Lindsey Parker sued Carilion Clinic, Carilion Healthcare Corporation (collectively, "Carilion"), and two Carilion employees, Christy Davis and Lindsey Young, claiming that they had disclosed her confidential medical information to others. Parker served process on Carilion but did not serve Davis or Young. The circuit court granted Carilion's demurrers and dismissed all of Parker's claims against it, which included both vicarious and direct liability claims. Parker challenges that holding on appeal. We agree with Parker that the circuit court should not have dismissed her vicarious liability claim on demurrer, but we agree with Carilion that the circuit court correctly dismissed the direct liability claims.

I. BACKGROUND

In her complaint, Parker claimed that she had been diagnosed with a medical condition at Rocky Mount Obstetrics & Gynecology. 1 J.A. at 2. Almost seven months later, she visited her primary care physician at Rocky Mount Family Practice for treatment unrelated to her previous diagnosis. Carilion owned and operated both healthcare facilities. While awaiting treatment at Rocky Mount Family Practice, Parker spoke with an acquaintance, Trevor Flora, in the waiting room. Davis, a Carilion employee working at Rocky Mount Family Practice, saw Parker conversing with Flora, with whom she also was acquainted.

Davis accessed Parker's confidential medical information and discovered Parker's previous diagnosis. Davis then contacted her friend Young, who was a Carilion employee working at a third facility and who also knew Flora. Davis told Young that Parker was at Rocky Mount Family Practice conversing with Flora and disclosed Parker's previous diagnosis to Young. Young then accessed Parker's confidential medical information and confirmed Davis's disclosure. Young thereafter disclosed Parker's previous diagnosis to Flora, who revealed the disclosure to Parker.

Parker's complaint alleged that Davis, Young, and Carilion had disclosed her confidential medical information in breach of the tort duty that we recognized in Fairfax Hospital v. Curtis , 254 Va. 437 , 442, 492 S.E.2d 642 (1997). She based her unauthorized-disclosure claim against Carilion on two theories: (i) Carilion was vicariously liable under respondeat superior principles for the breach by Davis and Young of their duty not to disclose and (ii) Carilion was directly liable because it had failed to secure her confidential medical information from unauthorized access and disclosure, as evidenced by Davis and Young's acts.

Parker also asserted a negligence per se claim against Carilion. She based this claim on the theory that the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 26, 29, and 42 U.S.C.) ("HIPAA"), imposed statutory requirements that Carilion violated by failing to secure, and thus protect from unauthorized disclosure, her confidential medical information. Parker argued that Code § 8.01-221 converted these statutory *815 violations into a negligence per se claim under Virginia law.

In its answer, Carilion admitted that Davis and Young were its employees at the time that they accessed and disclosed Parker's confidential medical information. In its demurrer to the unauthorized-disclosure count, however, Carilion argued with respect to Davis and Young that they had acted outside the scope of their employment, precluding Parker's respondeat superior claim as a matter of law. Carilion also contested the legal viability of Parker's direct liability claims, in which she had asserted a breach of the non-disclosure duty recognized in Fairfax Hospital and negligence per se based upon HIPAA violations.

On October 25, 2016, the circuit court entered an order sustaining Carilion's demurrers but granting Parker 21 days within which to amend her complaint. The order provided that if she did not do so, "the case is dismissed with prejudice." J.A. at 80. Parker did not amend her complaint but instead filed a notice of appeal on December 2, 2016.

II. RULE 1:1 & THE NOTICE OF APPEAL

As a threshold matter, Carilion asserts that Parker failed to file her notice of appeal within 30 days from the entry of the final order as required by Rule 5:9(a). Under Rule 1:1, Carilion reasons, the final order was entered on the date that it was signed, notwithstanding the fact that the order provided Parker 21 additional days within which to file an amended complaint. Although we held in Norris v. Mitchell that an order sustaining a demurrer and dismissing the case unless the plaintiff files an amended complaint within a specified period of time does not become final until the time for amendment lapses, see 255 Va. 235 , 239-40, 495 S.E.2d 809 (1998), Carilion argues that Rule 1:1's definition of when such an order is entered controls for the purpose of the 30-day deadline that Rule 5:9(a) imposes. We disagree.

Rule 5:9(a) provides in relevant part that

[n]o appeal shall be allowed unless, within 30 days after the entry of final judgment or other appealable order or decree, or within any specified extension thereof granted by this Court pursuant to Rule 5:5(a), counsel for the appellant files with the clerk of the trial court a notice of appeal and at the same time mails or delivers a copy of such notice to all opposing counsel.

This requirement is "mandatory, not merely directory." School Bd. v. Caudill Rowlett Scott, Inc. , 237 Va. 550 , 556, 379 S.E.2d 319 (1989). In Norris , we considered whether the circuit court had authority under Rule 1:1 to grant a nonsuit. See 255 Va. at 239 , 495 S.E.2d 809 . The circuit court entered an order on June 20 sustaining a demurrer and dismissing the case unless the plaintiffs filed an amended motion for judgment by July 8. See id. at 238, 495 S.E.2d 809 . On July 15, the plaintiffs filed a motion for nonsuit, which the court granted, but they never filed an amended motion for judgment as the June 20 order had required. See id. Because July 15 was later than 21 days after June 20 but sooner than 21 days after July 8, we directly answered the question whether Rule 1:1's 21-day period began to run on June 20 (when the order was entered) or on July 8 (when the entered order became final).

We ruled that the circuit court retained jurisdiction until 21 days after July 8 because an order merely sustaining a demurrer is not final, but an order dismissing a case is final. See Norris , 255 Va. at 239 , 495 S.E.2d 809 (citing Bibber v. McCreary , 194 Va. 394 , 395, 73 S.E.2d 382 (1952) ); Commercial Bank of Lynchburg v. Rucker , 24 S.E. 388 , 388 (1896). Furthermore, a trial court may enter an order dismissing a case if an amended complaint is not filed before a specified deadline. See Norris , 255 Va. at 239 , 495 S.E.2d 809 (citing London-Va. Mining Co. v. Moore , 98 Va. 256 , 257, 35 S.E. 722 (1900) ). In such cases, there is no dismissal if the plaintiff files the amended complaint before the deadline and the order thus never becomes final. Dismissal - and finality - occur only when the deadline expires without the filing of an amended complaint. See generally Kent Sinclair & Leigh B. Middleditch, Jr., Virginia Civil Procedure § 9.6, at 740 (6th ed. 2014) ("A court order sustaining or overruling a demurrer does not, of itself, *816 result in a final judgment; there must also be either a failure by the plaintiff to amend within the time allowed by the court or a direct dismissal of the case by the court.").

