This appeal from that judgment challenges several of the district court's decisions: (1) declining to impose sanctions for spoliation after one defendant deleted computer *38 files allegedly to hide involvement in the Internet postings; (2) holding that the invasion-of-privacy claim failed because there was no “publicity”; (3) dismissing the negligent-infliction-of-emotional-distress claim for lack of a threshold showing of a viable invasion-of-privacy claim; (4) holding that the clinic cannot be held liable for the unauthorized acts of its employees; (5) holding that the claim of “breach of a confidential relationship” is not a recognized cause of action; and (6) holding that the Health Insurance Portability and Accountability Act (HIPAA) preempts Minnesota Statutes section 144.335.
We conclude that the district court did not abuse its discretion by declining to impose sanctions for spoliation because there was no proof that the deleted computer files included knowingly destroyed evidence. We also conclude that the invasion-of-privacy claim was correctly resolved by summary judgment for lack of evidence; that the district court properly dismissed the negligent-infliction-of-emotional-distress claim because the claim depends on the survival of the invasion-of-privacy claim; and that the claim of breach of confidential relationship as alleged is waived, and the claim as recast under a different theory on appeal fails as a matter of law. But we conclude that HIPAA does not preempt section 144.335, which authorizes a private cause of action for releasing health care records. We therefore affirm in part, reverse in part, and remand.
The controversy in this case began when a clinic employee saw an acquaintance visiting a doctor and decided to nose around in the acquaintance's confidential file. Candace Yath went to a medical appointment in March 2006 at Fairview Cedar Ridge Clinic in Apple Valley. Yath told her doctor that she wanted to be tested for sexually transmitted diseases because she had a new sex partner. Navy Tek, a medical assistant who is related to Yath's husband, saw Yath at the clinic and became curious.
Tek's job gave her access to the clinic's electronic medical records. Tek decided to satisfy her curiosity by accessing Yath's medical file, knowing this would violate clinic policy. Tek learned from Yath's medical file that Yath's medical appointment was for sexually-transmitted-disease screening related to a new sex partner. She also learned that Yath had been diagnosed with a sexually transmitted disease.
Two days later, Tek sent an electronic mail message to Net Phat. Phat was related to both Tek and Yath by marriage, and she worked as a medical records coder at Fairview Ridges Hospital. In her e-mail to Phat, Tek wrote, “i gotta tell you somethin but can't do it over this....i'll call you when i'm not busy....but only if you promise not to say anything to anybody.” Phat responded that she would not tell anyone and added, “Now I'm curious what it is ... you will have to tell me.” Three minutes later, Tek replied, “you may already know anyways....i'll call you in a bit.”
Tek called and told Phat that she saw Yath's record and that Yath had another sex partner. Phat wrote back to Tek, “Wow ... I'm shocked.” She also wrote, “I look differently at my sister in law.” Phat was unaware that Candace Yath and her husband, Paul, had separated.
In April 2006, Phat told her brother (Yath's now ex-husband) what Tek relayed from Yath's medical file. Paul asked Phat if she had seen Yath's file, but Phat said that she had not. Word eventually reached Candace Yath that Tek had viewed her medical file and had shared the information with Phat. Yath's grandmother called Cedar Ridge Clinic and spoke with *39 Michelle St. Sauver, the clinic's manager. She complained that she believed that Tek had wrongfully accessed and told others the information in Yath's medical file. She also told St. Sauver that she believed Phat was involved.
Fairview investigated and learned that Tek had accessed Yath's medical file five times between March 21 and May 4, 2006. Fairview determined that Tek had no legitimate business reason to do so and that, therefore, her access was unauthorized by Fairview policy and prohibited by HIPAA. St. Sauver and a human resources worker confronted Tek on May 4. Although Tek initially denied accessing Yath's records, she recanted after St. Sauver showed her a computer usage audit. But she claimed that she had not disclosed the information to anyone.
