New York Court of Appeals holds that a medical corporation is not liable for the unauthorized disclosure of private health information by a non-physician.

A nurse recognized a patient as the boyfriend of a family member. The nurse then accessed the patient’s private health information contained in medical records and passed this information to the family member. The patient sued the clinic and asserted direct liability for breach of fiduciary duty in maintaining his private health information. The court, in a 6-1 decision, applied principles of vicarious liability and held that the clinic was not directly liable to the patient because the accessing and disclosure of private health information was not both reasonably foreseeable and within the nurse’s scope of employment—traditional respondeat superior concepts; therefore, no direct cause of action was stated directly against the clinic.

Case Law Alerts, 2nd Quarter, April 2014