Even a brief posting of private information on an Internet site amounts to “publicity per se” sufficient to support a civil action for invasion of privacy, according to a three judge panel of the Minnesota Court of Appeals in Yath v. Fairview Clinics, filed June 23, 2009. Candace Yath was a patient at the defendant clinic, where she sought testing for sexually transmitted diseases because she had a new sex partner. She was observed there by a clinic employee, Tek, who was an acquaintance. Tek later (and in violation of clinic policy) accessed Yath’s medical file, learning of Yath’s new sex partner (Yath was at the time married but estranged from her husband) and that Yath had been diagnosed with a sexually transmitted disease. Tek informed a second person, also an acquaintance (and relative) of Yath about the medical file information. Word soon spread to a group of people, including Yath’s husband.

One month later a web page appeared at MySpace.com bearing the title “Rotten Candy,” and including a photo of Yath and the contents of her medical file. The MySpace page asserted that “Rotten Candy” has a sexually transmitted disease, had recently cheated on her husband and was addicted to plastic surgery. After learning about the Internet posting, the clinic manager investigated. When the manager first accessed the webpage, it listed only six “friends,” indicating that at least six persons had accessed the page. When the manager tried again to access the web page, one or two days later, the webpage had been removed.

Yath sued the clinic and the two individuals, alleging a claim for invasion of privacy based on the publication of private facts. To state this claim, Yath was required to establish that defendants gave “publicity” to a private matter, that the publicity would be highly offensive to a reasonable person and that the matter is not of legitimate concern to the public.

Given the subject matter of the MySpace posting, the “publicity” element of the claim was the only one truly in dispute here. The trial court dismissed Yath’s claim because she failed to prove that more than a small number of people had actually viewed the webpage. Reversing, the court of appeals ruled that Yath was not required to prove that a large number of individuals accessed the webpage because the information had been made available directly to the public via the unprotected MySpace page, which the court equated to a “public forum.” To quote the court, publicity “occurs at the point when the communication is made to the public at large, not to a large number of the public.” The court nevertheless affirmed summary judgment against Yath because she had failed to offer sufficient evidence linking the defendants to the creation of the MySpace page.

Also of interest is the court’s ruling that Minnesota’s statute authorizing a civil action for damages against a person improperly disclosing health records is not preempted by the federal Health Insurance Portability and Accountability Act (HIPAA). The state statute in question, presently codified at Minnesota Statute section § 144.298, permits recovery by the patient of compensatory damages and attorneys’ fees against a person who intentionally or negligently discloses health records in violation of law. Finding that the civil remedy was complementary to, rather than contrary to HIPAA’s criminal sanctions for similar conduct, the court reversed the trial court’s dismissal of plaintiff’s state law claim.

This entry was authored by Donald “Tad” Selzer.