Opinion
HHDCV165041669S
11-14-2016
Jane Doe et al. v. Kenneth P. Abriola, M.D. et al
UNPUBLISHED OPINION
MEMORANDUM OF DECISION RE MOTION TO STRIKE (#107)
Sheila A. Huddleston, J.
The question presented in the pending motion to strike is whether medical providers owe an actionable duty of care to protect their patients from the inadvertent disclosure of medical records. The plaintiffs, Jane and John Doe, brought this action against three medical providers, alleging that the defendants negligently faxed Jane Doe's medical record, instead of a doctor's note, to her workplace. The medical record stated that Jane Doe was diagnosed as HIV positive. Jane Doe alleges that she suffered emotional injuries and financial losses as a result of the medical providers' " negligence per se" and negligent infliction of emotional distress because of the unauthorized disclosure in violation of the standards of care established under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d et seq., General Statutes § 52-146o, and federal and state regulations implementing HIPAA. Her husband, John Doe, asserts a claim for loss of consortium arising from the same factual allegations.
The plaintiffs moved for and were granted permission to proceed under the pseudonyms Jane Doe and John Doe because of the sensitive nature of the medical information allegedly at issue.
The defendants moved to strike all counts. They argue that there is no private right of action under HIPAA or state laws governing the confidentiality of medical records and that no Connecticut court has recognized a common-law cause of action for breach of confidentiality. The defendants further assert that they do not owe an actionable duty to the plaintiffs and that the plaintiffs have failed to allege an actual disclosure of the medical record. The plaintiffs respond that they have adequately alleged facts to support causes of action in negligence, negligence per se, negligent infliction of emotional distress, and loss of consortium.
Facts and Procedural History
The complaint alleges the following facts, which must be taken as true for the purpose of the motion to strike. Jane Doe and John Doe are Connecticut residents. Jane Doe is a patient of defendant Kenneth P. Abriola, a medical doctor specializing in internal medicine and infectious diseases. Defendant Kiley Spaulding is a licensed practical nurse and was at all relevant times an agent, servant, or employee of Abriola or of defendant Connecticut Health Care Group, LLC (CHCG), in Glastonbury, Connecticut. CHCG is a Connecticut corporation providing medical and health care personnel and services. CHCG employed Abriola and Spaulding at the time of the events alleged in the complaint.
On April 7, 2015, Jane Doe saw Abriola, her primary care physician, for an examination. At that time, he treated her and gave her a note for work. She asked that his note be faxed to her workplace and provided her employer's fax number to Abriola or Spaulding. At the same time, she asked to have a copy of her medical record mailed to her home address. On April 13, 2015, Abriola, Spaulding, or their agent or employee mailed Abriola's note to Jane Doe's home address and faxed her medical record to her workplace without her consent. The front page of her medical record indicated in bold letters: " Medical History: HIV POSITIVE DIAGNOSED IN 2006." The medical record was faxed to her workplace on a day when Jane Doe was not at work. An unidentified employee removed it from the fax machine and placed it on Jane Doe's desk.
Jane Doe is a manager who supervises more than twenty employees. When she returned to work on April 15, 2015, she found her medical record on her desk. The unauthorized disclosure of her medical record to one or more of her coworkers was the result of the " negligence and carelessness" of Abriola, Spaulding, and CHCG in that the defendants (1) failed to obtain authorization to release a medical record before disclosing it to a third party, although by a proper and reasonable exercise of medical care, they could and should have done so; (2) disclosed a medical record without authorization and consent, in violation of federal standards established by 45 C.F.R. § § 164.502(b), 164.514(d), and 164.530(c), under HIPAA; and/or (3) disclosed a medical record to a third party without authorization and consent, in violation of the standard of care under state law and regulations implementing HIPAA and General Statutes § 52-146o et seq.
Jane Doe claims that, as a result of the defendants' negligence, she has suffered personal injuries, including anxiety, stress, shame, anger, embarrassment, stigma, isolation, permanent emotional and psychological scarring, injuries to the nerves, and great pain and anguish, some of which are likely to be permanent. She further alleges that she was forced to incur expenses for medical care and attention; that her ability to enjoy life's activities has been reduced; and that she lost time from her employment, all as a result of the defendants' negligence. John Doe alleges loss of consortium, including both emotional and financial losses as a result of his wife's injuries.
