PHETERSON SPATORICO LLP, ROCHESTER (STEVEN A. LUCIA OF COUNSEL), FOR PLAINTIFFS-APPELLANTS.

BOND, SCHOENECK & KING PLLC, ROCHESTER (CLAIRE G. BOPP OF COUNSEL), FOR DEFENDANTS-RESPONDENTS.

Appeal from an order of the Supreme Court, Monroe County (Elena F. Cariola, J.), entered October 18, 2023. The order, insofar as appealed from, granted the motion of defendants Rochester Regional Health ACO, Inc., and Greater Rochester Independent Practice Association, Inc. to dismiss the complaint against them.

It is hereby ORDERED that the order so appealed from is unanimously modified on the law by denying the motion in part and reinstating the negligence claim against defendants Rochester Regional Health ACO, Inc. and Greater Rochester Independent Practice Association, Inc., and as modified the order is affirmed without costs.

Memorandum: Plaintiffs commenced this action alleging that, attendant to the health care services they received from defendant Rochester General Hospital (RGH), confidential medical records were generated and that those confidential medical records were stored on computer systems and networks maintained by RGH and defendants Rochester Regional Health ACO, Inc. (RRH) and Greater Rochester Independent Practice Association, Inc. (GRIPA). Plaintiffs further allege that defendant Christine M. Smith, R.N., a nurse at RGH, impermissibly accessed those records due to the failure of RGH, RRH and GRIPA "to exercise reasonable care in obtaining, retaining, securing, safeguarding, and protecting this confidential medical information from unlawful access." On appeal, plaintiffs contend that Supreme Court erred in granting the motion of RRH and GRIPA (hereafter, defendants) to dismiss the complaint against them on the grounds of documentary evidence and failure to state a cause of action (see CPLR 3211 [a] [1], [7]). We agree with plaintiffs in part.

On a motion to dismiss, a court must accept the plaintiff's allegations as true and determine whether they fit into any cognizable legal theory (see Lawrence v Graubard Miller, 11 NY3d 588, 595 [2008]; Matter of Machado v Tanoury, 142 AD3d 1322, 1323 [4th Dept 2016]). Affidavits submitted by a plaintiff may also be considered to remedy any defects in the complaint (see Leon v Martinez, 84 NY2d 83, 88 [1994]). Affidavits submitted by the defendant, however, rarely warrant dismissal of the complaint unless they conclusively establish that the plaintiff has no cause of action (see Rovello v Orofino Realty Co., 40 NY2d 633, 636 [1976]; see generally Koike Aronson, Inc. v Bearing Distribs., Inc., 208 AD3d 956, 957 [4th Dept 2022]).

"A medical corporation may . . . be liable in tort for failing to establish adequate policies and procedures to safeguard the confidentiality of patient information or to train their employees to properly discharge their duties under those policies and procedures. These potential claims [*2]provide the requisite incentive for medical providers to put in place appropriate safeguards to ensure protection of a patient's confidential information" (Doe v Guthrie Clinic, Ltd., 22 NY3d 480, 485 [2014]). Here, plaintiffs alleged that defendants generated and maintained the medical records that Smith impermissibly accessed and that they breached their duty to properly safeguard or monitor access to those records. Accepting as true the allegations in the complaint and the averments in the affidavits submitted in opposition to the motion, we conclude that plaintiffs have sufficiently alleged a negligence claim. We therefore conclude that the court erred in granting the motion with respect to the negligence claim against defendants, and we modify the order accordingly.

However, given that such a claim "gives rise to a cause of action sounding in tort" and not in breach of an implied contract (MacDonald v Clinger, 84 AD2d 482, 482 [4th Dept 1982]), we conclude that the court properly granted the motion with respect to the implied contract claim against defendants.

Entered: March 21, 2025

Ann Dillon Flynn

Clerk of the Court