
    164 A.3d 1110
    JOHN SMITH, A FICTITIOUS PERSON, PLAINTIFF-RESPONDENT, v. ARVIND R. DATLA, M.D. AND CONSULTANTS IN KIDNEY DISEASES, P.A., DEFENDANTS-APPELLANTS.
    Superior Court of New Jersey Appellate Division
    Argued May 8, 2017
    Decided July 12, 2017
    
      Before Judges Sabatino, Haas and Geiger.
    
      Mark A. Petraske argued the cause for appellants (Buckley, Theroux, Kline & Petraske, LLC, attorneys; Mr. Petraske and Teresa C. Finnegan, on the briefs).
    
      Craig J. Hubert argued the cause for respondent (Szaferman, Lakind, Blumstein & Blader, PC, attorneys; Mr. Hubert, of counsel and on the brief; Keith L. Hovey and Brandon C. Simmons, on the brief).
    
      E. Drew Britcher argued the cause for amicus curiae New Jersey Association for Justice (Britcher Leone, LLC, attorneys; Mr. Britcher, of counsel; Jessica E. Choper, on the brief).
    
      William H. Mergner, Jr. argued the cause for amicus curiae New Jersey State Bar Association (New Jersey State Bar Associa-
      
      lion, attorneys; Thomas H. Prol, President, of counsel; Mr. Mergner and Liana M. Nobile, on the brief).
   The opinion of the court was delivered by

GEIGER, J.S.C. (temporarily assigned).

This appeal raises the unresolved issue of what statute of limitations applies to a common-law invasion of privacy claim arising out of a defendant harmfully revealing private facts about a plaintiff to a third party. It also raises the related question of what limitations period applies to a statutory cause of action for a defendant’s improper disclosure of a plaintiffs HIV-positive status committed in violation of the AIDS Assistance Act (Act), N.J.S.A. 26:5C-1 to -14. The trial court held that both such claims are subject to a two-year statute of limitations. The trial court further ruled that plaintiffs medical malpractice claim was also subject to a two-year statute of limitations. We affirm.

This civil action seeks monetary damages and an award of attorney’s fees for invasion of privacy, violation of the Act, and medical malpractice. The first legal issue presented by this appeal is whether the tort of invasion of privacy by public disclosure of private facts is an “injury to the person” barred by the two-year limitation period set forth in N.J.S.A. 2A:14-2, or instead by the one-year limitation period for defamation set forth in N.J.S.A. 2A-.14-3. The second legal issue is whether a violation of the Act is subject to a one-year or two-year limitation period. The third issue is whether a claim of medical malpractice based upon the same wrongful public disclosure of private medical facts is subject to a one-year or two-year limitation period.

Before addressing these issues, we note the standard of review that governs our analysis. Defendants moved to dismiss the complaint under Rule 4:6-2(e) for “failure to state a claim upon which relief may be granted.” Because this appeal is from the denial of such a dismissal motion, we must accept as true plaintiffs version of the events. Rumbauskas v. Cantor, 138 N.J. 173, 175, 649 A.2d 853 (1994). Here, the issues raised by defendants do not involve a challenge to fact-finding on the part of the trial court, but rather involve pure questions of law.

On appeal, we engage in a de novo review from a trial court’s decision to grant or deny a motion to dismiss filed pursuant to Rule 4:6-2(e). Rezem Family Assoc., LP v. Borough of Millstone, 423 N.J.Super. 103, 114, 30 A.3d 1061 (App. Div.), certif. denied, 208 N.J. 366, 29 A.3d 739 (2011). Moreover, when analyzing pure questions of law raised in a dismissal motion, such as the application of a statute of limitations, we undertake a de novo review. See Royster v. N.J. State Police, 227 N.J. 482, 493, 152 A.3d 900 (2017); Town of Kearny v. Brandt, 214 N.J. 76, 91, 67 A.3d 601 (2013). A “trial court’s interpretation of the law and the legal consequences that flow from established facts are not entitled to any special deference.” Manalapan Realty, L.P. v. Twp. Comm. of Manalapan, 140 N.J. 366, 378, 658 A.2d 1230 (1995).

