Indiana Attorney General Todd Rokita has dropped a lawsuit against IU Health and IU Healthcare Associates, alleging that the Indianapolis-based academic medical center neglected to train its employees and safeguard personal health information after a physician spoke to the media about a 10-year-old girl's abortion.
Mr. Rokita's office filed the lawsuit Sept. 15, alleging that IU Health and IU Healthcare Associates failed to properly report, review and enforce HIPAA and Indiana law violations.
The lawsuit came about a year after the patient and her mother visited an IU Health hospital to terminate the child's pregnancy, which resulted from rape. The attorney general's office contended that after the abortion, IU Health physician Caitlin Bernard, MD, violated the patient's privacy at a political rally. In May 2023, the Indiana Medical Licensing Board found that Dr. Bernard violated HIPAA and the Indiana patient confidentiality rule.
Experts in the medical field disagreed with the board's finding, and IU Health's own probe found Dr. Bernard did not violate privacy law, according to the Indianapolis Star.
A notice of voluntary dismissal filed Aug. 7 in federal court states that IU Health filed a motion to dismiss the case in November 2023, which was granted in June 2024. The state then filed an amended complaint in July.
"The initial and amended complaints were filed under the State's long held and critically important interest in protecting the health and welfare of its residents and those that receive healthcare within its borders, including the protection of an individual's medical privacy," the notice stated.
Mr. Rokita's office wrote in the filing that it has verified that IU Health has undertaken the various actions since July 1, 2022 — the day the child's story was published by the Star — "all in satisfaction of the deficiencies claimed in the attorney general's complaint and amended complaint."
Those actions include training employees to avoid talking about patients in public areas; notifying employees they are required to contact public relations staff before communication so management can verify patient authorization; and conducting employee training on what constitutes protected health information, according to a news release from Mr. Rokita's office.
In a statement shared with Becker's, IU Health maintained that it did not violate HIPAA and acknowledged that the attorney general's complaints were dismissed. "However, we are disheartened by the suggestions made in the Indiana attorney general's notice of dismissal that implied corrective action was required by IU Health," the health system said.
"IU Health has and will continue to maintain its robust HIPAA compliance policies and training for its team members, as it has for years."