Courtney Guy v. Providence Health & Services Washington d/b/a Providence Alaska Medical Center

Notice: This opinion is subject to correction before publication in the PACIFIC REPORTER. Readers are requested to bring errors to the attention of the Clerk of the Appellate Courts, 303 K Street, Anchorage, Alaska 99501, phone (907) 264-0608, fax (907) 264-0878, email corrections@akcourts.gov.

THE SUPREME COURT OF THE STATE OF ALASKA

COURTNEY GUY, ) ) Supreme Court No. S-17520 Appellant, ) ) Superior Court No. 3AN-16-05145 CI v. ) ) OPINION PROVIDENCE HEALTH & ) SERVICES WASHINGTON d/b/a ) No. 7578 – January 14, 2022 Providence Alaska Medical Center, ) ) Appellee. ) )

Appeal from the Superior Court of the State of Alaska, Third Judicial District, Anchorage, Jennifer Henderson, Judge.

Appearances: Jason Gazewood and Ember Skye Tilton, Anchorage, for Appellant. Mara E. Michaletz, Birch Horton Bittner & Cherot, Anchorage, for Appellee.

Before: Winfree, Maassen, Carney, and Borghesan, Justices. [Bolger, Chief Justice, not participating.]

BORGHESAN, Justice.

I. INTRODUCTION A patient sued a hospital after learning that a hospital employee intentionally disclosed the patient’s health information in violation of the Health

Insurance Portability and Accountability Act (HIPAA).1 The patient alleged that the disclosure breached the hospital’s contractual obligations to him. The superior court instructed the jury to return a verdict for the hospital if the jury found that the employee was not acting in the course and scope of employment when she disclosed the patient’s information. The jury so found, leading to judgment in the hospital’s favor. We vacate the judgment because the jury instruction erroneously applied the rule of vicarious liability to excuse liability for breach of contract. A party that breaches its contractual obligations is liable for breach regardless of whether the breach is caused by an employee acting outside the scope of employment, unless the terms of the contract excuse liability for that reason. We therefore remand this case for further proceedings, in particular to determine whether a contract existed between the patient and hospital and, if so, the contract’s terms governing patient health information. II. FACTS AND PROCEEDINGS A. Facts In March 2013 Courtney Guy was assaulted and tortured by a group of men in Anchorage. Guy was treated for his injuries at Providence Alaska Medical Center (Providence). While Guy was hospitalized, one of his assailants communicated by text message with Providence employee Stacy Laulu. At the assailant’s request, Laulu accessed Guy’s medical records and illegally texted the information to the assailant. Months later, federal agents searched the assailant’s cell phone while investigating him for federal crimes. The agents found Laulu’s text messages, which had constituted a HIPAA violation.2 Upon learning of the violation, Providence fired Laulu,

1 Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified in scattered sections of 42 U.S.C.). 2 See, e.g., Murphy v. Dulay, 768 F.3d 1360, 1368-69 (11th Cir. 2014) (continued...)

-2- 7578

notified the Secretary of the United States Department of Health and Human Services of the violation, and informed Guy of the disclosure by letter. Laulu was subsequently convicted of violating HIPAA. B. Proceedings 1. Initial proceedings Roughly two-and-a-half years after Guy was informed of the HIPAA violation, he filed a complaint against Providence. Guy alleged that he had “suffered severe and prolonged serious physical injury” when “Laulu, as an employee and agent of Providence,” disclosed his health information. Guy claimed that Providence “had a contractual obligation to ensure that such information was not released to third parties” and had breached that duty, causing him injury. Providence answered the complaint, admitting that Laulu was a Providence employee when she disclosed Guy’s information. However, Providence claimed that “[t]he disclosure of this information was not authorized by Providence” and that “Laulu was not an agent of, or acting in the course and scope of her employment with, Providence when confidential patient information was disclosed.” Providence also denied that it had caused Guy’s injury. 2. Motion for summary judgment Providence moved for summary judgment. After pointing out that HIPAA violations do not give rise to private causes of action, Providence argued that any common-law tort claim based on disclosure of patient health information would be

2 (...continued) (explaining that “HIPAA regulations generally prohibit covered entities from using or disclosing ‘protected health information’ ” with exceptions for disclosures made through the judicial process or when expressly authorized by a patient (citing 45 C.F.R. § 164.508(a)(1))).

