HOWLAND v. TRUMAN MEDICAL CENTER INC (2025)

Rose Howland appeals the judgment of the Circuit Court of Jackson County (the “trial court”) dismissing her claims for lack of standing. Howland's claims arose from an incident that occurred in 2021, when she was both employed by and a patient of Truman Medical Center, Inc. (“Truman Medical”). Howland alleged that her co-workers accessed her patient files without authority, discovered she was not vaccinated for COVID-19, harassed and ostracized her for her vaccination decision, and, as a result, her workplace became “intolerable,” causing her to resign. Howland asserted six claims against Truman Medical: (1) breach of fiduciary duty of confidentiality; (2) breach of implied contract; (3) violation of the Missouri Merchandising Practices Act (“MMPA”); (4) negligence; (5) negligent training and supervision; and (6) negligence per se. Truman Medical moved to dismiss Howland's claims for lack of standing and failure to state a claim upon which relief can be granted. The trial court granted Truman Medical's motion in part, dismissing all claims for lack of standing except for the MMPA claim. Howland then voluntarily dismissed the MMPA claim without prejudice. The trial court entered a final judgment and this appeal followed.

We find the trial court erred in dismissing Howland's claims for lack of standing. However, we find the trial court did not err in dismissing the negligence per se count, as it failed to state a claim upon which relief can be granted. As a result, we affirm the dismissal of Howland's negligence per se claim and reverse the dismissal of her claims for breach of fiduciary duty, breach of implied contract, negligence, and negligent training and supervision.

Factual and Procedural Background

Howland initiated this action against Truman Medical in September 2022. Truman Medical filed a motion to dismiss for lack of standing and failure to state a claim upon which relief can be granted. The trial court denied Truman Medical's motion without prejudice “to allow [Howland] to cure the pleading deficiencies.” The trial court ordered Howland file an amended petition in compliance with Rule 55.05 within ten days.¹

Howland filed her Second Amended Petition for Damages, which is the operative petition in this matter. Howland alleged that she was an employee and patient of Truman Medical, and on November 12, 2021, “without authorization or any working need, [her] co-workers accessed her patient records maintained with [Truman Medical] to discover if [she] was vaccinated for COVID-19.” Howland had “declined to be vaccinated for the COVID-19 virus.” Howland alleged that her co-workers “shared [Howland's] vaccination status with their follow co-workers and other employees of [Truman Medical],” Howland's co-workers and supervisors “ostracize[d],” “ridicule[d] and harass[ed]” her for her “medical choices,” she “was demoted as a result of the improper disclosure,” and her “workplace became untenable,” such that “she could no longer effectively work for [Truman Medical] and she was forced to resign.”

Howland asserted that Truman Medical improperly handled and inadequately protected her confidential medical information, resulting in its wrongful disclosure. She claimed that, as a direct result, she suffered emotional distress, embarrassment, humiliation, loss of enjoyment of life, loss of privacy and confidentiality, “exposure to heightened future risk of identity theft,” “out-of-pocket expenses associated with the wrongful disclosure,” “out-of-pocket expenses incurred to mitigate the effects” of the wrongful disclosure, “the value of her time spent mitigating the effects” of the wrongful disclosure, and “the lost benefit of her bargain when she paid for her privacy to be protected and it was not.”

Howland asserted six claims against Truman Medical: (1) breach of fiduciary duty of confidentiality; (2) breach of implied contract; (3) violation of the MMPA; (4) negligence; (5) negligent training and supervision; and (6) negligence per se, based on violations of the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act (“HITECH”).²

Truman Medical again moved to dismiss for lack of standing and failure to state a claim upon which relief can be granted. After briefing on the motion, on November 16, 2023, the trial court granted Truman Medical's motion in part and denied it in part. The trial court concluded Howland lacked standing to assert the majority of her claims, finding Howland “failed to identify” how “the disclosure of her vaccination status caused her harm or presented a material risk of causing harm,” her “alleged injuries are purely conjectural and hypothetical,” and “[v]ague assertions are not enough to establish concrete injury.” The trial court further found Howland “failed to plead or support how the alleged harm caused the damage and the need for such things as monitoring or mitigation.” As a result, the trial court dismissed all claims except for the MMPA claim. As to that claim, the trial court found Howland had standing because “Plaintiffs can satisfy the injury in fact requirement for contract-related claims by alleging they did not receive the full benefit of their bargain.”

