Opinion
S-17520
01-14-2022
COURTNEY GUY, Appellant, v. PROVIDENCE HEALTH & SERVICES WASHINGTON d/b/a Providence Alaska Medical Center, Appellee.
Jason Gazewood and Ember Skye Tilton, Anchorage, for Appellant. Mara E. Michaletz, Birch Horton Bittner & Cherot, Anchorage, for Appellee.
Appeal from the Superior Court of the State of Alaska No. 3 AN-16-05145 CI, Third Judicial District, Anchorage, Jennifer Henderson, Judge.
Jason Gazewood and Ember Skye Tilton, Anchorage, for Appellant.
Mara E. Michaletz, Birch Horton Bittner & Cherot, Anchorage, for Appellee.
Before: Winfree, Maassen, Carney, and Borghesan, Justices.
[Bolger, Chief Justice, not participating.]
OPINION
BORGHESAN, JUSTICE.
I. INTRODUCTION
A patient sued a hospital after learning that a hospital employee intentionally disclosed the patient's health information in violation of the Health Insurance Portability and Accountability Act (HIPAA). The patient alleged that the disclosure breached the hospital's contractual obligations to him. The superior court instructed the jury to return a verdict for the hospital if the jury found that the employee was not acting in the course and scope of employment when she disclosed the patient's information. The jury so found, leading to judgment in the hospital's favor.
We vacate the judgment because the jury instruction erroneously applied the rule of vicarious liability to excuse liability for breach of contract. A party that breaches its contractual obligations is liable for breach regardless of whether the breach is caused by an employee acting outside the scope of employment, unless the terms of the contract excuse liability for that reason. We therefore remand this case for further proceedings, in particular to determine whether a contract existed between the patient and hospital and, if so, the contract's terms governing patient health information.
II. FACTS AND PROCEEDINGS
A. Facts
In March 2013 Courtney Guy was assaulted and tortured by a group of men in Anchorage. Guy was treated for his injuries at Providence Alaska Medical Center (Providence). While Guy was hospitalized, one of his assailants communicated by text message with Providence employee Stacy Laulu. At the assailant's request, Laulu accessed Guy's medical records and illegally texted the information to the assailant.
Months later, federal agents searched the assailant's cell phone while investigating him for federal crimes. The agents found Laulu's text messages, which had constituted a HIPAA violation. Upon learning of the violation, Providence fired Laulu, notified the Secretary of the United States Department of Health and Human Services of the violation, and informed Guy of the disclosure by letter. Laulu was subsequently convicted of violating HIPAA.
B. Proceedings
1. Initial proceedings
Roughly two-and-a-half years after Guy was informed of the HIPAA violation, he filed a complaint against Providence. Guy alleged that he had "suffered severe and prolonged serious physical injury" when "Laulu, as an employee and agent of Providence," disclosed his health information. Guy claimed that Providence "had a contractual obligation to ensure that such information was not released to third parties" and had breached that duty, causing him injury.
Providence answered the complaint, admitting that Laulu was a Providence employee when she disclosed Guy's information. However, Providence claimed that "[t]he disclosure of this information was not authorized by Providence" and that "Laulu was not an agent of, or acting in the course and scope of her employment with, Providence when confidential patient information was disclosed." Providence also denied that it had caused Guy's injury.
2. Motion for summary judgment
Providence moved for summary judgment. After pointing out that HIPAA violations do not give rise to private causes of action, Providence argued that any common-law tort claim based on disclosure of patient health information would be barred by the applicable two-year tort limitations period. As for Guy's contract claim, Providence contended that because it had no contract with Guy "concerning HIPAA or the disclosure of information about him," it did not breach any contractual obligations to Guy.
The court held oral argument on Providence's summary judgment motion. Guy's counsel raised an argument not made in briefing. He likened Guy's case to Luedtke v. Nabors Alaska Drilling, Inc., where this court recognized that at-will employment contracts contain an implied covenant of good faith and fair dealing and that requiring employees to undergo drug testing could in some instances amount to a breach of the implied covenant in light of the public policy in Alaska favoring employee privacy. Invoking this public policy, Guy argued that the court should follow Luedtke and find that the implied covenant of good faith and fair dealing protects patients' health information when receiving medical treatment. At the close of argument the superior court stated that if it considered this newly raised argument it would give both parties an opportunity to present supplemental briefing on the issue.
