Terrell v. Main Line Health, Inc.

320 F.Supp.3d 644

Gloria TERRELL

v.MAIN LINE HEALTH, INC., et al.

CIVIL ACTION NO. 17-3102

United States District Court, E.D. Pennsylvania.

Signed June 1, 2018

Albert J. Michell, Albert J. Michell, P.C., Philadelphia, PA, for Gloria Terrell.

Caren Litvin, Radnor, PA, Geoffrey Daniel Bruen, Mancheski & Bunker, Philadelphia, PA, for Main Line Health, Inc., et al.

MEMORANDUM

R. BARCLAY SURRICK, DISTRICT JUDGE

Presently before the Court is Defendants' Motion for Summary Judgment. (ECF No. 17.) For the following reasons, Defendant's Motion will be granted.

I. INTRODUCTION

This employment discrimination case arises from Plaintiff Gloria Terrell's allegations that her employer, Defendant Main Line Hospitals, Inc. ("MLHI")¹ terminated her employment as an operating room ("OR") secretary at Lankenau Hospital ("Lankenau") based on her age. Plaintiff's Complaint alleges that MLHI terminated her in violation of the Age Discrimination in Employment Act ("ADEA"), 29 U.S.C. §§ 621 - 634, and the Pennsylvania Human Relations Act ("PHRA"), 43 Pa. Stat. & Cons. Stat. Ann. §§ 951-963. (Compl., ECF No. 1.) Defendants contend that Plaintiff was terminated for a legitimate, nondiscriminatory reason, specifically, because she twice accessed information regarding a co-worker, in violation of MLHI's policies relating to patient privacy and in violation of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").² Because Plaintiff has failed to raise a triable issue of fact as to whether the proffered reason for her termination was pretextual, Defendants are entitled to summary judgment.

II. BACKGROUND

A. Factual Background³

1. Plaintiff's Position And Responsibilities

Plaintiff was born in 1955 and began her employment at Lankenau in 1974 as a nurse's aide. (CSMF ¶¶ 1, 3, 4.) Plaintiff subsequently became an Instrument Room Technician and then an OR secretary, the position that she held for more than thirty-five years until her termination in 2016. (Id. ¶¶ 4, 6.) At the time of the events relevant to this lawsuit, there were two other OR secretaries at Lankenau, Barbara Hawkins and Linda Robinson. (Id. ¶¶ 5, 6.) Hawkins had worked as an OR secretary for more than ten years, and Robinson had worked in the OR for approximately six months. (Id. ¶ 8.) As an OR secretary, Plaintiff's duties included setting up the OR schedule, calling for patients, sending for blood and medications, patient billing, maintaining office supplies, setting up patient charts, and ordering staff uniforms. (Id. ¶ 7.) Plaintiff also was responsible for training Robinson, who described Plaintiff as very well informed about the OR secretary position. (Id. ¶¶ 9, 10; Robinson Dep. 12, SMF Ex. G and CSMF Ex. 4.)⁴ Plaintiff and the other OR secretaries self-scheduled with respect to arranging coverage among themselves if one of them was unable to work a scheduled shift. (CSMF ¶ 37.)

OR secretaries use a system called "SIS" to electronically schedule surgeries. (CSMF ¶ 12.) They can also access patient demographics—such as name, date of birth, social security number, phone number, emergency contact information, and insurance information—through an electronic database called "Invision," but they cannot access medical charts. (Id. ¶¶ 25-27; SMF ¶ 4.) During the time period relevant to this action, Plaintiff and the other OR secretaries were supervised by Administrative Coordinator Andrea Ledford and Nurse Manager Annette Frawley. (CSMF ¶¶ 48, 16.)

2. MLHI's Privacy And Disciplinary Policies

MLHI is subject to the regulations promulgated pursuant to HIPAA to protect the privacy, security, and confidentiality of health information. (SMF ¶ 5.) MLHI has implemented a number of policies and employee training programs related to the protection of confidential information and the disciplinary consequences of confidentiality violations. (SMF Exs. J, K, L, M, Q, R, S; CSMF Ex. 8.) For example, MLHI's Confidentiality Policy provides, in relevant part:

[A]ll employees ... are required to maintain the confidentiality of all privileged information. Privileged information consists of, but is not limited to, data that can be communicated verbally, electronically, or in hard copy regarding the following:

1. Patient information (e.g., diagnosis, content of medical records)

* * *

3. Employee information (e.g., salary, demographics)

(SMF ¶ 5, Ex. J.) The accompanying Confidentiality Statement requires employees to agree that they "will only access information on patients/employees about whom I have a business need to know." (SMF Ex. J.) The Statement also includes an employee acknowledgement that "any unauthorized access to, use of or disclosure of privileged information or any other confidential information concerning a current or past patient or employee ... may result in immediate discharge from employment with [MLH]." (Id. )

