Opinion
A170711
07-27-2022
A. B., Plaintiff, v. The OREGON CLINIC, an Oregon professional corporation, Defendant. A. B., Plaintiff, v. Innovative Anesthesia Management, LLC, a Delaware foreign limited liability corporation and The Oregon Clinic, an Oregon professional corporation, Defendants. A. B., Plaintiff-Appellant, v. Providence Health & Services-Oregon, an Oregon domestic nonprofit corporation, Defendant-Respondent.
Gregory Kafoury, Portland, argued the cause for appellant. Also on the opening brief was Kafoury & McDougal. Also on the reply brief were Mark McDougal and Kafoury & McDougal. Michael T. Stone, Hillsboro, argued the cause and filed the brief for respondent.
Gregory Kafoury, Portland, argued the cause for appellant. Also on the opening brief was Kafoury & McDougal. Also on the reply brief were Mark McDougal and Kafoury & McDougal.
Michael T. Stone, Hillsboro, argued the cause and filed the brief for respondent.
Before Mooney, Presiding Judge, and Pagán, Judge, and DeVore, Senior Judge.
Pagán, J., vice DeHoog, J. pro tempore.
MOONEY, P. J. After undergoing a colonoscopy at The Oregon Clinic (TOC), plaintiff experienced symptoms that led her to believe that she may have been sexually assaulted during the procedure. She was examined and treated at Providence St. Vincent's Medical Center (PSVMC) for a possible sexual assault, and defendant Providence Health & Services-Oregon (defendant) later disclosed that protected health information (PHI) to TOC without plaintiff's consent. Plaintiff subsequently brought this common-law breach of confidence claim against defendant. See Humphers v. First Interstate Bank , 298 Or. 706, 696 P.2d 527 (1985) (recognizing and describing breach of confidence tort ). Plaintiff alleged that defendant breached its duty to maintain the confidentiality of her PHI under, as relevant to this appeal, the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996 and its implementing regulations, as well as Oregon state law governing PHI, ORS 192.553 to 192.581. The trial court granted summary judgment in favor of defendant on the basis that the disclosure was permissible under those laws and entered a limited judgment dismissing plaintiff's claim against defendant. Plaintiff appeals, challenging the trial court's summary judgment ruling. Given the pleadings and the summary judgment record in this case, we conclude that the trial court did not err. Accordingly, we affirm. I. STANDARD OF REVIEW
Plaintiff also filed actions against TOC and Innovative Anesthesia related to the alleged sexual assault (Multnomah County Circuit Court Case Nos. 15CV05508 and 16CV13049, respectively), and the three cases were consolidated for trial. This appeal involves only plaintiff's case against Providence.
The tort has also been referred to as breach of confidentiality. Stevens v. First Interstate Bank , 167 Or.App. 280, 286 n 4, 999 P.2d 551, rev den. , 331 Or. 429, 26 P.3d 148 (2000) (so noting).
The regulations implementing HIPAA standards with respect to the security and confidentiality of health information, 45 CFR Parts 160 and 164, are known as the Privacy Rule. OHSU v. Oregonian Publishing Co., LLC , 362 Or. 68, 80-81, 403 P.3d 732 (2017).
Some provisions of Oregon law governing PHI have changed since the events giving rise to this litigation. However, because those changes do not affect our analysis in this case, we cite the current versions of the statutes in this opinion.
In reviewing a trial court's grant of summary judgment, we view the facts and all reasonable inferences that may be drawn from those facts in the light most favorable to the nonmoving party, in this case plaintiff. Vaughn v. First Transit, Inc. , 346 Or. 128, 132, 206 P.3d 181 (2009). "We review a trial court's grant of summary judgment for errors of law and will affirm if there are no genuine disputes about any material fact and the moving party is entitled to judgment as a matter of law." Thompson v. Portland Adventist Medical Center , 309 Or.App. 118, 121, 482 P.3d 805 (2021).
Our review has been made more difficult because of plaintiff's failure in many instances to comply with ORAP 5.40(9) (requiring references to the location in the record where facts material to the determination of the appeal appear) and reference to facts outside of the record.