The court denied Providence's motion for summary judgment in a written order. "After consideration of new arguments brought forth at oral argument," the court found genuine issues of material fact "as to the existence and terms of the contract for services entered between Mr. Guy and Providence and, further, whether the duty of good faith and fair dealing would be violated by the conceded unauthorized disclosure of private medical information."
Providence moved for reconsideration, pointing to the court's promise to provide an opportunity for supplemental briefing in the event it considered arguments beyond those already briefed. The court granted Providence's motion to reconsider and invited Providence to file supplemental briefing. Providence then requested and received a one-month extension, but it does not appear to have filed any supplemental briefing on this issue.
3. Trial
Trial began in October 2018, but the judge declared a mistrial. A second trial was scheduled for June 2019.
Before the first trial, Providence had filed a memorandum regarding jury instructions. One of its proposed jury instructions stated that "[i]n order to determine whether [Providence] is legally responsible for the acts of Stacy Laulu, you must decide that it is more likely true than not true that Stacy Laulu was acting within the course and scope of her employment when the disclosure occurred." Before the second trial, which was held before a new judge, the court notified the parties that it intended to give this proposed instruction (among others) to the jury.
Guy objected to this instruction. Guy argued that his action was based on contract and that the concept of vicarious liability did not apply because "[v]icarious liability is a concept that a principal is liable in tort for harms caused by its agent." He proposed his own instructions seemingly based on a mix of contract and tort principles. The superior court accepted some but not all of Guy's instructions.
On the first day of the second trial the judge invited the parties to address the dispute over jury instructions. Guy's counsel stated that Providence was "attempting to use vicarious liability as a defense to a contract claim, which doesn't seem to be available." He argued that the jury instructions failed to address contract law and asked the court to use "our earlier contract instructions that we submitted." Guy's counsel argued that he was not able to find a single case where vicarious liability "was approved as a defense to a contract claim."
Later that day Guy submitted a supplemental brief on the issue. The brief explained that "[t]here is no reference in the Restatement (Second) of Contracts regarding vicarious liability." Rather, "[v]icarious liability rests in tort." Guy asked that "[i]nstead, the Court instruct on the relevant contractual breach instructions."
Providence responded that its proposed instruction did not use the term "vicarious liability" and was "based on previous pattern jury instructions referencing agency relationships," namely Alaska Pattern Jury Instructions-Civ. 23.01 and 23.02. Providence argued that "vicarious liability is to tort law as agency is to contract," and claimed that "Alaska has a long history of applying principles of agency liability to contract claims." It cited the Restatement (First) of Agency, arguing that the factors set forth "for the consideration of an agent's authority (and a principal's liability).... are not unlike Alaska Civil Pattern Jury Instruction."
The disputed instruction, reflecting Providence's position, instructed jurors that the parties did not dispute that Laulu illegally disclosed Guy's information, but that
[i]n order to determine whether [Providence] is legally responsible for the acts of Stacy Laulu, you must decide that it is more likely true than not true that Stacy Laulu was acting within the scope of her employment with, or agency for, [Providence].
To make this decision, the jury was instructed to consider:
(1) whether [Providence] expressly authorized Stacy Laulu's conduct, or Stacy Laulu's conduct was similar to conduct that the defendant authorized, or Stacy Laulu's conduct was not a remote or improbable occurrence in connection with authorized conduct;
(2) whether Stacy Laulu's conduct occurred substantially within the time and place authorized by the defendant; and
(3) whether Stacy Laulu's conduct was motivated, at least in part, by an intent to serve the defendant.
