Paul v. Providence Health System-Oregon

240 P.3d 1110 (2010) 237 Or. App. 584

Laurie PAUL, Plaintiff, and
Russell Gibson and William Weiller, DDS, individually and on behalf of all similarly-situated individuals, Plaintiffs-Appellants,
v.
PROVIDENCE HEALTH SYSTEM-OREGON, an Oregon corporation, Defendant-Respondent.

060101059; A137930.

Court of Appeals of Oregon.

Argued and Submitted April 2, 2009. Decided October 6, 2010.

David F. Sugerman, Portland, argued the cause for appellants. With him on the briefs were Paul & Sugerman, PC, Brian S. Campf, and Brian S. Campf, P.C.

John F. McGrory, Jr., Portland, argued the cause for respondent. With him on the brief were Gregory A. Chaimov and Davis Wright Tremaine LLP.

Before HASELTON, Presiding Judge, and ARMSTRONG, Judge, and ROSENBLUM, Judge.

ARMSTRONG, J.

Plaintiffs brought this class action after unencrypted records containing personal, medical, and financial information of an estimated 365,000 patients were stolen from the car of one of defendant's employees. Plaintiffs alleged that defendant had negligently failed to safeguard those records and that defendant had violated the Unlawful Trade Practices Act (UTPA) by representing that it would keep patient information confidential when it knew that it had not taken sufficient steps to ensure that. Plaintiffs sought injunctive relief and damages for past and future costs of credit-monitoring services to protect against identity theft and for emotional distress. The trial court granted defendant's ORCP 21 A(8) motions to dismiss plaintiffs' complaint for failure to state a claim, concluding that the relief sought was barred by Lowe v. Philip Morris USA, Inc., 207 Or.App. 532, 142 P.3d 1079 (2006) (Lowe I), aff'd, 344 Or. 403, 183 P.3d 181 (2008) (Lowe II). The court also granted defendant's motion under ORCP 32 I to strike the class allegations from the complaint. Plaintiffs appeal, assigning error to both rulings. On appeal, we affirm the trial court's dismissal of plaintiffs' claims and, accordingly, do not reach plaintiffs' contention that the court erred in striking the class allegations.

I. BACKGROUND

When reviewing an order granting a motion to dismiss for failure to state a claim, we accept as true all well-pleaded facts in the complaint and give the party opposing the motion the benefit of all reasonable inferences that can be drawn from those facts. Caba v. Barker, 341 Or. 534, 536, 145 P.3d 174 (2006). Accordingly, we take the facts from plaintiffs' third amended complaint.

The facts alleged in this case are few: An employee of defendant, a medical care provider, took computer disks and tapes home and left them in his car overnight, and they were stolen. The disks and tapes contained unencrypted patient records for approximately 365,000 individuals; the records included names, addresses, phone numbers, Social Security numbers, and patient care information. Approximately three-and-one-half weeks after the theft, defendant sent letters to each person whose information was contained on the stolen disks and tapes, alerting them to the loss of data and advising them to take precautions to protect themselves. Plaintiffs subsequently filed this action as a class action on behalf of all people whose information was contained on the disks and tapes.

As a result of the theft, plaintiffs and class members allege that they have been exposed to "loss of privacy, to past and future out-of-pocket losses associated with monitoring credit reports and placing and maintaining fraud alerts, to credit injuries inherent in credit monitoring and placing and maintaining fraud alerts, and to repair costs of credit damage caused by the theft of data." Their complaint pleaded two claims for relief: negligence and violation of the UTPA.

In their claim for negligence, plaintiffs sought relief under theories of negligence per se and common-law negligence. The former was predicated on defendant's alleged failure to comply with federal and state law providing for the protection of medical information, specifically ORS 192.518 et seq. and 45 C.F.R. Parts 160 and 164. With regard to the latter claim, plaintiffs alleged that defendant was negligent "in failing to safeguard the data, in failing to encrypt it, in allowing its agent or employee to store such data in his or her car, and in failing to put in place policies that would protect such data from theft and disclosure." The injury alleged with respect to both theories was the same

"financial injury in the form of past and future costs to monitor credit reports, recurring future costs to notify and re-notify credit bureaus of fraud alerts, costs of notification to the Social Security Administration, the Immigration and Naturalization Agency, the Internal Revenue Service, State and Local law enforcement agencies and possible future costs of repair of identity theft."

In their second claim for relief, plaintiffs alleged that defendant had violated the UTPA^[1] by (1) "representing that all information gathered to sell its services or goods would be safeguarded and kept confidential when it knew that it lacked adequate means to safeguard such information" and (2) "representing that the business of sale of services and goods would include privacy and confidentiality when it knew that the transactions were not confidential due to its inadequate data protection program."

