OPINION
ROSS, Judge.
This invasion-of-privacy case involves the Internet posting of embarrassing personal information taken surreptitiously from a patient’s medical file. A Fairview Cedar Ridge Clinic employee saw a personal acquaintance at the clinic and read her medical file, learning that she had a sexually transmitted disease and a new sex partner other than her husband. The employee disclosed this information to another employee, who then disclosed it to others, including the patient’s estranged husband. Then someone created a MySpace.com webpage posting the information on the Internet. The patient sued the clinic and the individuals allegedly involved in the disclosure under various legal theories. The district court granted summary judgment to the defendants on most of the claims.
This appeal from that judgment challenges several of the district court’s decisions: (1) declining to impose sanctions for spoliation after one defendant deleted com[38]*38puter files allegedly to hide involvement in the Internet postings; (2) holding that the invasion-of-privacy claim failed because there was no “publicity”; (3) dismissing the negligent-infliction-of-emotional-distress claim for lack of a threshold showing of a viable invasion-of-privacy claim; (4) holding that the clinic cannot be held liable for the unauthorized acts of its employees; (5) holding that the claim of “breach of a confidential relationship” is not a recognized cause of action; and (6) holding that the Health Insurance Portability and Accountability Act (HIPAA) preempts Minnesota Statutes section 144.335.
We conclude that the district court did not abuse its discretion by declining to impose sanctions for spoliation because there was no proof that the deleted computer files included knowingly destroyed evidence. We also conclude that the invasion-of-privacy claim was correctly resolved by summary judgment for lack of evidence; that the district court properly dismissed the negligent-infliction-of-emotional-distress claim because the claim depends on the survival of the invasion-of-privacy claim; and that the claim of breach of confidential relationship as alleged is waived, and the claim as recast under a different theory on appeal fails as a matter of law. But we conclude that HIPAA does not preempt section 144.335, which authorizes a private cause of action for releasing health care records. We therefore affirm in part, reverse in part, and remand.
FACTS
The controversy in this case began when a clinic employee saw an acquaintance visiting a doctor and decided to nose around in the acquaintance’s confidential file. Candace Yath went to a medical appointment in March 2006 at Fairview Cedar Ridge Clinic in Apple Valley. Yath told her doctor that she wanted to be tested for sexually transmitted diseases because she had a new sex partner. Navy Tek, a medical assistant who is related to Yath’s husband, saw Yath at the clinic and became curious.
Tek’s job gave her access to the clime’s electronic medical records. Tek decided to satisfy her curiosity by accessing Yath’s medical file, knowing this would violate clinic policy. Tek learned from Yath’s medical file that Yath’s medical appointment was for sexually-transmitted-disease screening related to a new sex partner. She also learned that Yath had been diagnosed with a sexually transmitted disease.
Two days later, Tek sent an electronic mail message to Net Phat. Phat was related to both Tek and Yath by marriage, and she worked as a medical records coder at Fairview Ridges Hospital. In her e-mail to Phat, Tek wrote, “i gotta tell you som-ethin but can’t do it over this... .i’ll call you when i’m not busy... .but only if you promise not to say anything to anybody.” Phat responded that she would not tell anyone and added, “Now I’m curious what it is ... you will have to tell me.” Three minutes later, Tek replied, “you may already know anyways... .i’ll call you in a bit.”
Tek called and told Phat that she saw Yath’s record and that Yath had another sex partner. Phat wrote back to Tek, “Wow ... I’m shocked.” She also wrote, “I look differently at my sister in law.” Phat was unaware that Candace Yath and her husband, Paul, had separated.
In April 2006, Phat told her brother (Yath’s now ex-husband) what Tek relayed from Yath’s medical file. Paul asked Phat if she had seen Yath’s file, but Phat said that she had not. Word eventually reached Candace Yath that Tek had viewed her medical file and had shared the information with Phat. Yath’s grandmother called Cedar Ridge Clinic and spoke with [39]*39Michelle St. Sauver, the clinic’s manager. She complained that she believed that Tek had 'wrongfully accessed and told others the information in Yath’s medical file. She also told St. Sauver that she believed Phat was involved.
Fairview investigated and learned that Tek had accessed Yath’s medical file five times between March 21 and May 4, 2006. Fairview determined that Tek had no legitimate business reason to do so and that, therefore, her access was unauthorized by Fairview policy and prohibited by HIPAA. St. Sauver and a human resources worker confronted Tek on May 4. Although Tek initially denied accessing Yath’s records, she recanted after St. Sauver showed her a computer usage audit. But she claimed that she had not disclosed the information to anyone.
