Home > Legal Updates >

N.Y. Appeals Court Okays Punitive Damages For Unintentional Data Breaches

A New York State court decision upholding a jury award of significant punitive damages for a privacy breach signals to all employers -- and especially health care employers -- that deal with personal information of the urgent need to establish data handling protocols and to train employees and administrative staff, as well as professionals, on these protocols.

The New York Supreme Court Appellate Division ruled in a 3-2 decision that punitive damages can be awarded for a grossly negligent breach of confidential medical information even if the breach was not intentional or malicious. In this case, the jury awarded the plaintiff $365,000 ($65,000 in compensatory emotional distress damages and $300,000 in punitive damages).

On October 14, 1999, the plaintiff underwent an abortion at a surgery center. She specifically instructed a member of the Center's staff that her home phone number was not to be used and that all calls regarding her medical treatment were to be made to her cell phone number, which she provided. The plaintiff lived with her parents, who were strongly opposed to both premarital sex and abortion. The plaintiff did not want them to learn about the procedure.

In her pre-operative history questionnaire, the plaintiff included her home phone number, but later crossed it out. However, administrative personnel apparently used the questionnaire to generate labels that included her home telephone number that were affixed to nearly every page of the plaintiff's medical file.

Believing the plaintiff did not complete all of the required blood work following her release from the Center, a nurse called the home number listed in the file to follow up with the plaintiff. Despite realizing that she was speaking with the plaintiff's mother, the nurse spoke about the plaintiff's condition. Although she did not expressly state the plaintiff had had an abortion, the nurse's questions and the other information she provided was sufficient for the plaintiff's mother to conclude that her daughter underwent an abortion.

The Appellate Division's concluded that:

the callous, reckless, or grossly negligent disregard of an individual's right to the privacy and confidentiality of sensitive medical informationóa right protected by the declared public policy of this State (see Public Health Law § 2803-c[1], [3][f])-[can] be sufficiently reprehensible and morally culpable to support an award of exemplary damages[citation omitted].

The majority agreed with the dissent's conclusion that the Center was acting in good faith, with no malice or intent to violate the plaintiff's rights, and was concerned about the plaintiff's wellbeing. However, the majority disagreed that proof of a malicious motive or bad faith is a necessary element of all demands for punitive damages. The majority cited a long line of cases in New York recognizing that actors engaging in "grossly negligent or reckless conduct showing an utter disregard for the safety or rights of others may be deserving of the imposition of punitive damages."

The court pointed to the following evidence from which it held the jury could rationally conclude "rose to a level of recklessness, gross negligence, and callous indifference to the plaintiff's rights necessary to support an award of punitive damages":

• The Center had no written plan to implement a patient's right to maintain the privacy and confidentiality of personal and medical records as required under NY Public Health Law Section 2803-c(5). (While the opinion does not discuss the privacy and security regulations under the Health Insurance Portability and Accountability Act (HIPAA), it is likely that the Center is covered under those regulations, in which case, it also has a duty under federal law to have similar policies and procedures in place.)
• There was no written "no-call" policy. Three different nurses testified as to three different practices for handling no-call requests.
• There was no reason to call the plaintiff's home since, unbeknownst to the nurse that made the call, the Center had received results of the blood work it needed earlier that morning.
• The nurse continued to discuss the plaintiff's medical issues with the plaintiff's mother, even though she knew she was speaking with the mother and not the plaintiff, and the Center had received specific instructions to call the plaintiff's cell phone number only.

In short, the majority held, "[T]here was no justification whatsoever offered for the remarkably casual way in which the Center handled the plaintiff's sensitive medical information, and the need to deter other medical providers from engaging in similar conduct could not be clearer."

Ultimately, the court ordered a new trial in this case on the issue of punitive damages because of errors committed by the trial court. The trial court failed to (i) admit certain evidence for the jury to consider in determining the punitive damages and (ii) adequately instruct the jury as to the clear and convincing standard of proof necessary to support an award of punitive damages, the appeals court said. Nonetheless, an aggrieved party's entitlement to punitive damages under similar circumstances is plainly recognized.

While this decision clearly is required reading for the Privacy Officer of any health care provider in New York, particularly those in organizations that have not taken adequate steps to protect patient confidentiality, its effects could be felt more broadly. Reasoning similar to the majority's in this decision could be applied to all businesses in the state responsible for maintaining sensitive personal information.

In recent years, New York and other states have enacted laws requiring the protection of certain personal information, the wrongful disclosure of which could have significant adverse consequences for the individual. Many businesses and employers have yet to take steps to comply with these requirements, leaving them open to a court concluding, as here, that their grossly negligent or reckless conduct showed an utter disregard for the safety or rights of others and are, therefore, deserving of the imposition of punitive damages.

The Workplace Privacy Group at Jackson Lewis can help employers both to evaluate your needs in this area and to set up appropriate procedures and training.

Related Links
Long Island Surgery Center New York Supreme Court Opinion [224 KB] Massachusetts Identity Theft Law Creates Data Breach Notification, Protection and Destruction Requir New York AG announces first settlement under NY's Information Security Breach and Notification Law