¶ 1. In this appeal, we are asked to recognize a common-law private right of action for damages resulting from the unjustified disclosure to a third party of information obtained by medical personnel during treatment. Plaintiff alleges in her lawsuit that she incurred damages as the result of an emergency room nurse informing a police officer that she was intoxicated, had driven to the hospital, and was intending to drive home. The trial court granted defendant Central Vermont Medical Center (CVMC) summary judgment based on its determination that nothing in the record supported an inference that the nurse's disclosure of the information was for any reason other than her good-faith concern for plaintiff's and the public's safety. In this opinion, we recognize a common-law private right of action for damages based on a medical provider's unjustified disclosure to third persons of information obtained during treatment. Like the trial court, however, we conclude that CVMC was entitled to judgment as a matter of law because, viewing the material facts most favorably to plaintiff and applying the relevant law we adopt today, we conclude that no reasonable factfinder could determine that the disclosure was for any purpose other than to mitigate the threat of imminent and serious harm to plaintiff and the public. Accordingly, we affirm the trial court's judgment.

I. Facts and Procedural History

¶ 2. The following facts are taken from the parties' statements of undisputed material facts, viewing them most favorably to plaintiff, the nonmoving party. 1 During the early morning hours of May 10, 2014, plaintiff drove herself to CVMC after lacerating her arm. She arrived at the emergency room at 2:12 a.m. The charge nurse (Clinical Nurse Coordinator) detected a heavy odor of alcohol on plaintiff's breath, and it became apparent to the nurse that plaintiff had been drinking. Members of the treatment team administered an alco-sensor test to assess plaintiff's level of intoxication. The test revealed a breath-alcohol concentration of .215, over two and one-half times the legal limit, at 2:40 a.m.

¶ 3. Based on information provided by plaintiff, the charge nurse understood that plaintiff did not have a ride home. After her laceration was treated, plaintiff did not meet the criteria for admission to the hospital and was cleared for discharge. She was discharged at 3:05 a.m.

¶ 4. A police officer was on duty in the emergency room pursuant to a contract between CVMC and the Berlin Police Department. Shortly before plaintiff was discharged, the charge nurse approached the officer and informed him that plaintiff was blatantly intoxicated, 2 that she had driven herself to the hospital, and that she was about to drive herself home. After receiving this information from the charge nurse and communicating with plaintiff, the officer arrested her on suspicion of driving while intoxicated. The resulting criminal charge was later dismissed by the prosecutor.

¶ 5. In July 2016, plaintiff filed a complaint against the charge nurse and CVMC, alleging that she incurred damages as the result of (1) the nurse's negligent disclosure of information obtained during plaintiff's medical treatment, in violation of the standard of care applicable to medical providers; and (2) CVMC's inadequate training and failure to develop policies regarding the disclosure of information obtained during medical treatment.

¶ 6. In December 2017, following discovery, defendants moved for summary judgment. Regarding plaintiff's negligence claim against the charge nurse, defendants argued that this Court has never recognized a duty enforceable in a tort action not to disclose information obtained during medical treatment and that, even if such a duty existed, the nurse's disclosure of information in this case fully complied with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), see 42 U.S.C. § 1320d-6 (concerning wrongful disclosure of individually identifiable health information), because it was done to avert an imminent threat to plaintiff's and the public's safety. Defendants further argued that plaintiff could not prevail on her claim against CVMC because that claim was dependent upon the underlying claim against the charge nurse. In opposing summary judgment, plaintiff noted that the vast majority of jurisdictions have recognized a private right of action for damages resulting from the disclosure of information obtained during medical treatment. She argued that there were disputed material facts concerning whether the disclosure of the information in this case was necessary to protect plaintiff or the public.

