◆ A divided Indiana Court of Appeals has reinstated a patient’s claim that a hospital is vicariously liable for the actions of a medical assistant who accessed the patient’s medical records and then shared details with her husband, according to The Indiana Lawyer.^[1] The patient, Haley SoderVick, sued Fort Wayne-based Parkview Health System Inc. after Parkview notified her in May 2018 of the disclosure of her protected health information (PHI). SoderVick had gone to an appointment with an obstetrician-gynecologist on Parkview’s campus in Wabash in October 2017, and while she was there, medical assistant Alexis Christian accessed her medical records for one minute, the court record shows. “Christian then immediately texted information about SoderVick to Christian’s then-husband, Caleb Thomas,” Judge John Baker wrote for the majority. “In these texts, Christian disclosed SoderVick’s name, the fact that she was a patient, a potential diagnosis, and that she worked as a dispatcher. Christian also texted Thomas that SoderVick was HIV-positive and had had more than fifty sexual partners, although this information was not included in her chart and was ultimately false,” Baker wrote. “Christian testified that she had been checking Facebook on her phone during her lunch break earlier that day and had seen that SoderVick had liked a photo of Thomas. Later that afternoon, when Christian was ‘inputting chart information and came across all of that information’ about SoderVick, she claims she felt ‘concerned’ and therefore texted her husband asking if and how he knew SoderVick, curious as to whether they might have had a sexual history together.” According to the court record, Thomas’ sister saw the texts on his phone and notified Parkview, which investigated the potential HIPAA violation, ultimately firing Christian and notifying SoderVick. The case was remanded to the trial court for further proceedings.