Plaintiff appeals from a judgment dismissing with prejudice her complaint for intentional or negligent spoliation of evidence. The trial court entered the judgment after granting defendant’s motion to dismiss plaintiff’s complaint under ORCP 21 A(8) for failure to state facts sufficient to constitute a claim for relief and denying plaintiff’s motion to amend her complaint to add a claim for negligent infliction of emotional distress. We affirm the dismissal of the original complaint but nevertheless reverse and remand because we conclude that the trial court improperly exercised its discretion by refusing to permit plaintiff to amend her complaint.
In her complaint, plaintiff alleged that she was referred by her physician to defendant for testing and monitoring to determine whether she had a sleep disorder. She scheduled an overnight video-recorded and monitored study at defendant’s Gresham facility, and she appeared at the scheduled date and time in April 2008. One of defendant’s employees advised plaintiff to take her regular sleep medication before commencing the study, and she did so. During the night, plaintiff awoke to find that her bra had been unclasped, her breasts were exposed, and one of defendant’s employees was standing over her and staring at her. Plaintiff later told several other employees or agents of defendant what had occurred, and she made repeated verbal and written requests for a copy of the recording of the sleep study, beginning on the morning after the study. In May 2010, more than two years after the sleep study, plaintiff received a letter from defendant advising her that the recording of her study had not been retained and that defendant was unable to produce a copy.
Plaintiff filed this action in October 2010. In her complaint, plaintiff alleged that, as a result of defendant’s intentional or negligent spoliation of the videotape evidence, the value of her claims against defendant for sexual battery, abuse of a vulnerable person, and intentional infliction of emotional distress, had been diminished.
Defendant moved pursuant to ORCP 21 A(8) to dismiss plaintiff’s complaint on the grounds that plaintiff *219had failed to allege ultimate facts to constitute a claim for relief because Oregon does not recognize claims for the intentional or negligent spoliation of evidence and, even if it did, plaintiff would have no legally cognizable claim because the underlying tort claims to which the evidence applied were never brought and were time barred when plaintiff filed her complaint. Defendant further argued that the economic-loss doctrine foreclosed plaintiff’s claim because there was no special relationship between plaintiff and defendant, and additionally, that plaintiff was not a “vulnerable person” within the meaning of ORS 124.100.
Plaintiff opposed defendant’s ORCP 21 motion, asserting that Oregon law supported at least negligence-based claims for the destruction of evidence, and that defendant’s negligence in failing to produce the recording of her sleep study had foreclosed her ability to bring her underlying claims against defendant. Plaintiff further argued that those claims were not time barred because defendant could not rely on a statute of limitations defense where its own actions had prevented plaintiff from bringing her underlying claims. Finally, plaintiff countered that, even if the sexual battery and intentional infliction of emotional distress claims were time barred when she filed this action for spoliation, the claim for abuse of a vulnerable person under ORS 124.100 was not time-barred because plaintiff was within the class of persons protected by that statute as she had been “incapacitated” during the sleep study, and, therefore, the seven-year statute of limitations for her claim had not expired. At the hearing on defendant’s motion to dismiss, plaintiff orally sought leave to replead, as below.
After the hearing, the trial court granted defendant’s motion without leave to amend or replead. The court explained its decision in a written opinion:
“Plaintiff asserted a claim for intentional and negligent spoliation of evidence, alleging that [d]efendant destroyed video evidence of a sleep study requested by her physician. I find that Oregon law does not recognize an independent tort of spoliation under the circumstances of this case. For that reason, I am granting [d]efendant’s motion to dismiss.
“That leaves the question of whether plaintiff should be allowed leave to amend to allege a negligence claim, similar *220to the one alleged in Simpkins v. Connor, 210 Or App 224[, 150 P3d 417] (2006). In order to determine whether such an amendment should be allowed, two issues need to be addressed: first, whether a Simpkins-type claim still exists under Oregon law, and second, whether plaintiff is able to adequately allege causation.
