NOTICE: This opinion is subject to motions for reargument under V.R.A.P. 40 as well as formal
revision before publication in the Vermont Reports. Readers are requested to notify the Reporter
of Decisions by email at: JUD.Reporter@vermont.gov or by mail at: Vermont Supreme Court, 109
State Street, Montpelier, Vermont 05609-0801, of any errors in order that corrections may be made
before this opinion goes to press.
2019 VT 38
No. 2018-157
Elizabeth Lawson Supreme Court
On Appeal from
v. Superior Court, Washington Unit,
Civil Division
Patricia Halpern-Reiss and December Term, 2018
Central Vermont Medical Center
Mary Miles Teachout, J.
David C. Sleigh and Kyle L. Hatt of Sleigh Law, St. Johnsbury, for Plaintiff-Appellant.
Nicole Andreson and Angela R. Clark of Dinse, Knapp & McAndrew, P.C., Burlington, for
Defendant-Appellee Central Vermont Medical Center.
PRESENT: Reiber, C.J., Skoglund, Robinson and Eaton, JJ., and Howard, Supr. J. (Ret.),
Specially Assigned
¶ 1. EATON, J. In this appeal, we are asked to recognize a common-law private right
of action for damages resulting from the unjustified disclosure to a third party of information
obtained by medical personnel during treatment. Plaintiff alleges in her lawsuit that she incurred
damages as the result of an emergency room nurse informing a police officer that she was
intoxicated, had driven to the hospital, and was intending to drive home. The trial court granted
defendant Central Vermont Medical Center (CVMC) summary judgment based on its
determination that nothing in the record supported an inference that the nurse’s disclosure of the
information was for any reason other than her good-faith concern for plaintiff’s and the public’s
safety. In this opinion, we recognize a common-law private right of action for damages based on
a medical provider’s unjustified disclosure to third persons of information obtained during
treatment. Like the trial court, however, we conclude that CVMC was entitled to judgment as a
matter of law because, viewing the material facts most favorably to plaintiff and applying the
relevant law we adopt today, we conclude that no reasonable factfinder could determine that the
disclosure was for any purpose other than to mitigate the threat of imminent and serious harm to
plaintiff and the public. Accordingly, we affirm the trial court’s judgment.
I. Facts and Procedural History
¶ 2. The following facts are taken from the parties’ statements of undisputed material
facts, viewing them most favorably to plaintiff, the nonmoving party.1 During the early morning
hours of May 10, 2014, plaintiff drove herself to CVMC after lacerating her arm. She arrived at
the emergency room at 2:12 a.m. The charge nurse (Clinical Nurse Coordinator) detected a heavy
odor of alcohol on plaintiff’s breath, and it became apparent to the nurse that plaintiff had been
drinking. Members of the treatment team administered an alco-sensor test to assess plaintiff’s
level of intoxication. The test revealed a breath-alcohol concentration of .215, over two and one-
half times the legal limit, at 2:40 a.m.
¶ 3. Based on information provided by plaintiff, the charge nurse understood that
plaintiff did not have a ride home. After her laceration was treated, plaintiff did not meet the
criteria for admission to the hospital and was cleared for discharge. She was discharged at 3:05
a.m.
1
For the most part, the facts are undisputed. Plaintiff did not directly contest any of
CVMC’s alleged undisputed facts but alleges some facts that vary slightly from those alleged by
CVMC. CVMC disputes only a couple of the facts alleged by plaintiff but also argues that those
facts are not material to the legal issues in this case. None of the disputed facts bear on the outcome
of this decision.
2
¶ 4. A police officer was on duty in the emergency room pursuant to a contract between
CVMC and the Berlin Police Department. Shortly before plaintiff was discharged, the charge
nurse approached the officer and informed him that plaintiff was blatantly intoxicated,2 that she
had driven herself to the hospital, and that she was about to drive herself home. After receiving
this information from the charge nurse and communicating with plaintiff, the officer arrested her
on suspicion of driving while intoxicated. The resulting criminal charge was later dismissed by
the prosecutor.
¶ 5. In July 2016, plaintiff filed a complaint against the charge nurse and CVMC,
alleging that she incurred damages as the result of (1) the nurse’s negligent disclosure of
information obtained during plaintiff’s medical treatment, in violation of the standard of care
applicable to medical providers; and (2) CVMC’s inadequate training and failure to develop
policies regarding the disclosure of information obtained during medical treatment.
¶ 6. In December 2017, following discovery, defendants moved for summary judgment.
Regarding plaintiff’s negligence claim against the charge nurse, defendants argued that this Court
has never recognized a duty enforceable in a tort action not to disclose information obtained during
medical treatment and that, even if such a duty existed, the nurse’s disclosure of information in
this case fully complied with the Health Insurance Portability and Accountability Act of 1996
(HIPAA), see 42 U.S.C. § 1320d-6 (concerning wrongful disclosure of individually identifiable
health information), because it was done to avert an imminent threat to plaintiff’s and the public’s
safety. Defendants further argued that plaintiff could not prevail on her claim against CVMC
because that claim was dependent upon the underlying claim against the charge nurse. In opposing
summary judgment, plaintiff noted that the vast majority of jurisdictions have recognized a private
right of action for damages resulting from the disclosure of information obtained during medical
2
Plaintiff, but not CVMC, used the word “blatantly” in her statement of undisputed facts.
