On June 23, 2009, in Yath v. Fairview Clinics, a Minnesota state appellate court reversed a trial court’s ruling that the woman failed to show sufficient evidence of invasion of privacy in her suit against a health clinic, a former employee who was terminated for violating a company policy by accessing the patient’s records, and two other women who allegedly posted the information. The court decided a case that involved the posting and unlawful access to medical records of information about a woman’s sexually-transmitted disease to a MySpace page by friends and relatives of her estranged husband.
The trial court determined that since the MySpace posting was only online for 24 to 48 hours, the publication was not widespread enough to constitute exposure of information. However, the appeals court disagreed, noting that the MySpace pages were “a window that [her] enemies propped open for at least 24 hours allowing any internet-connected voyeur access to private details of her life.” Thus, the women satisfied the “publicity” element of her invasion of privacy claim.
The court also found that the employee’s wrongful access to and disclosure of the woman’s medical information was not foreseeable, thus the health clinic was not vicariously liable for its employee’s wrongful conduct. Additionally, the reversed the trial court and held that the Health Insurance Portability and Accountability Act (“HIPAA”) did not preempt a Minnesota law giving patients a private right of action for improper disclosure of medical records.