Contributed by Suzanne Newcomb
Under the common law doctrine of respondeat superior, which is recognized in all fifty states, an employer is liable for wrongful acts its employees commit within the scope of their employment. When wrongs are committed during the course of employment, the employer is vicarious liable. In other words, the employer is liable by virtue of its relationship to the wrong-doer, not because the employer itself did anything wrong. In this case, the employee’s regular job duties included accessing patients’ prescription records. Though she had no job-related reason to access this particular patient’s records, the court found there was sufficient evidence tying her actions to her job duties, so it allowed the jury to decide whether she was acting within the scope of her employment when she violated the patient’s privacy. The jury concluded she was. As a result, both the employee and her employer are liable.
So, what can a prudent employer do to protect itself? Well-drafted, clearly-defined policies remain the frontline defense. Despite the large jury verdict, this case really was a close call. The company’s policy left no doubt the employee knew her actions were inappropriate. In light of this, a different jury could have reached a different result.
Comprehensive and recurring training is a crucial next step. Even the best-crafted written policy is easily tossed into a drawer and forgotten. The more often you reinforce the rules, the less likely your employees will break them.
Finally, consistent enforcement is vital. Even an employer with well-drafted policies and comprehensive training can find itself facing possible respondeat superior liability. An employer that is also able to prove “we do not tolerate violations of this policy” is much more likely to convince a jury that its rogue employee was not acting within the scope of her employment. Notably, this employer chose to discipline, but not fire the employee. Might the outcome have been different had they fired her straightaway? It is impossible to know for sure, but firing her immediately upon confirming her breach would have strengthened the employer’s argument that it does not tolerate breaches of patient privacy.