12-1045-cv
     Doe v. Guthrie Clinic Ltd.

 1                                 UNITED STATES COURT OF APPEALS
 2                                     FOR THE SECOND CIRCUIT
 3
 4
 5                                                   August Term, 2012
 6
 7
 8   (Submitted September 28, 2012                                                    Decided: March 25, 2013)
 9
10
11                                                Docket No. 12-1045-cv
12
13   - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -x
14
15   JOHN DOE,
16
17                               Plaintiff-Appellant,
18
19                     -v.-                                                            12-1045-cv
20
21   GUTHRIE CLINIC, LTD., GUTHRIE HEALTH,
22   GUTHRIE HEALTHCARE SYSTEM, GUTHRIE
23   HEALTH PLAN, INC., GUTHRIE CLINIC
24   INC., GUTHRIE CLINIC, A Professional Corporation,
25   GUTHRIE CLINICS GROUP PRACTICE
26   PARTNERSHIP, L.L.P., GUTHRIE MEDICAL
27   GROUP, P.C., GUTHRIE ENTERPRISES TWIN
28   TIER MANAGEMENT CORPORATION,
29
30                               Defendants-Appellees.
31
32   ---------------------------------------x
33
34   Before: CHIN, LOHIER, and DRONEY, Circuit Judges.
35
36          Appeal from a judgment of the United States District Court for the Western
37   District of New York (Telesca, J.), dismissing a claim against medical corporations that
38   operate a New York-based healthcare facility. The dismissed claim was for breach of the
39   fiduciary duty of confidentiality arising from a non-physician employee’s unauthorized
40   disclosure of plaintiff John Doe’s confidential medical information. On appeal, Doe
41   challenges the District Court’s ruling that a medical corporation cannot be held liable
 1   under New York law for such a breach when the corporation’s employee acted outside the
 2   scope of her employment. We conclude that the availability of a common law cause of
 3   action directly against the medical corporation under these circumstances raises a specific
 4   question of New York law that is appropriately certified to the New York Court of
 5   Appeals. We therefore certify this question to the New York Court of Appeals and stay
 6   resolution of this appeal as it pertains to that issue. We dispose of Doe’s remaining
 7   claims on appeal in a separate summary order filed simultaneously with this opinion.
 8
 9                                             T. Andrew Brown, Joseph A. Gawlowicz,
10                                             Brown & Hutchinson, Rochester, New York,
11                                             for Plaintiff-Appellant John Doe.
12
13                                             Martha Brockway Stolley, Morgan, Lewis &
14                                             Bockius LLP, New York, New York, for
15                                             Defendants-Appellees Guthrie Clinic, Ltd.,
16                                             Guthrie Health, Guthrie Healthcare System,
17                                             Guthrie Health Plan, Inc., Guthrie Clinic Inc.,
18                                             Guthrie Clinic, A Professional Corporation,
19                                             Guthrie Clinics Group Practice Partnership,
20                                             L.L.P., Guthrie Medical Group, P.C., Guthrie
21                                             Enterprises Twin Tier Management
22                                             Corporation.
23
24   LOHIER, Circuit Judge:

25          Plaintiff-Appellant John Doe appeals from a judgment of the United States District

26   Court for the Western District of New York (Telesca, J.) dismissing his complaint against

27   various Pennsylvania-based entities (the “Guthrie Defendants”) that Doe alleges own

28   Guthrie Clinic Steuben (the “Clinic”), a healthcare facility in Corning, New York.1 Doe’s

29   appeal principally requires us to consider whether the unauthorized disclosure of

30   confidential medical information by a medical corporation’s employee gives a plaintiff a

31   right of action for breach of a fiduciary duty under New York law that runs directly


            1
            Presumably to preserve diversity of citizenship, Doe did not name the Clinic as a
     defendant.

                                                 -2-
1    against the corporation, even when the corporation’s employee acted outside the scope of

2    her employment and is not the plaintiff’s treating physician.

3           The New York courts are virtually silent about the ability of a plaintiff to sue a

4    medical corporation directly for a non-physician employee’s ultra vires disclosure of the

5    plaintiff’s confidential medical information. One decision by a divided panel of the

6    Appellate Division, Third Department, appears to have recognized such a cause of action.

7    We hesitate to rely on it exclusively, however, because we are mindful that direct

8    corporate liability generally rests on the doctrine of respondeat superior and is not

9    implicated by the ultra vires acts of employees. Absent a precedential decision from the

10   New York Court of Appeals on this point in the context of the unauthorized disclosure of

11   medical information, we are reluctant to permit, or foreclose, such a cause of action.