I.

The limited record in this interlocutory appeal reflects that plaintiff John Smith was a patient of defendant, Dr. Arvind R. Datla, a board-certified nephrologist. Co-defendant, Consultants in Kidney Diseases, PA, is a medical practice employing or owned by Dr. Datla. Dr. Datla was treating plaintiff for acute kidney failure. During an emergent bedside consultation in plaintiffs private hospital room on July 25, 2013, Dr. Datla discussed with plaintiff his medical condition. While doing so, Dr. Datla disclosed plaintiffs HIV-positive status in the presence of an unidentified third party who was also in the room. Plaintiff claims that Dr. Datla thereby revealed his HIV-positive status to the third party without his consent.

Plaintiff sued defendants, pleading various related theories. In his original complaint, plaintiff alleged invasion of privacy based on the inappropriate disclosure of private, confidential medical information to a third-party without plaintiffs consent, in violation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C.A. § 1320 (count one). He also alleged medical malpractice based on the inappropriate disclosure (count two). Plaintiff further alleged that after the disclosure, Dr. Datla attempted “to create a fraudulent ruse by which [Dr. Datla] would allege in front of the unauthorized third party and plaintiff that the medical information that had been disclosed referred, in fact, to a different patient.”

Plaintiff filed his complaint on July 1, 2015, almost two years after the July 25, 2013 disclosure event. Plaintiff contends that the disclosure of his HIV-positive status by defendant was negligent, careless, reckless, willful and wanton. Plaintiff claims that the disclosure caused him to endure pain and suffering, emotional distress, other emotional injuries and insult, and permanent injury with physiological consequences.

In his answer, Dr. Datla identifies himself as a board-certified specialist in nephrology and asserts that he was practicing ne-phrology in this case. After a Ferreira conference, plaintiff produced an affidavit of merit (AOM) from a board-certified specialist in internal medicine.

Prior to the filing of plaintiffs amended complaint, defendants simultaneously filed two separate motions to dismiss plaintiffs complaint. One motion sought dismissal of plaintiffs medical malpractice claim (count two) on grounds that an AOM by a physician who is not a board-certified nephrologist violates the Patients First Act, N.J.S.A 2A:53A-27, N.J.S.A. 2A:53A-41, and the Court’s holding in Nicholas v. Mynster, 213 N.J. 463, 487, 64 A.3d 536 (2013). The other motion sought dismissal of plaintiffs invasion of privacy claim (count one) on grounds that HIPAA does not provide for a private right of action. The trial court denied each motion in separate orders dated August 19, 2016. The judge found that because plaintiffs medical malpractice claim did not involve Dr. Datla’s specialty as a nephrologist, an AOM by a board-certified internist was sufficient. The judge further found that although there is no private right of action under HIPAA, plaintiff adequately pleaded and could proceed under a common-law invasion of privacy claim. Defendants did not move for leave to appeal either of those orders.

On that same day, the trial court granted plaintiff leave to amend his complaint. Plaintiffs amended complaint asserts three causes of action: (1) invasion of privacy based on public disclosure of private facts (count one); (2) medical malpractice based on the improper disclosure (count two); and (3) violation of the Act (count three). Plaintiff demands judgment for compensatory damages, interest, attorney’s fees, and costs of suit, but he did not seek an award of punitive damages.