Howland filed a motion for reconsideration, or in the alternative, for leave to amend her petition. The trial court denied the motion. Howland voluntarily dismissed her MMPA claim without prejudice and filed a motion for judgment, requesting the trial court “make its November 16, 2023 [order] a Final Judgment for which the Appellate Court can review.” The trial court entered a final judgment, from which Howland appeals. Howland asserts the trial court erred in finding that she did not have standing and dismissing her claim for breach of fiduciary duty of confidentiality (Point I), claim for breach of implied contract (Point II), and negligence claims (Point III).

Standard of Review

“Our review of a dismissal for lack of standing is de novo.” Corozzo v. Wal-Mart Stores, Inc., 531 S.W.3d 566, 572 (Mo. App. W.D. 2017) (internal marks omitted). We determine standing as a matter of law on the basis of the petition, assessing whether it invokes principles of substantive law. Id. In doing so, we construe the petition “liberally and accept all alleged facts as true and construe them in a light most favorable to the pleader.” Id. “If the petition sets forth any set of facts that, if proven, would entitle the plaintiffs to relief, then the petition states a claim.” Id.

“To state a claim, a petition must contain a short and plain statement of the facts showing that the pleader is entitled to relief.” Stanton v. City of Skidmore, 620 S.W.3d 245, 250 (Mo. App. W.D. 2021) (internal marks omitted). “Missouri is a fact pleading state,” but “[t]he facts that must be pleaded are the ultimate facts, not evidentiary facts.” Gruhn v. Schwermer, 710 S.W.3d 103, 109 (Mo. App. W.D. 2025). “Ultimate facts are those the jury must find to return a verdict for the plaintiff.” Id.

Finally, “[t]his court must affirm the dismissal if it can be sustained on any ground which is supported by the motion to dismiss, regardless of whether the circuit court relied on that ground.” Corozzo, 531 S.W.3d at 572.

Analysis

Standing

Howland asserts the trial court erred in dismissing her claims for lack of standing because she “has a justiciable interest in and has suffered a concrete harm related to her claims against [Truman Medical].” We agree that the trial court erred in dismissing her claims for lack of standing.

“Before a case may be heard by Missouri courts, a plaintiff must present a justiciable controversy.” City of St. Louis v. State, 682 S.W.3d 387, 398 (Mo. banc 2024) (citing Schweich v. Nixon, 408 S.W.3d 769, 773 (Mo. banc 2013)). “A justiciable controversy exists where (1) the plaintiff has a legally protectable interest at stake, (2) a substantial controversy exists between parties with genuinely adverse interests, and (3) that controversy is ripe for judicial determination.” Schweich, 408 S.W.3d at 773. “The first two elements of justiciability are encompassed jointly by the concept of ‘standing.’ ” Id. at 774.

“A party's standing to bring an action is one of the requirements of justiciability under both federal and Missouri law.” Courtright v. O'Reilly Auto., 604 S.W.3d 694, 700 (Mo. App. W.D. 2020); see also Corozzo, 531 S.W.3d at 574 (Standing “is the state analogue to the federal ‘case or controversy’ requirement.”). “Standing requires that a party have a personal stake arising from a threatened or actual injury.” Schweich, 408 S.W.3d at 774. “The requirement that the plaintiff have a threatened or real injury concerns whether the plaintiff suffered an injury in fact.” Mathews v. FieldWorks, LLC, 696 S.W.3d 382, 392 (Mo. App. W.D. 2024). “To establish injury in fact, a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’ ” Courtright, 604 S.W.3d at 700 (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016)). “An injury is ‘particularized’ if it ‘affect[s] the plaintiff in a personal and individual way.’ ” Mathews, 696 S.W.3d at 392 (quoting Spokeo, 578 U.S. at 339). “An injury is ‘concrete’ if it actually exists, whether as a tangible or as an intangible injury.” Id.

