Decision and Order Appealed From, dated February 17, 2012 [pp. - Case Document 17 Filed 02/17/12 Page1 of 22 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF NEW YORK JOHN DOE, Plaintiff, v. DECISION and ORDER GUTHRIE CLINIC, GUTHRIE GUTHRIE HEALTHCARE GUTHRIE HEALTH PLAN, GUTHRIE CLINIC GUTHRIE CLINIC, A PROFESSIONAL GUTHRIE CLINICS GROUP PRACTICE PARTNERSHIP, GUTHRIE MEDICAL GROUP, GUTHRIE ENTERPRISES, TWIN TIER MANAGEMENT CORPORATION, Defendants. INTRODUCTION Plaintiff John Doe, has been granted permission to proceed in this action under a fictitious name to protect his privacy interests. Doe brings this action against the defendants (collectively ?Guthrie? or ?the Guthrie defendants?) claiming that they violated several common law and statutory duties when a nurse at a medical clinic where plaintiff was being treated revealed private personal health information to Doe?s girlfriend regarding Doe's treatment for a sexually transmitted disease The nurse, who was related by marriage to Doe?s girlfriend, sent several text. messages to Doe?s girlfriend. when Doe was being treated for the STD at the Guthrie Clinic Steuben, a private medical clinic located in the city of Corning, New York, in Steuben Case Document 17 Filed 02/17/12 Page 2 of 22 County. Neither Guthrie Clinic Steuben nor the nurse who revealed plaintiff?s information are defendants in this action. In eight causes of action, Doe claims that the defendants: breached their duty of confidentiality to him; violated New York State Public Health and Civil Practice laws; engaged in negligent or intentional infliction of emotional distress; and negligently hired or retained the nurse who wrongfully disclosed plaintiff?s private health information. Defendants deny Doe?s charges, and nmve t1) dismiss his Complaint in its entirety. The defendants contend that plaintiff has failed to state a claim for any breach of confidentiality because Doe has failed to allege a knowing breach of confidentiality by any named defendant. While defendants concede for purposes of this motion that the nurse who disclosed Doe?s condition may have violated a duty of confidentiality, they claim that the named defendants did not knowingly violate any duty they may have owed Doe. Defendants further argue that there is no private cause of action under the New York State statutes asserted by the plaintiff. Finally, defendants contend that plaintiff has failed to state a cause of action for negligent or intentional infliction of emotional distress, or negligent hiring. Plaintiff opposes defendants? motion, and claims that he has stated valid causes of action with respect to all of his claims. For the reasons set forth below, however, I find that plaintiff has Page-2- A-44 Case Document 17 Filed 02/17/12 Page 3 of 22 failed to state any ?valid. cause of action against the named defendants, and therefore, I grant defendants? motion to dismiss. BACKGROUND The following facts are taken from the plaintiff?s complaint, and are assumed 1x3 be true for purposes of this motion. In approximately February, 2010, plaintiff was diagnosed. with a: sexually transmitted disease. He was referred 1x3 the Guthrie Clinic Steuben, a pmivate medical practice located in Steuben County, New York, for specialized treatment of his condition. On July 1, 2010, Doe arrived at the Guthrie Clinic Steuben for treatment of his STD. Magan Stalbird (?Stalbird?), a nurse employed at the clinic, recognized Doe as the boyfriend of her sister?in-law Jessica1 (?Jessica?), and without authorization or any medical treatment purpose, accessed Doe?s medical records for the purpose of determining the reason for his visit. Once Stalbird learned that Doe was being treated for an STD, and while Doe was still awaiting treatment in the office, she sent at least six text messages to Jessica. informing' Jessica. of' Doe?s condition, and allegedly mocking and ridiculing Doe. Jessica forwarded Stalbird?s messages to Doe while he waited for his treatment, and according to Doe, the messages suggested that Stalbird and other staff members were making fun of his medical condition. Jessica?s last name is not identified in the Complaint. Page-3- Case Document 17 Filed 02/17/12 Page 4 of 22 According to the Complaint, on July 6, 2010, five days after his visit to the Clinic, Doe called ?the Guthrie Defendants? to complain of Stalbird?s behavior.2 Based on Doe's allegations, an administrator named ?Mike? set up a meeting with Doe to discuss the incident. Although Doe alleges that Mike ?showed little interest in helping [him] resolve the problem of