St. Sauver also questioned Phat on May 4. Phat denied knowing anything about Yath's medical information. Neither Cedar Ridge Clinic nor Fairview Ridges Hospital, where Phat worked, investigated Phat's computer. St. Sauver and Lois Dahl, Fairview's information privacy and security director, explained that they did not search Phat's computer because Phat did not have a username or password that allowed her to access Yath's medical records at the clinic and because the clinic and hospital use different records software systems.
St. Sauver sent Tek home on May 4. Convinced that Tek had repeatedly accessed Yath's records without a legitimate business purpose, Fairview decided to fire Tek on May 10, 2006, for violating Fairview policy and HIPAA.
The next day, St. Sauver received an e-mail from Yath's grandmother accusing Tek or Phat of creating a disparaging Internet webpage at MySpace.com using the name “Rotten Candy” and posting information that Tek learned from Yath's medical file. The webpage included a photograph of Candace Yath and stated that “Rotten Candy” has a sexually transmitted disease, that she recently cheated on her husband, and that she is addicted to plastic surgery. The page listed six “friends,” indicating that by then at least those six people had accessed the page.
Fairview investigated the accusations. It tried to view the webpage on either May 11 or May 12, 2006, but by then the webpage had been “removed.” MySpace.com is a “blocked” website at Fairview, meaning that employees cannot access it using Fairview's internet system and that the webpage therefore could not have been created by an employee using a Fairview workplace computer. Yath and her attorneys also investigated the MySpace webpage. They discovered that the MySpace account for the webpage originated on a computer having an Internet Protocol address assigned to a business in Eagan. Tek's sister, Molyka Mao, worked at that business.
[1]Yath sued Tek, Mao, Phat, and Fairview on a variety of theories. She sued all the defendants directly for invasion of her privacy, and all except Mao for “breach of a confidential relationship.” She sued Tek, Mao, and Phat for intentional infliction of emotional distress. She sued Fairview for negligent infliction of emotional distress. She also sued all the defendants directly for violating Minnesota Statutes section 144.335, subdivision 3a(e), by disclosing information in Yath's medical file.
*40 Fairview and Phat each moved for summary judgment. Yath opposed summary judgment and also moved for a default judgment against Tek and Mao, who never answered the complaint. Yath moved the district court to impose sanctions on Phat for spoliation of evidence on the accusation that Phat deleted files from her computer that may have proven that she participated in the disclosure. The district court awarded summary judgment in favor of Fairview. It granted Phat's motion for summary judgment on all claims except intentional infliction of emotional distress. The district court denied Yath's motion for sanctions against Phat for alleged spoliation of evidence. It also found that Yath's motion for a default judgment against Tek and Mao was premature.
Yath then dismissed her claims against Tek and Mao and filed an appeal with this court, challenging the district court's summary judgment decision. But we recognized that the judgment was partial and nonappealable because not all claims were decided. Yath returned to the district court and dismissed her claim of intentional infliction of emotional distress. The district court entered a final order and judgment that disposed of all claims. Yath filed her second appeal, and a special term panel of this court allowed her appeal and agreed that we would review both dispositive orders.
12To address Yath's summary judgment challenge, we first consider her evidentiary claim that the district court erred by denying her motion to impose sanctions on Phat for spoliation. We do so because a finding of spoliation may result in certain inculpatory facts being accepted as true as a remedy for the infraction.
See Wajda v. Kingsbury, 652 N.W.2d 856, 863–64 (Minn.App.2002),
review denied (Minn. Nov. 19, 2002) (validating spoliation sanction permitting jury to infer that the evidence the defendant lost or destroyed was favorable to the plaintiff).
3456“Spoliation is the destruction of evidence.” Id. at 860. Sanctions for spoliation may be appropriate when a person knows or should have known that the evidence she destroyed was relevant to pending or future litigation. Patton v. Newmar Corp., 538 N.W.2d 116, 118–19 (Minn.1995). A district court has broad authority to determine what, if any, sanction is to be imposed for spoliation of evidence.
