Individuals whose electronic patient records were stolen from the car of an employee of Providence Health System were left with no remedy in a decision Wednesday by the Oregon Court of Appeals. The plaintiffs in Paul v. Providence Health System-Oregon were two of the 365,000 individuals whose records were stolen when a Providence employee took home computer discs and tapes and left them in his car overnight.
The plaintiffs sought to assert claims for negligence and violation of the Unlawful Trade Practices Act against Providence, claiming damages associated with the cost of credit-monitoring services, as well as emotional distress.
The Court of Appeals dismissed the negligence claim, citing the economic loss rule. Under that rule, a party is not typically liable for causing a stranger's purely economic loss. In this case, the losses were economic and not in the form of damage to person or property. To avoid the economic loss rule, a plaintiff must allege that defendant had a heightened duty of care to protect plaintiff against economic harm. Plaintiffs here could allege no such special duty.
The Court of Appeals likewise dismissed a claim based on an alleged breach of a duty of confidentiality. Such a claim exists under Oregon law for an affirmative disclosure of confidential information, but not for a failure to protect the information from misappropriation by a third party.
Finally, the Court of Appeals dismissed the Unlawful Trade Practices Act claim. Plaintiffs alleged that, as a provider of medical services, Providence represented that it would keep medical records safe. Plaintiffs could not show a "loss of money or property" from that misrepresentation under the Act because they did not allege a difference in value between the product or service as represented and as actually received. The out-of-pocket losses associated with credit monitoring are not the type of losses that are recoverable under the Act, according to the Court.
Comments