A. B. v. The Oregon Clinic

Argued and submitted July 6, 2021, affirmed July 27, 2022

A. B., Plaintiff, v. THE OREGON CLINIC, an Oregon professional corporation, Defendant. Multnomah County Circuit Court 15CV05508 A. B., Plaintiff, v. INNOVATIVE ANESTHESIA MANAGEMENT, LLC, a Delaware foreign limited liability corporation and The Oregon Clinic, an Oregon professional corporation, Defendants. Multnomah County Circuit Court 16CV13049 A. B., Plaintiff-Appellant, v. PROVIDENCE HEALTH & SERVICES-OREGON, an Oregon domestic nonprofit corporation, Defendant-Respondent. Multnomah County Circuit Court 17CV54515 A170711 515 P3d 387

Plaintiff appeals a judgment dismissing her claim against defendant Providence Health Services-Oregon for breach of confidence based on defendant’s disclosure of plaintiff’s protected health information to The Oregon Health Clinic. She contends that the trial court erred in granting summary judgment to defendant, because she presented evidence creating a genuine issue of mate- rial fact whether defendant’s purpose in disclosing the information was for health care operations or patient or public safety, as permitted under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its Privacy

Cite as 321 Or App 60 (2022) 61

Rule and ORS 192.553 to 192.581. Held: Plaintiff’s theory that defendant’s pur- pose for disclosing the protected information was to provide early warning to The Oregon Health Clinic so that it could protect itself from civil or criminal liability was based on mere speculation. Plaintiff thus failed to meet her burden to come forward with sufficient evidence to raise a question of material fact about defen- dant’s purpose for disclosing the information. Affirmed.

Michael A. Greenlick, Judge. Gregory Kafoury argued the cause for appellant. Also on the opening brief was Kafoury & McDougal. Also on the reply brief were Mark McDougal and Kafoury & McDougal. Michael T. Stone argued the cause and filed the brief for respondent. Before Mooney, Presiding Judge, and Pagán, Judge, and DeVore, Senior Judge.* MOONEY, P. J. Affirmed.

______________ * Pagán, J., vice DeHoog, J. pro tempore.

62 A. B. v. The Oregon Clinic

MOONEY, P. J.

After undergoing a colonoscopy at The Oregon Clinic (TOC), plaintiff experienced symptoms that led her to believe that she may have been sexually assaulted during the procedure. She was examined and treated at Providence St. Vincent’s Medical Center (PSVMC) for a possible sex- ual assault, and defendant Providence Health & Services- Oregon (defendant) later disclosed that protected health information (PHI) to TOC without plaintiff’s consent. Plain- tiff subsequently brought this common-law breach of con- fidence claim against defendant.1 See Humphers v. First Interstate Bank, 298 Or 706, 696 P2d 527 (1985) (recog- nizing and describing breach of confidence tort2). Plaintiff alleged that defendant breached its duty to maintain the confidentiality of her PHI under, as relevant to this appeal, the federal Health Insurance Portability and Accountability Act (HIPAA) of 1996 and its implementing regulations,3 as well as Oregon state law governing PHI, ORS 192.553 to 192.581.4 The trial court granted summary judgment in favor of defendant on the basis that the disclosure was per- missible under those laws and entered a limited judgment dismissing plaintiff’s claim against defendant. Plaintiff appeals, challenging the trial court’s summary judgment ruling. Given the pleadings and the summary judgment record in this case, we conclude that the trial court did not err. Accordingly, we affirm.

1 Plaintiff also filed actions against TOC and Innovative Anesthesia related to the alleged sexual assault (Multnomah County Circuit Court Case Nos. 15CV05508 and 16CV13049, respectively), and the three cases were consoli- dated for trial. This appeal involves only plaintiff’s case against Providence. 2 The tort has also been referred to as breach of confidentiality. Stevens v. First Interstate Bank, 167 Or App 280, 286 n 4, 999 P2d 551, rev den, 331 Or 429 (2000) (so noting). 3 The regulations implementing HIPAA standards with respect to the secu- rity and confidentiality of health information, 45 CFR Parts 160 and 164, are known as the Privacy Rule. OHSU v. Oregonian Publishing Co., LLC, 362 Or 68, 80-81, 403 P3d 732 (2017). 4 Some provisions of Oregon law governing PHI have changed since the events giving rise to this litigation. However, because those changes do not affect our analysis in this case, we cite the current versions of the statutes in this opinion.