II. HISTORICAL AND PROCEDURAL FACTS
A. Background
On April 21, 2014, plaintiff underwent a colonoscopy under anesthesia at TOC. After the procedure, she experienced pain in her vagina, and, when it continued, on April 25, she went to her gynecologist's office, Women's Healthcare Associates. A provider there sent her to the Emergency Department at PSVMC for a sexual assault exam. Plaintiff was given a Notice of Privacy Practices, which she acknowledged in writing.
Tara Bonforte, a sexual assault nurse examiner (SANE) at PSVMC, took plaintiff's history and plaintiff was physically examined by a physician, Dr. Ward. The examination revealed abrasions on the interior and exterior of plaintiff's vagina and redness on her cervix. Plaintiff authorized PSVMC to notify the police, and she was interviewed at the hospital by Deputy Condon from the Washington County Sheriff's Office (WCSO). Plaintiff also signed an authorization allowing PSVMC to release her medical information relating to the sexual assault evaluation to WCSO.
Subsequently, during the course of plaintiff's litigation against TOC for the alleged sexual assault, plaintiff learned that defendant had notified TOC of plaintiff's sexual assault examination and treatment at PSVMC, which lead to this action against defendant for breach of confidence.
B. Pleadings
Plaintiff alleged, in her second amended complaint, that defendant had disclosed her confidential information to TOC without her consent; that the information disclosed included her name, physical findings from her exam at PSVMC, and the resulting diagnosis of rape or other forcible sexual assault; and that the police would be contacting TOC to investigate. She alleged that the disclosure was in breach of defendant's duty of confidentiality with respect to plaintiff under various sources, including, as relevant here, state law governing PHI, ORS 192.553, and HIPAA privacy regulations, specifically, 45 CFR §§ 164.502 and 164.510. The complaint further alleged that "at least part of the reason for the [disclosure] was to warn [TOC] of the impending police investigation in order that [TOC] might prepare itself and its agents and employees against potential accusations involving civil or criminal liability" and that plaintiff suffered "a great sense of personal violation, humiliation, and betrayal, all to her noneconomic damages in the amount of $1,000,000."
After a hearing on defendant's ORCP 21 motions, plaintiff amended her complaint to identify the sources of the duty of confidentiality alleged to have been violated.
In her complaint, plaintiff also alleged that defendant had a duty of confidentiality as to her PHI under the Hippocratic Oath; the common law implied covenant of trust and confidence inherent in the physician-patient relationship; the implied covenant of confidentiality in the contract between plaintiff and her medical providers at PSVMC; ORS 677.190(5) ; the physician-patient testimonial privilege; and sections IV and VIII of the American Medical Association's Principles of Medical Ethics. However, plaintiff did not address those additional authorities in response to defendant's summary judgment motion disputing the applicability of those authorities. For that reason, we do not address them further.
In its amended answer, defendant admitted that it had made the alleged disclosure—in particular, that, after plaintiff's examination at PSVMC, a Providence Quality Manager had notified the Director of Quality and Risk at TOC of the concern that plaintiff may have been sexually assaulted during a medical procedure at TOC. Defendant further agreed that it had a duty under HIPAA and ORS 192.553 to 192.581 to maintain the confidentiality of plaintiff's PHI. However, as relevant here, defendant asserted that its disclosure was permitted by both federal and state law because it was made for purposes of health care operations and/or to avert a serious threat to public health or safety and, therefore, there was no breach.
Although defendant initially identified these as affirmative defenses, at the summary judgment stage, the parties and the trial court understood that it was plaintiff's burden to prove that the disclosure was unlawful.
