6 Breach of Confidentiality

6 Breach of Confidentiality¹

A. Definition

In South Carolina State Bd. of Med. Examiners v. Hedgepath,² the South Carolina Supreme Court determined that a physician has an ethical obligation not to reveal a patient's confidences when the revelation is neither compelled by law nor consented to by the patient. The duty to maintain confidences is independent, said the court, of whether the professional can be legally compelled to reveal some or all of those confidences. In other words, the absence of a testimonial privilege that prohibits certain in-court disclosures does not preclude a tort action for breach of confidence, because any evidentiary privilege is distinguishable from a duty of confidentiality.³ The Court did not address whether breach of a duty of confidentiality would be actionable as a separate tort,⁴ but in McCormick v. England,⁵ the Court of Appeals held that South Carolina recognizes a "cause of action for a physicians breach of duty of confidentiality." The court limited its decision to the case before it and those arising after the date the opinion was filed, November 17, 1997.⁶

Breach of confidentiality is related to, and/or overlaps with, several other causes of action from which it needs to be distinguished. Chief among these is invasion of privacy. As one commentary notes, the aspect of invasion of privacy that concerns public disclosure of private facts most closely parallels breach of confidentiality.⁷ McCormick acknowledged that there "may be some overlap" between the two, but said that should not preclude recognition of an independent tort for physician's breach of confidence since the actions are distinguishable.⁸ The court then observed that:

Invasion of privacy consists of the public disclosure of private facts about the plaintiff, and the gravamen of the tort is publicity as opposed to mere publication. The defendant must intentionally reveal facts which are of no legitimate public interest, as there is no right of privacy in public matters. In addition, the disclosure must be such as would be highly offensive and likely to cause serious mental injury to a person of ordinary sensibilities.
Thus, an invasion of privacy claim narrowly proscribes the conduct to that which is 'highly offensive' and 'likely to cause serious mental injury.' This standard is not consistent with the duty attaching to a confidential relationship because it focuses on the content, rather than the source of the information. The unauthorized revelation of confidential medical information should be protected without regard to the degree of its offensiveness. The privacy standard would not protect information that happens to be very distressing to a particular patient, even though the individual would likely not have revealed it without the expectation of confidentiality.⁹

McCormick also noted the relationship of a duty of confidentiality to other causes of action, including breach of implied contract, medical malpractice,¹⁰ and breach of a fiduciary duty,¹¹ but did not explain the differences between those actions and breach of confidentiality. An earlier commentary explored the distinctions between breach of confidentiality and breach of either contract — express or implied¹² — or fiduciary duty. The author said that breach of confidence seems to borrow from breach of contract and fiduciary duty, but actually represents a shift in the definition of the underlying wrong because the latter focus on the breach, while former is concerned with the communication. While contract and fiduciary law seek to remedy all breaches, breach of confidentiality attempts to punish one type of wrongdoing: speech. It represents a change in the nature of the wrong being penalized.¹³

B. Elements

South Carolina courts have not explicitly set forth the elements of the action. In McCormick v. England, the court held that "... an actionable tort lies for a physician's breach of the duty to maintain the confidences of his or her patient in the absence of a compelling public interest or other justification for the disclosure."¹⁴ A South Carolina commentary says "... the patient need only show that: (1) the doctor-patient relationship existed, and (2) the doctor divulged information gained from the patient in the course of this relationship to a third party."¹⁵ Taking these two statements together with decisions from other jurisdictions discussing the tort,¹⁶ it would seem that the elements might be stated as five: (1) a confidential relationship; (2) disclosure of confidential information; (3) disclosure was to a third party; (4) absence of consent or privilege; and (5) damages.¹⁷

C. Elements Defined

1. A Confidential Relationship

The plaintiff must show that a doctor/patient relationship existed between him or her and the defendant.¹⁸ That relationship has been described as a "consensual one wherein the patient knowingly seeks the assistance of a physician and the physician knowingly accepts him as a patient."¹⁹ South Carolina courts have given some definition to that relationship within the context of medical malpractice actions.²⁰

