John DOE, Plaintiff-Appellant, v. GUTHRIE CLINIC, LTD., Guthrie Health, Guthrie Healthcare System, Guthrie Health Plan, Inc., Guthrie Clinic Inc., Guthrie Clinic, A Professional Corporation, Guthrie Clinics Group Practice Partnership, L.L.P., Guthrie Medical Group, P.C., Guthrie Enterprises Twin Tier Management Corporation, Defendants-Appellees, 710 F.3d 492

LOHIER, Circuit Judge: Plaintiff-Appellant John Doe appeals from a judgment of the United States District Court for the Western District of New York (Telesca, J.) dismissing his complaint against various Pennsylvania-based entities (the “Guthrie Defendants”) that Doe alleges own Guthrie Clinic Steuben (the “Clinic”), a healthcare facility in Corning, New York.

Doe’s appeal principally requires us to consider whether the unauthorized disclosure of confidential medical information by a medical corporation’s employee gives a plaintiff a right of action for breach of a fiduciary duty under New York law that runs directly against the corporation, even when the corporation’s employee acted outside the scope of her employment and is not the plaintiffs treating physician.

The New York courts are virtually silent about the ability of a plaintiff to sue a medical corporation directly for a non-physician employee’s ultra vires disclosure of the plaintiffs confidential medical information. One decision by a divided panel of the Appellate Division, Third Department, appears to have recognized such a cause of action. We hesitate to rely on it exclusively, however, because we are mindful that direct corporate liability generally rests on the doctrine of respondeat superior and is not implicated by the ultra vires acts of employees.

Absent a precedential decision from the New York Court of Appeals on this point in the context of the unauthorized disclosure of medical information, we are reluctant to permit, or foreclose, such a cause of action.

As we explain more fully below, therefore, Doe’s appeal of the District Court’s dismissal of his claim for breach of fiduciary duty presents a question that has not been resolved by the New York Court of Appeals, that implicates significant New York state interests in the disclosure of confidential medical information and in the liability of New York-based medical facilities, and that is determinative of this appeal.

Accordingly, we defer decision and certify the following question to the New York Court of Appeals: Whether, under New York law, the common law right of action for breach of the fiduciary duty of confidentiality for the unauthorized disclosure of medical information may run directly against medical corporations, even when the employee responsible for the breach is not a physician and acts outside the scope of her employment? We dispose of Doe’s remaining claims on appeal in a separate

summary order filed simultaneously with this opinion. BACKGROUND Doe’s claims arise from an incident at the Clinic on July 1, 2010. Doe was at the Clinic to be treated for a sexually transmitted disease (“STD”). Magan Stalbird, a nurse, worked at the Clinic. Stalbird was the sister-in-law of Doe’s girlfriend, Jessica. While Doe was at the Clinic, and for reasons having nothing to do with Doe’s care, Stalbird sent six text messages to Jessica. All six messages discussed Doe’s STD and medical condition. After Doe learned about the messages and complained to the Clinic, the Clinic fired Stalbird.

Less than two weeks after the incident, the Clinic sent Doe a letter confirming that his confidential information had been improperly accessed and disclosed, and stating that appropriate disciplinary action had been taken. Doe filed this diversity action against various affiliated entities that he alleges own and operate the Clinic.

In the complaint he asserted causes of action for (1) common law breach of fiduciary duty to maintain the confidentiality of personal health information, (2) breach of contract, (3) negligent hiring, training, retention and/or supervision of employees, (4) negligent infliction of emotional distress, (5) intentional infliction of emotional distress, (6) breach of duty to maintain the confidentiality of personal health information under New York C.P.L.R. § 4504, (7) breach of duty to maintain the confidentiality of personal health information under New York Public Health Law § 4410, and (8) breach of duty to maintain the confidentiality of personal health information under New York Public Health Law § 2803-c.

The District Court granted the Guthrie Defendants’ motion to dismiss all eight claims under Rule 12(b)(6) of the Federal Rules of Civil Procedure. Doe appeals the dismissal of the claims for breach of fiduciary duty, breach of contract, negligent hiring, training, retention and/or supervision of employees, negligent infliction of emotional distress, and intentional infliction of emotional distress. In this opinion, we address only the first claim, for common law breach of the fiduciary duty of confidentiality.

DISCUSSION We review the District Court’s dismissal of a complaint pursuant to Rule 12(b)(6) de novo, Marsh v. Rosenbloom, 499 F.3d 165, 172 (2d Cir.2007), accepting all the factual allegations in the complaint as true and drawing all reasonable inferences in favor of the plaintiff. Metz v. U.S. Life Ins. Co. in City of New York, 662 F.3d 600, 602 (2d Cir.2011).

Most of Doe’s tort claims are premised on the Guthrie Defendants’ liability for Stalbird’s actions under the doctrine of respondeat superior Under New York common law, an employer is liable for the actions of an employee if her actions were foreseeable and if she acted within the scope of her employment. Horvath v. L & B Gardens, Inc., 89 A.D.3d 803, 932 N.Y.S.2d 184, 185 (2d Dep’t 2011). An employee’s conduct ordinarily cannot be attributed to the employer, however, if it was motivated solely by personal reasons “unrelated to the furtherance of the employer’s business.” Id. (quotation marks omitted).