“In order to pursue a claim for purely economic loss on a negligence theory, a plaintiff must allege the existence of a special relationship or a duty found in Oregon law. Plaintiff relies on a duty [she] believes exists under Oregon statute. In Simpkins, the Court of Appeals held that plaintiff was entitled to seek economic loss for the negligent failure to produce medical records because of the duty found in ORS 192.525, which read: ‘a health care provider must disclose a patient’s medical records.’ The court found that the legislature imposed this duty precisely for the purpose of addressing personal injury claims such as the one at issue in that case.
“The statute addressed in Simpkins, ORS 192.525, was repealed in 2003, and replaced with the statute relied upon by Plaintiff in this case, ORS 192.518(l)(b), which says that ‘an individual has * * * [t]he right to access and review protected health information of the individual.’ Plaintiff says that [defendant breached this duty by failing to preserve medical records that she could have used in pursuing a claim against [defendant.
“Defendant argues that the repeal of ORS 192.525 evidences a legislative intent to the duty discussed in Simpkins. Plaintiff argues that the language in ORS 192.518(l)(b) shows an intent to maintain that duty. Both the language of the statutes and the legislative history [are] less than enlightening in this regard, but on the whole, support! ] [plaintiff’s position. Therefore, in theory, I believe a plaintiff can still allege the type of negligence theory alleged in Simpkins, despite the repeal of ORS 192.525.
“I say ‘in theory’ because in this case [p]laintiff needs to surmount at least one more hurdle in order to be able to plead such a claim, namely, causation. Plaintiff argues that [d]efendant’s conduct in allegedly destroying critical evidence caused her underlying claims to have a diminished value. However, the underlying claims are time-barred, and therefore, there is no value that can be diminished. In other words, [p]laintiff cannot establish that [defendant’s *221conduct caused her loss because the claims were time-barred.
“Plaintiff further argues that the statute of limitations did not run on one of her possible theories, a statutory vulnerable person claim under ORS 124.100, et seq., because the limitations period is seven years. ORS 124.130. Plaintiff is not a vulnerable person within the meaning of that Act, and therefore, [p]laintiff cannot gain the benefit of its longer statute of limitations.”
Plaintiff appeals from the ensuing general judgment that dismissed her complaint with prejudice. On appeal, the parties reprise the multi-tiered arguments and counterarguments that they advanced before the trial court. Rather than address those arguments seriatim, we discuss only those issues that are necessary to explain our decision.
Whether plaintiff has a legally cognizable claim under the facts pleaded is an issue of law. SFG Income Fund, LP v. May, 189 Or App 269, 272, 75 P3d 470 (2003). In determining the sufficiency of a complaint, we accept as true all well-pleaded allegations in the complaint and give plaintiff the benefit of all favorable inferences that may be drawn from the facts alleged. Granewich v. Harding, 329 Or 47, 51, 985 P2d 788 (1999).
The parties vehemently dispute whether, or to what extent, a claim for spoliation of evidence is cognizable under Oregon law. Compare Boden v. Ford Motor Co., 86 Or App 465, 739 P2d 1067 (1987) (reversing ORCP 21 A(8) dismissal of claim for economic damages, for diminished value of product liability claim, resulting from third party’s negligent destruction spoliation of allegedly defective part; concluding that such a claim was cognizable under the foreseeability principles of Fazzolari v. Portland School Hist. No. 1J, 303 Or 1, 734 P2d 1326 (1987)), with Simpkins v. Connor, 210 Or App 224, 150 P3d 417 (2006) (disavowing Boderis foreseeability-based analysis as a basis for recovery of purely economic damages but reversing ORCP 21 A(8) dismissal of the plaintiff’s claim that, because of the defendant’s negligence in failing to timely produce certain medical records, violating a statutory duty prescribed under former ORS 192.525(2), the plaintiff was deprived of the *222ability to pursue a medical malpractice or wrongful death claim against the defendant).