¶ 7. In May 2018, the trial court granted summary judgment to CVMC. 3 After noting that the patient's privilege set forth in 12 V.S.A. § 1612 is an evidentiary privilege applicable only in judicial proceedings, see Kuligoski v. Brattleboro Retreat , 2016 VT 54A, ¶ 60, 203 Vt. 328 , 156 A.3d 436 , and that plaintiff had failed to identify any Vermont authority in support of a greater rule of confidentiality than that set forth in HIPAA, the court ruled that the disclosure at issue here did not violate HIPAA. In so ruling, the court relied on a HIPAA regulation permitting the disclosure of information based on the presumed good-faith belief that the disclosure was necessary to prevent a serious and imminent threat to the health or safety of a person or the public. In the court's view, there was no record basis for any reasonable inference that plaintiff's disclosure to an onsite police officer was for law enforcement purposes or any reason other than a good-faith concern for plaintiff's and the public's safety. Having found no negligence, the court granted CVMC summary judgment on both counts set forth in plaintiff's complaint. 4

II. The Claims of Error

¶ 8. On appeal, plaintiff argues that: (1) the trial court erred in holding that there is no common-law remedy for a health care provider's breach of a duty of confidentiality; and (2) assuming there is such a remedy, the court erred in granting CVMC summary judgment insofar as there are material facts in dispute as to whether the nurse breached the duty of confidentiality regarding information obtained during the course of medical treatment.

A. Private Right of Action

¶ 9. Plaintiff first argues that this Court should recognize a common-law private remedy for breach of a medical provider's duty of confidentiality concerning the disclosure of information obtained during medical treatment. Plaintiff seeks a common-law remedy because neither Vermont law nor HIPAA provides a private right of action to obtain damages incurred as the result of a medical provider's disclosure of information obtained during treatment. See Warren Pearl Constr. Corp. v. Guardian Life Ins. Co. , 639 F. Supp. 2d 371 , 377 (S.D.N.Y. 2009) (collecting numerous federal court cases recognizing that no private right of action exists under HIPAA); Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C. ( Byrne I ), 314 Conn. 433 , 102 A.3d 32 , 41, 45 (2014) (noting "the long line of federal and state cases establishing that there is no private right of action, express or implied, under HIPAA," which enforces its provisions through administrative imposition of fines and imprisonment); Bonney v. Stephens Mem'l Hosp. , 2011 ME 46 , ¶¶ 17, 19, 17 A.3d 123 (noting that all courts addressing issue have concluded that no private right of action exists under HIPPA, which provides only for administrative enforcement of its provisions).

¶ 10. On the other hand, although HIPAA serves in part to "protect the privacy of patients' health information given emerging advances in information technology," it does not preempt causes of action arising under state common or statutory law imposing liability for "health care providers' breaches of patient confidentiality." Byrne I , 102 A.3d at 35 , 45-48 (citing federal and state courts holding that HIPAA does not preempt state law imposing liability over and above that authorized by federal law). Indeed, as many courts have recognized, HIPAA may act as a guidepost or otherwise "inform the relevant standard of care" for state law claims alleging unlawful disclosure of information obtained during medical treatment. Id . at 46-48 , 49 (citing cases and concluding that "to the extent it has become the common practice for Connecticut health care providers to follow the procedures required under HIPAA in rendering services to patients, HIPAA and its implementing regulations may be utilized to inform the standard of care applicable to such claims arising from allegations of negligence in the disclosure of patients' medical records pursuant to a subpoena").

¶ 11. English common law did not afford patients a cause of action based on an expectation of privacy in information disclosed during medical treatment, Hammonds v. Aetna Cas. & Sur. Co. , 243 F. Supp. 793 , 795 n.1 (N.D. Ohio 1965), but the notion "that physicians should respect the confidences revealed by their patients in the course of treatment is a concept that has its genesis in the Hippocratic Oath." McCormick v. England , 328 S.C. 627 , 494 S.E.2d 431 , 435 (S.Ct.App. 1997). By the 1960s and 1970s, several courts had recognized a private right of action for damages resulting from medical providers' wrongful disclosure of information obtained during treatment, and currently the vast majority 5 of jurisdictions addressing whether to recognize such a cause of action have chosen to do so. See Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C. ( Byrne II ), 327 Conn. 540 , 175 A.3d 1 , 7, 11-15 (2018) (discussing cases and joining clear modern consensus of courts recognizing private cause of action for damages resulting from unlawful disclosure of patients' medical information); McCormick , 494 S.E.2d at 435 (citing majority of jurisdictions recognizing cause of action based on medical provider's unauthorized disclosure of information obtained during treatment); see also J. Zelin, Annotation, Physician's Tort Liability for Unauthorized Disclosure of Confidential Information About Patient , 48 A.L.R.4th 668 , § 2(a) (1986) (stating that courts have generally recognized right of patients to recover damages from physicians for unauthorized disclosure of information obtained during treatment).

