OPINION OF THE COURT
NEWMAN, Justice.We granted allocatur in this matter to determine whether the doctrine of corporate liability adopted in Thompson v. Nason Hospital, 527 Pa. 330, 591 A.2d 703 (1991), applies to state owned medical facilities under the medical-professional liability exception to sovereign immunity, 42 Pa.C.S. § 8522(b)(2). We hold that sovereign immunity precludes a cause of action based on corporate liability against Commonwealth medical facilities.
On September 4, 1990, Karyl L. Moser fractured her right lower leg and ankle. She received treatment at the emergency room of Ashland State Hospital and was admitted as an inpatient under the care of Dr. Landis Heistand, an orthopedic surgeon. The next day Dr. Heistand operated on Mrs. Mos-er’s leg. Hospital records describe the procedure as an open reduction and internal fixation of medial malleolus. Dr. Heistand released her from the hospital five days later. On January 7, 1991, Dr. Heistand removed surgical hardware from Mrs. Moser’s leg, and he permitted her to return to work on January 24, 1991. Mrs. Moser continued to see Dr. Heistand until May 6, 1991. From the time of her operation until her last visit, Mrs. Moser told Dr. Heistand that she *557continued to experience pain in her right leg and had difficulty walking.
On July 1, 1991, Mrs. Moser consulted a second orthopedic surgeon for another evaluation of her continuing pain. The doctor diagnosed that she was suffering from a nonunion of the fibular fracture of the right leg and a nonunion of the lateral malleolus. On August 7, 1991, Mrs. Moser underwent a second operation to treat her leg injury.
The Mosers filed a complaint for negligent treatment against Dr. Heistand, Ashland State Hospital and the Department of Public Welfare (DPW) on September 3, 1992. With respect to the Commonwealth defendants, the Mosers sought recovery based on ostensible agency liability, vicarious liability and corporate liability. Ashland State Hospital and DPW filed preliminary objections in the nature of a demurrer, in which they alleged that the Mosers failed to state a cause of action that fell within any of the statutory exceptions to sovereign immunity. The Court of Common Pleas of Schuylkill County (trial court) sustained the preliminary objections and dismissed the complaint against the Commonwealth defendants.1
On appeal, the Commonwealth Court affirmed the decision of the trial court on different grounds, citing Walls v. Hazleton State General Hospital, 157 Pa.Cmwlth. 170, 629 A.2d 232 (1993). In Walls, Commonwealth Court held that absent expert testimony establishing a connection between a hospital’s conduct and a plaintiff’s harm, the corporate theory of liability cannot stand. Upon review of the Moser’s complaint, the Commonwealth Court determined that it lacked any averment, which if accepted as true, could establish that any specific conduct of Ashland State Hospital or DPW was a substantial factor in causing Mrs. Moser’s harm. Because the Commonwealth Court held that the Mosers did not sustain *558their burden of proving that they had a cause of action against Ashland State Hospital and DPW, the Court did not reach the issue of whether the theory of corporate liability applies to state owned hospitals.
In Thompson, this Court recognized that hospitals have a non-delegable duty “to uphold the proper standard of care owed the patient, which is to ensure the patient’s safety and well-being while at the hospital.” Id. at 339, 591 A.2d at 707. Hospitals have the following duties:
(1) a duty to use reasonable care in the maintenance of safe and adequate facilities and equipment;
(2) a duty to select and retain only competent physicians;
(3) a duty to oversee all persons who practice medicine within its walls as to patient care; and
(4) a duty to formulate, adopt and enforce adequate rules and policies to ensure quality care for all patients.
Id. at 339-340, 591 A.2d at 707 (citations omitted).
The theory of corporate liability adopted by this court in Thompson provides that a “hospital is liable if it fails to uphold the proper standard of care owed its patient.” Id. at 341, 591 A.2d at 709. Because the duty to uphold the proper standard of care runs directly from the hospital to the patient, an injured party need not rely on the negligence of a third-party, such as a doctor or nurse, to establish a cause of action in corporate negligence.
As previously noted, the trial court sustained the Commonwealth parties’ preliminary objections on the basis that sovereign immunity precluded the Mosers’ action. However, the Commonwealth Court affirmed the trial court’s decision on the basis that the Mosers failed to establish a cause of action in corporate negligence. We disagree with Commonwealth Court’s determination. Our review of the complaint indicates that the Mosers alleged that Ashland State Hospital and DPW breached duties owed to Karyl Moser under Thompson. The complaint contains the following averments:
35. Defendant hospital failed to provide adequate supervision and control of its physician staff, agents and ostensible *559employees, by not conducting the proper review of the standard of care owed to each and every patient provided care within its facility.
37. Due to the fact that the defendant hospital failed to have proper quality control procedures in tact [sic] to conduct review of the medical care rendered patient Karyl Moser during her hospital stay from September 4, 1990 until her discharge on September 10, 1990, did directly and proximately cause and comparatively contribute to the resulting harm caused Karyl Moser----
38. That the defendant Hospital did not have adequate medical and surgical review policies and procedures in effect, and such mechanisms that were in effect failed to properly review and identify the failure of the surgical procedure performed on plaintiff patient Karyl Moser.
