The Indiana Department of Child Services told a child-abuse reporter that his report was confidential, but then released it without redacting his identity. The reporter and his family sued DCS based on both the statute protecting reporter anonymity and our common law. We denounce DOS’s thoughtlessness, but find no basis for liability under either theory. The statute protecting anonymity provides no private right of action—and we will not judicially infer one since the statute’s main purpose is to protect children in general and since it already provides enforcement mechanisms. Likewise, DOS’s recitation of the confidentiality statute did not create a common-law duty. We thus affirm summary judgment for DCS.
Facts and Procedural History
John Doe #1 lived with his wife, two adult sons, and minor daughter in a small southern-Indiana town where “[everybody *201knows everybody.” Each Wednesday, John drove neighborhood children to church. Over time, he noticed that something wasn’t quite right with some of his young passengers—eventually suspecting they were victims of abuse and neglect.
After talking it over with his wife, John called the DCS abuse and neglect hotline to report his suspicions. Near the end of the call, the DCS hotline employee asked for his contact information. Hesitant, John said he did not want anyone to know he called. But the operator explained, “Well, it’s confidential. Nobody will find out.” John gave his first name and phone number, then hung up.
' A few days later, John was mowing the grass when an irate neighbor began screaming at him while waving the DCS report—which was unredacted. Word spread around town and the Does were soon labeled “snitches.” John was “stared at, glared at, mooned, flipped off, [and] yelled at.” His wife was threatened that someone might “cut that smirky grin off’ her face. Their daughter required counseling because of bullying at school. And the Does’ sons hesitated to go outside—thinking twice about cooking on the grill or taking out the trash.’ All this harassment shook the family, making them wish they could afford to leave their longtime home for a different city.
The Does sued DCS for negligently disclosing John’s identity, raising two theories: one statutory, the other common-law. First, they claimed that the statute requiring DCS to protect reporter identity— Indiana Code section 31-33-18-2 (“Section 2”)—implies a private right of action. Second, they asserted that the DCS hotline operator’s statement that “[n]obody will find out” was a promise creating a common-law duty of confidentiality. DCS moved for summary judgment, asserting that Section 2 implies no right of action because it was designed to protect children by encouraging reporting, rather than to enable lawsuits, and that the common law imposes no duty on this record. The trial court granted summary judgment for DCS.
A divided panel of the Court of Appeals reversed. Doe v. Ind. Dep’t of Child Servs., 53 N.E.3d 613 (Ind. Ct. App. 2016). The majority declined to address whether Section 2 implied a right of action—finding instead that DCS owed the Does a common-law “private duty” based on the hotline worker’s “promise” of confidentiality. Id. at 616-17 (citing Mullin v. Mun. City of S. Bend, 639 N.E.2d 278, 284-85 (Ind. 1994)). Chief Judge Vaidik dissented, believing that Section 2 implied no right of action because its thrust was encouraging reporting, not enabling lawsuits, and that the common-law claim failed as well because the private-duty test applied only to emergency-dispatch situations. Id. at 618-21 (Vaidik, C.J., dissenting).
We granted DCS’s petition to transfer, thereby vacating the Court of Appeals decision. Ind. Appellate Rule 58(A).
Standard of Review
We review summary judgment de novo, affirming only when the designated evidence reveals no genuine issue of material fact and entitles the moving party—here, DCS—to judgment as a matter of law. Ind. Trial Rule 56(C); Hughley v. State, 15 N.E.3d 1000, 1003 (Ind. 2014).
At issue are two legal questions that we also address de novo. First, does Section 2, which prohibits DCS from identifying reporters, create a private right of action? Howard Reg’l Health Sys. v. Gordon, 952 N.E.2d 182, 185 (Ind. 2011) (reviewing the existence of a private right of action as a matter of law). Second, if not, does the common law nevertheless impose an actionable duty on DCS for telling John that *202his report was “confidential”? Rogers v. Martin, 68 N.E.3d 316, 320 (Ind. 2016) (reviewing the existence of a common-law duty, absent genuine issues of material fact, as a matter of law).
