FLORIDA DEPARTMENT OF CORRECTIONS, Petitioner, v. Lisa M. ABRIL, et vir., Respondents, 969 So. 2d 201

PER CURIAM. This case is before the Court pursuant to a certified question of great public importance from the Second District Court of Appeal. We have jurisdiction. Art. V, § 3(b)(4), Fla. Const. The appellee, Lisa M. Abril, sought damages based upon negligence in the unauthorized disclosure of the results of her HIV testing. Abril v. Dep’t of Corr., 884 So.2d 206, 207-08 (Fla. 2d DCA 2004). The district court reversed the trial court’s dismissal of the case for failure to state a cause of action. Id. at 213.

In reinstating the case, the Second District certified the following question to this Court as one of great public importance: IS FLORIDA’S IMPACT RULE APPLICABLE IN A CASE IN WHICH IT IS ALLEGED THAT THE INFLICTION OF EMOTIONAL INJURIES HAS RESULTED FROM A CLINICAL LABORATORY’S BREACH OF A DUTY OF CONFIDENTIALITY UNDER

SECTION 381.004(3)®, FLORIDA STATUTES (SUPP.1996), WITH RESPECT TO HIV TEST INFORMATION? Id. While not approving all of the reasoning, we approve the district court’s ultimate decision, answer the certified question in the negative, and hold that an entity that negligently and unlawfully violates a patient’s right of confidentiality and privacy in disclosing the results of HIV testing of the patient may be held responsible in a civil negligence action for damages caused to the patient by the unlawful disclosure.

Proceedings to Date The prior proceedings were summarized by the district court in the opinion below: The amended complaint alleged that Mrs. Abril, in the course of her employment with the department as a senior licensed practical nurse at the Hendry County Correctional Institution [ (HCCI) ], had given unprotected mouth-to-mouth resuscitation to an inmate. After it was determined that the inmate was infected with hepatitis C and that it was unknown whether the inmate was infected with HIV, Mrs.

Abril unsuccessfully sought testing for hepatitis and HIV through the department’s workers’ compensation carrier, which declined to authorize the testing because it determined that the resuscitation did not expose her to a risk of infection. Subsequently, the institution’s chief medical officer submitted a blood sample from Mrs. Abril to Continental Laboratory, a laboratory under contract with the State of Florida to provide clinical laboratory services for inmates for HIV testing.

The complaint further alleged that a document indicating that the test results for HIV were positive was faxed to an unsecured fax machine in the institution’s business office and to another fax machine in Tallahassee at the [Department of Corrections’] offices of Chief Health Services, despite Continental Laboratory’s assurances set forth in a prior fax to a “confidentially-secured” fax machine in the institution’s medical office that the results of the test were confidential and would be hand delivered.

It was alleged that the faxes with the test results were sent in response to a request for the information from a department employee who was concerned that the use of Continental Laboratory for the testing of Mrs. Abril’s blood might not have been authorized. The complaint also alleged that a number of persons employed by the department, who were not authorized by law to know of the test results, became aware of the test results through Continental Laboratory’s transmission of the results to the fax machines.

It was ultimately determined through testing, paid for by the workers’ compensation carrier, that Continental Laboratory’s HIV test on Mrs. Abril’s blood had produced a false positive and that Mrs. Abril had not in fact contracted HIV. Id. at 207. The Abrils subsequently filed a civil action, seeking damages, in part, for the mental anguish and emotional distress suffered by Ms.

Abril arising from Continental’s negligent failure to ensure the confidentiality and privacy of the HIV test results and the subsequent negligence of Continental and the Department of Corrections in causing the test results to be improperly disseminated to others. Id. at 207-08. Upon appeal of a trial court order dismissing the Abrils’ action, the Second District, in a unanimous decision explained in an opinion by Judge Canady, reversed the trial court, analogizing the case to that of Gracey v.

Eaker, 837 So.2d 348 (Fla.2002), in which this Court recently concluded that a civil action for damages arose from the breach by a psychotherapist of a statutory duty of confidentiality and privacy. Abril, 884 So.2d at 211-13. As in Gracey, the district court found that a statute, in this case

section 381.004(3)(f), Florida Statutes (Supp.1996), supported the recognition of a cause of action for negligence based upon the alleged breach of a duty of confidentiality on the part of the health care providers who conducted Ms. Abril’s HIV test. Id. at 212. Further, as in Gracey, the Second District concluded that the impact rule should not apply to bar such a claim even where no actual physical contact or injury was alleged. Id. at 212-13. We approve the district court’s decision reinstating the negligence cause of action.