Id. This court reviews a district court's decision to impose sanctions for spoliation to determine whether the district court abused its discretion. Wajda, 652 N.W.2d at 860.
Yath claims that the district court should have sanctioned Phat because Phat deleted the browser history and temporary Internet files from her computer in an attempt to hide evidence relevant to this litigation. We conclude that the district court did not abuse its discretion by declining to impose sanctions because Yath provided insufficient support for her allegation.
Yath sent a facsimile copy of a subpoena duces tecum to Phat's attorney, Laura Myslis, on July 3 at 4:51 p.m. The subpoena asked Phat to produce all files on any computer that she or her husband owned. Myslis did not receive the subpoena until July 5 because she was out of town for the July 4 holiday. She informed Phat about the subpoena on July 5. On July 16, Phat produced her computer for inspection. Yath's computer analyst examined the computer and submitted an affidavit to the district court stating, “No temporary internet files, browser history, internet or browser cache exist prior to July 3, 2007.” The analyst also opined that “all internet files were erased and scrubbed clean as of July 3, 2007 at approximately 8:05 p.m.” Yath asserts that “the coincidence between that service of the subpoena to Phat's attorney's office and the destruction of the evidence is too coincidental” and therefore constitutes proof that Phat intentionally destroyed evidence.
But the district court reasoned that the deletion might have been standard computer maintenance. The record also shows that Phat was not personally served with the subpoena until July 5, 2007, which was after the deletion. The district court credited Myslis's account regarding when she discovered the facsimile message, and it found that Yath failed to prove that Phat intended to destroy or hide evidence. The district court's refusal to impose sanctions was not an abuse of discretion because Yath did not meet her heavy burden to show that “no reasonable person would agree with the trial court's assessment of what sanctions, [if any,] are appropriate.” *42
Id. (quotation omitted). Although we agree that Yath has a reasonable basis
to suspect intentional destruction of evidence given the timing of the deletion, she did not provide the district court with such compelling support
to require a finding that intentional destruction of evidence occurred. The district court's appreciation of legitimate reasons for the deletion is plausible despite the suspicious timing. We therefore have no basis to overturn the district court's discretionary decision regarding spoliation.
7Yath contests the district court's summary-judgment decision dismissing her invasion-of-privacy claim. She argues that the district court erroneously concluded that the temporary posting of data gleaned from her medical file on MySpace.com “failed to meet the ‘publicity’ requirements for a successful claim.” The argument is persuasive.
89Minnesota recognizes the tort of invasion of privacy on three alternative theories: intrusion of seclusion, appropriation of a name or likeness of another, and publication of private facts. Bodah v. Lakeville Motor Express, Inc., 663 N.W.2d 550, 553 (Minn.2003). Yath's invasion-of-privacy claim is based on the publication of private facts, so the claim can survive summary judgment only if the record contains evidence that (1) a defendant gave “publicity” to a matter concerning Yath's private life, (2) the publicity of the private information would be highly offensive to a reasonable person, and (3) the matter is not of legitimate concern to the public.
Id. (quotation omitted). The district court held that Yath's private information was not given “publicity” within the meaning of the tort of invasion of privacy because Yath had not proven a sufficient number of people had seen the webpage. We reach a different legal conclusion.
“Publicity,” for the purposes of an invasion-of-privacy claim, means that “the matter is made public, by communicating it to the public at large, or to so many persons that the matter must be regarded as substantially certain to become one of public knowledge.” Id. at 557 (quoting from Restatement (Second) of Torts § 652D cmt. a (1977)). In other words, there are two methods to satisfy the publicity element of an invasion-of-privacy claim: the first method is by proving a single communication to the public, and the second method is by proving communication to individuals in such a large number that the information is deemed to have been communicated to the public.