Guthrie Health's breach? (Complaint at 28) it is undisputed that within one day of Doe?s meeting with Guthrie, Stalbird was fired from her employment. Thereafter, on July 12, 2010, Dr. Joseph A. Scopelliti, the President and CEO of Guthrie Clinic, Ltd., sent a letter to Doe explaining that there had been a tweach of Doe?s confidential health information, that appropriate disciplinary actions had been taken, and that steps had been taken to prevent such a breach from occurring in the future. On July 9, 2010, approximateLy 2 days after Stalbird was fired, Jessica received a text from her brother Greg Space (Stalbird?s husband) in which he allegedly threatened Doe?s life, and warned the two of them to ?Leave Magan the fuck alone.? Complaint at 30. Based on the phone call, Doe filed a criminal complaint against Greg Space, and sought an order of protection against him. 2 It is not clear which, if any of the defendants Doe contacted. ?Guthrie Clinic Steuben,? where the incident occurred, is not a named defendant, and plaintiff fails to identify which of the 9 named defendants he called. Page~4- A-40 Case Document 17 Filed 02/17/12 Page 5 of 22 DISCUSSION I. Motion to Dismiss Standard In reviewing a motion to dismiss pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure, the Court must factual allegations i1) the complaint and reasonable inferences in the plaintiff?s favor.? See Ruotolo v. City of New 514 F.3d 184, 188 (2d Cir.2008) (internal quotation marks omitted). In order to withstand dismissal, the complaint must plead ?enough facts to state a claim to relief that is plausible on its face.? See Bell Atl. Corp. V. Twomblv, 550 U.S. 544, 127 1955, 1974 (2007) (disavowing the oft-quoted statement from Conley v. Gibson, 355 U.S. 41 (1957), that ?a complaint should not be dismissed for failure to state a claim unless it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief?). ?While a complaint attacked by a Rule 12(1)) (6) motion to dismiss does not need detailed factual allegations, a plaintiff?s obligation to provide the grounds of his entitlement to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.? See id; at 1965 (internal quotation marks omitted). Moreover, conclusory allegations are not entitled to any assumption of truth, and therefore, will not support a finding that the plaintiff has stated a valid claim. Hayden v. Patterson, 594 F.3d 150, 161 (2mi Page-5? Case Document 17 Filed 02/17/12 Page 6 of 22 Circ., 2010). Thus, ?at a bare minimum, the operative standard requires the ?plaintiff [to] provide the grounds upon which his claim rests through factual allegations sufficient to raise a right to relief above the speculative level.?? See Goldstein v. Pataki, 516 F.3d 50, 56-57 (2d Cir.2008) (quoting Twomb y, 127 at 1974). II. Common Law Claims A. Breach of Fiduciary Duty Plaintiff alleges that the defendants, as fiduciaries, owed a duty of confidentiality to him, and that they breached this duty by disclosing his confidential health information. ?To state a claim for breach of fiduciary duty, plaintiff must allege the existence of a :fiduciary' relationship; (2) a knowing breach of a duty that relationship imposes; and (3) damages suffered.?? Trautenberq V. Paul, Weiss, Rifkind, Wharton Garrison L.L.P. 351 Fed.Appx. 472, 474 Cir., 2009)(quotinq Carruthers V. Flaum, 388 F.Supp.2d 360, 381 (S.D.N.Y.2005). In the instant case, plaintiff has named nine separate corporate entities as defendants, but has only alleged in a conclusory manner that each of the defendants owed the plaintiff a fiduciary duty. Specifically, as the basis for the alleged duty, Doe claims that each named defendant ?own[s], possess[es], operat[es], staff[s] and/or otherwise control[s] Guthrie Clinic Steuben in conjunction with the other Guthrie Defendants?, and Page?6- Case Document 17 Filed 02/17/12 Page 7 of 22 therefore owes a duty to Doe for actions taken by Guthrie Clinic Steuben. Complaint at 5, 6, 7, 8, 9, 10, ll, 12, 13, 14. There are no allegations specific to each defendant explaining the basis for any duty owed by that particular defendant to the plaintiff other than the alleged ownership, possession, operation, staffing, or control of the Clinic by the named defendants. Accordingly, I find that plaintiff has failed to establish that any of the named defendants owed a fiduciary duty to keep his information confidential. Plaintiff contends, however, that at least one of the defendants, Guthrie Clinic, Ltd, admitted that it owed a duty to the defendant, and that it breached that duty when the President and CEO of Guthrie Clinic