Although not analyzed in Norris , the commencement of the 30-day period for filing a notice of appeal requires "the entry of [a] final judgment or other appealable order or decree," Rule 5:9(a) (emphasis added), and Norris , Bibber , London-Virginia Mining Co. , and Commercial Bank of Lynchburg all decisively hold that an order merely sustaining a demurrer without dismissing the case is not final. Consequently, the 30-day period provided by Rule 5:9(a) does not begin to run in the absence of a final order, and in the case before us, no final order existed until the deadline for filing an amended complaint had expired. Absent a statutory provision stating otherwise, an order must be both entered and final before the 30-day period for filing a notice of appeal commences. Thus, Parker's notice of appeal was timely.

III. THE DEMURRERS

When reviewing an order granting a demurrer, we accept as true all factual allegations expressly pleaded in the complaint and interpret those allegations in the light most favorable to the claimant. See Coutlakis v. CSX Transp., Inc. , 293 Va. 212 , 215, 796 S.E.2d 556 (2017). 2 "Two important limitations on this principle, however, deserve emphasis." Coward v. Wellmont Health Sys. , 295 Va. 351 , 358, 812 S.E.2d 766 (2018).

First, while we also accept as true unstated inferences to the extent that they are reasonable , we give them no weight to the extent that they are unreasonable . The difference between the two turns on whether "the inferences are strained, forced, or contrary to reason," and thus properly disregarded as "arbitrary inferences." Second, we must distinguish allegations of historical fact from conclusions of law. We assume the former to be true arguendo , but we assume nothing about the correctness of the latter because "we do not accept the veracity of conclusions of law camouflaged as factual allegations or inferences." "Instead, we review all conclusions of law de novo."

Id. at 358-59 , 812 S.E.2d 766 (emphases in original) (footnote and citations omitted).

On appeal, Parker contends that the circuit court erred in granting the demurrers because she adequately pleaded four distinct causes of action:

• Tort claims against Davis and Young individually for breach of the "health care provider" duty of non-disclosure recognized in Fairfax Hospital . See Appellant's Suppl. Br. at 3-6.

• A respondeat superior claim against Carilion, as Davis and Young's employer, that alleged vicarious liability for the employees' torts. See Appellant's Br. at 16-19; Appellant's Suppl. Br. at 7-11.

• A direct claim against Carilion for breach of the "health care provider" duty of non-disclosure recognized in Fairfax Hospital . See Appellant's Br. at 16-19.

• A direct claim against Carilion alleging negligence per se based upon violations of federal HIPAA provisions. See id. at 20-22.

We will address these arguments in the same sequence.

A. TORT CLAIMS AGAINST DAVIS & YOUNG INDIVIDUALLY

Parker pleaded tort claims against Davis and Young individually, asserting that they were "healthcare providers" and thus owed a duty under Fairfax Hospital not to disclose her confidential medical information without her authorization. See J.A. at 4-5. On appeal, Parker argues in her first assignment of error that the circuit court "erred in ruling there is no cause of action under Virginia law against an employee of a healthcare provider when the employee makes an extra-judicial disclosure of sensitive confidential personal health information without the authorization of the patient-plaintiff." Appellant's Suppl. Br. at 1 (altering capitalization).

The circuit court, however, never addressed whether a viable cause of action *817 existed against Davis and Young individually. Instead, the court held only that Carilion could not be liable under respondeat superior principles because, based on Parker's allegations, Davis and Young had acted outside the scope of their employment. Parker nonetheless contends that we should address the issue given its importance to the underlying issue of respondeat superior liability. 3

Though we appreciate Parker's concerns, 4 we cannot address them in the present appeal. Rule 5:17(c)(1)(iii) requires an assignment of error to "address the findings or rulings in the trial court or other tribunal from which an appeal is taken." See Wright v. Commonwealth , 292 Va. 386 , 393-94, 789 S.E.2d 611 (2016), cert. denied , --- U.S. ----, 137 S.Ct. 1442 , 197 L.Ed.2d 655 (2017). For these reasons, we dismiss this assignment of error and offer no opinion on the question whether Parker's complaint alleged facts that, if true, would prove that Davis and Young qualified as "healthcare providers," J.A. at 4, for purposes of personal liability under Fairfax Hospital . 5

B. CARILION'S VICARIOUS LIABILITY

1. The Rebuttable Presumption

Parker asserts that the circuit court erred by ruling as a matter of law that Carilion was not vicariously liable for Davis and Young's tortious acts. She contends that when Carilion "admitted ... that Davis and Young were its employees," there arose a rebuttable presumption that Davis and Young were acting within the scope of their employment when they committed the alleged tort. See Appellant's Suppl. Reply Br. at 2; see also Majorana v. Crown Cent. Petroleum Corp. , 260 Va. 521 , 526, 539 S.E.2d 426 (2000). 6

Carilion acknowledges the rebuttable presumption but contends that the cases cited by Parker apply only when considering "the evidentiary burden at trial, not whether the plaintiffs' complaints alleged facts sufficient to state a vicarious liability claim." Appellees' Suppl. Br. at 17-18. And even if those cases apply at the pleading stage, Carilion adds, Parker's own pleadings, coupled with the factual interpretations that she advocates on appeal, show "that the defendant could not, as a matter of law, be held vicariously liable." Id. at 18; see also Oral Argument Audio at 18:04 to 18:11 (arguing that "there has to be more ... than just asserting magic words of employer-employee relationship"); id. at 18:32 to 18:36 (arguing that Parker pleaded herself out of the presumption because of "the information that's not provided" in the complaint).

*818 To Carilion's first point, we disagree that the presumption applies only at trial and has no role at the pleading stage of the case. There has always been in law a symmetry between pleadings and proof. On essential matters, the latter can go no further than the former. See Ted Lansing Supply Co. v. Royal Aluminum & Constr. Corp. , 221 Va. 1139 , 1141, 277 S.E.2d 228 (1981) ("Pleadings are as essential as proof, the one being unavailing without the other." (citation omitted) ); Martin P. Burks, Common Law and Statutory Pleading and Practice § 334, at 638 (T. Munford Boyd ed., 4th ed. 1952). A prima facie civil case - that is, the cluster of factual and legal assertions, which, if true, would authorize a judicial remedy - remains the same from the beginning of a judicial proceeding to its end. A demurrer, a motion for summary judgment, a motion to strike, and a motion to set aside a verdict all use the same definition of a prima facie case when the question presented is the legal sufficiency of the claim.

Without discussion, we applied the rebuttable presumption at the demurrer stage in Plummer v. Center Psychiatrists, Ltd. , 252 Va. 233 , 235-36, 476 S.E.2d 172 (1996). We elaborated on the point in Majorana . In that case, a pleading asserting an employer's liability under the doctrine of respondeat superior alleged an employment relationship. The employer filed a motion for summary judgment that relied only on the allegations in the claimant's pleading "to support its argument that [the employee] was acting outside the scope of his employment." Majorana , 260 Va. at 525 , 539 S.E.2d 426 .

