Opinion
11-CV-6089T
02-17-2012
JOHN DOE, Plaintiff, v. GUTHRIE CLINIC, LTD.; GUTHRIE HEALTH; GUTHRIE HEALTHCARE SYSTEM; GUTHRIE HEALTH PLAN, INC.; GUTHRIE CLINIC INC.; GUTHRIE CLINIC, A PROFESSIONAL CORPORATION; GUTHRIE CLINICS GROUP PRACTICE PARTNERSHIP, L.L.P.; GUTHRIE MEDICAL GROUP, P.C.; GUTHRIE ENTERPRISES, TWIN TIER MANAGEMENT CORPORATION, Defendants.
DECISION and ORDER
INTRODUCTION
Plaintiff John Doe, ("Doe") has been granted permission to proceed in this action under a fictitious name to protect his privacy interests. Doe brings this action against the defendants (collectively "Guthrie" or "the Guthrie defendants") claiming that they violated several common law and statutory duties when a nurse at a medical clinic where plaintiff was being treated revealed private personal health information to Doe's girlfriend regarding Doe's treatment for a sexually transmitted disease ("STD"). The nurse, who was related by marriage to Doe's girlfriend, sent several text messages to Doe's girlfriend when Doe was being treated for the STD at the Guthrie Clinic Steuben, a private medical clinic located in the city of Corning, New York, in Steuben County. Neither Guthrie Clinic Steuben nor the nurse who revealed plaintiff's information are defendants in this action.
In eight causes of action, Doe claims that the defendants: breached their duty of confidentiality to him; violated New York State Public Health and Civil Practice laws; engaged in negligent or intentional infliction of emotional distress; and negligently hired or retained the nurse who wrongfully disclosed plaintiff's private health information.
Defendants deny Doe's charges, and move to dismiss his Complaint in its entirety. The defendants contend that plaintiff has failed to state a claim for any breach of confidentiality because Doe has failed to allege a knowing breach of confidentiality by any named defendant. While defendants concede for purposes of this motion that the nurse who disclosed Doe's condition may have violated a duty of confidentiality, they claim that the named defendants did not knowingly violate any duty they may have owed Doe. Defendants further argue that there is no private cause of action under the New York State statutes asserted by the plaintiff. Finally, defendants contend that plaintiff has failed to state a cause of action for negligent or intentional infliction of emotional distress, or negligent hiring.
Plaintiff opposes defendants' motion, and claims that he has stated valid causes of action with respect to all of his claims. For the reasons set forth below, however, I find that plaintiff has failed to state any valid cause of action against the named defendants, and therefore, I grant defendants' motion to dismiss.
BACKGROUND
The following facts are taken from the plaintiff's complaint, and are assumed to be true for purposes of this motion. In approximately February, 2010, plaintiff was diagnosed with a sexually transmitted disease. He was referred to the Guthrie Clinic Steuben, a private medical practice located in Steuben County, New York, for specialized treatment of his condition.
On July 1, 2010, Doe arrived at the Guthrie Clinic Steuben for treatment of his STD. Magan Stalbird ("Stalbird"), a nurse employed at the clinic, recognized Doe as the boyfriend of her sister-in-law Jessica ("Jessica"), and without authorization or any medical treatment purpose, accessed Doe's medical records for the purpose of determining the reason for his visit. Once Stalbird learned that Doe was being treated for an STD, and while Doe was still awaiting treatment in the office, she sent at least six text messages to Jessica informing Jessica of Doe's condition, and allegedly mocking and ridiculing Doe. Jessica forwarded Stalbird's messages to Doe while he waited for his treatment, and according to Doe, the messages suggested that Stalbird and other staff members were making fun of his medical condition.
Jessica's last name is not identified in the Complaint.
