BROWN, Judge.

Courtney R. Robbins appeals the trial court's grant of summary judgment in favor of the Trustees of Indiana University and Clarian Health Partners, Inc. She raises the following two issues, which we revise and restate as:

We affirm.

Facts and Procedural History

In September 2010, Tiffaney DeBow, a licensed practical nurse, applied for a job at the Indiana University School of Medicine. Her application revealed that she had been a nurse for twelve years and had worked at three hospitals and a nursing home. Her application also revealed that she had been convicted of misdemeanor battery in May 2009. When questioned about the conviction, DeBow explained that during a confrontation with a woman who had made comments about DeBow's daughter on the Internet, DeBow poked the woman on the forehead.

As part of the application process, DeBow also read and signed the Indiana University Department of Medicine Commitment to Confidentiality Agreement, which provides in relevant part as follows:

Appellant's Appendix at 49.

The Confidentiality Agreement also provided in part:

Id.

After DeBow completed her employment application, an independent company conducted a pre-employment background check on her for the Trustees. The search revealed the misdemeanor battery conviction, which resulted in a one-year sentence with all but four days suspended, community service, six months on probation and twelve anger management classes. The search also revealed dismissed charges for class A misdemeanor criminal mischief in 2006 and class A misdemeanor driving while suspended in 2008 as well as a probation violation.

Following the background check, DeBow was offered a position providing health care services to the patients of the School of Medicine's Gastroenterology Department. After DeBow accepted the position, Nada Phoenix, acting on behalf of the School of Medicine, submitted an Access Request to Clarian Data Security to provide DeBow a username and password so she could access two electronic medical records systems owned by Clarian. Phoenix also submitted DeBow's signed Responsibility Statement wherein DeBow agreed to keep information in the medical records confidential and not to disclose it for personal, unauthorized, unethical, or illegal reasons. Both the Access Request and Responsibility Statement identified DeBow as a non-Clarian employee.

On October 11, 2010, her first day of work, DeBow began accessing the medical records of Robbins and her children. Specifically, a medical records access report shows that on October 11 and 13, DeBow accessed the medical records of Robbins and her children forty-two times between 2:05 p.m. and 4:28 p.m. Robbins was not a patient of the gastroenterology department, and the medical records DeBow accessed were not created in connection with treatment and care of Robbins at the School of Medicine. DeBow found the information in one of the medical records systems owned by Clarian. On October 13, DeBow posted medical information about Robbins obtained from these records on Robbins's former boyfriend's internet blog. When confronted by her employer, DeBow admitted what she had done and that she knew it was wrong. She admitted "that there was no legitimate business reason for her to access the records and explained that her sole motivation was that... [she] desired revenge." Id. at 54.

Pursuant to a plea agreement executed in February 2012, DeBow pled guilty in federal court to the felony charge of wrongful disclosure of individually identifiable health information for obtaining Robbins's health information during the course of her employment with the intent to transfer and use that information for personal gain and malicious harm and to embarrass Robbins, and DeBow was sentenced to probation for a term of three years and was fined $1,000.

In November 2012, Robbins filed an amended complaint against the Trustees and Clarian wherein she alleged that the defendants were vicariously liable for the actions of DeBow, who allegedly committed the torts of invasion of privacy by the public disclosure of private facts and intentional infliction of emotional distress. Robbins alternatively argued that if the Trustees were not vicariously liable to her for these acts, they were liable to her for negligently hiring DeBow.

The Trustees and Clarian filed summary judgment motions. The Trustees designated DeBow's affidavit in support of their motion. In the affidavit, DeBow explained that she accessed Robbins's medical records for "personal reasons." Id. at 57. According to DeBow, she and Robbins "had been involved in an acrimonious personal feud for many years and that was [her] motivation to disclose protected medical information." Id. DeBow further explained that she "was acting on [her] own initiative and not within the scope of [her] employment when [she] accessed and published [] Robbins' records," that she "was not involved in any way in the provision of medical care to [] Robbins or her children," and that she "knew it was against [her] employer's policies and rules and [her] acts were not part of [her] job." Id. Following a hearing, the trial court granted summary judgment in favor of the Trustees and Clarian.

