In the Missouri Court of Appeals Eastern District DIVISION THREE
J.J., by and through Next Friend, C.W., ) No. ED111339 ) Appellant, ) Appeal from the Circuit Court ) of Cape Girardeau County v. ) Cause No. 21CG-CC00302 ) POPLAR BLUFF REGIONAL ) MEDICAL CENTER, L.L.C., ) Honorable Benjamin F. Lewis ) Respondent. ) Filed: September 26, 2023
Introduction
J.J., by and through Next Friend, C.W., (J.J.) appeals from the trial court’s
judgment granting Poplar Bluff Regional Medical Center, L.L.C.’s (PBRMC) motion to
dismiss for J.J.’s failure to comply with Section 538.225.1.1 J.J. argues the trial court
erred in finding Section 538.225.1 applicable under the circumstances. We reverse and
remand for the trial court to reinstate J.J.’s action against PBRMC.
Background
In his first amended petition for damages, J.J., a minor child, alleged that PBRMC
was a health care provider, and that in January of 2021 he received in-patient mental health
treatment with PBRMC. While J.J. was a patient, an employee of PBRMC (Employee)
1 All statutory references are RSMo. Supp. 2017, unless otherwise indicated. recognized J.J. as a schoolmate and former boyfriend of her daughter. Although Employee
was not involved in J.J.’s medical treatment, she accessed J.J.’s medical records,
discovered his protected health information and his personally identifiable information
(together, PHI and PII information), and then revealed to her daughter J.J.’s in-patient
presence at PBRMC and the reason for his treatment. Employee’s daughter repeated J.J.’s
medical information to other students at J.J.’s school, resulting in J.J. being harassed and
bullied.
J.J. filed a suit for damages, alleging breach of the fiduciary duty of confidentiality
(Count I); breach of implied contract for PBRMC’s failure to reasonably safeguard J.J.’s
PHI and PII information or to provide him notice of the unauthorized access of his
information (Count II); violations of Section 407.010 of the Missouri Merchandising
Practices Act (MMPA) (Count III); negligence stemming from PBRMC’s failure to
exercise reasonable care and to properly safeguard and protect his PHI and PII information
(Count IV); negligent training and supervision (Count VI 2); and negligence per se under
the Health Insurance Portability and Accountability Act (HIPPA) and the Health
Information Technology Act (HITECH) (Count VII). 3
PBRMC filed a motion to dismiss J.J.’s suit for damages based on his failure to file
an affidavit of merit, as required by Section 538.225.1 in all cases against health care
2 J.J.’s first amended petition included counts numbered I-IV, VI, and VII, omitting a count numbered V. 3 We note that J.J.’s claims stem from PBRMC’s disclosure of his PHI and PII information, which constitutes a violation of HIPAA. HIPAA is a federal law designed to establish national standards to protect private health information from being disclosed without the patient’s consent or knowledge. 45 C.F.R. §§ 160-164 (2002) (setting forth standards). Although HIPAA establishes rules for the protections and dissemination of protected health information, it creates no private cause of action for a violation of those rules. Adams v. Eureka Fire Protection Dist., 352 Fed. Appx. 137, 138-39 (8th Cir. 2009). Instead, a plaintiff may pursue an action under Missouri common law seeking damages for invasion of privacy on the basis of the public disclosure of private facts, see, e.g., Y.G. v. Jewish Hosp. of St. Louis, 795 S.W.2d 488, 497-99 (Mo. App. E.D. 1990); for a breach of duty of confidentiality, see, e.g., Brandt v. Med. Def. Assocs., 856 S.W.2d 667, 670 (Mo. banc 1993); and for breach of implied contract, see, e.g., id.
2 providers for damages resulting from the provision of health care services. The trial court
agreed and dismissed J.J.’s claim for his failure to file an affidavit of merit pursuant to
Section 538.225.1. This appeal follows.
Standard of Review
We review de novo a trial court’s grant of a motion to dismiss. Crider v. Barnes-
Jewish St. Peters Hosp., 363 S.W.3d 127, 130 (Mo. App. E.D. 2012). When the trial court
has dismissed a petition, we treat the facts pleaded as true and construe all inferences in
favor of the appellant. J.K.M. v. Dempsey, 317 S.W.3d 621, 624-25 (Mo. App. S.D. 2010).