Howland's allegations were sufficient to establish standing. She alleged that Truman Medical improperly handled and inadequately protected her confidential medical information resulting in its wrongful disclosure. She asserted that such wrongful disclosure led to a demotion, as well as harassment, ostracization, and ridicule that rendered her workplace “intolerable” and “untenable,” forcing her to resign because “she could no longer effectively work” for Truman Medical. She claimed to have suffered emotional distress, embarrassment, humiliation, loss of enjoyment of life, loss of privacy and confidentiality, and “the lost benefit of her bargain when she paid for her privacy to be protected and it was not.”³ These allegations—which we accept as true for purposes of our review—demonstrated an injury to Howland that was actual and not merely conjectural or hypothetical (thus it was concrete) and affected her in a personal and individual way (thus it was particularized). In other words, Howland sufficiently alleged an injury in fact.⁴

In finding Howland's injuries “purely” conjectural and hypothetical, and her assertions of injury too “vague,” the trial court relied on cases which we find inapposite. The trial court first relied on cases involving violations of the federal Fair Credit Reporting Act (“FCRA”)—Campbell v. Adecco USA, Inc., 561 S.W.3d 116 (Mo. App. W.D. 2018) and Courtright v. O'Reilly Automotive, 604 S.W.3d 694 (Mo. App. W.D. 2020)—in which the plaintiffs alleged that the defendants failed to provide them with consumer reports and other information as required by the FCRA. In both cases, we determined that the plaintiffs could not establish standing by alleging a mere procedural violation of the statute, and the plaintiffs did not have standing to assert certain of their claims because they did not allege they suffered a concrete injury from the defendants’ claimed violations of the FCRA. See Campbell, 561 S.W.3d at 122-23; Courtright, 604 S.W.3d at 703-04. Here, however, Howland's allegations of injury concerned more than a mere procedural violation of a statute and—as discussed above—asserted an injury that was actual and concrete.

The trial court next relied on Sims v. Kahrs Law Offices, P.A., No. 22-2112-JWB, 2023 WL 2734317 (D. Kan. Mar. 31, 2023), stating that in Sims, the “plaintiff failed to set forth any facts supporting claims of emotional distress, aggravation, inconvenience, embarrassment, and frustration” and that “bare assertions of emotional harms [are] not sufficient to establish standing.” But here, Howland alleged facts supporting her claims of emotional harm, including that she was harassed, ridiculed, ostracized, and demoted, such that it was untenable for her to continue working for Truman Medical. Thus, the bare assertions of emotional harm deemed to be insufficient in Sims to support standing are unlike Howland's allegations here.⁵

Finally, the trial court relied on Mallak v. City of Brainerd, No. 13-2119 (DWF/LIB), 2017 WL 3668759 (D. Minn. Aug. 23, 2017), noting that in Mallak, the “court found standing when plaintiff supported [her] emotional distress claim as the result of the release of private information with deposition testimony and affidavit.” But Mallak was decided on summary judgment, where a trial court may—and sometimes must—consider matters outside the pleadings in making its determination. Here, the trial court decided standing on a motion to dismiss, where the allegations in the petition are to be taken as true without the need for any supporting evidence. Thus, to the extent the trial court determined Howland's allegations of emotional harm were insufficient to establish standing because they were not supported by evidence, such determination was erroneous.