Discussion

Summary judgment is appropriate only when there are no genuine issues of material fact and the moving party is entitled to judgment as a matter of law. Ind. Trial Rule 56(C). In reviewing a trial court's ruling on summary judgment, this court stands in the shoes of the trial court and applies the same standard in determining whether to affirm or reverse the grant of summary judgment. Doe v. Lafayette Sch. Corp., 846 N.E.2d 691, 696 (Ind.Ct.App.2006), reh'g denied. We must therefore determine whether there is a genuine issue of material fact and whether the trial court has correctly applied the law. Id.

Relying on specifically designated evidence, the moving party bears the burden of making a prima facie showing that there are no genuine issues of material fact and that it is entitled to judgment as a matter of law. Id. If the moving party meets this burden, the burden then shifts to the nonmovant to set forth specifically designated facts showing that there is a genuine issue for trial. Id.

A genuine issue of material fact exists where facts concerning an issue that would dispose of the issue are in dispute or where the undisputed material facts are capable of supporting conflicting inferences on such an issue. Id. In our review, we consider all of the designated evidence in the light most favorable to the nonmoving party. Id.

I.

A. Clarian

The first issue is whether the trial court erred in granting summary judgment in favor of the Trustees and Clarian on the issue of vicarious liability. According to Robbins, the Trustees and Clarian are vicariously liable to Robbins for the actions of DeBow, who allegedly committed the torts of invasion of privacy with the public disclosure of private facts and intentional infliction of emotional distress. Vicarious liability will be imposed upon an employer under the doctrine of respondeat superior where the employee has inflicted harm while acting within the scope of employment. Barnett v. Clark, 889 N.E.2d 281, 283 (Ind.2008).

At the outset, we note that the parties agree that Clarian was not DeBow's employer. Robbins, however, argues that Clarian can be held liable under the respondeat superior doctrine because Clarian and the Trustees were in a joint venture and DeBow was Clarian's agent.

A joint venture is an association of two or more persons formed to carry out a single business enterprise for profit. Walker v. Martin, 887 N.E.2d 125, 138 (Ind.Ct.App.2008), reh'g denied, trans. denied. In a joint venture, the parties must be bound by an express or implied contract providing for (1) a community of interests, and (2) joint mutual control, which is an equal right to direct and govern the undertaking that binds the parties to the agreement. Id. A joint venture is similar to a partnership except that a joint venture contemplates a single transaction. Id. A joint venture agreement must also provide for the sharing of profits. Id.

Our review of the designated materials reveals a Definitive Health Care Resources Consolidation Agreement, which sets forth the relationship between Clarian and the Trustees. Specifically, the Agreement provides in relevant part as follows:

Appellant's Appendix at 536. Because this Agreement does not give Clarian and the Trustees an equal right to direct and govern any undertaking and does not provide for the sharing of profits, Clarian and the Trustees were not in a joint venture for the purpose of a finding of vicarious liability.

And DeBow was not Clarian's agent. For the liability of an agent to be imputed to a principal, an agency relationship must exist. Smith v. Delta Tau Delta, Inc., 9 N.E.3d 154, 164 (Ind. 2014). An essential element of that relationship is that the agent must act on the principal's behalf. Id. The agent must also consent to act on the principal's behalf and be subject to the principal's control. Id. Whether an agency relationship exists is generally a question of fact, but if the evidence is undisputed, summary judgment may be appropriate. Id.

Our review of the designated evidence reveals that DeBow, who took care of patients in the medical school's gastroenterology department, did not act on Clarian's behalf and was not subject to Clarian's control. Rather, at the medical school's request, Clarian simply issued a username and password to DeBow so that she could access the electronic medical records that Clarian owned. Clarian is not subject to vicarious liability for DeBow's actions.

