Claimant Yolanda Fernandez moves this Court for permission to serve and file a late claim pursuant to Court of Claims Act § 10(6). The proposed claim alleges that the State Insurance Fund ("SIF") negligently divulged her personal information, including her social security number and certain medical information, to a third party.

Fernandez' application is supported by her own affidavit, an affirmation of counsel Joel Gluck, and various documentary exhibits. Claimant's affidavit states as follows: Fernandez is permanently disabled under the Workers' Compensation Law ("WCL"), and she receives workers' compensation benefits through SIF. On July 25, 2012, claimant's medical provider sent an MG-2 form to SIF requesting a variance to permit certain treatment.^[FN1] A few weeks later, claimant and her provider received a denial of a variance request for a different individual and [*2]different provider. At the same time, SIF sent its response to claimant's request, which included her social security number, date of birth, medical information and the name of her prior employer, to the other individual and that person's provider. As a result, claimant contends that she suffered "mental distress due to possible identity theft & loss of privacy," and monetary damages of $5,000 "for having to change all my accounts & credit cards."

Defendant opposes the application, and has submitted an affirmation of an assistant attorney general, and an affidavit of SIF claims manager Louis Vassallo.

Vassallo's affidavit states that his unit was assigned to handle claimant's case. On September 19, 2012, SIF granted the MG-2 variance in part, and faxed and mailed its response to the provider, claimant's attorney, and the WCB. Then on September 27, 2012, his unit received a call from Fernandez informing it of the mixup, and stating that she incurred expenses in contacting a number of credit bureaus. Vassallo understood from claimant that the MG-2 responses for Fernandez and of another individual receiving benefits from SIF were inadvertently switched at the time of mailing. According to Vassallo, SIF informed claimant that it would reimburse her for her expenses incurred as a result of the mixup, but claimant has yet to submit to SIF any bills for reimbursement in connection with this matter.

Court of Claims Act § 10(6) sets forth six factors to be considered on a late claim motion (see Bay Terrace Coop. Section IV v New York State Employees' Retirement Sys. Policemen's & Firemen's Retirement Sys., 55 NY2d 979, 981 [1982]). Those factors are: whether the delay in filing the claim was excusable; whether defendant had notice of the essential facts constituting the claim; whether defendant had an opportunity to investigate; whether defendant was substantially prejudiced; whether the claim appears to be meritorious; and whether claimant has any other available remedy. These factors are not necessarily exhaustive, nor is the presence or absence of any particular factor controlling (id.).

Of these factors, the appearance of merit is the most significant, because to permit the filing of a "a legally deficient claim which would be subject to immediate dismissal" would be "futile" (Prusack v State of New York, 117 AD2d 729, 730 [2d Dept 1986]).

Appearance of merit is assessed under the twofold test set forth in Matter of Santana v New York State Thruway Auth. (92 Misc 2d 1 [Ct Cl 1977]). To meet this test: (1) the proposed claim "must not be patently groundless, frivolous, or legally defective," and (2) the record as a whole, including the proposed claim and any affidavits or exhibits, must give "reasonable cause to believe that a valid cause of action exists" (id. at 11). In applying this standard, "the court looks at all of the submitted papers, including affidavits and exhibits, to determine whether a putative claimant has met the statutory burden of apparent merit'" (Mamedova v City Univ. of NY, 13 Misc 3d 1211[A], 2006 NY Slip Op 51775[U] [Ct Cl 2006]).

Claimant contends that SIF's negligent disclosure of claimant's social security number and other personal information to a third party were illegal under the Health Insurance Portability and Accountability Act ("HIPAA") and two specific provisions of the Workers' Compensation Law. Claimant further argues — as she must to prevail on any such causes of action — that there exists a private right of action for violation of these provisions.

In regard to HIPAA, counsel argues that although workers compensation carriers are exempt from HIPAA privacy rules, SIF violated the statute's "minimum necessary requirement" [*3]by divulging information to a third party^[FN2] (Gluck Aff. § 14). Even if that were the case, though, HIPAA and its regulations do not create a private right of action (see Warren Pearl Const. Corp. v Guardian Life Ins. Co. of America, 639 F Supp 2d 371, 377 [SD NY 2009] [collecting cases]). Rather, any violation thereunder is to be pursued against an alleged offender by the United States Secretary of Health and Human Services, not by a private individual (see Alsaifullah v Furco, 2013 WL 3972514, at *17 [SD NY 2013] [citing 42 USCA § 300gg-22]).