Truman Medical argues that Howland's briefing before the trial court “made little to nothing of the now-claimed harassment and ostracization,” and thus Howland cannot argue on appeal that these harms established standing. While Howland's arguments to the trial court relating to standing did not emphasize the workplace harassment and ostracization she suffered due to the disclosure of her medical information, she did contend that the “disclosure of [her] medical records directly caused [her] harm,” which included emotional distress, embarrassment, humiliation, and the loss of enjoyment of life.⁶ The trial court understood Howland's claims of emotional harm to relate to her working conditions, as the trial court in its dismissal order described Howland's allegations to include that the “disclosure of her vaccination status” resulted in harassment, ostracization, and demotion, making it “untenable to continue working” for Truman Medical, and as a result she suffered emotional distress, embarrassment, humiliation, and loss of enjoyment of life. Thus, we disagree with Truman Medical that this argument was not preserved for appeal.

For these reasons, we find Howland sufficiently alleged an injury in fact, and thus the trial court erred in dismissing her claims for lack of standing.

Failure to State a Claim

Our determination that Howland had standing does not end our analysis, however, because Truman Medical argues we can affirm the trial court's judgment of dismissal on alternative grounds. In its motion to dismiss, Truman Medical asserted Howland failed to state a claim upon which relief can be granted, and contends on appeal that we can affirm the dismissal of her claims on this basis. See Corozzo, 531 S.W.3d at 572 (“[T]his court must affirm the dismissal if it can be sustained on any ground which is supported by the motion to dismiss, regardless of whether the circuit court relied on that ground.”). We find, however, that only one of Howland's claims—her claim for negligence per se—failed to state a claim upon which relief can be granted; all other claims should have survived Truman Medical's motion to dismiss.

Truman Medical first argues that we should affirm the dismissal of Howland's claim for breach of fiduciary duty of confidentiality because Howland failed to allege all necessary elements of her claim.

Under Missouri law, “a physician has a fiduciary duty of confidentiality not to disclose any medical information received in connection with his treatment of the patient.” Brandt v. Med. Def. Assocs., 856 S.W.2d 667, 670 (Mo. banc 1993). “This duty arises out of a fiduciary relationship that exists between the physician and the patient.” Id. “If such information is disclosed under circumstances where this duty of confidentiality has not been waived, the patient has a cause of action for damages in tort against the physician” or medical facility. Id.; Fierstein v. DePaul Health Ctr., 949 S.W.2d 90, 92-93 (Mo. App. E.D. 1997) (the plaintiff stated a cause of action for breach of fiduciary duty of confidentiality against defendant medical center by alleging the defendant released the plaintiff's medical records to her ex-husband's attorney without the plaintiff “waiv[ing] her physician/patient privilege”).

Truman Medical asserts Howland's claim for breach of fiduciary duty failed because Howland was both a patient and employee of Truman Medical, and she did not allege whether Truman Medical “obtained her vaccination status as part of her employment or in her capacity as a patient.” Truman Medical contends that, absent an allegation that Truman Medical obtained Howland's vaccination records through a privileged patient-physician relationship, her breach of fiduciary duty claim must be dismissed. We find, however, that Howland alleged Truman Medical disclosed her “patient” medical information. In her Second Amended Petition, Howland alleged that she was a patient of Truman Medical and that her co-workers “accessed her patient records maintained with” Truman Medical, without being part of her care team, and discovered her COVID-19 vaccination status. (Emphasis added). Howland also alleged that had Truman Medical represented it would not protect her confidentiality and privacy, she would have sought treatment elsewhere. Given these allegations, we find Howland sufficiently pleaded her claim for breach of fiduciary duty.

Truman Medical next argues we should affirm the dismissal of Howland's breach-of-implied-contract claim. Truman Medical contends that “[t]he remedy of implied contract like [Howland] appears to seek here are equitable remedies under Missouri law,” and to state a claim for equitable relief, Howland must plead she lacks an adequate remedy at law, which she did not do. We disagree, however, that Howland's implied-contract claim was equitable in nature.