Likewise, we review de novo the trial court’s interpretation and application of Section
538.225.1. Thomas v. Miller, 447 S.W.3d 667, 670 (Mo. App. E.D. 2014).
Discussion
On appeal, J.J. raises six points of error challenging the trial court’s dismissal of
each of his six counts below. He argues in each point that his suit stemmed from the actions
of Employee, who was not involved in his medical treatment, in improperly accessing and
disseminating his PHI and PII information, rather than from the rendering of health care
services. He further argues that, therefore, because none of his six claims below related
solely to the provision of health care services, he was not required to file an affidavit of
merit pursuant to Section 538.225.1. Because all of J.J.’s points on appeal involve the
same analysis, we address them together.
In his six points on appeal, J.J. claims the trial court erred in dismissing his claims
for breach of fiduciary duty of confidentiality (Point I), breach of implied contract (Point
II), violations of the MMPA (Point III), negligence (Point IV), negligent training and
supervision (Point V), and negligence per se under HIPAA and HITECH (Point VI). He
3 argues that because his allegation that PBRMC’s employee improperly accessed and
disseminated his PHI and PII information did not relate solely to the rendering of a health
care service, he was not required to file an affidavit pursuant to Section 538.225.1. We
agree.
Section 538.225.1 provides:
In any action against a health care provider for damages for personal injury or death on account of the rendering of or failure to render health care services, the plaintiff or the plaintiff's attorney shall file an affidavit with the court stating that he or she has obtained the written opinion of a legally qualified health care provider which states that the defendant health care provider failed to use such care as a reasonably prudent and careful health care provider would have under similar circumstances and that such failure to use such reasonable care directly caused or directly contributed to cause the damages claimed in the petition.
The purpose of Section 538.225.1 is to weed out meritless medical malpractice lawsuits by
requiring the plaintiff to prove at an early stage of litigation that he or she will be able to
present evidence at trial to establish the defendant’s failure to provide reasonable medical
care. Doe 1631 v. Quest Diagnostics, Inc., 395 S.W.3d 8, 19 (Mo. banc 2013).
A two-part test governs whether Section 538.225.1 requires a plaintiff to file an
affidavit of merit. Devitre v. Orthopedic Ctr. Of St. Louis LLC, 349 S.W.3d 327, 331-32
(Mo. banc 2011). First, this Court must determine whether the relationship between the
parties is that of health care provider and recipient. Here, there is no dispute that PBRMC
was a health care provider and J.J. was a patient. Second, this Court must determine
whether the claim relates solely to the provision of health care services. Id. at 332. We
look at the facts alleged and language used in the petition, rather than to how the plaintiff
has characterized the claim, to determine if the true claim relates to the provision of health
care services. Crider, 363 S.W.3d at 130-3; see also J.K.M., 317 S.W.3d at 627.
4 The essential question on appeal here is what constitutes a health care service for
purposes of Section 538.225.1. Section 538.205 defines “health care services” as:
Any service that a health care provider renders to a patient in the ordinary course of the health care provider’s profession or, if the health care provider is an institution, in the ordinary course of furthering the purposes for which the institution is organized. Professional services shall include, but are not limited to, transfer to a patient of goods or services incidental or pursuant to the practice of the health care provider's profession or in furtherance of the purposes for which an institutional health care provider is organized[.]
By its plain language, health care services must be related to the health care provider’s
profession or purpose.
As a practical matter, a service is a health care service when the service involves a
question of professional medical judgment. Compare Spears v. Freeman Health Sys., 403
S.W.3d 616, 620 (Mo. App. S.D. 2012) (because determination of whether patient in
residential facility posed danger to other patients involved professional medical judgment,
Section 538.225.1 applied), and St. John’s Reg. Health Ctr., Inc. v. Windler, 847 S.W.2d
168, 171 (Mo. App. S.D. 1993) (because question of whether patient was properly held in
psychiatric hospital turned on correctness of medical diagnosis, Section 538.225.1
applied), with Buckles v. Skaggs Cmty. Health Assn., 613 S.W.3d 888, 890 (Mo. App.
