## Facts

- Elizabeth Lawson drove herself to a hospital emergency department after lacerating her arm.
- Hospital staff detected a heavy odor of alcohol and performed an alco-sensor test showing a blood-alcohol level of 0.215.
- After treatment, Lawson was cleared for discharge and stated she intended to drive herself home despite having no alternate transportation.
- A police officer was present in the emergency department on unrelated business.
- A charge nurse told the officer that Lawson had driven to the hospital, was intoxicated, and intended to drive home.
- The officer arrested Lawson on suspicion of DUI; the criminal charge was later dismissed.
- Lawson sued the hospital, alleging negligent disclosure of confidential medical information and negligence in policies and training regarding patient confidentiality.
- The nurse was dismissed from the case; the claim proceeded against the medical center, which obtained summary judgment.

## Issues

1. Whether Vermont common law recognizes a private right of action for damages based on a medical provider’s unjustified disclosure to third parties of information obtained during treatment.
2. If such a claim exists, whether summary judgment was proper because the undisputed facts showed the disclosure was justified as a good-faith effort to prevent serious and imminent harm.

## Decision

- The Vermont Supreme Court recognized a common-law private right of action for damages based on a medical provider’s unjustified disclosure of treatment-derived information to third persons.
- The Court affirmed summary judgment for the medical center because no reasonable factfinder could conclude the disclosure was for any purpose other than mitigating an imminent and serious threat to the patient and the public.
- The Court treated HIPAA’s “serious and imminent threat” provision as guidance for defining the common-law duty and its safety-based exception.
- Applying a subjective good-faith standard, the Court found no evidence permitting an inference of improper motive.

## Legal Principles

- Medical providers owe patients a common-law duty of confidentiality regarding information obtained in the course of treatment, enforceable through a private damages action for unjustified disclosure.
- HIPAA does not create a private right of action, but its regulations may inform the standard of care and recognized exceptions to confidentiality under state common law.
- A disclosure is justified, and therefore privileged from civil liability, when made to prevent or lessen a serious and imminent threat to health or safety and made in subjective good faith.
- Under the subjective good-faith test, the focus is on the provider’s actual belief that disclosure was necessary to prevent serious harm; absent evidence of an improper purpose, the privilege supports judgment as a matter of law.

## Conclusion

Vermont recognized a tort remedy for unjustified disclosure of medical information but held that, on undisputed facts showing a provider’s subjective good-faith safety concern about imminent serious harm, the disclosure is privileged and summary judgment for the provider is proper.


Lawson v. Halpern-Reiss, 212 A.3d 1213 (Vt. 2019)