¶ 12. In recognizing this common-law private right of action, courts have relied on various theories, "including invasion of privacy, breach of implied contract, medical malpractice, and breach of a fiduciary duty or a duty of confidentiality." McCormick , 494 S.E.2d at 436 . The most commonly accepted theory is breach of the duty of confidentiality, insofar as "health care providers enjoy a special fiduciary relationship with their patients" such that "recognition of the privilege is necessary to ensure that the bond remains." Byrne II , 175 A.3d at 12 ; see Biddle v. Warren Gen. Hosp. , 86 Ohio St.3d 395 , 715 N.E.2d 518 , 523 (1999) (citing cases for proposition that "courts have moved toward the inevitable realization that an action for breach of confidence should stand in its own right, and increasingly courts have begun to adopt it as an independent tort in their respective jurisdictions"); Humphers v. First Interstate Bank of Or. , 298 Or. 706 , 696 P.2d 527 , 534-35 (1985) (explaining why breach of duty of confidentiality is correct basis for tort alleging wrongful disclosure of medical information).

¶ 13. As evidence of sound public policy underlying the recognition of liability for breach of the duty of confidentiality, courts have cited "(1) state physician licensing statutes, (2) evidentiary rules and privileged communication statutes which prohibit a physician from testifying in judicial proceedings; (3) common law principles of trust, and (4) the Hippocratic Oath and principles of medical ethics which proscribe the revelation of patient confidences." McCormick , 494 S.E.2d at 435 ; accord Byrne II , 175 A.3d at 15 ; see Hammonds , 243 F. Supp. at 797 (asserting that public policy in support of actionable breach of confidentiality is reflected in medical profession's code of ethics, privileged communication statute, and state medical licensing statute). At the core of this reasoning is that when confidentiality between a medical provider and a patient is diminished in any way, it negatively impacts trustful communication between the two, which, in turn, degrades the medical provider's ability to render effective treatment. Byrne II , 175 A.3d at 7 ; see Alberts v. Devine , 395 Mass. 59 , 479 N.E.2d 113 , 118 (1985) (noting self-evident benefits, including creating environment most favorable for treatment and recovery of patient, of fostering confidentiality between medical provider and patient); Sorensen v. Barbuto , 2008 UT 8 , ¶ 12, 177 P.3d 614 (stating that duty of confidentiality "arises from the understanding that good medical care requires a patient's trust and confidence that disclosures to physicians will be used solely for the patient's welfare and that a patient's privacy with regard to those disclosures will be respected and protected").

¶ 14. For the same public policy reasons, we join the consensus of jurisdictions recognizing a common-law private right of action for damages arising from a medical provider's unauthorized disclosure of information obtained during treatment. We do not do so lightly. See Hay v. Med. Ctr. Hosp. of Vt. , 145 Vt. 533 , 539-40, 496 A.2d 939 , 943 (1985) (acknowledging that caution must be taken in recognizing new cause of action but nonetheless recognizing cause of action for minor child's loss of parental consortium "to see justice made available within our legal system, which [is] of paramount importance"). As we have stated on multiple occasions, "[w]e will not recognize a new cause of action or enlarge an existing one without first determining whether there is a compelling public policy reason for the change." Knight v. Rower , 170 Vt. 96 , 107, 742 A.2d 1237 , 1245 (1999) (quotation omitted) (declining to extend social host liability in Vermont). In this instance, however, public recognition and endorsement of a duty of confidentiality between medical providers and their patients is already evidenced in our law; therefore, providing a common-law remedy for a medical provider's breach of that duty upholds the expectations of the providers, their patients, and the general public. See Byrne II , 175 A.3d at 20-21 (Robinson, J, concurring) (emphasizing "continuing reticence to recognize new [common-law] causes of action" because it is normally duty of legislature and not court to make law, but acknowledging that providing common-law remedy for medical provider's breach of duty of confidentiality is "an appropriate exercise of our common-law authority to recognize new causes of action").

¶ 15. Many of this state's laws underscore Vermont's policy of protecting patient confidentiality by prohibiting the disclosure of patient information. Under Vermont law, hospital patients have "the right to expect that all communications and records pertaining to [their] care shall be treated as confidential." 18 V.S.A. § 1852(a)(7). Failure to comply with this provision may result in disciplinary action against a physician. Id . § 1852(b). Although only applicable in the context of a judicial proceeding, Kuligoski , 2016 VT 54A, ¶ 60, 203 Vt. 328 , 156 A.3d 436 , Vermont has established by statute and rule a patient's privilege against a medical provider's disclosure of information obtained in attending the patient, with some exceptions. 12 V.S.A. § 1612 ; V.R.E. 503.