C. Summary Judgment Proceedings
Defendant moved for summary judgment against plaintiff on several grounds. Among other points, as relevant on appeal, defendant argued that it was entitled to judgment as a matter of law on plaintiff's breach of confidence claim because its disclosure of plaintiff's information was permissible under HIPAA's Privacy Rule and state law allowing the disclosure of PHI from one covered entity to another for the health care operations of the entity receiving the information, 45 CFR § 164.506(c)(4) ; ORS 192.558, or to avert a serious threat to individual or public health or safety, 45 CFR § 164.512(j). Defendant also argued that, if disclosure was permitted under HIPAA for either reason, it was also necessarily permitted under Oregon law, because Oregon's law expressly permits disclosure of PHI as permitted by federal law, ORS 192.558(2)(b). Accordingly, in defendant's view, there was no breach, and defendant was therefore entitled to judgment as a matter of law. In support of its motion, defendant submitted a declaration from Gordon Eddington, a Quality Management Coordinator at PSVMC at the time of the events in question. Eddington, a nurse by education and training, described his job duties as including "investigating and responding to patient complaints and grievances as well as to concerns raised by employees and staff relating to quality of care and patient safety." Eddington stated that Bonforte had contacted him about the alleged sexual abuse of plaintiff at TOC and that he had documented his involvement in the matter in defendant's Oregon Quality Management Database (ORQMD), as was his routine practice. Those notes from the ORQMD were attached to his declaration as Exhibit A.
Defendant also cited ORS 192.567(2), the state law counterpart to 45 CFR § 164.512(j) ; however, that statute is inapplicable because it was enacted after the events giving rise to this litigation.
Defendant also argued that there was no breach because, even if its disclosure violated HIPAA or state law, the disclosure was privileged for the safety of individuals or as an important matter of public interest. Alternatively, defendant asserted that plaintiff waived any duty of confidentiality arising from the physician-patient privilege, ORS 40.235 —even assuming that it applied—when she voluntarily disclosed substantially the same information to WCSO and signed authorizations allowing release of her medical records at TOC and Providence to law enforcement. Finally, defendant argued that it was also entitled to summary judgment on the causation element of the tort—that plaintiff could not produce evidence sufficient to create a material question of fact that defendant's disclosure of plaintiff's PHI to TOC was the "cause in fact" of any injury to plaintiff.
Plaintiff did not address any of those arguments in her written response to defendant's summary judgment motion, and she mentioned them only cursorily at the hearing on the motion. In any event, given the issues raised on appeal and our conclusion that the trial court did not err in granting summary judgment to defendant on the breach of duty element, we need not discuss them further.
Eddington learned from Bonforte that plaintiff was not expecting any response from defendant, and that she had decided to report the allegations to the police. Once informed of the allegations of sexual abuse, Eddington believed that he was ethically required to take action on behalf of plaintiff and for the public safety of other potential patients at TOC and that it was part of his job to take "all appropriate action where indicated for patient safety and quality of care." Eddington stated that he understood that he was permitted under HIPAA and state law to disclose the information to another covered entity—here, TOC—about their shared patient—plaintiff—for such purposes. He also understood that the disclosure was to be to a person with the ability to reasonably prevent or lessen the threat.
Eddington further declared:
"Under the circumstances, I made a telephone call to Suzanne Laisner, the Director of Quality and Risk Management at [TOC], to advise her of the situation. I do not recall the specifics of the telephone call with Ms. Laisner. However, I documented that Ms. Laisner would initiate an investigation and follow up at their clinic. This would have been my expectation when I made the call to Quality Management at [TOC]. I would have provided the minimum necessary information to allow [TOC] to conduct a meaningful investigation.
"Although I do not have a specific recollection of the telephone call with Ms. Laisner, my purpose would have been
to make sure that [TOC] was aware of the allegation so that the situation could be looked into and any issues promptly addressed. My concerns would have been not only for plaintiff, but also to try and prevent potential sexual abuse of future patients."
Eddington's notes, documented in ORQMD, reflect that he spoke with Laisner on April 29:
"[D]iscussed this with Teri Polak, ED SANE RN.[ ] Teri tells me that the pt is not expecting a call from QM. She relates pt has or will contact Washington Co. deputies to lodge a complaint/report. Discussed this morning with Suzanne Laisner at Oregon Clinic. She will initiate an HR investigation and follow up at their clinic. "
Polak was the SANE nurse who suggested that Bonforte contact Eddington.
