DECISION AND JUDGMENT
YARBROUGH, J.
Introduction
{¶ 1} Appellant, Rebecca L. Wegrzyn, appeals the decision of the Lucas County Court of Common Pleas, which affirmed a decision of the Ohio Unemployment Compensation Review Commission ("the Commission") denying unemployment benefits to appellant, an X-Ray and CT Technologist. The appellees are the Director of the Ohio Department of Job and Family Services ("Director"), the Commission, and Mercy Riverside Hospital ("Riverside"), Wegrzyn's former employer.
Facts and Procedural History
{¶ 2} Beginning in August 2004, Wegrzyn worked at Mercy St. Anne's Hospital ("St. Anne's"), previously known as Riverside, located in Toledo, Ohio, which is owned and operated by Mercy Health Partners ("MHP"). On November 20, 2009, Wegrzyn was terminated for accessing confidential information thereby breaching Riverside's Health Insurance Portability and Accountability Act ("HIPAA") policy.
{¶ 3} Following her termination, Wegrzyn filed an application for unemployment compensation on November 21, 2009, with the Director. Wegrzyn received unemployment compensation benefits from November 28, 2009, through January 9, 2010. Thereafter, on January 15, 2010, the Director issued a redetermination disallowing Wegrzyn's claim for benefits, and additionally ordered Wegrzyn to repay the benefits that she received. Wegrzyn appealed, and on February 3, 2010, the appeal was transferred to the Commission.
{¶ 4} On February 25, 2010, and April 30, 2010, evidentiary hearings were held before a hearing officer. In a decision dated June 4, 2010, the hearing officer affirmed the Director's January 15, 2010 redetermination finding that Wegrzyn was discharged from her employment for just cause.
{¶ 5} Wegrzyn filed a request for review of the hearing officer's decision, which was denied in a July 6, 2010 decision from the Commission. On August 2, 2010, Wegrzyn filed an administrative appeal with the trial court. In a decision journalized on May 17, 2011, the trial court affirmed the decision of the Commission which determined that Wegrzyn was terminated for just cause.
{¶ 6} This appeal followed.
Assignments of Error
{¶ 7} Wegrzyn asserts the following assignments of error:
1. That the Lower Court did not review or take into consideration and in fact did NOT even write the Fact that The Hearing Officer in her Findings of Fact, stated that she had testimony under oath from an eye witness, "Melissa Robertson". That this witness said and testified that she witnessed this fact, that this appellant accessed medical records on November 7, 2009. When the certified transcripts clearly show that this eye witness Never testified that she seen this. And was not even there that day. The Lower Court never even wrote about this. This is the Major point in all this. And the Lower Court did not consider this at all. The Hearing Officer has/had her facts totally incorrect. And the hearing Officer is incorrect in her Findings of Fact. [sic throughout]
2. That the Lower Court is incorrect in its findings about the Hospitals [sic] "Employers" written policy.
Analysis
{¶ 8} In her first and second assignments of error, Wegrzyn contends that the trial court erred in finding that the Commission's decision was supported by the evidence and was not unlawful, unreasonable, or against the manifest weight of the evidence. Because these two assignments of error are interrelated, they will be discussed together.
{¶ 9} Generally, when reviewing a trial court's determination regarding whether the order of an administrative agency is supported by the evidence, the appellate court determines only whether the trial court abused its discretion. See Rossford Exempted Village School Dist. Bd. of Edn. v. State Bd. of Edn., 63 Ohio St.3d 705, 707, 590 N.E.2d 1240 (1992).
{¶ 10} However, the process of filing applications with the Director for determination of benefit rights and claims for unemployment compensation benefits is set forth in R.C. 4141.28. As a reviewing court, we may only reverse an unemployment board determination if it is unlawful, unreasonable, or against the manifest weight of the evidence. Tzangas, Plakas & Mannos v. Ohio Bur. of Emp. Services, 73 Ohio St.3d 694, 653 N.E.2d 1207 (1995), paragraph one of the syllabus. While this court is not permitted to make factual findings, or to determine the credibility of witnesses, we have the duty to determine whether the Commission's decision is supported by the evidence in the record. Id. at 696. The same standard of review is shared by all reviewing courts, from the common pleas court through the Ohio Supreme Court. Id. As a reviewing court, we may not substitute our judgment for that of the Commission on questions of fact or reassess the credibility of the witnesses. Kilgore v. Bd. of Rev., Bur. of Unemp. Comp., 2 Ohio App.2d 69, 72, 206 N.E.2d 423 (4th Dist.1965).