Subsequently, in September 2016, defendants filed a third motion to dismiss the now-amended complaint, arguing that all three claims were time-barred by a one-year statute of limitations. Specifically, defendants argued that all three claims were predicated on the public disclosure of private facts and should be subject to the same statute of limitations. Although New Jersey courts have not established a statute of limitations for the public disclosure of private facts, defendants analogized that type of invasion of privacy claim to claims for placing plaintiff in a false light in the public eye and defamation. Citing Rumbauskas, supra and Swan v. Boardwalk Regency, 407 N.J.Super. 108, 969 A.2d 1145 (App. Div. 2009), defendants further argued that a one-year statute of limitations should apply to all three counts because each count arose from the same operative facts, albeit under different legal theories. Plaintiff countered that he does not claim defamation, and that the general two-year statute of limitations for personal injury claims should apply to all three counts.

For purposes of their motion, defendants assumed that the facts alleged in plaintiffs amended complaint were true. Namely, they assumed that the unauthorized and improper disclosure allegedly made by Dr. Datla in the presence of a third party that plaintiff was HIV-positive violated the Act, and constituted invasion of privacy and medical malpractice.

Plaintiff concedes that, as his medical provider, Dr. Datla lawfully possessed the confidential record that plaintiff was HIV-positive. Plaintiff further concedes that the disclosure that he was HIV-positive was truthful.

Defendants appeal from the October 19, 2016 order denying their motion to dismiss. The judge held that a two-year statute of limitations applied to all three counts. The judge focused on the fact that the alleged harm resulted from the dissemination of a truthful statement to a third party without plaintiffs consent, rather than publication of a false statement about plaintiff. In his oral decision, the judge stated:

There are three separate claims here. There’s no doubt that there are three separate claims but they arise from a common core set of facts, which is the disclosure of private information to the public.

The judge rejected the argument that the common set of facts precluded different legal claims, concluding that “each claim has different elements surrounding those common set of facts.” The judge found plaintiffs claims to be similar to an intrusion claim. In describing defendants’ conduct, the judge stated:

So it’s not someone creating words or creating a document, it’s words or a document that was disclosed improperly, at least that’s the allegation. So it goes to the issue of an intrusion [into] somebody’s private life.

The judge also held that plaintiffs malpractice claim was subject to the two-year statute of limitations, as was his claim under the Act because it was “a personal injury claim” that has “an impact on the plaintiffs personhood.”

We granted defendants’ motion for leave to appeal the October 19, 2016 order. On appeal, defendants raise the following arguments: (1) the disclosure of private medical information constitutes invasion of privacy; (2) New Jersey case law imputes a one-year statute of limitations on invasion of privacy claims based on words; (3) an invasion of privacy based on public disclosure of private facts is directly analogous to claims for placing plaintiff in a false light and defamation; (4) claims for public disclosure of private facts are governed by the one-year statute of limitations for defamation; and (5) plaintiffs claim for public disclosure of private facts is grossly dissimilar to invasion of privacy by intrusion.

II.

“Statutes of limitations are essentially equitable in nature, promoting the timely and efficient litigation of claims.” Montells v. Haynes, 133 N.J. 282, 292, 627 A.2d 654 (1993) (citing Ochs v. Federal Ins. Co., 90 N.J. 108, 447 A.2d 163 (1982)). They spare courts from litigating stale claims, penalize dilatoriness, and serve as measures of repose. Farrell v. Votator Div., 62 N.J. 111, 115, 299 A.2d 394 (1973); Rosenau v. City of New Brunswick, 51 N.J. 130, 136, 238 A.2d 169 (1968).

Actions for personal injuries must be commenced within two years after the cause of action accrues. Baird v. Am. Med. Optics, 155 N.J. 54, 65, 713 A.2d 1019 (1998) (citing N.J.S.A. 2A:14-2). “Where the damages sought are for injuries to the person, the applicable statute is [N.J.S.A 2A:14-2] which fixes the period of two years irrespective of the form of the action.” Burns v. Bethlehem Steel Co., 20 N.J. 37, 39-40, 118 A.2d 544 (1955) (two-year personal injury statute of limitations applied to hearing loss claim of third-party beneficiary of contract between union and employer).