There are two types of implied contracts: contracts that are implied in law and contracts that are implied in fact.⁷ A breach of contract implied in law is an equitable claim; a breach of contract implied in fact is not. See Nickel v. Stephens Coll., 480 S.W.3d 390, 397 n.6 (Mo. App. W.D. 2015) (“There is no difference in legal effect between an express contract and one implied in fact.”). Although Howland broadly designated her claim in her Second Amended Petition as a “Breach of Implied Contract,” it is evident from her allegations that she asserted a breach of contract implied in fact: she alleged that “as part of her agreement” with Truman Medical she provided certain information to Truman Medical, and in doing so she and Truman Medical entered into an implied contract wherein Truman Medical was obligated to reasonably safeguard her information.⁸ Because a claim for breach of contract implied in fact is not an equitable action, Howland was not required to plead she lacked an adequate remedy at law, and her breach-of-contract claim should not have been dismissed on this basis.

Next, Truman Medical argues we should affirm the dismissal of Howland's negligence claims due to the economic loss doctrine. “In Missouri, the economic loss doctrine has been observed to prohibit a plaintiff from seeking to recover in tort for economic losses that are contractual in nature.” Autry Morlan Chevrolet, Cadillac, Inc. v. RJF Agencies, Inc., 332 S.W.3d 184, 192 (Mo. App. S.D. 2010); see also Child.’s Wish Found. Int'l, Inc. v. Mayer Hoffman McCann, P.C., 331 S.W.3d 648, 652 (Mo. banc 2011) (“many states, including Missouri, traditionally have restricted the availability of tort damages in cases alleging only economic loss”). However, we find the doctrine did not apply to bar Howland from asserting her negligence claims, as she alleged that she suffered not only economic loss that was contractual in nature, but harm resulting from Truman Medical's alleged improper disclosure of her medical information, including emotional distress, embarrassment, humiliation, and loss of enjoyment of life.

Finally, Truman Medical asserts we should affirm the dismissal of Howland's negligence per se claim, in which Howland asserted Truman Medical committed negligence per se by violating HIPAA and HITECH. Truman Medical contends that, because these federal statues do not provide a private right of action, Howland could not state a claim for negligence per se based on these statutes. We agree.

“Negligence per se is a form of ordinary negligence that results from the violation of a statute.” Lowdermilk v. Vescovo Bldg. & Realty Co., 91 S.W.3d 617, 628 (Mo. App. E.D. 2002) (internal marks omitted). “Negligence per se arises where the legislature pronounces in a statute what the conduct of a reasonable person must be, whether or not the common law would require similar conduct, and the court then adopts the statutory standard of care to define the standard of conduct of a reasonable person.” Id. (internal citation omitted). “As a result, the jury is instructed on the statutory standard of care rather than the care of the reasonable person.” Id.

However, not all statutes support a cause of action for negligence per se. Indeed, only those statutes which create a private right of action can form the basis for a negligence per se claim. See Bradley v. Ray, 904 S.W.2d 302, 314 (Mo. App. W.D. 1995) (affirming dismissal of negligence per se claim: “Because this Court finds no private cause of action can be implied under the Child Abuse Reporting Act, the alleged breach of the Act also does not amount to negligence per se” (internal citation omitted)).

Although Howland asserted a claim for negligence per se based on alleged violations of HIPAA and HITECH, it is well-settled that there is no private right of action to sue for a HIPAA violation. See Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010) (“HIPAA does not create a private right of action.”); Payne v. Taslimi, 998 F.3d 648, 660 (4th Cir. 2021) (“Every circuit court to consider whether HIPAA created a private right to sue has found that it does not.” (emphasis omitted)).⁹ Similarly, there is no private right of action to sue for a HITECH violation. See Newton v. Compass Health Network, No. 4:22-CV-239, 2022 WL 1154522, at *3 n.7 (E.D. Mo. Apr. 19, 2022) (“Like HIPAA, the HITECH Act does not allow an individual to bring a cause of action against a provider.”).¹⁰ Because these statutes do not provide a private right of action, a breach of these statues does not constitute negligence per se. See Bradley, 904 S.W.2d at 314. Accordingly, Howland failed to state a claim for negligence per se upon which relief can be granted, and her claim was rightfully dismissed.¹¹ See id.; see also J.R. v. Walgreens Boots All., Inc., No. 20-1767, 2021 WL 4859603, at *7 (4th Cir. Oct. 19, 2021) (affirming district court's dismissal of claim for negligence per se based on HIPAA, as no private right of action exists under HIPAA).