Counsel also points to WCL §§ 98 and 110-a, and asserts that these statutes provide a private right of action (Gluck Aff. ¶¶ 15-16). I cannot agree with that contention.

WCL § 98 states that "[i]nformation as required by the state fund . . . from employers or employees . . . shall not be opened to public inspection." WCL § 110-a states that "no workers' compensation record shall be disclosed, redisclosed, released, disseminated or otherwise published by an officer, member, employee or agent of the board to any other person," except under certain conditions and circumstances not applicable to this case.

Neither section 98 nor section 110-a specifically authorizes a private plaintiff to sue to recover damages resulting from a violation of these provisions. Therefore, claimant may bring a damages action under the cited statutes "only if a legislative intent to create such a right of action is fairly implied in the statutory provisions and their legislative history" (Carrier v Salvation Army, 88 NY2d 298, 302 [1996][internal quotation and citations omitted]). That determination turns on three factors: "(1) whether the [claimant] is one of the class for whose particular benefit the statute was enacted; (2) whether recognition of a private right of action would promote the legislative purpose; and (3) whether creation of such a right would be consistent with the legislative scheme" (Sheehy v Big Flats Community Day, 73 NY2d 629, 633 [1989] see also Madden v Creative Servs., 84 NY2d 738, 745 [1995]). The courts have made clear that the third factor is the "most important" consideration (Cruz v TD Bank, N.A., 22 NY3d 61, 70 [2013]), and have often declined to imply a right of action where it would be inconsistent with the legislative scheme, even when the first two factors have been met (see Cruz, 22 NY3d at 71-78; Sheehy, 73 NY2d at 634; Uhr v East Greenbush Cent.School Dist., 94 NY2d 32 [1999]). Here, as well, the first two criteria weigh in favor of a private right of action, but the third factor cuts against it. As a result, I find that a private right of action is unavailable.

Courts have generally found an implied right of action inconsistent with the legislative scheme when a remedial framework or enforcement measure is set forth within the four corners of the statute (see Cruz, 22 NY3d at 71 [courts "have . . . declined to recognize a private right of action where the Legislature specifically considered and expressly provided for enforcement mechanisms in the statute itself"] [internal quotations and citation omitted] see also Sheehy, 73 NY2d at 634-635 ["a private right of action should not be judicially sanctioned if it is incompatible with the enforcement mechanism chosen by the Legislature or with some other aspect of the over-all statutory scheme"]). Both provisions of the Workers Compensation Law [*4]on which claimant relies contain enforcement mechanisms. WCL § 98 provides that a SIF employee who discloses covered information "without authority of the commissioners or pursuant to their regulations, or as otherwise required by law" shall be guilty of a misdemeanor. WCL § 110-a provides that a SIF employee who violates its terms is subject to a Class A misdemeanor charge and a criminal fine not exceeding $1,000. In addition, the New York State Attorney General may make an application to commence a special proceeding in response to any violation of section 110-a, that may result in civil penalties of $500 plus Attorney General allowances and direct restitution.

Under these circumstances — where a statute provides for no private right of action, and set forth a specific alternative enforcement mechanism — courts have repeatedly declined to allow private suits to redress a violation (see e.g. Pelaez v Seide, 2 NY3d 186 [2004] [creation of a private right of action against municipal defendants under the Lead Poisoning Prevention Act does not comport with the legislative scheme when there is a tort remedy in place against the property owner] Carrier, 88 NY2d at 303 [no private right of action where statutory enforcement authority under Social Services Law § 460—d is "expressly vested only in the Department, with additional equitable enforcement remedies available upon the request of the [D]epartment' through the Attorney—General"] Larson v Albany Med. Ctr., 252 AD2d 936 [3d Dept 1998] [no private right of action for violation of Civil Rights Law § 79-i, as the statute provides for prosecution of a misdemeanor] Clancy v State of New York,126 Misc 2d 292, 293 [Ct Cl 1984] [violation of Workers Compensation Law § 120, does not provide "a substantive cause of action," where WCB may award civil penalties and order the restoration of an employee to former employment]).

