Elizabeth Lawson v. Patricia Halpern-Reiss and Central Vermont Medical Center

NOTICE: This opinion is subject to motions for reargument under V.R.A.P. 40 as well as formal
revision before publication in the Vermont Reports. Readers are requested to notify the Reporter
of Decisions by email at: JUD.Reporter@vermont.gov or by mail at: Vermont Supreme Court, 109
State Street, Montpelier, Vermont 05609-0801, of any errors in order that corrections may be made
before this opinion goes to press.


                                          2019 VT 38

                                          No. 2018-157

Elizabeth Lawson                                               Supreme Court

                                                               On Appeal from
   v.                                                          Superior Court, Washington Unit,
                                                               Civil Division

Patricia Halpern-Reiss and                                     December Term, 2018
Central Vermont Medical Center


Mary Miles Teachout, J.

David C. Sleigh and Kyle L. Hatt of Sleigh Law, St. Johnsbury, for Plaintiff-Appellant.

Nicole Andreson and Angela R. Clark of Dinse, Knapp & McAndrew, P.C., Burlington, for
 Defendant-Appellee Central Vermont Medical Center.


PRESENT: Reiber, C.J., Skoglund, Robinson and Eaton, JJ., and Howard, Supr. J. (Ret.),
         Specially Assigned


        ¶ 1.   EATON, J. In this appeal, we are asked to recognize a common-law private right

of action for damages resulting from the unjustified disclosure to a third party of information

obtained by medical personnel during treatment. Plaintiff alleges in her lawsuit that she incurred

damages as the result of an emergency room nurse informing a police officer that she was

intoxicated, had driven to the hospital, and was intending to drive home. The trial court granted

defendant Central Vermont Medical Center (CVMC) summary judgment based on its

determination that nothing in the record supported an inference that the nurse’s disclosure of the

information was for any reason other than her good-faith concern for plaintiff’s and the public’s
safety. In this opinion, we recognize a common-law private right of action for damages based on

a medical provider’s unjustified disclosure to third persons of information obtained during

treatment. Like the trial court, however, we conclude that CVMC was entitled to judgment as a

matter of law because, viewing the material facts most favorably to plaintiff and applying the

relevant law we adopt today, we conclude that no reasonable factfinder could determine that the

disclosure was for any purpose other than to mitigate the threat of imminent and serious harm to

plaintiff and the public. Accordingly, we affirm the trial court’s judgment.

                                   I. Facts and Procedural History

       ¶ 2.    The following facts are taken from the parties’ statements of undisputed material

facts, viewing them most favorably to plaintiff, the nonmoving party.1 During the early morning

hours of May 10, 2014, plaintiff drove herself to CVMC after lacerating her arm. She arrived at

the emergency room at 2:12 a.m. The charge nurse (Clinical Nurse Coordinator) detected a heavy

odor of alcohol on plaintiff’s breath, and it became apparent to the nurse that plaintiff had been

drinking. Members of the treatment team administered an alco-sensor test to assess plaintiff’s

level of intoxication. The test revealed a breath-alcohol concentration of .215, over two and one-

half times the legal limit, at 2:40 a.m.

       ¶ 3.    Based on information provided by plaintiff, the charge nurse understood that

plaintiff did not have a ride home. After her laceration was treated, plaintiff did not meet the

criteria for admission to the hospital and was cleared for discharge. She was discharged at 3:05

a.m.




       1
           For the most part, the facts are undisputed. Plaintiff did not directly contest any of
CVMC’s alleged undisputed facts but alleges some facts that vary slightly from those alleged by
CVMC. CVMC disputes only a couple of the facts alleged by plaintiff but also argues that those
facts are not material to the legal issues in this case. None of the disputed facts bear on the outcome
of this decision.
                                                     2
       ¶ 4.       A police officer was on duty in the emergency room pursuant to a contract between

CVMC and the Berlin Police Department. Shortly before plaintiff was discharged, the charge

nurse approached the officer and informed him that plaintiff was blatantly intoxicated,2 that she

had driven herself to the hospital, and that she was about to drive herself home. After receiving

this information from the charge nurse and communicating with plaintiff, the officer arrested her

on suspicion of driving while intoxicated. The resulting criminal charge was later dismissed by

the prosecutor.

       ¶ 5.       In July 2016, plaintiff filed a complaint against the charge nurse and CVMC,

alleging that she incurred damages as the result of (1) the nurse’s negligent disclosure of

information obtained during plaintiff’s medical treatment, in violation of the standard of care

applicable to medical providers; and (2) CVMC’s inadequate training and failure to develop

policies regarding the disclosure of information obtained during medical treatment.

       ¶ 6.       In December 2017, following discovery, defendants moved for summary judgment.