-3- 7578

barred by the applicable two-year tort limitations period. As for Guy’s contract claim, Providence contended that because it had no contract with Guy “concerning HIPAA or the disclosure of information about him,” it did not breach any contractual obligations to Guy. The court held oral argument on Providence’s summary judgment motion. Guy’s counsel raised an argument not made in briefing. He likened Guy’s case to Luedtke v. Nabors Alaska Drilling, Inc., where this court recognized that at-will employment contracts contain an implied covenant of good faith and fair dealing and that requiring employees to undergo drug testing could in some instances amount to a breach of the implied covenant in light of the public policy in Alaska favoring employee privacy.3 Invoking this public policy, Guy argued that the court should follow Luedtke and find that the implied covenant of good faith and fair dealing protects patients’ health information when receiving medical treatment. At the close of argument the superior court stated that if it considered this newly raised argument it would give both parties an opportunity to present supplemental briefing on the issue. The court denied Providence’s motion for summary judgment in a written order. “After consideration of new arguments brought forth at oral argument,” the court found genuine issues of material fact “as to the existence and terms of the contract for services entered between Mr. Guy and Providence and, further, whether the duty of good faith and fair dealing would be violated by the conceded unauthorized disclosure of private medical information.” Providence moved for reconsideration, pointing to the court’s promise to provide an opportunity for supplemental briefing in the event it considered arguments beyond those already briefed. The court granted Providence’s motion to reconsider and

3 768 P.2d 1123, 1130, 1136-37 (Alaska 1989).

-4- 7578

invited Providence to file supplemental briefing. Providence then requested and received a one-month extension, but it does not appear to have filed any supplemental briefing on this issue. 3. Trial Trial began in October 2018, but the judge declared a mistrial. A second trial was scheduled for June 2019. Before the first trial, Providence had filed a memorandum regarding jury instructions. One of its proposed jury instructions stated that “[i]n order to determine whether [Providence] is legally responsible for the acts of Stacy Laulu, you must decide that it is more likely true than not true that Stacy Laulu was acting within the course and scope of her employment when the disclosure occurred.” Before the second trial, which was held before a new judge, the court notified the parties that it intended to give this proposed instruction (among others) to the jury. Guy objected to this instruction. Guy argued that his action was based on contract and that the concept of vicarious liability did not apply because “[v]icarious liability is a concept that a principal is liable in tort for harms caused by its agent.” He proposed his own instructions seemingly based on a mix of contract and tort principles. The superior court accepted some but not all of Guy’s instructions. On the first day of the second trial the judge invited the parties to address the dispute over jury instructions. Guy’s counsel stated that Providence was “attempting to use vicarious liability as a defense to a contract claim, which doesn’t seem to be available.” He argued that the jury instructions failed to address contract law and asked the court to use “our earlier contract instructions that we submitted.” Guy’s counsel argued that he was not able to find a single case where vicarious liability “was approved as a defense to a contract claim.”

-5- 7578

Later that day Guy submitted a supplemental brief on the issue. The brief explained that “[t]here is no reference in the Restatement (Second) of Contracts regarding vicarious liability.” Rather, “[v]icarious liability rests in tort.” Guy asked that “[i]nstead, the Court instruct on the relevant contractual breach instructions.” Providence responded that its proposed instruction did not use the term “vicarious liability” and was “based on previous pattern jury instructions referencing agency relationships,” namely Alaska Pattern Jury Instructions — Civ. 23.01 and 23.02. Providence argued that “vicarious liability is to tort law as agency is to contract,” and claimed that “Alaska has a long history of applying principles of agency liability to contract claims.” It cited the Restatement (First) of Agency, arguing that the factors set forth “for the consideration of an agent’s authority (and a principal’s liability) . . . . are not unlike Alaska Civil Pattern Jury Instruction.” The disputed instruction, reflecting Providence’s position, instructed jurors that the parties did not dispute that Laulu illegally disclosed Guy’s information, but that [i]n order to determine whether [Providence] is legally responsible for the acts of Stacy Laulu, you must decide that it is more likely true than not true that Stacy Laulu was acting within the scope of her employment with, or agency for, [Providence]. To make this decision, the jury was instructed to consider: (1) whether [Providence] expressly authorized Stacy Laulu’s conduct, or Stacy Laulu’s conduct was similar to conduct that the defendant authorized, or Stacy Laulu’s conduct was not a remote or improbable occurrence in connection with authorized conduct; (2) whether Stacy Laulu’s conduct occurred substantially within the time and place authorized by the defendant; and (3) whether Stacy Laulu’s conduct was motivated, at least in part, by an intent to serve the defendant.

