A. B. v. Or. Clinic

321 Or.App. 60

515 P.3d 387

A. B., Plaintiff,

v.The OREGON CLINIC, an Oregon professional corporation, Defendant.

A. B., Plaintiff,

v.Innovative Anesthesia Management, LLC, a Delaware foreign limited liability corporation and The Oregon Clinic, an Oregon professional corporation, Defendants.

A. B., Plaintiff-Appellant,

v.Providence Health & Services-Oregon, an Oregon domestic nonprofit corporation, Defendant-Respondent.

A170711

Court of Appeals of Oregon.

Argued and submitted July 6, 2021

July 27, 2022

Gregory Kafoury, Portland, argued the cause for appellant. Also on the opening brief was Kafoury & McDougal. Also on the reply brief were Mark McDougal and Kafoury & McDougal.

Michael T. Stone, Hillsboro, argued the cause and filed the brief for respondent.

Before Mooney, Presiding Judge, and Pagán, Judge, and DeVore, Senior Judge.^*

MOONEY, P. J.

After undergoing a colonoscopy at The Oregon Clinic (TOC), plaintiff experienced symptoms that led her to believe that she may have been sexually assaulted during the procedure. She was examined and treated at Providence St. Vincent's Medical Center (PSVMC) for a possible sexual assault, and defendant Providence Health & Services-Oregon (defendant) later disclosed that protected health information (PHI) to TOC without plaintiff's consent. Plaintiff subsequently brought this common-law breach of confidence claim against defendant.¹ See Humphers v. First Interstate Bank , 298 Or. 706, 696 P.2d 527 (1985) (recognizing and describing breach of confidence tort² ). Plaintiff alleged that defendant breached its duty to maintain the confidentiality of her PHI under, as relevant to this appeal, the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996 and its implementing regulations,³ as well as Oregon state law governing PHI, ORS 192.553 to 192.581.⁴ The trial court granted summary judgment in favor of defendant on the basis that the disclosure was permissible under those laws and entered a limited judgment dismissing plaintiff's claim against defendant. Plaintiff appeals, challenging the trial court's summary judgment ruling. Given the pleadings and the summary judgment record in this case, we conclude that the trial court did not err. Accordingly, we affirm.

I. STANDARD OF REVIEW

In reviewing a trial court's grant of summary judgment, we view the facts and all reasonable inferences that may be drawn from those facts in the light most favorable to the nonmoving party, in this case plaintiff.⁵ Vaughn v. First Transit, Inc. , 346 Or. 128, 132, 206 P.3d 181 (2009). "We review a trial court's grant of summary judgment for errors of law and will affirm if there are no genuine disputes about any material fact and the moving party is entitled to judgment as a matter of law." Thompson v. Portland Adventist Medical Center , 309 Or.App. 118, 121, 482 P.3d 805 (2021).

II. HISTORICAL AND PROCEDURAL FACTS

A. Background

On April 21, 2014, plaintiff underwent a colonoscopy under anesthesia at TOC. After the procedure, she experienced pain in her vagina, and, when it continued, on April 25, she went to her gynecologist's office, Women's Healthcare Associates. A provider there sent her to the Emergency Department at PSVMC for a sexual assault exam. Plaintiff was given a Notice of Privacy Practices, which she acknowledged in writing.

Tara Bonforte, a sexual assault nurse examiner (SANE) at PSVMC, took plaintiff's history and plaintiff was physically examined by a physician, Dr. Ward. The examination revealed abrasions on the interior and exterior of plaintiff's vagina and redness on her cervix. Plaintiff authorized PSVMC to notify the police, and she was interviewed at the hospital by Deputy Condon from the Washington County Sheriff's Office (WCSO). Plaintiff also signed an authorization allowing PSVMC to release her medical information relating to the sexual assault evaluation to WCSO.

Subsequently, during the course of plaintiff's litigation against TOC for the alleged sexual assault, plaintiff learned that defendant had notified TOC of plaintiff's sexual assault examination and treatment at PSVMC, which lead to this action against defendant for breach of confidence.