The officer’s affidavit indicates that the nurse told him that plaintiff was “blatantly intoxicated.”
3
treatment. She argued that there were disputed material facts concerning whether the disclosure
of the information in this case was necessary to protect plaintiff or the public.
¶ 7. In May 2018, the trial court granted summary judgment to CVMC.3 After noting
that the patient’s privilege set forth in 12 V.S.A. § 1612 is an evidentiary privilege applicable only
in judicial proceedings, see Kuligoski v. Brattleboro Retreat, 2016 VT 54A, ¶ 60, 203 Vt. 328, 156
A.3d 436, and that plaintiff had failed to identify any Vermont authority in support of a greater
rule of confidentiality than that set forth in HIPAA, the court ruled that the disclosure at issue here
did not violate HIPAA. In so ruling, the court relied on a HIPAA regulation permitting the
disclosure of information based on the presumed good-faith belief that the disclosure was
necessary to prevent a serious and imminent threat to the health or safety of a person or the public.
In the court’s view, there was no record basis for any reasonable inference that plaintiff’s
disclosure to an onsite police officer was for law enforcement purposes or any reason other than a
good-faith concern for plaintiff’s and the public’s safety. Having found no negligence, the court
granted CVMC summary judgment on both counts set forth in plaintiff’s complaint.4
3
In its decision, the court noted that the charge nurse had been dismissed from the case
pursuant to the parties’ stipulation. As the court pointed out, although plaintiff’s first count
alleging negligence against the nurse was presumably dismissed along with the nurse, the
stipulation did not expressly state that that count had been withdrawn. The court surmised that the
parties may have intended to preserve the claim as against CVMC on a respondeat superior theory;
however, the court determined that it did not need to clarify the matter any further because the
nurse’s breach of a duty is a necessary predicate to the negligent supervision claim against CVMC.
When asked at oral argument on appeal about a respondeat superior theory, CVMC’s attorney
acknowledged that the parties’ attorneys had agreed in an unrecorded conversation during the trial
court proceedings that if the nurse were dismissed from the case, CVMC would not take the
position that respondeat superior was inapplicable here.
4
The court also noted, with respect to plaintiff’s second count, that plaintiff had not
provided an expert opinion regarding what policies or training CVMC should have had in place
and that such matters require expert support because they are not within the ordinary knowledge
of laypersons. See Taylor v. Fletcher Allen Health Care, 2012 VT 86, ¶¶ 10, 192 Vt. 418, 60 A.3d
646 (determining that plaintiff’s claims of fault and causation were “sufficiently complex as to be
beyond the scope of common knowledge to a layperson”).
4
II. The Claims of Error
¶ 8. On appeal, plaintiff argues that: (1) the trial court erred in holding that there is no
common law remedy for a health care provider’s breach of a duty of confidentiality; and
(2) assuming there is such a remedy, the court erred in granting CVMC summary judgment insofar
as there are material facts in dispute as to whether the nurse breached the duty of confidentiality
regarding information obtained during the course of medical treatment.
A. Private Right of Action
¶ 9. Plaintiff first argues that this Court should recognize a common-law private remedy
for breach of a medical provider’s duty of confidentiality concerning the disclosure of information
obtained during medical treatment. Plaintiff seeks a common-law remedy because neither
Vermont law nor HIPAA provides a private right of action to obtain damages incurred as the result
of a medical provider’s disclosure of information obtained during treatment. See Warren Pearl
Constr. Corp. v. Guardian Life Ins. Co., 639 F. Supp. 2d 371, 377 (S.D.N.Y. 2009) (collecting
numerous federal court cases recognizing that no private right of action exists under HIPAA);
Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C. (Byrne I), 102 A.3d 32, 41, 45 (Conn.
2014) (noting “the long line of federal and state cases establishing that there is no private right of
action, express or implied, under HIPAA,” which enforces its provisions through administrative
imposition of fines and imprisonment); Bonney v. Stephens Mem’l Hosp., 2011 ME 46, ¶¶ 17, 19,
17 A.3d 123 (noting that all courts addressing issue have concluded that no private right of action
exists under HIPPA, which provides only for administrative enforcement of its provisions).
¶ 10. On the other hand, although HIPAA serves in part to “protect the privacy of
patients’ health information given emerging advances in information technology,” it does not
preempt causes of action arising under state common or statutory law imposing liability for “health
care providers’ breaches of patient confidentiality.” Byrne I, 102 A.3d at 35, 45-48 (citing federal
and state courts holding that HIPAA does not preempt state law imposing liability over and above
5
that authorized by federal law). Indeed, as many courts have recognized, HIPAA may act as a
guidepost or otherwise “inform the relevant standard of care” for state law claims alleging unlawful
disclosure of information obtained during medical treatment. Id. at 46-48, 49 (citing cases and
concluding that “to the extent it has become the common practice for Connecticut health care
providers to follow the procedures required under HIPAA in rendering services to patients, HIPAA
and its implementing regulations may be utilized to inform the standard of care applicable to such
claims arising from allegations of negligence in the disclosure of patients’ medical records
pursuant to a subpoena”).