Discussion and Decision
To prevail on their negligence claims, the Does must prove that DCS (1) owed them a duty, (2) breached that duty, and (3) proximately caused their injuries. Rogers, 63 N.E.3d at 321. Here, the parties dispute only the first element: whether DCS owed a duty of confidentiality under Section 2 and, if not, whether it owed one under the common law. Though DOS's disclosure was irresponsible, it cannot trigger civil liability under either theory.
I. Section 2 Provides No Private Right of Action.
The parties agree that Section 2 does not expressly provide a private right of action; they dispute only whether it implies one. This is purely a question of legislative intent, not judicial preference: did the General Assembly intend Section 2 to create a right of action, despite not saying so expressly? See Alexander v. Sandoval, 532 U.S. 275, 286-87, 121 S.Ct. 1511, 149 L.Ed.2d 517 (2001). We have “long been reluctant” to infer this unwritten intent, since the legislature often1 creates rights of action using clear language. See F.D. v. Ind. Dep’t of Child Servs., 1 N.E.3d 131, 143-44 (Ind. 2013) (Rush, J., concurring in part and dissenting in part). This reluctance to invade the legislature’s purview has developed into a two-part rule: we usually will not infer a private right of action when the statute (1) primarily protects the public at large and (2) contains an independent enforcement mechanism. See, e.g., Gordon, 952 N.E.2d at 187 (citing Estate of Cullop v. State, 821 N.E.2d 403 (Ind. Ct. App. 2005)); LTV Steel Co. v. Griffin, 730 N.E.2d 1251, 1260 (Ind. 2000). We address each part in turn,
A. The statute’s mission is to protect children, not reporters.
When a statute is designed mainly for public benefit, it implies no right of action; incidental benefits to a private party make no difference. See Sprunger v. Egli, 44 N.E.3d 690, 693-94 (Ind. Ct. App. 2015); C.T. v. Gammon, 928 N.E.2d 847, 853-54 (Ind. Ct. App. 2010); Whinery v. Roberson, 819 N.E.2d 465, 475 (Ind. Ct. App. 2004), trans. dismissed; Borne ex rel. Borne v. Nw. Allen Cty. Sch. Corp., 532 N.E.2d 1196, 1203 (Ind. Ct. App. 1989), trans. denied. In Borne, for example, a child-abuse victim sued an elementary-*203school principal for breaching his statutory duty to report abuse. 532 N.E.2d at 1202. Though that statutory duty would have undeniably benefited the particular child-abuse victim, the Court of Appeals refused to infer a private right of action since the statute’s “primary thrust” was helping children in general. Id. at 1208.
The statute here has the same “primary thrust” as the statute in Borne. Indeed, they are both part of the “Reporting and Investigation of Child Abuse and Neglect” scheme, which declares five purposes all revolving around helping children in general:
(1) encourage effective reporting of suspected or known incidents of child abuse or neglect;
(2) provide effective child services to quickly investigate reports of child abuse or neglect;
(3) provide protection for an abused or a neglected child from further abuse or neglect;
(4) provide rehabilitative services for an abused or a neglected child and the child’s parent, guardian, or custodian; and
(5) establish a centralized statewide child abuse registry and an automated child protection system.
1.C. § 31-33-1-1 (2008).
This child-centered framework does not just encourage reporting; it consciously “err[s] on the side of over reporting.” Smith v. State, 8 N.E.3d 668, 683, 692 (Ind. 2014) (affirming a high-school principal’s conviction for failing to report a student’s alleged rape). It does so using two main tools. First, it imposes criminal liability—a Class B misdemeanor—for anyone who has reason to believe that a child may be a victim of abuse or neglect but fails to immediately report it to DCS or to police. I.C. §§ 31-33-5-1, -4, -22-l(a) (2008). Second, it immunizes good-faith reporters from any civil or criminal liability that may arise from their reports. I.C. § 31-33-6-1, - 2 (2008).