Analysis This Court and other appellate courts review decisions resolving motions to dismiss under a de novo standard where those motions are based on a claim that no legal cause of action exists as alleged in the complaint. Siegle v. Progressive Consumers Ins. Co., 819 So.2d 732, 734 (Fla. 2002). Here, the amended complaint alleges an action based on the negligence of Continental Laboratories, charging the department with vicarious liability for this negligence under the agency provisions of

section 768.28(10)(a), pursuant to which the State has waived immunity for the actions of health care services provided by private persons at the request of the department. See Abril, 884 So.2d at 207-08. In their amended complaint, the Abrils alleged that Continental was negligent and that it “breached its professional duty [to Ms.

Abril] by failing to provide that level of care, skill and treatment which, in light of all relevant surrounding circumstances is recognized as acceptable and appropriate by reasonably prudent similar health care providers.” Because of this breach, the Abrils allege they suffered mental anguish and emotional distress. Id. In arguing for reconsideration after the trial court granted the department’s motion to dismiss, the Abrils argued that their action was one for medical malpractice because of Continental’s negligence resulting in breach of its duty to maintain the confidentiality of the test results.

Thus, the Abrils essentially asserted a common law negligence claim against Continental utilizing the breach of the provisions of

section 381.004(3)(

f) as evidence of Continental’s negligence. DUTY To maintain an action for negligence, a plaintiff must establish that the defendant owed a duty, that the defendant breached that duty, and that this breach caused the plaintiff damages. See Clampitt v. D.J. Spencer Sales, 786 So.2d 570, 573 (Fla.2001). This Court has held that while breach, causation, and damages are ordinarily questions for the jury, “duty exists as a matter of law and is not a factual question for the jury to decide.” McCain v. Fla. Power Corp., 593 So.2d 500, 503 (Fla.1992). It is the existence of a duty on the part of Continental that is at issue in this case.

Section 381.004(3)(

f) The district court relied primarily upon the provisions of

section 381.004(3)(

f) as the source of a duty of confidentiality owed by Continental to Ms. Abril.

Section 381.004(3)(

f) provides: Except as provided in this section, the identity of any person upon whom a[n HIV] test has been performed and test results are confidential and exempt from the provisions of s. 119.07(1). No person who has obtained or has knowledge of a test result pursuant to this

section may disclose or be compelled to disclose the identity of any person upon whom a test is performed, or the results of such a test in a manner which permits identification of the subject of the test.... In rejecting the department’s argument that no duty to Ms. Abril existed, the district court explained: The complaint filed by the Abrils alleges facts that would be sufficient to establish that Continental Laboratory violated a duty imposed on it by

section 381.004 to maintain the confidentiality of HIV test results and to disclose those results only as authorized by law. The issue presented for resolution thus is not whether the complaint’s allegations are sufficient to establish the necessary elements of the existence of a duty and the breach of that duty. The dispositive question is whether the damages alleged — for mental anguish and emotional distress caused by Continental Laboratory’s breach of its duty — are cognizable under Florida law. The answer to this question depends on whether the impact rule is applicable to the claims at issue.

Abril, 884 So.2d at 209-10. Although the district court did not elaborate in great detail on its analysis, we conclude that the court was correct in its conclusion that the Abrils had properly alleged a cause of action for negligence. The courts of Florida have long recognized that the violation of a statute may be utilized as evidence of negligence. In Alford v.

Meyer, 201 So.2d 489 (Fla. 1st DCA 1967), the court explained: The rationale supporting the admission of a statute, ordinance, or administrative rule or regulation as prima facie evidence of negligence is that the standard of conduct or care embraced within such legislative or quasi-legislative measures represent a standard of at least reasonable care which should be adhered to in the performance of any given activity. Id. at 491; see also deJesus v. Seaboard Coast Line R.R. Co., 281 So.2d 198 (Fla. 1973).