Regarding plaintiff’s negligence claim against the charge nurse, defendants argued that this Court

has never recognized a duty enforceable in a tort action not to disclose information obtained during

medical treatment and that, even if such a duty existed, the nurse’s disclosure of information in

this case fully complied with the Health Insurance Portability and Accountability Act of 1996

(HIPAA), see 42 U.S.C. § 1320d-6 (concerning wrongful disclosure of individually identifiable

health information), because it was done to avert an imminent threat to plaintiff’s and the public’s

safety. Defendants further argued that plaintiff could not prevail on her claim against CVMC

because that claim was dependent upon the underlying claim against the charge nurse. In opposing

summary judgment, plaintiff noted that the vast majority of jurisdictions have recognized a private

right of action for damages resulting from the disclosure of information obtained during medical


       2
         Plaintiff, but not CVMC, used the word “blatantly” in her statement of undisputed facts.
The officer’s affidavit indicates that the nurse told him that plaintiff was “blatantly intoxicated.”
                                                   3
treatment. She argued that there were disputed material facts concerning whether the disclosure

of the information in this case was necessary to protect plaintiff or the public.

       ¶ 7.    In May 2018, the trial court granted summary judgment to CVMC.3 After noting

that the patient’s privilege set forth in 12 V.S.A. § 1612 is an evidentiary privilege applicable only

in judicial proceedings, see Kuligoski v. Brattleboro Retreat, 2016 VT 54A, ¶ 60, 203 Vt. 328, 156

A.3d 436, and that plaintiff had failed to identify any Vermont authority in support of a greater

rule of confidentiality than that set forth in HIPAA, the court ruled that the disclosure at issue here

did not violate HIPAA. In so ruling, the court relied on a HIPAA regulation permitting the

disclosure of information based on the presumed good-faith belief that the disclosure was

necessary to prevent a serious and imminent threat to the health or safety of a person or the public.

In the court’s view, there was no record basis for any reasonable inference that plaintiff’s

disclosure to an onsite police officer was for law enforcement purposes or any reason other than a

good-faith concern for plaintiff’s and the public’s safety. Having found no negligence, the court

granted CVMC summary judgment on both counts set forth in plaintiff’s complaint.4




       3
          In its decision, the court noted that the charge nurse had been dismissed from the case
pursuant to the parties’ stipulation. As the court pointed out, although plaintiff’s first count
alleging negligence against the nurse was presumably dismissed along with the nurse, the
stipulation did not expressly state that that count had been withdrawn. The court surmised that the
parties may have intended to preserve the claim as against CVMC on a respondeat superior theory;
however, the court determined that it did not need to clarify the matter any further because the
nurse’s breach of a duty is a necessary predicate to the negligent supervision claim against CVMC.
When asked at oral argument on appeal about a respondeat superior theory, CVMC’s attorney
acknowledged that the parties’ attorneys had agreed in an unrecorded conversation during the trial
court proceedings that if the nurse were dismissed from the case, CVMC would not take the
position that respondeat superior was inapplicable here.
       4
          The court also noted, with respect to plaintiff’s second count, that plaintiff had not
provided an expert opinion regarding what policies or training CVMC should have had in place
and that such matters require expert support because they are not within the ordinary knowledge
of laypersons. See Taylor v. Fletcher Allen Health Care, 2012 VT 86, ¶¶ 10, 192 Vt. 418, 60 A.3d
646 (determining that plaintiff’s claims of fault and causation were “sufficiently complex as to be
beyond the scope of common knowledge to a layperson”).
                                                  4
                                      II. The Claims of Error

       ¶ 8.    On appeal, plaintiff argues that: (1) the trial court erred in holding that there is no

common law remedy for a health care provider’s breach of a duty of confidentiality; and

(2) assuming there is such a remedy, the court erred in granting CVMC summary judgment insofar

as there are material facts in dispute as to whether the nurse breached the duty of confidentiality

regarding information obtained during the course of medical treatment.

                                    A. Private Right of Action

       ¶ 9.    Plaintiff first argues that this Court should recognize a common-law private remedy

for breach of a medical provider’s duty of confidentiality concerning the disclosure of information

obtained during medical treatment.       Plaintiff seeks a common-law remedy because neither

Vermont law nor HIPAA provides a private right of action to obtain damages incurred as the result

of a medical provider’s disclosure of information obtained during treatment. See Warren Pearl

Constr. Corp. v. Guardian Life Ins. Co., 639 F. Supp. 2d 371, 377 (S.D.N.Y. 2009) (collecting

numerous federal court cases recognizing that no private right of action exists under HIPAA);

Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C. (Byrne I), 102 A.3d 32, 41, 45 (Conn.

2014) (noting “the long line of federal and state cases establishing that there is no private right of

action, express or implied, under HIPAA,” which enforces its provisions through administrative

imposition of fines and imprisonment); Bonney v. Stephens Mem’l Hosp., 2011 ME 46, ¶¶ 17, 19,

17 A.3d 123 (noting that all courts addressing issue have concluded that no private right of action

exists under HIPPA, which provides only for administrative enforcement of its provisions).

