JUSTICE FREEMAN
delivered the judgment of the court, with opinion.
Chief Justice Thomas and Justices Fitzgerald, Kilbride, Garman, Karmeier, and Burke concurred in the judgment and opinion.
OPINION
Plaintiff, Suzanne Bagent, filed a complaint in the circuit court of Pike County against defendants, Misty Young and her former employer, Blessing Care Corporation, doing business as Illini Community Hospital (Illini Hospital or hospital), under a theory of respondeat superior. The circuit court entered summary judgment in favor of Illini Hospital. A divided panel of the appellate court reversed the judgment. 363 Ill. App. 3d 916. We allowed Illini Hospital’s petition for leave to appeal. 210 Ill. 2d R. 315(a). We now reverse the judgment of the appellate court, and remand the cause to the circuit court for further proceedings.
I. BACKGROUND
The record, which includes Young’s deposition testimony, contains the following pertinent evidence. In August 2001, Illini Hospital hired Young as a phlebotomist, i.e., a person trained in drawing blood. In February 2003, the hospital required employees, including Young, to attend a training session regarding the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. No. 104 — 191, 110 Stat. 1936) and its privacy provisions. Young attended the session and signed the hospital’s confidentiality policy and code of conduct, acknowledging in each document that she understood and accepted its terms. Attendees at the training session received a motto to remember: “What you see here, and what you hear here, remains here.”
Young understood the hospital’s confidentiality rules to mean that you “[bjasically don’t say anything. Everything is private.” She understood that the only persons to whom she could give confidential information were “[djoctors, nurses directly involved with that patient’s care.” She additionally understood that members of a patient’s family were not so authorized. Rather, she was “supposed to tell the family members to get in contact with a nurse that’s taking care of that patient.” Young received a fax from a facility that performs tests for Illini Hospital. The fax contained results of plaintiff’s blood test, which indicated to Young that plaintiff was pregnant. Young made two copies, one for plaintiffs physician and one for hospital records.
On a subsequent weekend night, Young and several of her friends visited a local tavern. Plaintiff’s sister, Sarah Bagent, was a waitress there and happened to be one of Young’s best friends. According to Young’s deposition: “I didn’t plan on going into the bar and trying to find Sarah, you know. The only thing I was thinking at the moment is, hi, Sarah, how are you, how is your sister doing?” Young further recounted her conversation with Sarah as follows:
“Little chitchat here and there, hi, how are you, what’s going on, how have you been, who are you seeing, stuff like that. And then how is your sister, Suzanne, and how is she feeling? And she’s [Sarah] like what do you mean? I’m like I thought she was pregnant, you know. And she’s like no. And from there on out, I told her, I said I’m really sorry. Actually, I told her I was sorry. I said please don’t tell Suzanne I said that I told you. Because she told me she’s like how did you find this out? And she was just asking me more and more questions. And I’m like, well, I seen her result. I said that I could get fired for this, I’m really sorry, I didn’t realize that you didn’t know I just assumed. And she’s like, no, its okay, it’s all right. She’s like Suzanne won’t care, blah, blah, blah.”
Young explained that, as soon as she said it, she “instantly knew” that she had made a mistake.
Further, Young explained her disclosure as follows:
“[T]he only reason why I said something that evening was because [Sarah] was a friend of mine, and I was assuming that, one of my best friends and her twin and being sisters, that they would speak to each other about this. And I just assumed. And assuming makes an ass out of me.”
That was the only conversation Young had with Sarah. Young testified in her deposition that they had subsequently avoided each other.
On October 13, 2003, plaintiff telephoned Connie Schroeder, chief executive officer of Mini Hospital, to complain that plaintiffs patient confidentiality had been violated. Upon investigation, Schroeder learned that Young had disclosed the information. On December 14, 2003, Young accepted the hospital’s offer of resignation in lieu of termination.
Plaintiff timely filed a complaint, in which she pled separate counts not only against Young, but also against Mini Hospital under a theory of respondeat superior. Plaintiff alleged breach of health-care practitioner/ patient confidentiality, invasion of privacy, negligent infliction of emotional distress and, against Young alone, intentional infliction of emotional distress, all based on a violation of the Hospital Licensing Act (210 ILCS 85/1 et seq. (West 2004)), the Managed Care Reform and Patient Rights Act (215 ILCS 134/1 et seq. (West 2004)), and article I, section 12, of the Illinois Constitution (Ill. Const. 1970, art. I, §12). Plaintiff also pled common law negligent infliction of emotional distress and, against Young alone, common law intentional infliction of emotional distress.