We need not, and do not, address the precise contours of a cognizable claim for spoliation under Oregon law because, by all accounts, plaintiff has not alleged sufficient facts to constitute such a claim. The jurisdictions that recognize an independent claim for spoliation of evidence require the plaintiff to have first brought the underlying claim and lost or suffered diminution in its value. See, e.g., Kent v. Costruzione AeronauticheGiovanni Agusta, S.P.A., 1990 WL 139414 (ED Pa 1990) (“Not until there is a disposition with respect to the underlying civil action can it be determined whether the destruction of evidence has prejudiced plaintiff.”); Fox v. Cohen, 84 Ill App 3d 744, 751, 406 NE2d 178 (1980) (holding that cause of action for negligent spoliation of evidence is premature until plaintiff actually loses her medical malpractice action due to lost EKG because damages are otherwise “purely speculative and uncertain”); Federated Mut. v. Litchfield Prec. Co., 456 NW2d 434 (Minn 1990) (resolution of a plaintiff’s underlying claim is necessary to demonstrate cognizable injury for purposes of a spoliation action, should such a tort be recognized).
Similarly, Oregon law generally does not permit a party to recover where the causal nexus between the defendant’s conduct and the plaintiff’s injury is speculative or uncertain. See, e.g., Parker v. Pettit, 171 Or 481, 490, 138 P2d 592 (1943) (“No recovery can be had where resort must be had to speculation or conjecture for the purpose of determining whether the damages resulted from the act of which complaint is made or from some other cause.”); Newell v. Weston, 150 Or App 562, 582, 946 P2d 691 (1997), rev den, 327 Or 317 (1998) (Existence and amount of damages must be established with “reasonable certainty,” and, “ [i] f the trier of fact must resort to speculation, conjecture or surmise, a claim of damages will fail.”).
As those principles are pertinent here, no trier of fact reasonably could determine the cause of any alleged damages that plaintiff suffered. Thus, the trial court properly granted defendant’s motion to dismiss on the ground that plaintiff could not establish causation because she did not *223allege that she had filed an action on any of the underlying claims.
Plaintiff urges that she is entitled to assert a claim for diminution of value in a claim for abuse of a vulnerable person, because, she asserts, such a claim would be timely if filed now. Instead of filing such a claim, plaintiff argues that she may simply bring a claim for diminution of its value based on the loss of evidence. We disagree. Assuming without deciding that plaintiff qualifies as a “vulnerable person” under ORS 124.100, there is no support for such a proposition in Oregon law, nor does there appear to be support for it. Again, among the jurisdictions recognizing an independent tort of spoliation, none has permitted a plaintiff to bring such a claim after the statute of limitations on her underlying claims has expired or if she still could file them but has eschewed that opportunity. As a result, plaintiff cannot establish that defendant’s failure to preserve the evidence caused her any damage. See, e.g. Baugher v. Gates Rubber Co., 863 SW2d 905 (Mo App 1993) (holding that plaintiff’s spoliation claim, to the extent Missouri would recognize such a claim, was premature because plaintiff could not establish any harm due to the fact that plaintiff had not lost the underlying lawsuit); Bondu v. Gurvich, 473 So 2d 1307 (Fla App 1984) (same). In short, there is no support for the proposition that a claim for spoliation can arise where, as here, plaintiff never filed an action on her underlying claims and such claims either are time barred or, as postulated by plaintiff, still could be filed.
Our decisions in Boden and Simpkins do not counsel a different result.
“In Boden, we determined that a storage facility that lost a crucial piece of evidence could be liable for the impaired value of the lawsuit. The trial court had dismissed the claim, based on the defendant’s argument that it did not have a duty to preserve the evidence. After the case had been argued and submitted, the Supreme Court announced its decision in Fazzolari. Citing that decision, we concluded that the plaintiff’s complaint stated a claim for relief in negligence because ‘a reasonable jury could [have found] it foreseeable that losing a piece of evidence would diminish the value of the lawsuit.’ It appears that we simply concluded that the trial court had applied the wrong negligence *224principles; we did not consider the economic loss rule set forth in Fazzolari and later cases or, therefore, whether any duty arose under the circumstances of Boden on which an action for economic loss could be predicated.”
Simpkins, 210 Or App at 229 (citations omitted). Boden does not stand for the proposition that a plaintiff may bring claims for spoliation after the statute of limitations on the underlying claims has expired or one or more of the underlying claims remain actionable.