sent plaintiff a letter explaining that Doe?s personal information had been improperly accessed and disclosed, and that Doe should take steps to ensure that his identity was not being used unlawfully. Without deciding whether Guthrie Clinic?s notification to Doe that his information had been improperly accessed and disseminated constitutes an admission that it owed a fiduciary duty to Doe to keep his information confidential, I find that even if the defendant did owe such a duty, plaintiff has failed to allege that the Guthrie Clinic Ltd., or any defendant, violated a duty to keep plaintiff?s information confidential. Page-7- A-49 Case Document 17 Filed 02/17/12 Page 8 of 22 As stated above, to establish a breach of a fiduciary duty to keep information confidential, a plaintiff must establish a knowing breach of that duty. In the instant case, there is no allegation that any of the defendants breached any duty of confidentiality, or that they ch11 so knowingly. Rather, the allegations ii} the Complaint allege that Stalbird improperly accessed Doe?s information and improperly disseminated that information to Doe?s girlfriend. However, there is 1K) allegation that any of the defendants improperly yaccessed or disseminated plaintiff?s information, and thus plaintiff has failed to establish a breach by any of the defendants. Plaintiff alleges, however, that Stalbird was employed by one or more of the defendants, and therefore, the defendants may be held liable for her actions on a theory of vicarious liability or respondeat superior. I find that plaintiff has failed to establish that Stalbird's action can be attributed to her former employer, and therefore, plaintiff has failed to establish that any defendant can be held vicariously liable for the alleged breach of a duty to keep personal health information confidential. It is well established under common law that an employer may be held liable for the intentional or negligent acts of an employee where the employee was acting within the scope of his or her employment. Horvath v. Gardens, Inc., 932 184, 185 Page-8- A-DU Case Document 17 Filed 02/17/12 Page 9 of 22 (N.Y.A.D. 2 Dept., to the doctrine of respondeat superior, an employer can be held vicariously liable for torts committed by an employee acting within the scope of omitted). However, for liabilityixnattach to an employer, for either negligent or intentional acts taken by the employee, the conduct must be foreseeable and must occur within the scope of the employee?s employment. Id. While the question of whether or not an employee?s conduct was within his or her scope of employment presents questions of fact, such a determination can.be made as a matter of law where the facts are not in dispute, or where the facts alleged fail to establish that the conduct was within the scope of employment. Clark Street Wine and Spirits v. Emporos Systems Corp., 754 F.Supp.2d 474, 486 (E.D.N.Y., 2010) (citing Girden v. Sandals Intern., 262 F.3d 195, 205 (2d Cir.2001). In determining whether or not conduct was within the scope of employment, courts consider factors such as: (1) whether the employee's act fell within the discretion and control of the employer; (2) whether the employee acted under the express or implied authority of the employer; (3) whether the employee's act was in furtherance of the employer's interests; (4) whether the employee's acts were in the ?discharge of duty? to the employer; (5) whether the act was in execution of the employer's orders or part of the work assigned by the employer; and (6) whether the acts were ?so closely connected? with what the employee was hired to do, and ?so fairly and reasonably incidental to it, that they may be regarded as methods, even though quite improper ones, of carrying out the objectives of employment.? Page-9- Case Document 17 Filed 02/17/12 Page 10 of 22 E110 v. Singh, 531 F.Supp.2d 552, 582 (S.D.N.Y., 2007)(guoting Rausman v. Bauqh, 682 42, 43 (N.Y.A.D. 2nd., 1998)). Based on the factors set forth above, I find that Stalbird?s acts of accessing plaintiff?s medical records and then disseminating information about his medical condition to 'her husband's sister were not within the scope of her employment as a nurse at the Guthrie Clinic Steuben. There is no evidence or allegation that Stalbird took such steps on behalf of the clinic, or with the clinic?s authorization. Nor was plaintiff discharging her duty as a nurse when she revealed Doe?s personal information to her husband?s sister. Her conduct was not in furtherance of the clinic's business, and indeed, was in contravention of the clinic?s policies regarding confidentiality. Moreover, New York Courts have repeatedly stated that where an employee undertook conduct for personal reasons, or had personal motivations, the employee?s conduct can not be attributed to his or her employer. ?