(Emphasis added.)
In a supplemental declaration, Eddington specified that his ORQMD entries in Exhibit A were made close in time to the events documented and that his review of the exhibit and emails between himself and Bonforte "refreshed [his] recollection of the nature of the concern raised, my investigation, and that I made a call to Suzanne Laisner at [TOC] to advise her of the situation."
Defendant also submitted excerpts from Laisner's deposition testimony, in which she testified that, in April 2014, she received a telephone call from someone "who identified themselves from their quality department at Providence St. Vincent." She testified that she did not remember who called her; when pressed, she said that she believed it was a woman. She was told that a TOC patient had been examined by the Emergency Department at PSVMC and found to have interior and exterior vaginal bruising. Laisner testified that she did not remember if she was told that the police were involved, but that she would have, and did, start an investigation.
In response to defendant's motion for summary judgment, plaintiff argued that "[t]he only issue is the intent of Providence St. Vincent," and that "[a]ny presumption of good faith and proper intent fails in the face of ‘any evidence’ which calls such good faith into question." (Emphasis added.) In other words, plaintiff did not dispute that defendant's disclosure would fit within the statutory exceptions identified by defendant if it had been made for those purposes. At the hearing on the motion, plaintiff acknowledged that disclosure of the information was permitted under HIPAA and state law if the purpose of the disclosure was for quality assurance or patient or public safety, but, she argued, "any evidence" that the disclosure was made for some other purpose sufficed to create a jury question on that issue.
To that point, plaintiff argued that there was evidence from which the jury could find that the call to TOC was not made by Eddington, the Quality Management Coordinator. In support, plaintiff submitted Eddington's deposition testimony—which was taken several months before his declarations described above—in which Eddington testified that he did not remember making the call to Laisner. Plaintiff suggested that "[a] reasonable juror might conclude that if he had made such a phone call, he would remember it." Plaintiff also pointed to Laisner's deposition testimony that she believed that it was a woman who called her. And that Laisner understood that hospitals are obligated to report evidence of sexual abuse, leading to the inference, according to plaintiff, that Laisner knew when she got the call that "it meant there was going to be a police investigation." Plaintiff also submitted an exhibit of an email chain among Providence employees in which, on May 27, 2014, a month after the disclosure, Shannon Alexander, Risk Manager at PSVMC, wrote, "Because the allegation was not about something that happened on our property, we passed the information off to Oregon Clinic, RM. We also were told the patient was contacting the police, so no additional reports were made." (Emphases added.) All of that, according to plaintiff, was evidence that Alexander was "in on the decision to make the phone call" to TOC and, therefore, that the disclosure of plaintiff's confidential information was from risk manager to risk manager, evidencing that defendant's intent in disclosing was not for purposes of quality assurance or individual or public safety, but to manage TOC's liability exposure.
Plaintiff argued that risk managers are "bureaucrats who deal with liability, not safety," and the role of a risk manager is to "[s]top people from making successful claims against our hospital costing us money, loss of reputation, in some cases scandal." The summary judgment record contains no evidence about the duties and role of risk managers in medical institutions.
Alexander testified that she did not recall calling Laisner or anybody at TOC in April 2014 about a patient safety report.
In short, plaintiff opposed summary judgment on the theory that there was a genuine issue of material fact as to who made the phone call to TOC and, consequently, as to the purpose of the call, such that the disclosure was not—as defendant contended—permitted under HIPAA and state statute for the purpose of health care operations or individual or public safety.
The court granted defendant's motion for summary judgment. In its oral ruling, the court reasoned that (1) plaintiff had the burden of proving that there was an unauthorized or unlawful disclosure, (2) there was no dispute that the relevant statutes and federal regulations permitted the disclosure for purposes of "healthcare operations for the protection of the public," and (3) plaintiff presented nothing more than suspicion or speculation that defendant disclosed the information for other than those reasons. The court concluded:
"And so when, in a case like this, somebody from quality management documents that they make the disclosure so that there be an investigation. They make it in circumstances where you would expect it—a disclosure to be made because there's a serious health and safety concern. There has to be something more than suspicion, speculation, or facts that would lead to unreasonable inferences to allow this to go to a jury.