There is nothing in Doe’s complaint to indicate that Stalbird’s actions were foreseeable to the Guthrie Defendants, or that her actions were taken within the scope of her employment. To the contrary, the complaint alleges that Stalbird was motivated by purely personal reasons to text confidential information about Doe to her sister-in-law. Those reasons had “nothing to do with [Doe’s] treat- meat and care.” (Compl. ¶ 25). As such, Stalbird’s actions cannot be imputed to the defendants on the basis of respondeat superior. Nevertheless, citing Doe v.

Cmty Health Plan-Kaiser Corp., 268 A.D.2d 183, 709 N.Y.S.2d 215 (3d Dep’t 2000), Doe argues that medical corporations are separately and strictly liable under New York law for breaching their fiduciary duty to keep personal health information confidential. In Doe, a medical records clerk disclosed information about treatment the plaintiff had received from a psychiatric social worker.

The Appellate Division, Third Department, held that the medical corporation could be held liable for the breach by its employee because “[t]o hold otherwise would render meaningless the imposition of such a duty on a medical corporation, since the wrongful disclosure of confidential information would never be within the scope of the employment of its employees.” Id. at 218. A specific common law cause of action against a physician who improperly discloses confidential medical information is well established in New York. See Burton v.

Matteliano, [81 A.D.3d 1272] 916 N.Y.S.2d 438, 440 (4th Dep’t 2011) (citing Tighe v. Ginsberg, [146 A.D.2d 268] 540 N.Y.S.2d 99, 100 (4th Dep’t 1989)). But the Third Department in Doe appears to have expanded that cause of action to include a direct right of action against a medical corporation for breach of medical confidentiality by a non-physician employee. See 709 N.Y.S.2d at 217-18. The Doe court based its expansion on the theory that “a medical corporation ... can only act through its agents, servants or employees.

Consequently, the duty owed plaintiff by [the medical corporation] to protect patient confidences, if breached, makes [the medical corporation] directly responsible.” Id. at 218.

In doing so, the Third Department focused on New York common law’s recognition of a physician’s fiduciary duty of confidentiality as well as on specific New York statutes that, without providing a private right of action, govern the disclosure of medical information by medical corporations and that generally “define and impose the scope of the actionable duty of confidentiality which arises between certain health care providers ... and their patients.” Id. at 217-18. The broad theory of medical corporate tort liability announced in Doe is subject to question.

Indeed, two justices dissented from the majority’s decision, which cited no statutory authority or caselaw to support its analysis. See id. at 218-19 (Mercure, J., concurring in part and dissenting in part). As the District Court noted in the instant case, moreover, a corporation can be held liable for improper disclosure by an employee where the employee acts within the scope of her employment — for example, by disclosing information to another medical provider — without the patient’s consent. Doe v. Guthrie Clinic, Ltd., No. 11 Civ. 6089, 2012 WL 531026, at *5 (W.D.N.Y. Feb. 17, 2012); see also Randi A.J. v.

Long Island Surgi-Center, 46 A.D.3d 74, 842 N.Y.S.2d 558, 562 (2d Dep’t 2007) (medical clinic conceded liability for nurse’s unilateral disclosure of confidential information to patient’s mother during routine follow-up telephone call). The Third Department’s holding in Doe remains the only relevant signpost on the question that confronts us, namely, whether, under New York law, the common law right of action for breach of medical confidentiality runs directly against medical corporations, even when the employee responsible for the breach is not a physician and acts outside the scope of her employment.

The only other Appellate Division decision to address the issue did so summarily. See Romanello v. Intesa Sanpaolo S.p.A., 97 A.D.3d 449, 949 N.Y.S.2d 345, 352 (1st Dep’t 2012). There, the lawsuit was against the plaintiffs employer, not against a medical corporation. It is true that in a case decided after the Third Department’s decision in Doe, the New York Court of Appeals declined to impose liability on a medical corporation for the unauthorized actions of its employee, a physician, who sexually assaulted a patient in the hospital. See N.X. v. Cabrini Med.

Ctr., 97 N.Y.2d 247, 739 N.Y.S.2d 348, 765 N.E.2d 844, 847 (2002) (Wesley, J.). But it is not clear that Cabrini was intended to apply to Doe’s more specific breach of fiduciary duty claim relating to confidential medical information. Although it involved a more egregious act (a sexual assault, not an unauthorized disclosure of confidential medical information), Cabrini, as we read it, addressed the applicability of the traditional doctrine of re-spondeat superior to a physician’s intentional tort.

It did not address an action for breach of fiduciary duty arising out of the unauthorized disclosure of confidential medical information. It is that specific and legally distinct cause of action that Doe held may be asserted directly against a medical corporation, even when respon-deat superior liability is absent, and that the plaintiff asserts directly against the Guthrie Defendants in the instant case.