[TJhere is no respondeat superior liability for torts committed for personal motives unrelated to the furtherance of the employer's business.? Murray v. Watervliet City School 515 150, 152 (N.Y.A.D. 3rd., 1987); Elie, 531 F.Supp.2d at 582; Clark Street Wine and Spirits, 754 F.Supp.2d at 487 (citinq',ArtalVan, Inc. v. Kitridge ?Realty' Co., Inc., 860 100, 102 (lst Dep't 2008); Naeqele v. Archdiocese of New York, 833 79, 80 (let Dep't 2007); Yildiz V. PJ Food Page-10- A-DA Case Document 17 Filed 02/17/12 Page 11 of 22 Service, Inc., 918 572, 574 (N.Y.A.D. bears no vicarious liability where the employee committed the tort for personal motives unrelated to the furtherance of the employer's business.?) In this case, it is clear from the pleadings that Stalbird was acting out of personal motivations when she texted information about Doe?s STD to her sister~in?law, who was dating Doe at the time. Because Stalbird was acting based on personal motivations, without authorization from any of the defendants, and was not acting in furtherance of her employer's interests, I find that Stalbird?s actions can not.be imputed to Guthrie Clinic Steuben, or any of the defendants. Plaintiff contends however, that Stalbird?s actions can be attributed ix) the defendants as ea matter of law, because the corporate defendants can only act through its agents and employees. In support of this argument, plaintiff sites Doe v. Community Health Plan-Kaiser Corp., 709 215, 218 (N.Y.A.D. 3??1 Dept., 2000) in which the court held that: a medical corporation, can only act through its agents, servants or employees. Consequently, the duty owed plaintiff by [the defendant medical corporation] to protect patient confidences, if breached, makes [the defendant medical corporation] directly responsible. To hold otherwise would render meaningless the imposition of such a duty on a medical corporation, since the wrongful disclosure of confidential information would never be within the scope of the employment of its employees. Page?11? A-DJ Case Document 17 Filed 02/17/12 Page 12 of 22 According to the plaintiff, the Court in Egg abrogated. the traditional analysis of vicarious liability in situations involving unauthorized disclosure of health information, and enunciated armnv standard of strict liability for corporations in cases where its employees, without authorization, disclosed confidential health information. For the reasons set forth below, I decline to follow the standard set forth in Qgg. Initially, I note that the court?s justification for imposing liability on employers under any circumstances in which an employee, without authorization, disclosed confidential information, is flawed. The Egg court held that failure to impose strict liability on the employer would ?render meaningless the imposition of such a duty . . . .since the wrongful disclosure of confidential information would never be within the scope of the employment of its employees." Qge, 709 at 218. Such a conclusion, however, is erroneous. An employee could be directed by his or her employer to disclose personal health information, as in a case where another physician, or some other entity requests health information from the medical provider. If the request for information was not valid, the disclosure would be unauthorized, yet the employee would have provided the information with authorization from his or her employer, and in furtherance of the employer?s interests. This example illustrates how an employee could be acting within his or her scope of employment when engaging Page?12? Case Document 17 Filed 02/17/12 Page 13 of 22 in the unauthorized disclosure of health information, contrary to the Egg court?s assertion that wrongful disclosure of information would ?never? be within an employee?s scope of employment. Because the unauthorized disclosure of information could be attributable to a corporation via the traditional analysis of vicarious liability, I find that the Egg court's reasoning justifying the alteration of vicarious liability analysis is flawed, and need not be followed. Moreover, the determination of whether or not strict liability may be imposed on a party is a question properly left to legislatures, not courts. See Sanatass v. Consolidated Investinq' Co., Inc., 887 1125, 1131 (N.Y., modification