On
Appeal from Superior Court, Washington Unit, Civil Division
Mary Miles Teachout, J.
David
C. Sleigh and Kyle L. Hatt of Sleigh Law, St. Johnsbury, for
Plaintiff-Appellant.
Nicole
Andreson and Angela R. Clark of Dinse, Knapp & McAndrew,
P.C., Burlington, for Defendant-Appellee Central Vermont
Medical Center.
PRESENT: Reiber, C.J., Skoglund, Robinson and Eaton, JJ., and
Howard, Supr. J. (Ret.), Specially Assigned
EATON,
J.
¶
1. In this appeal, we are asked to recognize a common-law
private right of action for damages resulting from the
unjustified disclosure to a third party of information
obtained by medical personnel during treatment. Plaintiff
alleges in her lawsuit that she incurred damages as the
result of an emergency room nurse informing a police officer
that she was intoxicated, had driven to the hospital, and was
intending to drive home. The trial court granted defendant
Central Vermont Medical Center (CVMC) summary judgment based
on its determination that nothing in the record supported an
inference that the nurse's disclosure of the information
was for any reason other than her good-faith concern for
plaintiff's and the public's safety. In this opinion,
we recognize a common-law private right of action for damages
based on a medical provider's unjustified disclosure to
third persons of information obtained during treatment. Like
the trial court, however, we conclude that CVMC was entitled
to judgment as a matter of law because, viewing the material
facts most favorably to plaintiff and applying the relevant
law we adopt today, we conclude that no reasonable factfinder
could determine that the disclosure was for any purpose other
than to mitigate the threat of imminent and serious harm to
plaintiff and the public. Accordingly, we affirm the trial
court's judgment. I. Facts and Procedural History
¶
2. The following facts are taken from the parties'
statements of undisputed material facts, viewing them most
favorably to plaintiff, the nonmoving party.[1] During the early
morning hours of May 10, 2014, plaintiff drove herself to
CVMC after lacerating her arm. She arrived at the emergency
room at 2:12 a.m. The charge nurse (Clinical Nurse
Coordinator) detected a heavy odor of alcohol on
plaintiff's breath, and it became apparent to the nurse
that plaintiff had been drinking. Members of the treatment
team administered an alco-sensor test to assess
plaintiff's level of intoxication. The test revealed a
breath-alcohol concentration of .215, over two and one-half
times the legal limit, at 2:40 a.m.
¶
3. Based on information provided by plaintiff, the charge
nurse understood that plaintiff did not have a ride home.
After her laceration was treated, plaintiff did not meet the
criteria for admission to the hospital and was cleared for
discharge. She was discharged at 3:05 a.m.
¶
4. A police officer was on duty in the emergency room
pursuant to a contract between CVMC and the Berlin Police
Department. Shortly before plaintiff was discharged, the
charge nurse approached the officer and informed him that
plaintiff was blatantly intoxicated, [2] that she had driven herself
to the hospital, and that she was about to drive herself
home. After receiving this information from the charge nurse
and communicating with plaintiff, the officer arrested her on
suspicion of driving while intoxicated. The resulting
criminal charge was later dismissed by the prosecutor.
¶
5. In July 2016, plaintiff filed a complaint against the
charge nurse and CVMC, alleging that she incurred damages as
the result of (1) the nurse's negligent disclosure of
information obtained during plaintiff's medical
treatment, in violation of the standard of care applicable to
medical providers; and (2) CVMC's inadequate training and
failure to develop policies regarding the disclosure of
information obtained during medical treatment.
¶
6. In December 2017, following discovery, defendants moved
for summary judgment. Regarding plaintiff's negligence
claim against the charge nurse, defendants argued that this
Court has never recognized a duty enforceable in a tort
action not to disclose information obtained during medical
treatment and that, even if such a duty existed, the
nurse's disclosure of information in this case fully
complied with the Health Insurance Portability and
Accountability Act of 1996 (HIPAA), see 42 U.S.C. §
1320d-6 (concerning wrongful disclosure of individually
identifiable health information), because it was done to
avert an imminent threat to plaintiff's and the
public's safety. Defendants further argued that plaintiff
could not prevail on her claim against CVMC because that
claim was dependent upon the underlying claim against the
charge nurse. In opposing summary judgment, plaintiff noted
that the vast majority of jurisdictions have recognized a
private right of action for damages resulting from the
disclosure of information obtained during medical treatment.
She argued that there were disputed material facts concerning
whether the disclosure of the information in this case was
necessary to protect plaintiff or the public.