Cite as 321 Or App 60 (2022) 63

I. STANDARD OF REVIEW In reviewing a trial court’s grant of summary judg- ment, we view the facts and all reasonable inferences that may be drawn from those facts in the light most favorable to the nonmoving party, in this case plaintiff.5 Vaughn v. First Transit, Inc., 346 Or 128, 132, 206 P3d 181 (2009). “We review a trial court’s grant of summary judgment for errors of law and will affirm if there are no genuine disputes about any material fact and the moving party is entitled to judg- ment as a matter of law.” Thompson v. Portland Adventist Medical Center, 309 Or App 118, 121, 482 P3d 805 (2021). II. HISTORICAL AND PROCEDURAL FACTS A. Background On April 21, 2014, plaintiff underwent a colonoscopy under anesthesia at TOC. After the procedure, she experi- enced pain in her vagina, and, when it continued, on April 25, she went to her gynecologist’s office, Women’s Healthcare Associates. A provider there sent her to the Emergency Department at PSVMC for a sexual assault exam. Plaintiff was given a Notice of Privacy Practices, which she acknowl- edged in writing. Tara Bonforte, a sexual assault nurse examiner (SANE) at PSVMC, took plaintiff’s history and plaintiff was physically examined by a physician, Dr. Ward. The exam- ination revealed abrasions on the interior and exterior of plaintiff’s vagina and redness on her cervix. Plaintiff autho- rized PSVMC to notify the police, and she was interviewed at the hospital by Deputy Condon from the Washington County Sheriff’s Office (WCSO). Plaintiff also signed an authorization allowing PSVMC to release her medical infor- mation relating to the sexual assault evaluation to WCSO. Subsequently, during the course of plaintiff’s liti- gation against TOC for the alleged sexual assault, plaintiff learned that defendant had notified TOC of plaintiff’s sexual

5 Our review has been made more difficult because of plaintiff’s failure in many instances to comply with ORAP 5.40(9) (requiring references to the loca- tion in the record where facts material to the determination of the appeal appear) and reference to facts outside of the record.

64 A. B. v. The Oregon Clinic

assault examination and treatment at PSVMC, which lead to this action against defendant for breach of confidence. B. Pleadings Plaintiff alleged, in her second amended complaint,6 that defendant had disclosed her confidential information to TOC without her consent; that the information disclosed included her name, physical findings from her exam at PSVMC, and the resulting diagnosis of rape or other forc- ible sexual assault; and that the police would be contacting TOC to investigate. She alleged that the disclosure was in breach of defendant’s duty of confidentiality with respect to plaintiff under various sources, including, as relevant here, state law governing PHI, ORS 192.553, and HIPAA privacy regulations, specifically, 45 CFR §§ 164.502 and 164.510.7 The complaint further alleged that “at least part of the rea- son for the [disclosure] was to warn [TOC] of the impending police investigation in order that [TOC] might prepare itself and its agents and employees against potential accusations involving civil or criminal liability” and that plaintiff suf- fered “a great sense of personal violation, humiliation, and betrayal, all to her noneconomic damages in the amount of $1,000,000.” In its amended answer, defendant admitted that it had made the alleged disclosure—in particular, that, after plaintiff’s examination at PSVMC, a Providence Quality Manager had notified the Director of Quality and Risk at TOC of the concern that plaintiff may have been sexually assaulted during a medical procedure at TOC. Defendant further agreed that it had a duty under HIPAA and ORS 192.553 to 192.581 to maintain the confidentiality 6 After a hearing on defendant’s ORCP 21 motions, plaintiff amended her complaint to identify the sources of the duty of confidentiality alleged to have been violated. 7 In her complaint, plaintiff also alleged that defendant had a duty of confi- dentiality as to her PHI under the Hippocratic Oath; the common law implied cov- enant of trust and confidence inherent in the physician-patient relationship; the implied covenant of confidentiality in the contract between plaintiff and her medi- cal providers at PSVMC; ORS 677.190(5); the physician-patient testimonial privi- lege; and sections IV and VIII of the American Medical Association’s Principles of Medical Ethics. However, plaintiff did not address those additional authorities in response to defendant’s summary judgment motion disputing the applicability of those authorities. For that reason, we do not address them further.

