didn't do anything wrong, due to the employer's relationship with the wrong-doer."

The pharmacist, Audra Withers, allegedly reviewed the prescription records of a woman named Abigail Hinchy, who had fathered a child with Withers’s husband, according to the Indy Star.

Withers shared the information she found, including Hinchey’s Social Security number, with her husband, who then gave the information to at least 3 other people. The husband was allegedly collecting the information to be used against Hinchy in a paternity lawsuit, according to the Indy Star.

When Hinchy complained to Walgreens officials, Withers received a written warning, and she will have to retake a training program about HIPAA rules, according to the Indy Star.

Walgreens has paid the $1.4 million, but the money will be held until the case is resolved.