St. Sauver also questioned Phat on May 4. Phat denied knowing anything about Yath’s medical information. Neither Cedar Ridge Clinic nor Fairview Ridges Hospital, where Phat worked, investigated Phat’s computer. St. Sauver and Lois Dahl, Fairview’s information privacy and security director, explained that they did not search Phat’s computer because Phat did not have a username or password that allowed her to access Yath’s medical records at the clinic and because the clinic and hospital use different records software systems.
St. Sauver sent Tek home on May 4. Convinced that Tek had repeatedly accessed Yath’s records without a legitimate business purpose, Fairview decided to fire Tek on May 10, 2006, for violating Fair-view policy and HIPAA.
The next day, St. Sauver received an email from Yath’s grandmother accusing Tek or Phat of creating a disparaging Internet webpage at MySpace.com using the name “Rotten Candy” and posting information that Tek learned from Yath’s medical file. The webpage included a photograph of Candace Yath and stated that “Rotten Candy” has a sexually transmitted disease, that she recently cheated on her husband, and that she is addicted to plastic surgery. The page listed six “friends,” indicating that by then at least those six people had accessed the page.
Fairview investigated the accusations. It tried to view the webpage on either May 11 or May 12, 2006, but by then the web-page had been “removed.” MySpace.com is a “blocked” website at Fairview, meaning that employees cannot access it using Fairview’s internet system and that the webpage therefore could not have been created by an employee using a Fairview workplace computer. Yath and her attorneys also investigated the MySpace web-page. They discovered that the MySpace account for the webpage originated on a computer having an Internet Protocol address assigned to a business in Eagan. Tek’s sister, Molyka Mao, worked at that business.1
Yath sued Tek, Mao, Phat, and Fairview on a variety of theories. She sued all the defendants directly for invasion of her privacy, and all except Mao for “breach of a confidential relationship.” She sued Tek, Mao, and Phat for intentional infliction of emotional distress. She sued Fairview for negligent infliction of emotional distress. She also sued all the defendants directly for violating Minnesota Statutes section 144.335, subdivision 3a(e), by disclosing information in Yath’s medical file.
[40]*40Fairview and Phat each moved for summary judgment. Yath opposed summary judgment and also moved for a default judgment against Tek and Mao, who never answered the complaint. Yath moved the district court to impose sanctions on Phat for spoliation of evidence on the accusation that Phat deleted files from her computer that may have proven that she participated in the disclosure. The district court awarded summary judgment in favor of Fairview. It granted Phat’s motion for summary judgment on all claims except intentional infliction of emotional distress. The district court denied Yath’s motion for sanctions against Phat for alleged spoliation of evidence. It also found that Yath’s motion for a default judgment against Tek and Mao was premature.
Yath then dismissed her claims against Tek and Mao and filed an appeal with this court, challenging the district court’s summary judgment decision. But we recognized that the judgment was partial and nonappealable because not all claims were decided. Yath returned to the district court and dismissed her claim of intentional infliction of emotional distress. The district court entered a final order and judgment that disposed of all claims. Yath filed her second appeal, and a special term panel of this court allowed her appeal and agreed that we would review both disposi-tive orders.
ISSUES
I. Did the district court abuse its discretion by denying Yath’s motion for sanctions against Phat for alleged spoliation of evidence after Phat deleted computer files that might have revealed her involvement in disclosing private medical data?
II. Does an Internet posting on MySpace.com constitute “publicity” and, if so, do the facts nevertheless allow summary judgment in favor of Fairview and Phat on Yath’s invasion-of-privacy claim?' •
III. Does evidence exist to prevent summary judgment in favor of Fairview on Yath’s negligent infliction-.of-emotional-distress claim for lack of a viable underlying invasion-of-privacy claim?
IV. Is Fairview vicariously liable to Yath for the records access and disclosure by its employees?
V. Has Yath made a viable claim against Fairview and Phat for “breach of a confidential relationship”?
VI. Does federal HIPAA preempt Minnesota Statutes section 144.335, which authorizes a private action for improper release of medical records?
ANALYSIS
Yath challenges the district court’s entry of summary judgment. Summary judgment is proper when, based on the pleadings, discovery, and affidavits filed with the court, there are no genuine issues of material fact and one party is entitled to judgment as a matter of law. Minn. R. Civ. P. 56.03. On appeal from summary judgment, this court reviews de novo the district court’s application of the law and the district court’s conclusion that no genuine issues of fact remain for trial. State by Cooper v. French, 460 N.W.2d 2, 4 (Minn.1990). We review the evidence in the light most favorable to the nonmoving party and resolve any doubts regarding the existence of a material fact against the moving party. Fabio v. Bellomo, 504 N.W.2d 758, 761 (Minn.1993). A fact is material if it affects the outcome of the case. Musicland Group, Inc. v. Ceridian Corp., 508 N.W.2d 524, 531 (Minn.App. 1993), review denied (Minn. Jan. 27, 1994). [41]*41“The party opposing summary judgment may not rely on unverified and conclusory allegations, or postulated evidence that might be developed at trial, or metaphysical doubt about the facts to establish a genuine issue of material fact.” Cargill Inc. v. Jorgenson Farms, 719 N.W.2d 226, 232 (Minn.App.2006) (quotation omitted). Summary judgment is also proper “when the record is devoid of proof on an essential element of the plaintiffs claim.” Id.
