This case arises out of a traffic accident in which Daniel Thomas (“Thomas”), who was driving a car belonging to his girlfriend Elizabeth Burgos (“Burgos”), hit a vehicle operated by plaintiff Mark Adams (“Adams”). After Safety Insurance (“Safety”), Burgos’ insurer, contacted Adams and obtained a statement from him about the accident, Burgos accessed Adams’ contact information through her work computer at defendant Congress Auto Insurance Agency, Inc. (“Congress”), and passed the information on to Thomas. Thomas proceeded to use the information to contact plaintiff and intimidate him. Plaintiff contends that Congress is liable for not doing more to stop Burgos from misusing the confidential information he provided to Safety.
On Congress’ earlier motion, I dismissed several of Adams’ initial claims, but allowed his claim that Congress was negligent in safeguarding Adams’ personal information to proceed.1
Following discovery, the matter is now before me on Adams’ motion to amend to reinstate his claims for negligent hiring, supervision and retention, and violation of G.L.c. 93A, and to add a claim for violation of 18 U.S.C. §2725 (Docket #13); Adams’ motion to compel Congress to provide a supplemental discovery response (Docket #14); and Congress’ motion for summary judgment on the remaining claim of negligence (Docket #15). After hearing, plaintiffs motions to amend and to compel are DENIED. Defendant’s motion for summary judgment is ALLOWED.
BACKGROUND
Congress hired Burgos as a customer service representative in August 2003. In 2010, Congress promoted her to the position of office manager. Congress terminated Burgos’ employment in December 2012.
In June 2010, Burgos and Thomas went on an extended vacation, traveling to California, Texas and Iowa. In Iowa, they were stopped for driving 24 miles per hour over the posted speed limit. The officer who stopped them smelled marijuana in the car, and observed a .45 caliber bullet in the back seat. Upon further inquiry, the police found two loaded handguns in Burgos’ pocketbook, a receipt for additional ammunition in Burgos’ address book, and a box and a half of ammunition. One handgun had a serial number removed. The other was stolen. Burgos admitted to the officer that the handguns were hers. Burgos and Thomas were arrested. Burgos was ultimately indicted in federal court in Iowa on the charge of possessing a firearm with an obliterated serial number. On October 21, 2010, while at work at Congress, U.S. Marshal’s Service personnel arrested Burgos on the federal charge.2 The federal charge against Burgos was ultimately resolved with a diversionary disposition that did not result in a guilty plea or finding.
Aside from Burgos’ arrest, Congress received no complaints about Burgos’ reliability, honesty or professionalism in carrying out her duties, and found her job performance excellent.
On July 13, 2012, Burgos’ boyfriend, Thomas, drove Burgos’ car without a valid driver’s license at a high rate of speed, ignored State Police efforts to pull him over, and struck a car driven by Adams. Safety insured Burgos’ vehicle. On July 24, 2012, Safety contacted Adams and obtained a statement from him. Adams provided Safely with his contact information.
*373Through her work at Congress, Burgos had legitimate electronic access through Congress’ computers to Safety’s RMV and other databases. On July 25 and 26, 2012, Burgos used her access to Safety’s databases to learn that Adams had filed a claim and to retrieve his contact information. Burgos’ access to Safety’s electronic records was within the scope of her work at Congress (i.e. she was authorized to access Safety’s electronic records in the ordinary course of doing her work for Congress), but in this instance she did so for personal purposes to help her boyfriend, Thomas. Burgos gave the information, including Adams’ contact information, to Thomas.
On July 26, 2012, Thomas called Adams. Thomas impersonated a State Police officer and threatened Adams in an effort to get him to drop his insurance claim and not to identify the person who had hit his vehicle. Adams alleges this caused him significant emotional distress.3
DISCUSSION
I. Adams’ Motion to Amend Complaint
Once a responsive pleading has been served or an order of dismissal entered, “a party may amend his pleading only by leave of court or by written consent of the adverse party; and leave shall be freely given when justice so requires.” Mass.R.Civ.P. 15(a). When a persuasive reason supports denying an amendment, the court may do so. See, e.g., Castellucci v. United States Fid. & Guar. Co., 372 Mass. 288, 291-92 (1977) (motion denied where trial imminent and amendment introduced new theory of liability). Among other reasons, leave to amend may be denied because of “undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the opposing party [and] futility of amendment.” Goulet v. Whitin Machine Works, Inc., 399 Mass. 547, 549-50 (1987), quoting Foman v. Davis, 371 U.S. 178, 182 (1962). See All Seasons Servs., Inc. v. Comm’r of Health & Hosps. of Boston, 416 Mass. 269, 272 (1993) (“good reason” to deny motion because proposed amendment “futile”).