¶ 11. English common law did not afford patients a cause of action based on an
expectation of privacy in information disclosed during medical treatment, Hammonds v. Aetna
Cas. & Sur. Co., 243 F. Supp. 793, 795 n.1 (N.D. Ohio 1965), but the notion “that physicians
should respect the confidences revealed by their patients in the course of treatment is a concept
that has its genesis in the Hippocratic Oath.” McCormick v. England, 494 S.E.2d 431, 435 (S.C.
1997). By the 1960s and 1970s, several courts had recognized a private right of action for damages
resulting from medical providers’ wrongful disclosure of information obtained during treatment,
and currently the vast majority5 of jurisdictions addressing whether to recognize such a cause of
action have chosen to do so. See Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C. (Byrne
II), 175 A.3d 1, 7, 11-15 (Conn. 2018) (discussing cases and joining clear modern consensus of
courts recognizing private cause of action for damages resulting from unlawful disclosure of
patients’ medical information); McCormick, 494 S.E.2d at 435 (citing majority of jurisdictions
5
Three federal district courts in older decisions declined to recognize such a cause of
action because of the then-current state caselaw in their districts, see Mikel v. Abrams, 541 F.
Supp. 591, 599 (W.D. Mo. 1982); Logan v. Dist. of Columbia, 447 F. Supp. 1328, 1335 (D.D.C.
1978), or because state law did not recognize a confidential relationship between physician and
patient, Collins v. Howard, 156 F. Supp. 322, 324 (S.D. Ga. 1957). The Supreme Court of
Tennessee declined to recognize a cause of action for breach of patient confidentiality because the
state had no common law or statutory privilege for communications between patients and
physicians. Quarles v. Sutherland, 389 S.W.2d 249, 251 (Tenn. 1965).
6
recognizing cause of action based on medical provider’s unauthorized disclosure of information
obtained during treatment); see also J. Zelin, Annotation, Physician’s Tort Liability for
Unauthorized Disclosure of Confidential Information About Patient, 48 A.L.R.4th 668, § 2(a)
(1986) (stating that courts have generally recognized right of patients to recover damages from
physicians for unauthorized disclosure of information obtained during treatment).
¶ 12. In recognizing this common-law private right of action, courts have relied on
various theories, “including invasion of privacy, breach of implied contract, medical malpractice,
and breach of a fiduciary duty or a duty of confidentiality.” McCormick, 494 S.E.2d at 436. The
most commonly accepted theory is breach of the duty of confidentiality, insofar as “health care
providers enjoy a special fiduciary relationship with their patients” such that “recognition of the
privilege is necessary to ensure that the bond remains.” Byrne II, 175 A.3d at 12; see Biddle v.
Warren Gen. Hosp., 715 N.E.2d 518, 523 (Ohio 1999) (citing cases for proposition that “courts
have moved toward the inevitable realization that an action for breach of confidence should stand
in its own right, and increasingly courts have begun to adopt an independent tort in their respective
jurisdictions”); Humphers v. First Interstate Bank of Or., 696 P.2d 527, 534-35 (Or. 1985)
(explaining why breach of duty of confidentiality is correct basis for tort alleging wrongful
disclosure of medical information).
¶ 13. As evidence of sound public policy underlying the recognition of liability for
breach of the duty of confidentiality, courts have cited “(1) state physician licensing statutes,
(2) evidentiary rules and privileged communication statutes which prohibit a physician from
testifying in judicial proceedings; (3) common law principles of trust, and (4) the Hippocratic Oath
and principles of medical ethics which proscribe the revelation of patient confidences.”
McCormick, 494 S.E.2d at 435; accord Byrne II, 175 A.3d at 15; see Hammonds, 243 F. Supp. at
797 (asserting that public policy in support of actionable breach of confidentiality is reflected in
medical profession’s code of ethics, privileged communication statute, and state medical licensing
7
statute). At the core of this reasoning is that when confidentiality between a medical provider and
a patient is diminished in any way, it negatively impacts trustful communication between the two,
which, in turn, degrades the medical provider’s ability to render effective treatment. Bryne II, 175
A.3d at 7; see Alberts v. Devine, 479 N.E.2d 113, 118 (Mass. 1985) (noting self-evident benefits,
including creating environment most favorable for treatment and recovery of patient, of fostering
confidentiality between medical provider and patient); Sorensen v. Barbuto, 2008 UT 8, ¶ 12, 177
P.3d 614 (stating that duty of confidentiality “arises from the understanding that good medical care
requires a patient’s trust and confidence that disclosures to physicians will be used solely for the
patient’s welfare and that a patient’s privacy with regard to those disclosures will be respected and
protected”).