       ¶ 10.   On the other hand, although HIPAA serves in part to “protect the privacy of

patients’ health information given emerging advances in information technology,” it does not

preempt causes of action arising under state common or statutory law imposing liability for “health

care providers’ breaches of patient confidentiality.” Byrne I, 102 A.3d at 35, 45-48 (citing federal

and state courts holding that HIPAA does not preempt state law imposing liability over and above

                                                  5
that authorized by federal law). Indeed, as many courts have recognized, HIPAA may act as a

guidepost or otherwise “inform the relevant standard of care” for state law claims alleging unlawful

disclosure of information obtained during medical treatment. Id. at 46-48, 49 (citing cases and

concluding that “to the extent it has become the common practice for Connecticut health care

providers to follow the procedures required under HIPAA in rendering services to patients, HIPAA

and its implementing regulations may be utilized to inform the standard of care applicable to such

claims arising from allegations of negligence in the disclosure of patients’ medical records

pursuant to a subpoena”).

       ¶ 11.   English common law did not afford patients a cause of action based on an

expectation of privacy in information disclosed during medical treatment, Hammonds v. Aetna

Cas. & Sur. Co., 243 F. Supp. 793, 795 n.1 (N.D. Ohio 1965), but the notion “that physicians

should respect the confidences revealed by their patients in the course of treatment is a concept

that has its genesis in the Hippocratic Oath.” McCormick v. England, 494 S.E.2d 431, 435 (S.C.

1997). By the 1960s and 1970s, several courts had recognized a private right of action for damages

resulting from medical providers’ wrongful disclosure of information obtained during treatment,

and currently the vast majority5 of jurisdictions addressing whether to recognize such a cause of

action have chosen to do so. See Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C. (Byrne

II), 175 A.3d 1, 7, 11-15 (Conn. 2018) (discussing cases and joining clear modern consensus of

courts recognizing private cause of action for damages resulting from unlawful disclosure of

patients’ medical information); McCormick, 494 S.E.2d at 435 (citing majority of jurisdictions


       5
          Three federal district courts in older decisions declined to recognize such a cause of
action because of the then-current state caselaw in their districts, see Mikel v. Abrams, 541 F.
Supp. 591, 599 (W.D. Mo. 1982); Logan v. Dist. of Columbia, 447 F. Supp. 1328, 1335 (D.D.C.
1978), or because state law did not recognize a confidential relationship between physician and
patient, Collins v. Howard, 156 F. Supp. 322, 324 (S.D. Ga. 1957). The Supreme Court of
Tennessee declined to recognize a cause of action for breach of patient confidentiality because the
state had no common law or statutory privilege for communications between patients and
physicians. Quarles v. Sutherland, 389 S.W.2d 249, 251 (Tenn. 1965).
                                                 6
recognizing cause of action based on medical provider’s unauthorized disclosure of information

obtained during treatment); see also J. Zelin, Annotation, Physician’s Tort Liability for

Unauthorized Disclosure of Confidential Information About Patient, 48 A.L.R.4th 668, § 2(a)

(1986) (stating that courts have generally recognized right of patients to recover damages from

physicians for unauthorized disclosure of information obtained during treatment).

       ¶ 12.   In recognizing this common-law private right of action, courts have relied on

various theories, “including invasion of privacy, breach of implied contract, medical malpractice,

and breach of a fiduciary duty or a duty of confidentiality.” McCormick, 494 S.E.2d at 436. The

most commonly accepted theory is breach of the duty of confidentiality, insofar as “health care

providers enjoy a special fiduciary relationship with their patients” such that “recognition of the

privilege is necessary to ensure that the bond remains.” Byrne II, 175 A.3d at 12; see Biddle v.

Warren Gen. Hosp., 715 N.E.2d 518, 523 (Ohio 1999) (citing cases for proposition that “courts

have moved toward the inevitable realization that an action for breach of confidence should stand

in its own right, and increasingly courts have begun to adopt an independent tort in their respective

jurisdictions”); Humphers v. First Interstate Bank of Or., 696 P.2d 527, 534-35 (Or. 1985)

(explaining why breach of duty of confidentiality is correct basis for tort alleging wrongful

disclosure of medical information).

       ¶ 13.   As evidence of sound public policy underlying the recognition of liability for

breach of the duty of confidentiality, courts have cited “(1) state physician licensing statutes,

(2) evidentiary rules and privileged communication statutes which prohibit a physician from

testifying in judicial proceedings; (3) common law principles of trust, and (4) the Hippocratic Oath

and principles of medical ethics which proscribe the revelation of patient confidences.”

McCormick, 494 S.E.2d at 435; accord Byrne II, 175 A.3d at 15; see Hammonds, 243 F. Supp. at

797 (asserting that public policy in support of actionable breach of confidentiality is reflected in

medical profession’s code of ethics, privileged communication statute, and state medical licensing

                                                 7
statute). At the core of this reasoning is that when confidentiality between a medical provider and

a patient is diminished in any way, it negatively impacts trustful communication between the two,

which, in turn, degrades the medical provider’s ability to render effective treatment. Bryne II, 175

A.3d at 7; see Alberts v. Devine, 479 N.E.2d 113, 118 (Mass. 1985) (noting self-evident benefits,

including creating environment most favorable for treatment and recovery of patient, of fostering

confidentiality between medical provider and patient); Sorensen v. Barbuto, 2008 UT 8, ¶ 12, 177

P.3d 614 (stating that duty of confidentiality “arises from the understanding that good medical care

requires a patient’s trust and confidence that disclosures to physicians will be used solely for the

patient’s welfare and that a patient’s privacy with regard to those disclosures will be respected and

protected”).