The supreme court's analysis and application in
Bodah is illuminating. The
Bodah court held that the publicity element was not satisfied when an employer disseminated employee names and social security numbers to sixteen managers in six states. Id. at 557–58. The employer disseminated the information by private means, specifically, by facsimile. The private rather than public nature of this communication caused the
Bodah court to consider whether the communication was to a large enough number of recipients to support a determination of “publicity” under the second method. It held that dissemination of information to the relatively small group of individuals did not satisfy the publicity element because the disseminated information could not “be regarded as substantially certain to become public.” Id.
But in reaching the conclusion, the supreme court explained the type of communication that would constitute publicity under the first method. It approvingly acknowledged the Restatement of Torts explanation that “any publication in a *43 newspaper or a magazine, even of small circulation ... or any broadcast over the radio, or statement made in an address to a large audience,” would meet the publicity element of an invasion-of-privacy claim. Id. at 554. It also relied on the Restatement for the proposition that posting private information in a shop window viewable by passers-by constitutes “publicity.” Id. The Restatement explains that “[t]he distinction ... is one between private and public communication.” Id. This explanation informs our judgment that the challenged communication here constitutes publicity under the first method, or publicity per se. Unlike
Bodah, where the private information went through a private medium to reach a finite, identifiable group of privately situated recipients, Yath's private information was posted on a public MySpace.com webpage for anyone to view. This Internet communication is materially similar in nature to a newspaper publication or a radio broadcast because upon release it is available to the public at large.
10The district court appears to have accepted Fairview and Phat's argument that the publicity element was not satisfied because Yath proved only that a small number of people actually viewed the MySpace.com webpage and that the webpage was available only 24 to 48 hours.
[2] A similar argument could be made about a newspaper having only a small circulation, or a radio broadcast at odd hours when few were listening. The district court therefore mistakenly analyzed “publicity” using the second method, which applies only to privately directed communication and requires an assessment based on the number of actual viewers. But when the communication is made by offering the information in a public forum, the first method applies and the tort is triggered when the discloser makes the private information publicly available, not when some substantial number of individuals actually get the information. Like the temporary posting of information in a shop window, the MySpace.com webpage put the information in view of any member of the public—in large or small numbers—who happened by. The number of actual viewers is irrelevant.
See id. at 554–57 (adopting the Restatement definition of publicity which explains that the distinction is “between private and public communication,” and that the publicity element is satisfied when information is “disseminat[ed] to the public at large”).
1112Fairview argues that posting information on a “social networking” website such as MySpace.com should be treated only as a private communication because Myspace.com webpages are not of “general interest” like online newspaper websites. But Bodah's analysis of the publicity element renders this claimed distinction meaningless. The determination does not depend on whether the content offered through the medium is of general interest to the public, but on whether the content is conveyed through a medium that delivers the information directly to the public. The supreme court's other example of publicity, albeit offered in dicta, is consistent with this approach. The court expressly opined that the posting of private employee information on the Internet would constitute “publicity.”
Id. at 554 (approvingly citing dictum of Purdy v. Burlington N. & Santa Fe Ry. Co., No. 98–833, slip op. at 6, 2000 WL 34251818 (D.Minn. Mar. 28, 2000)). By focusing on the number of people who were exposed to *44 the information, the district court revealed that it erroneously treated the nature of the medium as private, which would constitute publicity only if the information would likely be retold publicly. We hold that the publicity element of an invasion-of-privacy claim is satisfied when private information is posted on a publicly accessible Internet website.
The MySpace.com webpage that triggers Yath's claim was such a site. Access to it was not protected, as some webpages are, by a password or some other restrictive safeguard. It was a window that Yath's enemies propped open for at least 24 hours allowing any internet-connected voyeur access to private details of her life. The claim therefore survives the “publicity” challenge.