And this framework’s confidentiality protections further facilitate the goal of “over reporting” to help identify abused or neglected children. After a report comes in, the statutes require ■ DCS to act promptly while guarding the reporter’s identity. Within 48 hours, DCS must write a confidential report that identifies the child, the alleged perpetrator, and the “source of the report.” I.C. § 31-33-7-4 (2008); I.C. § 31-33-18-l(a) (Supp. 2012). DCS may disseminate this report to a closed universe of recipients—including police and prosecutors—but it must “protect[]” the reporter’s identity when disseminating the report to the victim’s parents and the accused. I.C. § 31-33-18-2 (Supp. 2012). This procedure ultimately serves the statutes’ express purpose, of protecting children. See I.C. § 31-33-1-1.
In sum, the objective of this statutory scheme is clear: helping and protecting Hoosier youth. Year after year, the number of Indiana’s child abuse and neglect investigations and cases continues to climb.2 The General Assembly’s mission— expressed in the statutory scheme’s five purposes—is to reverse this trend through reporting. That one of the scheme’s provisions incidentally benefits reporters by requiring confidentiality does not change this goal—especially given the alternative confidentiality-enforcement mechanisms we now address.
*204 B. The statutory scheme already ■provides enforcement.
When a statute expressly provides one enforcement mechanism, courts may not engraft another. See Gordon, 952 N.E.2d at 187 (citing Estate of Cullop, 821 N.E.2d 403). Affirming this principle, Indiana courts find no private right of action where the General Assembly has provided independent enforcement—even if only an infraction. See id.; Kimrey v. Donahue, 861 N.E.2d 379, 382 (Ind. Ct. App. 2007), trans. denied; Stulajter v. Harrah’s Ind. Corp., 808 N.E.2d 746, 748 (Ind. Ct. App. 2004); Estate of Cullop, 821 N.E.2d at 409 (gleaning no right of action from a transportation statute as it already provided independent enforcement through a Class C infraction).
Here, Section 2 contains two alternative enforcement mechanisms. First, a public employee—including a DCS hotline worker—who “knowingly or intentionally discloses” confidential information commits a Class A infraction carrying a fine of up to $10,000. See I.C. § 5-14-3-10(a) (Supp. 2012); I.C. § 34-28-5-4(a) (Supp. 2012). Second, that employee may also be “disciplined in accordance with the personnel policies” of their agency. I.C. § 5-14-3-10(b). DCS’s personnel policies provide that employees who breach confidentiality face a range of discipline, including dismissal.
We do not, of course, condone DCS’s thoughtless fumbling of sensitive information. Quite the opposite. Child-abuse reporters are DCS’s eyes and ears on the front lines of the. fight to protect children—and without their trust and cooperation, DCS faces a nearly impossible uphill battle. Knowing this, our General Assembly might choose to impose a light of action, just as it has for Hoosiers falsely accused of child abuse. I.C. § 31-33-22-3(b) (Supp. 2012). But separation of powers requires us ;to leave that decision to the legislature, rather than make it ourselves under the guise of statutory interpretation.
Thus, we cannot infer that the General Assembly intended Section 2 to impose civil liability. We now address the Does’ common-law claim.
II. There Is No Common-Law Basis to Impose a Duty on DCS.
The Does do not assert that there is a general common-law duty to maintain confidentiality. Rather, they argue that DCS had a duty because John detrimentally relied on the DCS worker’s statement that reporter identity is confidential. In addressing this common-law argument, we discuss three theories (though- the Does directly raise only the first): the “private duty” doctrine, the assumed-duty doctrine, and the three-part test for new duties in Webb v. Jarvis, 575 N.E.2d 992 (Ind. 1991). For the reasons explained below, we hold that none of these theories creates a duty, and thus reject the Does’ common-law claim. '■