Cite as 321 Or App 60 (2022) 65

of plaintiff’s PHI. However, as relevant here, defendant asserted that its disclosure was permitted by both federal and state law because it was made for purposes of health care operations and/or to avert a serious threat to public health or safety and, therefore, there was no breach.8 C. Summary Judgment Proceedings Defendant moved for summary judgment against plaintiff on several grounds. Among other points, as rel- evant on appeal, defendant argued that it was entitled to judgment as a matter of law on plaintiff’s breach of confi- dence claim because its disclosure of plaintiff’s information was permissible under HIPAA’s Privacy Rule and state law allowing the disclosure of PHI from one covered entity to another for the health care operations of the entity receiv- ing the information, 45 CFR § 164.506(c)(4); ORS 192.558, or to avert a serious threat to individual or public health or safety, 45 CFR § 164.512(j).9 Defendant also argued that, if disclosure was permitted under HIPAA for either reason, it was also necessarily permitted under Oregon law, because Oregon’s law expressly permits disclosure of PHI as permit- ted by federal law, ORS 192.558(2)(b). Accordingly, in defen- dant’s view, there was no breach, and defendant was there- fore entitled to judgment as a matter of law.10 8 Although defendant initially identified these as affirmative defenses, at the summary judgment stage, the parties and the trial court understood that it was plaintiff’s burden to prove that the disclosure was unlawful. 9 Defendant also cited ORS 192.567(2), the state law counterpart to 45 CFR § 164.512(j); however, that statute is inapplicable because it was enacted after the events giving rise to this litigation. 10 Defendant also argued that there was no breach because, even if its dis- closure violated HIPAA or state law, the disclosure was privileged for the safety of individuals or as an important matter of public interest. Alternatively, defen- dant asserted that plaintiff waived any duty of confidentiality arising from the physician-patient privilege, ORS 40.235—even assuming that it applied—when she voluntarily disclosed substantially the same information to WCSO and signed authorizations allowing release of her medical records at TOC and Providence to law enforcement. Finally, defendant argued that it was also entitled to summary judgment on the causation element of the tort—that plaintiff could not produce evidence sufficient to create a material question of fact that defendant’s disclo- sure of plaintiff’s PHI to TOC was the “cause in fact” of any injury to plaintiff. Plaintiff did not address any of those arguments in her written response to defendant’s summary judgment motion, and she mentioned them only cursorily at the hearing on the motion. In any event, given the issues raised on appeal and our conclusion that the trial court did not err in granting summary judgment to defendant on the breach of duty element, we need not discuss them further.

66 A. B. v. The Oregon Clinic

In support of its motion, defendant submitted a dec- laration from Gordon Eddington, a Quality Management Coordinator at PSVMC at the time of the events in question. Eddington, a nurse by education and training, described his job duties as including “investigating and responding to patient complaints and grievances as well as to concerns raised by employees and staff relating to quality of care and patient safety.” Eddington stated that Bonforte had con- tacted him about the alleged sexual abuse of plaintiff at TOC and that he had documented his involvement in the mat- ter in defendant’s Oregon Quality Management Database (ORQMD), as was his routine practice. Those notes from the ORQMD were attached to his declaration as Exhibit A. Eddington learned from Bonforte that plaintiff was not expecting any response from defendant, and that she had decided to report the allegations to the police. Once informed of the allegations of sexual abuse, Eddington believed that he was ethically required to take action on behalf of plaintiff and for the public safety of other potential patients at TOC and that it was part of his job to take “all appropriate action where indicated for patient safety and quality of care.” Eddington stated that he understood that he was permitted under HIPAA and state law to disclose the information to another covered entity—here, TOC—about their shared patient—plaintiff—for such purposes. He also understood that the disclosure was to be to a person with the ability to reasonably prevent or lessen the threat. Eddington further declared: “Under the circumstances, I made a telephone call to Suzanne Laisner, the Director of Quality and Risk Management at [TOC], to advise her of the situation. I do not recall the specifics of the telephone call with Ms. Laisner. However, I documented that Ms. Laisner would initiate an investigation and follow up at their clinic. This would have been my expectation when I made the call to Quality Management at [TOC]. I would have provided the mini- mum necessary information to allow [TOC] to conduct a meaningful investigation. “Although I do not have a specific recollection of the tele- phone call with Ms. Laisner, my purpose would have been

Cite as 321 Or App 60 (2022) 67

to make sure that [TOC] was aware of the allegation so that the situation could be looked into and any issues promptly addressed. My concerns would have been not only for plain- tiff, but also to try and prevent potential sexual abuse of future patients.”

