Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C.

327 Conn. 540

175 A.3d 1

Emily BYRNE

v.AVERY CENTER FOR OBSTETRICS AND GYNECOLOGY, P.C.

SC 19873

Supreme Court of Connecticut.

Argued May 1, 2017

Officially released January 16, 2018

Bruce L. Elstein, for the appellant (plaintiff).

James F. Biondo, for the appellee (defendant).

Rogers, C.J., and Palmer, Eveleigh, McDonald, Robinson and D'Auria, Js.^*

EVELEIGH, J.

The plaintiff, Emily Byrne,¹ appeals from the judgment of the trial court rendered in favor of the defendant, Avery Center for Obstetrics and Gynecology, P.C., on two counts of the operative complaint alleging, respectively, negligence and negligent infliction of emotional distress.² On appeal, the plaintiff asserts that the trial court incorrectly granted summary judgment in favor of the defendant on these counts because it incorrectly concluded that the defendant, as a health care provider, owed the plaintiff no common-law duty of confidentiality. We agree with the plaintiff and, accordingly, reverse the judgment of the trial court.

This case returns to us for a second time. The facts and procedural history are set forth in this court's prior decision. See Byrne v. Avery Center for Obstetrics & Gynecology, P.C. , 314 Conn. 433, 436–44, 102 A.3d 32 (2014). "Before July 12, 2005, the defendant provided the plaintiff [with] gynecological and obstetrical care and treatment. The defendant provided its patients, including the plaintiff, with notice of its privacy policy regarding protected health information and agreed, based on this policy and on law, that it would not disclose the plaintiff's health information without her authorization.

"In May, 2004, the plaintiff began a personal relationship with Andro Mendoza, which lasted until September, 2004.³ ... In October, 2004, she instructed the defendant not to release her medical records to Mendoza. In March, 2005, she moved from Connecticut to Vermont where she presently lives. On May 31, 2005, Mendoza filed paternity actions against the plaintiff in Connecticut and Vermont." (Footnote in original; internal quotation marks omitted.) Id., at 437, 102 A.3d 32. Thereafter, the defendant received a subpoena instructing the custodian of its records to appear before the issuing attorney on July 8, 2005, at the New Haven Regional Children's Probate Court and to produce "all medical records" pertaining to the plaintiff. "The defendant did not alert the plaintiff of the subpoena, file a motion to quash it or appear in court. Rather, the defendant mailed a copy of the plaintiff's medical file to the court around July 12, 2005. In September, 2005, [Mendoza] informed [the] plaintiff by telephone that he reviewed [the] plaintiff's medical [record] in the court file. On September 15, 2005, the plaintiff filed a motion to seal her medical file, which was granted. The plaintiff alleges that she suffered harassment and extortion threats from Mendoza since he viewed her medical records.⁴ ...

"The plaintiff subsequently brought this action against the defendant. Specifically, the operative complaint in the present case alleges that the defendant: (1) breached its contract with her when it violated its privacy policy by disclosing her protected health information without authorization; (2) acted negligently by failing to use proper and reasonable care in protecting her medical file, including disclosing it without authorization in violation of General Statutes § 52–146o⁵ and the [federal] regulations implementing [the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. § 1320d et seq. ], (3) made a negligent misrepresentation, upon which the plaintiff relied to her detriment, that her medical file and the privacy of her health information would be protected in accordance with the law; and (4) engaged in conduct constituting negligent infliction of emotional distress. After discovery, the parties filed cross motions for summary judgment." (Footnotes altered; internal quotation marks omitted.) Byrne v. Avery Center for Obstetrics & Gynecology, P.C. , supra, 314 Conn. at 437–39, 102 A.3d 32.