¶ 16. On the other hand, and equally as important, various Vermont statutes compel medical providers to disclose certain information to protect the public. See, e.g., 13 V.S.A. § 3504(a)(3) (providing immunity from civil suit for health care provider making good-faith report of disease associated with weapons of mass destruction); id . 4012(a) (requiring physician treating gunshot wound to report case to law enforcement); 18 V.S.A. §§ 1001, 1004, 1007, 1041, 1092 - 1093 (requiring medical providers to report information concerning patients diagnosed with or suspected of having communicable diseases dangerous to public health); 23 V.S.A. § 1203b(a) (requiring medical provider who is treating person in emergency room as result of motor vehicle accident to report to law enforcement blood-test result exceeding legal limit, notwithstanding any law or rule to contrary). By requiring disclosure under certain circumstances and in some cases providing immunity for the disclosure, statutes such as these implicitly acknowledge that medical providers have a general duty of confidentiality and that a violation of that duty may subject them to liability. McCormick , 494 S.E.2d at 439 ; Brandt v. Med. Def. Assocs. , 856 S.W.2d 667 , 670 (Mo. 1993) (stating that statutes providing exceptions to medical providers' duty of confidentiality "implicitly acknowledge that, in absence of such an exemption, there would be a breach of this duty").

¶ 17. The most recent and explicit examples of the Legislature's recognition of medical providers' duty of confidentiality is its enactment of a law prohibiting the disclosure of "protected health information" by a "covered entity," as the terms are defined by federal regulations, "unless the disclosure is permitted under" HIPAA. 18 V.S.A. § 1881. Also, the Legislature abrogated this Court's decision in Kuligoski , which had expanded mental health providers' duty to warn of a patient's dangerous propensities, and instead "limit[ed] mental health professionals duty to that as established in common law by Peck v. Counseling Service of Addison County, Inc. , 146 Vt. 61 , 499 A.2d 422 (1985)." 18 V.S.A. § 1882(a). These statutes had effective dates of October 1, 2016 and May 30, 2017, respectively, and thus do not directly govern this case. See 2015, No. 169 (Adj. Sess.), § 1; 2019, No. 15 § 2. Nevertheless, they further evince the longstanding legislative policy of protecting patient confidentiality. 6

¶ 18. Nevertheless, courts addressing the duty of patient confidentiality have recognized the need for practical limitations on prohibiting medical providers from disclosing information obtained during treatment-beyond what they are required to disclose by statute. See McCormick , 494 S.E.2d at 438 (noting that jurisdictions recognizing cause of action for breach of duty of patient confidentiality "do not hold that this duty is absolute"); cf. Peck v. Counseling Serv. of Addison Cty., Inc. , 146 Vt. 61 , 67, 499 A.2d 422 , 426 (1985) (noting "that the [patient] privilege is not sacrosanct and can properly be waived in the interest of public policy under appropriate circumstances," such as when patient threatens harm to identified victim). As recognized in HIPAA, § 1881, and many other Vermont laws, including those cited above, under certain circumstances information obtained during medical treatment either may or must be disclosed to protect the interests or safety of the patient or others. The right to disclose such information "is not necessarily coextensive with a duty to disclose." Biddle , 715 N.E.2d at 524 ; Humphers , 696 P.2d at 535 ("Even without such a legal obligation, there may be a privilege to disclose information for the safety of individuals or important to the public in matters of public interest.").

¶ 19. In § 1881, the Legislature has indicated a policy preference of essentially codifying into state law the requirements of HIPAA. See 18 V.S.A. § 1881(b) (stating that covered entity may not disclose protected health information unless disclosure is permitted under HIPAA). Given the Legislature's reliance on HIPAA, and medical care providers' familiarity with the law, we conclude that the federal statute and its implementing regulations should inform the standard of care and establish the framework for exceptions to medical care providers' duty of confidentiality. Byrne I , 102 A.3d at 49 (concluding that because health care providers are familiar with HIPAA procedures in rendering care to patients, HIPAA and its implementing regulations may be used to inform standard of care applicable to tort claims arising from allegations of negligent disclosure of patients' medical records). Although we ultimately uphold the trial court's grant of summary judgment in favor of CVMC in this case, we adopt a widely recognized common-law private right of action, using the HIPAA framework as a guide, rather than speculate as to whether or what right of action we would adopt in considering whether defendant is entitled to summary judgment.

