Header graphic for print
Privacy Law Blog

New York Court Finds Clinic Not Liable for Employee’s Disclosure of PHI

Posted in Medical Privacy

A federal district court dismissed an action against an employer alleging vicarious liability for an employee’s dissemination of a patient’s protected health information (PHI) related to treatment for a sexually transmitted disease (STD). Specifically, the court found that the employer, a private New York medical clinic, was not vicariously liable for the actions of the employee because the employee was acting in a personal capacity which was beyond the scope of her employment.

A federal district court dismissed an action against an employer alleging vicarious liability for an employee’s dissemination of a patient’s protected health information (PHI) related to treatment for a sexually transmitted disease (STD). Specifically, the court found that the employer, a private New York medical clinic, was not vicariously liable for the actions of the employee because the employee was acting in a personal capacity which was beyond the scope of her employment.

John Doe, the patient and plaintiff, began receiving treatment at Guthrie Clinic Stueben in Corning, New York, for an STD. During the course of a visit, a nurse, Magan Stalbird, recognized Doe as her sister-in-law’s boyfriend, and, without any authorization, preceded to repeatedly text her sister-in-law with the details of Doe’s condition. Doe then sued Guthrie Clinic and its related entities for eight causes of action, including the breach of the fiduciary duty of confidentiality as well as the violation of various New York state public health laws.

New York case law has established that to assert a successful claim for a breach of a fiduciary duty, a plaintiff must allege that a duty existed, there was knowledge of the breach of that duty and that damages were suffered as a result. However, the court found that Doe did not adequately establish that Guthrie breached its duty of confidentiality as Doe only alleged that it was Stalbird that accessed and disseminated the PHI, not Guthrie.

Doe further alleged that Guthrie could be held liable under a theory of vicarious liability based on the fact that Stalbird was employed by Guthrie. The court did not agree, and stated that in order to successfully assert a claim for vicarious liability, the employee’s negligent actions must have met several criteria, including that the actions fell within the employee’s scope of employment and were under the express or implied authority of the employer. The court found that Stalbird was not acting within the scope of her employment; instead, her actions were based solely on her own personal motivations. Furthermore, the court rejected Doe’s argument that Guthrie should be held strictly liable for Stalbird’s disclosure of his PHI by stating that both case law and legislative intent do not support Doe’s position. The court added that New York Courts have repeatedly affirmed that where an employee engages in an action based on personal reasons or due to personal motivations, the employee’s conduct cannot be attributed to her employer.

Lastly, Doe argued that Guthrie did not obtain his authorization to release his PHI, violating several New York state public health laws. The court rejected this argument by finding that the statutes were both inapplicable and do not include a private right of action.

The court dismissed all claims against Guthrie. The court’s decision is available here.