Court rejects wrongful termination claim against UC Health after HIPAA report

Three days later, Drake reported the suspected violation to her supervisor. When she did not hear back, she followed up with a different supervisor in January 2024. That follow-up triggered an investigation into the coworker, and during the process, UC Health realized Drake knew more about the patient than the care team did. The compliance department confirmed her access. 

When her supervisor inquired, Drake initially did not recall viewing the record but later acknowledged she must have done so to get the patient’s name for her report. UC Health’s internal policy limited access to patient records to three purposes: treating the patient, billing, or managing a department. Drake’s access did not fall within any of them. 

Her supervisor pushed back on the termination recommendation, telling HR that Drake had acted in good faith and only briefly viewed the record. He also raised concerns about the impact a termination could have on future good-faith reporting. HR held firm. The organization’s strict practice, its chief compliance officer later testified, was automatic termination for unauthorized access to patient records. Both the senior HR partner and Drake’s supervisor said they were unaware of any instance in which UC Health had handled such a violation differently. 

Drake was terminated on February 7, 2024. She sued, arguing the firing violated Ohio public policy because her access was motivated by an effort to report illegal conduct. The trial court sided with UC Health, and the appellate court agreed. The three-judge panel found that Drake failed to show the employer’s stated justification was pretextual. 

Her argument that UC Health’s progressive discipline policy should have applied fell short – the policy permitted termination for this type of violation and did not require lesser discipline first. Text messages Drake submitted from a coworker who claimed she had not been fired for a similar violation were discounted as hearsay because the coworker never testified. The court also declined to weigh in on whether HIPAA itself would have permitted Drake’s access, noting that UC Health fired her for violating its own internal policy, not federal law.