There are other potential confidential relationships.²¹ The general principles that should apply to determine whether a relationship is confidential are whether it is of a "public nature" beyond mere friendship, family, or confessor-confidant and whether it is customarily understood to carry an obligation of confidence, not just a relationship in which an individual would reasonably believe that information should be confidential.²²

Hedgepath,²³ used some language that hinted doctor/patient may not be the only confidential relationship subject to a breach of confidentiality action, although the holding in McCormick clearly limited the tort to that relationship.²⁴ Interestingly, another relationship — social worker/client — was actually at issue in the lower court in McCormick; however, only the physician's appeal was before the appellate court.²⁵ There is a statute, noted in McCormick, addressing mental health patients that may be a basis of liability for providers."²⁶ A "provider" is a person licensed under specified statutes "... who enters into a relationship with a patient to provide diagnosis, counseling, or treatment of a mental illness or emotional condition ...".²⁷ Providers include: psychologists;²⁸ licensed professional counselors, marriage and family therapists, and psycho-educational specialists;²⁹ licensed social workers; and, clinical nurse specialists.³⁰ The statute provides that, unless permitted or required by law, a provider may not knowingly reveal a confidence³¹ of a patient.³² The statute sets forth circumstances in which a provider may, or must, reveal a confidence.³³ A provider who releases a confidence with the patient's written authorization or pursuant to the statutory provisions is not liable to the patient for release to the person authorized to receive it. If, however, a confidence is released in violation of the statute and the release is intentional, wilful, or committed with gross negligence, the patient has a cause of action for damages.³⁴

One relationship that the South Carolina Supreme Court has definitively said does not establish a duty of confidentiality is that of pharmacist and customer.³⁵

2. Disclosure of Confidential Information

Without a disclosure, the action fails.³⁶ South Carolina courts have not specifically stated what would constitute "confidential information" for the purposes of an action for breach of confidentiality.³⁷ In Hedgepath the court merely described the information as "not flattering." In McCormick the physician prepared a "To Whom It May Concern" letter diagnosing the plaintiff as suffering from "major depression and alcoholism, acute and chronic'" and stating the plaintiff's children had experienced school difficulties because of family discord caused by the plaintiff's drinking. The doctor also said that, in his medical opinion, the plaintiff was "a danger to herself and to her family with her substance abuse and major depressive symptoms," and required hospitalization.

It is unclear whether the disclosure must be intentional, or may be merely inadvertent.³⁸One Ohio federal court concluded that doctors "... may be legally culpable for ... intentional, unauthorized divulgence of confidences."³⁹ Hedgepath nowhere uses the words intent, intentional or wilful. McCormick refers to intent only in its discussion of the invasion of privacy tort. While the court there said invasion of privacy requires a defendant to "intentionally reveal facts which are of no legitimate public interest," the court did not explicitly state that the intent requirement distinguishes invasion of privacy from breach of confidentiality. A Pennsylvania court has made that distinction and strongly inveighed against any intent requirement.⁴⁰

Another unresolved question in South Carolina is the parameters of confidential information. Commentators seem to agree that for information to be confidential it must be learned in a confidential relationship,⁴¹ while it appears that essentially any information learned in a confidential relationship is considered confidential.⁴²

3. Disclosure Was to a Third Party

The third element is one that distinguishes breach of confidentiality from invasion of privacy. The latter requires "publicizing" private matters. Publicity means the information is revealed to more than one or a small number of persons.⁴³ A publicity requirement would preclude many breach of confidentiality cases. However, a confidential relationship may be breached if an unauthorized disclosure is made to only one person, since great injury could result from disclosure to a single person.⁴⁴ The McCormick court said the one person must be one "not a party to the confidence."⁴⁵ Otherwise, disclosure to anyone,⁴⁶ including, the plaintiff's spouse,⁴⁷ will meet the third element of the tort. One exception may be a disclosure to another physician, or other medical personnel.⁴⁸ The...