On these alleged facts, Jane Doe asserts identical claims of " negligence per se" against Abriola (count one), Spaulding (count two), and CHCG (count three). She also asserts a claim of negligent infliction of emotional distress against all defendants (count four). John Doe asserts a claim of loss of consortium against all defendants (count five).
The defendants moved to strike the three negligence per se counts on the ground that there is no private cause of action under HIPAA or § 52-146o and no Connecticut court has recognized a common-law cause of action for breach of confidentiality. They further argue that the count for negligent infliction of emotional distress should be stricken because (1) the defendants owed no actionable duty to the plaintiff; (2) the plaintiff failed adequately to allege an actual disclosure of her medical records; and (3) the plaintiff has not alleged that the defendants' conduct was performed in an inconsiderate, humiliating or embarrassing manner. Finally, the defendants argue that John Doe's loss of consortium claim should be stricken because it is derivative of Jane Doe's claims, which are legally insufficient.
The plaintiffs argue that Jane Doe has adequately alleged a cause of action in negligence as well as in negligence per se. They further argue that the court should recognize a common-law duty of confidentiality, and a resulting cause of action for breach of that duty, under the principles stated in Grenier v. Commissioner of Transportation, 306 Conn. 523, 51 A.3d 367 (2012), Monk v. Temple George Associates, LLC, 273 Conn. 108, 869 A.2d 179 (2005), and various Connecticut jury instructions.
Applicable Legal Standards
A motion to strike challenges the legal sufficiency of a pleading and requires no factual findings by the trial court. Greenwald v. Van Handel, 311 Conn. 370, 374, 88 A.3d 467 (2014). The court must take the facts alleged in the complaint to be true and construe the complaint in the manner most favorable to sustaining its legal sufficiency. Violano v. Fernandez, 280 Conn. 310, 317-18, 907 A.2d 1188 (2006). If facts provable under the complaint would support a cause of action, the motion to strike must be denied. Id., 318. All well-pleaded facts and those facts necessarily implied from the allegations are taken as admitted. Id.
In this case, the defendant has argued, and the plaintiff does not disagree, that no Connecticut court has recognized a cause of action for a medical provider's negligent breach of patient confidentiality. The plaintiff argues, however, that the court should recognize such a cause of action under longstanding tort principles.
A motion to strike is a proper procedural vehicle to test whether Connecticut is ready to recognize some newly emerging ground of liability. Rich v. Foye, 51 Conn.Supp. 11, 16, 976 A.2d 819 (2007) . The judiciary has the inherent authority, pursuant to the state constitution, to recognize new tort causes of action, whether derived from a statutory provision or rooted in the common law. ATC Partnership v. Coats North America Consolidated, Inc., 284 Conn. 537, 552-53, 935 A.2d 115 (2007). There is no hard and fast test that courts apply when determining whether to recognize new causes of action. Id., 552. Nevertheless, a number of guiding principles can be found. One is whether existing sanctions are so ineffective as to warrant the recognition of a new cause of action. Id., 553. In that vein, courts must analyze the scope and applicability of current remedies under the facts alleged by the plaintiff. Id. Finally, courts remain " acutely aware of relevant statutes and do not ignore the statement of public policy that such statutes represent." Id.
The plaintiff has analyzed the principal issue presented in this motion as a question of duty. " Duty is a legal conclusion about relationships between individuals, made after the fact, and imperative to a negligence cause of action. The nature of the duty, and the specific persons to whom it is owed, are determined by the circumstances surrounding the conduct of the individual." (Internal quotation marks omitted.) Ruiz v. Victory Properties, LLC, 315 Conn. 320, 328, 107 A.3d 381 (2015). Although no universal test for duty has been formulated, our Supreme Court's threshold inquiry has always been " whether the specific harm alleged by the plaintiff was foreseeable to the defendant." (Internal quotation marks omitted.) Id. " The ultimate test of the duty to use care is found in the foreseeability that harm may result if it is not exercised." (Internal quotation marks omitted.) Id. " [T]he test for the existence of a legal duty entails (1) a determination of whether an ordinary person in the defendant's position, knowing what the defendant knew or should have known, would anticipate that harm of the general nature of that suffered was likely to result, and (2) a determination, on the basis of a public policy analysis, of whether the defendant's responsibility for its negligent conduct should extend to the particular consequences or particular plaintiff in the case." (Internal quotation marks omitted.) Id., 328-39. A duty to use care " may arise from a contract, from a statute, or from circumstances under which a reasonable person, knowing what he knew or should have known, would anticipate that harm of the general nature of that suffered was likely to result from his act or failure to act." (Internal quotation marks omitted.) Grenier v. Commissioner of Transportation, supra, 306 Conn. 539.