With respect to both their negligence and UTPA claims, plaintiffs sought (1) injunctive relief, requiring defendant to "pay for ongoing monitoring of credit reports, notify Social Security of the data loss, fund recurring credit bureau fraud alerts and pay for the future cost of possible loss and damage due to identity theft"; (2) economic damages for "past out-of-pocket expenses for credit monitoring services, credit injury, postage, long distance and time loss from employment to address these issues"; and (3) noneconomic damages for "impairment of access to credit inherent in placing and maintaining fraud alerts, as well as worry and emotional distress associated with the initial disclosure and the risk of any subsequent identity theft." Plaintiffs did not allege that they or class members have been victims of fraud or identity theft as a result of the stolen disks and tapes or that the information stolen has otherwise been compromised.

Defendant moved under ORCP 21 A(8) to dismiss both of plaintiffs' claims on the basis that each failed to "state ultimate facts sufficient to state a claim"; it also moved to strike plaintiffs' class allegations pursuant to ORCP 32 I and 32 E(4). The trial court granted defendant's motions and subsequently entered a judgment dismissing plaintiffs' complaint with prejudice. As noted, plaintiffs challenge both rulings on appeal; however, our disposition with respect to the former—that the trial court was correct in dismissing plaintiffs' claims under ORCP 21 A(8)—obviates the need to address the latter.

II. ANALYSIS

A. Plaintiffs' Negligence Claim

Citing our opinion in Lowe I, the trial court concluded that plaintiffs had failed to state a claim for negligence because "the damages prayed for [are] not compensable under Oregon law."^[2] Thus, the issue on appeal reduces to whether plaintiffs' complaint alleged an injury cognizable under Oregon negligence law. Zehr v. Haugen, 318 Or. 647, 656, 871 P.2d 1006 (1994) (harm to the plaintiff measurable in damages is a necessary element of negligence). As a result, although plaintiffs pleaded theories of common-law negligence and negligence per se, the distinction between the two has limited bearing on our analysis. See Fazzolari v. Portland School Dist. No. 1J, 303 Or. 1, 17, 734 P.2d 1326 (1987) (in common-law negligence actions, "the issue of liability for harm actually resulting from defendant's conduct properly depends on whether that conduct unreasonably created a foreseeable risk to a protected interest of the kind of harm that befell the plaintiff"); Abraham v. T. Henry Construction, Inc., 230 Or.App. 564, 573, 217 P.3d 212 (2009), rev. allowed, 348 Or. 523, 236 P.3d 151 (2010) ("Negligence per se * * * is not a distinct cause of action; it is a negligence claim based on violation of a standard of care set out by statute or rule.").

To recover in negligence, a plaintiff must suffer harm "to an interest of a kind that the law protects against negligent invasion." Solberg v. Johnson, 306 Or. 484, 490, 760 P.2d 867 (1988). In Lowe II, the Supreme Court considered that principle in the context of a long-time cigarette smoker who brought an action for negligence against cigarette manufacturers. The complaint did not allege that the plaintiff had suffered any present physical harm; rather, it alleged that, as a result of the defendants' negligent manufacture and sale of cigarettes, the plaintiff (and all similarly situated Oregonians) suffered a "`significantly increased risk of developing lung cancer.'" 344 Or. at 408, 183 P.3d 181. That risk, the plaintiff alleged, created a need for periodic medical monitoring and smoking-cessation treatment, including public education. She sought injunctive relief ordering the defendants to provide that monitoring and treatment. The trial court dismissed the complaint on the basis that, because the plaintiff had not alleged a present physical injury, the complaint failed to state a claim for negligence. Id. at 407, 183 P.3d 181.

On appeal, the Supreme Court considered two questions: (1) whether a significantly increased risk of future physical injury is, by itself, a sufficient harm to state a claim in negligence; and (2) whether the economic cost of undergoing periodic medical screening constitutes a sufficient harm for that purpose. Id. at 419, 183 P.3d 181.

The court readily resolved the first question in the negative, based on its earlier precedents, particularly Zehr, 318 Or. at 656, 871 P.2d 1006, in which the court had held that "the threat of future harm, by itself, is insufficient as an allegation of damage in the context of a negligence claim," and Bollam v. Fireman's Fund Ins. Co., 302 Or. 343, 347, 730 P.2d 542 (1986), in which the court had quoted W. Page Keeton, Prosser & Keeton on Torts 165 (5th ed. 1984) for the proposition that "`[t]he threat of future harm, not yet realized, is not enough.'" Lowe II, 344 Or. at 410, 183 P.3d 181. Under the reasoning of those cases, the court explained, the plaintiff had failed to allege a cognizable injury for purposes of stating a negligence claim:

"Plaintiff has not alleged that her exposure to defendants' products has resulted in any present physical effect, much less any present physical harm. Nor has she alleged that any future physical harm to her is certain to follow as a result of that exposure. Rather, she has alleged only that her exposure to defendants' products has significantly increased the risk that she will contract lung cancer sometime in the future. It is sufficient for the purposes of this case to hold only that, under Zehr and Bollam, the threat of future physical harm that plaintiff has alleged is not sufficient to give rise to a negligence claim."