In Simpkins, after the plaintiff’s husband died of a heart attack, she sued four defendants she knew had been involved in his care. Id. at 226. She requested records from Willamette Falls Hospital, but the hospital failed to produce the records until after the expiration of the statute of limitations for medical negligence had run against one of its physicians whose potential negligence was revealed in the belatedly produced records. Id. at 227. Consequently, the plaintiff amended her existing complaint to add the hospital as a fifth defendant, alleging that the hospital was liable for her lost ability to make a medical negligence claim against the physician and the hospital. Id.
The hospital moved for judgment on the pleadings, arguing that (1) Oregon law does not recognize a claim for negligent failure to produce records; and (2) the plaintiff had not alleged a “special relationship” that would create a duty on its part to protect her from economic loss. Simpkins, 210 Or App at 227. The trial court agreed that the plaintiff had failed to plead a source of duty outside the common law of negligence, which was necessary because her claim was for the economic loss of her potential medical malpractice claim against the physician and the hospital. Id. However, we reversed and remanded, concluding that the plaintiff had alleged a source of duty based on former ORS 192.525(2).
Simpkins is distinguishable on its facts and procedural posture. First, unlike this case, Simpkins did not involve a claim for spoliation. A review of the appellate briefing in Simpkins reveals that the claim was not one for spoliation; it was an ordinary negligence claim. That explains why there was no discussion regarding spoliation *225in our opinion, instead there was only a discussion of foreseeability and duty.
Second, the plaintiff’s claim in Simpkins was not against a party to the underlying claim. There, the plaintiff argued in his brief on appeal:
“In Oregon, of course, alternative remedies exist for discovery violations of a party to a lawsuit. Had defendant been a party to plaintiff’s initial lawsuit, and failed to properly answer requests for production of Johnny Simpkins’ medical records, other remedies would have been available. See, ORCP 46. But those remedies did not assist the plaintiff here, because defendant, a non-party to plaintiff’s initial lawsuit, failed to produce the records until plaintiff’s claim against Dr. Goldberg was completely barred by ORS 30.020(1).”
Thus, even the plaintiff in Simpkins acknowledged that there are appropriate remedies in the Oregon Rules of Civil Procedure to sanction discovery violations by a party to an underlying claim where evidence is negligently lost. Among the available remedies for failure to provide discovery under ORCP 46 B are the following:
“(2)(a) An order that the matters regarding which the order was made or any other designated facts shall be taken to be established for the purposes of the action in accordance with the claim of the party obtaining the order;
“(2)(b) An order refusing to allow the disobedient party to support or oppose designated claims or defenses, or prohibiting the disobedient party from introducing designated matters in evidence;
“(2)(c) An order striking out pleadings or parts thereof, or staying further proceedings until the order is obeyed, or dismissing the action or any part thereof, or rendering a judgment by default against the disobedient party;
“(2)(d) In lieu of any of the foregoing orders or in addition thereto, an order treating as a contempt of court the failure to obey any order except an order to submit to a physical or mental examination.”
In short, a defendant’s failure to produce the recording through discovery in a first-party action on the underlying claims would not necessarily have diminished the value of *226those claims; instead, the remedies available under ORCP 46 could have provided potent sanctions for a defendant’s failure to produce the recording in such an action. However, at this point, speculation regarding those matters is unhelpful. To the extent that plaintiff reads Simpkins to hold that, after her claims have expired or without bringing them at all, a plaintiff may bring a first-party spoliation claim against the original target defendant, such a reading is untenable.
Plaintiff remonstrates that the loss of the videotape evidence constituted fraudulent concealment that served to toll the statute of limitations. Plaintiff is mistaken. Fraudulent concealment in the pertinent sense involves concealment of the “fact that a cause of action has accrued” against the defendant. Chaney v. Fields Chevrolet Co., 264 Or 21, 27, 503 P2d 1239 (1972) (citations and internal quotation marks omitted). Plaintiff did not allege in this action that defendant had concealed the fact that a cause of action had accrued. Instead, she alleged that defendant had failed to adequately preserve evidence that would have assisted her in an action against defendant for underlying claims that she never filed. Because, as a matter of law, plaintiff failed to allege that defendant’s action caused her any cognizable injury, the trial court did not err in dismissing plaintiff’s complaint.