In its answer, Mini Hospital admitted that Young discovered certain information about plaintiff from reviewing plaintiffs medical records and revealed that information to plaintiffs sister at a tavern. Mini Hospital further alleged, however, that when Young revealed the information, she was acting outside the scope of her employment with the hospital.
In her answer, Young alleged as follows. At the time the lawsuit arose, she was an employee of Mini Hospital. Young admitted that, in the course of her duties, she saw certain medical records pertaining to plaintiff. Young further admitted that she inadvertently revealed one of plaintiff’s test results in a private conversation with plaintiff’s twin sister when asking the sister how plaintiff was feeling.
Discovery adduced the above-recited evidence in the form of depositions and affidavits with attached documents. Illini Hospital moved for summary judgment against plaintiff. The hospital contended, inter alia: that the Illinois Constitution and statutes do not authorize a private right of action; and that the hospital was not vicariously liable for Young’s actions because, when Young breached plaintiffs confidentiality, she was acting outside the scope of her employment. Young filed a motion for summary judgment, in which she joined in the hospital’s summary judgment motion as it pertained to those counts pled against her. Also, plaintiff moved for partial summary judgment against Young only on the issue of liability, leaving the issue of damages for trial.
Following a hearing, the circuit court ruled as follows. The court entered summary judgment in favor of Illini Hospital and Young on those counts alleging statutory causes of action, ruling that those statutes do not authorize a private right of action. Nonetheless, the court found that a common law right of privacy exists to allow plaintiff to bring an action against Young for violation of plaintiff’s common law right to privacy. The court granted plaintiffs motion for partial summary judgment against Young regarding whether Young improperly revealed plaintiff’s confidential information, but the court ruled that issues as to negligent or intentional infliction of emotional distress and damages were to be determined at trial.
Further, the circuit court entered summary judgment in favor of Illini Hospital. The court found that Young’s disclosure to plaintiffs sister was not made in the course of or within the scope of Young’s employment, and that no jury could find that Young made the disclosure to serve the purposes of Young’s employer, i.e., the hospital. In its ruling, the circuit court expressly observed that plaintiff did not claim that the hospital was directly liable based on any allegations of negligent hiring or training but, rather, plaintiff claimed that the hospital was vicariously liable under a theory of respondeat superior. The court observed that although there could be a cause of action for negligent hiring or negligent training, by its ruling it was not addressing or deciding that issue. Also, the court noted that its ruling would not prohibit or preclude plaintiff from refiling her complaint to include allegations of negligent hiring or training. The circuit court expressly found that this was a final judgment as to Illini Hospital, and that there was no just reason to delay enforcement or appeal of the judgment. See 210 Ill. 2d R. 304(a).
Plaintiffs sole contention before the appellate court was that the circuit court erred in granting summary judgment in favor of Illini Hospital. Plaintiff argued that the hospital was vicariously liable for Young’s violation of plaintiffs common law right to privacy under a theory of respondeat superior. A divided panel of the appellate court reversed the summary judgment in favor of the hospital. 363 Ill. App. 3d 916. The appellate court concluded that the disclosure of plaintiff’s medical information was not the kind of conduct that Young was employed to perform and that Young was not working as a phlebotomist at the time of her improper disclosure. 363 Ill. App. 3d at 923. However, the appellate court concluded that a question of fact, precluding summary judgment, existed as to whether the purpose of Young’s disclosure was motivated, at least in part, by a purpose to serve the hospital. 363 Ill. App. 3d at 923-24. The appellate court remanded the cause for further proceedings.
Presiding Justice Turner dissented. He opined that no purpose was served when Young told plaintiffs sister about plaintiffs pregnancy. The dissent opined: “No reasonable jury could find Young’s actions were even partly motivated by a purpose to serve Illini Hospital.” 363 Ill. App. 3d at 926 (Turner, EJ., dissenting). The dissent reasoned that, because Young’s conduct was outside the scope of her employment, Illini Hospital could not be held vicariously liable. 363 Ill. App. 3d at 926 (Turner, EJ., dissenting).