A. The “private duty" test applies only to a government’s promise to send emergency services.
In asserting their detrimental-reliance claim, the Does invoke the “private duty” test from Mullin v. Mun. City of S. Bend, 639 N.E.2d 278 (Ind. 1994), and Koher v. Dial, 653 N.E.2d 524 (Ind. Ct. App. 1995), trans. denied. In Mullin, after a mother lost her son to a house fire, she sued the city for breaching its “private duty” to dispatch an ambulance. 639 N.E.2d at 280. On appeal, we adopted a three-part private-duty test rooted in detrimental reliance: (1) the government must give “explicit assurance” that it will assist the plaintiff, (2) it must know that inaction could harm the plaintiff, and (3) the plaintiff must justifiably and detrimentally rely *205on the government’s affirmative undertaking. Id. at 284 (citing City of Rome v. Jordan, 263 Ga. 26, 426 S.E.2d 861, 863 (1993)). We held, however, that the mother’s claim failed the test because the city never promised an ambulance and because she gave no evidence of detrimental reliance. Id. at 285. In other words, if there is no promise or no detrimental reliance, there can be no private duty.
Though broadly worded, Muhin’s private-duty test was quickly confined to its original emergency-dispatch context. In Benton v. City of Oakland City, a man broke his neck diving into a lake and sued the city for breaching a duty to post shallow-water warnings. 721 N.E.2d 224, 225 (Ind. 1999). The Court of Appeals affirmed summary judgment for the city since it never assumed any “private duty.” Id. at 226. On transfer, we agreed because the private-duty test applies only to situations like the one in Mullin—where a governmental unit is alleged to have breached a duty to provide “emergency services.” Id. at 233.
Here, as in Benton, the Does’ claim does not pertain to “emergency services” and thus falls short of the narrow private-duty test. Certainly, John relied on the hotline employee’s statement that reporter identity was confidential. But since that statement was about confidentiality—not emergency dispatch—the Does cannot establish a private duty.
Mullin’s test, however, is not the only doctrine that encompasses detrimental-reliance claims. The Does also raised at the summary-judgment hearing the broader assumed-duty doctrine. We elect to address this issue.
B. Assumed duty does not apply as DCS only paraphrased a statute.
Indiana common law recognizes that one may gratuitously assume a duty by conduct. See, e.g., Yost v. Wabash Coll., 3 N.E.3d 509, 516-18, 521 (Ind. 2014). But we impose these duties “cautiously,” and have adopted the demanding test in the Restatement (Third) of Torts section 42, which requires a specific “undertaking”:
An .actor who undertakes to render services to another and who knows or should know that the services will reduce the risk of physical harm to the other has a duty of reasonable care to the other in conducting the undertaking if:
(a) the failure to exercise such care increases the risk of harm beyond that which existed without the undertaking, or
(b) the person to whom the services are rendered or another relies on the actor’s exercising reasonable care in the undertaking. .
See id. at 517; S. Shore Baseball, LLC v. DeJesus, 11 N.E.3d 903, 910-11 (Ind. 2014) (citing Yost as adopting the Restatement’s test). This “undertaking” element sets a high bar, requiring “affirmative, deliberate conduct.” Yost, 3 N.E.3d at 517.3
Critical here, this high bar is not cleared when the defendant merely references some type of pre-existing rule—like a regulation, policy, or statute. See id. at 517-18. In Yost,1 for example, a college fresh*206man suffered an injury during a fraternity hazing event and sued the college, arguing that it had assumed a duty to protect him in part because it had disseminated an anti-hazing policy. Id. at 513, 517-18. But we disagreed, finding this “do[es] not rise to the level of a specific undertaking that demonstrate[s] a special relationship.” Id. at 518. Communicating a rule was not enough.
Nor did merely communicating a rule pass muster in Lanni v. NCAA, 42 N.E.3d 542, 553 (Ind. Ct. App. 2015). There, a spectator at a college fencing match took a saber to the face and sued the NCAA, arguing that it had assumed a duty—by, among other things, setting boundaries around the fencing area—to prohibit spectators from standing too close to the action. Id. at 550, 553. But, relying on Yost, the Court of Appeals disagreed, reasoning that communicating a rule for bystanders’ safety does not “rise to the level of assuring [bystanders’] protection.” Id at 553. In short, conveying existing rules without an accompanying specific undertaking does not trigger liability.4
And that is all the DCS hotline employee did here. By informing John that his report was confidential, the employee did no more than the college in Yost or the NCAA in Lanni—she simply communicated an existing rule. Granted, the employee did summarize Section 2 using her own words: “[I]t’s confidential. Nobody will find out.” But given the demanding standard for “specific undertaking,” and given our caution in finding gratuitously assumed duties, we cannot read the hotline worker’s words as an offer to take on additional common-law liability.