¶ 14. For the same public policy reasons, we join the consensus of jurisdictions
recognizing a common-law private right of action for damages arising from a medical provider’s
unauthorized disclosure of information obtained during treatment. We do not do so lightly. See
Hay v. Med. Ctr. Hosp. of Vt., 145 Vt. 533, 539-40, 496 A.2d 939, 943 (1985) (acknowledging
that caution must be taken in recognizing new cause of action but nonetheless recognizing cause
of action for minor child’s loss of parental consortium “to see justice made available within our
legal system, which is of paramount importance”). As we have stated on multiple occasions, “[w]e
will not recognize a new cause of action or enlarge an existing one without first determining
whether there is a compelling public policy reason for the change.” Knight v. Rower, 170 Vt. 96,
107, 742 A.2d 1237, 1245 (1999) (quotation omitted) (declining to extend social host liability in
Vermont). In this instance, however, public recognition and endorsement of a duty of
confidentiality between medical providers and their patients is already evidenced in our law;
therefore, providing a common-law remedy for a medical provider’s breach of that duty upholds
the expectations of the providers, their patients, and the general public. See Byrne II, 175 A.3d at
20-21 (Robinson, J, concurring) (emphasizing “continuing reticence to recognize new [common-
8
law] causes of action” because it is normally duty of legislature and not court to make law, but
acknowledging that providing common-law remedy for medical provider’s breach of duty of
confidentiality is “an appropriate exercise of our common-law authority to recognize new causes
of action”).
¶ 15. Many of this State’s laws underscore Vermont’s policy of protecting patient
confidentiality by prohibiting the disclosure of patient information. Under Vermont law, hospital
patients have “the right to expect that all communications and records pertaining to [their] care
shall be treated as confidential.” 18 V.S.A. § 1852(a)(7). Failure to comply with this provision
may result in disciplinary action against a physician. Id. § 1852(b). Although only applicable in
the context of a judicial proceeding, Kuligoski, 2016 VT 54A, ¶ 60, Vermont has established by
statute and rule a patient’s privilege against a medical provider’s disclosure of information
obtained in attending the patient, with some exceptions. 12 V.S.A § 1612; V.R.E. 503.
¶ 16. On the other hand, and equally as important, various Vermont statutes compel
medical providers to disclose certain information to protect the public. See, e.g., 13 V.S.A.
§ 3504(a)(3) (providing immunity from civil suit for health care provider making good-faith report
of disease associated with weapons of mass destruction); id. 4012(a) (requiring physician treating
gunshot wound to report case to law enforcement); 18 V.S.A. §§ 1001, 1004, 1007, 1041, 1092-
1093 (requiring medical providers to report information concerning patients diagnosed with or
suspected of having communicable diseases dangerous to public health); 23 V.S.A. § 1203b(a)
(requiring medical provider who is treating person in emergency room as result of motor vehicle
accident to report to law enforcement blood-test result exceeding legal limit, notwithstanding any
law or rule to contrary). By requiring disclosure under certain circumstances and in some cases
providing immunity for the disclosure, statutes such as these implicitly acknowledge that medical
providers have a general duty of confidentiality and that a violation of that duty may subject them
to liability. McCormick, 494 S.E.2d at 439; Brandt v. Med. Def. Assocs., 856 S.W.2d 667, 670
9
(Mo. 1993) (stating that statutes providing exceptions to medical providers’ duty of confidentiality
“implicitly acknowledge that, in absence of such an exemption, there would be a breach of this
duty”).
¶ 17. The most recent and explicit example of the Legislature’s recognition of medical
providers’ duty of confidentiality is its enactment of a law prohibiting the disclosure of “protected
health information” by a “covered entity,” as the terms are defined by federal regulations, “unless
the disclosure is permitted under” HIPAA. 18 V.S.A. § 1881. At the same time, the Legislature
abrogated this Court’s decision in Kuligoski, which had expanded mental health providers’ duty
to warn of a patient’s dangerous propensities, and instead “limit[ed] mental health professional’s
duty to that as established in common law by Peck v. Counseling Service of Addison County, Inc.,
146 Vt. 61 (1985).” 18 V.S.A. § 1882(a). Although these statutes had an effective date of October
1, 2016, see 2015, No. 169 (Adj. Sess.), §§ 1-2, and thus do not directly govern this case, they
further evince the longstanding legislative policy of protecting patient confidentiality.6
6
The fact that 18 V.S.A. § 1881 does not explicitly provide for a private right of action
does not necessarily demonstrate that the Legislature intended to foreclose such a remedy. See
Wear v. Walker, 800 S.W.2d 99, 103 (Mo. Ct. App. 1990) (“Where a statute creates a right, but is
silent as to the remedy, the party entitled to the right may resort to any common law action which
would afford [that party] adequate and appropriate means of redress.”). “Restatement (Second) of
Torts § 874A provides a framework for determining whether a private action for damages is
available to remedy the violation of a statute that does not expressly include a civil remedy.”
