Eldred v. Oregon Anesthesiology Group, P.C.

Summary

The Oregon Court of Appeals affirmed dismissal of negligence and negligence per se claims arising from a data breach involving patients of Oregon Anesthesiology Group. Applying Paul v. Providence Health System-Oregon, the court held that the economic loss doctrine barred recovery for alleged economic losses because the plaintiff did not establish a special relationship or other duty requiring protection against that type of loss. The court also concluded that Oregon's Consumer Information Protection Act and section 5 of the Federal Trade Commission Act did not alter that analysis.

Holdings

1. The economic loss doctrine barred plaintiff's negligence and negligence per se claims because he sought recovery for purely economic losses and did not identify a duty beyond the common-law duty to exercise reasonable care that protected against that type of economic harm.
2. The Oregon Consumer Information Protection Act and section 5 of the Federal Trade Commission Act did not supply a heightened duty or private cause of action allowing plaintiff to recover purely economic damages through negligence or negligence per se under the circumstances alleged.
3. JH Kelly, LLC did not overrule or materially change Paul I and did not provide a basis to avoid the economic loss doctrine in this data-breach case.
4. The alleged third-party misuse of plaintiff's data did not establish that OAG owed a duty to protect plaintiff against purely economic loss.

Questions Presented

1. Whether the economic loss doctrine barred Eldred's negligence and negligence per se claims for purely economic losses allegedly resulting from a health care provider's failure to protect patient information.
2. Whether the relationship between a health care provider and patient, Oregon's Consumer Information Protection Act, HIPAA, or section 5 of the Federal Trade Commission Act supplied a special relationship or other duty sufficient to permit recovery for those economic losses.
3. Whether JH Kelly, LLC v. Quality Plus Services, Inc. changed or displaced Paul v. Providence Health System-Oregon's treatment of similar data-breach negligence claims.

Disposition

affirmed