-6- 7578

In evaluating these factors, the instruction permitted the jury to consider: • the time, place and purpose of Stacy Laulu’s conduct; • any previous situations that involve the defendant’s authorization to Stacy Laulu; • whether Stacy Laulu’s conduct was outside the defendant’s area of business activity; • whether the defendant had reason to expect that Stacy Laulu would engage in the conduct; • the similarity of Stacy Laulu’s conduct to any conduct that the defendant expressly authorized; • whether the defendant supplied any equipment or tools that Stacy Laulu used when engaging in the conduct; • whether Stacy Laulu departed from the normal method of accomplishing an authorized result; and • whether Stacy Laulu’s conduct involved a serious crime. If the jury ruled that Providence was not legally responsible, the disputed instruction ordered the jury to return a verdict for the hospital. The court later asked the parties for additional arguments regarding this proposed jury instruction. Providence’s counsel suggested that it would be “ironic” if parties that “don’t file within the statute of limitations . . . have more theories” than those that do: “[I]f you don’t bring a tort claim for something that’s obviously a tort, and you bring a contract claim, all of a sudden you’re in a stronger position because defenses that could be raised before are no longer viable.” Guy’s counsel responded that the proposed instruction was inconsistent with the contract claims being pled. Guy’s counsel then argued that the breach at issue was not Laulu’s revealing Guy’s health information, but her obtaining it in the first place. The fact that the information was subsequently

-7- 7578

revealed to the men who had assaulted Guy “is more along the lines of what the harm was, what the damage was.” The court observed that Guy’s theory had “shifted over the course of time in this case.” The court stated that the case was “unusual” because in a contract action, the relevant breach is not usually “based on a tort or crime committed by one of the employees.” And it described the case as “a tort case at heart trying very, very hard to be a contract case.” The court concluded that Civil Pattern Jury Instruction 23.10 “is applicable in this case where . . . the jury is being asked to decide . . . whether Providence should be held responsible for the conduct of Ms. Laulu.” Therefore the court gave the disputed instruction (Instruction 22), which was modeled on Civil Pattern Jury Instruction 23.10, to the jury. After trial the jury returned a verdict for Providence. The first question on the special verdict form asked: “Was Stacy Laulu acting within the course and scope of her employment or agency when the disclosure occurred so that defendant Providence Alaska Medical Center is legally responsible for any damages caused by the disclosure?” The jury answered: “No.” It did not reach any of the other questions on the verdict form. After the jury left, Guy’s counsel moved for a judgment notwithstanding the verdict, arguing that the jury instructions had improperly stated the law. The court denied the motion. The court later issued a final judgment reflecting the jury verdict. Guy appeals. III. STANDARD OF REVIEW “We review jury instructions de novo when a timely objection is made.”4 “A jury instruction containing an erroneous statement of law constitutes reversible error if it prejudiced one of the parties; prejudice exists ‘if it can be said that the verdict may

4 Cummins, Inc. v. Nelson, 115 P.3d 536, 541 (Alaska 2005).

-8- 7578

have been different had the erroneous instruction not been given.’ ”5 “As a type of jury instruction, a special verdict form is subject to the same standard of review as other jury instructions.”6 IV. DISCUSSION A. The Jury Instructions Were Erroneous. There is much truth to the superior court’s observation that this case is “a tort case at heart trying very, very hard to be a contract case.” Stacy Laulu wrongly disclosed confidential information about Guy to his assailants, allegedly causing Guy injury. Guy argues that Providence, Laulu’s employer, should be held liable for this injury. Courts in other jurisdictions have recognized that unauthorized disclosure of confidential health information gives rise to a cause of action in tort.7 But perhaps because this lawsuit was not filed within the two-year limitations period applicable to tort claims,8 it was pled as a breach of contract claim.9