Id. at 411, 183 P.3d 181.

The court then turned to the second issue—which most significantly bears on our analysis here—that is, whether, as the plaintiff argued, the economic cost of ongoing medical monitoring was a sufficient injury to provide a basis for a negligence claim. The court held that it was not, invoking the principle of Oregon negligence law that "[o]ne ordinarily is not liable for negligently causing a stranger's purely economic loss," but, rather, "liability for purely economic harm must be predicated on some duty of the negligent actor to the injured party beyond the common law duty to exercise reasonable care to prevent foreseeable harm." 344 Or. at 413, 183 P.3d 181 (internal quotation marks omitted; bracketed material in original). Because the plaintiff had not identified any such duty, the court held that the alleged economic harm—that is, the cost of medical screening—was not a sufficient injury for purposes of stating a claim for negligence. Id. at 413-14, 183 P.3d 181.^[3]

Here, plaintiffs have not alleged any physical injury, or even, as in Lowe, the threat of future physical injury. Rather, aside from their claim for emotional distress damages, which we address separately below, plaintiffs' claims allege purely economic loss without any injury to persons or property. As described above, the complaint alleges that plaintiffs "suffered financial injury" related to the costs of credit-monitoring services, notification, and fraud alerts, and possible future costs of repair of identity theft— similar to the damages for medical monitoring alleged by the plaintiff in Lowe. Thus, as the Supreme Court re-emphasized in Lowe II, to state a legally sufficient claim for negligence, plaintiffs must, at the least, identify a duty that defendant owed them—beyond the common-law duty to exercise reasonable care—to guard against that economic harm. 344 Or. at 413-14, 183 P.3d 181; see also Hale v. Groce, 304 Or. 281, 284, 744 P.2d 1289 (1987) ("It does not suffice that the harm is a foreseeable consequence of negligent conduct that may make one liable to someone else, for instance to a client. Some source of a duty outside the common law of negligence is required." (Citations omitted.)).

The existence of such a duty arises from the nature of the parties' relationship. Onita Pacific Corp. v. Trustees of Bronson, 315 Or. 149, 160, 843 P.2d 890 (1992) ("To resolve [whether the defendants owed the plaintiffs a duty to exercise reasonable care in communicating factual information to prevent economic losses to the plaintiffs], we examine the nature of the parties' relationship and compare that relationship to other relationships in which the law imposes a duty on parties to conduct themselves reasonably, so as to protect the other parties to the relationship."). In Conway v. Pacific University, 324 Or. 231, 240, 924 P.2d 818 (1996), the court further explained:

"In Onita, this court described the relationships summarized above [that is, those giving rise to the requisite heightened duty of care] as those in which the party who owes a duty of care is acting, `at least in part, * * * to further the economic interests of the "client," the person owed the duty of care.' 315 Or. at 161, 843 P.2d 890. Another way to characterize the types of relationships in which a heightened duty of care exists is that the party who owes the duty has a special responsibility toward the other party. This is so because the party who is owed the duty effectively has authorized the party who owes the duty to exercise independent judgment in the former party's behalf and in the former party's interests. In doing so, the party who is owed the duty is placed in a position of reliance upon the party who owes the duty; that is, because the former has given responsibility and control over the situation at issue to the latter, the former has a right to rely upon the latter to achieve a desired outcome or resolution.

"This special responsibility exists in situations in which one party has hired the other in a professional capacity, as well as in principal-agent and other similar relationships. It also exists in the type of situation described in Georgetown Realty [v. The Home Ins. Co., 313 Or. 97, 831 P.2d 7 (1992)], in which one party has relinquished control over the subject matter of the relationship to the other party and has placed its potential monetary liability in the other's hands. In all those relationships, one party has authorized the other to exercise independent judgment in his or her behalf and, consequently, the party who owes the duty has a special responsibility to administer, oversee, or otherwise take care of certain affairs belonging to the other party."

(Emphasis in original.)

As in Lowe, plaintiffs here have failed to identify any such heightened duty of care to protect against economic harm arising out of the relationship between themselves as patients and defendant as a health care provider, and, indeed, they never squarely address the question at all. To the extent they argue that federal and state laws protecting the confidentiality of health information establish that duty, we disagree.^[4] Although we agree that those statutes and rules establish standards of conduct, any violation of those standards does not give rise to a negligence per se claim for economic damages in the absence of a special relationship that protects against that type of injury. Thus, as in Lowe II, plaintiffs have failed to allege a legally sufficient claim for negligence as a result of the economic damages that they have allegedly incurred (or will incur) in protecting against the increased risk of identity theft that they face as a result of the theft of their medical records.