We turn to plaintiff’s second assignment of error, in which she asserts that the trial court abused its discretion by denying her request to amend her complaint to add a claim for negligent infliction of emotional distress based on the loss of the videotape evidence. During the argument on defendant’s motion to dismiss, plaintiff orally sought leave to amend her complaint to allege that defendant’s negligent destruction of the recording had itself caused her actionable emotional distress:
“THE COURT: *** [I]f it’s really just a negligence claim like we have in Simpkins, then your theory would be that the negligent destruction of the evidence caused emotional distress over not being able to know what happened to her.
“[PLAINTIFF’S COUNSEL]: Correct.
* * * *
*227“THE COURT: * * * In the negligence claim, the damages would be the emotional distress from not being able to know what happened to her?
“[PLAINTIFF’S COUNSEL]: That’s a — a very general summary, then, yes, Your Honor.
“THE COURT: * * * What you’re asking is if I determine there isn’t a spoliation claim, to give you leave to plead it as a negligence claim—
“[PLAINTIFF’S COUNSEL]: Correct.
“THE COURT: in which case you would allege the theory that you just explained?
“[PLAINTIFF’S COUNSEL]: Correct***”
In its letter opinion, the trial court stated:
“[A]t oral argument plaintiff asked for leave to amend to assert yet another theory, namely, that defendant’s negligent destruction of evidence caused her emotional distress. This theory is foreclosed by the recent holding in Paul v. Providence Health System-Oregon, 237 Or App 584[, 240 P3d 1110 (2010), aff’d on other grounds 351 Or 587, 273 P3d 106 (2012)]. In that case the Court of Appeals held that the relationship between a medical provider and a patient does not give rise to the heightened standard of care necessary to recover for emotional distress damages. 237 Or App at 597. Accordingly, [p]laintiff is not entitled to pursue a claim for negligent infliction of emotional distress.”
ORCP 25 A provides:
“When a motion to dismiss or a motion to strike an entire pleading or a motion for a judgment on the pleadings under Rule 21 is allowed, the court may, upon such terms as may be proper, allow the party to amend the pleading.”
We review a trial court’s ruling denying leave to amend a complaint for abuse of discretion. Crandon Capital Partners v. Shelk, 219 Or App 16, 40, 181 P3d 773, rev den, 345 Or 158 (2008) (amendment pursuant to ORCP 23). The trial court abuses its discretion if it exercises it in a manner that is unjustified by, and clearly against, reason and evidence. Quillen v. Roseburg Forest Products, Inc., 159 Or App 6, 10, 976 P2d 91 (1999).
*228The trial court declined to allow plaintiff to amend her complaint to allege a claim for negligent infliction of emotional distress because it concluded that such a claim “is foreclosed by the recent holding in [Paul].” On appeal, defendant defends that ruling on the ground that plaintiff could not plead a qualifying special relationship that would permit the recovery of economic damages in a negligence claim.
In Paul, the named plaintiffs were patients of the defendant, a nonprofit corporation that provides health care. An employee of the defendant left computer disks and tapes containing records of patients in a car; the disks and tapes were subsequently stolen. The records included names, addresses, phone numbers, Social Security numbers, and patient care information. The defendant notified all individuals whose information was contained on the disks and tapes and advised them to take precautions to protect themselves against identify theft. 237 Or App at 586-87.
The plaintiffs filed a class action on behalf of themselves and other individuals whose records had been stolen. The plaintiffs asserted common-law negligence and negligence per se claims, alleging that the defendant’s conduct had caused them financial injury in the form of past and future costs of credit monitoring, maintaining fraud alerts, and notifying various government agencies regarding the theft, as well as possible future costs related to identity theft. Id. at 587-88. The plaintiffs also alleged that they suffered non-economic damages for the emotional distress caused by the theft of the records and attendant worry over possible identity theft. The plaintiffs did not allege that any unauthorized person ever had reviewed any of the information contained on the disks and tapes, or that any plaintiff had suffered any actual financial loss, credit impairment, or identity theft. Id. at 588.