Eddington’s notes, documented in ORQMD, reflect that he spoke with Laisner on April 29: “[D]iscussed this with Teri Polak, ED SANE RN.[11] Teri tells me that the pt is not expecting a call from QM. She relates pt has or will contact Washington Co deputies to lodge a complaint/report. Discussed this morning with Suzanne Laisner at Oregon Clinic. She will initiate an HR investigation and follow up at their clinic.”

(Emphasis added.) In a supplemental declaration, Eddington specified that his ORQMD entries in Exhibit A were made close in time to the events documented and that his review of the exhibit and emails between himself and Bonforte “refreshed [his] recollection of the nature of the concern raised, my investigation, and that I made a call to Suzanne Laisner at [TOC] to advise her of the situation.” Defendant also submitted excerpts from Laisner’s deposition testimony, in which she testified that, in April 2014, she received a telephone call from someone “who identi- fied themselves from their quality department at Providence St. Vincent.” She testified that she did not remember who called her; when pressed, she said that she believed it was a woman. She was told that a TOC patient had been exam- ined by the Emergency Department at PSVMC and found to have interior and exterior vaginal bruising. Laisner testi- fied that she did not remember if she was told that the police were involved, but that she would have, and did, start an investigation. In response to defendant’s motion for summary judgment, plaintiff argued that “[t]he only issue is the intent of Providence St. Vincent,” and that “[a]ny presumption of 11 Polak was the SANE nurse who suggested that Bonforte contact Eddington.

68 A. B. v. The Oregon Clinic

good faith and proper intent fails in the face of ‘any evi- dence’ which calls such good faith into question.” (Emphasis added.) In other words, plaintiff did not dispute that defen- dant’s disclosure would fit within the statutory exceptions identified by defendant if it had been made for those pur- poses. At the hearing on the motion, plaintiff acknowledged that disclosure of the information was permitted under HIPAA and state law if the purpose of the disclosure was for quality assurance or patient or public safety, but, she argued, “any evidence” that the disclosure was made for some other purpose sufficed to create a jury question on that issue. To that point, plaintiff argued that there was evi- dence from which the jury could find that the call to TOC was not made by Eddington, the Quality Management Coordinator. In support, plaintiff submitted Eddington’s deposition testimony—which was taken several months before his declarations described above—in which Eddington testified that he did not remember making the call to Laisner. Plaintiff suggested that “[a] reasonable juror might conclude that if he had made such a phone call, he would remember it.” Plaintiff also pointed to Laisner’s deposition testimony that she believed that it was a woman who called her. And that Laisner understood that hospitals are obli- gated to report evidence of sexual abuse, leading to the infer- ence, according to plaintiff, that Laisner knew when she got the call that “it meant there was going to be a police inves- tigation.” Plaintiff also submitted an exhibit of an email chain among Providence employees in which, on May 27, 2014, a month after the disclosure, Shannon Alexander, Risk Manager at PSVMC, wrote, “Because the allegation was not about something that happened on our property, we passed the information off to Oregon Clinic, RM. We also were told the patient was contacting the police, so no addi- tional reports were made.”12 (Emphases added.) All of that, according to plaintiff, was evidence that Alexander was “in

12 Plaintiff argued that risk managers are “bureaucrats who deal with lia- bility, not safety,” and the role of a risk manager is to “[s]top people from making successful claims against our hospital costing us money, loss of reputation, in some cases scandal.” The summary judgment record contains no evidence about the duties and role of risk managers in medical institutions.