Plaintiffs' claim for emotional distress damages presents a related, but slightly different question. The complaint alleged that

"plaintiffs and class members have suffered non-economic damages in the past and will do so in the future in the form of * * * worry and emotional distress associated with the initial disclosure and the risk of any future subsequent identify theft, all to their non-economic damage in amounts to be proved at trial."

(Emphasis added.)

Negligent infliction of emotional distress may be actionable without physical injury if the negligent conduct infringed on an interest beyond those that are protected under the general obligation to exercise reasonable care to prevent foreseeable harm. Hammond v. Central Lane Communications Center, 312 Or. 17, 23, 816 P.2d 593 (1991). Here, plaintiffs argue that they adequately pleaded an entitlement to emotional distress damages as a result of the special relationship between patients and medical providers. Plaintiffs point to the "common law recognition of the nature of the relationship, legislative enactments evincing the fundamental nature of confidentiality and the special relationship between patient and physician, federal regulations, and evidentiary privileges" as giving rise to that special relationship. (Footnotes omitted.)^[5]

We begin with Humphers v. First Interstate Bank, 298 Or. 706, 696 P.2d 527 (1985), which, in turn, implicates ORS 677.190(5). In Humphers, the plaintiff, a mother who had placed her daughter for adoption, brought an action against the physician who had attended the birth of the daughter, seeking emotional distress damages for the physician's conduct in later helping to reveal the mother's identity to the daughter. The Supreme Court held that, "if [the] plaintiff has a claim, it arose from a breach by [the physician] of a professional duty to keep [the plaintiff's] secret rather than from a violation of [the] plaintiff's privacy." Id. at 709, 696 P.2d 527. The court reasoned:

"A physician's duty to keep medical and related information about a patient in confidence is beyond question. It is imposed by statute. ORS 677.190(5) provides for disqualifying or otherwise disciplining a physician for `willfully or negligently divulging a professional secret.' * * * The actionable wrong is the breach of duty in a confidential relationship[.]

"* * * Given [the constraints of other statutes that seek to preserve the secrecy of adoption records], there is no privilege to disregard the professional duty imposed by ORS 677.190(5) solely in order to satisfy the curiosity of the person who was given up for adoption."

Id. at 720-21, 696 P.2d 527. The court thus concluded that the plaintiff had a cognizable "claim of breach of confidentiality in a confidential relationship." Id. at 721, 696 P.2d 527. However, as defendant points out, that claim was based on the affirmative—rather than negligent—disclosure of confidential information, which plaintiffs here do not allege.

In Stevens v. First Interstate Bank, 167 Or.App. 280, 286, 999 P.2d 551, rev. den., 331 Or. 429, 26 P.3d 148 (2000), we confirmed that a claim for "breach of confidentiality," such as that alleged in Humphers, is indeed predicated on the affirmative disclosure of confidential information. In Stevens, bank depositors brought an action against a bank for breach of confidentiality, alleging emotional distress and anxiety as a result of a bank employee's misappropriation of the depositors' personal and credit information. On appeal of the trial court's grant of summary judgment for the bank, we noted that the case did not involve the bank's (or its agent's) affirmative disclosure or misappropriation of information, nor did it involve a claim for damages other than emotional distress damages. Rather, it posed the following narrow question:

"Where a third party misappropriates personal or credit information that a depositor had provided to a bank, and that misappropriation is the result of the bank's failure to adequately protect the information from such misappropriation, is the bank liable for the depositor's resulting emotional distress?"

Id. at 285-86, 999 P.2d 551. So framed, we held that the plaintiffs could not sustain a claim for "breach of confidentiality." Citing, among other authorities, Humphers, 298 Or. at 717-19, 696 P.2d 527, we reasoned:

"The gravamen of the tort of breach of confidentiality, in Oregon and nationally, is the affirmative disclosure of information by a person to whom the confidential information has been entrusted. * * * Plaintiffs identify no authority—and we have found none—that expands the tort to impose liability where the defendant has not affirmatively disclosed the `entrusted' or `confidential' information. We decline to do so."

Stevens, 167 Or.App. at 286, 999 P.2d 551 (emphasis in original; and additional citations omitted).

In this case, it is undisputed that plaintiffs' complaint does not allege that defendant affirmatively disclosed plaintiffs' confidential information. In fact, plaintiffs' allegations here are remarkably similar to those in Stevens, namely, that defendant failed to adequately protect plaintiffs' confidential information from misappropriation, and, as a result, they suffered "worry and emotional distress." Thus, contrary to plaintiffs' assertion, neither Humphers nor the "physician duty of confidentiality" prescribed in ORS 677.190(5) supports plaintiffs' position that they would be entitled to recover in negligence for emotional distress damages suffered as a result of defendant's conduct.