We held that summary judgment was improper because the rebuttable presumption arising out of the complaint supplied the necessary permissible inference that the tortfeasor had acted within the scope of his employment. See id. at 527 , 539 S.E.2d 426 (stating that "[t]he sole issue ... was whether the trial court erred by holding, as a matter of law, that the [pleading] did not state the necessary elements of respondeat superior within its factual allegations"); see also Plummer , 252 Va. at 237 , 476 S.E.2d 172 . Plummer and Majorana confirm the proper timing of the scope-of-employment presumption. It begins with the complaint, not the presentation of evidence at trial.

Addressing Carilion's second point, that Parker's complaint and its factual inferences themselves rebutted the presumption, the resolution of that issue depends on what the presumption actually presumes. Quite a lot, apparently, if we were to grant Parker's requested remedy: "Upon remand," Parker argues, the circuit court "should be instructed that when an employee is allowed access to medical information as part of their employment with a health care provider, and the employee wrongfully distributes or discloses such confidential information, they are acting within the scope of their employment as a matter of law." Appellant's Suppl. Br. at 8.

From Parker's perspective, neither her complaint nor its factual inferences could possibly provide a basis for self-refutation because "[u]nder these facts there is respondeat superior liability of the master-employer as a matter of law." Id. at 9. In response, Carilion argues that Parker "has affirmatively alleged facts demonstrating that [Davis and Young] were not acting within the scope of their employment," and thus, the circuit court properly dismissed the complaint as a matter of law. 7 Appellees' Suppl. Br. at 19 (emphasis in original).

We cannot fully agree with either Parker or Carilion.

2. The Job-Related-Service Principle

"[C]ommon-sense is opposed to making one man pay for another man's wrong." Oliver Wendell Holmes, Jr., Agency , 5 Harv. L. Rev. 1 , 14 (1891). On the strength of this premise, we have insisted that "[a] master is not liable for every wrong which a servant may commit during the continuance of an employment." E.H. Abernathy v. Romaczyk , 202 Va. 328 , 332, 117 S.E.2d 88 (1960) (citation *819 omitted); see also McNeill v. Spindler , 191 Va. 685 , 694, 62 S.E.2d 13 (1950) (same). Virginia has not recognized such an omnipotent form of vicarious liability. See, e.g. , Appalachian Power Co. v. Robertson , 142 Va. 454 , 466, 129 S.E. 224 (1925) (stating that "if the act be done while the servant is at liberty from service, and pursuing his own ends, exclusively, there can be no question of the freedom from liability, even if the injury could not have been committed without facilities afforded to the servant by his relations to the master" (citation omitted) ). Instead, under the traditional "doctrine of respondeat superior, an employer is liable for the tortious act of his employee if the employee was performing his employer's business and acting within the scope of his employment." Kensington Assocs. v. West , 234 Va. 430 , 432, 362 S.E.2d 900 (1987).

Restating the doctrine in such low-resolution terms, however, has led to "difficulties" in its application, Giant of Md., Inc. v. Enger , 257 Va. 513 , 516, 515 S.E.2d 111 (1999), and has proven to be conceptually "vexatious," Gina Chin & Assocs. v. First Union Bank , 260 Va. 533 , 541, 537 S.E.2d 573 (2000), and "perplexing," Kidd v. De Witt , 128 Va. 438 , 443, 105 S.E. 124 (1920). Less charitable observations suggest that the "highly indefinite" scope-of-employment phrase is

"devoid of meaning in itself" and is "obviously no more than a bare formula to cover the unordered and unauthorized acts of the servant for which it is found to be expedient to charge the master with liability, as well as to exclude other acts for which it is not."

Faragher v. City of Boca Raton , 524 U.S. 775 , 796, 118 S.Ct. 2275 , 141 L.Ed.2d 662 (1998) (citation omitted).

Aware of these doctrinal vagaries, we hold to the belief first expressed over a century ago that "the only safe course to pursue is to revert to first principles, and adhere to ancient landmarks" rather than yielding to some "new principle sought to be engrafted upon the law" for the alleged purpose of addressing "supposed exigencies of new conditions." Blair v.Broadwater , 121 Va. 301 , 308, 93 S.E. 632 (1917) (declining to customize the doctrine of respondeat superior to the "advent of automobiles"); see also Kidd , 128 Va. at 443 , 105 S.E. 124 (same). In Virginia, the first principle of respondeat superior is that vicarious liability may be imposed on an employer when "the service itself , in which the tortious act was done, was within the ordinary course of [the employer's] business," i.e., when the employee committed the tort while "performing a normal function" of his assigned job. Gina Chin , 260 Va. at 543, 545, 537 S.E.2d 573 (emphasis added) (quoting Davis v. Merrill , 133 Va. 69 , 78, 112 S.E. 628 (1922) ); see also Commercial Bus. Sys., Inc. v. BellSouth Servs., Inc. , 249 Va. 39 , 44, 453 S.E.2d 261 (1995) (same). "We have consistently applied this test in our jurisprudence." Giant of Md., Inc. , 257 Va. at 516 , 515 S.E.2d 111 .

To put the matter succinctly, "[t]he doctrine of respondeat superior applies only when the relation of master and servant is shown to exist between the wrongdoer and the person sought to be charged for the result of some neglect or wrong at the time and in respect to the very transaction out of which the injury arose ."

Manuel v. Cassada , 190 Va. 906 , 913, 59 S.E.2d 47 (1950) (emphasis in original) (citation omitted); see also Barnes v. Hampton , 149 Va. 740 , 744-45, 141 S.E. 836 (1928) (same); Blair , 121 Va. at 308 , 93 S.E. 632 (same).

Under this job-related-service principle, while it is true that vicarious liability "is not limited to those acts of the servant which promote the object of the employment," it is equally true that no such liability can be imposed if the tortious act did not arise out of the "very transaction," Manuel , 190 Va. at 913 , 59 S.E.2d 47 (emphasis and citation omitted), or service or task, that the employee was being paid to perform. "This is true, although the employee was using the master's property and the injury would not have been caused without the facilities afforded the employee by reason of his relation to his employer." Bryant v. Bare , 192 Va. 238 , 244, 64 S.E.2d 741 (1951) ; see also Master Auto Serv. Corp. v. Bowden , 179 Va. 507 , 510, 19 S.E.2d 679 (1942).

*820 The job-related-service principle has arisen in many intentional-tort contexts, 8 including one in which a "contract negotiator and administrator" committed fraud while "in the execution of the services for which he was employed." Commercial Bus. Sys., Inc. , 249 Va. at 46 , 453 S.E.2d 261 . The employer had authorized the "service itself" (negotiating a contract), id. at 44, 453 S.E.2d 261 (emphasis and citation omitted), which the employee performed, but had not authorized the tortious act (self-dealing), which the employee performed wholly out of self-interest. We nonetheless held that "the trial court erred in granting summary judgment in favor of" the employer because the employee, though acting against his employer's interests, did so entirely within the ambit of the particular "services" that his employer had expected him to perform. Id. at 46, 453 S.E.2d 261 ; see also Majorana , 260 Va. at 527, 539 S.E.2d 426 (reversing an entry of summary judgment against a claim alleging that a gas station attendant committed a tortious act within the scope of his employment when he assaulted the claimant during a sales transaction); Plummer , 252 Va. at 237-38 , 476 S.E.2d 172 (reversing a grant of a demurrer on a motion for judgment asserting that a psychologist committed a tortious act within the scope of his employment when he engaged in sexual intercourse with a patient while treating her for mental-health problems).