I
To address Yath’s summary judgment challenge, we first consider her evidentiary claim that the district court erred by denying her motion to impose sanctions on Phat for spoliation. We do so because a finding of spoliation may result in certain inculpatory facts being accepted as true as a remedy for the infraction. See Wajda v. Kingsbury, 652 N.W.2d 856, 863-64 (Minn.App.2002), review denied (Minn. Nov. 19, 2002) (validating spoliation sanction permitting jury to infer that the evidence the defendant lost or destroyed was favorable to the plaintiff).
“Spoliation is the destruction of evidence.” Id. at 860. Sanctions for spoliation may be appropriate when a person knows or should have known that the evidence she destroyed was relevant to pending or future litigation. Patton v. Newmar Corp., 538 N.W.2d 116, 118-19 (Minn. 1995). A district court has broad authority to determine what, if any, sanction is to be imposed for spoliation of evidence. Id. This court reviews a district court’s decision to impose sanctions for spoliation to determine whether the district court abused its discretion. Wajda, 652 N.W.2d at 860.
Yath claims that the district court should have sanctioned Phat because Phat deleted the browser history and temporary Internet files from her computer in an attempt to hide evidence relevant to this litigation. We conclude that the district court did not abuse its discretion by declining to impose sanctions because Yath provided insufficient support for her allegation.
Yath sent a facsimile copy of a subpoena duces tecum to Phat’s attorney, Laura Myslis, on July 3 at 4:51 p.m. The subpoena asked Phat to produce all files on any computer that she or her husband owned. Myslis did not receive the subpoena until July 5 because she was out of town for the July 4 holiday. She informed Phat about the subpoena on July 5. On July 16, Phat produced her computer for inspection. Yath’s computer analyst examined the computer and submitted an affidavit to the district court stating, “No temporary internet files, browser history, internet or browser cache exist prior to July 3, 2007.” The analyst also opined that “all internet files were erased and scrubbed clean as of July 3, 2007 at approximately 8:05 p.m.” Yath asserts that “the coincidence between that service of the subpoena to Phat’s attorney’s office and the destruction of the evidence is too coincidental” and therefore constitutes proof that Phat intentionally destroyed evidence.
But the district court reasoned that the deletion might have been standard computer maintenance. The record also shows that Phat was not personally served with the subpoena until July 5, 2007, which was after the deletion. The district court credited Myslis’s account regarding when she discovered the facsimile message, and it found that Yath failed to prove that Phat intended to destroy or hide evidence. The district court’s refusal to impose sanctions was not an abuse of discretion because Yath did not meet her heavy burden to show that “no reasonable person would agree with the trial court’s assessment of what sanctions, [if any,] are appropriate.” [42]*42Id. (quotation omitted). Although we agree that Yath has a reasonable basis to suspect intentional destruction of evidence given the timing of the deletion, she did not provide the district court with such compelling support to require a finding that intentional destruction of evidence occurred. The district court’s appreciation of legitimate reasons for the deletion is plausible despite the suspicious timing. We therefore have no basis to overturn the district court’s discretionary decision regarding spoliation.
II
Yath contests the district court’s summary-judgment decision dismissing her invasion-of-privacy claim. She argues that the district court erroneously concluded that the temporary posting of data gleaned from her medical file on MySpace.com “failed to meet the ‘publicity’ requirements for a successful claim.” The argument is persuasive.
Minnesota recognizes the tort of invasion of privacy on three alternative theories: intrusion of seclusion, appropriation of a name or likeness of another, and publication of private facts. Bodah v. Lakeville Motor Express, Inc., 663 N.W.2d 550, 553 (Minn.2003). Yath’s invasion-of-privacy claim is based on the publication of private facts, so the claim can survive summary judgment only if the record contains evidence that (1) a defendant gave “publicity” to a matter concerning Yath’s private life, (2) the publicity of the private information would be highly offensive to a reasonable person, and (3) the matter is not of legitimate concern to the public. Id. (quotation omitted). The district court held that Yath’s private information was not given “publicity” within the meaning of the tort of invasion of privacy because Yath had not proven a sufficient number of people had seen the webpage. We reach a different legal conclusion.
