Paul v. Providence Health System–Oregon

• Decision Date: 24 February 2012
• Docket Number: (CC 060101059,SC S059131).,CA A137930
• Citation: 351 Or. 587,273 P.3d 106
• Parties: Laurie PAUL, Plaintiff,andRussell Gibson and William Weiller, DDS, individually and on behalf of all similarly-situated individuals, Petitioners on Review, v. PROVIDENCE HEALTH SYSTEM–OREGON, an Oregon corporation, Respondent on Review.
• Court: Oregon Supreme Court

273 P.3d 106

351 Or. 587

Laurie PAUL, Plaintiff,andRussell Gibson and William Weiller, DDS, individually and on behalf of all similarly-situated individuals, Petitioners on Review,

v.PROVIDENCE HEALTH SYSTEM–OREGON, an Oregon corporation, Respondent on Review.

(CC 060101059

CA A137930

SC S059131).

Supreme Court of Oregon.

Argued and Submitted Sept. 21, 2011.Decided Feb. 24, 2012.

On review from the Court of Appeals.^*Maureen Leonard, Portland, argued the cause and filed the brief for petitioners on review.

Gregory A. Chaimov, Davis Wright Tremaine LLP, Portland, argued the cause and filed the brief for respondent on review. With him on the brief was John F. McGrory.

Before DE MUNIZ, Chief Justice, and DURHAM, BALMER, WALTERS, LINDER, and LANDAU, Justices.^**BALMER, J.

The issue in this case is whether a healthcare provider can be liable in damages when the provider's negligence permitted the theft of its patients' personal information, but the information was never used or viewed by the thief or any other person. Plaintiffs claimed economic and noneconomic damages for financial injury and emotional distress that they allegedly suffered when, through defendant's alleged negligence, computer disks and tapes containing personal information from an estimated 365,000 patients (including plaintiffs) were stolen from the car of one of defendant's employees. The trial court and Court of Appeals held that plaintiffs had failed to state claims for negligence or for violation of the Unlawful Trade Practices Act (UTPA), ORS 646.605 to 646.652. Paul v. Providence Health System–Oregon, 237 Or.App. 584, 240 P.3d 1110 (2010). We conclude that, in the absence of allegations that the stolen information was used in any way or even was viewed by a third party, plaintiffs have not suffered an injury that would provide a basis for a negligence claim or an action under the UTPA. We therefore affirm, although our analysis differs in some respects from that of the Court of Appeals.

I. BACKGROUND AND PROCEEDINGS BELOW

We take the facts from plaintiffs' third amended complaint. When reviewing a trial court order granting a motion to dismiss, we accept as true all well-pleaded facts in the complaint. Bailey v. Lewis Farm, Inc., 343 Or. 276, 278, 171 P.3d 336 (2007). The named plaintiffs were patients of defendant, a nonprofit corporation that provides health care. An employee of defendant left computer disks and tapes containing records of 365,000 patients in a car; the disks and tapes were subsequently stolen on or about December 30–31, 2005. The records included names, addresses, phone numbers, Social Security numbers, and patient care information. Defendant notified all individuals whose information was contained on the disks and tapes and advised them to take precautions to protect themselves against identify theft.¹

Plaintiffs filed this class action on behalf of themselves and other individuals whose records had been stolen. Plaintiffs asserted common law negligence and negligence per se claims, alleging that defendant's conduct had caused them financial injury in the form of past and future costs of credit monitoring, maintaining fraud alerts, and notifying various government agencies regarding the theft, as well as possible future costs related to identity theft.² Plaintiffs also alleged that they suffered noneconomic damages for the emotional distress caused by the theft of the records and attendant worry over possible identity theft. Plaintiffs did not allege any intentional conduct by defendant. Nor did plaintiffs allege that any unauthorized person ever had accessed any of the information contained on the disks and tapes, or that any plaintiff had suffered any actual financial loss, credit impairment, or identity theft. In addition to their negligence claims, plaintiffs alleged that defendant had violated the UTPA by representing that patient data would be kept confidential when defendant knew that such data was inadequately safeguarded.

Defendant filed a motion to dismiss plaintiffs' complaint for failure to state ultimate facts sufficient to constitute a claim for relief. The trial court granted defendant's motion, holding that the damages plaintiffs alleged were not compensable under Lowe v. Philip Morris USA, Inc., 207 Or.App. 532, 142 P.3d 1079 (2006), aff'd, 344 Or. 403, 183 P.3d 181 (2008),³ because plaintiffs' claimed damages—although reflecting, in part, expenses that plaintiffs actually had incurred—were premised on the risk of future injury, rather than actual present harm.