5 Barrett v. Era Aviation, Inc., 996 P.2d 101, 103 (Alaska 2000) (quoting Beck v. State, Dep’t of Transp. & Pub. Facilities, 837 P.2d 105, 114 (Alaska 1992)). 6 Manes v. Coats, 941 P.2d 120, 125 n.5 (Alaska 1997). 7 See, e.g., R.K. v. St. Mary’s Med. Ctr., Inc., 735 S.E.2d 715, 724 (W.Va. 2012) (holding HIPAA does not preempt state law causes of action for wrongful disclosure of health care information); Sheldon v. Kettering Health Network, 40 N.E.3d 661, 672 (Ohio App. 2015) (holding HIPAA does not preempt an independent tort claim for disclosure of private medical information by a physician or hospital); Walgreen Co. v. Hinchy, 21 N.E.3d 99, 104 (Ind. App. 2014) (affirming a jury verdict against a pharmacy for disclosing private information in a patient’s prescription records), aff’d on reh’g Walgreen Co. v. Hinchy, 25 N.E.3d 748 (Ind. App. 2015). 8 AS 09.10.070. 9 AS 09.10.053 (providing three-year statute of limitations on contract claims).

-9- 7578

It must therefore be tried as a breach of contract claim. Jurors were instructed to decide Providence’s liability by applying a principle of agency law commonly used in tort claims to determine vicarious liability: whether Laulu was acting in the course and scope of her employment when she disclosed Guy’s information to his assailant.10 But principles of agency law and vicarious liability do not apply to the question of whether a party to a contract may be liable for breaching its contractual obligations. A party to a contract is liable for breaching its contractual obligations even when the breach is caused by the party’s employee acting outside the scope of employment.11 Providence fails to cite a case holding that agency law applies to determining whether a contract was breached. It claims that “[f]or almost a century, Alaska courts have followed common law requiring principal liability for contract claims to be predicated on a principal’s authorization or ratification of an agent’s actions.” But the cases Providence cites do not apply agency principles to determine whether a

10 See, e.g., Lane v. City &Borough of Juneau, 421 P.3d 83, 94 (Alaska 2018) (“We have . . . followed the traditional rule that an employer is liable for the torts of an employee only ‘while the [employee] is acting in the scope of [their] employment.’ ” (alteration in original) (quoting Williams v. Alyeska Pipeline Serv. Co., 650 P.2d 343, 349 (Alaska 1982))); Taranto v. North Slope Borough, 909 P.2d 354, 358 (Alaska 1996) (“This court adopted the Restatement (Second) of Agency . . . rule that an employer will be held liable for both negligent and intentional torts of its employee, if the employee ‘is acting in the scope of [their] employment.’ ” (quoting Williams, 650 P.2d at 349)). 11 See RESTATEMENT (SECOND) OF CONTRACTS § 235(2) (AM. LAW. INST. 1981) (“When performance of a duty under a contract is due any non-performance is a breach.” (emphasis added)); cf. Webster v. S. Cal. First Nat’l Bank, 137 Cal. Rptr. 293, 297-98 (Cal. App. 1977) (promisor’s inability to perform contract due to court order obtained by third-party litigant against promisor does not excuse performance); 3 MARTIN D.CARR & ANN TAYLOR SCHWING, CALIFORNIA AFFIRMATIVE DEFENSES § 59:4 (2d ed.) (“Prevention by a stranger to the contract is not” a contract defense.).

-10- 7578

contracting party breached the terms of its contract. Instead, these cases apply agency principles only to determine whether an entity is bound by a contract. In Bendix Corp. v. Adams, the plaintiff sought to hold Bendix liable for breach of the plaintiff’s contract with Marine Advisors, a wholly-owned subsidiary of Bendix.12 The plaintiff argued that Marine was Bendix’s agent during negotiation and breach of the contract at issue.13 We disagreed, finding insufficient evidence of an agency relationship.14 Although we noted that Marine breached the contract at Bendix’s direction, this fact was “not . . . sufficient to establish that Marine was acting on behalf of Bendix at the time when the contract was formed” and therefore “would not make Bendix a party to the . . . contract on an agency theory so as to be liable for a breach of that contract.”15 In a footnote, we noted the possibility that Bendix subsequently ratified Marine’s contract but stated such a finding would depend on showing “that Marine initially entered into the contract for the benefit of Bendix even if at the time Marine did not have the requisite authority from Bendix.”16 Our decision that Bendix was not liable therefore turned on the conclusion that Bendix was not a party to the contract; our focus on whether Marine was “acting on behalf of” or “for the benefit of” Bendix pertained to whether Marine’s actions bound Bendix to the contract. The decision does not suggest that when a party is bound, agency principles are relevant to determine whether it has breached its contractual obligations.