We came to a similar conclusion in Gina Chin , a case in which a bank teller had accepted forged checks for deposit for his own gain. Vicarious liability could apply, we held, because the employee "was performing a normal function of a bank teller in accepting checks for deposit." Gina Chin , 260 Va. at 545, 537 S.E.2d 573 (emphasis added). The " 'service itself, in which the tortious act was done, was within the ordinary course of' the employer's business" because "accepting checks for deposit" was "a service within the ordinary course of" the bank's business. Id. at 544, 537 S.E.2d 573 . This observation was a crucial aspect of our conclusion. The bank would not have been vicariously liable if a janitor working for the bank had stepped aside from the "normal function," id. at 545, 537 S.E.2d 573 , of a janitor - that is, stepped aside from his or her "general job activity," 2 Dobbs et al., supra note 3, § 429, at 797 - to deposit a customer's forged check.

In each of these cases - Plummer , Majorana , and Gina Chin - the tortious act or transaction occurred while the employee was in fact performing a specific job-related service for the employer, and, but for the employee's wrongdoing, the service would otherwise have been within the authorized scope of his employment. To be sure, "[i]n many cases, perhaps most, an employee's intentional torts are purely personal acts and thus not within the scope of employment." Id. § 429, at 796. 9

Chief Justice Hassell emphasized this point on behalf of a unanimous Court in Giant of Maryland, Inc. , 257 Va. at 516 , 515 S.E.2d 111 . In that case, a grocery store manager directed a store employee to pick up a piece of celery. The employee refused, threatened the manager, and assaulted a co-worker who tried to intervene. A customer then attempted to speak to the employee, and the employee assaulted her too. All of these events occurred during a work-related argument between the employee and his boss over the employee's performance.

The circuit court let the case go to a jury and instructed the jury that "if the tortious act of the employee arose out of an activity which was within the employee's scope of employment or within the ordinary course of business, then that act may be considered to be within the scope of employment." Id. at 515, 515 S.E.2d 111 . We held that this broad, *821 unqualified statement of the rule was in error:

A comparison of our established test with the challenged jury instruction compels us to conclude that the jury instruction is erroneous. Under our aforementioned test, an employer is responsible for an employee's tortious act if that act was within the scope of the duties of the employment and in the execution of the service for which the employee was engaged .

Id. at 516, 515 S.E.2d 111 (emphases added). After restating the job-related-service principle, we explained why the broader language of the jury instruction was flawed:

The challenged jury instruction differs from the test that we have consistently applied because the instruction allows the jury to find the employer liable for any tort committed during the employee's employment, even if the service that the employee was performing when he committed the tortious acts was not within the ordinary course of the employer's business or not within the scope of the employee's authority .

Id. at 516-17, 515 S.E.2d 111 (emphasis added).

In short, "our established test" limits respondeat superior liability to tortious acts performed "within the scope of the duties of the employment and in the execution of the service for which the employee was engaged." Id. at 516, 515 S.E.2d 111 (emphases added). It simply is not enough, as the erroneous jury instruction in Giant of Maryland, Inc. stated, that the employee's claim " arose out of an activity which was within the employee's scope of employment or within the ordinary course of business." Id. at 515, 515 S.E.2d 111 (emphasis added). Instead, the employee must have committed the tort while actively engaged in a job-related service . Respondeat superior liability cannot be established merely by showing that the employee was "on the clock," using the employer's property, or on the employer's premises at the time of the alleged tortious acts or omissions. See generally Charles E. Friend, Personal Injury Law in Virginia § 9.2(A)(2)(a), at 205-07 (3d ed. 2003). 10

3. External, Independent, and Personal Motives

The employee's motive in committing the tortious act plays a role in the job-related service doctrine. For nearly a century, see Kidd , 128 Va. at 444 , 105 S.E. 124 , we have stated that respondeat superior liability cannot extend to an employer for an unauthorized tortious act by an employee arising " wholly from some external, independent, and personal motive on the part of the [employee] to do the act upon his own account," Smith v. Landmark Commc'ns, Inc. , 246 Va. 149 , 151-52, 431 S.E.2d 306 (1993) (emphasis added) (citation omitted). Though our application of this concept has been less than consistent, our adherence to the underlying principle has not wavered. See id. ; Sayles v. Piccadilly Cafeterias, Inc. , 242 Va. 328 , 332, 410 S.E.2d 632 (1991) ; Kensington Assocs. , 234 Va. at 432 , 362 S.E.2d 900 ; Broaddus v. Standard Drug Co. , 211 Va. 645 , 653, 179 S.E.2d 497 (1971) ; United Bhd. of Carpenters & Joiners v. Humphreys , 203 Va. 781 , 787, 127 S.E.2d 98 (1962) ; Slaughter v. Valleydale Packers, Inc. , 198 Va. 339 , 343, 94 S.E.2d 260 (1956) ; Tri-State Coach Corp. v. Walsh , 188 Va. 299 , 307, 49 S.E.2d 363 (1948) ; Davis , 133 Va. at 77 , 112 S.E. 628 ; Kidd , 128 Va. at 444 , 105 S.E. 124 .

The requirement that the tortious act "not arise wholly from some external, independent, and personal motive" of the employee, Smith , 246 Va. at 152 , 431 S.E.2d 306 (citation omitted), tracks analogous requirements in the second and third Restatements of Agency. Both make clear that a servant's tortious act "is withi[n] the scope of employment if, but only if ... it is actuated, at least in part , by a purpose to serve the master,"

*822 Restatement (Second) of Agency § 228(1)(c) (1958) (emphasis added), or, put another way, "[a]n employee's act is not within the scope of employment when it occurs within an independent course of conduct not intended by the employee to serve any purpose of the employer," Restatement (Third) of Agency § 7.07(2) (2006) (emphasis added).

As we explained in Gina Chin , "generally" speaking, an employee does not "commit[ ] a willful and wrongful act that results in injury to others ... 'with the intent to further the employer's interest.' " 260 Va. at 541, 537 S.E.2d 573 . "However, that does not resolve the legal issue presented, as a matter of law," concerning the applicability of respondeat superior liability. Id. at 542, 537 S.E.2d 573 . In such cases, inquiring into the employee's intent to further the employer's interest in isolation improperly reduces the job-related-service principle to "a simplistic determination." Id.

Admittedly, the trial court's task may be particularly difficult in cases in which the injury is caused by an intentional, often criminal, tortious act which clearly would not have been contemplated by the employer as being within the scope of employment, but which nonetheless was performed incident to the employment and even facilitated thereby.