However, our analysis in Stevens did not end with breach of confidentiality. Rather, notwithstanding the failure of that claim, we did not foreclose the possibility of recovery under a common-law negligence theory if, as we explained, the plaintiffs could demonstrate that their relationship with the bank "gave rise to some distinct `legally protected interest'" beyond those protected by generic, common-law foreseeability. 167 Or.App. at 286-87, 999 P.2d 551 (citing Nearing v. Weaver, 295 Or. 702, 708, 670 P.2d 137 (1983), and Fazzolari, 303 Or. at 17, 734 P.2d 1326). We ultimately rejected the plaintiffs' contention that the relationship between the plaintiffs, as depositors, and their bank satisfied that requirement, reasoning that

"the depositor-bank relationship is, in our view, more analogous to a merchant-customer relationship in which the customer, in transacting a credit card or other noncash purchase, provides certain information to the merchant. There, as here, the relationship is at arm's length, to achieve a specific economic end, and does not require the merchant to exercise independent judgment on the customer's behalf."

Id. at 287-88, 999 P.2d 551 (citations and omitted).^[6]

Significantly, in reaching that conclusion, we distinguished our earlier decision in Banaitis v. Mitsubishi Bank, Ltd., 129 Or.App. 371, 879 P.2d 1288 (1994), rev. dismissed, 321 Or. 511, 900 P.2d 508 (1995). Similar to this case, in Banaitis, there were federal and state statutes protecting the information at issue from disclosure, for example, the federal Right to Financial Privacy Act of 1978, 12 U.S.C. §§ 3401-3422; the federal Freedom of Information Act, 5 U.S.C. § 552; and various state criminal statutes "reflect[ing] a public interest in protecting the confidentiality of commercial financial records." 129 Or. App. at 378, 879 P.2d 1288. As we observed in Stevens, however, those statutes "pertain[ed] to a bank's obligation of nondisclosure" —thus, supporting the availability of a breach of confidentiality claim in the face of an unauthorized affirmative disclosure of a customer's financial information—and did not "give[] rise to a distinct `legally protected interest,' transcending a common law duty of due care, to protect depositors' financial information from tortious misappropriation by third parties." 167 Or.App. at 290, 999 P.2d 551 (emphasis in original).

Plaintiffs nonetheless insist that there are "critical differences between medical patient information and bank customer information" and that "[t]he nature of the underlying injury—disclosure of patient confidences—distinguishes this case from the litany of financial cases on which [defendant] relies." Plaintiffs fail, however, to identify those critical differences or explain why they compel a different result under the Conway construct. Specifically, plaintiffs fail to explain why the relationship between a medical provider and its patient gives rise to a duty on behalf of that provider to protect patient information from disclosure beyond the generic common-law duty to take reasonable steps to protect against foreseeable harm—in other words, why that relationship creates a legally protected interest in having defendant guard patients from the possibility of emotional distress caused by the loss of their personal medical information through theft.

To the extent that plaintiffs' argument implicates the physician-patient relationship as a source for the heightened standard of care necessary to recover emotional distress damages, prior case law from this court and the Supreme Court does not support that view. Curtis v. MRI Imaging Services II, 327 Or. 9, 956 P.2d 960 (1998), is particularly instructive. The issue there was whether the plaintiff could recover damages from medical providers for purely psychological injuries that allegedly resulted from a negligently performed diagnostic test.^[7] The trial court granted the defendants' motion for judgment on the pleadings, rejecting the plaintiff's argument that defendants had invaded a "legally protected interest" that arose out of the relationship between the defendants as medical providers and the plaintiff as patient.

The Supreme Court disagreed, concluding that the plaintiff had adequately pleaded a claim for relief.^[8] The court explained:

"[W]hen the claim is that a medical practitioner breached a professional duty to guard against a specified medical harm, the fact that that harm is psychological rather than physical is not a bar to liability. Our holding should not be read to mean that medical professionals operate under a general duty to avoid any emotional harm that foreseeably might result from their conduct. In that regard, their duty is no greater than that of the population at large. But, where the standard of care in a particular medical profession recognizes the possibility of adverse psychological reactions or consequences as a medical concern and dictates that certain precautions be taken to avoid or minimize it, the law will not insulate persons in that profession from liability if they fail in those duties, thereby causing the contemplated harm."

327 Or. at 15-16, 956 P.2d 960 (emphasis added). Thus, as the court emphasized, "a medical professional may operate under a standard of care that includes a specific duty to be aware of and guard against particular adverse psychological reactions or consequences to medical procedures." Id. at 14-15, 956 P.2d 960.

We applied that principle in Rustvold v. Taylor, 171 Or.App. 128, 14 P.3d 675 (2000), rev. dismissed, 332 Or. 305, 37 P.3d 147 (2001). In that case, the plaintiff brought an action for medical malpractice and negligent infliction of emotional distress against medical providers, including an anesthesiologist and a hospital, after she was given medicine using a syringe that may have been used with another patient. She claimed to have experienced emotional distress as a result, based on her fear of contracting blood-borne diseases, such as Hepatitis B or HIV. Id. at 130, 14 P.3d 675. The plaintiff argued that the trial court had erred in entering a summary judgment dismissing her claim for negligent infliction of emotional distress, among other theories, because her relationship with her medical providers created a legally protected interest—that is, a duty on behalf of those providers to protect her from all consequences of their negligence—that was invaded by the defendants' conduct. Id. at 137, 14 P.3d 675.