       ¶ 14.    For the same public policy reasons, we join the consensus of jurisdictions

recognizing a common-law private right of action for damages arising from a medical provider’s

unauthorized disclosure of information obtained during treatment. We do not do so lightly. See

Hay v. Med. Ctr. Hosp. of Vt., 145 Vt. 533, 539-40, 496 A.2d 939, 943 (1985) (acknowledging

that caution must be taken in recognizing new cause of action but nonetheless recognizing cause

of action for minor child’s loss of parental consortium “to see justice made available within our

legal system, which is of paramount importance”). As we have stated on multiple occasions, “[w]e

will not recognize a new cause of action or enlarge an existing one without first determining

whether there is a compelling public policy reason for the change.” Knight v. Rower, 170 Vt. 96,

107, 742 A.2d 1237, 1245 (1999) (quotation omitted) (declining to extend social host liability in

Vermont).      In this instance, however, public recognition and endorsement of a duty of

confidentiality between medical providers and their patients is already evidenced in our law;

therefore, providing a common-law remedy for a medical provider’s breach of that duty upholds

the expectations of the providers, their patients, and the general public. See Byrne II, 175 A.3d at

20-21 (Robinson, J, concurring) (emphasizing “continuing reticence to recognize new [common-

                                                 8
law] causes of action” because it is normally duty of legislature and not court to make law, but

acknowledging that providing common-law remedy for medical provider’s breach of duty of

confidentiality is “an appropriate exercise of our common-law authority to recognize new causes

of action”).

       ¶ 15.   Many of this State’s laws underscore Vermont’s policy of protecting patient

confidentiality by prohibiting the disclosure of patient information. Under Vermont law, hospital

patients have “the right to expect that all communications and records pertaining to [their] care

shall be treated as confidential.” 18 V.S.A. § 1852(a)(7). Failure to comply with this provision

may result in disciplinary action against a physician. Id. § 1852(b). Although only applicable in

the context of a judicial proceeding, Kuligoski, 2016 VT 54A, ¶ 60, Vermont has established by

statute and rule a patient’s privilege against a medical provider’s disclosure of information

obtained in attending the patient, with some exceptions. 12 V.S.A § 1612; V.R.E. 503.

       ¶ 16.   On the other hand, and equally as important, various Vermont statutes compel

medical providers to disclose certain information to protect the public. See, e.g., 13 V.S.A.

§ 3504(a)(3) (providing immunity from civil suit for health care provider making good-faith report

of disease associated with weapons of mass destruction); id. 4012(a) (requiring physician treating

gunshot wound to report case to law enforcement); 18 V.S.A. §§ 1001, 1004, 1007, 1041, 1092-

1093 (requiring medical providers to report information concerning patients diagnosed with or

suspected of having communicable diseases dangerous to public health); 23 V.S.A. § 1203b(a)

(requiring medical provider who is treating person in emergency room as result of motor vehicle

accident to report to law enforcement blood-test result exceeding legal limit, notwithstanding any

law or rule to contrary). By requiring disclosure under certain circumstances and in some cases

providing immunity for the disclosure, statutes such as these implicitly acknowledge that medical

providers have a general duty of confidentiality and that a violation of that duty may subject them

to liability. McCormick, 494 S.E.2d at 439; Brandt v. Med. Def. Assocs., 856 S.W.2d 667, 670

                                                9
(Mo. 1993) (stating that statutes providing exceptions to medical providers’ duty of confidentiality

“implicitly acknowledge that, in absence of such an exemption, there would be a breach of this

duty”).

          ¶ 17.   The most recent and explicit example of the Legislature’s recognition of medical

providers’ duty of confidentiality is its enactment of a law prohibiting the disclosure of “protected

health information” by a “covered entity,” as the terms are defined by federal regulations, “unless

the disclosure is permitted under” HIPAA. 18 V.S.A. § 1881. At the same time, the Legislature

abrogated this Court’s decision in Kuligoski, which had expanded mental health providers’ duty

to warn of a patient’s dangerous propensities, and instead “limit[ed] mental health professional’s

duty to that as established in common law by Peck v. Counseling Service of Addison County, Inc.,

146 Vt. 61 (1985).” 18 V.S.A. § 1882(a). Although these statutes had an effective date of October

1, 2016, see 2015, No. 169 (Adj. Sess.), §§ 1-2, and thus do not directly govern this case, they

further evince the longstanding legislative policy of protecting patient confidentiality.6