Id. at 542-43, 537 S.E.2d 573 . That said, "[w]e emphasize[d] that the employee's improper motive is not irrelevant to the issue whether the act was within the scope of employment." Id. at 543, 537 S.E.2d 573 (emphasis added). To the contrary, "it is merely a factor to be considered in making that determination, and, unless the deviation from the employer's business is slight on the one hand, or marked and unusual on the other, but falls instead between those two extremes, the question is for the jury." Id. at 543-44, 537 S.E.2d 573 .

4. Parker's Complaint Established a Rebuttable Presumption

In this case, Parker alleged that Davis and Young had committed the torts in the context of their employment with Carilion. 11 These allegations created a rebuttable presumption that facts exist (though not specifically pleaded) that would satisfy the "established test" for vicarious liability: that Davis and Young committed tortious acts "within the scope of [their] duties of ... employment and in the execution of the service for which [they were] engaged." Giant of Md., Inc. , 257 Va. at 516 , 515 S.E.2d 111 .

Carilion acknowledges that the presumption applies but contends that the express allegations in Parker's complaint rebut the presumption. We agree that, in theory, such an argument could have merit. A plaintiff can plead herself out of court by affirmatively alleging facts that rebut the presumption implied in law - no differently than a litigant at trial can rely on an evidentiary presumption and yet assert facts that undermine it. At the demurrer stage of a case, however, the self-refutation must be clear, not conjectural, and irrefutable rather than debatable. In this case, the rebuttal inferences that Carilion asserts are not strong enough to defeat the presumption and thereby establish, based solely on the pleadings, "that the defendant could not, as a matter of law, be held vicariously liable." Appellees' Suppl. Br. at 18.

Facts that come to light later might affirm or disaffirm the presumption. The scope-of-employment "presumption disappears in the face of positive facts to the contrary." McNeill , 191 Va. at 694 , 62 S.E.2d 13 ; see also Barnes , 149 Va. at 744 , 141 S.E. 836 (finding that the defendant "overc[a]me the burden and established the nonexistence of the relation at the time the injury was inflicted ... by positive and uncontradicted evidence"). If that happens, the burden of persuasion rests on the plaintiff to prove that Davis and Young's "duties of ... employment," Giant of Md., Inc. , 257 Va. at 516 , 515 S.E.2d 111 , included handling confidential patient records, that they were engaged "in the execution of [that] service for which" they were employed, id. , and that Davis and Young did not act " wholly from some external, *823 independent, and personal motive," Smith , 246 Va. at 151-52 , 431 S.E.2d 306 (emphasis added) (citation omitted). Because none of these factual contests can be addressed at the pleading stage of this case, we reverse the circuit court's order sustaining Carilion's demurrer to the respondeat superior claim.

C. CARILION'S DIRECT LIABILITY

On appeal, Parker contends that her complaint stated two theories of direct liability against Carilion: first, a claim under the tort duty recognized in Fairfax Hospital , and second, a state-law negligence per se claim based upon Carilion's alleged HIPAA violations.

1. Wrongful-Disclosure Tort Liability

Parker's first argument in support of a direct tort claim against Carilion relies on our holding in Fairfax Hospital . In that case, we held that absent a statute to the contrary or a risk of "serious danger to the patient or others," "a health care provider owes a duty to the patient not to disclose information gained from the patient during the course of treatment without the patient's authorization, and that [a] violation of this duty gives rise to an action in tort." Fairfax Hosp. , 254 Va. at 442 , 492 S.E.2d 642 . From this holding, Parker constructs a simple syllogism: (i) Carilion had a duty to not disclose her confidential information without her permission; (ii) two Carilion employees did just that; and (iii) Carilion therefore breached its duty. We see two problems with this argument.

First, it fails to police the conceptual boundaries between vicarious liability and direct liability. If an employer "has himself committed a wrong against the plaintiff, [the employer] may be held liable for his own wrongdoing . This is not vicarious liability." Friend, supra , § 9.1, at 201 (emphases in original). Liability based upon the employer's own tortious conduct "is not traditionally conceived as vicarious liability." 2 Dobbs et al., supra note 3, § 425, at 782. While ignoring this distinction, Parker correctly states the obvious that "[c]orporate health care providers only provide health care through their employees." Appellant's Br. at 19. The point of the respondeat superior doctrine is to draw a distinction between circumstances in which employers should be liable for their employees' misdeeds and circumstances in which they should not. Parker's syllogism, if true, would cut respondeat superior principles completely out of our common-law tradition.

Second, Parker fails to allege that Davis and Young acted with the requisite corporate authority. A corporate defendant may be liable as a primary tortfeasor (independent of respondeat superior liability) if it authorized, directed, ratified, or performed the tortious conduct through those who, under the governing management structure, had the discretionary authority to act on behalf of the corporation. 12 In the corporate context, this statement would include corporate officers acting with authority under the corporate bylaws or boards of directors acting with authority under the corporate charter.

In contrast, if a mere employee commits the tortious conduct, the corporate employer will not be subject to direct liability, technically speaking, but rather only to respondeat superior liability. Cf. Phillips Oil Co. v. Linn , 194 F.2d 903 , 905 (5th Cir. 1952) ("Corporate liability for the negligent acts of a mere servant or employee rests upon the *824 doctrine of respondeat superior. The liability of the master for the negligent acts of his vice principal is placed upon very different grounds, namely, that the negligent acts of the vice principal are the very acts of the corporation itself." (citations omitted) ); GTE Sw., Inc. v. Bruce , 956 S.W.2d 636 , 641-42 (Tex. App. 1997) ("Those whose conduct creates direct corporate liability include corporate officers, those who have authority to employ, direct, and discharge servants of the master, those engaged in the performance of nondelegable or absolute duties of the master, and those to whom a corporation has confided the management of the whole or a department or division of its business."), aff'd , 998 S.W.2d 605 , 618 (Tex. 1999).

Parker does not allege that Davis and Young were corporate officers or authorized agents of Carilion. As a result, Carilion can only be liable, if at all, for the tortious acts of Davis and Young under respondeat superior principles. The circuit court therefore correctly sustained the demurrer to any claim of direct liability for breach of the duty of non-disclosure recognized in Fairfax Hospital .

2. Negligence Per Se & HIPAA

HIPAA requires healthcare providers to "maintain reasonable ... safeguards ... to ensure the integrity and confidentiality of the" patient's confidential medical information and "to protect against any reasonably anticipated ... unauthorized uses or disclosures of" such information. 42 U.S.C. § 1320d-2(d)(2) (2012). Its purpose, as stated in its title, is

to improve portability and continuity of health insurance coverage in the group and individual markets, to combat waste, fraud, and abuse in health insurance and health care delivery, to promote the use of medical savings accounts, to improve access to long-term care services and coverage, to simplify the administration of health insurance, and ... other purposes.

110 Stat. at 1936. Similarly, the provisions dealing with unauthorized disclosure of confidential medical information are found in Title II, Subtitle F of HIPAA, the stated purpose of which is

to improve the Medicare program under title XVIII of the Social Security Act, the medicaid program under title XIX of such Act, and the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information.