This court allowed Illini Hospital’s petition for leave to appeal. 210 Ill. 2d R 315(a). We subsequently granted Cook County and the Illinois Association of Defense Trial Counsel leave to submit amicus curiae briefs in support of Illini Hospital. We also granted the Illinois Trial Lawyers Association leave to submit an amicus curiae brief in support of plaintiff. 155 Ill. 2d R 345. We will refer to additional pertinent background in the context of our analysis of the issues.
II. ANALYSIS
This matter is before us on the grant of summary judgment in favor of Illini Hospital. The purpose of summary judgment is not to try a question of fact, but rather to determine whether a genuine question of material fact exists. Adams v. Northern Illinois Gas Co., 211 Ill. 2d 32, 42-43 (2004); Gilbert v. Sycamore Municipal Hospital, 156 Ill. 2d 511, 517 (1993). Summary judgment is appropriate only where “the pleadings, depositions, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law.” 735 ILCS 5/2 — 1005(c) (West 2004).
In determining whether a genuine issue as to any material fact exists, a court must construe the pleadings, depositions, admissions, and affidavits strictly against the movant and liberally in favor of the opponent. A triable issue precluding summary judgment exists where the material facts are disputed or where, the material facts being undisputed, reasonable persons might draw different inferences from the undisputed facts. Although summary judgment can aid in the expeditious disposition of a lawsuit, it remains a drastic means of disposing of litigation and, therefore, should be allowed only where the right of the moving party is clear and free from doubt. Adams, 211 Ill. 2d at 43 (and cases cited therein). If the plaintiff fails to establish any element of the cause of action, summary judgment for the defendant is proper. Governmental Interinsurance Exchange v. Judge, 221 Ill. 2d 195, 215 (2006); Espinoza v. Elgin, Joliet & Eastern Ry. Co., 165 Ill. 2d 107, 114 (1995). In appeals from summary judgment rulings, review is de novo. Adams, 211 Ill. 2d at 43; Espinoza, 165 Ill. 2d at 113.
In the present case, the circuit court ruled that plaintiff could proceed against Young for violation of plaintiffs common law right to privacy, negligent infliction of emotional distress and, which plaintiff pled only against Young, intentional infliction of emotional distress. The appellate court held that a genuine issue of material fact exists whether Illini Hospital is vicariously hable on plaintiffs surviving theories.
The general rule is that a person injured by the negligence of another must seek his or her remedy from the person who caused the injury. The relation of employer and employee is an exception to this general rule. Darner v. Colby, 375 Ill. 558, 560 (1941); Metzler v. Layton, 373 Ill. 88, 91 (1939). Under the theory of respondeat superior, an employer can be liable for the torts of an employee, but only for those torts that are committed within the scope of the employment. Wright v. City of Danville, 174 Ill. 2d 391, 405 (1996); Pyne v. Witmer, 129 Ill. 2d 351, 359 (1989). Indeed, the employer’s vicarious liability extends to the negligent, willful, malicious, or even criminal acts of its employees when such acts are committed within the scope of the employment. See Mitchell v. Norman James Construction Co., 291 Ill. App. 3d 927, 932 (1997); Randi F. v. High Ridge YMCA, 170 Ill. App. 3d 962, 964 (1988); Webb v. Jewel Cos., 137 Ill. App. 3d 1004, 1006 (1985).
The term “scope of the employment,” used interchangeably with “in the course of the employment,” refers to a “bare formula,” whose “very vagueness has been of value in permitting a desirable degree of flexibility in decisions.” W. Keeton, Prosser & Keeton on Torts §70, at 502 (5th ed. 1984). The Second Restatement of Agency has identified three general criteria in determining whether an employee’s acts are within the scope of employment.
“ ‘(1) Conduct of a servant is within the scope of employment if, but only if:
(a) it is of the kind he is employed to perform;
(b) it occurs substantially within the authorized time and space limits;
(c) it is actuated, at least in part, by a purpose to serve the master ***[.]