This holding aligns with our reluctance to infer private rights of action. That is, when a statute provides no right of action, the fact that a defendant repeats it aloud does not trigger independent liability. Indeed, Indiana and other jurisdictions disfavor such end-runs around the legislature. See Sprunger v. Egli, 44 N.E.3d 690, 694 (Ind. Ct. App. 2015) (disagreeing that the plaintiffs common-law claim was “something other than an attempt -to assert a private right of action for failure to report [child] abuse”); Cruz v. TD Bank, N.A., 742 F.3d 520, 522-23 (2d Cir. 2013); Kerusa Co. LLC v. W10Z/515 Real Estate Ltd. Partnership, 12 N.Y.3d 236, 879 N.Y.S.2d 17, 906 N.E.2d 1049, 1054-55 (2009).
In sum, DCS did not assume a duty of confidentiality on this record. But the Does also asserted—for the first time at the Court of Appeals oral argument—that we should recognize a new duty encompassing these facts under our three-part test in Webb v. Jarvis, 575 N.E.2d 992 (Ind. 1991). We use our discretion to address this belated claim. But see Humphrey v. State, 73 N.E.3d 677, 687 n.2 (Ind. 2017) (deeming an argument waived when raised for the first time at oral argument); Vertucci v. NHP Mgmt. Co., 701 N.E.2d 604, 607 n.1 (Ind. Ct. App. 1998) (declining to address Webb since the plaintiffs “seemingly proceeded solely on the theory that [defendant] gratuitously assumed a duty’).
C. The Webb test yields the same result as the assumed-duty doctrine.
When determining a duty’s existence for. the first time, we often look to our three-part test in Webb: balancing (1) the parties’ relationship, (2) the foresee*207ability of harm, and (3) public policy. 575 N.E.2d at 995. Here, Webb imposes no duty.
We acknowledge that John satisfies the foreseeability prong, as retaliation against child-abuse reporters is an unfortunate reality for a town of any size, let alone one where “[everybody knows everybody.” The other two prongs, however, cut the other way. Like the college in Yost, DCS formed no “special relationship” with the Does by simply communicating a pre-existing rule. 3 N.E.3d at 518.5 And as for public policy, we cannot ignore that Indiana common law already forecloses a child-abuse victim from suing a bystander for failing to report abuse. See, e.g., Borne ex rel. Borne v. Nw. Allen Cty. Sch. Corp., 532 N.E.2d 1196, 1203 (Ind. Ct. App. 1989), trans. denied.
Regrettably, this result does not undo the wreckage. By relaying the statutory requirement of confidentiality and then violating it, DCS exposed an innocent family to harassment and threats. Our question on transfer, though, is narrow: should we expand our common law to impose a duty for summarizing a statute? On this record, we decline—seeing no reason why the common law should engulf an essentially statutory protection.
Conclusion
We do not condone DCS’s actions, but find no basis—in either statute or common law—for imposing a duty of confidentiality. We therefore affirm summary judgment for DCS.