HIPAA § 261, 110 Stat. at 2021. Alleging that Carilion failed to comply with HIPAA, Parker contends that she has a negligence per se remedy under Virginia common law and under Code § 8.01-221. We disagree.

The starting point in our analysis is the observation that "the violation of a statute does not, by that very fact alone, constitute actionable negligence or make the guilty party negligent per se." Williamson v. Old Brogue, Inc. , 232 Va. 350 , 355, 350 S.E.2d 621 (1986). The reason is that under Virginia law

the doctrine applies only where there is a common-law cause of action . The doctrine of negligence per se does not create a cause of action where one did not exist at common law. Thus, the doctrine does not create a duty of care. It merely sets a standard of care by which the defendant may be judged in the common-law action.

Friend, supra , § 2.3.2(A), at 23 (3d ed. 2003 & Supp. 2017) (emphases in original) (endnotes omitted).

"In other words, a statute may define the standard of care to be exercised where there is an underlying common-law duty , but the doctrine of negligence per se does not create a cause of action where none otherwise exists." Williamson , 232 Va. at 355 , 350 S.E.2d 621 (emphasis added). The absence of an underlying common-law duty renders the presence of a statutory standard of care irrelevant. To be sure, we have specifically considered the counter arguments against this basic premise and have expressly rejected them. See Steward v. Holland Family Props., LLC , 284 Va. 282 , 287, 290, 726 S.E.2d 251 (2012) (reiterating that "a statute setting the standard of care does not create the duty of care" and disclaiming any inference that prior cases "reversed the long-standing rule that an applicable duty of care must be shown in a negligence case" or that any precedent in Virginia has "created a new *825 rule that a statute setting a standard of care also creates the duty of care"). 13

Framed properly, therefore, a negligence per se claim predicated on a statutory violation

requires a showing that [i] the tortfeasor had a duty of care to the plaintiff, [ii] the standard of care for that duty was set by statute, [iii] the tortfeasor engaged in acts that violated the standard of care set out in the statute, [iv] the statute was enacted for public health and safety reasons, [v] the plaintiff was a member of the class protected by the statute, [vi] the injury was of the sort intended to be covered by the statute, and [vii] the violation of the statute was a proximate cause of the injury.

Id. at 287 , 726 S.E.2d 251 (citing McGuire v. Hodges , 273 Va. 199 , 206, 639 S.E.2d 284 (2007) ). Pragmatically speaking, "[t]he effect of the doctrine of 'negligence per se,' when applicable, is that it establishes the second element of common-law negligence - breach of duty - by reference to a statutory standard rather than the common-law 'ordinary prudent person' standard." Kent Sinclair, Sinclair on Virginia Remedies § 25-4[A], at 25-26 (5th ed. 2016); see also 1 Friend & Sinclair, supra note 3, § 25.02[7], at 25-18. 14

Parker's negligence per se argument based on HIPAA finds no support in Virginia law. None of our precedents has ever imposed a tort duty on a healthcare provider to manage its confidential information systems so as to deter employees from willfully gaining unauthorized access to confidential medical information. Parker argues that Fairfax Hospital permits an inference that such a duty exists. See Reply Br. at 3-4, 9-10 (arguing that Fairfax Hospital creates the underlying tort duty forming the basis of her negligence per se claim and that Carilion's assertion that there is no duty to protect confidential information would "gut the ruling in Fairfax Hospital and endanger" patients); Oral Argument Audio at 1:13 to 2:03, 12:53 to 13:25, 29:33 to 30:58 (arguing that the duty not to disclose includes the duty to safeguard). We disclaim any such inference.

Fairfax Hospital broke new ground. See Pierce v. Caday , 244 Va. 285 , 290-91, 422 S.E.2d 371 (1992) (addressing the duty of non-disclosure and stating that "we easily could adopt" a tort remedy but finding it "unnecessary ... to recognize expressly the existence of such a cause of action in Virginia in order to decide this case"). For that reason, when we did expressly recognize the tort in Fairfax Hospital , we cautiously limited our holding:

We hold that in the absence of a statutory command to the contrary, or absent a serious danger to the patient or others, a health care provider owes a duty to the patient not to disclose information gained from the patient during the course of treatment without the patient's authorization, and that violation of this duty gives rise to an action in tort .

*826 254 Va. at 442 , 492 S.E.2d 642 (emphases added). The distinction between a duty to protect and a duty not to disclose is not merely semantic. A non-disclosure duty can be breached when an employer authorizes the disclosure as in Fairfax Hospital . It can also be breached vicariously by the employer when its employees, operating within the reach of respondeat superior principles, disclose the information without authorization. In contrast, a duty to manage confidential information systems in a particular manner so as to prevent employees from gaining unauthorized access could be breached even if the employer had nothing at all to do with the actual disclosure and even if employees acting outside the scope of their employment willfully made the unauthorized disclosure. In other words, allowing negligence per se liability for failure to secure confidential information would subject the employer to liability that is even more attenuated and derivative than respondeat superior principles allow in the non-disclosure context.

No Virginia precedent has imposed such a tort duty on healthcare providers. 15 "The issue whether a legal duty in tort exists is a pure question of law." Kellermann v. McDonough , 278 Va. 478 , 487, 684 S.E.2d 786 (2009). The absence of a tort duty under Virginia law renders irrelevant the statutory standard of care under HIPAA. The circuit court thus did not err in sustaining Carilion's demurrer to the extent that the demurrer sought the dismissal of Parker's negligence per se claim. 16

Finally, we acknowledge, but find inconsequential, Parker's invocation of Code § 8.01-221. In relevant part, that statute provides that

[a]ny person injured by the violation of any statute may recover from the offender such damages as he may sustain by reason of the violation, even though a penalty or forfeiture for such violation be thereby imposed, unless such penalty or forfeiture be expressly mentioned to be in lieu of such damages.

For more than a century, however, we have construed this statute and its predecessors

merely to preserve to any injured person the right to maintain his action for the injury he may have sustained by reason of the wrong-doing of another, and to prevent the wrong-doer from setting up the defence that he had paid the penalty of his wrong-doing under a penal statute. It cannot be supposed that, in enacting [ Code §] 8.01-221, the Legislature had the remotest *827 idea of creating any new ground for bringing an action for damages.

Vansant & Gusler, Inc. v. Washington , 245 Va. 356 , 360, 429 S.E.2d 31 (1993) (alteration and citation omitted); see also Connelly v. Western Union Tel. Co. , 100 Va. 51 , 62-63, 40 S.E. 618 (1902) (quoting Tyler v. Western Union Tel. Co. , 54 F. 634 , 637 (W.D. Va. 1893) ) (same).