"With respect to the plaintiff's negligence based claims in counts two and four of the complaint, the trial court agreed with the defendant's contention that 'HIPAA preempts "any action dealing with confidentiality/privacy of medical information,' " which prompted the court to treat the summary judgment motion as one seeking dismissal for lack of subject matter jurisdiction. In its memorandum of decision, the trial court first considered the plaintiff's negligence claims founded on the violations of the regulations implementing HIPAA. The court first observed the 'well settled' proposition that HIPAA does not create a private right of action, requiring claims of violations instead to be raised through ... administrative channels. The trial court then relied on Fisher v. Yale University , Superior Court, judicial district of New Haven, Complex Litigation Docket, Docket No. X10–CV–04–4003207–S, 2006 WL 1075035 (April 3, 2006), and Meade v. Orthopedic Associates of Windham County , Superior Court, judicial district of Windham, Docket No. CV–06–4005043–S, 2007 WL 4755001 (December 27, 2007), and rejected the plaintiff's claim that she had not utilized HIPAA as the basis of her cause of action, but rather, relied on it as ' "evidence of the appropriate standard of care" for claims brought under state law, namely, negligence.' Emphasizing that the courts cannot supply a private right of action that the legislature intentionally had omitted, the trial court noted that the 'plaintiff has labeled her claims as negligence claims, but this does not change their essential nature. They are HIPAA claims.' The trial court further determined that the plaintiff's statutory negligence claims founded on a violation of § 52–146o were similarly preempted because the state statute had been superseded by HIPAA, and thus the plaintiff's state statutory claim 'amount[ed] to a claim for a HIPAA violation, a claim for which there is no private right of action.'

"The trial court concluded similarly with respect to the plaintiff's common-law negligence claims, observing that, under the regulatory definitions implementing HIPAA's preemption provision⁶ ... to 'the extent that common-law negligence permits a private right of action for claims that amount to HIPAA violations, it is a contrary provision of law and subject to HIPAA's preemption rule. Because it is not more stringent, according to the definition of 45 C.F.R. § 160.202, the preemption exception does not apply.' For the same reasons, the trial court dismissed count four of the complaint, claiming negligent infliction of emotional distress.

"With respect to the remainder of the pending motions, the trial court first denied, on the basis of its previous preemption determinations, the plaintiff's motion for summary judgment, which had claimed that the defendant's conduct in responding to the subpoena violated the HIPAA regulations, specifically 45 C.F.R. § 164.512 (e), as a matter of law. The trial court denied, however, the defendant's motion for summary judgment with respect to the remaining counts of the complaint, namely, count one alleging breach of contract and count three alleging negligent misrepresentation, determining that genuine issues of material fact existed with respect to contract formation through the defendant's privacy policy, and whether the plaintiff had received and relied upon that policy. Thus, the trial court denied the defendant's motion for summary judgment as to counts one and three of the complaint, and dismissed counts two and four of the complaint for lack of subject matter jurisdiction." (Citations omitted; footnotes added and omitted.) Byrne v. Avery Center for Obstetrics & Gynecology, P.C. , supra, 314 Conn. at 439–44, 102 A.3d 32.

Thereafter, pursuant to Practice Book § 61–4, the plaintiff obtained permission to file an appeal from the judgment of the trial court dismissing counts two and four of the complaint to the Appellate Court. The appeal was subsequently transferred to this court pursuant to General Statutes § 51–199 (c) and Practice Book § 65–1. On appeal to this court, the plaintiff asserted that the trial court improperly concluded that her state law claims for negligence and negligent infliction of emotional distress were preempted by HIPAA. Id., at 436, 102 A.3d 32. In examining the plaintiff's claim, this court explained: "We note at the outset that whether Connecticut's common law provides a remedy for a health care provider's breach of its duty of confidentiality, including in the context of responding to a subpoena, is not an issue presented in this appeal. Thus, assuming, without deciding, that Connecticut's common law recognizes a negligence cause of action arising from health care providers' breaches of patient privacy in the context of complying with subpoenas, we agree with the plaintiff and conclude that such an action is not preempted by HIPAA and, further, that the HIPAA regulations may well inform the applicable standard of care in certain circumstances." (Footnote omitted.) Id., at 446–47, 102 A.3d 32.

This court concluded that, "to the extent that Connecticut's common law provides a remedy for a health care provider's breach of its duty of confidentiality in the course of complying with a subpoena, HIPAA does not preempt the plaintiff's state common-law causes of action for negligence or negligent infliction of emotional distress against the health care providers in this case and, further, that regulations of the Department of Health and Human Services (department) implementing HIPAA may inform the applicable standard of care in certain circumstances." Id., at 436, 102 A.3d 32. Accordingly, this court reversed the judgment of the trial court and remanded the case to that court for further proceedings. Id., at 463, 102 A.3d 32.

On remand, the defendant filed a motion for summary judgment on the counts of the operative complaint alleging...