B. Trustees

We next turn to whether the Trustees as DeBow's employer may be held vicariously liable for the actions of DeBow. In her amended complaint, Robbins alleged that the Trustees were vicariously liable for the actions of DeBow and that DeBow committed the tort of invasion of privacy by the public disclosure of private facts as well as the tort of intentional infliction of emotional distress. If the Trustees may not be held vicariously liable for the actions of DeBow, then the Trustees are entitled to summary judgment with respect to Robbins's claim based on the alleged public disclosure of private facts by DeBow, and her claim based on the alleged intentional infliction of emotional distress by DeBow.1

Under the doctrine of respondeat superior, an employer, who is not liable because of its own acts, can be held liable "for the wrongful acts of his employee which are committed within the scope of employment." Doe, 846 N.E.2d at 701. An employee is acting within the scope of her employment when she is acting, at least in part, to further the interests of her employer. Id. Where an employee acts partially in self-interest but is still partially serving her employer's interests, liability will attach. Id. at 701-702. However, simply because an act could not have occurred without access to the employer's facilities does not bring it within the scope of employment. Id. at 702.

In addition, although Indiana courts have established that an employer can be vicariously liable for the criminal acts of an employee, this determination depends upon whether the employee's actions were authorized by the employer. Id. If it is determined that none of the employee's acts were authorized, there is no respondeat superior liability. Id. "Furthermore, acts for which the employer is not responsible are those done `on the employee's own initiative, [] with no intention to perform it as part of or incident to the service for which he is employed." Id. (quoting Stropes v. Heritage House Childrens Ctr., 547 N.E.2d 244, 247 (Ind.1989), reh'g denied). "However, an employee's wrongful act may still fall within the scope of his employment if his purpose was, to an appreciable extent, to further his employer's business, even if the act was predominantly motivated by an intention to benefit the employee himself." Stropes, 547 N.E.2d at 247. If some of the employee's actions were authorized, the question of whether the unauthorized acts were within the scope of employment is one for the jury. Doe, 846 N.E.2d at 702. The Indiana Supreme Court, in addressing an employer's vicarious liability for an employee's wrongful actions, addressed whether the employee was explicitly or impliedly authorized to take the action and whether the acts were an extension of authorized acts, were incidental to or associated with the employee's authorized duties, furthered the employer's business, or were motivated to any extent by the employer's interests. See Barnett, 889 N.E.2d at 286.

In support of her argument that the trial court erred in granting summary judgment in favor of the Trustees, Robbins directs us to this court's opinion in Walgreen Co. v. Hinchy, 21 N.E.3d 99 (Ind.Ct. App.2014), on reh'g, 25 N.E.3d 748 (Ind.Ct. App.2015), trans. denied. In Walgreen, a pharmacist, while at work, looked up the prescription profile of a customer in the Walgreen computer system. 21 N.E.3d at 104. A person who was in a relationship with the pharmacist sent text messages to the Walgreen customer stating that he had a printout related to the customer's prescription information. Id. at 104-105. The customer later contacted Walgreen to report her suspicion that the pharmacist had looked at her personal records and disclosed the information she learned to an unauthorized individual. Id. at 105. In addressing vicarious liability under the doctrine of respondeat superior, this court found that the pharmacist's actions were of the same general nature as those authorized, or incidental to the actions that were authorized, by Walgreen. Id. at 108. The court noted that the pharmacist was authorized to use the computer system, handle prescriptions for customers, look up customer information, review patient prescription histories, and make prescription-related printouts. Id. The court further observed that the customer belonged to the general category of individuals to whom the pharmacist owed a duty of privacy protection by virtue of her employment as a pharmacist. Id. The court held that the fact that some of the pharmacist's actions were authorized, or incidental to authorized actions, or of the same general nature as authorized actions, precluded summary judgment. Id.

The court in Walgreen also discussed this court's previous opinion in Doe, 846 N.E.2d 691. In Doe, a teacher gathered email addresses from his students in order to communicate with them about homework and other matters. Id. at 695. The teacher later advertised in an email to his students that he and his wife were looking for a babysitter, Doe responded, and soon thereafter began babysitting for the teacher. Id. The relationship between the teacher and Doe became romantic, and the email exchanges between them became sexually charged. Id. In emailing Doe, the teacher used a personal email account but regularly sent the emails using a school-provided laptop computer, and some of the emails were sent during school hours. Id. The teacher was later convicted of child seduction and engaging in deviate sexual conduct. Id. Doe filed a complaint for damages against the school, and the trial court entered summary judgment in favor of the school, noting the teacher was not acting within the scope of his employment but rather acting on his own initiative. Id. at 695-697. Doe appealed and argued in part that the school was vicariously liable for the acts of the teacher by way of the doctrine of respondeat superior. Id. at 701.