12 610 P.2d 24, 25-26, 32-33 (Alaska 1980). 13 Id. 14 Id. at 33. 15 Id. 16 Id. at 33 n.19.

-11- 7578

Sea Lion Corp. v. Air Logistics of Alaska, Inc. is equally off-point.17 In that case, we held that Sea Lion was liable as a direct signatory to a contract because Sea Lion’s board knew that Sea Lion’s president had signed the document, knew that the signature exposed Sea Lion to the risk of liability, and “said nothing tending to disavow the effect of [the president’s] signature.”18 Like Bendix, Sea Lion shows that a principal must authorize or ratify a contract made by an agent in order to be bound to a contract and therefore liable for breaching it. But it does not show that when a principal is indeed bound by a contract, the principal’s failure to perform contractual obligations is excused if the failure results from the actions of an agent acting outside the scope of authority. When deciding whether a party has breached the contract (rather than whether a party is bound by the contract), it is necessary to focus on the terms of the contract rather than on who or what caused the breach. In other words, we focus on the duties of the principal (which are spelled out in the contract) rather than the duties of the agent. This distinction reflects a major difference between contract and tort liability.19 In the tort context, vicarious liability entails holding the principal liable for a breach of someone else’s duty of care towards the injured party, such as when a business is vicariously liable for a delivery driver’s breach of the driver’s own duty to use care when driving. The test for vicarious liability, based on whether the agent was

17 787 P.2d 109 (Alaska 1990). 18 Id. at 116-19. 19 Of course, the terms of the contract themselves may specify that the identity of the person or thing that caused the failure to perform is material to determining whether the party has breached the contract.

-12- 7578

acting in the course and scope of employment, serves to determine whether it is fair to hold the employer liable for the employee’s breach of the employee’s duty.20 A contract claim, on the other hand, is based on the asserted breach of the principal’s duty to satisfy obligations the principal has agreed to. The rationale for the agency principles underlying Providence’s proposed jury instruction — to determine whether it is fair to hold the defendant liable for the breach of another person’s duty21 — has less force when the plaintiff seeks to hold the defendant liable for breach of its own duty. That is especially true because parties to a contract have the opportunity (at least in theory) to determine the precise scope of their obligations and liabilities — unlike the parties in a tort case, who often do not have a preexisting contractual relationship. These differences explain why there are countless decisions applying agency principles to determine vicarious liability in tort, yet Providence has not cited any decisions in which

20 The general rule is that it is fair to hold an employer vicariously liable when the employee was acting for the benefit of the employer. See RESTATEMENT (SECOND) OF AGENCY § 219(1) (AM. LAW. INST. 1958) (“A master is subject to liability for the torts of his servants committed while acting in the scope of their employment.”); id. cmt. a (“[W]ith the growth of large enterprises, it became increasingly apparent that it would be unjust to permit an employer to gain from the intelligent cooperation of others without being responsible for the mistakes, the errors of judgment and the frailties of those working under his direction and for his benefit.”). 21 See Lane v. City & Borough of Juneau, 421 P.3d 83, 94 (Alaska 2018) (“Before holding an employer legally responsible for an employee’s conduct, a court must determine whether the employee’s conduct was ‘so connected to his employment as to justify requiring . . . the employer [to] bear [the plaintiff’s] loss.’ ” (alterations and omissions in original) (quoting Williams v. Alyeska Serv. Co., 650 P.2d 343, 349 (Alaska 1982))).