We held that the plaintiff had failed to establish the existence of a duty—apart from the duty to avoid foreseeable risk of harm— necessary to satisfy the exception to the requirement that there be evidence of concomitant physical injury in order to recover for psychological distress. In doing so, we rejected the plaintiff's argument that the mere fact of the physician-patient relationship itself establishes that duty, holding that, although that relationship "can include a specific duty the violation of which may support a claim for negligent infliction of emotional distress" it does not "always * * * include such a specific duty." Id. at 138-39, 14 P.3d 675 (emphasis in original). We concluded that the plaintiff had failed to provide evidence of such a specific duty—that is, the plaintiff had failed to establish the existence of "`a standard of care that includes a specific duty to be aware of and guard against [the] particular psychological reactions or consequences'" the plaintiff allegedly suffered. Id. at 135, 14 P.3d 675 (quoting Curtis, 327 Or. at 14-15, 956 P.2d 960) (emphasis added).

This case suffers from an analogous deficiency. Here, plaintiffs have failed to identify an independent standard of care that includes the duty to guard against the specific harm they allege—viz., the emotional trauma associated with the loss of personal medical information as a result of theft.

In sum, plaintiffs have failed to identify a duty defendant owes them, beyond the duty to exercise reasonable care, sufficient to support a claim in negligence for economic damages. Plaintiffs have also failed to state a claim in negligence for their emotional distress damages because they do not allege an affirmative disclosure by defendant of their confidential personal and medical information, nor do they allege facts sufficient to support an inference of a specific professional duty by defendant to protect against emotional distress caused by the theft of that information. Thus, on this record, the trial court did not err in dismissing plaintiffs' negligence claim.

B. Plaintiffs' Unlawful Trade Practices Act Claim

Subject to an exception not applicable here, under the UTPA,

"any person who suffers any ascertainable loss of money or property, real or personal, as a result of willful use or employment by another person of a method, act or practice declared unlawful by ORS 646.608, may bring an individual action in an appropriate court to recover actual damages or $200, whichever is greater. The court or the jury, as the case may be, may award punitive damages and the court may provide the equitable relief the court considers necessary or proper."

ORS 646.638(1) (2005).^[9] Plaintiffs here alleged that defendant had violated ORS 646.608(1)(e) and (g), which provide:

"(1) A person engages in an unlawful practice when in the course of the person's business, vocation or occupation the person does any of the following:

"* * * * *

"(e) Represents that real estate, goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, quantities or qualities that they do not have * * *.

"* * * * *

"(g) Represents that real estate, goods or services are of a particular standard, quality, or grade, or that real estate or goods are of a particular style or model, if they are of another."

In particular, plaintiffs alleged that defendant violated those provisions by representing that "all information gathered to sell its services or goods would be safeguarded and kept confidential when it knew that it lacked adequate means to safeguard such information" and that "the business of sale of services and goods would include privacy and confidentiality when it knew that the transactions were not confidential due to its inadequate data protection program." As we understand it, plaintiffs' theory is that, as a provider of medical services to which state and federal confidentiality laws apply, defendant represented, in offering medical services and products for sale, that it would keep patients' private information confidential. Because defendant did not have procedures and practices in place to protect against the loss by theft of that information, patient records did not have that characteristic of confidentiality and, thus, defendant's services were not of the standard or quality represented.

The trial court granted defendant's motion to dismiss plaintiffs' claim, stating in its order only that "the damages prayed for [are] not compensable under Oregon law. See Lowe v. Philip Morris USA, Inc., 207 Or. App. 532[, 142 P.3d 1079 (2006), aff'd, 344 Or. 403, 183 P.3d 181 (2008)]." That statement suggests that the trial court dismissed plaintiffs' UTPA claim for failure to allege recoverable damages under the UTPA—that is, that plaintiffs failed to allege an "ascertainable loss" as a "result of" defendant's alleged misrepresentations. ORS 646.638(1).

Plaintiffs contest that ruling, arguing that they properly alleged "ascertainable loss" in the form of out-of-pocket expenses incurred for "credit monitoring services, credit injury, postage, long distance and time loss from employment." Defendant, on the other hand, contends that plaintiffs suffered no loss for the same reason that it believes their negligence claim fails—meaning, presumably, because any expenses incurred were in anticipation of preventing future harm, not the result of an existing harm. The trial court's reference to Lowe I—which did not address the UTPA—suggests the same.

