John Doe v. Guthrie Clinic, Ltd.

• Decision Date: 09 January 2014
• Citation: 982 N.Y.S.2d 431,22 N.Y.3d 480,2014 N.Y. Slip Op. 00138,5 N.E.3d 578
• Parties: John DOE, Appellant, v. GUTHRIE CLINIC, LTD., et al., Respondents.
• Court: New York Court of Appeals Court of Appeals

22 N.Y.3d 480

5 N.E.3d 578

982 N.Y.S.2d 431

2014 N.Y. Slip Op. 00138

John DOE, Appellant,

v.GUTHRIE CLINIC, LTD., et al., Respondents.

Court of Appeals of New York.

Jan. 9, 2014.

Brown & Hutchinson, Rochester (T. Andrew Brown of counsel), for appellant.

Morgan, Lewis & Bockius LLP, New York City (Martha B. Stolley and Heather L. Hopkins of counsel), for respondents.

OPINION OF THE COURT

PIGOTT, J.

The United States Court of Appeals for the Second Circuit has certified the following question for our consideration: “ Whether, under New York law, the common law right of action for breach of the fiduciary duty of confidentiality for the unauthorized disclosure of medical information may run directly against medical corporations, even when the employee responsible for the breach is not a physician and acts outside the scope of her employment?” We answer the question in the negative.

On July 1, 2010, “John Doe” was being treated for a sexually transmitted disease (STD) at the Guthrie Clinic Steuben, a private medical facility. A nurse employed by the Clinic recognized Doe as the boyfriend of her sister-in-law. The nurse accessed Doe's medical records and learned that he was being treated for the STD. While Doe was still awaiting treatment, she sent text messages to her sister-in-law informing her of Doe's condition. The sister-in-law immediately forwarded the messages to Doe; according to Doe, the messages suggested that staff members were making fun of his medical condition.

Five days after his visit to the Clinic, Doe called to complain of the nurse's behavior. He met with an administrator of the Clinic, and the nurse was fired. Thereafter, the President and CEO of Guthrie Clinic, Ltd. sent a letter to Doe confirming that there had been an unauthorized disclosure of Doe's confidential health information, that appropriate disciplinary actions had been carried out, and that steps had been taken to prevent such a breach from occurring in the future.

Doe subsequently filed this action in federal court against defendants, various affiliated entities that allegedly “owned, possessed, operated, staffed and/or otherwise controlled” the clinic. In his complaint, Doe asserted eight causes of action: (1) common-law breach of fiduciary duty to maintain the confidentiality of personal health information, (2) breach of contract, (3) negligent hiring, training, retention and/or supervision of employees, (4) negligent infliction of emotional distress, (5) intentional infliction of emotional distress, (6) breach of duty to maintain the confidentiality of personal health information under CPLR 4504, (7) breach of duty to maintain the confidentiality of personal health information under Public Health Law § 4410, and (8) breach of duty to maintain the confidentiality of personal health information under Public Health Law § 2803–c.

The United States District Court for the Western District of New York granted the defendants' motion to dismiss all eight claims (2012 WL 531026, 2012 U.S. Dist LEXIS 20507 [U.S.Dist.Ct.W.D.N.Y. Feb. 17, 2012] ).

Doe appealed the dismissal of the first five of the eight causes of action. The United States Court of Appeals for the Second Circuit affirmed the dismissal of four of the remaining five causes of action, reserving decision on his claim of breach of fiduciary duty, which is the only subject of this certified question (519 Fed.Appx. 719 [2d Cir.2013] ).

In a separate opinion (710 F.3d 492 [2d Cir.2013] ), the Second Circuit found that the nurse's actions were not foreseeable to defendants, nor were her actions taken within the scope of her employment ( id. at 495). The court explained that in his complaint Doe himself alleged that the nurse was motivated by purely personal reasons and “[t]hose reasons had ‘nothing to do with [Doe's] treatment and care’ ” ( id. at 495–496, citing Doe complaint at ¶ 25). “As such,” the court held, the nurse's “actions cannot be imputed to the defendants on the basis of respondeat superior ” ( id. at 496). The court certified the question to this Court, however, whether Doe may assert a specific and legally distinct cause of action against defendant for breach of the fiduciary duty of confidentiality, even when respondeat superior liability is absent ( id. at 498).