S.D. 2020) (plaintiff injured by security guard as he attempted to leave medical center
before receiving medical care or diagnosis was not required to submit Section 538.225.1
affidavit), and Meekins v. St. John’s Reg. Med. Ctr., Inc., 149 S.W.3d 525, 532-33 (Mo.
App. S.D. 2004) (drug screening test was not health care service, noting that when alleged
negligent acts or omissions “do not involve a matter of medical science” courts may look
to ordinary negligence). Thus, a plaintiff must only submit a Section 538.225.1 affidavit
5 of merit when the injury resulted from the health care provider’s rendering of or failure to
render a service that involved professional medical judgment.
Our characterization of a health care service parallels the plain language of Section
538.225.1, which explicitly provides that the affidavit of merit must “state[] that the
defendant health care provider failed to use such care as a reasonably prudent and careful
health care provider would have under similar circumstances and that such failure to use
such reasonable care directly caused or directly contributed to cause the damages claimed
in the petition.” By its own language, Section 538.225.1 is intended to apply to cases where
the true claim involves a determination of whether the health care provider’s professional
medical judgment regarding the patient’s medical needs fell below the general standard of
reasonable medical care. If a plaintiff must prove the health care provider failed to adhere
to the general standard of reasonable medical care to prevail at trial, the plaintiff must first
file an affidavit that complies with Section 538.225.1. See J.K.M., 317 S.W.3d at 627.
To illustrate this standard, it is helpful to compare the following two cases. In Doe
1631 v. Quest Diagnostics, Inc., Doe brought a claim against Quest for wrongful disclosure
of HIV test results under Section 191.656, which concerns the confidentiality of an
individual’s HIV status. 395 S.W.3d at 13. Quest argued that Doe should have been
required to file an affidavit of merit pursuant to Section 538.225.1 because, as a laboratory,
it was a health care provider providing health care services to Doe. Id. At 18-19. In
determining that a Section 535.225.1 affidavit of merit was not required, the Supreme
Court of Missouri reasoned that Section 538.225.1 applies when the plaintiff must prove
“a breach in the [defendant’s] duty of care as a medical provider in order to recover,” and
that, conversely, if the action is not based on what a reasonable medical provider would
6 have done under similar circumstances, then the plaintiff is not required to provide an
affidavit of merit. Id. at 19. Because Doe’s claim was for damages resulting from the
unauthorized release of his medical records and did not allege Quest’s actions fell below
the standard of reasonable medical care, he was not required to file an affidavit of merit.
In so holding, the court specifically stated “it cannot be said that the duty of confidentiality
for medical records is a ‘health care service” under section 538.225.” Id. 4
By contrast, in J.K.M. v. Dempsey, J.K.M. brought suit against a physician for a
breach of fiduciary duty and for assault and battery based on the physician’s treatment of
J.K.M.’s medical condition with an injection of a saline solution. 317 S.W.3d at 623-24.
Although J.K.M. argued his suit did not state a claim for medical malpractice, his true claim
was that the physician failed to obtain informed consent and rendered improper medical
services. Because these claims involved a determination of whether the physician adhered
to a standard of reasonable medical care in providing medical treatment, J.K.M. was
required to file an affidavit that complied with Section 538.225.1. See id. at 627.
PBRMC argues that Section 538.225.1 applies expansively and encompasses “all
claims” against health care providers, including cases not based in medical negligence. We
agree to an extent. The application of Section 538.225.1 is not limited to actions where the
true claim is medical malpractice but, rather, can apply to other personal injury claims
4 PBRMC argues that Doe 1631 v. Quest Diagnostics, Inc. is distinguishable because Doe’s claim alleged a breach of Section 191.656, which imposes liability on anyone, without regard for whether they are a medical provider, for the disclosure of an individual’s HIV status. 395 S.W.3d 8 (Mo. banc 2013). This distinction does not matter. Section 538.225.1 can apply to claims that impose liability on anyone regardless of whether they are a medical provider, see, e.g., Vitale v. Sandow, 912 S.W.2d 121, 122 (Mo. App. W.D. 1995) (Section 538.225.1 affidavit of merit required in action for libel). The holding in Doe 1631 is not limited to cases claiming a breach of confidentiality under Section 191.656, but its analysis can apply more broadly to any claim against a health care provider claiming a breach of confidentiality, such as in the case at bar. Doe 1631 articulates that whether Section 538.225.1 applies depends upon the specific claims in the petition and what evidence is required to prove those specific claims.