In his motion to amend, plaintiff seeks to restore the claims for negligent hiring, negligent supervision, negligent retention, and G.L.c. 93A, which I dismissed a year ago; and to add a new claim for violation of 18 U.S.C. §2725. While Adams’ motion might be considered unduly delayed or dilatory, the futility of the amendments is ultimately determinative of his motion.4 See All Seasons Servs., 416 Mass. at 272.
An employee’s criminal history is generally an insufficient basis to prove negligence in hiring, supervision or retention. See Coughlin v. Titus & Bean Graphics, Inc., 54 Mass.App.Ct. 633, 639 (2002) (summary judgment granted in favor of employer, where employee, who had prior convictions for rape and assault and battery with a dangerous weapon, murdered woman on employer’s premises; not reasonably foreseeable employee would attack member of public); Foster v. The Loft, Inc., 26 Mass.App.Ct. 289, 294 (1988) (knowledge of employee’s criminal record, without more, insufficient to establish employer’s negligence). Burgos was never convicted, the charge she faced was ultimately dismissed, and a firearms charge (dr even a conviction) would not have rendered it reasonably foreseeable that Burgos would engage in the 1ype of actions at issue in this case. See, e.g., id. at 294 n.7 (“Obviously, the nature of the employee’s criminal record is important. An employee’s past conviction of larceny by check would not make the employer liable, on the basis of the doctrine of negligent hiring or negligent retention, for the employee’s subsequent rape of a customer”); Doe v. Foot Locker Corporate Servs., Inc., 2008 WL 5467610 at «8-9 (Mass.Super. Apr. 3, 2008) (Connors, J.) (employee’s criminal history, including conviction for possessing child pornography and a charge that was later dismissed of assault and battery, not indicative of inability to perform requirements for retail position).
The fact that Burgos was charged with possession of a firearm with an obliterated serial number does not support Adams’ bare assertions that Burgos was unfit to handle sensitive, confidential information she regularly accessed in furtherance of her job duties. Nor does it plausibly suggest Adams is entitled to recover from Congress because Congress should have taken additional steps to prevent Burgos from accessing confidential data after she was charged. The suggestion that “an employer can never hire a person with a criminal record or retain such a person as its employee ‘at the risk of being held liable for [the employee’s torts] flies in the face of the premise that sociefy must make a reasonable effort to rehabilitate those who have gone astray.’ ” Foster, 26 Mass.App.Ct. at 294 n.6 (internal citation omitted).
The proposed amended complaint does not allege any information known to Congress before it hired Burgos suggesting she was unfit to be hired, any way in which Congress failed to supervise Burgos in particular, or any action by Burgos before she accessed Adams’ information that suggested she had a unique need for training or additional supervision. Even in light of the circumstances and facts surrounding Burgos’ 2010 firearm charge, the proposed amended complaint does not recite anything material that Congress knew or should have known while Burgos was employed that hints at Burgos being an unfit employee ripe for termination.
With respect to adding a count for violation of G.L.c. 93A, negligence itself does not constitute a violation of Chapter 93A. Squeri v. McCarrick, 32 Mass.App.Ct. 203, 206-07 (1992). The allegation that Congress “fail[ed] to meet the Commonwealth’s standards regarding the protection of confidential personal information” adds nothing more, even in light of the added fact of Burgos’ firearm charge in 2010 while employed by Congress. Such an allegation is simply another way to restate negligence. The proposed amended complaint does not plead facts showing that Burgos accessed *374“personal information” within the meaning of G.L.c. 93H; does not allege how, if at all, Chapter 93H or any regulation applies in this instance; and does not plead facts to suggest that Congress breached any specific “standard! ] regarding the protection of confidential personal information” applicable in the Commonwealth. See, e.g., Klairmont v. Gainsboro Restaurant, Inc., 465 Mass. 165, 170 (2013) (assertion of a violation of at least some regulations may serve as basis for 93A claim).
Adams’s proposed claim based on 18 U.S.C. §2725 is also futile because the proposed amended complaint alleges no facts establishing Congress’ vicarious liability for Burgos’ actions. Under 18 U.S.C. §2725, one “who knowingly obtains, discloses or uses personal information, from a motor vehicle record, for a purpose not permitted under [18 U.S.C. §§2721, et seq.) shall be liable to the individual to whom the information pertains, who may bring a civil action in a United States district court.” There is no evidence to suggest Congress violated this statute other than through Burgos’ actions. Any claim against Congress must therefore be based on a respondeat superior theory.