According to the Complaint, on July 6, 2010, five days after his visit to the Clinic, Doe called "the Guthrie Defendants" to complain of Stalbird's behavior. Based on Doe's allegations, an administrator named "Mike" set up a meeting with Doe to discuss the incident. Although Doe alleges that Mike "showed little interest in helping [him] resolve the problem of Guthrie Health's breach" (Complaint at ¶ 28) it is undisputed that within one day of Doe's meeting with Guthrie, Stalbird was fired from her employment. Thereafter, on July 12, 2010, Dr. Joseph A. Scopelliti, the President and CEO of Guthrie Clinic, Ltd., sent a letter to Doe explaining that there had been a breach of Doe's confidential health information, that appropriate disciplinary actions had been taken, and that steps had been taken to prevent such a breach from occurring in the future.
It is not clear which, if any of the defendants Doe contacted. "Guthrie Clinic Steuben," where the incident occurred, is not a named defendant, and plaintiff fails to identify which of the 9 named defendants he called.
On July 9, 2010, approximately 2 days after Stalbird was fired, Jessica received a text from her brother Greg Space (Stalbird's husband) in which he allegedly threatened Doe's life, and warned the two of them to "Leave Magan the fuck alone." Complaint at ¶ 30. Based on the phone call, Doe filed a criminal complaint against Greg Space, and sought an order of protection against him.
DISCUSSION
I. Motion to Dismiss Standard
In reviewing a motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure, the Court must "accept...all factual allegations in the complaint and draw...all reasonable inferences in the plaintiff's favor." See Ruotolo v. City of New York, 514 F.3d 184, 188 (2d Cir.2008) (internal quotation marks omitted). In order to withstand dismissal, the complaint must plead "enough facts to state a claim to relief that is plausible on its face." See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 127 S.Ct. 1955, 1974 (2007) (disavowing the oft-quoted statement from Conley v. Gibson, 355 U.S. 41 (1957), that "a complaint should not be dismissed for failure to state a claim unless it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief").
"While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff's obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." See id. at 1965 (internal quotation marks omitted). Moreover, conclusory allegations are not entitled to any assumption of truth, and therefore, will not support a finding that the plaintiff has stated a valid claim. Hayden v. Patterson, 594 F.3d 150, 161 (2nd Circ., 2010). Thus, "at a bare minimum, the operative standard requires the 'plaintiff [to] provide the grounds upon which his claim rests through factual allegations sufficient to raise a right to relief above the speculative level.'" See Goldstein v. Pataki, 516 F.3d 50, 56-57 (2d Cir.2008) (quoting Twombly, 127 S.Ct. at 1974).
II. Common Law Claims
A. Breach of Fiduciary Duty
Plaintiff alleges that the defendants, as fiduciaries, owed a duty of confidentiality to him, and that they breached this duty by disclosing his confidential health information.
"To state a claim for breach of fiduciary duty, plaintiff must allege '(1) the existence of a fiduciary relationship; (2) a knowing breach of a duty that relationship imposes; and (3) damages suffered.'" Trautenberg v. Paul, Weiss, Rifkind, Wharton & Garrison L.L.P. 351 Fed.Appx. 472, 474 (2nd Cir., 2009)(quoting Carruthers v. Flaum, 388 F.Supp.2d 360, 381 (S.D.N.Y.2005).
In the instant case, plaintiff has named nine separate corporate entities as defendants, but has only alleged in a conclusory manner that each of the defendants owed the plaintiff a fiduciary duty. Specifically, as the basis for the alleged duty, Doe claims that each named defendant "own[s], possess[es], operat[es], staff[s] and/or otherwise control[s] Guthrie Clinic Steuben in conjunction with the other Guthrie Defendants", and therefore owes a duty to Doe for actions taken by Guthrie Clinic Steuben. Complaint at ¶¶ 5, 6, 7, 8, 9, 10, 11, 12, 13, 14. There are no allegations specific to each defendant explaining the basis for any duty owed by that particular defendant to the plaintiff other than the alleged ownership, possession, operation, staffing, or control of the Clinic by the named defendants. Accordingly, I find that plaintiff has failed to establish that any of the named defendants owed a fiduciary duty to keep his information confidential.