7 made against health care providers. See J.K.M., 317 S.W.3d at 625 (citing Budding v.
SSM Healthcare Sys., 19 S.W.3d 678, 680 (Mo. banc 2000)). However, as the Supreme
Court of Missouri held in Doe 1631, the affidavit requirement extends beyond medical
malpractice only to cases where liability for the alleged personal injury involves a
determination of whether the health care provider’s actions fell below the standard of
reasonable medical care. 395 S.W.3d at 19. For example, the plaintiff in Vitale v. Sandow
was required to file an affidavit that complied with Section 538.225.1, even though the
plaintiff had brought suit for libel against a physician who had published letters saying the
patient’s symptoms were due to malingering. 912 S.W.2d 121, 122 (Mo. App. W.D. 1995).
Although the standard of reasonable medical care is not an element of libel, to prevail in a
libel case the plaintiff must prove the contested statement is false. Whether the physician’s
diagnosis was incorrect and violated the standard of reasonable medical care was an issue
the patient was required to prove at trial, thus triggering the affidavit requirement of Section
538.225.1. Id.
Applying these general standards, we consider the circumstances here. J.J. alleged
that PBRMC breached its fiduciary duty of confidentiality towards him, breached their
implied contract to keep his medical information confidential, violated the MMPA, was
generally negligent in its protection of his PHI and PII information, was negligent in its
training and supervision of its employees, and was negligent per se under HIPAA and
HITECH.
We briefly set out the standard of liability for each claim. Although this Court is
not asked to determine the merits of J.J.’s claims against PBRMC, the elements of each
particular claim can clarify the application of Section 538.225.1’s affidavit requirement.
8 Missouri case law recognizes that physicians owe their patients a fiduciary duty of
confidentiality not to disclose any medical information received in connection with the
treatment of the patient, and it allows a cause of action for damages in tort based on the
breach of that duty. See Brandt v. Med. Defense Assocs., 856 S.W.2d 667, 670-71 (Mo.
banc 1993) (superseded by statute on other grounds) (recognizing claims for breach of
fiduciary duty of confidentiality, negligence, and breach of implied contract). This duty to
maintain confidential medical records applies to all employees in a health care setting, and
the health care provider has a statutory duty under HIPAA and HITECH to establish and
enforce procedures to ensure its employees likewise comply with this duty of
confidentiality. See 45 C.F.R. § 164.306(a)(4) (2013) (covered entities must ensure
compliance by its workforce). If a defendant health care provider does not comply with its
duties under HIPAA and HITECH, and the plaintiff is injured as a result of a statutory
violation, then the defendant is liable for negligence per se. See Debrill v. Normandy
Assocs., Inc., 383 S.W.3d 77, 84-85 (Mo. App. E.D. 2012).
In addition to actions in tort, a health care provider’s breach of confidentiality
arguably can also give rise to liability under the MMPA. To prevail on a claim brought
under the MMPA, “a plaintiff must plead and prove he or she (1) purchased merchandise
(which includes services) from defendants; (2) for personal, family or household purposes;
and (3) suffered an ascertainable loss of money or property; (4) as a result of an act declared
unlawful under the Merchandising Practices Act.” Murphy v. Stonewall Kitchen, LLC,
503 S.W.3d 308, 311 (Mo. App. E.D. 2016); see also Section 407.025.1, RSMo. Supp.
2020 (creating private right of action). The MMPA prohibits the use of, inter alia,
deception, misrepresentation, unfair practices, and the concealment, suppression, or
9 omission of any material fact in connection with the sale or advertisement of any
merchandise in trade or commerce. Section 407.020.1. An unfair practice is defined as
any practice that “offends any public policy as it has been established by the Constitution,
statues or common law of this state,” is unethical, or presents a risk of substantial injury to
consumers. 15 C.R.S. 60-8.020 (1994).