While foreseeability is essential to the finding of a duty, however, it is not dispositive. " [A] simple conclusion that the harm to the plaintiff was foreseeable . . . cannot by itself mandate a determination that a legal duty exists. Many harms are quite literally foreseeable, yet for pragmatic reasons, no recovery is allowed . . . A further inquiry must be made, for we recognize that duty is not sacrosanct in itself . . . but is only an expression of the sum total of those considerations of policy [that] lead the law to say that the plaintiff is entitled to protection . . . The final step in the duty inquiry, then, is to make a determination of the fundamental policy of the law, as to whether the defendant's responsibility should extend to such results." (Internal quotation marks omitted.) Ruiz v. Victory Properties, LLC, supra, 315 Conn. 336-37. In considering whether public policy favors the imposition of a legal duty, our Supreme Court has considered the following four factors: " (1) the normal expectations of the participants in the activity under review; (2) the public policy of encouraging participation in the activity, while weighing the safety of the participants; (3) the avoidance of increased litigation; and (4) the decisions of other jurisdictions." (Internal quotation marks omitted.) Monk v. Temple George Associates, LLC, supra, 273 Conn. 118.
Although no Connecticut trial or appellate court has yet recognized a common-law cause of action for a negligent breach of confidentiality of medical information, our Supreme Court recently signaled its willingness to consider whether such a cause of action should be recognized. In Byrne v. Avery Center for Obstetrics and Gynecology, P.C., 314 Conn. 433, 102 A.3d 32 (2014), the court overruled a trial court's determination that HIPAA preempted a common-law cause of action for negligent breach of confidentiality. After conducting an extensive analysis of the text and history of the federal regulations implementing HIPAA, the court held that " if Connecticut's common law recognizes claims arising from a health care provider's alleged breach of its duty of confidentiality in the course of complying with a subpoena, HIPAA and its implementing regulations do not preempt such claims." (Emphasis added.) Id., 458-59. It further concluded that " to the extent it has become the common practice for Connecticut health care providers to follow the procedures required under HIPAA in rendering services to their patients, HIPAA and its implementing regulations may be utilized to inform the standard of care applicable to such claims arising from allegations of negligence in the disclosure of patients' medical records pursuant to a subpoena." Id., 459. It noted, however, that whether HIPAA regulations " are suitable for use as a legislatively imposed standard of care for purposes of establishing negligence per se is a potentially complex question of law" that had not been adequately briefed by the parties and was therefore not addressed by the court. Id., 459 n.22.
In Byrne, the issue presented was one of federal preemption. The parties had not addressed whether Connecticut would recognize a tort cause of action for negligent breach of confidentiality. The Supreme Court assumed, without deciding, that such a cause of action existed for purposes of its preemption analysis. Id., 446. After concluding that the plaintiff's claims were not preempted by HIPAA, the court remanded the action to the trial for further proceedings. On remand, the trial court concluded that no Connecticut court has recognized or adopted a " common-law privilege" for communications between a patient and physicians, and that " [a]ny recognition of this cause of action is best addressed to our Supreme and Appellate Courts or the legislature." It therefore granted summary judgment for the defendant as to the plaintiff's claims of negligent disclosure and negligent infliction of emotional distress. Byrne v. Avery Center for Obstetrics and Gynecology, P.C., Superior Court, judicial district of Fairfield at Bridgeport, Docket No. CV-07-001633-S (August 3, 2015, Arnold, J.) [60 Conn.L.Rptr. 789, ]. An appeal from that decision is pending in the Appellate Court in Docket No. AC 38666.