The concurring opinion maintains that we should analyze this case under the second theory of publicity, but not the first. The concurrence's reason is that a finding of publicity depends on the matter being communicated to such a large number of people that it becomes public knowledge. This is a correct statement of the law describing only the second theory of publicity, but it ignores the first theory. The Restatement and caselaw teach that proof of publicity under the first theory does not require evidence that the information has been communicated to a large number of people. Rather, the question is whether the information has been communicated “
to the public at large.” Bodah, 663 N.W.2d at 553–54 (citing Restatement (Second) of Torts § 652D cmt. a). That the Internet vastly enlarges both the amount of information publicly available and the number of sources offering information does not erode the reasoning leading us to hold that posting information on a publicly accessible webpage constitutes publicity. If a late-night radio broadcast aired for a few seconds and potentially heard by a few hundred (or by no one) constitutes publicity as a matter of law, a maliciously fashioned webpage posted for one or two days and potentially read by hundreds, thousands, millions (or by no one) also constitutes publicity as a matter of law.
It is true that mass communication is no longer limited to a tiny handful of commercial purveyors and that we live with much greater access to information than the era in which the tort of invasion of privacy developed. A town crier could reach dozens, a handbill hundreds, a newspaper or radio station tens of thousands, a television station millions, and now a publicly accessible webpage can present the story of someone's private life, in this case complete with a photograph and other identifying features, to more than one billion Internet surfers worldwide. This extraordinary advancement in communication argues for, not against, a holding that the MySpace posting constitutes publicity.
13Contrary to the concurring opinion, as the Restatement examples illustrate, publicity under the first theory occurs at the point when the communication is made to the public at large, not to a large number of the public: “any
publication in a newspaper or a magazine, even of small circulation” (not
any information that a large number of persons actually read in the newspaper ); “in a handbill
distributed to a large number of persons” (not
a handbill actually read by a large number of persons ); “any broadcast over the radio” (not
any broadcast actually heard by a significant audience ). Restatement (Second) of Torts § 652D cmt. a. “Publicity” therefore occurs on the act that disseminates the information “to the public at large,” which is the printing, distribution, or utterance in the public forum. Although the damages calculation for invasion of privacy might be influenced *45 by the extent to which the publicity was effective,
see Restatement (Second) of Torts § 652H cmt. b (explaining that damages recoverable under an invasion-of-privacy claim closely resemble damages recoverable for defamation);
cf. Longbehn v. Schoenrock, 727 N.W.2d 153, 160 (Minn.App.2007) (permitting recovery in defamation for the injury to reputation), a determination that publicity occurred does not require a large actual audience.
We acknowledge that some public webpages might get little actual attention. But the same may be said of a card posted on the door of a residence or a poster displayed in a shop window, each of which constitutes publicity.
See Thompson v. Adelberg & Berman, Inc., 181 Ky. 487, 205 S.W. 558 (1918) (reversing judgment against plaintiff who alleged that the defendant clothing store had posted cards for several hours on the front door and side windows of her house and on a stick near the public sidewalk indicating that the plaintiff had failed to pay a store debt);
see also Brents v. Morgan, 221 Ky. 765, 299 S.W. 967 (1927) (citing
Thompson and holding that poster in a shop window identifying debtor to passers-by was actionable as an invasion of privacy). The unrestricted MySpace.com webpage posting likewise constitutes publicity.
1415Fairview and Phat argue alternatively that we could affirm the district court's dismissal of Yath's invasion-of-privacy claim on other grounds. “This court can, if it needs to, affirm summary judgment on alternative theories presented but not ruled on at the district court level.” Nelson v. Short–Elliot–Hendrickson, Inc., 716 N.W.2d 394, 402 (Minn.App.2006). Fairview and Phat argued in the district court, and again on appeal, that Yath's invasion-of-privacy claim is also subject to summary judgment because Yath did not produce any evidence that Phat or Fairview were involved in creating the MySpace.com webpage. This argument is convincing.