B. Summary Judgment Ruling

¶ 20. Plaintiff argues that the trial court erred in granting CVMC summary judgment because there are disputed material facts as to whether the information provided to the onsite police officer was legally compelled or necessary to prevent imminent danger to plaintiff or the public. CVMC responds that plaintiff fails to identify specific material facts in dispute and that the evidence demonstrates the nurse's good-faith belief that the information she provided to the officer was necessary to protect plaintiff and the public. CVMC posits that the hospital may well have been liable for any resulting damages had the nurse not provided the information to the officer and had plaintiff driven from the hospital and injured herself or others.

¶ 21. "We review a decision granting summary judgment de novo, using the same standard as the trial court: summary judgment is appropriate if the moving party shows that the material facts are not genuinely disputed and that he or she is entitled to judgment as a matter of law." Gross v. Turner , 2018 VT 80 , ¶ 8, --- Vt. ----, 195 A.3d 654 (citing V.R.C.P. 56(a) ). "In determining whether a genuine dispute of material fact exists, the nonmoving party is entitled to the benefit of all reasonable doubts and inferences." Id . (quotation omitted). "Once a claim is challenged by a properly supported motion for summary judgment, the nonmoving party may not rest upon the allegations in the pleadings, but must come forward with admissible evidence to raise a dispute regarding the facts." Id .

¶ 22. In this case, relying on a regulatory HIPAA exception for good-faith disclosures to prevent serious and imminent threats to the safety of the public, the trial court granted summary judgment to CVMC based on its determination the record did not contain "any reasonable inference that [the charge nurse's] disclosure to the onsite police officer was for law enforcement purposes or any other reason than out of a good-faith concern for [plaintiff's] and the traveling public's safety." Plaintiff argues here, as she did before the trial court, that there are material facts in dispute that compel the denial of CVMC's motion for summary judgment, but she does not state what those facts are. A vague allegation that facts are contested, without more, is insufficient to withstand summary judgment. See Baldwin v. Upper Valley Servs., Inc. , 162 Vt. 51 , 55, 644 A.2d 316 , 318 (1994) ("Opposing allegations must have sufficient support in specific facts to create a genuine issue of material fact.").

¶ 23. Both the trial court and the parties focused on the HIPAA regulation permitting "disclosures to avert a serious threat to health or safety." 45 C.F.R. § 164.512 (j). In relevant part, the regulation permits a "covered entity" to disclose "protected health information" as long as two conditions are met: the covered entity has a good-faith belief that the disclosure is "necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public," and the disclosure is "to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat." Id . § 164.512(j)(1)(i). The regulation further provides that a covered entity disclosing information pursuant to this exception is "presumed to have acted in good faith with regard to a belief described in" the exception. Id . § 164.512(j)(4).

¶ 24. We conclude that this exception, including its good-faith component, provides an appropriate limit to obtaining damages for the disclosure of information obtained during medical treatment. While we recognize that due care must "be exercised in order to insure that only that information which is necessary to protect the potential victim is revealed," Peck , 146 Vt. at 68 , 499 A.2d at 427 , we must be cautious in requiring medical providers, particularly in emergency situations such as this, to parse too finely what information can or cannot be disclosed to protect individuals or the public in general from an imminent and serious threat of harm.

¶ 25. CVMC does not contest that it is a covered entity and that the information provided to the onsite police officer was protected health information. Nor does plaintiff contest that, assuming there was a threat justifying disclosure of the information, the police officer was a person reasonably able to prevent the threat. The point of contention is whether the record demonstrates, as a matter of law, that the nurse had a good-faith belief that all the information provided to the officer was necessary to prevent a serious and imminent threat to the health or safety of plaintiff or the general public.