We agree with the trial court. The question is whether plaintiffs have adequately pleaded "any ascertainable loss" as "a result of" defendant's alleged misrepresentation with respect to the confidentiality of patient records. "Ascertainable" means "capable of being discovered, observed, or established." Scott v. Western Int. Sales, Inc., 267 Or. 512, 515-16, 517 P.2d 661 (1973). Plaintiffs' alleged out-of-pocket expenses are themselves certainly "capable of being discovered, observed, or established"; in other words, they are "ascertainable." However, that does not answer the question whether those expenses represent a "loss" for purposes of the UTPA, that is, whether plaintiffs have alleged a "loss of money or property" as "a result of" the alleged misrepresentation.

"What the legislature meant by an `ascertainable loss of money or property' is not free from doubt."^[10]Weigel v. Ron Tonkin Chevrolet Co., 298 Or. 127, 133, 690 P.2d 488 (1984). Under the typical UTPA scenario, the loss is evidenced by the difference in value between the product as represented by the defendant and as actually received by the plaintiff. See, e.g., Weigel, 298 Or. at 137, 690 P.2d 488 (difference in value between car sold as "new" and one that had previously been sold and returned to the dealer); Crooks v. Pay Less Drug Stores, 285 Or. 481, 592 P.2d 196 (1979) (difference between a razor's advertised price and its actual sale price); Byers v. Santiam Ford, Inc., 281 Or. 411, 574 P.2d 1122 (1978) (difference in value between new car and one driven as a demonstrator, damaged in an accident, and repaired before being sold as "new"); Scott, 267 Or. at 516, 517 P.2d 661 (difference in value between a tent that had merely a vent and was therefore worth less than a tent represented as having a zippered window); see also Feitler v. The Animation Celection, Inc., 170 Or.App. 702, 713, 13 P.3d 1044 (2000) (to obtain promised feature of exclusivity of drawing collection, the plaintiff would have had to purchase drawings that the defendant withheld; thus, the plaintiff incurred "ascertainable loss"). The recoverable losses in each of those cases have the features of representing essentially the difference in value between what the plaintiff paid for and what the plaintiff received.

Here, plaintiffs do not allege such a difference in value.^[11] Rather, the thrust of plaintiffs' allegations is that, as a result of defendant's violation of the UTPA, they have been threatened with a loss of money or property due to the theft of their financial data, and they seek to recover damages for money that they have spent to forestall those threatened losses.

Although not directly on point, Gemignani v. Pete, 187 Or.App. 584, 71 P.3d 87, rev. den., 336 Or. 16, 77 P.3d 319 (2003), is helpful in understanding that the UTPA's contemplation of recovery for "ascertainable loss * * * as a result of" an allegedly unlawful practice is not without its limits. There, the plaintiffs, two couples who had contracted with the defendant to construct their homes, claimed that the defendant had misrepresented that their homes were free and clear of any liens or encumbrances by delivering warranty deeds stating as much, when, in fact, title was encumbered by a trust deed securing a line of credit to the defendant. One couple ultimately lost their home to the bank as a result. However, we held that that loss did not flow from any misrepresentations in the warranty deed but, instead, was the result of the bank's prior lien:

"By the time of the delivery of the [warranty] deed, they already had made all the required payments. Whether the deed warranted clear title or not, they still would have lost their home to the bank. Thus, the loss of their home was not an ascertainable loss within the meaning of the UTPA."

Id. at 591, 71 P.3d 87. Similarly, we rejected the plaintiffs' claim for attorney fees incurred in the defendant's subsequent bankruptcy proceedings, on the basis that their participation in those proceedings was "occasioned," not by the misrepresentations in the deed, but by the existence of the bank's lien. Id.

Here, too, we fail to understand how the money expended by plaintiffs is a loss occasioned by the alleged UTPA violations. In short, rather than allege a loss of money or property as a result of defendant's misrepresentations, plaintiffs' complaint alleges out-of-pocket expenses to prevent a potential loss of money or property (through identity theft) that might result from the misrepresentations. Plaintiffs have directed us to no authority—and we are aware of none—for the proposition that such a "once removed" loss is a loss covered under the UTPA. We conclude that the money spent to prevent a potential ascertainable loss under the UTPA is not itself an "ascertainable loss of money or property, real or personal, as a result of" a violation of the statute.

III. CONCLUSION

In conclusion, we agree with the trial court that plaintiffs failed to state a legally sufficient claim for negligence or under the UTPA. The trial court properly granted defendant's motion to dismiss.

Affirmed.

NOTES

[1] Relevant provisions of the UTPA are set out in full below; in general, the act authorizes an individual action for damages and equitable relief by a person who has "suffer[ed] any ascertainable loss of money or property" as a result of an unlawful trade practice. ORS 646.638(1) (2005) (see 237 Or.App. 584 at 600 n. 9, 240 P.3d 1110 at 1120 n. 9).