          6
           The fact that 18 V.S.A. § 1881 does not explicitly provide for a private right of action
does not necessarily demonstrate that the Legislature intended to foreclose such a remedy. See
Wear v. Walker, 800 S.W.2d 99, 103 (Mo. Ct. App. 1990) (“Where a statute creates a right, but is
silent as to the remedy, the party entitled to the right may resort to any common law action which
would afford [that party] adequate and appropriate means of redress.”). “Restatement (Second) of
Torts § 874A provides a framework for determining whether a private action for damages is
available to remedy the violation of a statute that does not expressly include a civil remedy.”
Montague v. Hundred Acre Homestead, LLC, 2019 VT 16, ¶ 23, ___ Vt. ___, ___ A.3d ___.
Under § 874A, when a statute protects a class of persons by prohibiting certain conduct but does
not explicitly provide a civil remedy, a court may afford a remedy to a person protected by the
statute—either under an existing tort or by recognizing a new cause of action—as long as the
remedy furthers the purpose of the statute and is needed to assure the effectiveness of the statute.
See Restatement (Second) of Torts 874A cmt. i (1979) (stating that plaintiff must be member of
protected group and must show that “the interest invaded, the harm resulting to that interest and
the hazard producing the harm were all within the purview of the legislative provision”). The
Restatement identifies the following six factors for consideration, with the primary test being
whether a private tort remedy would be consistent with and promote the effectiveness of the policy
underlying the statute: the specificity of the statute, the adequacy of existing remedies, the extent
to which a tort action would supplement or interfere with other existing remedies, the significance
of the legislative purpose, the extent of the change in tort law, the burden that the new tort would
create on the judicial system, and whether plaintiffs would be able to show that they are in a
protected class. Id. § 874A cmt. h. Although we reiterate that 18 V.S.A. § 1881 is not directly
                                                   10
       ¶ 18.    Nevertheless, courts addressing the duty of patient confidentiality have recognized

the need for practical limitations on prohibiting medical providers from disclosing information

obtained during treatment—beyond what they are required to disclose by statute. See McCormick,

494 S.E.2d at 438 (noting that jurisdictions recognizing cause of action for breach of duty of patient

confidentiality “do not hold that this duty is absolute”); cf. Peck v. Counseling Serv. of Addison

Cty., Inc., 146 Vt. 61, 67, 499 A.2d 422, 426 (1985) (noting “that the [patient] privilege is not

sacrosanct and can properly be waived in the interest of public policy under appropriate

circumstances,” such as when patient threatens harm to identified victim). As recognized in

HIPAA, § 1881, and many other Vermont laws, including those cited above, under certain

circumstances information obtained during medical treatment either may or must be disclosed to

protect the interests or safety of the patient or others. The right to disclose such information “is

not necessarily coextensive with a duty to disclose.” Biddle, 715 N.E.2d at 524; Humphers, 696

P.2d at 535 (“Even without such a legal obligation, there may be a privilege to disclose information

for the safety of individuals or important to the public in matters of public interest.”).

       ¶ 19.   In § 1881, the Legislature has indicated a policy preference of essentially codifying

into state law the requirements of HIPAA. See 18 V.S.A. § 1881(b) (stating that covered entity

may not disclose protected health information unless disclosure is permitted under HIPAA). Given

the Legislature’s reliance on HIPAA, and medical care providers’ familiarity with the law, we

conclude that the federal statute and its implementing regulations should inform the standard of

care and establish the framework for exceptions to medical care providers’ duty of confidentiality.




applicable in this case, we see nothing in these tests or factors that would caution us against
recognizing a common-law private right of action for breach of the duty of patient confidentiality,
given the absence of an express remedy in § 1881. Indeed, the common-law private remedy we
recognize today furthers the purposes of § 1881 and is also consistent with and complimentary to
HIPAA, upon which § 1881 relies. See Byrne II, 175 A.3d at 11 (stating that common-law private
cause of action would not conflict with or complicate compliance with HIPAA, especially given
medical providers’ familiarity with HIPAA).
                                               11
Byrne I, 102 A.3d at 49 (concluding that because health care providers are familiar with HIPAA

procedures in rendering care to patients, HIPAA and its implementing regulations may be used to

inform standard of care applicable to tort claims arising from allegations of negligent disclosure

of patients’ medical records). Although we ultimately uphold the trial court’s grant of summary

judgment in favor of CVMC in this case, we adopt a widely recognized common-law private right

of action, using the HIPAA framework as a guide, rather than speculate as to whether or what right

of action we would adopt in considering whether defendant is entitled to summary judgment.

                                  B. Summary Judgment Ruling

       ¶ 20.   Plaintiff argues that the trial court erred in granting CVMC summary judgment

because there are disputed material facts as to whether the information provided to the onsite police

officer was legally compelled or necessary to prevent imminent danger to plaintiff or the public.

CVMC responds that plaintiff fails to identify specific material facts in dispute and that the

evidence demonstrates the nurse’s good-faith belief that the information she provided to the officer

was necessary to protect plaintiff and the public. CVMC posits that the hospital may well have

been liable for any resulting damages had the nurse not provided the information to the officer and

had plaintiff driven from the hospital and injured herself or others.