Summary judgment is proper “when the record is devoid of proof on an essential element of the plaintiff's claim.” Cargill, 719 N.W.2d at 232. Yath conceded at oral argument that there is nothing in the record, except her allegation that “Phat is a liar,” to establish that Phat or Fairview were involved in creating or sustaining the MySpace.com webpage. Our independent examination of the record confirms Yath's concession. Because MySpace.com is a “blocked” site at Fairview's Cedar Ridge Clinic and at Fairview Ridges Hospital, the webpage could not have been created at Fairview. And Yath actually traced the creation of the webpage to the IP address of an Eagan business's computer. Tek's sister, Molyka Mao, worked at the business. At most, the record suggests that Mao created the website possibly with Tek's assistance. It appears that the district court may have improperly addressed the claim as it regards these two. But Yath dismissed Mao and Tek from this suit and the record reveals no communication between Mao and Phat and no affiliation between Mao and Fairview. It is true that these defendants remained part of the case through summary judgment. But their dismissal occurred before the appeal. That Mao and Tek may be liable if the invasion-of-privacy claims against them are revived does not prevent us from affirming summary judgment.
Because Yath failed to produce any evidence on an essential element of her claim—specifically, that any of the defendants surviving on appeal were involved in creating or sustaining the disparaging MySpace.com webpage—her invasion-of-privacy claim fails.
25The district court also dismissed Yath's claim of “breach of confidential relationship” because it concluded that “Minnesota law does not recognize a cause of action for breach of fiduciary duty between a physician and a patient.” Yath argues that the district court misinterpreted her claim and erroneously concluded that Yath failed to state a claim under Minnesota law. She asserts that she “never alleged” that any defendant is liable based on a fiduciary relationship between physician and patient. She maintains instead that her confidential-relationship claim is based on Minnesota Statutes section 595.02, subdivision 1(d) (2006). The statute does not support Yath's newly recast claim.
Section 595.02 addresses witness testimony. Subdivision 1, regarding the competency of witnesses, provides, “Every person of sufficient understanding ... may testify ... in court ... except ... (d) A licensed physician ... shall not, without the consent of the patient, be allowed to disclose any information ... acquired in attending the patient in a professional capacity.” Id., subd. 1(d). The statute concerns testimonial privilege and does not confer a civil cause of action. Additionally, Yath's allegation does not regard testimony. Because this testimonial-privilege statute does not apply factually or legally to confer a private cause of action, and because Yath now waives what appeared to be a common-law claim for breach of a fiduciary relationship, her cause of action for “breach of confidential relationship” fails as a matter of law.
26We last address Yath's argument that the district court erred by concluding that *49 Minnesota Statutes section 144.335 (2006)
[3] is preempted by HIPAA, 42 U.S.C. §§ 1320d–1320d–8 (2006). The district court dismissed Yath's claims under section 144.335 because it concluded that section 144.335 is contrary to HIPAA and is therefore preempted by it. Questions of statutory construction are subject to de novo review. State v. Al–Naseer, 734 N.W.2d 679, 683 (Minn.2007). Yath contends that section 144.335 is not contrary to HIPAA. We agree.
The general statutory rule is that HIPAA supersedes or preempts any “contrary” provision of state law. 42 U.S.C. § 1320d–7(a)(1). Fairview argued, and the district court agreed, that Minnesota Statutes section 144.335 is “contrary” to HIPAA because section 144.335 provides for a private cause of action for the wrongful disclosure of an individual's medical records while HIPAA does not. But just because a distinction exists does not make the Minnesota provision “contrary” to HIPAA.
A state law is “contrary” to HIPAA if a health care provider “would find it impossible to comply with both the State and federal requirements” or if the state law is “an obstacle to the accomplishment and execution of the full purposes” of HIPAA. 45 C.F.R. § 160.202. It would not be impossible for Fairview or Phat to comply with both HIPAA and Minnesota Statutes section 144.335 because both laws, in complementary rather than contradictory fashion, discourage a person from wrongfully disclosing information from another person's health record.