Section 381.004(3)(f), at a minimum, creates a reasonable standard of care for handling HIV testing results, and Continental’s breach of this statute by the improper release of Abril’s results may be evidence that the laboratory acted negligently. The district court also noted that in addition to the explicit provisions for confidentiality of HIV testing under

section 381.004, health care laboratories are also governed by other provisions of the Florida Statutes, such as the Florida Clinical Laboratory Law in

section 483.181(2), Florida Statutes (1995), which explicitly mandates that “[t]he results of a test must be reported directly to the licensed practitioner or other authorized person who requested it.” Abril, 884 So.2d at 209 n. 1 (quoting

section 483.181(2)). Indeed, Florida has a long tradition of recognizing the privacy interests of patients in confidential medical records. See, e.g., State v. Johnson, 814 So.2d 390, 393 (Fla.2002) (“A patient’s medical records enjoy a confidential status by virtue of the right to privacy contained in the Florida Constitution, and any attempt on the part of the government to obtain such records must first meet constitutional muster.”). In addition to the specific provisions of

section 381.004 protecting HIV testing,

section 395.3025 of the Florida Statutes also expressly provides that a patient’s medical records are confidential and must not be disclosed without the consent of the patient. Thus, it is apparent that more than one Florida statute may have been breached by the disclosure of Ms. Abril’s confidential medical information. Further, as is evidenced by our decision in Johnson, this Court has consistently and rigorously enforced the rights of patients to confidentiality in their medical records.

In view of these multiple sources of a duty of confidentiality and privacy, it is not surprising that the Second District declared that “the existence of a duty on the part of Continental Laboratory to maintain the confidentiality of information relating to Mrs. Abril’s HIV test is unquestioned.” Abril, 884 So.2d at 213. Because the Abrils could rely on the violation of several Florida statutes, including

section 381.004, as evidence of negligence, we find no error in the district court’s reinstatement of their civil action for negligence. IMPACT RULE As did the district court, we look to our decision in Gracey and reach a similar result as to the application of the impact rule. The impact rule, as applied in Florida, requires that “before a plaintiff can recover damages for emotional distress caused by the negligence of another, the emotional distress suffered must flow from physical injuries the plaintiff sustained in an impact.” R.J. v. Humana of Fla., Inc., 652 So.2d 360, 362 (Fla.1995) (quoting Reynolds v.

State Farm Mut. Auto. Ins. Co., 611 So.2d 1294, 1296 (Fla. 4th DCA 1992)). The rule actually requires some impact on the plaintiff, or, in certain situations, the manifestation of severe emotional distress such as physical injuries or illness. Gracey, 837 So.2d at 355. Although this Court has upheld the viability of the impact rule, it has recognized exceptions where a plaintiff may recover for emotional damages even though he or she suffered no impact or physical manifestation of the injuries.

These exceptions, however, “have been narrowly created and defined in a certain very narrow class of cases in which the foreseeability and gravity of the emotional injury involved, and lack of countervailing policy concerns, have surmounted the policy rationale undergirding the application of the impact rule.” Rowell v. Holt, 850 So.2d 474, 478 (Fla.2003). For example, we have noted that the impact rule does not apply to any intentional torts, such as defamation, invasion of privacy, and intentional infliction of emotional distress. Id. at 478 n. 1.

The rule also appears not to apply to “freestanding torts” which exist regardless of what emotional damages may accompany these torts, such as wrongful birth. See Kush v. Lloyd, 616 So.2d 415, 422 (Fla.1992). In Gracey, this Court also recognized an exception to the impact rule for a breach of the duty of confidentiality as to the release of sensitive personal information. Gracey, 837 So.2d at 357. The Abrils assert that as with the breach of confidentiality in Gracey, the emotional damages resulting from the dissemination of confidential HIV test results are foreseeable and grave.

In the instant case, the Second District held that the impact rule did not bar the emotional distress damages asserted in the claim below. Abril, 884 So.2d at 213. The court again analogized the case to Gracey, where this Court held that the impact rule should not apply because the emotional distress the Graceys suffered as a result of their psychotherapist breaching his duty of confidentiality, was at least equal to that typically suffered by the victim of a defamation or an invasion of privacy.

Indeed, we can envision few occurrences more likely to result in emotional distress than having one’s psychotherapist reveal without authorization or justification the most confidential details of one’s life. Our reasoning in Kush thus provides ample support for the notion that the impact rule should be inapplicable to the instant case. Gracey, 837 So.2d at 356. In Gracey this Court also relied on the statutory duty it found as evidence that the Legislature recognized that plaintiffs could be injured by breaches of the duty of confidentiality, regardless of whether they suffered any physical impact or injury.