Plaintiff contends, however, that at least one of the defendants, Guthrie Clinic, Ltd, admitted that it owed a duty to the defendant, and that it breached that duty when the President and CEO of Guthrie Clinic sent plaintiff a letter explaining that Doe's personal information had been improperly accessed and disclosed, and that Doe should take steps to ensure that his identity was not being used unlawfully. Without deciding whether Guthrie Clinic's notification to Doe that his information had been improperly accessed and disseminated constitutes an admission that it owed a fiduciary duty to Doe to keep his information confidential, I find that even if the defendant did owe such a duty, plaintiff has failed to allege that the Guthrie Clinic Ltd., or any defendant, violated a duty to keep plaintiff's information confidential.
As stated above, to establish a breach of a fiduciary duty to keep information confidential, a plaintiff must establish a knowing breach of that duty. In the instant case, there is no allegation that any of the defendants breached any duty of confidentiality, or that they did so knowingly. Rather, the allegations in the Complaint allege that Stalbird improperly accessed Doe's information and improperly disseminated that information to Doe's girlfriend. However, there is no allegation that any of the defendants improperly accessed or disseminated plaintiff's information, and thus plaintiff has failed to establish a breach by any of the defendants.
Plaintiff alleges, however, that Stalbird was employed by one or more of the defendants, and therefore, the defendants may be held liable for her actions on a theory of vicarious liability or respondeat superior. I find that plaintiff has failed to establish that Stalbird's action can be attributed to her former employer, and therefore, plaintiff has failed to establish that any defendant can be held vicariously liable for the alleged breach of a duty to keep personal health information confidential.
It is well established under common law that an employer may be held liable for the intentional or negligent acts of an employee where the employee was acting within the scope of his or her employment. Horvath v. L & B Gardens, Inc., 932 N.Y.S.2d 184, 185 (N.Y.A.D. 2 Dept., 2011)("Pursuant to the doctrine of respondeat superior, an employer can be held vicariously liable for torts committed by an employee acting within the scope of employment.")(citations omitted). However, for liability to attach to an employer, for either negligent or intentional acts taken by the employee, the conduct must be foreseeable and must occur within the scope of the employee's employment. Id. While the question of whether or not an employee's conduct was within his or her scope of employment presents questions of fact, such a determination can be made as a matter of law where the facts are not in dispute, or where the facts alleged fail to establish that the conduct was within the scope of employment. Clark Street Wine and Spirits v. Emporos Systems Corp., 754 F.Supp.2d 474, 486 (E.D.N.Y., 2010) (citing Girden v. Sandals Intern., 262 F.3d 195, 205 (2d Cir.2001). In determining whether or not conduct was within the scope of employment, courts consider factors such as:
(1) whether the employee's act fell within the discretion and control of the employer; (2) whether the employee acted under the express or implied authority of the employer; (3) whether the employee's act was in furtherance of the employer's interests; (4) whether the employee's acts were in the "discharge of duty" to the employer; (5) whether the act was in execution of the employer's orders or part of the work assigned by the employer; and (6) whether the acts were "so closely connected" with what the employee was hired to do, and "so fairly and reasonably incidental to it, that they may be regarded as methods, even though quite improper ones, of carrying out the objectives of employment."Ello v. Singh, 531 F.Supp.2d 552, 582 (S.D.N.Y., 2007)(quoting Rausman v. Baugh, 682 N.Y.S.2d 42, 43 (N.Y.A.D. 2nd., 1998)).
Based on the factors set forth above, I find that Stalbird's acts of accessing plaintiff's medical records and then disseminating information about his medical condition to her husband's sister were not within the scope of her employment as a nurse at the Guthrie Clinic Steuben. There is no evidence or allegation that Stalbird took such steps on behalf of the clinic, or with the clinic's authorization. Nor was plaintiff discharging her duty as a nurse when she revealed Doe's personal information to her husband's sister. Her conduct was not in furtherance of the clinic's business, and indeed, was in contravention of the clinic's policies regarding confidentiality.