12          As we explain more fully below, therefore, Doe’s appeal of the District Court’s

13   dismissal of his claim for breach of fiduciary duty presents a question that has not been

14   resolved by the New York Court of Appeals, that implicates significant New York state

15   interests in the disclosure of confidential medical information and in the liability of New

16   York-based medical facilities, and that is determinative of this appeal. Accordingly, we

17   defer decision and certify the following question to the New York Court of Appeals:

18                 Whether, under New York law, the common law right of
19                 action for breach of the fiduciary duty of confidentiality for
20                 the unauthorized disclosure of medical information may run
21                 directly against medical corporations, even when the
22                 employee responsible for the breach is not a physician and
23                 acts outside the scope of her employment?
24


                                                  -3-
1           We dispose of Doe’s remaining claims on appeal in a separate summary order filed

2    simultaneously with this opinion.

3                                         BACKGROUND

4           Doe’s claims arise from an incident at the Clinic on July 1, 2010. Doe was at the

5    Clinic to be treated for a sexually transmitted disease (“STD”). Magan Stalbird, a nurse,

6    worked at the Clinic. Stalbird was the sister-in-law of Doe’s girlfriend, Jessica. While

7    Doe was at the Clinic, and for reasons having nothing to do with Doe’s care, Stalbird sent

8    six text messages to Jessica. All six messages discussed Doe’s STD and medical

9    condition. After Doe learned about the messages and complained to the Clinic, the Clinic

10   fired Stalbird. Less than two weeks after the incident, the Clinic sent Doe a letter

11   confirming that his confidential information had been improperly accessed and disclosed,

12   and stating that appropriate disciplinary action had been taken.

13          Doe filed this diversity action against various affiliated entities that he alleges own

14   and operate the Clinic. In the complaint he asserted causes of action for (1) common law

15   breach of fiduciary duty to maintain the confidentiality of personal health information, (2)

16   breach of contract, (3) negligent hiring, training, retention and/or supervision of

17   employees, (4) negligent infliction of emotional distress, (5) intentional infliction of

18   emotional distress, (6) breach of duty to maintain the confidentiality of personal health

19   information under New York C.P.L.R. § 4504, (7) breach of duty to maintain the

20   confidentiality of personal health information under New York Public Health Law

21   § 4410, and (8) breach of duty to maintain the confidentiality of personal health

22   information under New York Public Health Law § 2803-c.

                                                  -4-
1           The District Court granted the Guthrie Defendants’ motion to dismiss all eight

2    claims under Rule 12(b)(6) of the Federal Rules of Civil Procedure. Doe appeals the

3    dismissal of the claims for breach of fiduciary duty, breach of contract, negligent hiring,

4    training, retention and/or supervision of employees, negligent infliction of emotional

5    distress, and intentional infliction of emotional distress. In this opinion, we address only

6    the first claim, for common law breach of the fiduciary duty of confidentiality.

7                                          DISCUSSION

8           We review the District Court’s dismissal of a complaint pursuant to Rule 12(b)(6)

9    de novo, Marsh v. Rosenbloom, 

, 172 (2d Cir. 2007), accepting all the

10   factual allegations in the complaint as true and drawing all reasonable inferences in favor

11   of the plaintiff. Metz v. U.S. Life Ins. Co. in City of New York, 

, 602 (2d

12   Cir. 2011).

13          Most of Doe’s tort claims are premised on the Guthrie Defendants’ liability for

14   Stalbird’s actions under the doctrine of respondeat superior.2 Under New York common

15   law, an employer is liable for the actions of an employee if her actions were foreseeable

16   and if she acted within the scope of her employment. Horvath v. L & B Gardens, Inc.,

17   

, 185 (2d Dep’t 2011). An employee’s conduct ordinarily cannot be


            2
             The Guthrie Defendants deny that Stalbird was employed by any of them,
     apparently on the theory that the Clinic is an independent entity not sued as a defendant
     herein. For purposes of this appeal, we assume, based on the record evidence of a letter
     sent to Doe by the Defendant-Appellee Guthrie Clinic, Ltd., that an employment
     relationship existed between that Defendant (and perhaps other Defendants-Appellees as
     well) and Stalbird.

                                                  -5-
1    attributed to the employer, however, if it was motivated solely by personal reasons

2    “unrelated to the furtherance of the employer’s business.” Id. (quotation marks omitted).

3    There is nothing in Doe’s complaint to indicate that Stalbird’s actions were foreseeable to

4    the Guthrie Defendants, or that her actions were taken within the scope of her

5    employment. To the contrary, the complaint alleges that Stalbird was motivated by

6    purely personal reasons to text confidential information about Doe to her sister-in-law.