Cite as 321 Or App 60 (2022) 69

on the decision to make the phone call” to TOC and, there- fore, that the disclosure of plaintiff’s confidential informa- tion was from risk manager to risk manager, evidencing that defendant’s intent in disclosing was not for purposes of quality assurance or individual or public safety, but to man- age TOC’s liability exposure.13 In short, plaintiff opposed summary judgment on the theory that there was a genuine issue of material fact as to who made the phone call to TOC and, consequently, as to the purpose of the call, such that the disclosure was not—as defendant contended—permitted under HIPAA and state statute for the purpose of health care operations or individual or public safety. The court granted defendant’s motion for sum- mary judgment. In its oral ruling, the court reasoned that (1) plaintiff had the burden of proving that there was an unauthorized or unlawful disclosure, (2) there was no dis- pute that the relevant statutes and federal regulations per- mitted the disclosure for purposes of “healthcare operations for the protection of the public,” and (3) plaintiff presented nothing more than suspicion or speculation that defendant disclosed the information for other than those reasons. The court concluded: “And so when, in a case like this, somebody from quality management documents that they make the disclosure so that there be an investigation. They make it in circum- stances where you would expect it—a disclosure to be made because there’s a serious health and safety concern. There has to be something more than suspicion, speculation, or facts that would lead to unreasonable inferences to allow this to go to a jury. “* * * [W]e don’t really have anything other than sus- picion or speculation with respect to the intent of [defen- dant]. So I’m going to grant summary judgment as to * * * [d]efendant.” Plaintiff sought reconsideration of that ruling, which was denied, and the court subsequently entered a limited judg- ment of dismissal with prejudice as to defendant. Plaintiff 13 Alexander testified that she did not recall calling Laisner or anybody at TOC in April 2014 about a patient safety report.

70 A. B. v. The Oregon Clinic

appeals, challenging the trial court’s summary judgment ruling.14 III. ANALYSIS “The gravamen of the tort of breach of confidenti- ality, in Oregon and nationally, is the affirmative disclo- sure of information by a person to whom the confidential information has been entrusted.” Stevens v. First Interstate Bank, 167 Or App 280, 286, 999 P2d 551, rev den, 331 Or 429 (2000) (emphasis and footnote omitted) (citing Humphers, 298 Or at 717-19). That legal duty “not to speak” is not deter- mined by “custom or reasonable expectations,” Humphers, 298 Or at 718; rather, the “contours of the asserted duty of confidentiality are determined by a legal source external to the tort claim itself,” and a plaintiff asserting such a duty “must identify its source and terms,” id. at 719. The plain- tiff must also prove a breach of that duty. See id. at 721 (“The actionable wrong is the breach of duty in a confiden- tial relationship.”). In this case, the parties agree that defendant had a duty of confidentiality with respect to plaintiff’s PHI aris- ing from federal and state law, specifically, HIPAA’s Privacy Rule, as well as ORS 192.553 to 192.581, both of which pro- tect an individual’s PHI from unlawful disclosure. See 42 USC § 1320d-2; 45 CFR § 164.502(a); ORS 192.553(1)(a). Both statutory schemes, however, allow disclosure without the patient’s authorization or consent under certain circum- stances.15 See 45 CFR § 164.502(a)(1); ORS 192.558. Under HIPAA’s Privacy Rule, a covered entity may, as relevant here, disclose an individual’s PHI without the individual’s consent for health care operations (which includes quality assessment and improvement activities and patient 14 Plaintiff purports to assign error to the trial court’s “holding that there was no evidence from which a reasonable jury could infer improper intent on the part of defendant,” which is an improper assignment. Assignments of error are to be directed to a trial court’s ruling, not its reasoning. See ORAP 5.45(3) (“Each assignment of error must identify precisely the legal, procedural, factual or other ruling that is being challenged.”). That said, we understand that plain- tiff intended to assign error to the trial court’s summary judgment ruling. 15 It is undisputed that Providence and TOC are covered entities and health care providers under the relevant federal and state law and that plaintiff was a patient of both entities.

Cite as 321 Or App 60 (2022) 71

safety activities) or to avert a serious threat to the health or safety of an individual or the public. In particular, with respect to the first category, a covered entity is permitted to use or disclose protected health information “[f]or * * * health care operations, as permitted by and in compliance with § 164.506.” 45 CFR § 164.502(a)(1)(ii). In turn, 45 CFR § 164.506(c)(4) provides, as relevant: “A covered entity may disclose protected health informa- tion to another covered entity for health care operations activities of the entity that receives the information, if each entity either has or had a relationship with the individual who is the subject of the protected health information being requested, the protected health information pertains to such relationship, and the disclosure is: “(i) For a purpose listed in paragraph (1) or (2) of the definition of health care operations[.]” HIPAA’s definition of “health care operations,” 45 CFR § 164.501, provides, in paragraphs (1) and (2): “Health care operations means any of the following activities of the covered entity to the extent that the activi- ties are related to covered functions: “(1) Conducting quality assessment and improvement activities, including outcomes evaluation and development of clinical guidelines, provided that the obtaining of gener- alizable knowledge is not the primary purpose of any stud- ies resulting from such activities; patient safety activities (as defined in 42 CFR 3.20); * * * and related functions that do not include treatment; “(2) Reviewing the competence or qualifications of health care professionals, evaluating practitioner and pro- vider performance, * * * accreditation, certification, licens- ing, or credentialing activities[.]” And, 42 CFR § 3.20 defines “patient safety activities” to include “[e]fforts to improve patient safety and the quality of health care delivery[.]” With respect to the second category, 45 CFR § 164.512(j), provides, in part: “(1) Permitted disclosures. A covered entity may, con- sistent with applicable law and standards of ethical conduct,