Moreover, New York Courts have repeatedly stated that where an employee undertook conduct for personal reasons, or had personal motivations, the employee's conduct can not be attributed to his or her employer. "[T]here is no respondeat superior liability for torts committed for personal motives unrelated to the furtherance of the employer's business." Murray v. Watervliet City School Dist., 515 N.Y.S.2d 150, 152 (N.Y.A.D. 3rd., 1987); Ello, 531 F.Supp.2d at 582; Clark Street Wine and Spirits, 754 F.Supp.2d at 487 (citing Artalyan, Inc. v. Kitridge Realty Co., Inc., 860 N.Y.S.2d 100, 102 (1st Dep't 2008); Naegele v. Archdiocese of New York, 833 N.Y.S.2d 79, 80 (1st Dep't 2007); Yildiz v. PJ Food Service, Inc., 918 N.Y.S.2d 572, 574 (N.Y.A.D. 2.Dept.,2011)("employer bears no vicarious liability where the employee committed the tort for personal motives unrelated to the furtherance of the employer's business.") In this case, it is clear from the pleadings that Stalbird was acting out of personal motivations when she texted information about Doe's STD to her sister-in-law, who was dating Doe at the time. Because Stalbird was acting based on personal motivations, without authorization from any of the defendants, and was not acting in furtherance of her employer's interests, I find that Stalbird's actions can not be imputed to Guthrie Clinic Steuben, or any of the defendants.
Plaintiff contends however, that Stalbird's actions can be attributed to the defendants as a matter of law, because the corporate defendants can only act through its agents and employees. In support of this argument, plaintiff sites Doe v. Community Health Plan-Kaiser Corp., 709 N.Y.S.2d 215, 218 (N.Y.A.D. 3rd Dept., 2000) in which the court held that:
a medical corporation, can only act through its agents, servants or employees. Consequently, the duty owed plaintiff by [the defendant medical corporation] to protect patient confidences, if breached, makes [the defendant medical corporation] directly responsible. To hold otherwise would render meaningless the imposition of such a duty on a medical corporation, since the wrongful disclosure of confidential information would never be within the scope of the employment of its employees.According to the plaintiff, the Court in Doe abrogated the traditional analysis of vicarious liability in situations involving unauthorized disclosure of health information, and enunciated a new standard of strict liability for corporations in cases where its employees, without authorization, disclosed confidential health information. For the reasons set forth below, I decline to follow the standard set forth in Doe.
Initially, I note that the Doe court's justification for imposing liability on employers under any circumstances in which an employee, without authorization, disclosed confidential information, is flawed. The Doe court held that failure to impose strict liability on the employer would "render meaningless the imposition of such a duty . . . .since the wrongful disclosure of confidential information would never be within the scope of the employment of its employees." Doe, 709 N.Y.S.2d at 218. Such a conclusion, however, is erroneous. An employee could be directed by his or her employer to disclose personal health information, as in a case where another physician, or some other entity requests health information from the medical provider. If the request for information was not valid, the disclosure would be unauthorized, yet the employee would have provided the information with authorization from his or her employer, and in furtherance of the employer's interests. This example illustrates how an employee could be acting within his or her scope of employment when engaging in the unauthorized disclosure of health information, contrary to the Doe court's assertion that wrongful disclosure of information would "never" be within an employee's scope of employment. Because the unauthorized disclosure of information could be attributable to a corporation via the traditional analysis of vicarious liability, I find that the Doe court's reasoning justifying the alteration of vicarious liability analysis is flawed, and need not be followed.