       ¶ 21.   “We review summary judgment de novo, using the same standard as the trial court:

summary judgment is appropriate if the moving party shows that the material facts are not

genuinely disputed and that he or she is entitled to judgment as a matter of law.” Gross v. Turner,

2018 VT 80, ¶ 8, ___ Vt. ___, 195 A.3d 654 (citing V.R.C.P. 56(a)). “In determining whether a

genuine dispute of material fact exists, the nonmoving party is entitled to the benefit of all

reasonable doubts and inferences.” Id. (quotation omitted). “Once a claim is challenged by a

properly supported motion for summary judgment, the nonmoving party may not rest upon the

allegations in the pleadings but must come forward with admissible evidence to raise a dispute

regarding the facts.” Id.

                                                 12
        ¶ 22.   In this case, relying on a regulatory HIPAA exception for good-faith disclosures to

prevent serious and imminent threats to the safety of the public, the trial court granted summary

judgment to CVMC based on its determination the record did not contain “any reasonable

inference that [the charge nurse’s] disclosure to the onsite police officer was for law enforcement

purposes or any other reason than out of a good-faith concern for [plaintiff’s] and the traveling

public’s safety.” Plaintiff argues here, as she did before the trial court, that there are material facts

in dispute that compel the denial of CVMC’s motion for summary judgment, but she does not state

what those facts are. A vague allegation that facts are contested, without more, is insufficient to

withstand summary judgment. See Baldwin v. Upper Valley Servs., Inc., 162 Vt. 51, 55, 644 A.2d

316, 318 (1994) (“Opposing allegations must have sufficient support in specific facts to create a

genuine issue of material fact.”).

        ¶ 23.   Both the trial court and the parties focused on the HIPAA regulation permitting

“disclosures to avert a serious threat to health or safety.” 45 C.F.R. § 164.512(j). In relevant part,

the regulation permits a “covered entity” to disclose “protected health information” as long as two

conditions are met: the covered entity has a good-faith belief that the disclosure is “necessary to

prevent or lessen a serious and imminent threat to the health or safety of a person or the public,”

and the disclosure is “to a person or persons reasonably able to prevent or lessen the threat,

including the target of the threat.” Id. § 164.512(j)(1)(i). The regulation further provides that a

covered entity disclosing information pursuant to this exception is “presumed to have acted in

good faith with regard to a belief described in” the exception. Id. § 164.512(j)(4).

        ¶ 24.   We conclude that this exception, including its good-faith component, provides an

appropriate limit to obtaining damages for the disclosure of information obtained during medical

treatment. While we recognize that due care must “be exercised in order to insure that only that

information which is necessary to protect the potential victim is revealed,” Peck, 146 Vt. at 68,

499 A.2d at 427, we must be cautious in requiring medical providers, particularly in emergency

                                                   13
situations such as this, to parse too finely what information can or cannot be disclosed to protect

individuals or the public in general from an imminent and serious threat of harm.

        ¶ 25.   CVMC does not contest that it is a covered entity and that the information provided

to the onsite police officer was protected health information. Nor does plaintiff contest that,

assuming there was a threat justifying disclosure of the information, the police officer was a person

reasonably able to prevent the threat. The point of contention is whether the record demonstrates,

as a matter of law, that the nurse had a good-faith belief that all the information provided to the

officer was necessary to prevent a serious and imminent threat to the health or safety of plaintiff

or the general public.

        ¶ 26.   In answering this question, we first reexamine what the nurse told the officer. As

stated above, the nurse indicated that plaintiff was blatantly intoxicated, that she had driven herself

to the hospital, and that she was about to drive herself home. Given the record before us, if the

nurse had told the officer only that plaintiff was blatantly intoxicated and was about to drive herself

home, CVMC would surely be entitled to summary judgment. But we must also consider that the

nurse also told the officer that the blatantly intoxicated plaintiff had driven herself to the hospital,

thereby suggesting that plaintiff had committed a crime. In considering this particular statement,

we recognize that the disclosure exception in § 164.512(j)(1)(i) is directed at preventing future

conduct, in the sense that it allows disclosures based on a good-faith belief that doing so is

necessary to prevent the threat of imminent and serious harm.7


        7
           That is in contrast to the exception in § 164.512(j)(1)(ii), which allows, in most instances,
see id. § 164.512(j)(2), the disclosure of limited types of information, see id. § 164.512(j)(3), when
there is a good-faith belief that the disclosure is necessary for law enforcement to identify or
apprehend someone either because that person has escaped from custody or because an individual
has admitted to participating “in a violent crime that the covered entity reasonably believes may
have caused serious physical harm to the victim.” (Emphasis added.) HIPAA regulations also
contain a permitted disclosure exception for law-enforcement purposes, but that exception has
several conditions, including that the disclosure is in compliance with legal process or required by
law and that it constitutes evidence of a crime that occurred on the premises of the covered entity.
See id. § 164.512(f).
                                                    14
        ¶ 27.   The critical question, then, is whether, as a matter of law, and based on the evidence

viewed most favorably to plaintiff, the nurse had a good-faith belief that telling the officer the

intoxicated plaintiff had driven herself to the hospital was necessary to prevent the imminent and

serious threat of her driving in an intoxicated state away from the hospital. In answering this

question, we consider the meaning of the term “good faith” in this context, as well as the record

evidence in light of that meaning.