to . . . strict liability statute must be made by the Legislature, not this Court?); Affiliated FM Ins. Co. v. Trane Co., 831 F.2d 153, 155 (7??Circ., the principles of Erie in mind, plus the clear pronouncement from the Wisconsin Supreme Court to defer to the legislature, we decline to expand strict liability law . . . Bierman v. Consolidated Edison Co. of New York, 320 331, 332 a rule of strict liability is to be adopted, the pronouncement should come from the Legislature or the Court of Appeals, and not from a court of original Accordingly, I see no need for this court, applying the law of New York, to impose a standard of strict liability absent legislative authority to do so. Page-13- A-DD Case Document 17 Filed 02/17/12 Page 14 of 22 Finally, I note that upon extensive search, the court is unable to find any case other than suggesting that an employer may be held strictly liable in cases where an employee has, without authorization, violated ?1 duty of confidentiality owed by the employer. Indeed, the New York State Court of Appeals, in a case decided after Egg, has declined to adopt the Qge court?s strict liability standard. See, N.X. v. Cabrini Medical Center, 765 844, 847 the doctrine of respondeat superior, an employer may be vicariously liable for the tortious acts of its employees only if those acts were committed in furtherance of the employer's business and ?within the scope of I decline to extend a standard of strict liability to employers where the New York State Legislature and Court of Appeals have declined to so, and therefore 12 find that plaintiff has failed to establish that the defendants breached any duty of care to Doe when Stalbird, without authorization, and acting outside the scope of her employment, revealed plaintiff?s confidential health information to Doe?s girlfriend. B. Breach of Contract Plaintiff alleges that the defendants breached contracts with him by disclosing his personal information. Plaintiff has not identified any valid written agreement with any defendant as the basis of his breach of contract claim, but instead alleges that the defendants violated an ?implied? contract of good faith. Assuming Page-14- A-DO Case Document 17 Filed 02/17/12 Page 15 of 22 arguendo that plaintiff may proceed on a claim of breach of contract, I find that he has failed to establish that any defendant breached a contractual duty of confidentiality, and thus I grant defendants? motion to dismiss this claim. ?To make out a viable claim for breach of contract a ?complaint need only allege (1) the existence of an agreement, (2) adequate performance of the contract by the plaintiff, (3) breach of contract by the defendant, and (4) damages.?? Eternity Global Master Fund Ltd. v. Morgan Guar. Trust Co. of N.Y., 375 F.3d 168, 177 (2nd Cir. 2004)(quoting Harsco Corp. v. Segui, 91 F.3d 337, 348 (2d Cir.1996). In the instant case, Doe alleges that the defendants breached a duty of confidentiality embodied in an implied contract when Stalbird disclosed his personal information. For the reasons set forth above, however, I find that Stalbird?s disclosure of Doe?s medical information can not be imputed to the defendants. Because plaintiff has failed to allege any other independent basis for his breach of contract claim, I grant defendants? motion to dismiss these claims. C. Negligent Hiring Plaintiff alleges that the defendants are liable for the acts of Stalbird because they negligently hired her. To state a claim for negligent hiring under New York law, a plaintiff must allege: that the tortfeasor and the defendant were in an employee?employer relationship; (2) that the employer ?knew or Page?15- Case Document 17 Filed 02/17/12 Page 16 of 22 should have known of the employee's propensity for the conduct which caused the injury? prior to the injury's occurrence; and, (3) that the tort was committed on the employer's premises or with the employer?s chattels.? Ehrens v. Lutheran Church, 385 F.3d 232, 235 (2d Cir.2004). In the instant case, there is no credible, non? conclusory allegation that any defendant knew or should have known that Stalbird would breach her duty of confidentiality with respect to any patient?s private health information. Accordingly, plaintiff has failed to state a claim for negligent hiring. Moreover, because Stalbird was fired by the Guthrie Clinic Steuben within one day of learning of Stalbird's dissemination of Doe?s information, plaintiff is unable to state a claim for negligent retention of an employee. I therefore grant defendants? motion to dismiss plaintiff's negligent hiring