In evaluating these factors, the instruction permitted the jury to consider:
• the time, place and purpose of Stacy Laulu's conduct;
• any previous situations that involve the defendant's authorization to Stacy Laulu;
• whether Stacy Laulu's conduct was outside the defendant's area of business activity;
• whether the defendant had reason to expect that Stacy Laulu would engage in the conduct;
• the similarity of Stacy Laulu's conduct to any conduct that the defendant expressly authorized;
• whether the defendant supplied any equipment or tools that Stacy Laulu used when engaging in the conduct;
• whether Stacy Laulu departed from the normal method of accomplishing an authorized result; and
• whether Stacy Laulu's conduct involved a serious crime.
If the jury ruled that Providence was not legally responsible, the disputed instruction ordered the jury to return a verdict for the hospital.
The court later asked the parties for additional arguments regarding this proposed jury instruction. Providence's counsel suggested that it would be "ironic" if parties that "don't file within the statute of limitations... have more theories" than those that do: "[I]f you don't bring a tort claim for something that's obviously a tort, and you bring a contract claim, all of a sudden you're in a stronger position because defenses that could be raised before are no longer viable." Guy's counsel responded that the proposed instruction was inconsistent with the contract claims being pled. Guy's counsel then argued that the breach at issue was not Laulu's revealing Guy's health information, but her obtaining it in the first place. The fact that the information was subsequently revealed to the men who had assaulted Guy "is more along the lines of what the harm was, what the damage was."
The court observed that Guy's theory had "shifted over the course of time in this case." The court stated that the case was "unusual" because in a contract action, the relevant breach is not usually "based on a tort or crime committed by one of the employees." And it described the case as "a tort case at heart trying very, very hard to be a contract case." The court concluded that Civil Pattern Jury Instruction 23.10 "is applicable in this case where... the jury is being asked to decide... whether Providence should be held responsible for the conduct of Ms. Laulu." Therefore the court gave the disputed instruction (Instruction 22), which was modeled on Civil Pattern Jury Instruction 23.10, to the jury.
After trial the jury returned a verdict for Providence. The first question on the special verdict form asked: "Was Stacy Laulu acting within the course and scope of her employment or agency when the disclosure occurred so that defendant Providence Alaska Medical Center is legally responsible for any damages caused by the disclosure?" The jury answered: "No." It did not reach any of the other questions on the verdict form. After the jury left, Guy's counsel moved for a judgment notwithstanding the verdict, arguing that the jury instructions had improperly stated the law. The court denied the motion. The court later issued a final judgment reflecting the jury verdict. Guy appeals.
III. STANDARD OF REVIEW
"We review jury instructions de novo when a timely objection is made.""A jury instruction containing an erroneous statement of law constitutes reversible error if it prejudiced one of the parties; prejudice exists 'if it can be said that the verdict may have been different had the erroneous instruction not been given.'" "As a type of jury instruction, a special verdict form is subject to the same standard of review as other jury instructions."
IV. DISCUSSION
A. The Jury Instructions Were Erroneous.
There is much truth to the superior court's observation that this case is "a tort case at heart trying very, very hard to be a contract case." Stacy Laulu wrongly disclosed confidential information about Guy to his assailants, allegedly causing Guy injury. Guy argues that Providence, Laulu's employer, should be held liable for this injury. Courts in other jurisdictions have recognized that unauthorized disclosure of confidential health information gives rise to a cause of action in tort.
But perhaps because this lawsuit was not filed within the two-year limitations period applicable to tort claims, it was pled as a breach of contract claim. It must therefore be tried as a breach of contract claim. Jurors were instructed to decide Providence's liability by applying a principle of agency law commonly used in tort claims to determine vicarious liability: whether Laulu was acting in the course and scope of her employment when she disclosed Guy's information to his assailant. But principles of agency law and vicarious liability do not apply to the question of whether a party to a contract may be liable for breaching its contractual obligations. A party to a contract is liable for breaching its contractual obligations even when the breach is caused by the party's employee acting outside the scope of employment.
Providence fails to cite a case holding that agency law applies to determining whether a contract was breached. It claims that "[f]or almost a century, Alaska courts have followed common law requiring principal liability for contract claims to be predicated on a principal's authorization or ratification of an agent's actions." But the cases Providence cites do not apply agency principles to determine whether a contracting party breached the terms of its contract. Instead, these cases apply agency principles only to determine whether an entity is bound by a contract.