íJí
(2) Conduct of a servant is not within the scope of employment if it is different in kind from that authorized, far beyond the authorized time or space limits, or too little actuated by a purpose to serve the master.’ (Restatement (Second) of Agency §228 (1958).)” Pyne, 129 Ill. 2d at 360.
These three criteria are generally recognized (see, e.g., 1 J. Lee & B. Lindahl, Modern Tort Law §7:7, at 7 — 11, 7 — 12 (2d ed. 2002); W. Keeton, Prosser & Keeton on Torts §70, at 502 (5th ed. 1984)), and Illinois courts look thereto for guidance. Pyne, 129 Ill. 2d at 360. The Restatement labels section 228 as a “General Statement.” Subsequent sections elaborate these three criteria. Pyne, 129 Ill. 2d at 360; see Restatement (Second) of Agency §228, Comment a, at 505 (1958) (“Sections 229-236 state the circumstances which determine whether acts can be considered to be within the scope of employment”).
Whether an employee was acting within the course of the employment depends on the employment contract and the nature of the relationship, which must exist at the time of and in respect to the particular facts out of which the injury arose. Plaintiff has the burden of showing the contemporaneous relationship between the tortious act and the scope of employment. Pyne, 129 Ill. 2d at 360.
We observe that the parties disagree as to whether the absence of any one section 228 criterion obviates consideration of the remaining two. Section 228 lists its three criteria conjunctively in determining whether conduct is within the scope of employment, but disjunctively in determining whether conduct is outside of the scope of employment, both of which suggests that the lack of any one criterion takes the conduct out of the scope of employment. Further, scholars have described the three section 228 criteria as requirements, all of which must be met to conclude that an employee was acting within the scope of employment. 1 J. Lee & B. Lindahl, Modern Tort Law §7:7, at 7 — 11 (2d ed. 2002); W. Keeton, Prosser & Keeton on Torts §70, at 502 (5th ed. 1984). We hold that all three criteria of section 228 of the Second Restatement of Agency must be met to conclude that an employee was acting within the scope of employment. To make this conclusion, a court must consider all of the surrounding circumstances. Each case must depend on its own facts.
Also, it is well settled that summary judgment “is generally inappropriate when scope of employment is at issue. [Citations.] Only if no reasonable person could conclude from the evidence that an employee was acting within the course of employment should a court hold as a matter of law that the employee was not so acting.” Pyne, 129 Ill. 2d at 359; accord Restatement (Second) of Agency §228, Comment d, at 505 (1958) (“The question whether or not the act done is so different from the act authorized that it is not within the scope of the employment is decided by the court if the answer is clearly indicated; otherwise, it is decided by the jury”).
In the present case, the appellate court analyzed Illini Hospital’s vicarious liability by way of the three criteria of section 228 of the Second Restatement of Agency. Regarding the first criterion, the appellate court concluded that Young’s disclosure of plaintiff’s medical records was not the kind of conduct Young was employed to perform. 363 Ill. App. 3d at 922-23. Although Illini Hospital agrees with this conclusion, plaintiff disagrees, contending that genuine issues of fact preclude this conclusion.
Plaintiff relies on section 229 of the Second Restatement of Agency, which elaborates the first criterion of section 228, i.e., whether the employee’s complained-of conduct is of the kind he or she is employed to perform. Section 229 instructs a court to consider the following factual matters in determining whether the complained-of act of the employee, although not authorized by the employer, is nevertheless so similar or incidental to employer-authorized conduct as to be within the scope of employment. Pertinent matters include: whether the act is one commonly done by such employees; the time, place, and purpose of the act; the previous relations between the employer and the employee; whether the act is outside the enterprise of the employer or, if within the enterprise, has not been entrusted to any employee; whether the employer has reason to expect that such an act will be done; the similarity in quality of the act done to the act authorized; whether the employer furnished to the employee the instrumentality by which the harm is done; and the extent of departure from the normal method of accomplishing an authorized result. Restatement (Second) of Agency §229(2) (1958).
These factors refer primarily to the “physical activities” of employees. Since the phrase “scope of employment” is used to determine the liability of the employer for the conduct of the employee, the ultimate question is whether or not the loss resulting from the employee’s acts should justly be considered as one of the normal risks to be borne by the employer. Restatement (Second) of Agency §229, Comment a, at 507 (1958).