claim. D. Negligent Infliction of Emotional Distress ?Under New York law, a plaintiff may recover for negligent infliction of emotional distress under one of two theories: (1) the ?bystander theory? or (2) the ?direct duty theory.?? H'ggins v. Metro?north Railroad Company 2001 WL 503003 (S.D.N.Y., May 11, 2001)(citing United States ex rel. Ben?Shlush v. St. Luke's?Roosevelt Hosp.,, 200 WL 269895 at *4 (S.D.N.Y. Mar. 10, 2000) (additional citations omitted). Under the ?bystander? theory, plaintiff must allege that she witnessed the death or serious bodily injury of a member of her immediate family. Mortise Page-16~ Case Document17 Filed 02/17/12 Page17 of 22 v. United States, 102 F.3d 693 (2d Cir.l996). There are no allegations the complaint that Plaintiff witnessed anyone?s death or serious bodily injury. Nor can Doe make out a claim under the ?direct duty? theory, as such a claim requires evidence that plaintiff suffered an emotional injury as a result of defendant?s breach of a duty ?which unreasonably endangered her own physical safety, . . . or caused her to fear for her physical safety.? V. Metro?north Commuter Railroad Company, 89 F.Supp.2d. 506, 530 (S.D.N.Y., 2000)(citations omitted). Plaintiff has not identified the breach of a duty that endangered his physical safety or caused him to fear for his safety. gee Mortise, 102 F.3d at 693 (duty alleged "must be specific to the plaintiff, and not some amorphous, free?floating duty to society?). While plaintiff alleges that 1K3 was physically threatened kn! his girlfriend's brother Greg Space, there is no suggestion that Space?s conduct can attributed to the defendants, or that any alleged breach of a duty by the defendants endangered Doe?s safety, or caused him to fear for his safety. Finally, the complaint is devoid of any allegation that plaintiff suffered a physical manifestation of the emotional injury, a required element of a claim for negligent infliction of emotional distress. Bertuzzi v. Chase Manhattan Bank, N.A., 1999 WL 759997, at *7 n. 3 (S.D.N.Y. Sept. 24, 1999); Iannotti v. City of Amsterdam, 225 990, 639 537, 538 (3d Dep't 1996). Because plaintiff has failed to establish a claim for Page-17- A-DH Case Document 17 Filed 02/17/12 Page 18 of 22 negligent infliction of emotional distress, I grant defendant?s motion to dismiss this claim. E. Intentional Infliction of Emotional Distress Plaintiff alleges that the unauthorized disclosure of his personal health information constitutes extreme and outrageous conduct on the part of the defendants that caused him to suffer extreme emotional distress. To state a c?aim for intentional infliction of emotional distress, a plaintiff must allege that the defendant, engaged, in extreme and. outrageous conduct; (2) [with] intent to cause, or reckless disregard of a substantial probability of causing, severe emotional distress; (3) a causal connection between the conduct and the injury; and (4) severe emotional distress." Stuto v. Fleishman, 164 F.3d 820, 827 (2d Cir.1999). The conduct complained of must be "so outrageous in character, and so extreme in degree, as to go beyond all possible bounds of decency, and to be regarded as atrocious, and utterly intolerable in a civilized society." Fischer v. Malonev, 43 553, 558 (1978). Ordinarily, whether the challenged conduct is sufficiently outrageous will be determined as a matter of law. Nevin V. Citibank, 107 F.Supp.2d.333, 345?46 (S.D.N.Y. 2000)(Citing Howell v. New York Post Company, Inc., 81 115, 121 (1993)). In the instant case, however, plaintiff has failed to allege that any of the named defendants disclosed his personal health information without authorization. While the Complaint alleges Page-18- A-OU Case Document17 Filed 02/17/12 Page 19 of 22 that Stalbird released information without authorization, there is no allegation that the named defendants engaged in, directed, or authorized such conduct, and thus plaintiff has failed to allege that the defendants, or anyone acting on behalf of the defendants, disclosed his information without consent. In opposition to the defendants? motion to dismiss, plaintiff, has failed to allege any facts suggesting that Stalbird?s conduct could.be attributed to any one of the defendants, and thus I find that plaintiff has failed to state a claim for intentional infliction of emotional distress. Statutory Claims Plaintiff alleges that the defendants improperly disclosed his confidential personal health information in violation of sections 2803?0 and 4410 of the New York Public Health Law, and Section 4504 of the New York Civil