¶ 26. In answering this question, we first reexamine what the nurse told the officer. As stated above, the nurse indicated that plaintiff was blatantly intoxicated, that she had driven herself to the hospital, and that she was about to drive herself home. Given the record before us, if the nurse had told the officer only that plaintiff was blatantly intoxicated and was about to drive herself home, CVMC would surely be entitled to summary judgment. But we must also consider that the nurse also told the officer that the blatantly intoxicated plaintiff had driven herself to the hospital, thereby suggesting that plaintiff had committed a crime. In considering this particular statement, we recognize that the disclosure exception in § 164.512(j)(1)(i) is directed at preventing future conduct, in the sense that it allows disclosures based on a good-faith belief that doing so is necessary to prevent the threat of imminent and serious harm. 7

¶ 27. The critical question, then, is whether, as a matter of law, and based on the evidence viewed most favorably to plaintiff, the nurse had a good-faith belief that telling the officer the intoxicated plaintiff had driven herself to the hospital was necessary to prevent the imminent and serious threat of her driving in an intoxicated state away from the hospital. In answering this question, we consider the meaning of the term "good faith" in this context, as well as the record evidence in light of that meaning.

¶ 28. "Good faith" is undefined in the HIPPA regulations that we rely on in establishing the scope of, and exceptions to, the duty we are recognizing today. Although the term "good faith" is ubiquitous in the law, "its meaning varies somewhat with the context." Restatement (Second) of Contracts § 205 cmt. a (1979); see Good Faith , Black's Law Dictionary (10th ed. 2014) (quoting description of good faith in R. Brownsword et al., Good Faith in Contract in Good Faith in Contract: Concept and Context , 1, 3 (1999), as " 'an elusive idea, taking on different meanings and emphases as we move from one context to another' ").

¶ 29. In connection with the qualified immunity defense, Vermont has adopted the federal objective "good faith" test whereby we evaluate the objective reasonableness of the official's conduct in relation to settled, clearly established law. See Cook v. Nelson , 167 Vt. 505 , 509-10, 712 A.2d 382 , 384 (1998). Under this objective test, acts committed without any ill intent may be excluded from the protections of qualified immunity. Id . Similarly, under the Uniform Common Interest Ownership Act, we have explained that "good faith" means "in a commercially reasonable manner." Will v. Mill Condo. Owners' Ass'n , 2004 VT 22 , ¶ 15, 176 Vt. 380 , 848 A.2d 336 . This too is an objective definition that does not require us to divine the subjective intent of the actor.

¶ 30. In other contexts, "good faith" is primarily a subjective concept relating to the intentions of the actor rather than the reasonableness of the acts. 8 For example, in discussing the factors relevant to a civil claim of conversion, this Court discussed the actor's "good faith" and "intent" interchangeably. Montgomery v. Devoid , 2006 VT 127 , ¶ 16, 181 Vt. 154 , 915 A.2d 270 ; see Carter v. Gugliuzzi , 168 Vt. 48 , 58, 716 A.2d 17 , 24-25 (1998) (equating "lack of intent to deceive" and "good faith").

¶ 31. Notably, numerous courts have applied a subjective good-faith standard with respect to statutes providing immunity from civil or criminal liability for persons disclosing medical information in good faith while reporting or aiding in the investigation of child abuse. Nelson v. Lindaman , 867 N.W.2d 1 , 8, 12-13 (Iowa 2015) (applying subjective standard under Iowa statute and citing other jurisdictions that have done so in construing similar statutes). The subjective standard is adopted in that context in part because good faith "rests on a defendant's subjective honest belief that the defendant is aiding and assisting in the investigation of a child abuse report." Garvis v. Scholten , 492 N.W.2d 402 , 404 (Iowa 1992) (reasoning that statute was intended "to encourage those having information about child abuse to come forward when asked to do so, without the fear of litigation should it later be shown that the information was improperly released").

¶ 32. Because we have adopted the standards in HIPAA as framing the contours and limits of a cause of action for breach of the duty not to disclose protected health information, to answer the pivotal question in this case we must determine how "good faith" is defined for purposes of § 164.512(j)(1), (4) -and, in particular, whether to apply a subjective or objective test. For the following reasons, we conclude that the applicable test in this case is a subjective one. That is, whether the nurse's motivation for disclosing the protected health care information was based solely on her belief that the disclosure was necessary to protect or lessen a serious and imminent threat to health or safety, or whether the nurse sought to satisfy some other purpose, even a well-intentioned one, apart from this narrow legal exception to her general duty of nondisclosure.