An employer will only be vicariously liable for the acts of its employee if she acts within the scope of her employment. See, e.g., Lev v. Beverly Enterprises-Massachusetts, Inc., 457 Mass. 234, 238 (2010), citing Dias v. Brigham Med. Assocs., Inc., 438 Mass. 317, 319-20 (2002). An employee acts within the scope of her employment if the work is “of the kind [s]he is employed to perform ... if it occurs substantially within the authorized time and space limits . . . and if it is motivated, at least in part, by a purpose to serve the employer.” Lev, 457 Mass. at 238 (internal citations omitted). Burgos’ employment only authorized her to make proper use of the confidential data contained in the Safety databases in furtherance of serving Congress’ professional mission. Burgos’ actions accessing Safety’s information about Adams and disclosing it to Thomas in furtherance of a conspiracy between Burgos and Thomas constituted an unauthorized and unlawful use of the Safety database. Burgos’ disclosure of information she learned about Adams to Thomas was not designed to serve Congress’ interests. Because there are no facts suggesting Congress is vicariously liable for Burgos’ actions, the addition of a count under 18 U.S.C. §2725 would be futile.
II. Summary Judgment
A party may obtain summary judgment on a claim where “there is no genuine issue as to any material fact and [ ] the moving party is entitled to a judgment as a matter of law.” Mass.R.Civ.P. 56(c). See Kourouvacilis v. General Motors Corp., 410 Mass. 706, 712-16 (1991). The moving party must first demonstrate the absence of a triable issue and that it is entitled to judgment as a matter of law. If, as here, the moving party does not bear the burden of proof at trial, the movant may demonstrate the absence of a triable issue by showing that the nonmoving party has no reasonable expectation of proving an essential element of his claim at trial. Flesner v. Technical Communications Corp., 410 Mass. 805, 809 (1991); Kourouvacilis, 410 Mass. at 716. Once the moving party establishes the absence of a triable issue, the party opposing the motion must respond and allege specific facts establishing the existence of a genuine issue of material fact. Mass.R.Civ.P. 56(e). The nonmoving party may not merely rest on assertions of dispute, but must show the existence of actual disputes of fact. LaLonde v. Eissner, 405 Mass. 207, 209 (1989).
Negligence claims ordinarily are not resolved on summary judgment because negligence is often a question of fact. Jupin v. Kask, 447 Mass. 141, 146 (2006); Coughlin v. Titus & Bean Graphics, Inc., 54 Mass.App.Ct. at 638. “[W]hen no rational view of the evidence permits a finding of negligence,” however, a judge “may decide the issue as a matter of law.” Roderick v. Brandy Hill Co., 36 Mass.App.Ct. 948, 949 (1994). To prove negligence, Adams must show that Congress owed him a duty of reasonable care, that Congress breached that duty, that Congress’ breach caused him harm, and that he suffered damages. See Jupin, 447 Mass. at 146 (considering latter three elements questions of fact for jury); Yakubowicz v. Paramount Pictures Corp., 404 Mass. 624, 629 (1989) (‘There can be negligence only where there is a duty to be careful." (Citation omitted)). Whether a duty exists at all is a question of law appropriate for summary judgment. See Jupin, 447 Mass, at 146, citing Remy v. MacDonald, 440 Mass. 675, 677 (2004) (“[i]f no such duty exists" there is no negligence claim).
For several reasons, Congress is entitled to summary judgment. First, whether Congress owed a duty to Adams to safeguard personal information it was authorized to access through Safety’s databases, what that duty entailed, and whether Congress breached that duty (i.e. whether Congress was under a duty to Adams to do more than it was doing to safeguard confidential information), are all matters requiring expert testimony. In the context of an insurer’s alleged failure to comply with a contractual duty to defend, the Supreme Judicial Court stated:
The standard of reasonable conduct for an insurer... is not a matter within the common knowledge of the ordinary lay person . . . Such standard of care is analogous to the standard of care owed by other professionals to their clients and is elucidated by expert testimony . . . Only where professional negligence is so gross or obvious that jurors can rely on their common knowledge to recognize or infer negligence may the case be made without expert testimony.