Montague v. Hundred Acre Homestead, LLC, 2019 VT 16, ¶ 23, ___ Vt. ___, ___ A.3d ___.
Under § 874A, when a statute protects a class of persons by prohibiting certain conduct but does
not explicitly provide a civil remedy, a court may afford a remedy to a person protected by the
statute—either under an existing tort or by recognizing a new cause of action—as long as the
remedy furthers the purpose of the statute and is needed to assure the effectiveness of the statute.
See Restatement (Second) of Torts 874A cmt. i (1979) (stating that plaintiff must be member of
protected group and must show that “the interest invaded, the harm resulting to that interest and
the hazard producing the harm were all within the purview of the legislative provision”). The
Restatement identifies the following six factors for consideration, with the primary test being
whether a private tort remedy would be consistent with and promote the effectiveness of the policy
underlying the statute: the specificity of the statute, the adequacy of existing remedies, the extent
to which a tort action would supplement or interfere with other existing remedies, the significance
of the legislative purpose, the extent of the change in tort law, the burden that the new tort would
create on the judicial system, and whether plaintiffs would be able to show that they are in a
protected class. Id. § 874A cmt. h. Although we reiterate that 18 V.S.A. § 1881 is not directly
10
¶ 18. Nevertheless, courts addressing the duty of patient confidentiality have recognized
the need for practical limitations on prohibiting medical providers from disclosing information
obtained during treatment—beyond what they are required to disclose by statute. See McCormick,
494 S.E.2d at 438 (noting that jurisdictions recognizing cause of action for breach of duty of patient
confidentiality “do not hold that this duty is absolute”); cf. Peck v. Counseling Serv. of Addison
Cty., Inc., 146 Vt. 61, 67, 499 A.2d 422, 426 (1985) (noting “that the [patient] privilege is not
sacrosanct and can properly be waived in the interest of public policy under appropriate
circumstances,” such as when patient threatens harm to identified victim). As recognized in
HIPAA, § 1881, and many other Vermont laws, including those cited above, under certain
circumstances information obtained during medical treatment either may or must be disclosed to
protect the interests or safety of the patient or others. The right to disclose such information “is
not necessarily coextensive with a duty to disclose.” Biddle, 715 N.E.2d at 524; Humphers, 696
P.2d at 535 (“Even without such a legal obligation, there may be a privilege to disclose information
for the safety of individuals or important to the public in matters of public interest.”).
¶ 19. In § 1881, the Legislature has indicated a policy preference of essentially codifying
into state law the requirements of HIPAA. See 18 V.S.A. § 1881(b) (stating that covered entity
may not disclose protected health information unless disclosure is permitted under HIPAA). Given
the Legislature’s reliance on HIPAA, and medical care providers’ familiarity with the law, we
conclude that the federal statute and its implementing regulations should inform the standard of
care and establish the framework for exceptions to medical care providers’ duty of confidentiality.
applicable in this case, we see nothing in these tests or factors that would caution us against
recognizing a common-law private right of action for breach of the duty of patient confidentiality,
given the absence of an express remedy in § 1881. Indeed, the common-law private remedy we
recognize today furthers the purposes of § 1881 and is also consistent with and complimentary to
HIPAA, upon which § 1881 relies. See Byrne II, 175 A.3d at 11 (stating that common-law private
cause of action would not conflict with or complicate compliance with HIPAA, especially given
medical providers’ familiarity with HIPAA).
11
Byrne I, 102 A.3d at 49 (concluding that because health care providers are familiar with HIPAA
procedures in rendering care to patients, HIPAA and its implementing regulations may be used to
inform standard of care applicable to tort claims arising from allegations of negligent disclosure
of patients’ medical records). Although we ultimately uphold the trial court’s grant of summary
judgment in favor of CVMC in this case, we adopt a widely recognized common-law private right
of action, using the HIPAA framework as a guide, rather than speculate as to whether or what right
of action we would adopt in considering whether defendant is entitled to summary judgment.
B. Summary Judgment Ruling
¶ 20. Plaintiff argues that the trial court erred in granting CVMC summary judgment
because there are disputed material facts as to whether the information provided to the onsite police
officer was legally compelled or necessary to prevent imminent danger to plaintiff or the public.
CVMC responds that plaintiff fails to identify specific material facts in dispute and that the
evidence demonstrates the nurse’s good-faith belief that the information she provided to the officer
was necessary to protect plaintiff and the public. CVMC posits that the hospital may well have
been liable for any resulting damages had the nurse not provided the information to the officer and
had plaintiff driven from the hospital and injured herself or others.