Analysis
The dispositive issue in this case is whether a medical provider owes a legally cognizable common-law duty to protect the confidentiality of a patient's medical information. Although several trial courts have held that no such duty has been recognized in Connecticut, most have based that conclusion either on the absence of appellate authority recognizing such a cause of action or in the belief that HIPAA preempted such a cause of action. The Supreme Court's decision in Byrne resolved the preemption issue and concluded that a common-law cause of action--if such exists--is not preempted by HIPAA. The trial court's decision, on remand, did not address the factors usually associated with analysis as to whether an actionable duty exists.
The first question in a duty analysis is that of foreseeability: that is, would the ordinary person in the defendant's position, knowing what he knew or should have known, anticipate that harm of the general nature of that suffered was likely to result? Monk v. Temple George Associates, LLC, supra, 273 Conn. 115. In this case, the plaintiff alleges that the disclosure of her medical record, with its prominent notation of her HIV diagnosis, caused her anxiety, stress, shame, isolation, emotional and psychological harm requiring her to seek psychotherapy medical care and treatment, and lost time from employment, as well as a reduction in her ability to enjoy life. Given the nature of the particular disclosure alleged in this case, those harms are clearly foreseeable. Anxiety about being stigmatized, isolated, or discriminated against is a highly foreseeable consequence of an involuntary disclosure of a patient's HIV diagnosis. See Doe v. Marselle, 236 Conn. 845, 858 n.14, 675 A.2d 835 (1996) (discussing discrimination against people infected by HIV).
But foreseeability alone does not suffice to create an actionable duty. The court must then consider public policy, applying the four factors set out in Monk, supra, 273 Conn. 118: (1) the normal expectations of the participants in the activity; (2) the public policy of encouraging participation in the activity, while weighing the safety of the participants; (3) the avoidance of increased litigation; and (4) the decisions of other jurisdictions.
As to the first prong, it is fair to say that doctors have long recognized the need to maintain the confidentiality of a patient's medical information. From the Hippocratic Oath to the present ethical rules governing medical professionals, the importance of confidentiality has been recognized as a critical component in the provision of medical services. Without assurances of confidentiality, individuals are less likely to seek prompt medical care for conditions about which they are embarrassed or ashamed.
As to the second prong, it is equally certain that it is important, as a matter of public health, for sick people to seek medical care and to be candid with their medical providers about any circumstances from which their symptoms may have arisen. A patient is more likely to be candid when assured that all information about his or her medical condition is confidential.
The third prong, however, is more complicated. On the one hand, it can be argued that health care providers are already under regulatory duties to maintain the confidentiality of protected health information, under both HIPAA and state laws, and recognition of an actionable duty of care in tort should cause a relatively small increase in litigation if health care providers are generally complying with their preexisting legal duties. On the other hand, the court must consider that it is not writing on a blank slate. It must consider the significance of legislative decisions to create civil causes of action for the disclosure of certain specific health-related information but not others. Statutes enacted over the past half-century inform the public policy analysis as to the desirability of causes of action for civil damages related to the unauthorized disclosure of medical information.
More specifically, in 1969, the legislature enacted several provisions governing confidentiality of, and testimonial privileges for, psychological and psychiatric records, now codified at General Statutes § § 52-146c through 52-146j. Twenty years later, in 1989, it enacted laws specifically governing the confidentiality of information relating to individuals with AIDS or infected by HIV.