"*** [W]e don't really have anything other than suspicion or speculation with respect to the intent of [defendant]. So I'm going to grant summary judgment as to *** [d]efendant."
Plaintiff sought reconsideration of that ruling, which was denied, and the court subsequently entered a limited judgment of dismissal with prejudice as to defendant. Plaintiff appeals, challenging the trial court's summary judgment ruling.
Plaintiff purports to assign error to the trial court's "holding that there was no evidence from which a reasonable jury could infer improper intent on the part of defendant," which is an improper assignment. Assignments of error are to be directed to a trial court's ruling, not its reasoning. See ORAP 5.45(3) ("Each assignment of error must identify precisely the legal, procedural, factual or other ruling that is being challenged."). That said, we understand that plaintiff intended to assign error to the trial court's summary judgment ruling.
III. ANALYSIS
"The gravamen of the tort of breach of confidentiality, in Oregon and nationally, is the affirmative disclosure of information by a person to whom the confidential information has been entrusted." Stevens v. First Interstate Bank , 167 Or.App. 280, 286, 999 P.2d 551, rev den. , 331 Or. 429, 26 P.3d 148 (2000) (emphasis and footnote omitted) (citing Humphers , 298 Or. at 717-19, 696 P.2d 527 ). That legal duty "not to speak" is not determined by "custom or reasonable expectations," Humphers , 298 Or. at 718, 696 P.2d 527 ; rather, the "contours of the asserted duty of confidentiality are determined by a legal source external to the tort claim itself," and a plaintiff asserting such a duty "must identify its source and terms," id. at 719, 696 P.2d 527. The plaintiff must also prove a breach of that duty. See id. at 721, 696 P.2d 527 ("The actionable wrong is the breach of duty in a confidential relationship.").
In this case, the parties agree that defendant had a duty of confidentiality with respect to plaintiff's PHI arising from federal and state law, specifically, HIPAA's Privacy Rule, as well as ORS 192.553 to 192.581, both of which protect an individual's PHI from unlawful disclosure. See 42 USC § 1320d-2 ; 45 CFR § 164.502(a) ; ORS 192.553(1)(a). Both statutory schemes, however, allow disclosure without the patient's authorization or consent under certain circumstances. See 45 CFR § 164.502(a)(1) ; ORS 192.558.
It is undisputed that Providence and TOC are covered entities and health care providers under the relevant federal and state law and that plaintiff was a patient of both entities.
Under HIPAA's Privacy Rule, a covered entity may, as relevant here, disclose an individual's PHI without the individual's consent for health care operations (which includes quality assessment and improvement activities and patient safety activities) or to avert a serious threat to the health or safety of an individual or the public. In particular, with respect to the first category, a covered entity is permitted to use or disclose protected health information "[f]or *** health care operations, as permitted by and in compliance with § 164.506." 45 CFR § 164.502(a)(1)(ii). In turn, 45 CFR § 164.506(c)(4) provides, as relevant:
"A covered entity may disclose protected health information to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship, and the disclosure is:
"(i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations[.]"
HIPAA's definition of "health care operations," 45 CFR § 164.501, provides, in paragraphs (1) and (2):
"Health care operations means any of the following activities of the covered entity to the extent that the activities are related to covered functions:
"(1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of generalizable knowledge is not the primary purpose of any studies resulting from such activities; patient safety activities (as defined in 42 CFR 3.20 ); *** and related functions that do not include treatment;
"(2) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and provider performance, *** accreditation, certification, licensing, or credentialing activities[.]"
And, 42 CFR § 3.20 defines "patient safety activities" to include "[e]fforts to improve patient safety and the quality of health care delivery[.]"