For over a century, we have held to the view that neither Code § 8.01-221 nor its predecessors created a "new right of action for damages" based upon statutory violations. Vansant & Gusler, Inc. , 245 Va. at 361 , 429 S.E.2d 31 . Instead, the statute merely recognizes, but does not supplant, existing common-law principles framing the negligence per se doctrine. Admittedly, "one might well wonder why the statute was passed." 1 Friend & Sinclair, supra note 3, § 26.18, at 26-79. The answer is that the statute expressly "prevent[s] the wrong-doer from setting up the defence that he had paid the penalty imposed under a penal statute." Hortenstine v. Virginia-Carolina Ry. , 102 Va. 914 , 924, 47 S.E. 996 (1904) (citing Connelly , 100 Va. at 62 , 40 S.E. 618 ), superseded by statute on other grounds , Code § 6118 (1919), as recognized in Kelly v. Schneller , 148 Va. 573 , 577-78, 139 S.E. 275 (1927). 17

Adhering to our settled precedent interpreting Code § 8.01-221, we decline Parker's invitation to reinterpret it as a legislative directive to transform alleged federal HIPAA violations into a state-law, negligence per se claim.

IV. CONCLUSION

We agree with Parker that the circuit court erred in its order granting the demurrer to the extent that it dismissed Parker's respondeat superior claim against Carilion. We therefore reverse the circuit court's judgment on this issue. We disagree with Parker regarding Carilion's direct liability under Fairfax Hospital and under the doctrine of negligence per se. We thus affirm the circuit court's judgment on these issues. We remand this case for further proceedings consistent with this opinion.

Affirmed in part, reversed in part, and remanded.

I concur with the majority's conclusion that the circuit court erred by sustaining Carilion's demurrer to Parker's respondeat superior claim. The allegations in her complaint were sufficient to create a presumption that Davis and Young were acting within the scope of their employment, and Carilion has not rebutted that presumption. * I also concur with the majority's conclusion that the court did not err by sustaining Carilion's demurrer to her negligence per se claims. However, I must write separately to differentiate myself from the majority on the role employees' motives play in the determination of whether they acted within the scope of their employment.

I disagree with the majority opinion's analysis of how to determine whether employees *828 act within the scope of their employment, thereby making their employers liable for their actions. While there is nothing controversial in the majority opinion's statement in Part III(B)(2) that the doctrine of respondeat superior limits an employer's exposure to vicarious liability to instances wherein the employee acted within the scope of his or her employment, the problem has been determining what "the scope of employment" means. We said a century ago that "[t]he difficulty, as has been often remarked, lies not in the uncertainty of the principle we are considering, but in its application." Henry Myers & Co. v. Lewis , 121 Va. 50 , 64, 92 S.E. 988 (1917). "The decisions of cases [even by 1917] on the one side or the other of the border [between whether an employee has acted within the scope of employment or outside it] are not all in accord; or [even] reconcilable, indeed, on principle." Id . at 75, 92 S.E. 988 . The intervening years have not been illuminating, and the majority opinion may only add to the confusion.

The majority opinion declares that the first principle of respondeat superior is that an employer may be vicariously liable only when the service in which the employee's tortious act was done was within the ordinary course of the employer's business. Ante at 819 (citing Gina Chin & Assocs. v. First Union Bank , 260 Va. 533 , 543, 537 S.E.2d 573 (2000), Giant of Md., Inc. v. Enger , 257 Va. 513 , 516, 515 S.E.2d 111 (1999), Commercial Bus. Sys., Inc. v. BellSouth Servs., Inc. , 249 Va. 39 , 44, 453 S.E.2d 261 (1995), and Davis v. Merrill , 133 Va. 69 , 78, 112 S.E. 628 (1922) ). The majority opinion correctly divides this issue into two questions, but I fear it may lead readers to conflate them. The first question seeks to ascertain the employee's task or function (which the majority opinion describes as the employee's service). In short, we must answer, what did the employer pay the employee to do? The second question seeks to ascertain whether the encounter-which need not be physical or face-to-face-between the employee and the plaintiff in which the tortious act occurred (which the majority opinion describes as the transaction) was within that task or function. The first question evaluates the relationship between the employer and the employee; the second question evaluates the relationship between the employee and the plaintiff, insofar as they are brought into contact by their respective relationships with the employer.

This distinction is important. The first question does not focus on the particular act the employee committed, but on whether the employer "has put the [employee] in his place to do that class of acts." Henry Myers , 121 Va. at 65, 92 S.E. 988 (internal quotation marks omitted). If so, "he must be answerable for the manner in which the [employee] has conducted himself in doing the business which it was the act of the master to place him in." Id. (emphasis and internal quotation marks omitted). Thus, for example, the bank in Gina Chin that employed a teller who knowingly deposited forged checks into his brother's girlfriend's account, 260 Va. at 537, 537 S.E.2d 573 , was subject to liability because "accepting checks for deposit" is "a normal function of a bank teller." Id. at 545, 537 S.E.2d 573 .

The more important point, on which I diverge from the majority opinion, is in respect to the role of the employee's motive. The majority opinion takes our previous statements about individual motive and unduly emphasizes them. The personal motive of the employee is not the controlling factor in determining whether the employer is vicariously liable for his or her tortious acts. To the contrary, the employee's personal motive may be so outweighed by the nexus between the employee's tortious act and the scope of his or her employment that the question of motive is almost eclipsed by it.

This point is illustrated with two observations. First, when repeating the rule that the employee's tortious act must not "arise wholly from some external, independent, and personal motive on the part of the employee," ante at 821 (citing Smith v. Landmark Commc'ns, Inc. , 246 Va. 149 , 151-52, 431 S.E.2d 306 (1993) ) (emphasis omitted), the majority opinion omits the language preceding it that allows for employer liability when the tortious act is done "from some impulse or emotion which naturally grew out of or was incident to the attempt to perform the *829 master's business." E.g. , Davis , 133 Va. at 77 , 112 S.E. 628 .

For example, in Davis , a gateman at a railroad crossing shot at a car whose driver insisted that he open the gate in the middle of the night. Id. at 71-72, 112 S.E. 628 . In Tri-State Coach Corp. v. Walsh , 188 Va. 299 , 303, 49 S.E.2d 363 (1948), a bus driver punched the plaintiff after he drove his car between the bus and the curb, ignoring the bus driver's signaled intention to turn in that direction. In both cases, we determined that the tortious acts were so inextricably intertwined with the job that the employer paid the employee to do that the employee's motive was no defense to the employer's liability.

In Davis , we wrote that

[i]f a person, acting for himself, wilfully and maliciously inflict an injury upon another, he is liable in damages for such injury. And there is no reason why a master should be permitted to turn his business over to servants who have no regard for the public welfare and thereby escape the responsibility which he would otherwise have to bear. It is manifestly right and just that both corporations and individuals be required to answer in damages for wanton and malicious assaults inflicted within the scope of the servant's employment and duty, and it matters not whether the act of the servant is due to a lack of judgment, infirmity of temper, or the influence of passion, or that the servant goes beyond his strict line of duty and authority in inflicting such injury.