In support of her argument that the school was vicariously liable, Doe argued that the teacher used a school-provided laptop to send her emails and that emailing students was an act authorized by the school. Id. This court observed that, if some of an employee's actions were authorized, the question of whether the unauthorized acts were within the scope of employment is one for the jury. Id. at 702. We noted that, simply because the teacher used the school's equipment and facilities to initiate a relationship with Doe, his acts did not necessarily fall within his scope of employment. Id. We held that, while the school authorized the teacher "to send emails to students for school purposes," there was no indication that the school "authorized him to send emails to students for personal reasons." Id. On this basis, we concluded that the teacher, "on his own initiative and unrelated to any school function," instigated an intimate relationship with Doe. Id. We also concluded that his actions "were not incident to any service provided by [the school], but rather were fueled entirely by self-interest in a romantic relationship with Doe." Id. We affirmed the entry of summary judgment in favor of the school. Id.

We find the reasoning in Doe persuasive in light of the particular facts and circumstances of this case. DeBow accessed Robbins's medical records while at work. However, like in Doe, the fact that DeBow used the access provided to her to obtain Robbins's medical information does not necessarily mean that her acts were within her scope of employment. Id.

Importantly, in signing the Indiana University Department of Medicine Commitment of Confidentiality Agreement, DeBow agreed that she would "only access, use (read, add, change, or delete), or disclose information for which [she had] a business reason and [was] authorized to do so" and that "[a]t no time [would she] access, use, or disclose confidential or sensitive information to any person or third party for a personal, unauthorized, unethical, or illegal reason." Appellant's Appendix at 49 (emphases added). The designated evidence thus establishes that, while DeBow's employer authorized her to access patient information for business reasons, she was expressly not authorized to access, use, or disclose the information for personal, unauthorized, unethical, or illegal reasons. Indeed, DeBow stated in her affidavit, which was designated by the Trustees, that she accessed Robbins's medical records "for personal reasons and not as part of [her] employment by Indiana University." Id. at 57. DeBow also stated that she "was acting on [her] own initiative and not within the scope of [her] employment when [she] accessed and published [] Robbins' records," that she "was not involved in any way in the provision of medical care" to Robbins, and that she "knew it was against [her] employer's policies and rules and [her] acts were not part of [her] job." Id.

The affidavit of an administrative supervisor in the gastroenterology department, also designated by the Trustees, stated that, when DeBow was asked about improperly accessing Robbins's health records, DeBow "admitted that there was no legitimate business reason for her to access the records and explained that her sole motivation was that ... [she] desired revenge." Id. at 54. Robbins does not point to designated evidence opposing these statements. Robbins does not claim that DeBow accessed her records for business reasons. The Trustees' designated evidence establishes that Robbins was not a patient of the School of Medicine's Gastroenterology Department, unlike in Walgreen where the person whose information was accessed was a Walgreen customer. In her amended complaint, which was designated by the Trustees, Robbins claimed that DeBow "had no reason to access [her] and her children's health care records" and that DeBow "was not involved in any way with providing any heath [sic] care or treatment of Robbins or her children." Id. at 36.

DeBow of her own initiative and unrelated to any business function of her employment or her employer, accessed and disclosed the private medical records of Robbins. This disclosure was unauthorized and illegal. DeBow pled guilty in federal court to the wrongful disclosure of individually identifiable health information for obtaining Robbins's health information for personal gain. DeBow's wrongful act was not to any extent to further her employer's business. DeBow was not explicitly or impliedly authorized to access or disclose medical records for personal reasons, her actions were not an extension of authorized access for the purpose of treating Robbins, and the acts were not motivated to any extent by her employer's interests. DeBow's actions were not incident to any service provided by her employer but were motivated entirely by self-interest related to a personal relationship with Robbins and to humiliating Robbins. The actions of DeBow were not sufficiently associated with her employment duties so as to fall within the scope of her employment.

Walgreen does not require a different outcome. Some of the pharmacist's actions in Walgreen were authorized, such as handling prescriptions for Walgreen customers, reviewing prescription histories, and making prescription-related printouts. The Walgreen opinion did not discuss whether the pharmacist signed an agreement explicitly limiting her access to customer records and forbidding the use of records for personal reasons. As revealed by the confidentiality agreement and other designated evidence discussed above, none of DeBow's conduct, including accessing and disclosing Robbins's medical records for personal reasons, was authorized by her employer.