With respect to the second category, 45 CFR § 164.512(j), provides, in part:
"(1) Permitted disclosures. A covered entity may, consistent with applicable law and standards of ethical
conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure:
"(i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and
"(B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat[.]"
A covered entity is presumed to have acted in good faith with respect to the belief described above, "if the belief is based upon the covered entity's actual knowledge or in reliance on a credible representation by a person with apparent knowledge or authority." 45 CFR § 164.512(j)(4).
Under state law, ORS 192.558(3) allows a health care provider such as defendant to disclose an individual's PHI without the individual's authorization
"(a) To another covered entity for health care operations activities of the entity that receives the information if:
"(A) Each entity has or had a relationship with the individual who is the subject of the protected health information; and
"(B) The protected health information pertains to the relationship and the disclosure is for the purpose of:
"(i) Health care operations as listed in ORS 192.556(4)(a) or (b) [.]"
The specified health care operations are "[q]uality assessment, accreditation, auditing and improvement activities," ORS 192.556(4)(a), and "[c]ase management and care coordination," ORS 192.556(4)(b). State law also allows a health care provider to disclose the information without the person's consent "[a]s otherwise permitted or required by state or federal law or by order of the court." ORS 192.558(2)(b).
On appeal, the parties essentially reprise the arguments they made below, focusing on whether defendant breached its duty of confidentiality. Defendant contends that it did not—and therefore plaintiff could not establish that element of her claim as a matter of law—because its disclosure to TOC was permitted under federal and state law either for health care operations, or to avert a serious threat to the safety of an individual or the public, as set out above. It asserts that the evidence demonstrates that defendant disclosed plaintiff's PHI for "quality assessment and improvement activities, patient safety, and/or evaluating practitioner and provider performance at TOC." According to defendant, once Eddington—a Quality Management Coordinator—learned that plaintiff's sexual assault examination at PSVMC raised concerns that she may have been sexually abused while undergoing a procedure at TOC, he was "compelled to act not only for plaintiff but also for the protection of future patients who may have been in danger of sexual abuse." And, the disclosure was based on a good faith belief that it was "necessary to prevent such harm and to a person or persons reasonably able to prevent or lessen the threat."
Significantly, plaintiff does not dispute defendant's underlying proposition. That is, as the trial court observed, plaintiff does not dispute that, if the disclosure was made for those purposes, defendant's disclosure would have been permitted by law—in other words, that it would fall within the statutory and regulatory parameters set out above. Rather, plaintiff argues only that she presented sufficient evidence to raise a genuine issue of material fact as to whether that was indeed defendant's purpose or, as she claims, that, instead, defendant's intent was to "afford [TOC] an early warning about the impending police investigation so that it might better defend its own interests against plaintiff's allegations." We reject that argument.
The only time plaintiff even touches on the question of statutory interpretation is to challenge, in her reply brief, defendant's reliance on DelleCurti v. Walgreen Co. , 70 N.E.3d 111 (Ohio App. 2016), for its interpretation of the patient safety exception in 45 CFR § 164.506(c)(4). That is insufficient to raise an issue about the regulation separate from the thrust of her argument, which is that defendant's purpose for disclosing was not patient safety. Similarly, with regard to the good faith belief requirement in 45 CFR § 164.512(j), as plaintiff recognizes in her reply brief, any argument about the presumption of good faith is essentially immaterial because her claim is that defendant acted with an improper motive in calling TOC.
To begin, we are not persuaded by plaintiff's characterization of her burden on summary judgment. Plaintiff, as the party adverse to summary judgment, "has the burden of producing evidence on any issue raised in the motion as to which the adverse party would have the burden of persuasion at trial." ORCP 47 C. Thus, as plaintiff acknowledges, because she would have had the burden of proof at trial on the question whether defendant breached its duty of confidentiality under HIPAA and/or state law—specifically, given the statutory framework set out above, that defendant's disclosure was not for a permissible purpose—she was required to produce evidence on that issue in response to defendant's motion.