“Publicity,” for the purposes of an invasion-of-privacy claim, means that “the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge.” Id. at 557 (quoting from Restatement (Second) of Torts § 652D cmt. a (1977)). In other words, there are two methods to satisfy the publicity element of an invasion-of-privacy claim: the first method is by proving a single communication to the public, and the second method is by proving communication to individuals in such a large number that the information is deemed to have been communicated to the public.
The supreme court’s analysis and application in Bodah is illuminating. The Bo-dah court held that the publicity element was not satisfied when an employer disseminated employee names and social security numbers to sixteen managers in six states. Id. at 557-58. The employer disseminated the information by private means, specifically, by facsimile. The private rather than public nature of this communication caused the Bodah court to consider whether the communication was to a large enough number of recipients to support a determination of “publicity” under the second method. It held that dissemination of information to the relatively small group of individuals did not satisfy the publicity element because the disseminated information could not “be regarded as substantially certain to become public.” Id.
But in reaching the conclusion, the supreme court explained the type of communication that would constitute publicity under the first method. It approvingly acknowledged the Restatement of Torts explanation that “any publication in a [43]*43newspaper or a magazine, even of small circulation ... or any broadcast over the radio, or statement made in an address to a large audience,” would meet the publicity element of an invasion-of-privacy claim. Id. at 554. It also relied on the Restatement for the proposition that posting private information in a shop window viewable by passers-by constitutes “publicity.” Id. The Restatement explains that “[t]he distinction ... is one between private and public communication.” Id. This explanation informs our judgment that the challenged communication here constitutes publicity under the first method, or publicity per se. Unlike Bodah, where the private information went through 'a private medium to reach a finite, identifiable group of privately situated recipients, Yath’s private information was posted on a public MySpace.com webpage for anyone to view. This Internet communication is materially similar in nature to a newspaper publication or a radio broadcast because upon release it is available to the public at large.
The district court appears to have accepted Fairview and Phat’s argument that the publicity element was not satisfied because Yath proved only that a small number of people actually viewed the MySpace.com webpage and that the web-page was available only 24 to 48 hours.2 A similar argument could be made about a newspaper having only a small circulation, or a radio broadcast at odd hours when few were listening. The district court therefore mistakenly analyzed “publicity” using the second method, which applies only to privately directed communication and requires an assessment based on the number of actual viewers. But when the communication is made by offering the information in a public forum, the first method applies and the tort is triggered when the discloser makes the private information publicly available, not when some substantial number of individuals actually get the information. Like the temporary posting of information in a shop window, the MySpace.com webpage put the information in view of any member of the public — in large or small numbers— who happened by. The number of actual viewers is irrelevant. See id. at 554-57 (adopting the Restatement definition of publicity which explains that the distinction is “between private and public communication,” and that the publicity element is satisfied when information is “dissemi-nat[ed] to the public at large”).
Fairview argues that posting information on a “social networking” website such as MySpace.com should be treated only as a private communication because Myspace.com webpages are not of “general interest” like online newspaper websites. But Bodah’s analysis of the publicity element renders this claimed distinction meaningless. The determination does not depend on whether the content offered through the medium is of general interest to the public, but on whether the content is conveyed through a medium that delivers the information directly to the public. The supreme court’s other example of publicity, albeit offered in dicta, is consistent with this approach. The court expressly opined that the posting of private employee information on the Internet would constitute “publicity.” Id. at 554 (approvingly citing dictum of Purdy v. Burlington N. & Santa Fe Ry. Co., No. 98-833, slip op. at 6, 2000 WL 34251818 (D.Minn. Mar. 28, 2000)). By focusing on the number of people who were exposed to [44]*44the information, the district court revealed that it erroneously treated the nature of the medium as private, which would constitute publicity only if the information would likely be retold publicly. We hold that the publicity element of an invasion-of-privacy claim is satisfied when private information is posted on a publicly accessible Internet website.
The MySpace.com webpage that triggers Yath’s claim was such a site. Access to it was not protected, as some webpages are, by a password or some other restrictive safeguard. It was a window that Yath’s enemies propped open for at least 24 hours allowing any internet-connected voyeur access to private details of her life. The claim therefore survives the “publicity” challenge.
The concurring opinion maintains that we should analyze this ease under the second theory of publicity, but not the first. The concurrence’s reason is that a finding of publicity depends on the matter being communicated to such a large number of people that it becomes public knowledge. This is a correct statement of the law describing only the second theory of publicity, but it ignores the first theory. The Restatement and caselaw teach that proof of publicity under the first theory does not require evidence that the information has been communicated to a large number of people. Rather, the question is whether the information has been communicated “to the public at large.” Bodah, 663 N.W.2d at 553-54 (citing Restatement (Second) of Torts § 652D cmt. a). That the Internet vastly enlarges both the amount of information publicly available and the number of sources offering information does not erode the reasoning leading us to hold that posting information on a publicly accessible webpage constitutes publicity. If a late-night radio broadcast aired for a few seconds and potentially heard by a few hundred (or by no one) constitutes publicity as a matter of law, a maliciously fashioned webpage posted for one or two days and potentially read by hundreds, thousands, millions (or by no one) also constitutes publicity as a matter of law.