General Statutes § 52-146c created a testimonial privilege for communications between a psychologist and patient, generally requiring the consent of the patient or authorized representative of the patient for a psychologist to disclose such privileged communications in civil, criminal, juvenile, probate, commitment, and arbitration proceedings. The privilege, however, was subject to several exceptions, codified in § 52-146c(c). General Statutes § 52-146d through § 52-146i addressed confidential communications between a psychiatrist and patient. Within those statutes, § 52-146e expressly declared in relevant part that " [a]ll communications and records as defined in section 52-146d shall be confidential and shall be subject to the provisions of sections 52-146d to 52-146j, inclusive . . ." This was not merely a testimonial privilege, as in § 52-146c, but the statutory imposition of a positive duty of confidentiality. Section 52-146d(2) broadly defined " communications and records" to mean " all oral and written communications and records thereof relating to diagnosis or treatment of a patient's mental condition between the patient and a psychiatrist, or between a member of the patient's family and a psychiatrist, or between any of such persons and a person participating under the supervision of a psychiatrist in the accomplishment of the objectives of diagnosis and treatment, wherever made, including communications and records which occur in or are prepared at a mental health facility[.]" Most importantly, § 52-146j(b) expressly created a cause of action for civil damages for a violation of the statutes governing the confidentiality of psychiatric communications and records. It provides: " Any person aggrieved by a violation of sections 52-146d to 52-146j, inclusive, may prove a cause of action for civil damages."
In 1990, the legislature created a statutory privilege for communications with or information held by physicians, surgeons, and other licensed health care providers. This was codified as General Statutes § 52-146o, the statute upon which the plaintiff here seeks to rely for a " negligence per se" claim. Notably, however, § 52-146o is merely a testimonial privilege statute that applies " in any civil action or any proceeding preliminary thereto or in any probate, legislative or administrative proceeding." Unlike § § 52-146e, 52-146k(a)(3), 52-146n and 52-146q(b), governing psychiatric providers, domestic violence counselors, judicial employee assistance providers, and licensed social work providers, respectively, § 52-146o does not contain a general declaration that the communications of other physicians and other health care workers are " confidential." Nor does it create a civil cause of action for disclosure of health care communications or records, as § 52-146e expressly does for psychiatric communications and records.
General Statutes § 52-146o(a) provides: " Except as provided in sections 52-146c to 52-146j, inclusive, sections 52-146p, 52-146q and 52-146s, and subsection (b) of this section, in any civil action or any proceeding preliminary thereto or in any probate, legislative or administrative proceeding, a physician or surgeon, licensed pursuant to section 20-9, or other licensed health care provider, shall not disclose (1) any communication made to him or her by, or any information obtained by him or her from, a patient or the conservator or guardian of a patient with respect to any actual or supposed physical or mental disease or disorder, or (2) any information obtained by personal examination of a patient, unless the patient or that patient's authorized representative explicitly consents to such disclosure."
It must also be noted that the various privilege and confidentiality statutes codified between § 52-146c and § 52-146s, inclusive, contain numerous statutory exceptions. See, for example, § 52-146c(c) (exceptions to psychologist-patient privilege); § 52-146f (exceptions to psychiatrist-patient confidentiality and privilege provisions); § 52-146g (allowing access to psychiatric records for purposes of research); § 52-146k(e) (exceptions to domestic violence counselor confidentiality provision); § 52-146o(b) (exceptions to privilege for communications to health care providers); § 52-146p(c) (exceptions to privilege for marital and family counselors); and § 52-146q(c) (exceptions to confidentiality provisions for social workers). These exceptions indicate that the legislature carefully balanced the need for confidentiality of medical information against other societal needs and determined that confidentiality must sometimes give way to other concerns.
The court must also consider General Statutes § § 19a-581 to 19a-590, inclusive, which govern the confidentiality of information related to HIV and AIDS. Section 19a-583 imposes strict limits on the disclosure of HIV-related information, specifying persons to whom such information can be released and for what purposes it may be released. Section 19a-590 imposes civil liability for violations of the HIV statutes. It provides as follows: " Any person, except as otherwise provided in this chapter, who wilfully violates any provision of this chapter shall be liable in a private cause of action for injuries suffered as a result of such violation. Upon a finding that an individual has been injured as a result of such violation, damages shall be assessed in the amount sufficient to compensate said individual for such injury."
In Doe v. Marselle, supra, 236 Conn. at 860, the Supreme Court construed the word " wilfully" in § 52-190 to mean simply " a knowing disclosure of confidential HIV-related information." (Emphasis added.) It held that the term did not require proof of intent to injure. Id. However, it distinguished a " wilful" or " knowing" disclosure from a merely inadvertent disclosure. " Had the term wilful not been used, persons would be liable for inadvertent disclosures or nonvolitional acts. By establishing liability only for wilful violations, the legislature indicated that inadvertent violations would not be actionable." Id.