The defendant filed a motion to dismiss the plaintiffs’ complaint for failure to state ultimate facts sufficient to constitute a claim for relief. The trial court granted that motion, holding that the damages the plaintiffs alleged were not compensable under Lowe v. Philip Morris USA, Inc., 207 Or App 532, 142 P3d 1079 (2006), aff’d, 344 *229Or 403, 183 P3d 181 (2008), because the plaintiffs’ claimed damages — although reflecting, in part, expenses that the plaintiffs actually had incurred — were premised on the risk of future injury, rather than actual present harm. Paul, 237 Or App at 588.
The plaintiffs appealed, and we affirmed. We first analyzed whether the plaintiffs had stated a negligence claim for economic damages. To recover damages for purely economic harm, liability “ ‘must be predicated on some duty of the negligent actor to the injured party beyond the common law duty to exercise reasonable care to prevent foreseeable harm.’” Oregon Steel Mills, Inc. v. Coopers & Lybrand, LLP, 336 Or 329, 341, 83 P3d 322 (2004) (quoting Onita Pacific Corp. v. Trustees of Bronson, 315 Or 149, 159, 843 P2d 890 (1992)). We held that the plaintiffs had failed to identify a “heightened duty of care to protect against economic harm arising out of the relationship between themselves as patients and defendant as a health care provider.” Paul, 237 Or App at 592. We rejected the plaintiffs’ argument that state and federal statutes protecting the confidentiality of medical records established an independent standard of care that the defendant had violated, reasoning that those statutes did not create a special relationship between the parties that would give rise to a heightened duty owed to the plaintiffs. Id. at 593. Because the plaintiffs failed to identify a special relationship between the parties, we concluded that the plaintiffs could not, under the Supreme Court’s opinion in Lowe, recover for the expenses of monitoring a future potential harm. Id.
We then turned to the plaintiffs’ claim for damages for emotional distress. A plaintiff may recover damages for emotional distress, in the absence of physical injury, “where the defendant’s conduct infringed on some legally protected interest apart from causing the claimed distress, even when that conduct was only negligent.” Hammond v. Central Lane Communications Center, 312 Or 17, 23, 816 P2d 593 (1991). As with the plaintiffs’ claim for economic damages, we held that the plaintiffs had failed to identify a special relationship between the parties that could give rise to a duty of care to avoid emotional harm to plaintiffs. Paul, 237 Or App at 597. We distinguished those cases where a plaintiff recovered *230emotional distress damages in the absence of a special relationship, because those cases involved an “affirmative” breach of a duty of confidentiality. In the absence of an affirmative breach or a special relationship, we held that the plaintiffs had not stated a claim for emotional distress. Id. at 600.
The Supreme Court affirmed our decision in Paul, but on different grounds. With respect to the negligence claim, the court assumed, without deciding, that the defendant owed a duty to protect the plaintiffs against economic losses, but nevertheless concluded that the plaintiffs’ allegations were insufficient because they did not allege actual, present injury caused by the defendant’s conduct. Paul, 351 Or at 594-95. For similar reasons, with respect to the emotional distress claim, the court did not decide whether a health care provider can be liable in negligence for the emotional distress damages of its patients that may result from the misuse of their personal information. The court said:
“Assuming, without deciding, that defendant does owe a duty to plaintiffs to protect them from such harm— under Oregon tort cases or derived from the health care information statutes that the parties cite — we conclude that plaintiffs’ allegations of injury here are insufficient to state a claim for emotional distress damages. As we have already observed, plaintiffs’ alleged emotional distress is premised entirely on the risk of future identity theft, and not on any actual identity theft or present financial harm. No case from Oregon — or, as far as we can tell, any other jurisdiction — supports the claim that plaintiffs make here.”
Id. at 599 (emphasis omitted). Based on those conclusions, the Supreme Court affirmed the dismissal of the action.
As noted, defendant here relies on our decision in Paul. In particular, defendant likens plaintiff’s attempt to amend her complaint to the unsuccessful effort of the plaintiffs in Paul to seek emotional distress damages. According to defendant, here, as this court held in Paul,
“plaintiffs fail to explain why the relationship between a medical provider and its patient gives rise to a duty on behalf of that provider to protect patient information from disclosure beyond the generic common-law duty to take *231reasonable steps to protect against foreseeable harm— in other words, why that relationship creates a legally protected interest in having defendant guard patients from the possibility of emotional distress caused by the loss of their personal medical information through theft.”