[2] The Supreme Court issued its opinion (Lowe II) affirming our decision in Lowe I after the trial court had granted defendant's motions and dismissed plaintiffs' complaint.

[3] The court explicitly declined the plaintiff's suggestion that it should reconsider those "well-established" requirements of Oregon negligence law so that the defendants would be required to bear the costs of medical monitoring, consistently with the law of some other jurisdictions. The court noted that there were well-reasoned arguments on both sides of the issue but that they did not provide a basis for overruling the Oregon cases that had established Oregon's requirements. Lowe II, 344 Or. at 414-15, 183 P.3d 181.

[4] In the context of their negligence per se claim, plaintiffs refer to a standard of care established by those provisions. Specifically, they refer to ORS 192.518(1)(a), which states that "[i]t is the policy of the State of Oregon that an individual has [t]he right to have protected health information of the individual safeguarded from unlawful use or disclosure," and ORS 192.520, which governs the authorized uses or disclosures of that information. They also cite 45 C.F.R. § 164.306, authorized under the federal Health Insurance Portability and Accountability Act of 1996 (HIPPA). Among other things, that regulation requires "[c]overed entities" to "[e]nsure the confidentiality, integrity, and availability of all electronic protected health information the covered entity creates, receives, maintains, or transmits," and to "protect against any reasonably anticipated" threats to the security or unauthorized disclosure of that information. 45 C.F.R. § 164.306(a)(1)-(3).

[5] In particular, in addition to ORS 192.518 and 45 C.F.R. § 164.306 (described above, 237 Or. App. at 593 n. 4, 240 P.3d at 1115-16 n. 4), plaintiffs cite Humphers v. First Interstate Bank, 298 Or. 706, 696 P.2d 527 (1985); ORS 677.190(5) (authorizing the suspension or revocation of a license to practice medicine for "[w]illfully or negligently divulging a professional secret without the written consent of the patient"); OEC 504-1 (establishing physician-patient privilege); and OEC 504-2 (establishing nurse-patient privilege).

[6] The framework for that analysis, as we noted, was set out in Conway, 324 Or. at 241, 924 P.2d 818, which is quoted above. 237 Or.App. at 591-93, 240 P.3d at 1115.

[7] Specifically, the plaintiff alleged severe emotional distress resulting from the defendants' failure to (1) properly explain the nature of an MRI procedure, particularly its possible claustrophobic effects; (2) take an adequate history of his preexisting asthmatic condition; (3) properly monitor him during the procedure; and (4) terminate the procedure when he complained of breathing difficulties. Curtis, 327 Or. at 11, 956 P.2d 960.

[8] The court concluded that it need not decide whether, as the parties had argued it, "negligent infliction of emotional distress is the relevant claim," because the plaintiff had adequately pleaded a claim for relief based on "medical malpractice." Curtis, 327 Or. at 16, 956 P.2d 960. Subsequently, in Rathgeber v. James Hemenway, Inc., 335 Or. 404, 416, 69 P.3d 710 (2003), the court recognized that the analytical framework for the two types of claims may differ. There, the pleadings alleged a breach of fiduciary duty by a real estate professional, which, the court concluded, was essentially a claim for "real estate professional malpractice" to which the Curtis analysis applied. Id. at 417, 69 P.3d 710. The court concluded that, as with medical professionals, real estate professionals "do not have the general duty to protect against emotional harm," and, because the plaintiffs did not plead a "standard of care [governing the professional's conduct] that includes the duty to protect a client from emotional harm," the trial court erred in not striking the plaintiffs' allegation of emotional distress damages. Id. at 418, 69 P.3d 710.

[9] The statute has since been amended. Or. Laws 2009, ch. 327, § 1; Or. Laws 2009, ch. 552, §§ 6-7. Those amendments are inapplicable in this case.

[10] It is clear that the magnitude of the loss is not dispositive. As the court explained in Weigel, the text of the UTPA as a whole—including the $200 statutory damages provision—suggests that,

"in enacting ORS 646.638, the legislature was concerned as much with devising sanctions for the prescribed standards of trade and commerce as with remedying private losses, and that such losses therefore should be viewed broadly. The private loss indeed may be so small that the common law likely would reject it as grounds for relief, yet it will support an action under the statute."

298 Or. at 135-36. That does not speak, however, to the core of the question presented here: whether plaintiffs have alleged a recoverable loss at all. The parties did not present any legislative history indicating the legislature's intent with respect to that question, nor have we discovered any. See State v. Gaines, 346 Or. 160, 172, 206 P.3d 1042 (2009) (in determining the meaning of a statute, appellate court may consider legislative history proffered by the parties, if useful).

[11] In their brief on appeal, plaintiffs state, without elaboration, "Also, when defendant offered medical services that lacked proper confidentiality features, the services were worth less than the amounts charged." However, plaintiffs failed to include that allegation in their complaint; accordingly, we do not consider it.