        ¶ 28.   “Good faith” is undefined in the HIPPA regulations that we rely on in establishing

the scope of, and exceptions to, the duty we are recognizing today. Although the term “good faith”

is ubiquitous in the law, “its meaning varies somewhat with the context.” Restatement (Second)

of Contracts § 205 cmt. a (1979); see Good Faith, Black’s Law Dictionary (10th ed. 2014) (quoting

description of good faith in R. Brownsword et al., Good Faith in Contract in Good Faith in

Contract: Concept and Context, 1, 3 (1999), as “ ‘an elusive idea, taking on different meanings

and emphases as we move from one context to another’ ”).

        ¶ 29.   In connection with the qualified immunity defense, Vermont has adopted the

federal objective “good faith” test whereby we evaluate the objective reasonableness of the

official’s conduct in relation to settled, clearly established law. See Cook v. Nelson, 167 Vt. 505,

509-10, 712 A.2d 382, 384 (1998). Under this objective test, acts committed without any ill intent

may be excluded from the protections of qualified immunity. Id. Similarly, under the Uniform

Common Interest Ownership Act, we have explained that “good faith” means “in a commercially

reasonable manner.” Will v. Mill Condo. Owners’ Ass’n, 2004 VT 22, ¶ 15, 176 Vt. 380, 848

A.2d 336. This too is an objective definition that does not require us to divine the subjective intent

of the actor.




                                                 15
       ¶ 30.   In other contexts, “good faith” is primarily a subjective concept relating to the

intentions of the actor rather than the reasonableness of the acts. 8 For example, in discussing the

factors relevant to a civil claim of conversion, this Court discussed the actor’s “good faith” and

“intent” interchangeably. Montgomery v. Devoid, 2006 VT 127, ¶ 16, 181 Vt. 154, 915 A.2d 270;

see Carter v. Gugliuzzi, 168 Vt. 48, 58, 716 A.2 17, 24-25 (1998) (equating “lack of intent to

deceive” and “good faith”).

       ¶ 31.   Notably, numerous courts have applied a subjective good-faith standard with

respect to statutes providing immunity from civil or criminal liability for persons disclosing

medical information in good faith while reporting or aiding in the investigation of child abuse.

Nelson v. Lindaman, 867 N.W.2d 1, 8, 12-13 (Iowa 2015) (applying subjective standard under

Iowa statute and citing other jurisdictions that have done so in construing similar statutes). The

subjective standard is adopted in that context in part because good faith “rests on a defendant’s

subjective honest belief that the defendant is aiding and assisting in the investigation of a child

abuse report.” Garvis v. Scholten, 492 N.W.2d 402, 404 (Iowa 1992) (reasoning that statute was

intended “to encourage those having information about child abuse to come forward when asked




       8
          In yet other circumstances, “good faith” may encompass both subjective and objective
elements. See, e.g., Lauzon v. State Farm Mut. Auto. Ins. Co., 164 Vt. 620, 621, 674 A.2d 1246,
1247 (1995) (mem.) (explaining that in context of complaints for bad faith handling of insurance
claims plaintiff must show both that insurance company had no reasonable basis to deny coverage
under policy and that company knew or recklessly disregarded fact that no reasonable basis existed
for denying claim); see also Trepanier v. Getting Organized, Inc., 155 Vt. 259, 269-70, 583 A.2d
583, 590 (1990) (“We need not decide at this point whether we will determine the presence of
good faith on a subjective or objective standard or a combination of both. It is sufficient to say
that a contracting party who acts in complete disregard of the honest advice it is contractually
obligated to give merely to further its own interests can be found to lack good faith.”). The
definitions of “good faith” in Black’s Law Dictionary encompass both subjective and objective
elements. See Good faith, Black’s Law Dictionary (“A state of mind consisting in (1) honesty in
belief or purpose, (2) faithfulness to one’s duty or obligation, (3) observance of reasonable
commercial standards of fair dealing in a given trade or business, or (4) absence of intent to defraud
or to seek unconscionable advantage.”).
                                                 16
to do so, without the fear of litigation should it later be shown that the information was improperly

released”).

       ¶ 32.     Because we have adopted the standards in HIPAA as framing the contours and

limits of a cause of action for breach of the duty not to disclose protected health information, to

answer the pivotal question in this case we must determine how “good faith” is defined for

purposes of § 164.512(j)(1), (4)—and, in particular, whether to apply a subjective or objective test.

For the following reasons, we conclude that the applicable test in this case is a subjective one.

That is, whether the nurse’s motivation for disclosing the protected health care information was

based solely on her belief that the disclosure was necessary to protect or lessen a serious and

imminent threat to health or safety, or whether the nurse sought to satisfy some other purpose,

even a well-intentioned one, apart from this narrow legal exception to her general duty of

nondislcosure.

       ¶ 33.     First, the HIPAA regulation that frames our analysis specifically hinges on the

actor’s good faith in connection with the actor’s actual beliefs, rather than on whether the actor

acted in a manner that is objectively in good faith. See 45 C.F.R. § 164.512(j)(1) (“A covered

entity may, consistent with applicable law and standards of ethical conduct, use or disclose

protected health information, if the covered entity, in good faith, believes the use or

disclosure . . . [i]s necessary to prevent or lessen a serious and imminent threat to the health and

safety of a person or the public . . . .”).9 This wording suggests a subjective understanding of

“good faith” focused on the actor’s intentions and beliefs.