It is true that mass communication is no longer limited to a tiny handful of commercial purveyors and that we live with much greater access to information than the era in which the tort of invasion of privacy developed. A town crier could reach dozens, a handbill hundreds, a newspaper or radio station tens of thousands, a television station millions, and now a publicly accessible webpage can present the story of someone’s private life, in this case complete with a photograph and other identifying features, to more than one billion Internet surfers worldwide. This extraordinary advancement in communication argues for, not against, a holding that the MySpace posting constitutes publicity.
Contrary to the concurring opinion, as the Restatement examples illustrate, publicity under the first theory occurs at the point when the communication is made to the public at large, not to a large number of the public: “any publication in a newspaper or a magazine, even of small circulation” (not any information that a large number of persons actually read in the newspaper); “in a handbill distributed to a large number of persons” (not a handbill actually read by a large number of persons); “any broadcast over the radio” (not any broadcast actually heard by a significant audience). Restatement (Second) of Torts § 652D cmt. a. “Publicity” therefore occurs on the act that disseminates the information “to the public at large,” which is the printing, distribution, or utterance in the public forum. -Although the damages calculation for invasion of privacy might be influenced [45]*45by the extent to which the publicity was effective, see Restatement (Second) of Torts § 652H cmt. b (explaining that damages recoverable under an invasion-of-privacy claim closely resemble damages recoverable for defamation); cf. Longbehn v. Schoenrock, 727 N.W.2d 153, 160 (Minn. App.2007) (permitting recovery in defamation for the injury to reputation), a determination that publicity occurred does not require a large actual audience.
We acknowledge that some public web-pages might get little actual attention. But the same may be said of a card posted on the door of a residence or a poster displayed in a shop window, each of which constitutes publicity. See Thompson v. Adelberg & Berman, Inc., 181 Ky. 487, 205 S.W. 558 (1918) (reversing judgment against plaintiff who alleged that the defendant clothing store had posted cards for several hours on the front door and side windows of her house and on a stick near the public sidewalk indicating that the plaintiff had failed to pay a store debt); see also Brents v. Morgan, 221 Ky. 765, 299 S.W. 967 (1927) (citing Thompson and holding that poster in a shop window identifying debtor to passers-by was actionable as an invasion of privacy). The unrestricted MySpace.com webpage posting likewise constitutes publicity.
Fairview and Phat argue alternatively that we could affirm the district court’s dismissal of Yath’s invasion-of-privacy claim on other grounds. “This court can, if it needs to, affirm summary judgment on alternative theories presented but not ruled on at the district court level.” Nelson v. Short-Elliot-Hendrickson, Inc., 716 N.W.2d 394, 402 (Minn.App.2006). Fairview and Phat argued in the district court, and again on appeal, that Yath’s invasion-of-privacy claim is also subject to summary judgment because Yath did not produce any evidence that Phat or Fair-view were involved in creating the MySpace.com webpage. This argument is convincing.
Summary judgment is proper “when the record is devoid of proof on an essential element of the plaintiffs claim.” Cargill, 719 N.W.2d at 232. Yath conceded at oral argument that there is nothing in the record, except her allegation that “Phat is a liar,” to establish that Phat or Fairview were involved in creating or sustaining the MySpace.com webpage. Our independent examination of the record confirms Yath’s concession. Because MySpace.com is a “blocked” site at Fairview’s Cedar Ridge Clinic and at Fairview Ridges Hospital, the webpage could not have been created at Fairview. And Yath actually traced the creation of the webpage to the IP address of an Eagan business’s computer. Tek’s sister, Molyka Mao, worked at the business. At most, the record suggests that Mao created the website possibly with Tek’s assistance. It appears that the district court may have improperly addressed the claim as it regards these two. But Yath dismissed Mao and Tek from this suit and the record reveals no communication between Mao and Phat and no affiliation between Mao and Fairview. It is true that these defendants remained part of the case through summary judgment. But their dismissal occurred before the appeal. That Mao and Tek may be liable if the invasion-of-privacy claims against them are revived does not prevent us from affirming summary judgment.
Because Yath failed to produce any evidence on an essential element of her claim — specifically, that any of the defendants surviving on appeal were involved in creating or sustaining the disparaging MySpace.com webpage — -her invasion-of-privacy claim fails.