{¶ 11} Pursuant to R.C. 4141.29(D)(2)(a), no individual may receive benefits if that individual "has been discharged for just cause in connection with the individual's work." In Irvine v. State of Ohio Unemp. Comp. Bd. of Rev., 19 Ohio St.3d 15, 17, 482 N.E.2d 587 (1985), the Ohio Supreme Court defined "just cause" as "that which, to an ordinarily intelligent person, is a justifiable reason for doing or not doing a particular act." Thus, the issue before us focuses on whether Riverside's decision to terminate appellant from her position was justified under such a standard.
{¶ 12} Our review of the record reveals that the hearing officer made the following relevant findings of fact:
[Wegrzyn] had received training on HIPAA and confidential information at the hospital. The employer's written policy allows for immediate termination for any HIPAA breach. An example of the breach, according to the employer's written policy, would include someone looking up a neighbor about why they were in the hospital, but without a medical need to do so in order to perform their job.
[Wegrzyn] was terminated for accessing a patient's history, one of her daughter's friends, on November 7, 2009, without the need to do so in order to perform her job. Melissa Robertson, MRI Technologist, was a witness to the fact that claimant had accessed this particular patient's history. The Employer's Policy
{¶ 13} As to the evidence in the record that supports Wegrzyn's termination for cause, the certified record from the Commission contains the hospital's "Regional Policy and Procedure." This document states,
POLICY:
It is the policy of [MHP] to mitigate any harmful effects from the misuse of protected healthcare information by the hospital or any business associates.
PROCEDURE:
* * *
3. If an employee has misused the information, the Human Resources will determine employee sanctions based on MHP policy.
* * *
5. The hospital reserves the right to terminate a business associate agreement in the event the misuse of confidential information continues despite counseling.
* * *
SANCTIONS:
Violations of MHP policies may result in the restriction of access to MHP resources. In addition, disciplinary action, up to and including termination, may be applicable under other MHP policies, guidelines and implementing procedures. (Emphasis added.)
{¶ 14} Despite Wegrzyn's repeated argument in reliance on procedure number 5 that she was required to receive counseling prior to being terminated, this procedure has no relation to Wegrzyn as an employee of the hospital. The policy clearly distinguishes "employees" from "business associates." Per procedure number 3 of this policy, an employee's sanctions are determined by the hospital's human resources department based upon MHP policy.
{¶ 15} In addition to the Regional Policy, the record contains a "Confidentiality" policy dated January 30, 2009, which states:
All patient information is confidential and the property of MHP. Any attempt to reveal, access, disclose, review, copy or transmit Confidential Information without a legitimate business need and appropriate authorization is a violation of this policy. This includes, but is not limited to:
1. Accessing patient records, including information pertaining to a friend, co-worker, relative or public figure or yourself without the proper authorization and a business need to know.
{¶ 16} This policy also sets forth the following remedy for violations, "A violation of this policy may be grounds for corrective action, up to and including immediate termination as outlined in Corrective action policy eHR 5.0. In addition, [MHP] may seek other relief, including but not limited to restraining orders, monetary damages and other actions in law and equity." (Emphasis added.)
{¶ 17} Furthermore, an "Information Security Agreement" signed by Wegrzyn and dated August 16, 2004, is included in the certified record. In this document, Wegrzyn agreed to the following as a condition of her employment:
2. I understand that it is the policy of [MHP] to grant information access on a "need to know" basis only. Therefore, I agree not to seek additional access beyond that which has been provided to me to carry out my duties and responsibilities.
3. I understand that [MHP] may issue one or more access IDs and passwords enabling me to identify myself to various computer systems. Since an access ID is equivalent to a written signature, I agree never to disclose my password to any other person, and I assume full responsibility for all transactions conducted under the authority of my access ID.
