22 N.Y.3d 480 (2014)
A medical corporation is not directly liable for an employee’s breach of a patient’s confidentiality when the employee’s actions are outside the scope of their employment and not reasonably foreseeable.
Summary
The New York Court of Appeals held that a medical corporation cannot be held directly liable for an employee’s unauthorized disclosure of a patient’s medical information when the employee acted outside the scope of their employment and for purely personal reasons. The case arose when a clinic employee disclosed a patient’s STD diagnosis to the patient’s girlfriend. The court reasoned that imposing such strict liability would be against precedent and that the corporation’s duty is limited to reasonably foreseeable risks and actions within the scope of employment. However, the court noted that claims of negligent hiring, supervision, or failure to establish adequate policies may be maintained.
Facts
John Doe was being treated for an STD at Guthrie Clinic Steuben. A clinic nurse recognized Doe as her sister-in-law’s boyfriend. The nurse accessed Doe’s medical records and sent text messages to her sister-in-law disclosing Doe’s condition while he was still awaiting treatment. The sister-in-law forwarded the messages to Doe, who complained to the clinic. The clinic fired the nurse and sent Doe a letter acknowledging the unauthorized disclosure and outlining steps taken to prevent future breaches.
Procedural History
Doe filed suit in federal court against the clinic, asserting multiple causes of action, including breach of fiduciary duty. The District Court dismissed all claims. The Second Circuit affirmed the dismissal of most claims but certified the question of whether a direct cause of action for breach of fiduciary duty could lie against the clinic, even absent respondeat superior liability, to the New York Court of Appeals after determining the nurse acted outside the scope of her employment and for personal reasons. The Second Circuit noted, “As such…[the nurse’s] actions cannot be imputed to the defendants on the basis of respondeat superior”.
Issue(s)
Whether, under New York law, the common-law right of action for breach of the fiduciary duty of confidentiality for the unauthorized disclosure of medical information may run directly against medical corporations, even when the employee responsible for the breach is not a physician and acts outside the scope of her employment?
Holding
No, because a medical corporation’s duty of safekeeping a patient’s confidential medical information is limited to those risks that are reasonably foreseeable and to actions within the scope of employment.
Court’s Reasoning
The court applied the doctrine of respondeat superior, stating,