Moreover, the determination of whether or not strict liability may be imposed on a party is a question properly left to legislatures, not courts. See e.g.,; Sanatass v. Consolidated Investing Co., Inc., 887 N.E.2d 1125, 1131 (N.Y., 2008)("Any modification to . . . strict liability statute must be made by the Legislature, not this Court"); Affiliated FM Ins. Co. v. Trane Co., 831 F.2d 153, 155 (7th Circ., 1987)("With the principles of Erie in mind, plus the clear pronouncement from the Wisconsin Supreme Court to defer to the legislature, we decline to expand strict liability law . . . ."); Bierman v. Consolidated Edison Co. of New York, 320 N.Y.S.2d 331, 332 (N.Y.Sup., 1970)("If a rule of strict liability is to be adopted, the pronouncement should come from the Legislature or the Court of Appeals, and not from a court of original jurisdiction."). Accordingly, I see no need for this court, applying the law of New York, to impose a standard of strict liability absent legislative authority to do so.
Finally, I note that upon extensive search, the court is unable to find any case other than Doe suggesting that an employer may be held strictly liable in cases where an employee has, without authorization, violated a duty of confidentiality owed by the employer. Indeed, the New York State Court of Appeals, in a case decided after Doe, has declined to adopt the Doe court's strict liability standard. See, N.X. v. Cabrini Medical Center, 765 N.E.2d 844, 847 (2002)("Under the doctrine of respondeat superior, an employer may be vicariously liable for the tortious acts of its employees only if those acts were committed in furtherance of the employer's business and within the scope of employment."). I decline to extend a standard of strict liability to employers where the New York State Legislature and Court of Appeals have declined to do so, and therefore I find that plaintiff has failed to establish that the defendants breached any duty of care to Doe when Stalbird, without authorization, and acting outside the scope of her employment, revealed plaintiff's confidential health information to Doe's girlfriend.
B. Breach of Contract
Plaintiff alleges that the defendants breached contracts with him by disclosing his personal information. Plaintiff has not identified any valid written agreement with any defendant as the basis of his breach of contract claim, but instead alleges that the defendants violated an "implied" contract of good faith. Assuming arguendo that plaintiff may proceed on a claim of breach of contract, I find that he has failed to establish that any defendant breached a contractual duty of confidentiality, and thus I grant defendants' motion to dismiss this claim.
"To make out a viable claim for breach of contract a 'complaint need only allege (1) the existence of an agreement, (2) adequate performance of the contract by the plaintiff, (3) breach of contract by the defendant, and (4) damages.'" Eternity Global Master Fund Ltd. v. Morgan Guar. Trust Co. of N.Y., 375 F.3d 168, 177 (2nd Cir. 2004)(quoting Harsco Corp. v. Segui, 91 F.3d 337, 348 (2d Cir.1996). In the instant case, Doe alleges that the defendants breached a duty of confidentiality embodied in an implied contract when Stalbird disclosed his personal information. For the reasons set forth above, however, I find that Stalbird's disclosure of Doe's medical information can not be imputed to the defendants. Because plaintiff has failed to allege any other independent basis for his breach of contract claim, I grant defendants' motion to dismiss these claims.
C. Negligent Hiring
Plaintiff alleges that the defendants are liable for the acts of Stalbird because they negligently hired her. To state a claim for negligent hiring under New York law, a plaintiff must allege: "(1) that the tortfeasor and the defendant were in an employee-employer relationship; (2) that the employer "knew or should have known of the employee's propensity for the conduct which caused the injury" prior to the injury's occurrence; and, (3) that the tort was committed on the employer's premises or with the employer's chattels." Ehrens v. Lutheran Church, 385 F.3d 232, 235 (2d Cir.2004). In the instant case, there is no credible, non-conclusory allegation that any defendant knew or should have known that Stalbird would breach her duty of confidentiality with respect to any patient's private health information. Accordingly, plaintiff has failed to state a claim for negligent hiring. Moreover, because Stalbird was fired by the Guthrie Clinic Steuben within one day of learning of Stalbird's dissemination of Doe's information, plaintiff is unable to state a claim for negligent retention of an employee. I therefore grant defendants' motion to dismiss plaintiff's negligent hiring claim.