72 A. B. v. The Oregon Clinic

use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure: “(i)(A) Is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public; and “(B) Is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat[.]” A covered entity is presumed to have acted in good faith with respect to the belief described above, “if the belief is based upon the covered entity’s actual knowledge or in reli- ance on a credible representation by a person with apparent knowledge or authority.” 45 CFR § 164.512(j)(4). Under state law, ORS 192.558(3) allows a health care provider such as defendant to disclose an individual’s PHI without the individual’s authorization “(a) To another covered entity for health care opera- tions activities of the entity that receives the information if: “(A) Each entity has or had a relationship with the individual who is the subject of the protected health infor- mation; and “(B) The protected health information pertains to the relationship and the disclosure is for the purpose of: “(i) Health care operations as listed in ORS 192.556(4)(a) or (b)[.]” The specified health care operations are “[q]uality assess- ment, accreditation, auditing and improvement activities,” ORS 192.556(4)(a), and “[c]ase management and care coor- dination,” ORS 192.556(4)(b). State law also allows a health care provider to disclose the information without the per- son’s consent “[a]s otherwise permitted or required by state or federal law or by order of the court.” ORS 192.558(2)(b). On appeal, the parties essentially reprise the argu- ments they made below, focusing on whether defendant breached its duty of confidentiality. Defendant contends that it did not—and therefore plaintiff could not establish that element of her claim as a matter of law—because its disclosure to TOC was permitted under federal and state law either for health care operations, or to avert a serious

Cite as 321 Or App 60 (2022) 73

threat to the safety of an individual or the public, as set out above. It asserts that the evidence demonstrates that defen- dant disclosed plaintiff’s PHI for “quality assessment and improvement activities, patient safety, and/or evaluating practitioner and provider performance at TOC.” According to defendant, once Eddington—a Quality Management Coordinator—learned that plaintiff’s sexual assault exam- ination at PSVMC raised concerns that she may have been sexually abused while undergoing a procedure at TOC, he was “compelled to act not only for plaintiff but also for the protection of future patients who may have been in danger of sexual abuse.” And, the disclosure was based on a good faith belief that it was “necessary to prevent such harm and to a person or persons reasonably able to prevent or lessen the threat.” Significantly, plaintiff does not dispute defendant’s underlying proposition. That is, as the trial court observed, plaintiff does not dispute that, if the disclosure was made for those purposes, defendant’s disclosure would have been per- mitted by law—in other words, that it would fall within the statutory and regulatory parameters set out above.16 Rather, plaintiff argues only that she presented sufficient evidence to raise a genuine issue of material fact as to whether that was indeed defendant’s purpose or, as she claims, that, instead, defendant’s intent was to “afford [TOC] an early warning about the impending police investigation so that it might better defend its own interests against plaintiff’s allegations.” We reject that argument. To begin, we are not persuaded by plaintiff’s char- acterization of her burden on summary judgment. Plaintiff, as the party adverse to summary judgment, “has the bur- den of producing evidence on any issue raised in the motion

16 The only time plaintiff even touches on the question of statutory inter- pretation is to challenge, in her reply brief, defendant’s reliance on DelleCurti v. Walgreen Co., 70 NE3d 111 (Ohio App 2016), for its interpretation of the patient safety exception in 45 CFR § 164.506(c)(4). That is insufficient to raise an issue about the regulation separate from the thrust of her argument, which is that defendant’s purpose for disclosing was not patient safety. Similarly, with regard to the good faith belief requirement in 45 CFR § 164.512(j), as plaintiff recognizes in her reply brief, any argument about the presumption of good faith is essen- tially immaterial because her claim is that defendant acted with an improper motive in calling TOC.