       ¶ 34.     Second, the regulation’s basis for a presumption of good faith supports the view

that the standard of good faith in this circumstance is subjective. In particular, § 164.512(j)(4)

provides that “a covered entity that uses or discloses protected health information pursuant to


       9
         Because plaintiff did not rely on specific applicable standards of ethical conduct, we do
not address whether and how such standards impact the scope of § 164.512(j)(1)(i).
                                                17
paragraph (j)(1) of this section is presumed to have acted in good faith with regard to a belief

described in paragraph (j)(1) . . . if the belief is based on the covered entity’s actual knowledge or

in reliance on a credible representation by a person with apparent knowledge or authority.” The

focus of this presumption is on the subjective knowledge underlying the belief.

       ¶ 35.   Finally, by its terms, this exception will normally apply in emergency situations

involving serious safety concerns when medical providers must make quick decisions about what

information is necessary to prevent the imminent risk of harm. As noted above, we are reluctant

to impose the specter of liability for misjudgment on a health care provider weighing whether to

make a discretionary disclosure to prevent imminent and serious harm to public health and safety.

       ¶ 36.   Applying the subjective standard, we conclude that plaintiff has not met her burden

of production to rebut the applicable presumption of good faith. Through case law and Vermont

Rule of Evidence 301, we have adopted a bursting-bubble theory of presumptions in civil cases,

unless otherwise provided by law. Chittenden v. Waterbury Ctr. Cmty. Church, Inc., 168 Vt. 478,

492, 726 A.2d 20, 29 (1998). Under that theory, “ ‘a presumption shifts only the burden of

production, losing its mandatory effect as soon as evidence sufficient to support a finding of the

nonexistence of the presumed fact is introduced.’ ” Id. (quoting Reporter’s Notes to V.R.E. 301).

We see no policy reason to depart from that theory here.

       ¶ 37.   Thus, CVMC bears the ultimate burden of persuasion as to the applicability of the

good-faith exception to the general rule prohibiting health care providers from disclosing protected

health information. But the presumption of good faith in HIPAA, § 64.512(j)(4), which we adopt

for purposes of analyzing the common-law tort we recognize in this decision, shifts the burden to

plaintiff to make some showing that the nurse’s disclosure that plaintiff had driven to the hospital

and was blatantly intoxicated was not made in good faith.

       ¶ 38.   Although the burden of production is not a heavy one, plaintiff did not meet hers in

this case. Nothing in the record suggests that the nurse supplied the information to the officer for

                                                 18
any reason other than her good-faith belief that the information was necessary to prevent plaintiff

from driving drunk from the hospital and endangering herself and the public. Plaintiff made no

proffer suggesting that the nurse hoped inclusion of the arguably superfluous information about

how plaintiff got to the hospital would lead to plaintiff’s censure, arrest, or prosecution or that she

had any ulterior motive beyond the permitted one.10 Nor did she challenge defendants’ statement

of undisputed fact, the nurse’s affidavit, or the nurse’s deposition testimony indicating that the

nurse provided the information to the officer solely in the hope that he would give plaintiff a ride

home. Thus, the record unequivocally shows that plaintiff’s intent in disclosing all of the

information provided to the officer was consistent with the exception set forth in § 164.512(j)(1)(i).

       ¶ 39.   In light of the presumption of good faith, which was bolstered by the record,

plaintiff had the burden of proffering some facts or information indicating that the nurse had other

motives. She did not do so. Accordingly, CVMC was entitled to summary judgment.11 See Zullo

v. State, 2019 VT 1, ¶ 56, ___ Vt. ___, ___ A.3d ___ (emphasizing “that although subjective

motivation may often have to be resolved by the factfinder, a plaintiff cannot withstand summary

judgment without producing colorable facts upon which a reasonable jury could find bad faith”);

cf. Nelson, 867 N.W.2d at 11 (“Courts applying equivalent subjective good-faith immunity statutes

have not hesitated to grant or affirm summary judgment when there is no evidence the defendant

was dishonest in reporting to the child abuse investigator.”); Garvis, 492 N.W.2d at 404 (affirming

trial court’s grant of summary judgment where “the defendants’ subjective good faith in aiding




       10
            It is not necessary for us to resolve whether the disclosure of the prior driving while
intoxicated that evening went beyond the permissible bounds of disclosure. Even assuming it did,
plaintiff has not overcome the presumption of good faith.
       11
            We do not rule out the possibility that a disclosure may be so unreasonable with
reference to the scope of the exception in § 164.512(j)(1)(i) that the disclosure alone is sufficient
to rebut the presumption that the disclosure was made in subjective good faith. That is not the
case here.
                                                19
and assisting the [child abuse] investigation [by disclosing plaintiffs’ medical information] went

unchallenged”).

       Affirmed.

                                              FOR THE COURT:



                                              Associate Justice




                                               20