* * *
7. I understand that any willful destruction, unauthorized modification, or unauthorized disclosure of confidential information belonging to [MHP] constitutes a legal and ethical breach of this agreement. I will become subject to disciplinary action up to and including dismissal, and may also be subject to civil or criminal prosecution. (Emphasis added.)
{¶ 18} Thus, the record clearly demonstrates that immediate employment termination is an appropriate sanction for a HIPAA violation.
Wegrzyn's HIPAA Violation
{¶ 19} In demonstrating that Wegrzyn accessed a record against the hospital's HIPAA policy, Riverside introduced a document from its human resources manager, Kay Lesle-Pilner, showing that Wegrzyn's user identification number was used to access a patient record five times on November 7, 2009, through a system-wide database. The record reflects that Wegrzyn was at work on this particular day. Testimony reveals that the patient whose record was accessed by Wegrzyn was 15 years old, and was receiving care at Mercy St. Charles Hospital ("St. Charles"), and not at the hospital where Wegrzyn was employed.
{¶ 20} Melissa Robertson, Wegrzyn's coworker, testified that Wegrzyn had a discussion with Robertson wherein Wegrzyn revealed that a friend's 15-year-old daughter was receiving care at St. Charles and would be transferred to Mercy St. Vincent's Hospital ("St. Vincent's"). Robertson testified that in this conversation, Wegrzyn admitted that she had, on a prior date "looked up some information to do with [the patient] [to] see how she was doing and stated that she had had [sic] uh an X-ray or a CT of her chest that day." Following this conversation, Robertson reported the incident to Janet Miller, Wegrzyn's supervisor.
{¶ 21} In rebuttal, Wegrzyn testified that she spoke directly with the 15-year-old patient's mother and that is how Wegrzyn learned of the patient's condition, whereabouts, and treatment. Wegrzyn complains that the Commission did not note in its findings of fact that Robertson was not at work on November 7, 2009. After reviewing the record, it is clear that Robertson never claimed to have been an "eye-witness" to Wegrzyn's HIPAA violation. Robertson reported Wegrzyn to Miller following the conversation with Wegrzyn on a later date. It is apparent that the hearing officer believed Robertson's recollection of the conversation with Wegrzyn, and determined that it was insignificant that Robertson did not see Wegrzyn physically access the patient's information. The hospital investigated, and confirmed that Wegrzyn accessed the patient's information without a business need to do so. Testimony from Robertson also reflects that Wegrzyn disclosed the information to Robertson, which alone is a HIPAA violation per MHP policy. We must defer to the hearing officer's determination of Robertson's credibility as a witness, and find that the record supports the Commission's finding that Wegrzyn accessed confidential information without a business need to do so against the hospital's HIPAA policy.
{¶ 22} In further support of her position, Wegrzyn called Dr. Ryan Stahl, an emergency room physician at St. Anne's, to testify on her behalf. Dr. Stahl testified that he would have Wegrzyn pull records of patients to determine the patient's medical history. However, there was no testimony from Dr. Stahl to support Wegrzyn's contention that a physician ordered her to access a patient's medical history in an instance when a patient is located at a different hospital. In fact, when questioned at the hearing, Wegrzyn admitted that a physician did not ask her to access the files of the minor patient located at a different hospital.
{¶ 23} We find that the Commission's decision, and the trial court's decision affirming the same, was supported by some evidence in the record, and therefore was not unlawful, unreasonable, or against the manifest weight of the evidence.
{¶ 24} Accordingly, we find Wegrzyn's first and second assignments of error not well-taken.
Conclusion
{¶ 25} In consideration whereof, we find that substantial justice was done. The decision of the Lucas County Court of Common Pleas is affirmed. Wegrzyn is ordered to pay the costs of this appeal pursuant to App.R. 24.
Judgment affirmed.
A certified copy of this entry shall constitute the mandate pursuant to App.R. 27. See also 6th Dist.Loc.App.R. 4.
Mark L. Pietrykowski, J., Arlene Singer, P.J., Stephen A. Yarbrough, J., Concur.