Id. at 357. The Second District stated that this same reasoning applied in the instant case, and also relied on this Court’s opinion in Rowell, stating that “there is no legally significant distinction between the ‘foreseeability and gravity of the emotional injury involved’ in the instant case and the ‘foreseeablity and gravity of the emotional injury’ involved in Gracey.” Abril, 884 So.2d at 212.

The district court noted that the statutes in Gracey and in the instant case had the same purpose of protecting individuals from disclosure of highly personal, sensitive information and in both situations, the only possible injury flowing from the violation of the respective statutes was emotional distress. Abril, 884 So.2d at 212. While the court noted that unlike Gracey, no technical fiduciary relationship existed between the laboratory and the plaintiffs, the duty of confidentiality owed to the plaintiffs was “unquestioned.” Id. at 213.

We agree with the district court that this Court’s analysis in Gracey sets strong precedential authority for this exception. At least one clear purpose behind the enactment of

section 381.004(3)(

f) was to ensure that people potentially exposed to HIV would get tested. The Legislature also apparently concluded, however, that people may resist HIV testing because of the fear that their results would become public knowledge. § 381.004(1), Fla. Stat. (Supp.1996).

The specific safeguards provided by the statute to prevent disclosure lend weight to the argument that public dissemination of the test results would cause emotional distress, and thus Continental should have known that by sending the results in an unsecured fax, it was risking causing great emotional distress to the Abrils if an unauthorized party saw the test results. Because the only reasonable damages arising from a breach of

section 381.004(3)(

f) are emotional distress, and because this emotional damage would be akin to that suffered by victims of defamation or invasion of privacy, we conclude they should not be barred by the impact rule.

See Gracey, 837 So.2d at 356-57 (holding that the impact rule should not bar recovery because “[t]he emotional distress that [plaintiffs] allege they have suffered is at least equal to that typically suffered by the victim of a defamation or an invasion of privacy” and that “[ijmposition of the impact rule in this context would render the legislative intent and its statutory implementation meaningless and without substance”).

Thus, based on our recent precedent in Gracey we agree that an exception to the impact rule should be made when a laboratory or other health care provider is negligent in failing to keep confidential the results of an HIV test. Accordingly, we approve the Second District’s decision reversing the trial court’s dismissal of appellee’s action and we further approve the court’s holding that the impact rule does not bar a cause of action for a breach of confidentiality in negligently disclosing the results of HIV testing. It is so ordered. LEWIS, C.J., and ANSTEAD, PARIENTE, and QUINCE, JJ, concur.

PARIENTE, J., concurs with an opinion. CANTERO, J., concurs in part and dissents in part with an opinion. WELLS, J., dissents with an opinion. BELL, J., dissents with an opinion, in which WELLS, J., concurs. . According to one of the Abrils' exhibits, Ms. Abril is suffering from and undergoing treatment for severe depression and posttraumatic stress disorder as a result of the laboratory's negligence. . The complaint alleged that the department was liable for the laboratory’s negligence pursuant to

section 768.28(10)(a), Florida Statutes (Supp.1996), which states: Health care providers or vendors, or any of their employees or agents, that have contractually agreed to act as agents of the Department of Corrections to provide health care services to inmates of the state correctional system shall be considered agents of the ... Department ... for the purposes of ...

section [768.28, Florida’s sovereign immunity waiver statute], while acting within the scope of and pursuant to guidelines established in said contract or by rule. The Second District noted that the department made no argument disputing its responsibility under this statute, and it has raised no such argument in this appeal. Abril, 884 So.2d at 212 n. 3. . As earlier noted, the Abrils broadly alleged that Continental breached its common law duty to act as a reasonably professional laboratory in like circumstances. Abril, 884 So.2d at 208.

In fact, although not directly pertinent to the legal issue before us, the Abrils presented affidavits in the trial court from various medical and research professionals, stating their opinion that the laboratory breached its professional duties in not properly disseminating the results of the HIV test results. . Our decision in Humana involved a claim for misdiagnosis of HIV/AIDS, and did not involve a claim for breach of confidentiality or unlawful dissemination of confidential information.