See 42 U.S.C. § 1320d–6(a)(3) (providing that “[a] person who knowingly ... discloses individually identifiable health information to another person, shall be punished” by a fine of not more than $50,000 or imprisonment of not more than one year, or both); Minn.Stat. § 144.335, subd. 3a(a) (“A provider ... may not release a patient's health records to a person without a signed and dated consent ... unless the release is specifically authorized by law.”). The goals of the two laws are similar. Both protect the privacy of an individual's health care information. The difference in remedy is functional only, in that a HIPAA violation subjects a person to criminal penalties while section 144.335 exposes a person to compensatory damages in a civil action.
See Minn.Stat. § 144.335, subd. 3a(e) (“A person who negligently or intentionally releases a health record in violation of this subdivision ... is liable to the patient for compensatory damages caused by [the] unauthorized release, plus costs and reasonable attorney's fees.”). Although the penalties under the two laws differ, compliance with section 144.355 does not exclude compliance with HIPAA.
Section 144.335 also is not “an obstacle to the accomplishment and execution of the full purposes” of HIPAA. The stated purpose of HIPAA is to improve the Medicare and Medicaid programs and “the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.” Health Insurance Portability and Accountability Act, P.L. 104–191 § 261, 110 Stat. 1936, 2021 (1996). To accomplish that purpose, HIPAA requires entities that maintain or transmit health care information to establish safeguards “to ensure the integrity and confidentiality” of an individual's health care information and “to protect against any reasonably anticipated ... unauthorized *50 uses or disclosures of the information.” 42 U.S.C. § 1320d–2(d)(2). If a person wrongfully discloses health care information, that person may be subject to criminal penalties, including fines or imprisonment. 42 U.S.C. § 1320d–6. Rather than creating an “obstacle” to HIPAA, Minnesota Statutes section 144.335 supports at least one of HIPAA's goals by establishing another disincentive to wrongfully disclose a patient's health care record. We hold that Minnesota Statutes section 144.335 is not a contrary state law preempted by HIPAA.
Yath claims that Phat and Fairview violated Minnesota Statutes section 144.335, subdivision 3a(e), by “negligently or intentionally releas[ing] Yath's health record.” The plain language of the statute imposes liability when a “person” negligently or intentionally releases a “health record.” Fairview relies on that language and argues that because neither Fairview Cedar Ridge Clinic nor Fairview Ridges Hospital is a “person,” the statute does not create a cause of action for Yath against Fairview. Citing Minnesota Statutes section 645.44, subdivision 7, Yath counters that “person” is generally defined to include both natural persons and corporate bodies, and therefore the statute creates a cause of action against Fairview. The district court declined to address these arguments because it concluded that HIPAA preempts section 144.335.
27As already explained, we disagree with the district court's preemption holding. We generally do not decide matters that were presented to but not decided by the district court.
See Wood v. Diamonds Sports Bar & Grill, Inc., 654 N.W.2d 704, 709 (Minn.App.2002) (citing Thiele v. Stich, 425 N.W.2d 580, 582 (Minn.1988)),
review denied (Minn. Feb. 26, 2003). Unlike the question of whether Yath introduced evidence that any remaining defendant participated in the Internet publicity, this question of statutory construction depends on novel legal arguments that should be addressed first by the district court. We repeat that the district court did not address Yath's vicarious liability argument as applied to section 144.335, presumably because of its preemption analysis and decision. We have therefore also offered no opinion about the merits of that argument. Because we reverse the district court's preemption decision, the district court will have an opportunity on remand to address all unresolved issues related to liability under section 144.335.
The district court did not abuse its discretion by declining to impose sanctions for Phat's alleged spoliation of evidence. Yath's claims on the theories of invasion of privacy, negligent infliction of emotional distress, respondeat superior for the intentional torts, and breach of confidential relationship fail as a matter of law. But because we conclude that HIPAA does not preempt Minnesota Statutes section 144.335, we reverse the dismissal of those claims and remand for the district court to consider the claims' unresolved issues.
Affirmed in part, reversed in part, and remanded.