Claims for defamation are subject to the one-year statute of limitations imposed by N.J.S.A 2A:14-3, and must be filed within one year after the publication of the alleged libel or slander. Rumbauskas, supra, 138 N.J. at 183, 649 A.2d 853.

The applicable statute of limitations for three of the four types of invasion of privacy have already been determined by our courts. Specifically, claims for invasion of privacy based on intrusion on seclusion are subject to the two-year statute of limitations imposed by N.J.S.A 2A:14-2. Id. at 182, 649 A.2d 853. Claims for invasion of privacy based on placing plaintiff in a false light are subject to the one-year statute of limitations imposed by N.J.S.A. 2A:14-3. Swan, supra, 407 N.J.Super. at 122-23, 969 A.2d 1145. Claims for invasion of privacy based on a person’s name or likeness are subject to the six-year statute of limitations imposed by N.J.S.A. 2A:14-1. Canessa v. J.I. Kislak, Inc., 97 N.J.Super. 327, 355, 235 A.2d 62 (Law Div. 1967).

In McGrogan v. Till, 167 N.J. 414, 771 A.2d 1187 (2001), the Court set forth the test to be employed when determining the appropriate statute of limitations to apply.

The holdings in Montells and Labree recognize that in the analysis of which statute of limitations period should apply to a cause of action, the concept of “nature of the injury” is not to be subjected to a complaint-specific inquiry. The “nature of the injury” is used to determine the “nature of the cause of action” or the general characterization of that class of claims in the aggregate. That analysis precedes resolution of the question of which statute of limitations applies to a type of cause of action, and does not contemplate an analysis of the specific complaint and the injuries it happens to allege.
[Id. at 422-23, 771 A.2d 1187.]

Consistent with other statutes such as the Law Against Discrimination (LAD), N.J.S.A. 10:5-1 to -49, and the New Jersey Civil Rights Act (NJCRA), N.J.S.A. 10:6-1 to -2, we must then look to the most analogous cause of action to determine the appropriate statute of limitations. See Montells, supra, 133 N.J. at 291-92, 627 A.2d 654. In doing so, the focus is on the nature of the injury, not the underlying legal theory of the claim when determining which statute of limitations applies. Id. at 291, 627 A.2d 654 (citing Heavner v. Uniroyal, Inc., 63 N.J. 130, 145, 305 A.2d 412 (1973)); Brown v. N.J. Coll. of Med. & Dentistry, 167 N.J.Super. 532, 535, 401 A.2d 288 (Law Div. 1979).

In Montells, the Court held that a single statute of limitations should apply to all LAD claims despite the varied injuries and requested relief. Montells, supra, 133 N.J. at 291, 627 A.2d 654. The Court recognized that although LAD “vindicates economic rights and some rights that sound in contract, the statute strikes directly at conduct that injures the personhood of another. A discrimination claim cuts most deeply at the personal level.” Id. at 293, 627 A.2d 654.

While plaintiffs three causes of action arise out of the same operative facts, those common facts can give rise to different claims. See, e.g., Dairy Stores, Inc. v. Sentinel Pub. Co., 104 N.J. 125, 133, 516 A.2d 220 (1986) (a statement about the poor quality of a product implying that the seller is fraudulent may be actionable under actions for defamation and product disparagement, which stem from different branches of tort law); Ramanadham v. N.J. Mfrs. Ins. Co., 188 N.J.Super. 30, 33, 455 A.2d 1134 (App. Div. 1982) (claims included breach of contract and violation of the Consumer Fraud Act). By way of further example, a common core of facts may give rise to an action against a nursing home for negligence, breach of contract, consumer fraud, and violations of federal mandates.

We will now analyze the applicable statute of limitations for each of the three counts of the amended complaint.

III.