D. Negligent Infliction of Emotional Distress
"Under New York law, a plaintiff may recover for negligent infliction of emotional distress under one of two theories: (1) the 'bystander theory' or (2) the 'direct duty theory.'" Higgins v. Metro-north Railroad Company 2001 WL 503003 (S.D.N.Y., May 11, 2001)(citing United States ex rel. Ben-Shlush v. St. Luke's-Roosevelt Hosp., 200 WL 269895 at *4 (S.D.N.Y. Mar. 10, 2000) (additional citations omitted). Under the "bystander" theory, plaintiff must allege that she witnessed the death or serious bodily injury of a member of her immediate family. Mortise v. United States, 102 F.3d 693 (2d Cir.1996). There are no allegations in the complaint that Plaintiff witnessed anyone's death or serious bodily injury. Nor can Doe make out a claim under the "direct duty" theory, as such a claim requires evidence that plaintiff suffered an emotional injury as a result of defendant's breach of a duty "which unreasonably endangered her own physical safety, . . . or caused her to fear for her physical safety." Wahlstrom v. Metro-north Commuter Railroad Company, 89 F.Supp.2d. 506, 530 (S.D.N.Y., 2000)(citations omitted). Plaintiff has not identified the breach of a duty that endangered his physical safety or caused him to fear for his safety. See Mortise, 102 F.3d at 693 (duty alleged "must be specific to the plaintiff, and not some amorphous, free-floating duty to society"). While plaintiff alleges that he was physically threatened by his girlfriend's brother Greg Space, there is no suggestion that Space's conduct can attributed to the defendants, or that any alleged breach of a duty by the defendants endangered Doe's safety, or caused him to fear for his safety. Finally, the complaint is devoid of any allegation that plaintiff suffered a physical manifestation of the emotional injury, a required element of a claim for negligent infliction of emotional distress. Bertuzzi v. Chase Manhattan Bank, N.A., 1999 WL 759997, at *7 n. 3 (S.D.N.Y. Sept. 24, 1999); Iannotti v. City of Amsterdam, 225 A.D.2d 990, 639 N.Y.S.2d 537, 538 (3d Dep't 1996). Because plaintiff has failed to establish a claim for negligent infliction of emotional distress, I grant defendant's motion to dismiss this claim.
E. Intentional Infliction of Emotional Distress
Plaintiff alleges that the unauthorized disclosure of his personal health information constitutes extreme and outrageous conduct on the part of the defendants that caused him to suffer extreme emotional distress. To state a claim for intentional infliction of emotional distress, a plaintiff must allege that the defendant engaged in "(1) extreme and outrageous conduct; (2) [with] intent to cause, or reckless disregard of a substantial probability of causing, severe emotional distress; (3) a causal connection between the conduct and the injury; and (4) severe emotional distress." Stuto v. Fleishman, 164 F.3d 820, 827 (2d Cir.1999). The conduct complained of must be "so outrageous in character, and so extreme in degree, as to go beyond all possible bounds of decency, and to be regarded as atrocious, and utterly intolerable in a civilized society." Fischer v. Maloney, 43 N.Y.2d 553, 558 (1978). Ordinarily, whether the challenged conduct is sufficiently outrageous will be determined as a matter of law. Nevin v. Citibank, 107 F.Supp.2d 333, 345-46 (S.D.N.Y. 2000)(citing Howell v. New York Post Company, Inc., 81 N.Y.2d 115, 121 (1993)).
In the instant case, however, plaintiff has failed to allege that any of the named defendants disclosed his personal health information without authorization. While the Complaint alleges that Stalbird released information without authorization, there is no allegation that the named defendants engaged in, directed, or authorized such conduct, and thus plaintiff has failed to allege that the defendants, or anyone acting on behalf of the defendants, disclosed his information without consent. In opposition to the defendants' motion to dismiss, plaintiff, has failed to allege any facts suggesting that Stalbird's conduct could be attributed to any one of the defendants, and thus I find that plaintiff has failed to state a claim for intentional infliction of emotional distress.
III. Statutory Claims
Plaintiff alleges that the defendants improperly disclosed his confidential personal health information in violation of sections 2803-c and 4410 of the New York Public Health Law, and Section 4504 of the New York Civil Practice Law and Rules. For the reasons set forth below, I find that plaintiff has failed to state a cause of action with respect to any of these claims.
