Skip to content

Klein v Catholic Health Sys. of Long Is., Inc., 2024 NY Slip Op 04951 [231 AD3d 797]

October 9, 2024

Appellate Division, Second Department

[*1]

Refael Klein, Appellant,

v

Catholic Health System of Long Island, Inc., Doing Business as Catholic Health Services of Long Island, Respondent.

Law Office of Alexander Sakin, LLC, New York, NY, for appellant.

Ward Greenberg Heller & Reidy LLP, Rochester, NY (Thomas S. D’Antonio and Christine M. Naassana of counsel), for respondent.

In an action, inter alia, to recover damages for negligence, the plaintiff appeals from an order of the Supreme Court, Nassau County (Diccia T. Pineda-Kirwan, J.), dated July 26, 2022. The order, insofar as appealed from, granted that branch of the defendant’s motion which was pursuant to CPLR 3211 (a) to dismiss the amended complaint.

Ordered that the order is affirmed insofar as appealed from, with costs.

The plaintiff commenced this action in 2020. The amended complaint alleged, inter alia, that the defendant improperly disclosed the plaintiff’s confidential medical information through Healthix, a statewide computer network that collects medical records. The amended complaint asserted causes of action, among other things, to recover damages for negligence, negligence per se, and breach of fiduciary duty, and for a permanent injunction enjoining the defendant from further unauthorized access or disclosure of the plaintiff’s medical records. The defendant moved, inter alia, pursuant to CPLR 3211 (a) to dismiss the amended complaint. In an order dated July 26, 2022, the Supreme Court, among other things, granted that branch of the defendant’s motion. The plaintiff appeals.

“On a motion to dismiss pursuant to CPLR 3211 (a) (7), the complaint is to be afforded a liberal construction, the facts alleged are presumed to be true, the plaintiff is afforded the benefit of every favorable inference, and the court is to determine only whether the facts as alleged fit within any cognizable legal theory” ( Gorbatov v Tsirelman , 155 AD3d 836 , 837 [2017]; see Clevenger v Yuzek , 222 AD3d 931 , 934 [2023]). “Dismissal of the complaint is warranted if the plaintiff fails to assert facts in support of an element of the claim, or if the factual allegations and inferences to be drawn from them do not allow for an enforceable right of recovery” ( Connaughton v Chipotle Mexican Grill, Inc. , 29 NY3d 137 , 142 [2017]; see Myers v Schneiderman , 30 NY3d 1 , 11 [2017]). In addition, where, as here, evidentiary material is considered in connection with a motion to dismiss for failure to state a cause of action, dismissal should not eventuate “unless it has been shown that a material fact as claimed by the pleader to be one is not a fact at all and unless it can be said that no significant dispute exists regarding it” ( Guggenheimer v Ginzburg , 43 NY2d 268, 275 [1977]; see Wedgewood Care Ctr., Inc. v Kravitz , 198 AD3d 124 , 130 [2021]; Rabos v R&R Bagels & Bakery, Inc. , 100 AD3d 849 , 851-852 [2012]). “Under CPLR 3211 (a) (1), dismissal is warranted only if ‘the documentary evidence utterly refutes [*2] plaintiff’s factual allegations, conclusively establishing a defense as a matter of law’ ” ( 344 Rockaway Parkway Inv. Group, LLC v Estate of Colon , 219 AD3d 1388 , 1389 [2023], quoting Goshen v Mutual Life Ins. Co. of N.Y. , 98 NY2d 314, 326 [2002]; see Yan Ping Xu v Van Zwienen , 212 AD3d 872 , 874 [2023]).

A finding of negligence per se requires a violation of a statutorily imposed duty ( see Elliott v City of New York , 95 NY2d 730, 736 [2001]; Katikireddy v Espinal , 137 AD3d 866 , 867 [2016]). Here, the amended complaint, as amplified by the plaintiff’s submissions in opposition the defendant’s motion ( see Gorbatov v Tsirelman , 155 AD3d at 838-839), alleged that the defendant violated CPLR 4504, the Health Insurance Portability and Accountability Act of 1996 (42 USC § 1320d et seq. [hereinafter HIPAA]), and Public Health Law § 2803-c by providing his confidential medical information to Healthix.

A physician may be held liable in damages for breach of a patient’s right to confidentiality pursuant to CPLR 4504 (a) ( see Chanko v American Broadcasting Cos. Inc. , 27 NY3d 46 , 53-54 [2016]; Razzano v Goldman , 178 AD3d 866 , 867 [2019]). “The elements of a cause of action [alleging] breach of physician-patient confidentiality are: (1) the existence of a physician-patient relationship; (2) the physician’s acquisition of information relating to the patient’s treatment or diagnosis; (3) the disclosure of such confidential information to a person not connected with the patient’s medical treatment, in a manner that allows the patient to be identified; (4) lack of consent for that disclosure; and (5) damages” ( Chanko v American Broadcasting Cos. Inc. , 27 NY3d at 53-54; see Razzano v Goldman , 178 AD3d at 867).

The Statewide Health Information Network for New York enables the electronic exchange of clinical information among qualified entities and qualified entity participants for authorized purposes, including “to improve the quality, coordination and efficiency of patient care . . . while protecting patient privacy and ensuring data security” (10 NYCRR 300.1 [a]). “Under section 18 (6) of the Public Health Law, individuals who work for a qualified entity . . . are deemed personnel under contract with a health care provider that is a [qualified entity] participant. As such, a [qualified entity] participant may disclose to such a qualified entity necessary patient information without a written authorization from the patient of the [qualified entity] participant” ( id. § 300.5 [a]).