39. That during the period of inpatient hospitalization ..., the defendant hospital owed a nondelegable duty directly to plaintiff patient; such duty to uphold the standard of quality care to ensure her safety and well-being was breached by the defendant hospital failing to oversee all persons who practice medicine and/or surgery within its walls, including the care provided to Karyl Moser.
Where a preliminary objection in the nature of a demurrer is sustained, an appellate court’s review is limited.
All material facts set forth in the complaint as well as all inferences reasonably deducible therefrom are admitted as true for [the purpose of this review.] The question presented by the demurrer is whether, on the facts averred, the law says with certainty that no recovery is possible. "Where a doubt exists as to whether a demurrer should be sustained, this doubt should be resolved in favor of overruling it.
Vattimo v. Lower Bucks Hospital, Inc., 502 Pa. 241, 244, 465 A.2d 1231, 1232-33 (1983) (citations omitted).
Accordingly, the averments set forth in the Mosers’ complaint were sufficient to establish a cause of action in corporate negligence.
*560When bringing an action against a Commonwealth party, the plaintiff must establish a common law or statutory cause of action, and that the cause of action falls within an exception to sovereign immunity enumerated in 42 Pa.C.S. § 8522. Here, we have determined that the Mosers have a common law cause' of action under Thompson. Accordingly, the focus of our inquiry is whether this cause of action is barred by 42 Pa.C.S. § 8522, which provides in relevant part:
(b) Acts which impose liability. The following acts by a Commonwealth party may result in the imposition of liability on the Commonwealth and the defense of sovereign immunity shall not be raised to claims for damages caused by:
(2) Medical-professional liability. Acts of health care employees of Commonwealth agency medical facilities or institutions or by a Commonwealth party who is a doctor, dentist, nurse or related health care personnel.
42 Pa.C.S. § 8522(b)(2).
It is well established that we must strictly construe exceptions to sovereign immunity because the legislature intended to exempt the Commonwealth from immunity only in specific situations. Snyder v. Harmon, 522 Pa. 424, 562 A.2d 307 (1989).
A cause of action under corporate liability is based on the breach of non-delegable duties that a hospital owes directly to its patients, and is independent of the negligence of the hospital’s employees or ostensible agents. Edwards v. Brandywine Hospital, 438 Pa.Super. 673, 652 A.2d 1382 (1995). The cause of action arises from the policies, actions or inaction of the institution itself rather than the specific acts of individual hospital employees. For example, if a physician who is a hospital employee negligently performs an operation, the patient can bring suit against the hospital for the doctor’s act under respondeat superior. Tonsic v. Wagner, 458 Pa. 246, 329 A.2d 497 (1974). However, if a hospital fails to keep an incompetent doctor from practicing within its walls, and a *561patient suffers harm as a result, the patient may have a cause of action in corporate liability against the hospital. In that instance, the focus of the action is not the negligence of the doctor, but the negligence of the hospital. While a plaintiff clearly may bring an action in respondeat superior against a Commonwealth agency medical facility because 42 Pa.C.S. § 8522(b)(2) of the Code specifically waives sovereign immunity for acts of health care employees, we have not yet examined whether a plaintiff can bring an action in corporate negligence against a Commonwealth medical facility. We hold today that it may not.
A cause of action in- corporate negligence is based on the negligent acts of an institution. For such a cause of action to be viable against a Commonwealth hospital, sovereign immunity for the acts of the institution must be waived. Institutions do not act on their own, but through the creation and enforcement of policies established by their officers and employees. Nevertheless, the medical-professional liability exception to sovereign immunity specifically refers to “[a]cts of health care employees” and “a Commonwealth party who is a doctor, dentist, nurse or related health care professional.” Accordingly, while 42 Pa.C.S. § 8522(b)(2) waives sovereign immunity for the negligent acts of specified individuals when they are working at or for a Commonwealth institution, it does not waive sovereign immunity for individuals who act as the corporate entity.
While Commonwealth medical facilities are not immune from suit based on the negligence of their health care employees (respondeat superior), 42 Pa.C.S. § 8522(b)(2) does not provide for a waiver of immunity for the facilities themselves. Because of our responsibility to construe narrowly the legislatively created exceptions to sovereigri immunity, Snyder, we cannot extend the corporate theory of liability to state owned medical facilities. Accordingly, plaintiffs who seek recovery from the Commonwealth for damages sustained in such facilities must base their cause of action on the negli*562gence of the parties specifically enumerated in 42 Pa.C.S. 8522(b)(2).
For these reasons, we affirm the order of the Commonwealth Court. We make this decision based on sovereign immunity rather than on the failure to state a cause of action in corporate liability.
FLAHERTY, J., files a concurring opinion in which NIX, C.J., joins.
NIGRO, J., files a dissenting opinion.
. The trial court also concluded that Dr. Heistand was an independent contractor rather than an employee of Ashland State Hospital. This conclusion does not affect the matter before us because a cause of action in corporate liability is based on the duties a hospital owes to its patients, and not on the status of specific individuals who work in the institution.