Plaintiff contends that to defeat summary judgment she need only produce "some evidence" or "any evidence" that defendant's intent in disclosing the information was not for health care operations or to avert a serious threat to public safety, as permitted under the relevant law. Although plaintiff is correct that, in Mason v. BCK Corp. , 292 Or.App. 580, 586, 426 P.3d 206, rev den. , 363 Or. 817, 431 P.3d 420 (2018), we held that the clear and convincing standard of proof at issue there did not "change the standard of ‘some evidence’ or ‘any evidence’ when considering whether a party has produced evidence sufficient to show a genuine dispute of material fact" for purpose of summary judgment, that does not change the fact that, under ORCP 47 C, no genuine issue of material fact exists if, based on the record before the court viewed in a manner most favorable to the adverse party, "no objectively reasonable juror could return a verdict for the adverse party." Id. at 587, 426 P.3d 206 (emphasis added; internal quotation marks omitted). Thus, to create a genuine issue of material fact, plaintiff must come forward not only with "some" evidence of defendant's improper purpose but with "some" evidence from which an objectively reasonable jury could find that improper intent. See, e.g. , Chapman v. Mayfield , 263 Or.App. 528, 530, 329 P.3d 12 (2014), aff'd , 358 Or. 196, 361 P.3d 566 (2015) ("Because plaintiffs would have had the burden of proof at trial, to withstand defendant's motion for summary judgment, plaintiffs had the burden of producing admissible evidence establishing facts that by themselves or by their reasonable inferences could cause a reasonable juror to find each element of plaintiffs’ claim. " (Emphasis added; internal quotation marks omitted.)); Brant v. Tri-Met , 230 Or.App. 97, 104, 213 P.3d 869 (2009) (to withstand summary judgment, the party with the burden of proving a claim must present evidence that gives a factfinder a basis "other than sheer speculation" to conclude that the elements of the claim have been satisfied). Plaintiff's interpretation—at least as we understand it—does not account for the "reasonable juror" part of her burden.
With the standard thus clarified, we turn to plaintiff's argument. In supporting her claim that defendant's intent was, at least in part, to "afford [TOC] an early warning about the impending police investigation so that it might better defend its own interests against plaintiff's allegations," plaintiff points to the following evidence in the summary judgment record:
• Eddington's initial deposition testimony that he did not recall making a call to anyone at TOC about plaintiff
• Laisner's testimony that she believed it was a woman who called her
• Alexander's email that "we passed the information off to Oregon Clinic."
According to plaintiff, that evidence leads to the following reasonable inferences: that Eddington may not have made the call and, at the least, was not the sole decisionmaker; that "there was an active effort to conceal the caller, and content, of the phone call"; that Alexander, the risk manager, was involved in the decision to make the disclosure; and that, because the risk manager's role is to protect the institution, defendant's disclosure of plaintiff's PHI was not for purposes of health care operations or to protect patient or public safety, as allowed by statute, but, rather, to help TOC protect itself against plaintiff's allegations. Further, according to plaintiff, Eddington's declaration is speculative even as to Eddington's intent, because it establishes only what his purpose "would have been," and, thus, "Providence has provided no direct evidence of the purpose behind the phone call."
Plaintiff also argues that Eddington's documentation of the call with Laisner, reflecting that he spoke with Laisner and she "will initiate an HR investigation and follow up at their clinic"—because it was preceded by a sentence that plaintiff "has or will contact Washington Co. deputies to lodge a complaint/report"—allows for the inference that the purpose of the call was to inform TOC that plaintiff would be contacting the police. In the same vein, for the first time in her reply brief, plaintiff also points to a portion of the ORQMD record documenting an email from Eddington to Bonforte in which he says, "Thanks for the additional info. I agree it will be complicated for her [referring to plaintiff]; this is a very serious allegation and I'm sure [TOC] will be exhaustive in investigating the situation if she pursues it with them. " (Emphasis in plaintiff's brief.) That, according to plaintiff at oral argument, is a "smoking gun," because it is evidence that TOC would only investigate if it was pressured to do so—that TOC was not interested in pursuing it for quality assurance or public safety purposes.
