Indiana Attorney General Todd Rokita has filed a lawsuit against IU Health and IU Healthcare Associates, alleging that the Indianapolis-based academic medical center failed to train employees and protect personal health information a year after a physician spoke to the media about a 10-year-old patient's abortion.
The Indiana Office of the Indiana Attorney General announced the lawsuit Sept. 15. Here are 11 things to know about the lawsuit and events that precede it:
1. In summer 2022, a 10-year-old girl and her mother visited an IU Health hospital to terminate the child's pregnancy, which resulted from rape. Neither the girl nor her mother gave authorization for the care team to speak with the media about the case, according to Mr. Rokita's office.
2. "After the abortion, while the mother and daughter were still at the hospital for recovery and observation, they were greeted with a front-page news story in the Indianapolis Star, which described the 10-year-old's case in great detail," the Indiana Office of the AG contends. "This article went public, and the story became worldwide household news after the doctor spoke to a reporter at a political rally."
3. The new story published by the Indianapolis Star July 1, 2022, was about patients traveling to Indiana for abortion services from other states as Indiana prepared to further restrict such medical services. It begins with mention of a physician in Ohio contacting IU Health physician Caitlin Bernard, MD, to refer the 10-year-old, pregnant patient for abortion services. The call came hours after Ohio banned abortions after six weeks; the patient was six weeks and three days pregnant. (Abortion is effectively banned in Indiana as of August 2023.)
4. In July 2022, Mr. Rokita made allegations during an appearance on Fox News that Dr. Bernard had a history of failing to report abortions. Mr. Rokita did not share evidence to support the claim. (Records show Dr. Bernard complied with reporting requirements set by both the Indiana Department of Health and the Indiana Department of Child Services.) Following that TV news appearance, Mr. Rokita said he was "gathering the evidence as we speak, and we're going to fight this to the end, including looking at her licensure." He also said there may be further action if a HIPAA violation occurred.
5. Attorneys for Dr. Bernard sent a cease and desist to Mr. Rokita after his news appearance, noting the false and misleading statements constitute defamation. IU Health responded to the attorney general's claims with the following statement to the media: "As part of IU Health's commitment to patient privacy and compliance with privacy laws, IU Health routinely initiates reviews, including the matters in the news concerning Dr. Caitlin Bernard. IU Health conducted an investigation with the full cooperation of Dr. Bernard and other IU Health team members. IU Health's investigation found Dr. Bernard in compliance with privacy laws."
6. Mr. Rokita went on to file an administrative complaint that resulted in the Indiana Medical Licensing Board conducting a hearing and finding in May 2023 that Dr. Bernard violated HIPAA by improperly disclosing patient information and for improperly de-identifying patient information. The board also found Dr. Bernard violated the Indiana patient confidentiality rule by failing to get patient permission prior to disclosing any information. Dr. Bernard received a letter of reprimand and a $3,000 fine.
7. The medical licensing board rejected accusations from Mr. Rokita that Dr. Bernard violated state law by not reporting the child abuse to Indiana authorities. The board also declined Mr. Rokita's request to suspend Dr. Bernard's license. The board issued no restrictions on her practice of medicine.
8. IU Health issued a statement expressing disagreement with the medical licensing board's determination that Dr. Bernard violated the federal HIPAA law and state patient privacy law, and maintained the physician did not violate privacy laws.
9. In announcing the lawsuit's filing Sept. 15, Mr. Rokita argues that by publicly disagreeing with the licensing board and maintaining that Dr. Bernard's actions were legally compliant, IU Health has "caused confusion" among its 36,000 employees about what conduct is permitted under federal HIPAA privacy laws and the Indiana patient confidentiality rule.
10. The lawsuit consists of seven counts against IU Health: failure to implement or follow administrative, technical and physical safeguards to protect the privacy of protected information; failure to document disclosures of personal health information; failure to implement or apply and document sanctions; failure to appropriately train its workforce; failure to notify patients of breach; failure to mitigate harm; and violations of Indiana's Deceptive Consumer Sales Act.
11. IU Health shared the following statement with Becker's in response to news of the lawsuit: "At IU Health, we hold ourselves accountable every day for providing quality healthcare and securing privacy for our patients. We continue to be disappointed the Indiana Attorney General's office persists in putting the state's limited resources toward this matter. We will respond directly to the AG's office on the filing."