[46]*46III
Yath next challenges summary judgment in favor of Fairview on her claim of negligent infliction of emotional distress. A plaintiff may recover for negligent infliction of emotional distress only “when that plaintiff is within a zone of danger of physical impact, reasonably fears for his or her own safety, and consequently suffers severe emotional distress with resultant physical injury.” Bohdan v. Alltool Mfg., Co., 411 N.W.2d 902, 907 (Minn.App.1987), review denied (Minn. Nov. 13, 1987). One exception to the “zone-of-danger” rule is that a plaintiff “may recover damages for mental anguish or suffering for a direct invasion of his rights, such as defamation, malicious prosecution, or other willful, wanton or malicious conduct.” Id.
Yath argues that her invasion-of-privacy claim constitutes a direct invasion of her rights and that because the claim is viable, her negligent-infliction-of-emotional-distress claim should survive the summary judgment motion. She argues no other possible theory of liability, and so we limit our review based on the narrow argument presented. So framed, the argument fails. Because we have held that Yath’s invasion-of-privacy claim against Fairview is subject to summary judgment, we affirm the district court’s dismissal of Yath’s negligent-infliction-of-emotional-distress claim.
IV
We next address vicarious liability. Yath argues that Fairview is vicariously liable for the alleged common-law torts and statutory misconduct of its employees Tek and Phat. Yath specifically argues that the district court improperly resolved factual disputes in Fairview’s favor and wrongfully decided the factual question of whether Tek and Phat were acting within the “scope of employment” when they disseminated Yath’s medical information. Fairview argues that the district court’s conclusion should be affirmed for two reasons: (1) because Yath “did not assert a respondeat superior claim against Fairview, [and she] cannot on appeal rely on claims that were not pled” and (2) because “[t]he district court correctly concluded that Fairview was not responsible for the unauthorized acts of two of its employees.”
Yath’s complaint does not expressly assert a theory of vicarious liability in any of her claims against Fairview. The district court noted this but still analyzed the complaint under that theory. Yath’s written response to Fairview’s motion for summary judgment invited the analysis because Yath expressly argued that Fairview should be vicariously liable. Because the parties presented arguments regarding Fairview’s vicarious liability and the district court analyzed the theory as if it had been pleaded expressly, we reject the contention that the theory has been waived by deficient pleading. See O’Reilly v. Allstate Ins. Co., 474 N.W.2d 221, 223 (Minn.App. 1991) (rejecting claim that a theory was waived because it had not been specifically pleaded after the district court chose not to treat the claim as waived). But the district court did not analyze whether Fairview may be vicariously liable for its employees’ alleged violations of Minnesota Statutes section 144.335. The district court may have decided not to consider whether vicarious liability applies to violations of section 144.335 because it determined that HIPAA preempted Yath’s claim under that section. Given our decision regarding preemption in section VI below, we limit our review of vicarious liability as applied to intentional torts.
The district court concluded that Fairview is not vicariously liable for Tek and Phat’s wrongful access to and disclosure of Yath’s medical information be[47]*47cause Tek and Phat’s acts occurred outside the scope of their employment. But the district court applied the wrong test to determine whether Tek and Phat’s acts occurred within the scope of their employment. The district court applied the four-part test used in Snilsberg v. Lake Washington Club, 614 N.W.2d 738 (Minn.App. 2000), review denied (Minn. Oct. 17, 2000), which addresses whether an employer can be vicariously hable for its employee’s negligent acts. Id. at 745 (“Factors to consider in determining whether negligent acts occurred in the scope of employment include....”) (emphasis added). Because Yath’s only recognized and remaining tort claim against Fairview (invasion of privacy) addresses intentional conduct, the district court should have applied the two-part test used in Fahrendorff v. N. Homes, Inc., 597 N.W.2d 905, 910 (Minn. 1999).
The Fahrendorff court explained that an employer may be held liable for the intentional misconduct of its employees when (1) the source of the harm is related to the duties of the employee and (2) the harm occurs within work-related limits of time and place. See id. (analyzing whether a group home could be liable for an intentional sexual assault committed by one of its employees). The critical inquiry to determine if the source of the harm is related to the duties of the employee is whether the employee’s acts were foreseeable. Id. at 911-13. “Whether an employee’s acts are foreseeable is a question of fact.” Frieler v. Carlson Mktg. Group, Inc., 751 N.W.2d 558, 583 (Minn. 2008). But “to survive summary judgment on a claim that an employer is liable for an employee’s intentional tort ..., the plaintiff must present sufficient evidence to raise an issue of fact with respect to the foreseeability of such misconduct by the employee.” Id. at 584.