Plaintiffs appealed, and the Court of Appeals affirmed. That court began by analyzing whether plaintiffs had stated a negligence claim for economic damages. To recover damages for purely economic harm, liability “ ‘must be predicated on some duty of the negligent actor to the injured party beyond the common law duty to exercise reasonable care to prevent foreseeable harm.’ ” Oregon Steel Mills, Inc. v. Coopers & Lybrand, LLP, 336 Or. 329, 341, 83 P.3d 322 (2004) (quoting Onita Pacific Corp. v. Trustees of Bronson, 315 Or. 149, 159, 843 P.2d 890 (1992)). The Court of Appeals held that plaintiffs had failed to identify a “heightened duty of care to protect against economic harm arising out of the relationship between themselves as patients and defendant as a health care provider.” Paul, 237 Or.App. at 592, 240 P.3d 1110. The court rejected plaintiffs' argument that state and federal statutes protecting the confidentiality of medical records established an independent standard of care that defendant had violated, reasoning that those statutes did not create a special relationship between the parties that would give rise to a heightened duty owed to plaintiffs. Id. at 593, 240 P.3d 1110. Because plaintiffs failed to identify a special relationship between the parties, the court concluded that plaintiffs could not, under this court's opinion in Lowe, recover for the expenses of monitoring a future potential harm. Id.

The Court of Appeals then turned to plaintiffs' claim for damages for emotional distress. A plaintiff may recover damages for emotional distress, in the absence of physical injury, “where the defendant's conduct infringed on some legally protected interest apart from causing the claimed distress, even when that conduct was only negligent.” Hammond v. Central Lane Communications Center, 312 Or. 17, 23, 816 P.2d 593 (1991). As with plaintiffs' claim for economic damages, the Court of Appeals held that plaintiffs had failed to identify a special relationship between the parties that could give rise to a duty of care to avoid emotional harm to plaintiffs. Paul, 237 Or.App. at 597, 240 P.3d 1110. The court distinguished those cases where a plaintiff recovered emotional distress damages in the absence of a special relationship, because those cases involved an “affirmative” breach of a duty of confidentiality. In the absence of an affirmative breach or a special relationship, the court held that plaintiffs had not stated a claim for emotional distress. Id. at 600, 240 P.3d 1110.

Regarding plaintiffs' claim under the UTPA, the Court of Appeals held that the only financial harm identified by plaintiffs in their complaint—the out-of-pocket expenses incurred to prevent identity theft—was not an “ascertainable loss” under the UTPA. Id. at 604, 240 P.3d 1110. That was so because the money that plaintiffs had spent was “to prevent a potential loss” ( e.g., financial injury caused by future identity theft) that “might result from the misrepresentations,” but was not itself an ascertainable loss caused by defendant. Id. (emphasis in original).

II. PLAINTIFFS' NEGLIGENCE CLAIMS

We begin with plaintiffs' claim for common law negligence. As we recently stated in Lowe, “Not all negligently inflicted harms give rise to a negligence claim.” 344 Or. at 410, 183 P.3d 181. Rather, to recover in negligence, a plaintiff must suffer harm “to an interest of a kind that the law protects against negligent invasion.” Solberg v. Johnson, 306 Or. 484, 490, 760 P.2d 867 (1988). Plaintiffs, in their third amended complaint, describe their injury as follows:

“Plaintiffs and class members suffered economic damages in the form of past out-of-pocket expenses for credit monitoring services, credit injury, long distance and time loss from employment to address these issues. * * * In addition, plaintiffs and class members have suffered non-economic damages in the past and will do so in the future in the form of impairment of access to credit inherent in placing and maintaining fraud alerts, as well as worry and emotional distress associated with the initial disclosure and the risk of any future subsequent identity theft * * *.”

(Emphasis added.) Thus, plaintiffs allege that defendant's negligence created the risk of future identify theft, and they seek economic damages for the past and future expense of credit monitoring services and related expenditures made to address the risk of identity theft. They also allege that the increased risk of future identify theft has caused them present and future emotional distress, and they seek damages for that noneconomic injury. Although plaintiffs allege that an unknown person stole digital records containing plaintiffs' information from defendant's employee's car, they do not allege that the thief or any third person actually used plaintiffs' information in any way that caused financial harm or emotional distress to them.⁴ They allege no actual “identity theft,” as that term is used in Oregon statutes,⁵ nor do they allege that defendant's actions caused them actual financial injury, apart from the expenses that they incurred in the form of credit monitoring that they initiated.

A. Damages for Economic Loss

Under the economic loss doctrine, “[O]ne ordinarily is not liable for negligently causing a stranger's purely economic loss without injuring his person or property.” Hale v. Groce, 304 Or. 281, 284, 744 P.2d 1289 (...