J.J. here claimed that because he was a patient receiving in-patient treatment at a
PBRMC facility, PBRMC had both a fiduciary and a general duty of confidentiality under
Missouri common law to protect and preserve the confidentiality of his PHI and PII
information. J.J. argued that PBRMC breached these duties when Employee, who
witnessed J.J.’s presence at the in-patient facility but was not involved in his treatment,
was able to access and disclose his PHI and PII information, without his permission, to her
daughter, who then told his classmates. This unauthorized disclosure by a PBRMC
employee caused him injury. As well, J.J. pleaded that, because he purchased services,
namely health care treatment, from PBRMC for personal purposes, PBRMC was bound by
the terms of MMPA. However, he argued PBRMC engaged in acts, practices, or conduct
that violated the MMPA’s prohibition of misrepresentation and unfair practices, in that,
although PBRMC represented it would not disclose J.J.’s PHI and PII information to
unauthorized third parties, it failed to implement security and training measures necessary
to prevent the unauthorized release thereof. As a result of PBRMC’s unfair and deceptive
practices, he suffered damages.
J.J.’s true claims stem solely from PBRMC’s breach of confidentiality. The
purpose of Section 538.225.1 is to weed out meritless medical malpractice lawsuits. See
Doe 1631, 395 S.W.3d at 19. J.J.’s action here against PBRMC is for breach of its duty of
10 confidentiality, and not an action for medical malpractice. See id. (claim for breach of
confidentiality is not claim for medical malpractice); Brandt, 856 S.W.2d at 669. PBRMC
is a health care institution and its purpose is to provide professional medical treatment.
Medical treatment necessarily involves the exercise of professional medical judgment that
complies with a reasonable standard of medical care. By contrast, the keeping of
confidential medical records in a health care setting is an administrative duty incidental to
providing medical treatment, and it does not involve the application of professional medical
judgment that complies with a reasonable standard of medical care.
Resolution of J.J.’s claim here does not involve determining whether PBRMC
exercised professional medical judgment that fell below the standard of reasonable medical
care when providing J.J. medical treatment. See Doe 1631, 395 S.W.3d at 19. Rather,
Employee, who accessed and disseminated J.J.’s PHI and PII information, was not
involved in his health care, and the record does not suggest her dissemination of his PHI
and PII information was related to her, or anyone else’s, professional medical judgment.
Instead, J.J.’s recitation of fact, which we accept as true on appeal, see Creative
Compounds, LLC v. Thermolife Int’l, LLC, 669 S.W.3d 330, 335 (Mo. App. E.D. 2023),
suggests that Employee’s dissemination of his confidential medical information was more
akin to an act of gossip.
Even though Employee’s failure to preserve the confidentiality of J.J.’s PHI and
PII information occurred at a health care institution, the failure was not related to J.J.’s
medical treatment and did not involve a question of medical judgment, and thus PBRMC’s
breach of confidentiality cannot be considered a failure to render a “health care service”
within the meaning of Section 538.225.1. See Doe 1631, 395 S.W.3d at 19 (when claim
11 for breach of duty of confidentiality is not based on “what a reasonable provider would
have done in the same or similar circumstances … it cannot be said that the duty of
confidentiality for medical records is a ‘health care service’”). Under the facts here, J.J.
did not allege injuries stemming from the rendering of or failure to render a health care
service, and thus he was not required to file a medical affidavit pursuant to Section
538.225.1.
Points I, II, III, IV, V, and VI are granted.
Conclusion
The judgment of the trial court dismissing J.J.’s motion for failure to comply with
Section 538.225.1’s affidavit requirement is reversed, and we remand for the trial court to
reinstate J.J.’s claims against PBRMC.
Gary M. Gaertner, Jr., J.
Lisa P. Page, P.J., and Angela T. Quigless, J., concur.