We conclude that the Trustees designated evidence making a prima facie showing that DeBow's wrongful acts were not committed within the scope of employment, that Robbins did not set forth designated facts showing there is a genuine issue for trial, and thus that the Trustees established that they as DeBow's employer may not be held vicariously liable for DeBow's actions under the doctrine of respondeat superior. Accordingly, we affirm the entry of summary judgment in favor of the Trustees as to Robbins's claim of invasion of privacy by public disclosure of private facts and her claim of intentional infliction of emotional distress.

II.

The next issue is whether the trial court erred in granting summary judgment in favor of the Trustees on the issue of negligent hiring.2 Specifically, Robbins argues that the Trustees knew or should have known that DeBow had a propensity to commit criminal acts and they "[were] asking for trouble." Appellant's Brief at 28.

Indiana recognizes the tort of negligent hiring and retention of an employee. Konkle v. Henson, 672 N.E.2d 450, 460 (Ind.Ct.App.1996). We have adopted the Restatement (Second) of Torts § 317 (1965), which provides:

In addition, there are general rules and concepts surrounding the imposition of a duty that must also be satisfied. Clark v. Aris, Inc., 890 N.E.2d 760, 763 (Ind.Ct.App.2008), trans. denied. In determining whether to impose a duty of care, three factors must be considered: (1) the relationship between the parties, (2) the reasonable foreseeability of harm to the person injured, and (3) public policy concerns. Id. (citing Webb v. Jarvis, 575 N.E.2d 992, 995 (Ind.1991)). Imposition of a duty is limited to those instances where a reasonably foreseeable victim is injured by a reasonably foreseeable harm. Id. at 764 (citing Webb, 575 N.E.2d at 995). Whether a duty exists is ordinarily a question of law, but sometimes the existence of a duty depends upon underlying facts that require resolution by the trier of fact. Id.

Sandage v. Board of Commissioners of Vanderburgh County, 897 N.E.2d 507 (Ind.Ct.App.2008), is instructive on the issue of negligent hiring and an employee's criminal history. There, an employer hired Travis Moore, a jail inmate on work release who had been convicted of robbery and recently tested positive for THC, to clean parking lots. Instead of returning to jail after work one evening, Moore went to a private home and killed three people. The victims' estates filed a complaint for damages against Sandage's employer alleging that the employer had negligently hired and retained Sandage. The trial court granted the employer's summary judgment motion. On appeal, this court pointed out that Moore's employment did not put him in contact with the victims and the murders did not constitute a recurrence of criminal behavior for which Moore had earlier been convicted. Id. at 513. We therefore affirmed the trial court's grant of summary judgment in favor of the employer. See also Clark, 890 N.E.2d at 765 (concluding that where Baer's employment did not put him in contact with the victims and nothing in his criminal history suggested that he was capable of murder, neither the victims nor the tragic harm that befell them was reasonably foreseeable).

Here, as in Sandage and Clark, DeBow's employment did not put her in contact with the victim, who was not a department of gastroenterology patient. DeBow was not authorized to access Robbins's electronic medical records when she was not a patient of DeBow's employer, and DeBow's violation of medical confidentiality did not constitute a recurrence of criminal behavior for which DeBow had earlier been convicted. Specifically, there were no prior reports of DeBow accessing and publishing any other patient's confidential medical records. Under these circumstances, Robbins was not a reasonably foreseeable victim and DeBow's internet posting of information that humiliated Robbins was not a reasonably foreseeable harm. The trial court did not err in granting summary judgment in favor of the Trustees on the negligent hiring issue.

Conclusion

For the foregoing reasons, the trial court did not err in granting summary judgment in favor of the Trustees and Clarian.

Affirmed.

PYLE, J., concurs.

CRONE, J., concurs in part and concurs in result in part with separate opinion.

CRONE, Judge, concurring in part and concurring in result in part.