237 Or App at 597.
Because the Supreme Court in Paul did not reject the reasoning of our opinion in that case concerning the requirements for a claim for emotional distress damages, we do not question its vitality here. We nevertheless conclude that the trial court’s reliance in this case on our decision in Paul was misplaced. As noted, in Paul, we concluded, in part, that the
“[pjlaintiffs have failed to identify an independent standard of care that includes the duty to guard against the specific harm they allege — viz., the emotional trauma associated with the loss of personal medical information as a result of theft.”
237 Or App at 599.
Plaintiff’s proposed amendment did not suffer from the same deficiency in this case. ORS 192.518(l)(b) obligated defendant to provide plaintiff with a copy of the recording of her sleep study because it was a medical record to which she was entitled. In the statute as it was originally enacted, former ORS 192.525,1 “the legislature imposed a duty to *232disclose medical records precisely because of concerns that patients’ ability to pursue personal injury claims would be compromised unless health care providers fully complied with requests for medical records Simpkins, 210 Or App at 233. The provision oí former ORS 192.525 that we relied on in Simpkins was incorporated in all material respects into ORS 192.518 when the 2003 legislature brought Oregon law into compliance with the Health Insurance Portability and Accountability Act of 1998 (HIPAA), 45 CFR § 160.203.
ORS 192.518 was renumbered in 2011 as ORS 192.553 and provides as follows:
“(1) It is the policy of the State of Oregon that an individual has:
“(a) The right to have protected health information of the individual safeguarded from unlawful use or disclosure; and
“(b) The right to access and review protected health information of the individual.
“(2) In addition to the rights and obligations expressed in ORS 192.553 to 192.581, the federal Health Insurance Portability and Accountability Act privacy regulations, 45 CFR parts 160 and 164, establish additional rights and obligations regarding the use and disclosure of protected health information and the rights of individuals regarding the protected health information of the individual.”
As did former ORS 192.525, HIPAA requires health care providers to produce an individual’s protected health information to the individual upon his or her request:
“Except as otherwise provided in paragraph (a)(2) or (a) (3) of this section, an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set, for as long as the protected health information is maintained in the designated record set.”
45 CFR § 164.524(a)(1). 2
*233The trial court concluded that ORS 192.553 contains the same duty to disclose medical records to a patient upon request as did its predecessor statute that was at issue in Simpkins. That conclusion is consistent with both the legislative history of both statutes and common sense — there is no reason to believe that patients’ ability to pursue personal injury claims would be any less likely to be compromised by nondisclosure of medical records in 2003, when ORS 92.525 was repealed and ORS 192.5with 18 was enacted, than they were in 1997, when ORS 192.525 was originally enacted. Former ORS 192.525 was repealed and replaced by ORS 19.518 (2003), not because the legislature meant to change state policy concerning an individual’s right to access his or her own medical records, but because former ORS 192.525 had used terms and contained an authorization form that were not consistent with HIPAA. Testimony, House Judiciary Committee, HB 2305, Feb 18, 2003, Ex B (statement of Gwen Dayton). As noted in the testimony of Ronald Marcum, the Chief Privacy Officer and Chief Medical Information Officer for Oregon Health Sciences University, the HIPAA-compliant law was not intended to displace existing Oregon policy:
“HB 2305 maintains the current protections for Oregon residents regarding the use and disclosure of their health information and does not impose new restrictions. * * * HB 2305 does remove the conflicts in language and the preemptive issues previously described that were present in ORS 192.525 and 192.530 when compared with the requirements for the federal Privacy Rule (45 CFR 160 and 164).”
Testimony, House Judiciary Committee, HB 2305, Feb 18, 2003, Ex D (statement of Ronald G. Marcum).
