Privacy Breach: Court Bars Recovery for Emotional Distress for Future Risk of Identity Theft

The Supreme Court of Oregon held that a hospital cannot be held liable for damages for past and future financial injury and emotional distress sought by plaintiffs who claimed that the hospital's negligence resulted in the theft of their personal information, including their names, addresses, phone numbers, Social Security numbers, and health information, contained on computer disks and tapes that were stolen from the car of a hospital employee. The complaint, filed as a class action on behalf of 365,000 similarly situated patients, alleged that the plaintiffs incurred costs for credit monitoring even before the hospital entered into an agreement with the state attorney general to pay for credit monitoring services. They also sought damages for emotional distress that they experienced because of the risk of future theft of their personal information and potential identity theft.

The plaintiffs claimed that the hospital/patient relationship imposed a duty on the hospital to protect them against economic loss, contending that the duty arises from federal and state statutes requiring hospitals to protect their health information. The high court found the plaintiffs' claims were too great a departure from existing case law in the jurisdiction and concluded that negligence posing a risk of future harm is insufficient to constitute an actionable negligence injury. The court pointed out that the plaintiffs alleged no actual identity theft or financial harm other than credit monitoring and similar mitigation costs and that the plaintiffs' claim for emotional distress, present and future, was solely based on apprehension of an increased risk of future harm. No proof existed that a third party viewed any of the plaintiffs' personal information or used it for any purpose in any manner. The court conceded that the plaintiffs' concerns were plausible but noted that state and federal statutes address those risks and that enforcement actions can be taken pursuant to those statutes, such as the action taken by the Oregon attorney general, to ensure compliance. (*Paul, Gibson and Weiller v. Providence Health...