-13- 7578

a court has applied agency principles to excuse a party to a contract from liability for breaching its terms.22 This case does not concern whether someone was acting as another’s agent when entering into a contract, as in Bendix and Sea Lion, nor whether Providence is vicariously liable for torts committed by Laulu. Rather, the key issues are whether a contract between Guy and Providence existed and, if so, what terms, if any, such contract contained governing protection of patient health information. The superior court denied Providence’s motion for summary judgment, concluding there were “genuine issues of material fact as to the existence and terms of the contract for services entered between Mr. Guy and Providence and . . . [as to] whether the duty of good faith and fair dealing would be violated by the conceded unauthorized disclosure of private medical information.” Therefore the threshold issue in this case is the existence and terms of a contract between the parties. It is conceivable that such a contract did exist and contained terms obliging Providence to take steps to prevent disclosure of patient health information from disclosure by rogue employees like Laulu. If so, and if Providence breached those obligations, then the jury’s finding that Laulu was acting outside the scope of her employment would not necessarily excuse Providence from liability. Because Jury Instruction 22 permitted the jury to excuse Providence from liability without first deciding whether there was a contract between Providence and Guy and what such contract may have required of Providence, this instruction was error.

22 Providence suggested before the superior court that it is unfair to preclude a tort defense for what is seemingly a tort claim at heart, albeit presented as a contract claim. Whether fair or not, each claim for relief comes with its own advantages and disadvantages. For example, there is a longer limitations period for contract claims than for tort claims, but a party pursuing a contract claim has to prove elements that a party pursuing a tort claim does not: namely, the existence of a contract and its terms.

-14- 7578

B. The Erroneous Jury Instruction Prejudiced Guy Because He Presented Sufficient Evidence For A Jury To Find That The Disclosure Of His Health Information Caused Him Injury. Providence claims that Jury Instruction 22 did not constitute reversible error because the verdict would have been the same even if the instruction had not been given.23 It argues that Guy presented too little evidence of injury resulting from the disclosure of his information for the jury to find any damages. We disagree and conclude that the erroneous jury instruction warrants reversing the judgment. Guy presented evidence in the form of his own testimony, explaining that he had “paranoia” about health care providers as a result of his experience at Providence. Had the unauthorized disclosure not occurred, Guy testified that his mental health “would probably be a little bit more . . . well-balanced or not so sketchy.” Guy testified that he had not applied for Medicaid since the incident, which “stemmed from [Guy] not trusting” that his medical information would not be “given out” as it was at Providence. From this testimony, a reasonable jury could have found that Guy experienced damages caused by Laulu’s disclosure. Providence argues that Guy did not offer any evidence that the hospital was aware of or authorized Laulu’s conduct. But as discussed above, there was no need for Guy to present any evidence that Providence ratified Laulu’s disclosure; Jury Instruction 22 was improper precisely because this is not a relevant issue in a breach of contract case. Nor is it the case, as Providence argues, that the evidence Guy presented was “wholly contrary” to a finding of damages. Providence points to evidence presented

23 See Barrett v. Era Aviation, Inc., 996 P.2d 101, 103 (Alaska 2000) (“A jury instruction containing an erroneous statement of law constitutes reversible error if it prejudiced one of the parties; prejudice exists ‘if it can be said that the verdict may have been different had the erroneous instruction not been given.’ ” (quoting Beck v. State, Dep’t of Transp. & Pub. Facilities, 837 P.2d 105, 114 (Alaska 1992))).

-15- 7578

at trial that Providence took immediate remedial actions once it found out about the HIPAA violation, including contacting Guy to inform him of the breach and offering further assistance. But Guy did not claim that Providence injured him by failing to follow its remedial HIPAA protocol. Rather he claimed, and presented evidence intended to show, that Providence injured him when Laulu revealed his medical information to Guy’s assailant. Guy’s recovery is not precluded by his testimony that he had not seen the text messages between Laulu and the assailant. Providence claims that because Guy was not aware of what the text messages relayed, he could not have shown that Laulu’s disclosure caused damage to him. Providence suggested at trial that Laulu’s text messages might have relayed only that Guy was in the hospital — a fact the assailant already knew. But Guy was in the hospital after being assaulted and tortured, and Laulu furnished information about Guy to his assailant. A jury could reasonably have found that Guy experienced fear, distress, and anxiety knowing that his information was shared with his attackers, even if that information was limited in scope. Similarly unpersuasive is Providence’s claim that Guy failed to identify reasonably certain damages caused by Laulu’s disclosure because Guy “admitted that he could not differentiate between the trauma arising from the disclosure versus the significant torture that caused him to seek medical treatment to begin with.” Providence cites to a portion of the trial at which Guy’s counsel asked him if there was “some way” he could “explain the difference” between the trauma he experienced from the assault and the trauma he experienced from Laulu’s disclosure. Guy replied: Not really. They’re both like the same because, like, it was just — I was helpless. There was nothing I could do when the assault was going on. I could — there was absolutely nothing I could do. I was helpless. And when I was at