Conclusion

For the reasons described above, we find the trial court erred in determining Howland lacked standing. Nonetheless, the trial court did not err in dismissing Howland's count of negligence per se, as that count failed to state a claim upon which relief can be granted. Dismissal of the negligence per se claim is affirmed. We reverse the dismissal of Howland's claims for breach of fiduciary duty, breach of implied contract, negligence, and negligent training and supervision, and remand to the trial court for further proceedings consistent with this opinion.

FOOTNOTES

1.   Rule 55.05 provides that a pleading “shall contain (1) a short and plain statement of the facts showing that the pleader is entitled to relief and (2) a demand for judgment for the relief to which the pleader claims to be entitled.”

2.   “HIPAA is a federal law designed to establish standards to protect private health information from being disclosed without the patient's consent or knowledge.” J.J. v. Poplar Bluff Reg'l Med. Ctr., L.L.C., 675 S.W.3d 259, 262 n.3 (Mo. App. E.D. 2023). HITECH “widens the scope of privacy and security protections available under HIPAA; it increases the potential legal liability for non-compliance; and it provides for more enforcement.” Newton v. Compass Health Network, 4:22-CV-239, 2022 WL 1154522, at *3 n.7 (E.D. Mo. Apr. 19, 2022).

3.   In refusing to dismiss Howland's MMPA claim, the trial court found Howland had “standing to pursue her MMPA claim” because “Plaintiffs can satisfy the injury in fact requirement for contract-related claims by alleging they did not receive the full benefit of their bargain,” quoting Boone v. PepsiCo, Inc., 653 F. Supp. 3d 635, 643 (E.D. Mo. 2023). Yet the trial court nonetheless dismissed Howland's breach-of-implied-contract claim for lack of standing, despite Howland asserting that she suffered a “loss of the benefit of the bargain” as a result of the breach.

4.   While we find Howland sufficiently alleged an injury in fact, we agree with the trial court that Howland's allegations of harm relating to an “exposure to heightened future risk of identity theft”—including monitoring and mitigation efforts—were too conjectural and hypothetical to establish standing, given the circumstances of the wrongful disclosure alleged here. See McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295, 300-03 (2d Cir. 2021) (whether a plaintiff establishes standing based on an increased risk of identity theft depends on the specific facts alleged, and “where plaintiffs have not alleged a substantial risk of future identity theft, the time they spent protecting themselves against this speculative threat cannot create an injury” (internal marks omitted)). But—as discussed above—these were not the only harms alleged, and the other injuries pleaded by Howland were sufficient to establish standing. Cf. TransUnion LLC v. Ramirez, 594 U.S. 413, 441 (2021) (“the risk of future harm on its own does not support Article III standing for the plaintiffs’ damages claim” (emphasis added)).

5.   Additionally, the district court's discussion of standing in Sims was in the context of a statutory violation: the plaintiff alleged the defendant violated the federal Fair Debt Collection Practices Act (“FDCPA”) when it disclosed her personal information. 2023 WL 2734317, at *2-10. The district court found that plaintiff's “alleged intangible injuries” of emotional distress, aggravation, inconvenience, embarrassment, and frustration, were “not sufficient to establish a concrete injury under the FDCPA.” Id. at *7.

6.   Howland's briefing to the trial court included other arguments relating to standing, such as the assertion that her loss of privacy relating to her medical information, in and of itself, was a concrete injury sufficient to establish standing. The trial court did not acknowledge or address this argument, nor do we address it on appeal, because we find that, considering all of Howland's allegations of harm and not just her loss of privacy, she sufficiently alleged standing.

