Wills v. Jesson, et al., A18-0948 (Minn. App., Feb. 4, 2019), unpublished.

The Minnesota Court of Appeals affirmed a motion to dismiss on a complaint that alleged violation of both the Minnesota Health Records Act (MHRA) and the Data Practices Act, “when another [Minnesota Sex Offender Program] patient improperly received and read a portion of Wills’s quarterly treatment progress report.”

The Court of Appeals indicated that under Minn. Stat. § 144.293, subd. 2 of the MHRA, only the person who releases the individual’s health records is liable, and noted that Wills failed to allege that a former Minnesota Department of Human Services Commissioner (Jesson) is the person who released the records at issue. The Court further rejected Wills’ vicarious liability arguments due to the statute “explicitly impos[ing] liability on the person who improperly discloses patient’s health records, and not on anyone else.” As a result, the MHRA claim was appropriately dismissed.

The district court dismissed the Data Practices Act claim due to Wills’ failure to plead actual damages. However, the Court of Appeals upheld the district court’s dismissal on other grounds.

The Court stated that Minn. Stat. § 13.08 has three elements: (1) the defendant be the “responsibility authority;” (2) the responsibility authority violated the Data Practices Act; and (3) the plaintiff suffered damages as a result of the Data Practices Act violation. In its analysis, the Court of Appeals stated that Jesson is the responsible authority and as a result, the complaint meets the first element.

However, in evaluating the second element the Court of Appeals determined that the complaint does not allege that Jesson herself violated the Data Practices Act. The Court of Appeals subsequently rejected Wills’ argument that Jesson is liable under the doctrine of respondeat superior, instead stating that the plain language of Minn. Stat. § 13.08 “limits liability to a responsible authority if he or she commits a violation of the statute.” As a result, the Court of Appeals held that the Data Practices Act claim was properly dismissed as this second element was not met.

Although it was unnecessary for the Court of Appeals to evaluate whether the complaint met the third element, in dicta, the Court of Appeals discussed the damages element and noted that individuals may recover damages for emotional harm, but must still prove the nature and extent of the damages and harm.