The difficulty for the plaintiffs in Paul was their inability to establish any affirmative breach of the defendant’s duty to maintain the confidentiality of their personal and medical information or a specific professional duty by the defendant to protect against emotional distress caused by the theft of that information. Paul, 237 Or App at 600. Although the plaintiffs in Paul relied in part on former ORS 192.518(l)(a) as a source of duty for their negligence per se claim, id. at 593 n 4, they failed to connect that *234statutory duty to “safeguard” protected health information from unlawful use or disclosure to any affirmative breach by the defendant. There simply was no allegation that unlawful use or affirmative disclosure of the plaintiffs’ records had actually occurred. Id. at 594-96. Here, by contrast, former ORS 192.518(l)(b) “imposed a duty to disclose medical records precisely because of concerns that patients’ ability to pursue personal injury claims would be compromised unless health care providers fully complied with requests for medical records.” Simpkins, 210 Or App at 233. Plaintiff proposed to allege an affirmative breach of that duty based on defendant’s loss or destruction of the recording of her sleep study. That she was entitled to do and, in doing so, she was also entitled to seek damages against defendant for negligently causing her emotional distress. See, e.g., Humphers v. First Interstate Bank, 298 Or 706, 720-21, 696 P2d 527 (1985) (holding that the plaintiff was entitled to seek emotional distress damages for a physician’s affirmative breach of a statutory duty to keep patient information confidential); see also Paul, 237 Or App at 594-95 (so describing the holding in Humphers in distinguishing that case).
Because the trial court’s erroneous application of Paul was the sole reason for its refusal to allow plaintiff to amend her complaint to allege a claim for negligent infliction of emotional distress, as we now explain, the court improperly exercised its discretion by declining plaintiff’s request to amend. A trial court’s refusal to allow leave to amend is reviewed for the improper exercise of discretion, which is evaluated on appeal by considering factors that include the following:
“‘(1) the nature of the proposed amendments and their relationship to the existing pleadings; (2) the prejudice, if any, to the opposing party; (3) the timing of the proposed amendments and related docketing concerns; and (4) the colorable merit of the proposed amendments.’”
Safeport, Inc. v. Equipment Roundup & Mfg., 184 Or App 690, 699, 60 P3d 1076 (2002), rev den, 335 Or 255 (2003) (quoting Ramsey v. Thompson, 162 Or App 139, 147, 986 P2d 54 (1999), rev den, 329 Or 589 (2000)). Here, the requested *235amendment would have added a claim for negligence arising from the same operative facts already pleaded, there was no cognizable prejudice to defendant in permitting such an amendment, and the request occurred shortly after plaintiff filed this action, so there were no docketing concerns. Under those circumstances, we conclude that the court improperly exercised its discretion by declining to permit plaintiff to amend her complaint to assert a claim for negligent infliction of emotional distress.
Defendant objects that recasting plaintiff’s spoliation claims as a claim for negligent infliction of emotional distress would not solve plaintiff’s causation conundrum. We disagree. Plaintiff’s emotional distress claim was not premised on the diminution in value of her underlying tort claims; instead, it would seek recovery for emotional distress flowing from the destruction of the evidence that defendant was required to retain, that is, from not being able to know what happened to her before she awoke to find her breasts exposed and one of defendant’s employees standing over her and staring at her.
Dismissal of original complaint affirmed; reversed and remanded with instructions to allow filing of amended complaint for negligent infliction of emotional distress.
Former ORS 192.525 provided, in pertinent part:
“(1) The Legislative Assembly declares that it is the policy of the State of Oregon to protect both the right of an individual to have the medical history of the individual protected from disclosure to persons other than the health care provider and insurer of the individual who needs such information, and the right of an individual to review the medical records of that individual. It is recognized that both rights may be limited, but only to benefit the patient. These rights of confidentiality and full access must be protected by private and public institutions providing health care services and by private practitioners of the healing arts. The State of Oregon commits itself to fulfilling the objectives of this public policy for public providers of health care. Private practitioners of the healing arts and private institutions providing health care services are encouraged to adopt voluntary guidelines that will grant health care recipients access to their own medical records while preserving those records from unnecessary disclosure.
“(2) Except as otherwise provided by law, a health care provider must disclose a patient’s medical records after receiving a written release authorization that directs the health care provider to produce the patient’s medical records. * * * If the patient is not able to give consent to the release, *232the authorization must be signed by a person authorized by law to obtain the medical records sought under the authorization.”
In general, Oregon requires health care records to be retained for at least seven years. OAR 333-071-0060; OAR 333-505-0050(18). See also ORS 431.520 (public health records must be preserved for at least seven years).