7.   “[A] contract implied in law is not actually a contract and, instead, is an obligation to do justice where no promise was ever made or intended.” Am. Eagle Waste Indus., LLC v. St. Louis Cnty., 379 S.W.3d 813, 828-29 (Mo. banc 2012); see also 66 Am. Jur. 2d Restitution & Implied Contracts § 4 (2025) (“A contract implied in law is a legal fiction, an obligation created by the law” and “imposed regardless of any actual agreement between the parties”; it is “adopted to achieve justice or for obtaining just results.”). “Courts sometimes use the term ‘quasi-contract’ to refer to this phenomenon.” Am. Eagle Waste Indus., 379 S.W.3d at 829; see also Hammond v. Toole, 644 S.W.3d 289, 297 (Mo. App. W.D. 2022) (“The principle of unjust enrichment has given rise to the doctrine of quasi-contract, also known as contract implied in law, as a theory of recovery.”).Unlike a contract implied in law, a contract implied in fact is a true contract, albeit one that is not stated orally or in writing. See 17A Am. Jur. 2d Contracts § 11 (2025) (“A contract is express if stated either orally or in writing, and it is implied [in fact] if its terms are not so stated”; a contract implied in fact is a “true contract, which arises if the assent of the parties is manifested by conduct rather than words”); see also Nickel v. Stephens Coll., 480 S.W.3d 390, 397 n.6 (Mo. App. W.D. 2015) (“A true contract is said to be express or implied in fact”).

8.   Howland also clarified in her suggestions in opposition to the motion to dismiss that she was asserting a claim for breach of contract implied in fact.

9.   “This is because HIPAA does not expressly allow for a private cause of action but delegates enforcement authority to the Secretary of the Department of Health and Human Services, reflecting Congress's intent to forgo creating a private remedy.” Payne, 998 F.3d at 660.

10.   “However, it does allow a state attorney general to bring an action on behalf of his or her residents.” Newton, 2022 WL 1154522, at *3 n.7.

11.   We do not believe our holding is at odds with the Eastern District's opinion in J.J. v. Poplar Bluff Regional Medical Center, L.L.C., 675 S.W.3d 259 (Mo. App. E.D. 2023). The sole issue in J.J. was whether the plaintiff's claims (which were similar to the claims raised in this action) were properly dismissed by the trial court due to the plaintiff's failure to file an affidavit of merit pursuant to section 538.225.1, RSMo (requiring affidavit of health care provider certifying merit of medical malpractice case). See 675 S.W.3d at 262-63. The Eastern District reversed the trial court's dismissal, finding that the affidavit requirement of section 538.225.1 did not apply to the plaintiff's claims. Id. at 267. In making this determination, the Eastern District—in dicta—described the elements of the plaintiff's claims. See id. at 266 (“Although this Court is not asked to determine the merits of J.J.’s claims against PBRMC, the elements of each particular claim can clarify the application of Section 538.225.1's affidavit requirement.”). The Eastern District stated the following relating to negligence per se: “If a defendant health care provider does not comply with its duties under HIPAA and HITECH, and the plaintiff is injured as a result of a statutory violation, then the defendant is liable for negligence per se.” Id. In so stating, the Eastern District relied on Dibrill v. Normandy Associates, Inc., 383 S.W.3d 77, 84-85 (Mo. App. E.D. 2012), a case that did not involve violations of HIPAA or HITECH. We also note that the Eastern District acknowledged elsewhere in its opinion that “[a]lthough HIPAA establishes rules for the protections and dissemination of protected health information, it creates no private cause of action for a violation of those rules,” and “[i]nstead, a plaintiff may pursue an action under Missouri common law seeking damages for invasion of privacy on the basis of the public disclosure of private facts, for a breach of duty of confidentiality, and for breach of implied contract.” Id. at 262 n.3 (internal citations omitted). Given that the Eastern District's discussion of negligence per se was dicta, the Eastern District relied on a negligence per se case that did not involve HIPAA or HITECH, and it acknowledged HIPAA does not create a private right of action, we do not perceive J.J. to stand for the proposition that a plaintiff may prevail on a claim of negligence per se based on HIPAA or HITECH.

EDWARD R. ARDINI, JR., JUDGE

All concur.