¶ 21. “We review summary judgment de novo, using the same standard as the trial court:
summary judgment is appropriate if the moving party shows that the material facts are not
genuinely disputed and that he or she is entitled to judgment as a matter of law.” Gross v. Turner,
2018 VT 80, ¶ 8, ___ Vt. ___, 195 A.3d 654 (citing V.R.C.P. 56(a)). “In determining whether a
genuine dispute of material fact exists, the nonmoving party is entitled to the benefit of all
reasonable doubts and inferences.” Id. (quotation omitted). “Once a claim is challenged by a
properly supported motion for summary judgment, the nonmoving party may not rest upon the
allegations in the pleadings but must come forward with admissible evidence to raise a dispute
regarding the facts.” Id.
12
¶ 22. In this case, relying on a regulatory HIPAA exception for good-faith disclosures to
prevent serious and imminent threats to the safety of the public, the trial court granted summary
judgment to CVMC based on its determination the record did not contain “any reasonable
inference that [the charge nurse’s] disclosure to the onsite police officer was for law enforcement
purposes or any other reason than out of a good-faith concern for [plaintiff’s] and the traveling
public’s safety.” Plaintiff argues here, as she did before the trial court, that there are material facts
in dispute that compel the denial of CVMC’s motion for summary judgment, but she does not state
what those facts are. A vague allegation that facts are contested, without more, is insufficient to
withstand summary judgment. See Baldwin v. Upper Valley Servs., Inc., 162 Vt. 51, 55, 644 A.2d
316, 318 (1994) (“Opposing allegations must have sufficient support in specific facts to create a
genuine issue of material fact.”).
¶ 23. Both the trial court and the parties focused on the HIPAA regulation permitting
“disclosures to avert a serious threat to health or safety.” 45 C.F.R. § 164.512(j). In relevant part,
the regulation permits a “covered entity” to disclose “protected health information” as long as two
conditions are met: the covered entity has a good-faith belief that the disclosure is “necessary to
prevent or lessen a serious and imminent threat to the health or safety of a person or the public,”
and the disclosure is “to a person or persons reasonably able to prevent or lessen the threat,
including the target of the threat.” Id. § 164.512(j)(1)(i). The regulation further provides that a
covered entity disclosing information pursuant to this exception is “presumed to have acted in
good faith with regard to a belief described in” the exception. Id. § 164.512(j)(4).
¶ 24. We conclude that this exception, including its good-faith component, provides an
appropriate limit to obtaining damages for the disclosure of information obtained during medical
treatment. While we recognize that due care must “be exercised in order to insure that only that
information which is necessary to protect the potential victim is revealed,” Peck, 146 Vt. at 68,
499 A.2d at 427, we must be cautious in requiring medical providers, particularly in emergency
13
situations such as this, to parse too finely what information can or cannot be disclosed to protect
individuals or the public in general from an imminent and serious threat of harm.
¶ 25. CVMC does not contest that it is a covered entity and that the information provided
to the onsite police officer was protected health information. Nor does plaintiff contest that,
assuming there was a threat justifying disclosure of the information, the police officer was a person
reasonably able to prevent the threat. The point of contention is whether the record demonstrates,
as a matter of law, that the nurse had a good-faith belief that all the information provided to the
officer was necessary to prevent a serious and imminent threat to the health or safety of plaintiff
or the general public.
¶ 26. In answering this question, we first reexamine what the nurse told the officer. As
stated above, the nurse indicated that plaintiff was blatantly intoxicated, that she had driven herself
to the hospital, and that she was about to drive herself home. Given the record before us, if the
nurse had told the officer only that plaintiff was blatantly intoxicated and was about to drive herself
home, CVMC would surely be entitled to summary judgment. But we must also consider that the
nurse also told the officer that the blatantly intoxicated plaintiff had driven herself to the hospital,
thereby suggesting that plaintiff had committed a crime. In considering this particular statement,
we recognize that the disclosure exception in § 164.512(j)(1)(i) is directed at preventing future
conduct, in the sense that it allows disclosures based on a good-faith belief that doing so is
necessary to prevent the threat of imminent and serious harm.7
7
That is in contrast to the exception in § 164.512(j)(1)(ii), which allows, in most instances,
see id. § 164.512(j)(2), the disclosure of limited types of information, see id. § 164.512(j)(3), when
there is a good-faith belief that the disclosure is necessary for law enforcement to identify or
apprehend someone either because that person has escaped from custody or because an individual
has admitted to participating “in a violent crime that the covered entity reasonably believes may
have caused serious physical harm to the victim.” (Emphasis added.) HIPAA regulations also
contain a permitted disclosure exception for law-enforcement purposes, but that exception has
several conditions, including that the disclosure is in compliance with legal process or required by
law and that it constitutes evidence of a crime that occurred on the premises of the covered entity.
See id. § 164.512(f).
14
¶ 27. The critical question, then, is whether, as a matter of law, and based on the evidence
viewed most favorably to plaintiff, the nurse had a good-faith belief that telling the officer the
intoxicated plaintiff had driven herself to the hospital was necessary to prevent the imminent and
serious threat of her driving in an intoxicated state away from the hospital. In answering this
question, we consider the meaning of the term “good faith” in this context, as well as the record
evidence in light of that meaning.
