2nd Cir Certified Question Raises Medical Privacy Concerns

Does the unauthorized disclosure of confidential medical information by a clinic’s employee create a right of action for breach of a fiduciary duty against the clinic under New York law? Does it matter if the blabbermouth employee acted outside the scope of her employment? If she was not the plaintiff’s treating physician?
Before the Second Circuit Court of Appeals answers these questions, it wants a little guidance from the New York Court of Appeals because the New York courts are virtually silent about a plaintiff’s ability to sue a medical corporation directly for a non-physician employee’s ultra vires disclosure of the plaintiff’s confidential medical information.
The question for the New York Court of Appeals:
Whether, under New York law, the common law right of action for breach of the fiduciary duty of confidentiality for the unauthorized disclosure of medical information may run directly against medical corporations, even when the employee responsible for the breach is not a physician and acts outside the scope of her employment?
The facts in the case leading to this question would give anyone cause for concern, but they prove especially noteworthy in New York, where so many celebrities seek medical treatment.
The plaintiff, John Doe, was at the Guthrie Clinic - Corning Steuben to be treated for a sexually transmitted disease. Magan Stalbird, a nurse, worked at the Clinic. Stalbird was the sister-in-law of Doe's girlfriend, Jessica.
While Doe was at the Clinic, and for reasons having nothing to do with Doe's care, Stalbird sent six text messages to Jessica discussing Doe's STD and medical condition.
After Doe learned about the messages and complained to the Clinic, the Clinic fired Stalbird and notified Doe that appropriate disciplinary action had been taken.
Doe sued the clinic for common law breach of fiduciary duty to maintain the confidentiality of personal health information, breach of contract, negligent hiring, negligent infliction of emotion distress, intentional infliction of emotional distress, and breach of duty to maintain the confidentiality of personal health information under three New York laws: Civil Practice Law § 4504, Public Health Law § 4410, and Public Health Law § 2803-c.
The district court granted the Clinic's 12(b)(6) motion to dismiss all eight claims.
On appeal, the Second Circuit concluded that the availability of a common law cause of action directly against the Clinic under these circumstances raised was a question for the New York Court of Appeals, and stayed the appeal pending an answer.
We'll keep you posted as the case progresses. In the all-knowing TMZ era, we suspect that a lot of celebrities (and attorneys-to-the-stars) will be following this case.
Related Resources:
- Doe v. Guthrie Clinic Ltd. (FindLaw's CaseLaw)
- Client Bait and Switch is Breach of Fiduciary Duty (FindLaw's Second Circuit Blog)
- Broker Can't Sue Law Firm for Breach of Fiduciary Duty (FindLaw's Sixth Circuit Blog)