The uncontradicted evidence in this case establishes that Young’s disclosure of plaintiffs medical record was not the kind of conduct Young was employed to perform. Young’s discovery deposition and an affidavit from Kathy Hull, who oriented, trained, and supervised Young at Illini Hospital, prove that Young’s training as a phlebotomist included drawing blood and keeping records. In a typical day, Young would draw blood, perform drug screens, conduct filing and billing, and deliver medical records to physicians’ mail boxes. Young was not employed to divulge confidential patient information while off duty and after hours in a tavern. See, e.g., Hargan v. Southwestern Electric Cooperative, Inc., 311 Ill. App. 3d 1029, 1033 (2000) (holding that any acts in which employee engaged with intent to woo plaintiffs wife away from him during business meetings and trips simply had no connection to business of employer).
The fact that Illini Hospital expressly forbade Young to reveal patient information bolsters our conclusion that Young’s disclosure of plaintiffs medical records was not the kind of conduct she was employed to perform. Of course, an act of an employee, although forbidden, may be within the scope of employment. An employer cannot avoid vicarious liability for the misconduct of an employee by telling the employee to act carefully. Restatement (Second) of Agency §230, Comment c, at 512 (1958). However, it must be remembered that an act is outside of the scope of employment if it has no connection with the conduct the employee is required to perform. Prohibition to perform acts, except those of a certain category, may indicate that the scope of employment extends only to acts of that category. Furthermore, the employer’s prohibition may be a factor in determining, in an otherwise doubtful case, whether the act of the employee is incidental to the employment. The employer’s prohibition accentuates the limits of the employee’s permissible action and, hence, supports a finding that the prohibited act is entirely beyond the scope of employment. Restatement (Second) of Agency §230, Comment c, at 512 (1958).
In the present case, not only was Young’s disclosure of plaintiffs medical records not incidental to Young’s employment, but the hospital plainly forbade Young from so doing. No reasonable person could conclude that Young’s conduct was the kind she was employed to perform.
The second broad criterion of whether Young’s disclosure of plaintiffs medical information was within the scope of her employment is whether the disclosure occurred substantially within the authorized time and space limits. Restatement (Second) of Agency §228 (1958). The appellate court noted the fact that Young was not working as a phlebotomist at the time of her improper disclosure. However, the court ultimately concluded that Young had a continuing duty to maintain patient confidentiality. The appellate court reasoned:
“The hospital’s training of its employees did not limit the duty of the employee to maintain confidentiality of patients’ medical information only during working hours. Rather, that duty, imposed by the hospital in the execution of its duties, was, according to its own training, to extend to all times and to all places. In effect, for purposes of patient confidentiality, Young was on duty 24 hours a day, 7 days a week.” 363 Ill. App. 3d at 923.
The appellate court then concluded: “An employee entrusted with confidential information in the course of his or her employment has a duty not to disclose the information — without limitation as to time or space.” 363 Ill. App. 3d at 924.
After considering all of the circumstances, it is clear that the first and third criteria of section 228 of the Second Restatement of Agency are absent from this case. Accordingly, we need not discuss the second criterion and do not express an opinion on the correctness of the appellate court’s analysis with respect thereto.
The third criterion of whether Young’s disclosure of plaintiffs medical information was within the scope of her employment is whether the disclosure was actuated, at least partially, by a purpose to serve the hospital. Restatement (Second) of Agency §228 (1958). The appellate court did not, and based on this record could not, hold that Young’s disclosure was motivated by any conceivable purpose of serving the hospital. Rather, the appellate court’s only reference to the actuation criterion was the following italicized observation: “An employee entrusted with confidential information in the course of his or her employment has a duty not to disclose the information — without limitation as to time or space. The duty not to do so is actuated by the needs and requirements of the employer ” (Emphasis added.) 363 Ill. App. 3d at 924.