I fully concur in the majority's affirmance of summary judgment in favor of Clarian and in favor of the Trustees on Robbins's negligent hiring and intentional infliction of emotional distress claims. I would also affirm summary judgment in favor of the Trustees on Robbins's claim for invasion of privacy by the public disclosure of private facts, but I would do so on the basis that the Trustees cannot be held vicariously liable for a nonexistent tort. Whether Indiana recognizes this tort is technically an open question, but for all practical purposes the answer is currently no.3

In Doe v. Methodist Hospital, 690 N.E.2d 681, 682 (Ind.1997), a plurality of our supreme court "decline[d] to recognize" the tort, notwithstanding the insistence of two justices that "[f]or almost half a century, Indiana courts have clearly recognized the common law tort of invasion of privacy, including the unwarranted public disclosure of private matters." Id. at 694 (Dickson, J., joined by Sullivan, J., concurring in result). Four years later, in Felsher v. University of Evansville, 755 N.E.2d 589, 593 (Ind.2001), a unanimous supreme court essentially characterized the Doe plurality's view as a majority holding: "Our discussion of [the history of the privacy tort] and the Second Restatement served as a prelude to our decision not to recognize a branch of the tort involving the public disclosure of private facts." More recently, in Westminster Presbyterian Church of Muncie v. Cheng, 992 N.E.2d 859, 868 (Ind.Ct.App.2013), trans. denied (2014), another panel of this Court cited Doe in stating that "public disclosure of private facts is not a recognized cause of action in Indiana," and our supreme court denied transfer in that case.4

In sum, since Felsher was decided in 2001, our state's highest court has acted as if public disclosure of private facts is not a valid cause of action in Indiana, even though a majority of the court has not so held. Although neither Doe nor Felsher is binding precedent on this point, I am not inclined to rock this particular boat. Consequently, I would affirm summary judgment in favor of the Trustees on Robbins's invasion of privacy claim on the basis that they cannot be held vicariously liable for a nonexistent tort.

Nevertheless, I respectfully urge our supreme court to revisit its pronouncements in Doe and Felsher in light of the exponential increase in the amount and sensitivity of personal information that has become available online since those cases were decided and the corresponding increase in the speed and ease with which that information may be broadcast to the public. It is difficult to overstate the extent to which we have surrendered, by choice or compulsion, the most intimate details of our lives to the digital domain. Many Hoosiers are paid (or, as in the case of state employees, must be paid) online. And many Hoosiers bank, shop, conduct business, pay taxes, engage in social and political activity, seek medical and legal advice, and (pursuant to federal law) have their health records stored online. Although much of this information is expected and intended to be disseminated to a wide audience (family vacation photos, job résumés), much is expected and intended to be kept under the electronic equivalent of a lock and key (financial records, psychiatric treatment notes). See Neil M. Richards & Daniel J. Solove, Prosser's Privacy Law: A Mixed Legacy, 98 CAL. L. REV. 1887, 1920 (Dec. 2010) ("People expose information with varying expectations of the extent and nature of its future exposure. When they go about their daily activities, most people expect not to have the information about them recorded, compiled, or widely disseminated."). As Justice Dickson presciently recognized in his separate opinion in Doe, "With our ever-increasing population and the growing technological opportunities for invasive scrutiny into others' lives, the compilation of private data, and the disclosure of purely personal matters, this common law tort [of public disclosure of private facts] grows in importance as a valuable source of deterrence and accountability." 690 N.E.2d at 695 (Dickson, J., concurring in result).5

Assuming for argument's sake that the tort is in fact alive and well in Indiana, I would agree with the majority that DeBow's acquisition and disclosure of Robbins's medical information for purely personal reasons was not within the scope of her employment and therefore the Trustees may not be held vicariously liable under a respondeat superior theory. I would not find the Confidential Agreement to be dispositive in this regard, however, and I would note that other courts have recognized that direct liability may arise in similar situations. See, e.g., Doe v. Guthrie Clinic, Ltd., 22 N.Y.3d 480, 982 N.Y.S.2d 431, 5 N.E.3d 578, 581 (2014) ("A medical corporation may ... be liable in tort for failing to establish adequate policies and procedures to safeguard the confidentiality of patient information or to train their employees to properly discharge their duties under those policies and procedures."). This is an area in which technology is advancing faster than the law, and I am sure that we will be required to revisit it in the future.