133 Va. at 74 , 112 S.E. 628 (emphasis added).

Similarly, in Tri-State Coach , we wrote that, "[t]hough this was an intentional and wilful tort, the jury was justified in concluding that it was the result of an impulse or emotion which directly arose out of the prosecution of the master's business and was within the course of the employment." 188 Va. at 305 , 49 S.E.2d 363 . We continued that

the wilfulness or wrongful motive which moves an employee to commit an act which causes injury to a third person does not of itself excuse the employer's liability therefor. The test of liability is not the motive of the employee in committing the act complained of, but whether that act was within the scope of the duties of employment and in the execution of the service for which he was engaged.

Id. at 305-06, 49 S.E.2d 363 (quoting 35 Am. Jur., Master and Servant § 560, at 994-95 (1941) ) (emphasis added).

The cited section of American Jurisprudence begins by noting that

under the earlier common law it seems to have been the accepted view of many courts that an employer was not liable for the malicious or intentional torts of his employee even though committed by the latter while forwarding the master's business. According to this view, the wilful act of the employee was deemed to be a departure from the employer's business, or was presumed prima facie to be outside the scope of the employment. The courts, however, have long since departed from the rule of nonliability of an employer for wilful or malicious acts from his employee .

35 Am. Jur., Master and Servant § 560, at 994-95 (1941) (emphasis added). Thus, the idea that the employee's motive alone could excuse the employer from vicarious liability was "long" obsolete even in 1941. Rather, as the next section explains, "[t]he general rule is that the master is liable for all tortious acts of the servant committed by such servant while acting within the scope of his employment." Id. at § 561, pp. 995-96.

Consequently, the majority opinion's emphasis is in the wrong place when it opines that an employee's personal motive can excuse the employer from vicarious liability, regardless of the proximity of the employee's tortious act to the scope of his or her employment. We expressly ruled in Davis that the employee's gunshots were motivated by his anger at being asked to raise the gate in the middle of the night, but affirmed the judgment against the employer because he fired the shots as part of the encounter that began when the chauffeur made the request, which was clearly within the employee's function to fulfill. 133 Va. at 78, 81 , 112 S.E. 628 .

Likewise, in Tri-State Coach , we noted that "the altercation [between the bus driver *830 and the plaintiff] arose about the manner in which [the driver] was operating the bus." 188 Va. at 304 , 49 S.E.2d 363 . "[T]he tort was inflicted by [the bus driver] in asserting his claim and in executing the service for which he was employed. The blow was struck before the turn was negotiated and it was a part of [the bus driver's] contention that he was rightfully in position on the highway to make such turn." Id. We therefore affirmed the judgment against the bus driver's employer. Id. at 311, 49 S.E.2d 363 .

These cases illustrate that an employee's tortious act motivated by emotion or passion provoked from the very performance of the task or function that his or her employer pays him or her to do may result in the employer's vicarious liability.

The second observation is that in Gina Chin , we expressly noted that the employee's motive "is not determinative of whether" the tortious act took place within the scope of the employment. 260 Va. at 543, 537 S.E.2d 573 (citing Commercial Business Systems , 249 Va. at 45 , 453 S.E.2d 261 , and Tri-State Coach , 188 Va. at 305-06 , 49 S.E.2d 363 ). To the contrary, motive is subordinate to the question of whether the employee was doing what the employer paid him or her to do when he or she committed the tortious act. Id. Otherwise, the bank in Gina Chin could hardly have been subject to vicarious liability for the tortious acts of its teller: we specifically noted that he "was acting out of self-interest" and "his conduct was 'outrageous and violative of his employer's rules.' " Id. at 545, 537 S.E.2d 573 (quoting Commercial Business Systems , 249 Va. at 46 , 453 S.E.2d 261 ). Surely there can be few clearer examples of an employee acting "wholly from some external, independent, and personal motive," ante at 821, than when a bank teller deposited knowingly forged checks into an accomplice's bank account in exchange for a share of the stolen proceeds. There is no question that he did not purport to further his employer's interest in any degree. See Gina Chin , 260 Va. at 542, 537 S.E.2d 573 . Yet we reversed the circuit court's ruling sustaining the bank's motion to strike and awarding it summary judgment in that case. Id. at 545-46, 537 S.E.2d 573 . The majority opinion suggests that the role of personal motive it articulates today is consistent with Gina Chin , ante at 17, 537 S.E.2d 573 , but it does not explain how the bank in that case could have been vicariously liable for the teller's acts if his motive were considered the way the majority opinion now purports to require.

Gina Chin is no outlier. In Commercial Business Systems , a computer repair company's employee accepted bribes from one subcontractor to allow another subcontractor's contract to expire and award the replacement contract to the former. 249 Va. at 42-43 , 453 S.E.2d 261 . When the latter sued, the circuit court in that case awarded the employer summary judgment. We reversed in this case, too, id. at 50-51, 453 S.E.2d 261 , despite expressly ruling that the employee's "motive was personal-to advance his self-interest, rather than the interest of [his employer]." Id. at 46, 453 S.E.2d 261 . The dispositive issue was that the employee was clearly performing the function for which he had been employed. Id.

In Plummer v. Center Psychiatrists , 252 Va. 233 , 235, 476 S.E.2d 172 (1996), a psychologist sexually assaulted a patient, who sued his employer. On demurrer, the employer argued that the psychologist had not acted within the scope of his employment as a matter of law because he acted solely from his personal interests. After the circuit court sustained the demurrer, we reversed, holding that the employer's assertion of personal motive did not rebut the presumption that the employee was acting within the scope of his employment. Id. at 237-38 , 476 S.E.2d 172 .

Thus, this line of cases, culminating in Gina Chin , stands for the proposition that we stated in that case: "the motive of the employee in committing the act complained of is not determinative of whether it took place within the scope of the employment relationship." 260 Va. at 543, 537 S.E.2d 573 . Rather, it is "merely a factor." Id.

I hasten to note that these holdings do not compel a verdict against the employer when the facts or allegations establish a clear nexus between the employee's tortious act and the scope of his or her employment because the act was committed while the employee *831 was performing the task or function that the employer paid him or her to do. Rather, they only require that the question of the employer's liability advance to a jury. Gina Chin , 260 Va. at 542, 537 S.E.2d 573 ; Plummer , 252 Va. at 235 , 476 S.E.2d 172 ; Commercial Business Systems , 249 Va. at 46 , 453 S.E.2d 261 . But the majority opinion's over-emphasis on the "wholly ... external, independent, and personal motive" question suggests that the assertion of such a motive by an employer will excuse it from vicariously liability as a matter of law. As we stated in Gina Chin and as the majority recognizes, the trial court's task may be particularly difficult in cases where the injury is caused by an intentional, often criminal, tortious act. My disagreement with the majority stems from its heavy focus on the motive of the employee, when we have consistently stated that the relevant issue is "whether the service itself, in which the tortious act was done, was within the ordinary course of [the employer's] business." Gina Chin , 260 Va. at 543, 537 S.E.2d 573 . Consequently, I cannot join in or concur with Parts III(B)(2), (3), and (4) of the majority opinion.