7    Those reasons had “nothing to do with [Doe’s] treatment and care.” (Compl. ¶ 25). As

8    such, Stalbird’s actions cannot be imputed to the defendants on the basis of respondeat

9    superior.

10          Nevertheless, citing Doe v. Cmty Health Plan-Kaiser Corp., 

 (3d

11   Dep’t 2000), Doe argues that medical corporations are separately and strictly liable under

12   New York law for breaching their fiduciary duty to keep personal health information

13   confidential. In Doe, a medical records clerk disclosed information about treatment the

14   plaintiff had received from a psychiatric social worker. The Appellate Divison, Third

15   Department, held that the medical corporation could be held liable for the breach by its

16   employee because “[t]o hold otherwise would render meaningless the imposition of such

17   a duty on a medical corporation, since the wrongful disclosure of confidential information

18   would never be within the scope of the employment of its employees.” Id. at 218.

19          A specific common law cause of action against a physician who improperly

20   discloses confidential medical information is well established in New York. See Burton

21   v. Matteliano, 

, 440 (4th Dep’t 2011) (citing Tighe v. Ginsberg, 540

                                                 -6-


, 100 (4th Dep’t 1989)). But the Third Department in Doe appears to have

2    expanded that cause of action to include a direct right of action against a medical

3    corporation for breach of medical confidentiality by a non-physician employee. See 709

4    N.Y.S.2d at 217-18. The Doe court based its expansion on the theory that “a medical

5    corporation . . . can only act through its agents, servants or employees. Consequently, the

6    duty owed plaintiff by [the medical corporation] to protect patient confidences, if

7    breached, makes [the medical corporation] directly responsible.” Id. at 218. In doing so,

8    the Third Department focused on New York common law’s recognition of a physician’s

9    fiduciary duty of confidentiality as well as on specific New York statutes that, without

10   providing a private right of action,3 govern the disclosure of medical information by

11   medical corporations and that generally “define and impose the scope of the actionable

12   duty of confidentiality which arises between certain health care providers . . . and their

13   patients.” Id. at 217-18.

14          The broad theory of medical corporate tort liability announced in Doe is subject to

15   question. Indeed, two justices dissented from the majority’s decision, which cited no

16   statutory authority or caselaw to support its analysis. See id. at 218-19 (Mercure, J.,


            3
              See id. at 217 (“Although the statutes and regulations requiring physicians (and
     medical corporations) to protect the confidentiality of patient information gained during
     the course of treatment clearly express the State’s public policy, they do not constitute a
     basis upon which plaintiff may maintain a cause of action against [the medical
     corporation] since a private right of action springing from such statutes has not been
     recognized.”). Cf. Lightman v. Flaum, 

, 1032 (N.Y. 2001) (statutory
     privileges are “not the sources of the underlying duties” of confidentiality and “do[] not
     establish the parameters of those fiduciary relationships”).

                                                  -7-
1    concurring in part and dissenting in part). As the District Court noted in the instant case,

2    moreover, a corporation can be held liable for improper disclosure by an employee where

3    the employee acts within the scope of her employment – for example, by disclosing

4    information to another medical provider – without the patient’s consent. Doe v. Guthrie

5    Clinic, Ltd., No. 11 Civ. 6089, 

, at *5 (W.D.N.Y. Feb. 17, 2012); see

6    also Randi A.J. v. Long Island Surgi-Center, 

, 562 (2d Dep’t. 2007)

7    (medical clinic conceded liability for nurse’s unilateral disclosure of confidential

8    information to patient’s mother during routine follow-up telephone call).

9           The Third Department’s holding in Doe remains the only relevant signpost on the

10   question that confronts us, namely, whether, under New York law, the common law right

11   of action for breach of medical confidentiality runs directly against medical corporations,

12   even when the employee responsible for the breach is not a physician and acts outside the

13   scope of her employment. The only other Appellate Division decision to address the

14   issue did so summarily. See Romanello v. Intesa Sanpaolo S.p.A., 

,

15   352 (1st Dep’t 2012). There, the lawsuit was against the plaintiff’s employer, not against

16   a medical corporation.

17          It is true that in a case decided after the Third Department’s decision in Doe, the

18   New York Court of Appeals declined to impose liability on a medical corporation for the

19   unauthorized actions of its employee, a physician, who sexually assaulted a patient in the

20   hospital. See N.X. v. Cabrini Med. Ctr., 

, 847 (N.Y. 2002) (Wesley, J.).