Here, it is undisputed that Healthix is a qualified entity and that the defendant is a qualified entity participant. Therefore, under New York law, Healthix was not, as a matter of law, “a person not connected with the patient’s medical treatment” ( Chanko v American Broadcasting Cos. Inc. , 27 NY3d at 53).

Similarly, the HIPAA Privacy Rule provides that “[a] covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information” (45 CFR 164.502 [e] [1] [i]). It is undisputed that the defendant is a covered entity and that Healthix was its business associate.

Finally, Public Health Law § 2803-c establishes a standard of care that applies only to “residential health care facilities,” a category that does not include hospitals ( see Dray v Staten Is. Univ. Hosp. , 160 AD3d 614 , 619-620 [2018]; Public Health Law § 2801 [1], [3]). Accordingly, the plaintiff failed to allege facts that would establish that the defendant violated a statutorily imposed duty. Thus, the Supreme Court properly directed dismissal of the cause of action to recover damages for negligence per se ( see Clevenger v Yuzek , 222 AD3d at 934).

The Supreme Court also properly directed dismissal of the cause of action to recover damages for negligence. “The elements of negligence are ‘(1) a duty owed by the defendant to the plaintiff, (2) a breach thereof, and (3) injury proximately resulting therefrom’ ” ( Abbott v Johnson , 152 AD3d 730 , 732 [2017], quoting Solomon v City of New York , 66 NY2d 1026, 1027 [1985]). Here, for the reasons stated above, the defendant did not owe a statutory duty to the plaintiff to withhold his confidential medical information from Healthix. Furthermore, contrary to the plaintiff’s contention, [*3] a Healthix consent form that the defendant submitted in support of its motion did not bar the defendant from disclosing the plaintiff’s confidential medical information to Healthix. “A consent form must generally be ‘construed according to the rules of contract interpretation’ ” ( Marinelli v New York Methodist Hosp. , 205 AD3d 710 , 713 [2022], quoting Matter of Banos v Rhea , 25 NY3d 266 , 276 [2015]). “ ’The words and phrases used by the parties must, as in all cases involving contract interpretation, be given their plain meaning’ ” ( 255 Butler Assoc., LLC v 255 Butler, LLC , 208 AD3d 834 , 836 [2022] [internal quotation marks omitted], quoting Ellington v EMI Music, Inc. , 24 NY3d 239 , 244 [2014]). Here, the plaintiff signed the consent form, on which he checked a box marked “I DENY CONSENT for [the defendant] to access my electronic health information through Healthix . . . for any purpose, even in a medical emergency. ” A preamble to the consent form clarifies that “[y]ou may use this Consent Form to decide whether or not to allow [the defendant] to see and obtain access to your electronic health records in this way.” The consent form at no point refers to the defendant’s right to disclose information to Healthix. Therefore, the plain meaning of these words and phrases ( see 255 Butler Assoc., LLC v 255 Butler, LLC , 208 AD3d at 836) “utterly refute[d]” the plaintiff’s factual allegation that the consent form barred the defendant from disclosing his confidential medical information to Healthix ( 344 Rockaway Parkway Inv. Group, LLC v Estate of Colon , 219 AD3d at 1389 [internal quotation marks omitted]) and showed that the plaintiff’s allegation to that effect “is not a fact at all” ( Marinelli v New York Methodist Hosp. , 205 AD3d at 711, quoting Guggenheimer v Ginzburg , 43 NY2d at 275).

By the same token, the Supreme Court properly directed dismissal of the cause of action to recover damages for breach of fiduciary duty. “A cause of action to recover damages for breach of fiduciary duty . . . ‘must allege: (1) the existence of a fiduciary relationship, (2) misconduct by the defendant, and (3) damages directly caused by the defendant’s misconduct’ ” ( City of Long Beach v Agostisi , 221 AD3d 776 , 777-778 [2023], quoting DeMartino v Abrams, Fensterman, Fensterman, Eisman, Formato, Ferrara & Wolf, LLP , 189 AD3d 774 , 775 [2020]). Here, for the reasons stated above, the plaintiff failed to allege facts constituting misconduct by the defendant. As the defendant was expressly authorized by statute to share the plaintiff’s confidential medical information with Healthix, and the consent form conclusively refuted the plaintiff’s allegation that he denied permission for the defendant to do so, he failed to allege facts supporting the element of misconduct ( see Connaughton v Chipotle Mexican Grill, Inc. , 29 NY3d at 142), and the documentary evidence conclusively refuted his allegations to the contrary ( see 344 Rockaway Parkway Inv. Group, LLC v Estate of Colon , 219 AD3d at 1389).

Finally, the Supreme Court properly directed dismissal of the cause of action for a permanent injunction. “Although it is permissible to plead a cause of action for a permanent injunction, permanent injunctive relief is, at its core, a remedy that is dependent on the merits of the substantive claims asserted by a plaintiff” ( Corsello v Verizon N.Y., Inc. , 77 AD3d 344 , 368 [2010] [citation omitted], mod 18 NY3d 777 [2012]; see Pickard v Campbell , 207 AD3d 1105 , 1110 [2022]). Here, as the plaintiff failed to properly plead his substantive claims, “ ’injunctive relief is simply not available’ ” ( Pickard v Campbell , 207 AD3d at 1110, quoting Weinreb v 37 Apts. Corp. , 97 AD3d 54 , 58 [2012]).

Accordingly, the Supreme Court properly granted that branch of the defendant’s motion which was pursuant to CPLR 3211 (a) to dismiss the amended complaint. Brathwaite Nelson, J.P., Wooten, Ford and Taylor, JJ., concur..