MLHI requires employees to undertake annual HIPAA compliance training and testing. (Id. ¶ 8.) MLHI's Compliance Program materials define Protected Health Information ("PHI") as "any information that is identifiable to a patient," including, name, address, email address, date of birth, and insurance and other financial information. (CSMF ¶ 42, Ex. 8.) The materials state that patients must authorize the disclosure of their PHI unless it is needed for treating the patient, for payment for treating the patient, or for health care operations. (Id. ¶ 43, Ex. 8.) Employees are also instructed that they must "[a]ccess only the information you need to do your job," and "[u]se the information to perform your job only." (Id. Ex. 8.) The training states that employees have the same HIPAA privacy rights as other patients. (SMF ¶ 10.)

Plaintiff participated in HIPAA training annually while employed by MLHI. (Id. ¶ 9.) Although Plaintiff undertook the training, she testified that she felt rushed to complete it during her work day, and she would sometimes skip ahead to the test without fully reading through the preceding materials.⁵ (Terrell Dep. 113-16, 132-33, 137-38, SMF Ex. A and CSMF Ex. 1.) When she answered test questions incorrectly, she would then go back and review the related training material more carefully. (Id. ) However, Plaintiff understood that she was only permitted to access patient information as needed to perform her job. (Terrell Dep. 125-126; SMF ¶ 11; Pl.'s Resp. to SMF ¶ 11.)

In April 2016, MLHI implemented a privacy monitoring system called "Fair Warning." (SMF ¶ 13.) Using algorithms, Fair Warning monitors and analyzes instances of access to patient records to identify any that lack a legitimate business purpose. (Id. ¶ 14.) When Fair Warning detects a potentially suspect instance of employee access to patient records, it sends an email to the employee's manager to determine whether there was a legitimate business need for the access. (Id. ¶ 15; CSMF ¶ 47.) If the manager does not identify a legitimate business need, the matter is referred to MLHI's Human Resources ("HR") department for investigation. (Id. ¶ 16.)

MLHI's Code of Conduct and Behaviors that Undermine a Culture of Safety ("Code of Conduct") provides examples of conduct that can lead to disciplinary action, including termination. (SMF Ex. K.) These include: "[u]nauthorized release/disclosure/access of confidential information," "[u]nauthorized and/or non-business related access, use or disclosure of electronic protected health information," and "[u]nauthorized and/or inappropriate use of MLH information system resources." (Id. ) The Code of Conduct further provides that violations "will lead to Performance Management action, up to and including termination of employment." (Id. )

MLHI's Performance Management Policy generally provides four color-coded levels of discipline: (1) performance expectations review (blue); (2) performance coaching (yellow); (3) corrective intervention (orange), and (4) termination (red). (SMF Ex. Q.) The policy directs managers to intervene "early in the development of [a] performance and/or behavioral concern to help the employee recognize and correct the deficiencies," but notes that "[t]here may be circumstances ... in which immediate termination ... is warranted." (Id. ) Under this policy, circumstances warranting termination include "[w]hen the issue is serious in nature," and "[w]hen the issue is either an egregious first time occurrence or a repeat occurrence of a behavioral or code of conduct violation." (Id.)

MLHI also has specific disciplinary guidelines for HIPAA/privacy violations.

(Employee Sanction Guidelines for HIPAA/Security Violations ("HIPAA Sanction Guidelines"). (SMF Ex. R.) The HIPAA Sanction Guidelines divide violations into four categories, each with mitigating and contributing factors and possible sanctions. (Id. ) The four categories are:

(1) accidental or inadvertent violation;

(2) failure to follow established privacy/security policies and procedures;

(3) deliberate or purposeful violation without harmful intent; and

(4) disclosure or use of PHI for illegal purpose or unauthorized public disclosure of PHI.

(Id. ) Examples of category 3 violations include "[a]ccessing PHI outside the scope of job duties (to compare coworker workloads, learn about clinical operations)" and "[c]hecking on a coworker, family member or neighbor." (Id. ) The possible sanctions for a category 3 violation are orange (corrective action) or red (termination).⁶ (Id. ; CSMF ¶ 86.)

Lankenau employees who violate HIPAA are not automatically terminated, and the level of discipline imposed depends upon the facts and circumstances of each case. (CSMF ¶ 92; Papa Dep. 11, SMF Ex. B and CSMF Ex. 2.) Lankenau's HR Director, Greg Papa, testified that the performance management program "is not meant to be progressive. It's meant to assign the performance management action that best fits the situation.... [I]f someone's act is egregious, we could go right to termination, or if it's deliberate or some other circumstance." (Papa Dep. 60-61.)

3. Circumstances Of Plaintiff's Termination

MLHI...