Paul v. Providence Health System-Oregon
273 P.3d 106
Or.2012Background
- Defendant Providence Health System-Oregon had computer disks/tapes with records of 365,000 patients stolen from an employee's car in late 2005.
- Records included names, addresses, phone numbers, Social Security numbers, and patient care information; defendant notified affected individuals and advised precautions.
- Plaintiffs allege common law negligence, negligence per se, and a UTAP (UTPA) claim for damages due to defendant's alleged inadequate safeguards.
- Plaintiffs did not allege actual identity theft or third-party viewing or use of their information; no present financial loss was alleged apart from monitoring costs.
- Trial court and Court of Appeals dismissed, relying on Lowe v. Philip Morris, that future-risk damages alone do not support a negligence claim.
- Oregon Supreme Court affirmed, holding no injury in fact shown to support negligence or UTPA/emotional distress claims when only future risk is alleged.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Economic damages require present injury | Paul argues duty exists to protect against economic loss; past/present monitoring costs recoverable. | Providence contends Lowe bars recovery for monitoring lacking present injury; no special duty to cover future harm. | Absent present injury, economic damages are not recoverable. |
| Emotional distress without present harm | Plaintiffs claim distress from risk of future identity theft infringes a legally protected interest. | Providence contends no duty to protect emotional distress absent intentional conduct or special relationship; no present harm. | No recoverable emotional distress where only risk of future harm is alleged. |
| UTPA liability for purely future losses | UTPA violation since misrepresentation of confidentiality caused threatened losses and monitoring costs. | UTPA requires ascertainable loss; monitoring costs to prevent future loss are not cognizable. | No ascertainable loss caused by defendant's conduct; UTPA claim rejected. |
| Whether relationship or statutes create heightened duty | Health-care provider status and confidentiality statutes create a heightened duty to protect information. | No explicit duty from statutes or physician-patient relationship to cover emotional distress or economic loss absent present injury. | Even assuming a duty, plaintiffs failed to state present-injury-based claims. |
| Scope of Lowe in context | Lowe should not categorically bar recovery where patient-provider relationship exists. | Lowe controls; monitoring costs for future risk not recoverable. | Lowe's rule applies; prospective harm alone does not support negligence or related damages. |
Key Cases Cited
- Lowe v. Philip Morris USA, Inc., 344 Or. 403 (Or. 2008) (presence of present injury required; future risk alone not actionable)
- Oregon Steel Mills, Inc. v. Coopers & Lybrand, LLP, 336 Or. 329 (Or. 2004) (duty can arise from special relationship or legislation to recover economic loss)
- Hammond v. Central Lane Communications Center, 312 Or. 17 (Or. 1991) (emotional distress must involve legally protected interest or intentional conduct)
- Pisciotta v. Old Nat. Bancorp, 499 F.3d 629 (7th Cir. 2007) (economic-harm theories; viewing recognizing no recovery for monitoring absent present injury)
- Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011) (increased risk of identity theft not injury-in-fact for damages)