¶ 33. First, the HIPAA regulation that frames our analysis specifically hinges on the actor's good faith in connection with the actor's actual beliefs, rather than on whether the actor acted in a manner that is objectively in good faith. See 45 C.F.R. § 164.512 (j)(1) ("A covered entity may, consistent with applicable law and standards of ethical conduct, use or disclose protected health information, if the covered entity, in good faith, believes the use or disclosure ... [i]s necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public ...."). 9 This wording suggests a subjective understanding of "good faith" focused on the actor's intentions and beliefs.

¶ 34. Second, the regulation's basis for a presumption of good faith supports the view that the standard of good faith in this circumstance is subjective. In particular, § 164.512(j)(4) provides that "[a] covered entity that uses or discloses protected health information pursuant to paragraph (j)(1) of this section is presumed to have acted in good faith with regard to a belief described in paragraph (j)(1) ... if the belief is based up on the covered entity's actual knowledge or in reliance on a credible representation by a person with apparent knowledge or authority." The focus of this presumption is on the subjective knowledge underlying the belief.

¶ 35. Finally, by its terms, this exception will normally apply in emergency situations involving serious safety concerns when medical providers must make quick decisions about what information is necessary to prevent the imminent risk of harm. As noted above, we are reluctant to impose the specter of liability for misjudgment on a health care provider weighing whether to make a discretionary disclosure to prevent imminent and serious harm to public health and safety.

¶ 36. Applying the subjective standard, we conclude that plaintiff has not met her burden of production to rebut the applicable presumption of good faith. Through case law and Vermont Rule of Evidence 301, we have adopted a bursting-bubble theory of presumptions in civil cases, unless otherwise provided by law. Chittenden v. Waterbury Ctr. Cmty. Church, Inc. , 168 Vt. 478 , 492, 726 A.2d 20 , 29 (1998). Under that theory, " 'a presumption shifts only the burden of production, losing its mandatory effect as soon as evidence sufficient to support a finding of the nonexistence of the presumed fact is introduced.' " Id . (quoting Reporter's Notes to V.R.E. 301 ). We see no policy reason to depart from that theory here.

¶ 37. Thus, CVMC bears the ultimate burden of persuasion as to the applicability of the good-faith exception to the general rule prohibiting health care providers from disclosing protected health information. But the presumption of good faith in HIPAA, § 164.512(j)(4), which we adopt for purposes of analyzing the common-law tort we recognize in this decision, shifts the burden to plaintiff to make some showing that the nurse's disclosure that plaintiff had driven to the hospital and was blatantly intoxicated was not made in good faith.

¶ 38. Although the burden of production is not a heavy one, plaintiff did not meet hers in this case. Nothing in the record suggests that the nurse supplied the information to the officer for any reason other than her good-faith belief that the information was necessary to prevent plaintiff from driving drunk from the hospital and endangering herself and the public. Plaintiff made no proffer suggesting that the nurse hoped inclusion of the arguably superfluous information about how plaintiff got to the hospital would lead to plaintiff's censure, arrest, or prosecution or that she had any ulterior motive beyond the permitted one. 10 Nor did she challenge defendants' statement of undisputed fact, the nurse's affidavit, or the nurse's deposition testimony indicating that the nurse provided the information to the officer solely in the hope that he would give plaintiff a ride home. Thus, the record unequivocally shows that defendant's intent in disclosing all of the information provided to the officer was consistent with the exception set forth in § 164.512(j)(1)(i).

¶ 39. In light of the presumption of good faith, which was bolstered by the record, plaintiff had the burden of proffering some facts or information indicating that the nurse had other motives. She did not do so. Accordingly, CVMC was entitled to summary judgment. 11 See Zullo v. State , 2019 VT 1 , ¶ 56, --- Vt. ----, 205 A.3d 466 (emphasizing "that although subjective motivation may often have to be resolved by the factfinder, a plaintiff cannot withstand summary judgment without producing colorable facts upon which a reasonable jury could find bad faith"); cf. Nelson , 867 N.W.2d at 11 ("Courts applying equivalent subjective good-faith immunity statutes have not hesitated to grant or affirm summary judgment when there was no evidence the defendant was dishonest in reporting to the child abuse investigator."); Garvis , 492 N.W.2d at 404 (affirming trial court's grant of summary judgment where "the defendants' subjective good faith in aiding and assisting the [child abuse] investigation [by disclosing plaintiffs' medical information] went unchallenged").

Affirmed .