HURLEY v. ROCHESTER REGIONAL HEALTH ACO INC (2025)

MEMORANDUM AND ORDER

It is hereby ORDERED that the order so appealed from is unanimously modified on the law by denying the motion in part and reinstating the negligence claim against defendants Rochester Regional Health ACO, Inc. and Greater Rochester Independent Practice Association, Inc., and as modified the order is affirmed without costs.

Memorandum: Plaintiffs commenced this action alleging that, attendant to the health care services they received from defendant Rochester General Hospital (RGH), confidential medical records were generated and that those confidential medical records were stored on computer systems and networks maintained by RGH and defendants Rochester Regional Health ACO, Inc. (RRH) and Greater Rochester Independent Practice Association, Inc. (GRIPA). Plaintiffs further allege that defendant Christine M. Smith, R.N., a nurse at RGH, impermissibly accessed those records due to the failure of RGH, RRH and GRIPA “to exercise reasonable care in obtaining, retaining, securing, safeguarding, and protecting this confidential medical information from unlawful access.” On appeal, plaintiffs contend that Supreme Court erred in granting the motion of RRH and GRIPA (hereafter, defendants) to dismiss the complaint against them on the grounds of documentary evidence and failure to state a cause of action (see CPLR 3211 [a] [1], [7]). We agree with plaintiffs in part.

On a motion to dismiss, a court must accept the plaintiff's allegations as true and determine whether they fit into any cognizable legal theory (see Lawrence v. Graubard Miller, 11 N.Y.3d 588, 595, 873 N.Y.S.2d 517, 901 N.E.2d 1268 [2008]; Matter of Machado v. Tanoury, 142 A.D.3d 1322, 1323, 38 N.Y.S.3d 356 [4th Dept. 2016]). Affidavits submitted by a plaintiff may also be considered to remedy any defects in the complaint (see Leon v. Martinez, 84 N.Y.2d 83, 88, 614 N.Y.S.2d 972, 638 N.E.2d 511 [1994]). Affidavits submitted by the defendant, however, rarely warrant dismissal of the complaint unless they conclusively establish that the plaintiff has no cause of action (see Rovello v. Orofino Realty Co., 40 N.Y.2d 633, 636, 389 N.Y.S.2d 314, 357 N.E.2d 970 [1976]; see generally Koike Aronson, Inc. v. Bearing Distribs., Inc., 208 A.D.3d 956, 957, 173 N.Y.S.3d 366 [4th Dept. 2022]).

“A medical corporation may ․ be liable in tort for failing to establish adequate policies and procedures to safeguard the confidentiality of patient information or to train their employees to properly discharge their duties under those policies and procedures. These potential claims provide the requisite incentive for medical providers to put in place appropriate safeguards to ensure protection of a patient's confidential information” (Doe v. Guthrie Clinic, Ltd., 22 N.Y.3d 480, 485, 982 N.Y.S.2d 431, 5 N.E.3d 578 [2014]). Here, plaintiffs alleged that defendants generated and maintained the medical records that Smith impermissibly accessed and that they breached their duty to properly safeguard or monitor access to those records. Accepting as true the allegations in the complaint and the averments in the affidavits submitted in opposition to the motion, we conclude that plaintiffs have sufficiently alleged a negligence claim. We therefore conclude that the court erred in granting the motion with respect to the negligence claim against defendants, and we modify the order accordingly.

However, given that such a claim “gives rise to a cause of action sounding in tort” and not in breach of an implied contract (MacDonald v. Clinger, 84 A.D.2d 482, 482, 446 N.Y.S.2d 801 [4th Dept. 1982]), we conclude that the court properly granted the motion with respect to the implied contract claim against defendants.