¶
7. In May 2018, the trial court granted summary judgment to
CVMC.[3] After noting that the patient's
privilege set forth in 12 V.S.A. § 1612 is an
evidentiary privilege applicable only in judicial
proceedings, see Kuligoski v. Brattleboro Retreat,
2016 VT 54A, ¶ 60, 203 Vt. 328, 156 A.3d 436, and that
plaintiff had failed to identify any Vermont authority in
support of a greater rule of confidentiality than that set
forth in HIPAA, the court ruled that the disclosure at issue
here did not violate HIPAA. In so ruling, the court relied on
a HIPAA regulation permitting the disclosure of information
based on the presumed good-faith belief that the disclosure
was necessary to prevent a serious and imminent threat to the
health or safety of a person or the public. In the
court's view, there was no record basis for any
reasonable inference that plaintiff's disclosure to an
onsite police officer was for law enforcement purposes or any
reason other than a good-faith concern for plaintiff's
and the public's safety. Having found no negligence, the
court granted CVMC summary judgment on both counts set forth
in plaintiff's complaint.[4] II. The Claims of Error
¶
8. On appeal, plaintiff argues that: (1) the trial court
erred in holding that there is no common law remedy for a
health care provider's breach of a duty of
confidentiality; and (2) assuming there is such a remedy, the
court erred in granting CVMC summary judgment insofar as
there are material facts in dispute as to whether the nurse
breached the duty of confidentiality regarding information
obtained during the course of medical treatment. A. Private
Right of Action
¶
9. Plaintiff first argues that this Court should recognize a
common-law private remedy for breach of a medical
provider's duty of confidentiality concerning the
disclosure of information obtained during medical treatment.
Plaintiff seeks a common-law remedy because neither Vermont
law nor HIPAA provides a private right of action to obtain
damages incurred as the result of a medical provider's
disclosure of information obtained during treatment. See
Warren Pearl Constr. Corp. v. Guardian Life Ins.
Co., 639 F.Supp.2d 371, 377 (S.D.N.Y. 2009) (collecting
numerous federal court cases recognizing that no private
right of action exists under HIPAA); Byrne v. Avery Ctr.
for Obstetrics & Gynecology, P.C. (Byrne
I), 102 A.3d 32, 41, 45 (Conn. 2014) (noting "the
long line of federal and state cases establishing that there
is no private right of action, express or implied, under
HIPAA," which enforces its provisions through
administrative imposition of fines and imprisonment);
Bonney v. Stephens Mem'l Hosp., 2011 ME 46,
¶¶ 17, 19, 17 A.3d 123 (noting that all courts
addressing issue have concluded that no private right of
action exists under HIPPA, which provides only for
administrative enforcement of its provisions).
¶
10. On the other hand, although HIPAA serves in part to
"protect the privacy of patients' health information
given emerging advances in information technology," it
does not preempt causes of action arising under state common
or statutory law imposing liability for "health care
providers' breaches of patient confidentiality."
Byrne I, 102 A.3d at 35, 45-48 (citing federal and
state courts holding that HIPAA does not preempt state law
imposing liability over and above that authorized by federal
law). Indeed, as many courts have recognized, HIPAA may act
as a guidepost or otherwise "inform the relevant
standard of care" for state law claims alleging unlawful
disclosure of information obtained during medical treatment.
Id. at 46-48, 49 (citing cases and concluding that
"to the extent it has become the common practice for
Connecticut health care providers to follow the procedures
required under HIPAA in rendering services to patients, HIPAA
and its implementing regulations may be utilized to inform
the standard of care applicable to such claims arising from
allegations of negligence in the disclosure of patients'
medical records pursuant to a subpoena").
¶
11. English common law did not afford patients a cause of
action based on an expectation of privacy in information
disclosed during medical treatment, Hammonds v. Aetna
Cas. & Sur. Co., 243 F.Supp. 793, 795 n.1 (N.D. Ohio
1965), but the notion "that physicians should respect
the confidences revealed by their patients in the course of
treatment is a concept that has its genesis in the
Hippocratic Oath." McCormick v. England, 494
S.E.2d 431, 435 (S.C. 1997). By the 1960s and 1970s, several
courts had recognized a private right of action for damages
resulting from medical providers' wrongful disclosure of
information obtained during treatment, and currently the vast
majority[5] of jurisdictions addressing whether to
recognize such a cause of action have chosen to do so. See
Byrne v. Avery Ctr. for Obstetrics & Gynecology,
P.C. (Byrne II), 175 A.3d 1, 7, 11-15 (Conn.
2018) (discussing cases and joining clear modern consensus of
courts recognizing private cause of action for damages
resulting from unlawful disclosure of patients' medical
information); McCormick, 494 S.E.2d at 435 (citing
majority of jurisdictions recognizing cause of action based
on medical provider's unauthorized disclosure of
information obtained during treatment); see also J. Zelin,
Annotation, Physician's Tort Liability for
Unauthorized Disclosure of Confidential Information About
Patient, 48 A.L.R.4th 668, § 2(a) (1986) (stating
that courts have generally recognized right of patients to
recover damages from physicians for unauthorized disclosure
of information obtained during treatment).
¶
12. In recognizing this common-law private right of action,
courts have relied on various theories, "including
invasion of privacy, breach of implied contract, medical
malpractice, and breach of a fiduciary duty or a duty of
confidentiality." McCormick, 494 S.E.2d at 436.
The most commonly accepted theory is breach of the duty of
confidentiality, insofar as "health care providers enjoy
a special fiduciary relationship with their patients"
such that "recognition of the privilege is necessary to
ensure that the bond remains." Byrne II, 175
A.3d at 12; see Biddle v. Warren Gen. Hosp., 715
N.E.2d 518, 523 (Ohio 1999) (citing cases for proposition
that "courts have moved toward the inevitable
realization that an action for breach of confidence should
stand in its own right, and increasingly courts have begun to
adopt an independent tort in their respective
jurisdictions"); Hu ...