A. New York Public Health Law Section 2803-c
N.Y. Public Health Law § 2803-c(2) provides that: "every nursing home and facility providing health related service, as defined in subdivision two and paragraph (b) of subdivision four of section twenty-eight hundred one of this article, shall adopt and make public a statement of the rights and responsibilities of the patients who are receiving care in such facilities, and shall treat such patients in accordance with the provisions of such statement." Among the rights of patients of such facilities is the right to have private health information kept confidential. Section 2801(4)(b) defines a "Health-related service" in relevant part as "service in a facility or facilities which provide or offer lodging, board and physical care . . . ." There is no allegation or evidence that the Guthrie Clinic, Steuben, is a "health-related service" as defined by Section 2801(4)(b), and therefore, there is no showing by the plaintiff that the provisions of N.Y. Public Health Law § 2803-c(2) apply to the Guthrie Clinic, Steuben. Because plaintiff has failed to demonstrate that N.Y. Public Health Law § 2803-c(2) has any applicability in this action, I grant defendants' motion to dismiss this cause of action.
B. New York Public Health Law Section 4410
New York Public Health Law Section 4410 applies to health maintenance organizations, and provides in relevant part that "[u]nless the patient waives the right of confidentiality, a health maintenance organization or its comprehensive health services plan shall not be allowed to disclose any information which was acquired by such organization or plan in the course of the rendering to a patient of professional services by a person authorized to practice medicine, registered professional nursing, licensed practical nursing, or dentistry, and which was necessary to acquire to enable such person to act in that capacity, except as may be otherwise required by law." (emphasis added) Accordingly, it is not clear that § 4410 applies in this case, where the plaintiff was treated at Guthrie Clinic Steuben, which has not been identified as a health maintenance organization or comprehensive health services plan. Nevertheless, even if the defendants were subject to the requirements of § 4410, they may not be held liable to the plaintiff for any breach of that section as New York courts have explicitly held that § 4410 does not give rise to a private cause of action for the unauthorized disclosure of personal health information. Burton v. Matteliano, 81 A.D.3d 1272, 1275 (N.Y.A.D. 4 Dept.,2011)("[T]here is no private cause of action pursuant to Section 4410 of the New York Public Health Law." citing Doe v. Community Health Plan-Kaiser Corp., 268 A.D.2d at 187). Accordingly, because plaintiff has no private cause of action pursuant to § 4410 of the New York Public Health Law, I grant defendants' motion to dismiss this cause of action.
C. New York Civil Practice Law and Rules Section 4504
Section 4504 of the New York State Civil Practice Law and Rules provides in relevant part that "a person authorized to practice medicine, registered professional nursing, licensed practical nursing, dentistry, podiatry or chiropractic shall not be allowed to disclose any information which he acquired in attending a patient in a professional capacity, and which was necessary to enable him to act in that capacity." N.Y. C.P.L.R. § 4504(a). Courts in New York have unanimously held that Section 4504 does not provide a private cause of action to a plaintiff seeking damages for the alleged unauthorized disclosure of confidential health information. Burton, 81 A.D.3d at 1275, citing Doe v. Community Health Plan-Kaiser Corp., 268 A.D.2d at 186-187, (N.Y.A.D. 3 Dept., 2000); Waldron v. Ball Corp., 210 A.D.2d 611, 614, lv. denied 85 N.Y.2d 803). Accordingly, I find that plaintiff has failed to state a cause of action for a violation of § 4504 of the New York Civil Practice Law and Rules, and I therefore grant defendants motion for summary judgment dismissing plaintiff's claim.
CONCLUSION
For the reasons set forth above, the defendants' motion to dismiss is granted, and the plaintiff's Complaint is dismissed.
ALL OF THE ABOVE IS SO ORDERED.
______________
MICHAEL A. TELESCA
United States District Judge
Dated: Rochester, New York
February 17, 2012