¶ 28. “Good faith” is undefined in the HIPPA regulations that we rely on in establishing
the scope of, and exceptions to, the duty we are recognizing today. Although the term “good faith”
is ubiquitous in the law, “its meaning varies somewhat with the context.” Restatement (Second)
of Contracts § 205 cmt. a (1979); see Good Faith, Black’s Law Dictionary (10th ed. 2014) (quoting
description of good faith in R. Brownsword et al., Good Faith in Contract in Good Faith in
Contract: Concept and Context, 1, 3 (1999), as “ ‘an elusive idea, taking on different meanings
and emphases as we move from one context to another’ ”).
¶ 29. In connection with the qualified immunity defense, Vermont has adopted the
federal objective “good faith” test whereby we evaluate the objective reasonableness of the
official’s conduct in relation to settled, clearly established law. See Cook v. Nelson, 167 Vt. 505,
509-10, 712 A.2d 382, 384 (1998). Under this objective test, acts committed without any ill intent
may be excluded from the protections of qualified immunity. Id. Similarly, under the Uniform
Common Interest Ownership Act, we have explained that “good faith” means “in a commercially
reasonable manner.” Will v. Mill Condo. Owners’ Ass’n, 2004 VT 22, ¶ 15, 176 Vt. 380, 848
A.2d 336. This too is an objective definition that does not require us to divine the subjective intent
of the actor.
15
¶ 30. In other contexts, “good faith” is primarily a subjective concept relating to the
intentions of the actor rather than the reasonableness of the acts. 8 For example, in discussing the
factors relevant to a civil claim of conversion, this Court discussed the actor’s “good faith” and
“intent” interchangeably. Montgomery v. Devoid, 2006 VT 127, ¶ 16, 181 Vt. 154, 915 A.2d 270;
see Carter v. Gugliuzzi, 168 Vt. 48, 58, 716 A.2 17, 24-25 (1998) (equating “lack of intent to
deceive” and “good faith”).
¶ 31. Notably, numerous courts have applied a subjective good-faith standard with
respect to statutes providing immunity from civil or criminal liability for persons disclosing
medical information in good faith while reporting or aiding in the investigation of child abuse.
Nelson v. Lindaman, 867 N.W.2d 1, 8, 12-13 (Iowa 2015) (applying subjective standard under
Iowa statute and citing other jurisdictions that have done so in construing similar statutes). The
subjective standard is adopted in that context in part because good faith “rests on a defendant’s
subjective honest belief that the defendant is aiding and assisting in the investigation of a child
abuse report.” Garvis v. Scholten, 492 N.W.2d 402, 404 (Iowa 1992) (reasoning that statute was
intended “to encourage those having information about child abuse to come forward when asked
8
In yet other circumstances, “good faith” may encompass both subjective and objective
elements. See, e.g., Lauzon v. State Farm Mut. Auto. Ins. Co., 164 Vt. 620, 621, 674 A.2d 1246,
1247 (1995) (mem.) (explaining that in context of complaints for bad faith handling of insurance
claims plaintiff must show both that insurance company had no reasonable basis to deny coverage
under policy and that company knew or recklessly disregarded fact that no reasonable basis existed
for denying claim); see also Trepanier v. Getting Organized, Inc., 155 Vt. 259, 269-70, 583 A.2d
583, 590 (1990) (“We need not decide at this point whether we will determine the presence of
good faith on a subjective or objective standard or a combination of both. It is sufficient to say
that a contracting party who acts in complete disregard of the honest advice it is contractually
obligated to give merely to further its own interests can be found to lack good faith.”). The
definitions of “good faith” in Black’s Law Dictionary encompass both subjective and objective
elements. See Good faith, Black’s Law Dictionary (“A state of mind consisting in (1) honesty in
belief or purpose, (2) faithfulness to one’s duty or obligation, (3) observance of reasonable
commercial standards of fair dealing in a given trade or business, or (4) absence of intent to defraud
or to seek unconscionable advantage.”).
16
to do so, without the fear of litigation should it later be shown that the information was improperly
released”).
¶ 32. Because we have adopted the standards in HIPAA as framing the contours and
limits of a cause of action for breach of the duty not to disclose protected health information, to
answer the pivotal question in this case we must determine how “good faith” is defined for
purposes of § 164.512(j)(1), (4)—and, in particular, whether to apply a subjective or objective test.
For the following reasons, we conclude that the applicable test in this case is a subjective one.
That is, whether the nurse’s motivation for disclosing the protected health care information was
based solely on her belief that the disclosure was necessary to protect or lessen a serious and
imminent threat to health or safety, or whether the nurse sought to satisfy some other purpose,
even a well-intentioned one, apart from this narrow legal exception to her general duty of
nondislcosure.
¶ 33. First, the HIPAA regulation that frames our analysis specifically hinges on the
actor’s good faith in connection with the actor’s actual beliefs, rather than on whether the actor
acted in a manner that is objectively in good faith. See 45 C.F.R. § 164.512(j)(1) (“A covered
entity may, consistent with applicable law and standards of ethical conduct, use or disclose
protected health information, if the covered entity, in good faith, believes the use or
disclosure . . . [i]s necessary to prevent or lessen a serious and imminent threat to the health and
safety of a person or the public . . . .”).9 This wording suggests a subjective understanding of
“good faith” focused on the actor’s intentions and beliefs.