Massa, Slaughter, and Goff, JJ., concur. David, J., concurs in part and dissents in part with.separate opinion.. See, e.g„ Ind. Code § 5-14-1,5-7 (Supp. 2016) (open door law); I.C. § 5-14-3-9 (Supp. 2016) (public records access); I.C. § 6-1.1-35-12 (2014) (disclosure of confidential tax information); I.C. § 9-22-3-36 (2016) (salvage motor vehicles); I.C. § 16-41-2-7 (2008) (reporting communicable diseases); I.C. § 23-2-5-15 (2016) (loan brokers); I.C. § 23-19-5-9 (2016) (securities fraud); I.C. § 24-3-2-12(b) (2016) (cigarette fair trade); I.C. § 24-3-4-14 (2016) (cigarette import and distribution); I.C. § 24-4-5-7 (2016) (cloth product trademarks); I.C. § 24-4.8-3-1 (2016) (spyware); I.C. § 24-5-8-17 (2016) (business opportunity transactions); I.C. § 24-5-13.5-13 (2016) (buyback vehicle disclosures); I.C. § 24-5-15-9 (2016) (credit services); I.C. § 24-5-17-14 (2016) (environmental marketing claims); I.C. § 24-5-19-9 (2016) (deceptive commercial solicitation); I.C. § 24-5-21-6 (2016) (prescription drug discount cards); I.C. § 24-5-23-2 (2016) (marketing by mortgage lenders); I.C. § 24-5-24-15 (2016) (security freezes for consumer reports); I.C. § 24-9-5-4 (2016) (home loan practices); I.C. § 24-11-5-1 (2016) (patent infringement); I.C. § 32-31-7-7 (2016) (tenant obligations); I.C. § 32-31-8-6 (2016) (landlord obligations); I.C. § 32-36-1-10 (2016) (rights of publicity); I.C. § 32-37-5-1 (2016) (copyright); I.C. § 34-28-7-3 (2014) (possessing firearms in locked vehicles); I.C. § 35-42-3.5-3 (2014) (human and sexual trafficking); I.C. § 36-7-11-21 (2012) (historic preservation).
. See, e.g., Ind. Dep’t of Child Servs., Annual Report to the State Budget Committee & Legislative Council, at 23-24 (Dec. 2016), http:// www.in.gov/dcs/files/SFY16DCSAnmlalReport FINAL.pdf.
. See also Smith v. Delta Tau Delta, Inc., 9 N.E.3d 154, 161-63 (Ind. 2014) (finding fraternity’s published rules against underage drinking insufficient to assume a duty to prevent it); McCollough v. Noblesville Sch., 63 N.E.3d 334, 339, 346 (Ind. Ct. App. 2016) (finding school principal's promise to investigate a basketball coach’s alleged battery insufficient to assume a duty to do so), trans. denied; McClure v. Strother, 570 N.E.2d 1319, 1321 (Ind. Ct. App. 1991) (finding landowner’s promise that ground was firm insufficient to assume a duty to prevent plaintiff's ladder from slipping on mud).
. See Shawnee Constr. & Eng'g, Inc. v. Stanley, 962 N.E.2d 76, 80, 86 (Ind. Ct. App. 2011) (holding that a contractual provision ensuring compliance with safety regulations was not enough to find assumed duty), trans. denied; Marks v. N. Ind. Pub. Serv. Co., 954 N.E.2d 948, 956 (Ind. Ct. App. 2011) (“Having safety rules and requirements is insufficient without some affirmative conduct on the part of [the defendant].”).
. The dissent’s "special relationship” analysis—"perhaps the crux” of its argument—focuses on detrimental reliance, arguing that John detrimentally relied on DCS’s "extra, • explicit and specific assurance” that no one will learn his identity. Op. at 209. Yet Indiana’s common law already provides detrimental-reliance theories, and the Does do not satisfy the elements. The assumed-duty doctrine, for example, requires a "specific undertaking"; here there was none. See Yost, 3 N.E.3d at 518. Actual fraud requires a material misrepresentation of "past or existing facts”; here the promise concerned only the future. See Rice v. Strunk, 670 N.E.2d 1280, 1289 (Ind. 1996) (citing Pugh's IGA, Inc. v. Super Food Servs., Inc., 531 N.E.2d 1194, 1197 (Ind. Ct. App. 1988)). And constructive fraud requires either a material misrepresentation of “past or existing facts” or silence "when a duty to speak exists”; here there was neither. See id. at 1284; In re Scahill, 767 N.E.2d 976, 979 (Ind. 2002). Our common law has thus carefully defined liability for promises, and this case—though distressing— does not warrant an ad hoc exception.