The legislature thus has acted, over the past five decades, to limit the uses and permissible disclosures of a wide range of health-related information. It has deemed some information to be so sensitive that it has expressly created civil causes of action for damages for unauthorized disclosures, such as disclosures of psychiatric information or " knowing" disclosures of HIV-related information. Its decision not to extend a civil cause of action to unauthorized disclosures of HIV-related information that were merely negligent or inadvertent suggests that it viewed the costs of imposing such liability as exceeding the benefits. It surely could not be based on a belief that a negligent disclosure would be less harmful to the person whose HIV-related information is disclosed. Rather, it must reflect a balancing of the need to deter knowing but unauthorized disclosures of HIV-related information with the additional costs that would be imposed if health care providers could be liable for simple human errors such as that described in the complaint in this action.
It is noteworthy, too, that the legislature did not choose to create a private cause of action for the unauthorized disclosure of general medical information, while it did choose to create a cause of action for unauthorized disclosure of certain specific types of information, including HIV-related information. The plaintiff in this case may have alleged § 52-146o as evidence of the standard of care for disclosure of medical records in general to avoid consideration of § 19a-590, the statute more directly relevant to the information inadvertently disclosed in her case. By its express text and by its interpretation in Doe v. Marselle, § 19a-150 makes it clear that there is no cause of action for merely inadvertent disclosures of HIV-related information. It would be inappropriate to find an actionable tort duty for violation of § 52-146o, the general health information privilege statute, where the legislature has chosen not to create such a cause of action under the more specific HIV-related confidentiality statute. The court concludes, consequently, that the third prong of the public policy analysis heavily favors rejection of an actionable duty for a merely negligent disclosure of HIV-related information.
The fourth prong of the duty analysis considers the actions of other states. Neither party briefed the state of the law in other states. The court's own research reveals that some states have recognized a cause of action for breach of the confidentiality of medical records, while others have rejected it. Compare Biddle v. Warren General Hospital . 86 Ohio St.3d 395, 1999 Ohio 115, 715 N.E.2d 518 (Ohio 1999) (recognizing independent tort for unauthorized, unprivileged disclosure to a third party of nonpublic medical information learned within a physician-patient relationship), with Quarles v. Sutherland, 215 Tenn. 651, 389 S.W.2d 249 (Tenn. 1965) (rejecting same). See also " Physician's tort liability for unauthorized disclosure of confidential information about patient, " 48 A.L.R.4th 668 (1986). States that have recognized a tort for the unauthorized disclosure of medical information have done so under a variety of theories, including breach of a fiduciary relationship, invasion of privacy, and the violation of various statutory duties. See id., § 2[a]; see also Biddle v. Warren General Hospital, supra, 715 N.E.2d 522-23. Courts have also recognized various limitations and defenses to such a tort, including a defense of lack of malice. See 48 A.L.R.4th 668, § 18. Given the differences from state to state in the types of actions recognized, the limitations on those causes of action, and the statutory milieu in each of the states, the court does not find the decisions of other states to provide much useful guidance in this case.
Considering all the factors above, the court concludes that the most significant factor is the legislative activity concerning the confidentiality of medical records in general and, more specifically, HIV-related information. The legislature appears to have considered the benefits and costs of creating causes of action for breaches of confidentiality regarding medical information and to have determined that only certain types of breaches warrant the imposition of civil liability. It expressly limited a cause of action for civil damages for disclosure of HIV-related information to " wilful" disclosures. In view of this legislative expression of public policy, and in the absence of substantive guidance from our Supreme Court, this court concludes that no actionable common-law duty should be recognized for a merely negligent disclosure of confidential health information, including HIV-related information.
Conclusion
In the absence of an actionable duty arising from a negligent disclosure of medical information, Jane Doe's claims in negligence and in negligent infliction of emotional distress must fail. Because John Doe's claim of loss of consortium is derivative of Jane Doe's claims, his claim also fails under this analysis. Accordingly, the defendants' motion to strike is granted as to all five counts of the complaint.