74 A. B. v. The Oregon Clinic

as to which the adverse party would have the burden of per- suasion at trial.” ORCP 47 C. Thus, as plaintiff acknowl- edges, because she would have had the burden of proof at trial on the question whether defendant breached its duty of confidentiality under HIPAA and/or state law—specifically, given the statutory framework set out above, that defen- dant’s disclosure was not for a permissible purpose—she was required to produce evidence on that issue in response to defendant’s motion. Plaintiff contends that to defeat summary judgment she need only produce “some evidence” or “any evidence” that defendant’s intent in disclosing the information was not for health care operations or to avert a serious threat to public safety, as permitted under the relevant law. Although plain- tiff is correct that, in Mason v. BCK Corp., 292 Or App 580, 586, 426 P3d 206, rev den, 363 Or 817 (2018), we held that the clear and convincing standard of proof at issue there did not “change the standard of ‘some evidence’ or ‘any evi- dence’ when considering whether a party has produced evi- dence sufficient to show a genuine dispute of material fact” for purpose of summary judgment, that does not change the fact that, under ORCP 47 C, no genuine issue of material fact exists if, based on the record before the court viewed in a manner most favorable to the adverse party, “no objec- tively reasonable juror could return a verdict for the adverse party.” Id. at 587 (emphasis added; internal quotation marks omitted). Thus, to create a genuine issue of material fact, plaintiff must come forward not only with “some” evidence of defendant’s improper purpose but with “some” evidence from which an objectively reasonable jury could find that improper intent. See, e.g., Chapman v. Mayfield, 263 Or App 528, 530, 329 P3d 12 (2014), aff’d, 358 Or 196, 361 P3d 566 (2015) (“Because plaintiffs would have had the burden of proof at trial, to withstand defendant’s motion for summary judgment, plaintiffs had the burden of producing admissible evidence establishing facts that by themselves or by their reasonable inferences could cause a reasonable juror to find each element of plaintiffs’ claim.” (Emphasis added; internal quotation marks omitted.)); Brant v. Tri-Met, 230 Or App 97, 104, 213 P3d 869 (2009) (to withstand summary judgment, the party with the burden of proving a claim must present

Cite as 321 Or App 60 (2022) 75

evidence that gives a factfinder a basis “other than sheer speculation” to conclude that the elements of the claim have been satisfied). Plaintiff’s interpretation—at least as we understand it—does not account for the “reasonable juror” part of her burden. With the standard thus clarified, we turn to plain- tiff’s argument. In supporting her claim that defendant’s intent was, at least in part, to “afford [TOC] an early warn- ing about the impending police investigation so that it might better defend its own interests against plaintiff’s allega- tions,” plaintiff points to the following evidence in the sum- mary judgment record: • Eddington’s initial deposition testimony that he did not recall making a call to anyone at TOC about plaintiff • Laisner’s testimony that she believed it was a woman who called her • Alexander’s email that “we passed the information off to Oregon Clinic.” According to plaintiff, that evidence leads to the fol- lowing reasonable inferences: that Eddington may not have made the call and, at the least, was not the sole decision- maker; that “there was an active effort to conceal the caller, and content, of the phone call”; that Alexander, the risk man- ager, was involved in the decision to make the disclosure; and that, because the risk manager’s role is to protect the institution, defendant’s disclosure of plaintiff’s PHI was not for purposes of health care operations or to protect patient or public safety, as allowed by statute, but, rather, to help TOC protect itself against plaintiff’s allegations. Further, according to plaintiff, Eddington’s declaration is speculative even as to Eddington’s intent, because it establishes only what his purpose “would have been,” and, thus, “Providence has provided no direct evidence of the purpose behind the phone call.” Plaintiff also argues that Eddington’s documenta- tion of the call with Laisner, reflecting that he spoke with Laisner and she “will initiate an HR investigation and

76 A. B. v. The Oregon Clinic

follow up at their clinic”—because it was preceded by a sen- tence that plaintiff “has or will contact Washington Co. dep- uties to lodge a complaint/report”—allows for the inference that the purpose of the call was to inform TOC that plaintiff would be contacting the police. In the same vein, for the first time in her reply brief, plaintiff also points to a portion of the ORQMD record documenting an email from Eddington to Bonforte in which he says, “Thanks for the additional info. I agree it will be complicated for her [referring to plain- tiff]; this is a very serious allegation and I’m sure [TOC] will be exhaustive in investigating the situation if she pursues it with them.” (Emphasis in plaintiff’s brief.) That, according to plaintiff at oral argument, is a “smoking gun,” because it is evidence that TOC would only investigate if it was pres- sured to do so—that TOC was not interested in pursuing it for quality assurance or public safety purposes.