The appellate court clearly misapprehended the import of the third criterion of section 228 of the Second Restatement of Agency. Elaborating on this criterion, section 235 of the Restatement provides that an act of an employee, i.e., the particular act of the employee that is at issue, is not within the scope of employment if it is done with no intention to perform it as part of or incident to a service on account of which he or she is employed. Restatement (Second) of Agency §235 (1958). Section 235 explains that, rather than “the needs and requirements of the employer” (363 Ill. App. 3d at 924), it is the state of mind of the employee that is material. See, e.g., 1 J. Lee & B. Lindahl, Modern Tort Law §7:7, at 7 — 12 (2d ed. 2002) (describing criterion as follows: “The employee was motivated, at least partially, by a purpose to serve the employer” (emphasis added)). However, it is only from the manifestations of the employee and the surrounding circumstances that, ordinarily, the employee’s intent can be determined. Restatement (Second) of Agency §235, Comment a, at 520-21 (1958).
Applying the correct legal standard to this case, there is no genuine issue of material fact as to Young’s motivation for disclosing plaintiffs medical record. By her own candid admission, Young disclosed plaintiffs pregnancy to Sarah, plaintiff’s sister, because Sarah was both plaintiff’s sister and Young’s friend. Young assumed, albeit incorrectly, that plaintiff had already related the information to Sarah. Young was in no way motivated to serve the hospital. As the dissent correctly reasoned, “nothing in the record supports an inference that Young was attempting to benefit or serve her employer when she divulged plaintiff’s medical records. In fact, such disclosure was in direct contravention to the confidentiality agreements and did nothing to further the business of Illini Hospital.” 363 Ill. App. 3d at 925 (Turner, P.J., dissenting). We agree and so hold. See, e.g., Hentges v. Thomford, 569 N.W.2d 424, 427-29 (Minn. App. 1997) (holding that employee-minister was not motivated by purpose to serve employer-congregation when he accidentally shot parishioner during deer hunting).
Although summary judgment is generally inappropriate when scope of employment is at issue, when no reasonable person could conclude from the evidence that an employee was acting within the scope of employment, a court should hold as a matter of law that the employee was not so acting. Pyne, 129 Ill. 2d at 359; Torrence v. DeFrates, 56 Ill. App. 3d 118, 120 (1978), quoting Boehmer v. Norton, 328 Ill. App. 17, 24 (1946); see, e.g., Murphy v. Urso, 88 Ill. 2d 444, 464-65 (1981) (upholding grant of summary judgment in favor of employer where employee acted outside of scope of employment).
In the present case, after considering the three criteria of section 228 of the Second Restatement of Agency, we uphold the circuit court’s grant of summary judgment in favor of Illini Hospital. Clearly, there was no dispute as to the pertinent facts. Regardless of whether Young was required to maintain patient confidentiality at all times and places, such that an improper disclosure would occur “within the authorized time and space” (Restatement (Second) of Agency §228(l)(b) (1958)), the evidence would still be insufficient to establish the hospital’s liability. The evidence would not permit any jury to find that Young’s disclosure of plaintiffs pregnancy to plaintiffs sister was in any way actuated by a purpose to serve the hospital. The only reasonable inference from the undisputed facts was that Young was in the tavern for purely personal reasons, unexpectedly met her friend Sarah, began speaking with Sarah and, in violation of the hospital’s prohibition, revealed plaintiffs medical condition. Regardless of whether Young’s disclosure occurred that night in the tavern, or during Young’s work hours on hospital property, it cannot be fairly said that Young was motivated to serve the hospital when she made the disclosure. We agree with the dissenting justice in the appellate court that no reasonable jury could so find. 363 Ill. App. 3d at 926 (Turner, P.J., dissenting).
Also, there was no evidence to show that Young’s disclosure was even incident to the performance of the duties that the hospital entrusted to her. The only reasonable inference from the undisputed facts is that Young’s motivation was solely and exclusively personal and not related to her position as an employee of Illini Hospital. See, e.g., Rusnack v. Giant Food, Inc., 26 Md. App. 250, 337 A.2d 445 (1975) (upholding summary judgment in favor of employer, court discussed all three section 228 criteria, and concluded that employee’s acts not motivated by purpose of serving employer); Snilsberg v. Lake Washington Club, 614 N.W.2d 738 (Minn. App. 2000) (same).
III. CONCLUSION
For the foregoing reasons, the judgment of the appellate court is reversed, the judgment of the circuit court of Pike County is affirmed, and the cause is remanded to the circuit court for further proceedings.
Appellate court judgment reversed; circuit court judgment affirmed;
cause remanded.