In those instances where an implied private right of action has been found, the Court noted the presence of factors not at issue here. In particular, these decisions either identified direct support for such a right in the language of the statute or legislative history (see AHA Sales, Inc. v Creative Bath Prods., Inc., 58 AD3d 6, 16 [2d Dept 2008] [finding private right of action where statutory language "indicat[es] that wage claims asserted by individuals . . . are permissible"] Doe v Roe, 190 AD2d 463, 470 [4th Dept 1993] [language of statute "acknowledged a private cause of action"]), or the laws at issue imposed an "affirmative duty" on the defendant which carried obligations that "inure[d] directly and personally" to the plaintiff (see Maimonides Medical Center v First United American Life Ins. Co., 2014 NY Slip Op 01441, at *5-*8 [2d Dept 2014] Henry v Isaac, 214 AD2d 188, 193 [2d Dept 1995]). Thus, in Maimonides Medical Center, the statute at issue specifically required that certain payments be made by health insurers to claimants, and the upshot of granting plaintiffs a right to sue was that they could obtain precisely what they were supposed to be paid under the relevant provision.

Here, claimant points to no language in the statutory text or legislative history that would support a private right of action, and none is apparent. Moreover, sections 98 and 110-a impose no affirmative obligation on SIF inuring directly to the claimant's benefit. Rather, claimant seeks to extract such an affirmative duty — that SIF cover any damages resulting from an unauthorized release of private information — from provisions that merely prohibit disclosure. Because there is no evidence of "the Legislature's willingness to expose [SIF] to liability that it might not otherwise incur," such an outcome would not be consistent with the legislative scheme (see Uhr, 94 NY2d at 42). I therefore find no implied private right of action under these provisions. [*5]

Claimant's allegations do not give rise to any other potentially meritorious case of action. While there are other New York statutes which prohibit disclosure of private information, none of them support a private right of action under the circumstances alleged here. Article 6-A of the Public Officers Law, entitled "Personal Privacy Protection Law," bars with certain exceptions the intentional release of social security numbers and other private information to the general public by government entities.^[FN3] It does not, however, create new a private right of action beyond those remedies set forth in the statute^[FN4] (see e.g. Lawrence v State of New York, 180 Misc 2d 337 [Ct Cl 1999] [it would be "imprudent for a court to add by implication a provision that it is reasonable to assume the Legislature intentionally omitted" from Article 6-A] Gosselin v State of New York, UID No. 2000-015-021 [Ct Cl, Collins, J., April 6, 2000] ["no private cause of action against the State for the unauthorized dissemination of computer information in violation of the Personal Privacy Protection Law"]).

Further, New York also does not recognize a common-law right of privacy (see Messenger v Gruner + Jahr Print. & Publ., 94 NY2d 436, 441 [2000], citing Roberson v Rochester Folding Box Co., 171 NY 538 [1902]). Rather, article 5 of the Civil Rights Law provides the "exclusive basis for a breach of privacy action" (see Crandall v Personal Mtge. Corp., 210 AD2d 981, 982 [4th Dept 1994]), and the breach at issue does not fall within the limited private right of action provided by that statute (see Civil Rights Law §§ 50-c and 51).

Finally, claimant contends that she may assert a claim for negligent infliction of emotional distress. But such a cause of action will lie only in extremely limited circumstances not found here (see Losquadro v Winthrop Univ. Hosp., 216 AD2d 533, 534 [2d Dept 1995] ["conduct that unreasonably endangers the [claimant's] physical safety"] Johnson v State of New York, 37 NY2d 378, 381-382 [1975] [misinforming claimant of a death] Dobisky v Rand, 248 AD2d 903 [3d Dept 1998] [negligent mishandling of a corpse] Ornstein v New York City Health & Hosps. Corp., 10 NY3d 1 [2008] [negligent exposure of claimant to the HIV virus]). To the extent the proposed claim can be read to allege intentional infliction of emotional distress (as counsel suggests in his affirmation, at ¶ 12), no such claim may be brought against the State (see Brown v State of New York, 125 AD2d 750, 752 [3d Dept 1986], appeal dismissed 70 NY2d 747 [1987]).

Thus, the proposed claim does not state a viable cause of action against the State, and [*6]therefore does not satisfy the two part test for appearance of merit set forth in Santana. On this basis, and in the absence of any other statutory factor that would warrant a different result, I find that claimant has failed to show that she should be permitted to file a late claim pursuant to section 10(6) (see McCarthy v New York State Canal Corp., 244 AD2d 57 [3d 1998] ["in the absence of the appearance of merit to claimant's claim, the request to file a late notice of claim . . . should have been denied"]).

In view of the foregoing, motion no. M-84495 is denied.

Albany, New York

April 17, 2014

DAVID A. WEINSTEIN

Judge of the Court of Claims