CERTIFICATION Second Circuit Local Rule 27.2 permits us to certify to the New York Court of Appeals “determinative questions of New York law [that] are involved in a case pending before [us] for which no controlling precedent of the Court of Appeals exists.” N.Y. Comp.Codes R. & Regs. tit. 22, § 500.27(a); see also N.Y. Const. Art. 6, § 3(b)(9). “In deciding whether to certify a question, we consider: (1) the absence of authoritative state court

interpretations of [the law in question]; (2) the importance of the issue to the state, and whether the question implicates issues of state public policy; and (3) the capacity of certification to resolve the litigation.” Georgitsi Realty, LLC v. Penn-Star Ins. Co., 702 F.3d 152, 158 (2d Cir.2012) (quotation marks omitted). Here, each factor favors certification. First, as we have explained, existing state caselaw on the question we have identified for certification is extremely sparse. See Barenboim v. Starbucks Corp., 698 F.3d 104, 117 (2d Cir.2012).

Based on the three New York state decisions discussed above, we cannot predict with confidence how the New York State Court of Appeals “would rule on this legal question.” Michalski v. Home Depot, Inc., 225 F.3d 113, 116 (2d Cir.2000); see Casey v. Merck & Co., Inc., 653 F.3d 95, 100-101 (2d Cir.2011); Elliott Assocs., L.P. v. Banco de la Nacion, 194 F.3d 363, 370 (2d Cir.1999); see also West v. AT & T, 311 U.S. 223, 236, 61 S.Ct. 179, 85 L.Ed. 139 (1940) (“[A] federal court is not free to reject the state rule merely because it has not received the sanction of the highest state court.”).

Of course, we appreciate the possibility that the New York Court of Appeals may confidently conclude that Cabrini determines the outcome in this case. Second, the question identified for certification presents “important issues of New York law and policy.” Barenboim, 698 F.3d at 117. Medical privacy and the confidentiality of medical records are of concern to New York.

As the majority in Doe pointed out, a number of New York state statutes govern the disclosure of personal health information, and how to regulate New York-based health care providers in this area is generally best left to the sound value judgments of New York’s courts and legislature. Finally, having disposed of Doe’s other claims in a separate

summary order, we think the resolution of the only remaining “unsettled and important issue of state law will” likely “determine the outcome of this appeal.” Georgitsi, 702 F.3d at 159. If the New York Court of Appeals determines that a medical corporation cannot be held directly liable under the circumstances presented, that will end the litigation. If, on the other hand, the New York Court of Appeals holds that a medical corporation may be held liable for the unauthorized, ultra vires disclosure of confidential information by a non-physician employee, then we would, vacate the judgment of the District Court and remand for further proceedings — that is, either

summary judgment or trial. CONCLUSION For the foregoing reasons, we certify the following question to the New York Court of Appeals: Whether, under New York law, the common law right of action for breach of the fiduciary duty of confidentiality for the unauthorized disclosure of medical information may run directly against medical corporations, even when the employee responsible for the breach is not a physician and acts outside the scope of her employment? In certifying this question, we understand that the New York Court of Appeals may reformulate or expand the certified question as it deems appropriate.

It is hereby ORDERED that the Clerk of the Court transmit to the Clerk of the New York Court of Appeals a certificate in the form attached, together with a copy of this opinion and a complete set of briefs, appendices, and the record filed by the parties in this Court. This panel will retain jurisdiction to decide the case once we have had the benefit of the views of the New York Court of Appeals or once that court declines to accept certification. Finally, we order the parties to bear equally any fees and costs that may be requested by the New York Court of Appeals. Decision is RESERVED.

CERTIFICATE The foregoing is hereby certified to the Court of Appeals of the State of New York pursuant to 2d Cir. L.R. 27.2 and N.Y. Comp.Codes R. & Regs. tit. 22, § 500.27(a), as ordered by the United States Court of Appeals for the Second Circuit. . Presumably to preserve diversity of citizenship, Doe did not name the Clinic as a defendant. . The Guthrie Defendants deny that Stalbird was employed by any of them, apparently on the theory that the Clinic is an independent entity not sued as a defendant herein.

For purposes of this appeal, we assume, based on the record evidence of a letter sent to Doe by the Defendant-Appellee Guthrie Clinic, Ltd., that an employment relationship existed between that Defendant (and perhaps other Defendants-Appellees as well) and Stalbird. .

See id. at 217 ("Although the statutes and regulations requiring physicians (and medical corporations) to protect the confidentiality of patient information gained during the course of treatment clearly express the State’s public policy, they do not constitute a basis upon which plaintiff may maintain a cause of action against [the medical corporation] since a private right of action springing from such statutes has not been recognized.”). Cf. Lightman v.

Flaum, 97 N.Y.2d 128, 736 N.Y.S.2d 300, 761 N.E.2d 1027, 1032 (2001) (statutory privileges are "not the sources of the underlying duties” of confidentiality and "do[] not establish the parameters of those fiduciary relationships”).