21   But it is not clear that Cabrini was intended to apply to Doe’s more specific breach of

                                                  -8-
1    fiduciary duty claim relating to confidential medical information. Although it involved a

2    more egregious act (a sexual assault, not an unauthorized disclosure of confidential

3    medical information), Cabrini, as we read it, addressed the applicability of the traditional

4    doctrine of respondeat superior to a physician’s intentional tort. It did not address an

5    action for breach of fiduciary duty arising out of the unauthorized disclosure of

6    confidential medical information. It is that specific and legally distinct cause of action

7    that Doe held may be asserted directly against a medical corporation, even when

8    respondeat superior liability is absent, and that the plaintiff asserts directly against the

9    Guthrie Defendants in the instant case.

10                                        CERTIFICATION

11          Second Circuit Local Rule 27.2 permits us to certify to the New York Court of

12   Appeals “determinative questions of New York law [that] are involved in a case pending

13   before [us] for which no controlling precedent of the Court of Appeals exists.” N.Y.

14   Comp. Codes R. & Regs. tit. 22, § 500.27(a); see also N.Y. Const. Art. 6, § 3(b)(9). “In

15   deciding whether to certify a question, we consider: (1) the absence of authoritative state

16   court interpretations of [the law in question]; (2) the importance of the issue to the state,

17   and whether the question implicates issues of state public policy; and (3) the capacity of

18   certification to resolve the litigation.” Georgitsi Realty, LLC v. Penn-Star Ins. Co., 702

, 158 (2d Cir. 2012) (quotation marks omitted). Here, each factor favors

20   certification.

21

                                                   -9-
1           First, as we have explained, existing state caselaw on the question we have

2    identified for certification is extremely sparse. See Barenboim v. Starbucks Corp., 698

, 117 (2d Cir. 2012). Based on the three New York state decisions discussed

4    above, we cannot predict with confidence how the New York State Court of Appeals

5    “would rule on this legal question.” Michalski v. Home Depot, Inc., 

, 116

6    (2d Cir. 2000); see Casey v. Merck & Co., Inc., 

, 100-101 (2d Cir. 2011);

7    Elliott Assocs., L.P. v. Banco de la Nacion, 

, 370 (2d Cir. 1999); see also

8    West v. AT&T, 

, 236 (1940) (“[A] federal court is not free to reject the state

9    rule merely because it has not received the sanction of the highest state court.”). Of

10   course, we appreciate the possibility that the New York Court of Appeals may confidently

11   conclude that Cabrini determines the outcome in this case.

12          Second, the question identified for certification presents “important issues of New

13   York law and policy.” Barenboim, 698 F.3d at 117. Medical privacy and the

14   confidentiality of medical records are of concern to New York. As the majority in Doe

15   pointed out, a number of New York state statutes govern the disclosure of personal health

16   information, and how to regulate New York-based health care providers in this area is

17   generally best left to the sound value judgments of New York’s courts and legislature.

18          Finally, having disposed of Doe’s other claims in a separate summary order, we

19   think the resolution of the only remaining “unsettled and important issue of state law

20   will” likely “determine the outcome of this appeal.” Georgitsi, 702 F.3d at 159. If the

21   New York Court of Appeals determines that a medical corporation cannot be held directly

                                                 -10-
1    liable under the circumstances presented, that will end the litigation. If, on the other

2    hand, the New York Court of Appeals holds that a medical corporation may be held liable

3    for the unauthorized, ultra vires disclosure of confidential information by a non-physician

4    employee, then we would vacate the judgment of the District Court and remand for

5    further proceedings – that is, either summary judgment or trial.

6                                          CONCLUSION

7           For the foregoing reasons, we certify the following question to the New York

8    Court of Appeals:

 9          Whether, under New York law, the common law right of action for breach
10          of the fiduciary duty of confidentiality for the unauthorized disclosure of
11          medical information may run directly against medical corporations, even
12          when the employee responsible for the breach is not a physician and acts
13          outside the scope of her employment?
14
15   In certifying this question, we understand that the New York Court of Appeals may

16   reformulate or expand the certified question as it deems appropriate.

17          It is hereby ORDERED that the Clerk of the Court transmit to the Clerk of the

18   New York Court of Appeals a certificate in the form attached, together with a copy of this

19   opinion and a complete set of briefs, appendices, and the record filed by the parties in this

20   Court. This panel will retain jurisdiction to decide the case once we have had the benefit

21   of the views of the New York Court of Appeals or once that court declines to accept

22   certification. Finally, we order the parties to bear equally any fees and costs that may be

23   requested by the New York Court of Appeals. Decision is RESERVED.

24

                                                  -11-
1                                       CERTIFICATE

2         The foregoing is hereby certified to the Court of Appeals of the State of New York

3   pursuant to 2d Cir. L.R. 27.2 and N.Y. Comp. Codes R. & Regs. tit. 12, § 500.27(a), as

4   ordered by the United States Court of Appeals for the Second Circuit.




                                              -12-