Generally, a hospital or medical corporation may be held vicariously liable for the wrongful acts of its employees ( see e.g. Hill v. St. Clare's Hosp., 67 N.Y.2d 72, 79, 499 N.Y.S.2d 904, 490 N.E.2d 823 [1986] ). However, “[u]nder the doctrine of respondeat superior, an employer may be vicariously liable for the tortious acts of its employees only if those acts were committed in furtherance of the employer's business and within the scope of employment” ( N.X. v. Cabrini Med. Ctr., 97 N.Y.2d 247, 251, 739 N.Y.S.2d 348, 765 N.E.2d 844 [2002] ). Thus, a medical corporation is generally not liable for a tort of an employee when such an action is not within the scope of employment.

We have, in other circumstances, declined to hold a medical corporation to a “heightened duty” for an employee's misconduct. For instance, in N.X. v. Cabrini Med. Ctr., where a physician employed by the defendant hospital committed a sexual assault on a sedated patient, this Court rejected the attempt to hold the hospital strictly liable. We declined to recognize a heightened duty on the part of the hospital, explaining:

“A hospital has a duty to safeguard the welfare of its patients, even from harm inflicted by third persons, measured by the capacity of the patient to provide for his or her own safety.... This sliding scale of duty is limited, however; it does not render a hospital an insurer of patient safety or require it to keep each patient under constant surveillance.... As with any liability in tort, the scope of a hospital's duty is circumscribed by those risks which are reasonably foreseeable” ( id. at 252–253, 739 N.Y.S.2d 348, 765 N.E.2d 844).

Since the sexual assault committed by the hospital employee was “not in furtherance of hospital business” and was “a clear departure from the scope of employment, having been committed for wholly personal motives” ( id. at 251, 739 N.Y.S.2d 348, 765 N.E.2d 844), we concluded that the hospital could not be held vicariously liable.

Here, Doe urges us to impose absolute liability on the medical corporation for an employee's dissemination of a patient's confidential medical information. We decline to do so, and, to the extent that this rationale may have been employed in Doe v. Community Health Plan—Kaiser Corp., 268 A.D.2d 183, 709 N.Y.S.2d 215 (3d Dept.2000), we reject that decision. For the same reasons stated in Cabrini, a medical corporation's duty of safekeeping a patient's confidential medical information is limited to those risks that are reasonably foreseeable and to actions within the scope of employment.

The dissent, in accepting Doe's argument would impose strict liability on medical corporations for any disclosure by an employee, an approach that is unnecessary and against precedent.^* In cases where an injured plaintiff's cause of action fails because the employee is acting outside the scope of employment, a direct cause of action against the medical corporation for its own conduct, be it negligent hiring, supervision or other negligence, may still be maintained ( see Judith M. v. Sisters of Charity Hosp., 93 N.Y.2d 932, 934, 693 N.Y.S.2d 67, 715 N.E.2d 95 [1999] ). A medical corporation may also be liable in tort for failing to establish adequate policies and procedures to safeguard the confidentiality of patient information or to train their employees to properly discharge their duties under those policies and procedures. These potential claims provide the requisite incentive for medical providers to put in place appropriate safeguards to ensure protection of a patient's confidential information. Those causes of action in the present case have already been resolved by the federal courts and we therefore do not address them.

Accordingly, the certified question should be answered in the negative.

RIVERA, J. (dissenting).

Patients, who have little say in the matter, disclose their personal information to medical corporations trusting that it will be kept private. In answering the certified question in the negative, the majority limits a patient's remedy even in cases where a corporation has failed in its duty to protect confidential information. I believe that a medical corporation's duty extends beyond an employee's conduct within the scope of employment, and I would answer the certified question in the affirmative.

The majority's narrow conception of a medical corporation's duty undermines New York's public policy to protect the confidentiality of patients' medical records ( seePublic Health Law § 2803–c [1], [3][f] ). The ease with which confidential patient information can now spread through personal digital devices and across social networks demands a strong legal regime to protect a patient's confidentiality. A cause of action directly against a medical corporation, unhampered by questions as to whether an employee's conduct occurred within the scope of employment, ensures the fullest protections for patients and best addresses the current realities of medical service delivery.

Comprehensive medical records are crucial to ensuring proper medical care. Medical providers, including corporate medical providers, require private medical data from patients to ensure proper treatment. A patient reveals personal data for purposes of receiving medical services, with the understanding that the patient retains a right to confidentiality in such information. Technological advances have made it possible to collect and house patient data in ways easily accessible to a patient's doctor and other health care provider staff. Computers and cellular devices have transformed medical record keeping and health care service provision, making access to such data fast and...