¶ 34. Second, the regulation’s basis for a presumption of good faith supports the view
that the standard of good faith in this circumstance is subjective. In particular, § 164.512(j)(4)
provides that “a covered entity that uses or discloses protected health information pursuant to
9
Because plaintiff did not rely on specific applicable standards of ethical conduct, we do
not address whether and how such standards impact the scope of § 164.512(j)(1)(i).
17
paragraph (j)(1) of this section is presumed to have acted in good faith with regard to a belief
described in paragraph (j)(1) . . . if the belief is based on the covered entity’s actual knowledge or
in reliance on a credible representation by a person with apparent knowledge or authority.” The
focus of this presumption is on the subjective knowledge underlying the belief.
¶ 35. Finally, by its terms, this exception will normally apply in emergency situations
involving serious safety concerns when medical providers must make quick decisions about what
information is necessary to prevent the imminent risk of harm. As noted above, we are reluctant
to impose the specter of liability for misjudgment on a health care provider weighing whether to
make a discretionary disclosure to prevent imminent and serious harm to public health and safety.
¶ 36. Applying the subjective standard, we conclude that plaintiff has not met her burden
of production to rebut the applicable presumption of good faith. Through case law and Vermont
Rule of Evidence 301, we have adopted a bursting-bubble theory of presumptions in civil cases,
unless otherwise provided by law. Chittenden v. Waterbury Ctr. Cmty. Church, Inc., 168 Vt. 478,
492, 726 A.2d 20, 29 (1998). Under that theory, “ ‘a presumption shifts only the burden of
production, losing its mandatory effect as soon as evidence sufficient to support a finding of the
nonexistence of the presumed fact is introduced.’ ” Id. (quoting Reporter’s Notes to V.R.E. 301).
We see no policy reason to depart from that theory here.
¶ 37. Thus, CVMC bears the ultimate burden of persuasion as to the applicability of the
good-faith exception to the general rule prohibiting health care providers from disclosing protected
health information. But the presumption of good faith in HIPAA, § 64.512(j)(4), which we adopt
for purposes of analyzing the common-law tort we recognize in this decision, shifts the burden to
plaintiff to make some showing that the nurse’s disclosure that plaintiff had driven to the hospital
and was blatantly intoxicated was not made in good faith.
¶ 38. Although the burden of production is not a heavy one, plaintiff did not meet hers in
this case. Nothing in the record suggests that the nurse supplied the information to the officer for
18
any reason other than her good-faith belief that the information was necessary to prevent plaintiff
from driving drunk from the hospital and endangering herself and the public. Plaintiff made no
proffer suggesting that the nurse hoped inclusion of the arguably superfluous information about
how plaintiff got to the hospital would lead to plaintiff’s censure, arrest, or prosecution or that she
had any ulterior motive beyond the permitted one.10 Nor did she challenge defendants’ statement
of undisputed fact, the nurse’s affidavit, or the nurse’s deposition testimony indicating that the
nurse provided the information to the officer solely in the hope that he would give plaintiff a ride
home. Thus, the record unequivocally shows that plaintiff’s intent in disclosing all of the
information provided to the officer was consistent with the exception set forth in § 164.512(j)(1)(i).
¶ 39. In light of the presumption of good faith, which was bolstered by the record,
plaintiff had the burden of proffering some facts or information indicating that the nurse had other
motives. She did not do so. Accordingly, CVMC was entitled to summary judgment.11 See Zullo
v. State, 2019 VT 1, ¶ 56, ___ Vt. ___, ___ A.3d ___ (emphasizing “that although subjective
motivation may often have to be resolved by the factfinder, a plaintiff cannot withstand summary
judgment without producing colorable facts upon which a reasonable jury could find bad faith”);
cf. Nelson, 867 N.W.2d at 11 (“Courts applying equivalent subjective good-faith immunity statutes
have not hesitated to grant or affirm summary judgment when there is no evidence the defendant
was dishonest in reporting to the child abuse investigator.”); Garvis, 492 N.W.2d at 404 (affirming
trial court’s grant of summary judgment where “the defendants’ subjective good faith in aiding
10
It is not necessary for us to resolve whether the disclosure of the prior driving while
intoxicated that evening went beyond the permissible bounds of disclosure. Even assuming it did,
plaintiff has not overcome the presumption of good faith.
11
We do not rule out the possibility that a disclosure may be so unreasonable with
reference to the scope of the exception in § 164.512(j)(1)(i) that the disclosure alone is sufficient
to rebut the presumption that the disclosure was made in subjective good faith. That is not the
case here.
19
and assisting the [child abuse] investigation [by disclosing plaintiffs’ medical information] went
unchallenged”).
Affirmed.
FOR THE COURT:
Associate Justice
20