Practice Law and Rules. For the reasons set forth below, I find that plaintiff has failed to state a cause of action with respect to any of these claims. A. New York Public Health Law Section 2803-c N.Y. Public Health Law 2803?c(2) provides that: ?every nursing home and facility providing health related service, as defined in subdivision two and paragraph of subdivision four of section twenty?eight hundred one of this article, shall adopt and make public a statement of the rights and responsibilities of the patients who are receiving care in such facilities, and shall treat such patients in accordance with the provisions of such statement.? Page-19? Case Document 17 Filed 02/17/12 Page 20 of 22 Among the rights of patients of such facilities is the right to have private health information kept confidential. Section 2801(4)(b) defines a ?Health?related service? in relevant part as ?service in a facility or facilities which. provide or offer lodging, board and physical care . . . There is no allegation or evidence that the Guthrie Clinic, Steuben, is a ?health~related service? as defined by Section 2801(4)(b), and therefore, there is no showing by the plaintiff that the provisions of N.Y. Public Health Law 2803?c(2) apply to the Guthrie Clinic, Steuben. Because plaintiff has failed to demonstrate that N.Y. Public Health Law 2803?c(2) has any applicability in this action, I grant defendants? motion to dismiss this cause of action. B. New York Public Health Law Section 4410 New York Public Health Law Section 4410 applies to health maintenance organizations, and. provides in relevant. part. that ?[u]nless the patient waives the right of confidentiality, a health maintenance organization or its comprehensive health services plan shall not be allowed to disclose any information which was acquired by such organization or plan in the course of the rendering to a patient of professional services by a person authorized.to practice medicine, registered professional nursing, licensed practical nursing, or dentistry, and which was necessary to acquire to enable such person to act in that capacity, except as may be otherwise required by law.? (emphasis added) Accordingly, it is not clear Page-20- A-OA Case Document 17 Filed 02/17/12 Page 21 of 22 that 4410 applies in this case, where the plaintiff was treated at Guthrie Clinic Steuben, which has not been identified as a health maintenance organization or comprehensive health services plan. Nevertheless, even if the defendants were subject to the requirements of" 4410, they' may not be held liable to the plaintiff for any breach of that section as New York courts have explicitly held that 4410 does not give rise to a private cause of action for the unauthorized. disclosure of personal health information. Burton v. Matteliano, 81 1272, 1275 (N.Y.A.D. 4 is no private cause of action pursuant to Section 4410 of the New York Public Health Law.? citing Doe v. Community Health Plan?Kaiser Corp., 268 at 187). Accordingly, because plaintiff has IN) private cause of action pursuant to 4410 of the New York Public Health Law, I grant defendants? motion to dismiss this cause of action. C. New York Civil Practice Law and Rules Section 4504 Section 4504 of the New York State Civil Practice Law and Rules provides in relevant. part that. person authorized in) practice medicine, registered professional nursing, licensed practical nursing, dentistry, podiatry or chiropractic shall not.be allowed to disclose any information which he acquired in attending a patient in a professional capacity, and which was necessary to enable him to act in that capacity.? N.Y. C.P.L.R. 4504(a). Courts in New York have unanimously held that Section 4504 does not Page-21? A-OJ Case Document 17 Filed 02/17/12 Page 22 of 22 provide a private cause of action to a plaintiff seeking damages for the alleged unauthorized disclosure of confidential health information. Burton, 81 at 1275, citing Doe v. Community Health Plan-Kaiser Corp., 268 at 186~187, (N.Y.A.D. 3 waldron v. Ball Corp., 210 611, 614, 1v. denied 85 803). Accordingly, I find that plaintiff has failed to state a cause of action for a violation of 4504 of the New York Civil Practice Law and Rules, and I therefore grant defendants motion for summary judgment dismissing plaintiff?s claim. CONCLUSION For the reasons set forth above, the defendants' motion to dismiss is granted, and the plaintiff?s Complaint is dismissed. ALL OF THE ABOVE IS SO ORDERED. Michael A. Telesca MICHAEL A. TELESCA United States District Judge Dated: Rochester, New York February 17, 2012 Page-22-