Fahrendorff is procedurally similar to this case. In Fahrendorff, the supreme court reviewed a district court’s grant of summary judgment in favor of an employer on a vicarious-liability claim. The district court had concluded that the employer was not vicariously liable for its employee’s intentional sexual assault because the employee’s act was performed for “personal sexual gratification [and therefore] was not in furtherance of [the employee’s] duties.” Fahrendorff, 597 N.W.2d at 909. But the supreme court reversed summary judgment, restating a prior holding that “just because an employee’s ultimate actions may be motivated by personal gratification and prohibited by the employer does not mean that those actions fall outside the scope of employment as a matter of law.” Id. at 911. The court clarified that the critical inquiry is whether the employee’s acts were foreseeable, and it held that the plaintiff had raised a fact issue through an expert’s affidavit that opined that sexual abuse is a “well known hazard” in the group-home industry. Id. at 911-12.
But Frieler is much closer to our case factually. In Frieler, the supreme court again considered an employer’s vicarious liability for the intentional torts of its employees. See 751 N.W.2d at 582-84 (analyzing a plaintiffs claim of vicarious liability against an employer for sexual harassment committed by one of its employees). The Frieler court repeated that “a plaintiff must present some evidence that an employee’s [intentional tort] was foreseeable to survive summary judgment.” Id. at 583. The plaintiff had argued that the employee’s intentional tort of sexual harassment was “foreseeable as a matter of law” because it is well known that sexual harassment is a “common problem in American workplaces.” Id. But the supreme court re[48]*48jected that argument, explaining, “[W]e are not willing to reverse our long-standing precedent that for purposes of re-spondeat superior, the foreseeability of an employee’s conduct is a question of fact to be analyzed based on the evidence presented in the particular case.” Id. at 583-84. The Frieler court affirmed summary judgment against the plaintiff on her claim of sexual harassment because she had not produced any evidence that sexual harassment by the defendant-employee was foreseeable.
Similarly here, Yath essentially asks us to hold that the wrongful access to and dissemination of private medical information is foreseeable as a matter of law. We refuse to do so. The claim fails as a matter of law because Yath presented no evidence that the wrongful access and dissemination of private medical information by Tek was foreseeable. We recognize that this reasoning could be subject to the criticism that we are ignoring a commonly recognized concern regarding patient information or elevating form over substance. See Frieler, 751 N.W.2d at 575 (“[Njotions of public policy and fairness [should not] require a plaintiff ... to hire an expert to testify that sexual harassment is a well-known hazard ... [and][r]equir-ing such testimony ... would place form over substance.”) (Page, J., dissenting). But the majority in Frieler considered and expressly rejected the criticism, explaining, “[I]t does not place ‘form over substance’ to require a plaintiff to present sufficient evidence of the necessary elements of her claim to survive summary judgment.” Id. at 584 n. 20. Because Yath failed to present any evidence to establish that Tek and Phat’s actions were foreseeable, she failed to create a fact issue to avoid summary judgment for Fair-view’s vicarious liability for Tek and Phat’s allegedly tortious conduct.
V
The district court also dismissed Yath’s claim of “breach of confidential relationship” because it concluded that “Minnesota law does not recognize a cause of action for breach of fiduciary duty between a physician and a patient.” Yath argues that the district court misinterpreted her claim and erroneously concluded that Yath failed to state a claim under Minnesota law. She asserts that she “never alleged” that any defendant is liable based on a fiduciary relationship between physician and patient. She maintains instead that her confidential-relationship claim is based on Minnesota Statutes section 595.02, subdivision 1(d) (2006). The statute does not support Yath’s newly recast claim.
Section 595.02 addresses witness testimony. Subdivision 1, regarding the competency of witnesses, provides, “Every person of sufficient understanding ... may testify ... in court ... except ... (d) A licensed physician ... shall not, without the consent of the patient, be allowed to disclose any information ... acquired in attending the patient in a professional capacity.” Id., subd. 1(d). The statute concerns testimonial privilege and does not confer a civil cause of action. Additionally, Yath’s allegation does not regard testimony. Because this testimonial-privilege statute does not apply factually or legally to confer a private cause of action, and because Yath now waives what appeared to be a common-law claim for breach of a fiduciary relationship, her cause of action for “breach of confidential relationship” fails as a matter of law.
VI
We last address Yath’s argument that the district court erred by concluding that Minnesota Statutes section 144.335 [49]*49(2006)3 is preempted by HIPAA, 42 U.S.C. §§ 1320d-1320d-8 (2006). The district court dismissed Yath’s claims under section 144.335 because it concluded that section 144.335 is contrary to HIPAA and is therefore preempted by it. Questions of statutory construction are subject to de novo review. State v. Al-Naseer, 734 N.W.2d 679, 683 (Minn.2007). Yath contends that section 144.335 is not contrary to HIPAA. We agree.
The general statutory rule is that HI-PAA supersedes or preempts any “contrary” provision of state law. 42 U.S.C. § 1320d-7(a)(l). Fairview argued, and the district court agreed, that Minnesota Statutes section 144.335 is “contrary” to HI-PAA because section 144.335 provides for a private cause of action for the wrongful disclosure of an individual’s medical records while HIPAA does not. But just because a distinction exists does not make the Minnesota provision “contrary” to HI-PAA.
