from the Iowa District Court for Polk County, Michael D.
appeals from the district court's dismissal of her
petition for judicial review challenging the Iowa Board of
Nursing's conclusion she violated the confidentiality or
privacy rights of a patient and imposition of a citation and
L. Brown and Tyler R. Smith of Hansen, McClintock &
Riley, Des Moines, for appellant.
J. Miller, Attorney General, and Tessa Register, Assistant
Attorney General, for appellee.
Considered by Potterfield, P.J., and Doyle and Tabor, JJ.
POTTERFIELD, PRESIDING JUDGE
Dawn Leach appeals from the district court's dismissal of
her petition for judicial review challenging the Iowa Board
of Nursing's conclusion she violated the confidentiality
or privacy rights of a patient and imposition of a citation
and warning. Leach maintains the district court erred in
dismissing her petition for judicial review because the
Board's conclusion is "[b]ased upon an irrational,
illogical, or wholly unjustifiable application of law to fact
that has clearly been vested by a provision of law in the
discretion of the agency," Iowa Code §
17A.19(10)(m), and is "not supported by substantial
evidence in the record before the court when that record is
viewed as a whole," Id. §
Background Facts and Proceedings.
was employed by Unity Point Health Finley Hospital (Finley)
to work as a nurse in the intensive care unit (ICU). On
eleven dates during December 2015, Leach remotely accessed
patient census lists while she was not working. The census
lists contained private health information, such as patient
names, ages, diagnosis, unit, diet order, medications, and
learned of the access in January 2016 and questioned Leach
about it. Leach admitted she accessed the lists, stating she
did so in order to check ICU capacity to determine whether it
was likely she would be required to work her assigned
shifts. Leach was advised that checking the list
was in violation the hospital's information security
policies that prevented remote access into the hospital's
system without authorization-which Leach did not have-and
when not necessary to complete her job responsibilities.
Finley issued Leach an employee disciplinary notice on
January 20; she was suspended for two twelve-hour shifts and
required to repeat the HIPAA NetLearning module.
supervisor filed a complaint with the Board, and, after an
investigation, the Board found probable cause to file a
notice of hearing and statement of charges against Leach. It
was alleged Leach violated the confidentiality or privacy
rights of the patient or client, in violation of Iowa Code
section 147.55(3) (2015) and Iowa Administrative Code rule
contested hearing took place in January 2018. The Board made
the following finding of facts:
[Leach] accessed the patient lists for the sole purpose of
determining the ICU's census so she could determine
whether she would [be] working her assigned shift the
following day or placed on call. [She] did not use the
information from the patient lists for any other purpose, and
she did not share the information with anyone. [Leach] denies
that she looked at any information other than the number of
. . . . . . . [Leach] was not authorized to access Finley
patient lists from remote locations, and she did not need the
patient list information in order to perform ...