Plaintiff's theory is based on speculation and guesswork rather than reasonable inferences. See Mason , 292 Or.App. at 602-03, 426 P.3d 206 ("Whether a factual finding is based on reasonable inference, or would instead require impermissible speculation, will depend on the broader circumstances of each case."); State v. Bivins , 191 Or.App. 460, 467, 83 P.3d 379 (2004) ("There is a difference between inferences that may be drawn from circumstantial evidence and mere speculation. Reasonable inferences are permissible; speculation and guesswork are not." (Internal citations and quotation marks omitted.)). The line that separates reasonable inferences from speculation is " ‘drawn by the laws of logic.’ " Id. (internal quotation marks omitted). "[W]e have held evidence insufficient to support an inference when the conclusion to be drawn from it requires too great an inferential leap—that is, when the logic is too strained." Id. at 468, 83 P.3d 379 (internal quotation marks omitted). Of course, the laws of logic include "principles of deduction or inference." State v. Hedgpeth , 365 Or. 724, 733, 452 P.3d 948 (2019) (internal quotation marks omitted). We keep in mind that multiple reasonable inferences may be drawn from the evidence, but those inferences must still be reasonable and not speculative. Id. at 732-33, 452 P.3d 948.
Plaintiff's proposed inferences fall on the speculative side of the line. Evidence that Eddington did not initially recall making the call to TOC, but later—after reviewing his notes, which were documented in ORQMD close in time to the original event, as was routine—was reminded of the call, does not, absent speculation, lead to the inference that Eddington was trying to conceal who made the call or its content. Similarly, Alexander's use of the word "we," when reporting on the incident a month later, most naturally refers to Providence the entity, not herself personally. And most glaring of all, even if a juror could reasonably infer from that evidence (along with Laisner's testimony that she thought it was a woman who called her ) that Alexander was involved in the decision to contact TOC, there is nothing in the summary judgment record to indicate that a risk manager is not typically concerned with health care operations—including quality assurance and patient safety—or the safety of individuals or the public. Indeed, the record is devoid of evidence as to the role and duties of a hospital risk manager. That absence cuts against plaintiff. The bare fact that a risk manager might have been involved in the decision to disclose the information to TOC does not lead to a reasonable inference that the purpose of the call was to "afford [TOC] an early warning about the impending police investigation so that it might better defend its own interests against plaintiff's allegations," as plaintiff claims.
Laisner also stated in her deposition testimony that she did not recall who had called her.
Indeed, even if we assume that a risk manager's primary concern is liability, a risk manager would have reason to investigate plaintiff's allegations and take appropriate action to ensure that patients were not being harmed because that, in turn, would reduce the risk of liability on behalf of the institution.
Similarly, the fact that Eddington's ORQMD note that he "discussed this morning with Suzanne Laisner at [TOC]" follows a sentence in the same note that plaintiff would be contacting the police does not lead to a reasonable inference that the purpose of the call was to help TOC protect itself. Rather, the note simply records what transpired and Eddington's involvement in it, including that Laisner would initiate an investigation. Finally, Eddington's email note that TOC would undergo an exhaustive investigation "if plaintiff pursue[d] it with them" goes more to TOC's intentions than it does to anything about defendant's purpose in sharing the information. To conclude otherwise relies entirely on guesswork.
In sum, the summary judgment record does not contain evidence legally sufficient to support a finding that defendant's disclosure of the information was other than for purposes of health care operations or patient and public safety, as permitted by law. Plaintiff, thus, failed to come forward with sufficient evidence to create a genuine issue of fact about defendant's purpose for disclosing the information. We agree with the trial court's characterization of plaintiff's theory as a logically flawed "post hoc fallacy"—that, "since [defendant] informed [TOC], and [TOC] presumably discouraged cooperation [with the police investigation],[ ] then it was [defendant's] intent to discourage cooperation." The trial court did not err in granting summary judgment to defendant.
A presumption of fact that itself is not supported by the summary judgment record.
Affirmed.