When is a hospital employee acting within the scope of employment?

If a hospital employee accesses a patient medical record for a reason having nothing to do with treatment of the patient and then unlawfully discloses that information, is the hospital liable for the employee's actions? No, says the First District.

The case is Turley v. University of Cincinnati Medical Center. Turley was admitted to the hospital, but refused to tell defendant Raphael Bradley why. Bradley threatened to have defendant Ryan Rawls, a hospital employee, look up Turley's medical records. A few weeks later, Bradley read Turley's medical information to her over the phone, posted Turley's medical records to Facebook, and emailed Turley's medical records to others.

Turley sued Bradley, Rawls, and the hospital, alleging that Rawls improperly accessed her medical info and improperly disclosed it to Bradley, who then improperly disclosed it to others--and that the hospital was liable for Rawls's actions under a respondeat superior theory. The hospital moved for summary judgment on the ground that Rawls was not acting within the scope of her employment, even providing an affidavit from a VP stating that Rawls did not have a treatment-related reason to access Turley's records. Both the trial court and the appellate court found that Rawls thus was not within the scope of her employment, and granted summary judgment to the hospital.

With this decision I'm left to wonder what exactly an employee would have to do in order for the hospital to be liable for the employee's actions. Isn't the fact that Rawls was not supposed to access and disclose this information the plaintiff's entire point? I suppose the answer probably turns on the fact that Rawls acted intentionally rather than negligently, but there is no such discussion in either the trial court's or appellate court's decisions.