A state law is “contrary” to HIPAA if a health care provider “would find it impossible to comply with both the State and federal requirements” or if the state law is “an obstacle to the accomplishment and execution of the full purposes” of HIPAA. 45 C.F.R. § 160.202. It would not be impossible for Fairview or Phat to comply with both HIPAA and Minnesota Statutes section 144.335 because both laws, in complementary rather than contradictory fashion, discourage a person from wrongfully disclosing information from another person’s health record. See 42 U.S.C. § 1320d-6(a)(3) (providing that “[a] person who knowingly ... discloses individually identifiable health information to another person, shall be punished” by a fine of not more than $50,000 or imprisonment of not more than one year, or both); Minn.Stat. § 144.335, subd. 3a(a) (“A provider ... may not release a patient’s health records to a person without a signed and dated consent ... unless the release is specifically authorized by law.”). The goals of the two laws are similar. Both protect the privacy of an individual’s health care information. The difference in remedy is functional only, in that a HIPAA violation subjects a person to criminal penalties while section 144.335 exposes a person to compensatory damages in a civil action. See Minn.Stat. § 144.335, subd. 3a(e) (“A person who negligently or intentionally releases a health record in violation of this subdivision ... is liable to the patient for compensatory damages caused by [the] unauthorized release, plus costs and reasonable attorney’s fees.”). Although the penalties under the two laws differ, compliance with section 144.355 does not exclude compliance with HIPAA.
Section 144.335 also is not “an obstacle to the accomplishment and execution of the full purposes” of HIPAA. The stated purpose of HIPAA is to improve the Medicare and Medicaid programs and “the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.” Health Insurance Portability and Accountability Act, P.L. 104-191 § 261, 110 Stat. 1936, 2021 (1996). To accomplish that purpose, HI-PAA requires entities that maintain or transmit health care information to establish safeguards “to ensure the integrity and confidentiality” of an individual’s health care information and “to protect against any reasonably anticipated ... un[50]*50authorized uses or disclosures of the information.” 42 U.S.C. § 1320d-2(d)(2). If a person wrongfully discloses health care information, that person may be subject to criminal penalties, including fines or imprisonment. 42 U.S.C. § 1320d-6. Rather than creating an “obstacle” to HIPAA, Minnesota Statutes section 144.335 supports at least one of HIPAA’s goals by establishing another disincentive to wrongfully disclose a patient’s health care record. We hold that Minnesota Statutes section 144.335 is not a contrary state law preempted by HIPAA.
Yath claims that Phat and Fairview violated Minnesota Statutes section 144.335, subdivision 3a(e), by “negligently or intentionally releas[ing] Yath’s health record.” The plain language of the statute imposes liability when a “person” negligently or intentionally releases a “health record.” Fairview relies on that language and argues that because neither Fairview Cedar Ridge Clinic nor Fairview Ridges Hospital is a “person,” the statute does not create a cause of action for Yath against Fairview. Citing Minnesota Statutes section 645.44, subdivision 7, Yath counters that “person” is generally defined to include both natural persons and corporate bodies, and therefore the statute creates a cause of action against Fairview. The district court declined to address these arguments because it concluded that HIPAA preempts section 144.335. '
As already explained, we disagree with the district court’s preemption holding. We generally do not decide matters that were presented to but not decided by the district court. See Wood v. Diamonds Sports Bar & Grill, Inc., 654 N.W.2d 704, 709 (Minn.App.2002) (citing Thiele v. Stich, 425 N.W.2d 580, 582 (Minn.1988)), review denied (Minn. Feb. 26, 2003). Unlike the question of whether Yath introduced evidence that any remaining defendant participated in the Internet publicity, this question of statutory construction depends on novel legal arguments that should be addressed first by the district court. We repeat that the district court did not address Yath’s vicarious liability argument as applied to section 144.335, presumably because of its preemption analysis and decision. We have therefore also offered no opinion about the merits of that argument. Because we reverse the district court’s preemption decision, the district court will have an opportunity on remand to address all unresolved issues related to liability under section 144.335.
DECISION
The district court did not abuse its discretion by declining to impose sanctions for Phat’s alleged spoliation of evidence. Yath’s claims on the theories of invasion of privacy, negligent infliction of emotional distress, respondeat superior for the intentional torts, and breach of confidential relationship fail as a matter of law. But because we conclude that HIPAA does not preempt Minnesota Statutes section 144.335, we reverse the dismissal of those claims and remand for the district court to consider the claims’ unresolved issues.
Affirmed in part, reversed in part, and remanded.