Paul v. Providence Health Sys.-Oregon - 351 Or. 587, 273 P.3d 106 (2012)

Rule:

The Oregon Supreme Court consistently rejects claims for emotional distress damages caused by a defendant's negligence, in the absence of any physical injury. The Supreme Court, however, allows claims for emotional distress damages in three situations: (1) where the defendant intended to inflict severe emotional distress; (2) where the defendant intended to do the painful act with knowledge that it will cause grave distress, when the defendant's position in relation to the plaintiff involves some responsibility aside from the tort itself; and (3) where the defendant's conduct infringed on some legally protected interest apart from causing the claimed distress, even when that conduct was only negligent.

Facts:

Plaintiff patients claimed economic and noneconomic damages for financial injury and emotional distress that they allegedly suffered when, through defendant's alleged negligence, computer disks and tapes containing personal information from an estimated 365,000 patients were stolen from the car of one of defendant's employees. The trial court and Court of Appeals held that plaintiffs had failed to state claims for negligence or for violation of the Unlawful Trade Practices Act (UTPA), ORS 646.605 to 646.652.

Issue:

Can a healthcare provider be liable in damages when the provider's negligence permitted the theft of its patients' personal information, but the information was never used or viewed by the thief or any other person?

Answer:

No.

Conclusion:

The court concluded that, in the absence of allegations that the stolen information was used in any way or even was viewed by a third party, the patients have not suffered an injury that would provide a basis for a negligence claim or an action under the UTPA. The court found that the patients failed to allege actual, present injury caused by the corporation's conduct. The cost of credit monitoring that resulted, not from any "present economic harm" to the patients, but from the risk of possible future harm, was insufficient to state a negligence claim. The patients did not allege actual identity theft or financial harm, other than credit monitoring and similar mitigation costs. They did not offer a cogent basis for overruling Oregon's well-established negligence requirements, which required the allegation of present injury. There was no indication that the UTPA was intended to protect against such speculative losses at the risk of identity theft.