HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Federal Judge Rules in Favor of UMMC in Legal Battle Over Theft of Patient Data

A federal judge has ruled in favor of University of Mississippi Medical Center (UMMC) in an unauthorized access and data theft case against three former employees.

UMMC took legal action against Dr. Spencer Sullivan and other former employees over the alleged theft and use of patients’ medical records. In July 2014, UMMC hired Dr. Sullivan as the medical director of its Hemophilia Treatment Center. When he joined UMMC, Dr. Sullivan signed a contract with a non-compete clause, which prevented him from using UMMC data to solicit patients for an independent practice.

According to the lawsuit, in January 2016, Sullivan started making arrangements to open his own hemophilia clinic and pharmacy and conspired with other UMMC staff members – Linnea McMillan, Kathryn Sue Stevens, and Rachel Henderson Harris – to assist with setting up the new practice, which included compiling a list of UMMC patients.

A patient list was created that included patient names, telephone numbers, dates of birth, diagnosis, prescription information, insurance information, and pharmacy information. After setting up the practice, in June 2016 Dr. Sullivan resigned from UMMC and used the patient list to solicit patients and encouraged them to continue their treatment at his new Mississippi Center for Advanced Medicine in Madison, MS.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Around 20 UMMC employees were recruited to work at the new, for-profit medical center and most of the patients of Batson Children’s Hospital chose to follow their physicians and switched to the new clinic.

UMMC took legal action against Dr. Sullivan and his co-conspirators alleging violations of the Computer Fraud and Abuse Act and the Federal Trade Secrets Act, with all defendants denying stealing patient information from UMMC. In 2018, the Clarion-Ledger covered the story and ongoing legal battle between UMMC, Sullivan, and his co-conspirators. After reading the story, McMillan’s ex-husband contacted UMMC and provided a copy of the patient list, which he said he found in his ex-wife’s car. That discovery marked a major shift in the litigation; however, even though the list had been recovered, the defendants continued to deny stealing and using patient data under oath.

Then, in April 2021, Harris admitted to lying in her deposition and provided 1,469 pages of text messages that were sent by herself and her co-defendants in relation to the UMMC patient data, which revealed that they had conspired to shred stolen documents, which included destroying patient data. She also confirmed that Sullivan, McMillan, Stevens, and herself had used the patient list. On June 22, 2020, the court dismissed with prejudice all claims against Harris.

On March 12, 2021, UMMC filed a motion for default judgment against the remaining defendants, alleging they had all committed perjury and had all engaged in spoliation of evidence by destroying the patient list and other data stolen from UMMC.

Sullivan had denied possessing hard drives containing files and emails stolen from UMMC, but when a magistrate judge ordered him to provide either the hard drives or his computer, Sullivan admitted possessing files on a hard drive and USB drive and provided them to the defense team.

On October 8, 2021, U.S. District Judge Carlton Reeves issued a default judgment in favor of UMMC and the case has now been scheduled for trial on February 16, 2020.

“The Court issued a default judgment against defendants who destroyed, and then before this Court lied and denied destroying, data essential to the plaintiff’s claim. In so ruling, this Court emphasized that Defendant’s conduct constituted “an assault on this Court’s ability to find the truth, to do justice,” wrote Reeves. “At every turn, Defendants’ persistent lies under oath, willful destruction of evidence, and obstinate withholding of evidence thwarted UMMC’s discovery efforts. This pattern of evasion unnecessarily drove up the expense of litigation, both in time and in money, for UMMC. Once caught, defendants showed little remorse.”

Reeve went on to write, “Defendants’ lies and evasions, particularly Dr. Sullivan’s recent conduct in relation to the long-sought hard drives, suggest that nothing less than the full exercise of this court’s inherent power will command the defendants’ respect for the judicial process, or secure their commitment to telling this court the truth.”

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.