-16- 7578

Providence laid up in the bed, you know, after surgery and at their disposal, there’s nothing I can do. Fairly read, Guy’s testimony indicates that both experiences made him feel helpless, not that the two experiences were indistinguishable. And at other points in his testimony Guy clearly attributed specific harm to the disclosure, including “paranoia” and “conspiracy issues”; a mental condition that was less balanced and caused him to be less “at ease” than before the disclosure; and a decision to not apply for Medicaid since his information was revealed because of the resulting distrust. Finally it is not the case, as Providence argues, that Guy’s attempt to recover damages for future therapy was doomed by his failure to obtain mental health treatment since the assault. Guy testified that he had contacted multiple therapists and even met with one, but the meeting was unsuccessful because the disclosure had impaired his ability to trust. Guy also testified about his desire to see a therapist in the future. And although true that Guy had not applied for Medicaid in order to facilitate mental health treatment, Guy testified that the reason he had not applied for Medicaid was that his experience with Providence made him wary of sharing his medical information. A jury might conclude that Guy did not need money for psychiatric care because he did not have a history of receiving such care. But it could also conclude that Guy did not obtain this care at least in part because of the paranoia and mistrust caused by Providence, and that Guy should not be penalized for suffering from the very paranoia and mistrust for which he now seeks redress. Finally, even if a jury concluded that Guy did not need damages for future therapy, it could still conclude that he needed damages for home security and an identity theft prevention system, as he requested at trial.

-17- 7578

Considering the evidence from the perspective of the jury,24 the inclusion of Jury Instruction 22 prejudiced Guy. Guy testified that the disclosure had caused him feelings of fear and paranoia and affected his ability to heal from the 2013 assault. This evidence was not so one-sided that this court can assume that, had the jury reached the issue of damages, it would have awarded Guy nothing. Because “the jury may have returned a different verdict” if it had been properly instructed,25 we must reverse. C. We Remand For Further Proceedings On This Breach Of Contract Action. We remand for determination of the duties Providence owed to Guy. In order to prevail in a breach of contract action, the plaintiff “must show that the defendant had a duty to perform and that the defendant failed to perform as agreed in the contract.”26 It is undisputed that Laulu, a Providence employee, revealed Guy’s health information, and that this action violated HIPAA. The question on remand is whether this conduct violated any contractual duty that Providence owed to Guy. The superior court denied summary judgment because there were “genuine issues of material fact as to the existence and terms of the contract for services entered between Mr. Guy and Providence and, further, whether the duty of good faith and fair dealing would be violated by the conceded unauthorized disclosure of private medical information.”

24 Zamarello v. Reges, 321 P.3d 387, 392 (Alaska 2014) (“We evaluate whether any error was prejudicial by putting ourselves in the position of the jurors and determining whether the error probably affected their judgment.” (quoting Henrichs v. Chugach Alaska Corp., 250 P.3d 531, 535 (Alaska 2011))). 25 Parnell v. Peak Oilfield Serv. Co., 174 P.3d 757, 765 (Alaska 2007), reh’g Jan. 29, 2008. 26 Alaska Pattern Jury Instructions — Civ. 24.03 Cmt. (citing 5A A. CORBIN, CORBIN ON CONTRACTS § 1228 (1963) and 11 S. WILLISTON, A TREATISE ON THE LAW OF CONTRACTS § 1290 (3d ed. 1968)).

-18- 7578

These are the threshold issues that must be resolved by briefing and, if necessary, trial on remand. V. CONCLUSION We REVERSE the judgment of the superior court and REMAND for further proceedings consistent with this opinion.

-19- 7578