B. Pleadings

Plaintiff alleged, in her second amended complaint,⁶ that defendant had disclosed her confidential information to TOC without her consent; that the information disclosed included her name, physical findings from her exam at PSVMC, and the resulting diagnosis of rape or other forcible sexual assault; and that the police would be contacting TOC to investigate. She alleged that the disclosure was in breach of defendant's duty of confidentiality with respect to plaintiff under various sources, including, as relevant here, state law governing PHI, ORS 192.553, and HIPAA privacy regulations, specifically, 45 CFR §§ 164.502 and 164.510.⁷ The complaint further alleged that "at least part of the reason for the [disclosure] was to warn [TOC] of the impending police investigation in order that [TOC] might prepare itself and its agents and employees against potential accusations involving civil or criminal liability" and that plaintiff suffered "a great sense of personal violation, humiliation, and betrayal, all to her noneconomic damages in the amount of $1,000,000."

In its amended answer, defendant admitted that it had made the alleged disclosure—in particular, that, after plaintiff's examination at PSVMC, a Providence Quality Manager had notified the Director of Quality and Risk at TOC of the concern that plaintiff may have been sexually assaulted during a medical procedure at TOC. Defendant further agreed that it had a duty under HIPAA and ORS 192.553 to 192.581 to maintain the confidentiality of plaintiff's PHI. However, as relevant here, defendant asserted that its disclosure was permitted by both federal and state law because it was made for purposes of health care operations and/or to avert a serious threat to public health or safety and, therefore, there was no breach.⁸

C. Summary Judgment Proceedings

Defendant moved for summary judgment against plaintiff on several grounds. Among other points, as relevant on appeal, defendant argued that it was entitled to judgment as a matter of law on plaintiff's breach of confidence claim because its disclosure of plaintiff's information was permissible under HIPAA's Privacy Rule and state law allowing the disclosure of PHI from one covered entity to another for the health care operations of the entity receiving the information, 45 CFR § 164.506(c)(4) ; ORS 192.558, or to avert a serious threat to individual or public health or safety, 45 CFR § 164.512(j).⁹ Defendant also argued that, if disclosure was permitted under HIPAA for either reason, it was also necessarily permitted under Oregon law, because Oregon's law expressly permits disclosure of PHI as permitted by federal law, ORS 192.558(2)(b). Accordingly, in defendant's view, there was no breach, and defendant was therefore entitled to judgment as a matter of law.¹⁰

In support of its motion, defendant submitted a declaration from Gordon Eddington, a Quality Management Coordinator at PSVMC at the time of the events in question. Eddington, a nurse by education and training, described his job duties as including "investigating and responding to patient complaints and grievances as well as to concerns raised by employees and staff relating to quality of care and patient safety." Eddington stated that Bonforte had contacted him about the alleged sexual abuse of plaintiff at TOC and that he had documented his involvement in the matter in defendant's Oregon Quality Management Database (ORQMD), as was his routine practice. Those notes from the ORQMD were attached to his declaration as Exhibit A.

Eddington learned from Bonforte that plaintiff was not expecting any response from defendant, and that she had decided to report the allegations to the police. Once informed of the allegations of sexual abuse, Eddington believed that he was ethically required to take action on behalf of plaintiff and for the public safety of other potential patients at TOC and that it was part of his job to take "all appropriate action where indicated for patient safety and quality of care." Eddington stated that he understood that he was permitted under HIPAA and state law to disclose the information to another covered entity—here, TOC—about their shared patient—plaintiff—for such purposes. He also understood that the disclosure was to be to a person with the ability to reasonably prevent or lessen the threat.

Eddington further declared:

"Under the circumstances, I made a telephone call to Suzanne Laisner, the Director of Quality and Risk Management at [TOC], to advise her of the situation. I do not recall the specifics of the telephone call with Ms. Laisner. However, I documented that Ms. Laisner would initiate an investigation and follow up at their clinic. This would have been my expectation when I made the call to Quality Management at [TOC]. I would have provided the minimum necessary information to allow [TOC] to conduct a meaningful investigation.

"Although I do not have a specific recollection of the telephone call with Ms. Laisner, my purpose would have been to make sure that [TOC] was aware of the allegation so that the situation could be looked into and any issues promptly addressed. My concerns would have been not only for plaintiff, but also to try and prevent potential sexual abuse of future patients."

Eddington's notes, documented in ORQMD, reflect that he spoke with Laisner on April 29:

"[D]iscussed this with Teri Polak, ED SANE RN.^{[11 ]} Teri tells me that the pt is not expecting a call from QM. She relates pt has or will contact Washington Co. deputies to lodge a complaint/report. Discussed this morning with Suzanne Laisner at Oregon Clinic. She will initiate an HR investigation and follow up at their clinic. "

(Emphasis added.)

In a supplemental declaration, Eddington specified that his ORQMD entries in Exhibit A were made close in time...