Plaintiff’s theory is based on speculation and guess- work rather than reasonable inferences. See Mason, 292 Or App at 602-03 (“Whether a factual finding is based on rea- sonable inference, or would instead require impermissible speculation, will depend on the broader circumstances of each case.”); State v. Bivins, 191 Or App 460, 467, 83 P3d 379 (2004) (“There is a difference between inferences that may be drawn from circumstantial evidence and mere spec- ulation. Reasonable inferences are permissible; speculation and guesswork are not.” (Internal citations and quotation marks omitted.)). The line that separates reasonable infer- ences from speculation is “ ‘drawn by the laws of logic.’ ” Id. (internal quotation marks omitted). “[W]e have held evidence insufficient to support an inference when the conclusion to be drawn from it requires too great an inferential leap—that is, when the logic is too strained.” Id. at 468 (internal quo- tation marks omitted). Of course, the laws of logic include “principles of deduction or inference.” State v. Hedgpeth, 365 Or 724, 733, 452 P3d 948 (2019) (internal quotation marks omitted). We keep in mind that multiple reasonable infer- ences may be drawn from the evidence, but those inferences must still be reasonable and not speculative. Id. at 732-33.

Plaintiff’s proposed inferences fall on the specula- tive side of the line. Evidence that Eddington did not initially

Cite as 321 Or App 60 (2022) 77

recall making the call to TOC, but later—after reviewing his notes, which were documented in ORQMD close in time to the original event, as was routine—was reminded of the call, does not, absent speculation, lead to the inference that Eddington was trying to conceal who made the call or its content. Similarly, Alexander’s use of the word “we,” when reporting on the incident a month later, most naturally refers to Providence the entity, not herself personally. And most glaring of all, even if a juror could reasonably infer from that evidence (along with Laisner’s testimony that she thought it was a woman who called her17) that Alexander was involved in the decision to contact TOC, there is noth- ing in the summary judgment record to indicate that a risk manager is not typically concerned with health care operations—including quality assurance and patient safety— or the safety of individuals or the public. Indeed, the record is devoid of evidence as to the role and duties of a hospital risk manager. That absence cuts against plaintiff. The bare fact that a risk manager might have been involved in the decision to disclose the information to TOC does not lead to a reasonable inference that the purpose of the call was to “afford [TOC] an early warning about the impending police investigation so that it might better defend its own interests against plaintiff’s allegations,” as plaintiff claims.18 Similarly, the fact that Eddington’s ORQMD note that he “discussed this morning with Suzanne Laisner at [TOC]” follows a sentence in the same note that plaintiff would be contacting the police does not lead to a reasonable inference that the purpose of the call was to help TOC pro- tect itself. Rather, the note simply records what transpired and Eddington’s involvement in it, including that Laisner would initiate an investigation. Finally, Eddington’s email note that TOC would undergo an exhaustive investigation “if plaintiff pursue[d] it with them” goes more to TOC’s inten- tions than it does to anything about defendant’s purpose

17 Laisner also stated in her deposition testimony that she did not recall who had called her. 18 Indeed, even if we assume that a risk manager’s primary concern is liabil- ity, a risk manager would have reason to investigate plaintiff’s allegations and take appropriate action to ensure that patients were not being harmed because that, in turn, would reduce the risk of liability on behalf of the institution.

78 A. B. v. The Oregon Clinic

in sharing the information. To conclude otherwise relies entirely on guesswork. In sum, the summary judgment record does not contain evidence legally sufficient to support a finding that defendant’s disclosure of the information was other than for purposes of health care operations or patient and public safety, as permitted by law. Plaintiff, thus, failed to come forward with sufficient evidence to create a genuine issue of fact about defendant’s purpose for disclosing the information. We agree with the trial court’s characterization of plaintiff’s theory as a logically flawed “post hoc fallacy”—that, “since [defendant] informed [TOC], and [TOC] presumably dis- couraged cooperation [with the police investigation],[19] then it was [defendant’s] intent to discourage cooperation.” The trial court did not err in granting summary judgment to defendant. Affirmed.

19 A presumption of fact that itself is not supported by the summary judg- ment record.