Herbert A. Sullivan, Inc. v. Utica Mutual Ins. Co., 439 Mass. 387, 402-03 (2003) (citations omitted). See also Aceto v. Dougherty, 415 Mass. 654, 660 (1993) (expert testimony required for negligence action turning on informed consent); Fishman v. Brooks, 396 Mass. 643, *375647 (1986) (expert testimony usually required for attorney negligence).
Like in the context of an insurer’s duty to defend, expert testimony is necessary to prove a negligence claim against an insurance company on a theory that it failed to safeguard confidential information. See, e.g., Bryant v. Jackson, 31 Mass. L. Rptr. 425, 2013 WL 5529322 at *4 (Sept. 17, 2013) (Leibensperger, J.) (expert testimony required to demonstrate whether defendant complied with standard of care in training and supervising employees with access to confidential medical records). Practices and policies for maintaining, and governing access to, confidential information in the insurance business are not matters of common knowledge or experience. Adams therefore must bring forward qualified expert testimony to proceed on his negligence claim. He has not done so. He offers no evidence from which a jury could reasonably find what the standard of care was in the industry at the time, and whether Congress breached that standard of care. To be sure, Adams alleges that Congress had a duly to keep his confidential personal information secure and protected, and to ensure that that information was not misused, distributed or made public; and that it breached that duty by allowing Burgos to have access to Adams’ confidential information without reasonable safeguards designed to prevent an employee from misusing the information. Such allegations are not sufficient; absent expert testimony on these points, Adams cannot prevail.5
Congress is also entitled to summary judgment because of Adams’ inability to prove that any negligence on the part of Congress was the proximate cause of injury to Adams. A third party’s criminal conduct will sever a chain of causation between any alleged negligence and a plaintiffs injury. See Griffiths v. Campbell, 425 Mass. 31, 35-36 (1997). In this case, the alleged continuing negligence of Congress was concurrent with, and Burgos allegedly accessed Adams personal information provided to Safety close in time to, Thomas’ threatening phone call. While typically a factual question left to the jury, in light of the record presented, there is no fact that could plausibly support holding Congress liable in the face of Burgos’ and Thomas’ intervening criminal acts.6
ORDER
Plaintiff Mark Adams’ Motion to Amend the Complaint (Docket #13) is DENIED.
Plaintiff Mark Adams’ Motion to Compel Defendant to Provide a Supplemental Discovery Response (Docket #14) is DENIED.
Defendant’s Motion for Summary Judgment (Docket #15) is ALLOWED. Judgment shall enter for defendant.
See Memorandum of Decision and Order on Defendant’s Motion to Dismiss Complaint (Oct. 1, 2013) [31 Mass. L. Rptr. 473].
Where is a dispute about whether Congress promoted Burgos to office manager before or after she was arrested at Congress’ office in October 2010. Given that Congress retained Burgos in the office manager position thereafter, this dispute is immaterial.
Adams reported the call to the police, who located Thomas. Thomas and Burgos were later charged with and found guilty of witness intimidation.
Adams’ motion to compel disclosure about a former Congress employee is no reason to delay determination on plaintiffs motion to amend or defendant’s motion for summary judgment. In light of my ruling below, and Congress’ concession that it knew the details of Burgos’ arrest, the deposition would be immaterial. For purposes of my ruling, I assume that Congress knew all of the details of Burgos’ arrest and charge in 2010, but chose to keep her on at the company.
The evidence suggests Congress’ procedures were in line with the procedures of other similarly situated insurance agencies. Adams has not offered evidence showing that Congress (and similarly situated insurance agencies) owed a duly of care that required it to adopt additional policies or procedures to safeguard confidential information, or that had it done so it would have prevented Burgos’ rogue disobedience.
Adams has not presented expert testimony to support his claim that Thomas’ phone call was the proximate cause of emotional distress. Indeed, Adams’ physician proffered that, based on his knowledge of Adams’ medical conditions, he observed no newphysical manifestations of distress in Adams following the phone call. Adams also has not demonstrated sufficient objective physical symptoms to support a claim of emotional distress. See Sullivan v. Boston Gas Co., 414 Mass. 129, 137-38 (1993) (“plaintiffs must corroborate their mental distress claims with enough objective evidence of harm to convince a judge that their claims” are likely genuine); Lo v. Fed. Home Loan Mortg. Corp., 2011 WL 8008118 at *5 (Mass.Super. May 29, 2012) (Fahey, J.). Adams proffers evidence that he has trouble sleeping, but his sleep issues have been steadily present and chronic since 2009, and his depression and anxiety have been constant since May 2012, well before Thomas’ phone call.