A. INVASION OF PRIVACY

Count one alleges an invasion of privacy by public disclosure of private facts. Invasion of privacy

is not one tort, but a complex of four. The law of privacy comprises four distinct kinds of invasion of four different interests of the plaintiff, which are tied together by the common name, but otherwise have almost nothing in common except that each represents an interference with the right of the plaintiff to “be left alone.”
[William L. Prosser, The Law of Torts § 112 (3d ed. 1964).]

The four classifications of “invasion of privacy” propounded by Dean Prosser are:

(1) intrusion (e.g., intrusion on plaintiffs physical solitude or seclusion, as by invading his or her home, illegally searching, eavesdropping, or prying into personal affairs); (2) public disclosure of private facts (e.g., making public private information about plaintiff); (3) placing plaintiff in a false light in the public eye (which need not be defamatory, but must be something that would be objectionable to the ordinary reasonable person); and (4) appropriation, for the defendant’s benefit, of the plaintiffs name or likeness.
[Rumbauskas, supra, 138 N.J. at 180, 649 A.2d 853 (citing W. Page Keeton, et al., Prosser and Keeton on the Law of Torts § 117 (5th ed. 1984)).]

Dean Prosser further noted:

It should be obvious at once that these four types of invasion may be subject, in some respects at least, to different rules; and that when what is said as to any one of them is carried over to another, it may not be at all applicable, and confusion may follow.
[William L. Prosser, Privacy, 48 Cal. L. Rev. 383, 389 (1960).]

“Prosser adds that almost all the confusion in the area is caused by the failure to separate and distinguish the four forms of invasion of privacy and to realize that they call for different treatment.” Rumbauskas, supra, 138 N.J. at 180, 649 A.2d 853 (citing Privacy, supra, 48 Cal. L. Rev. at 407).

In contrast to invasion of privacy torts involving appropriation or false light, the tort of “invasion of privacy by unreasonable publication of private facts occurs when it is shown that ‘the matters revealed were actually private, that dissemination of such facts would be offensive to a reasonable person, and that there is no legitimate interest of the public in being apprised of the facts publicized.’” Romaine v. Kallinger, 109 N.J. 282, 297, 537 A.2d 284 (1988) (quoting Bisbee v. John C. Conover Agency, 186 N.J.Super. 335, 340, 452 A.2d 689 (App. Div. 1982)). We determine that the defendants’ unauthorized disclosure of plaintiffs HIV-positive status falls within the second type of invasion of privacy: public disclosure of private facts.

We find no binding precedent determining the appropriate statute of limitations to apply to claims for invasion of privacy based on improper disclosure of private facts.

The pivotal question becomes whether plaintiffs injuries for invasion of privacy is more like an “injury to the person” under N.J.S.A. 2A:14-2(a), as to which a two-year statute of limitation applies, or like injuries for defamation under N.J.S.A. 2A:14-3, as to which the one-year statute of limitation applies. See Montells, supra, 133 N.J. at 291, 627 A.2d 654.

In Rumbauskas, a victim of stalking and death threats brought an action for invasion of privacy claiming intrusion on seclusion. The Court held that such an action “constitutes a claim for ‘injury to the person’ of the plaintiff and is governed by the two-year statute of limitations set forth in N.J.S.A. 2A:14-2,” because the “defendant’s conduct struck directly at the personhood of plaintiff’ and “cuts most deeply at the personal level.” Rumbauskas, supra, 138 N.J. at 182, 649 A.2d 853.

In its analysis, the Supreme Court discussed the difficulty in determining the statute of limitations applicable to false light claims:

Jurisdictions throughout the country have struggled with the classification of actions for invasion of privacy. One of the most familial- difficulties is determining whether placing one in a false-light in the public eye should be regarded as defamatory in nature, thereby subjecting causes of action to the specific statutes of limitations applicable to defamation claims. For example, because of the inherent similarities between false-light and defamation claims, the Supreme Court of Washington concluded that the same statute of limitations applies to both types of claims. Eastwood v. Cascade Broadcasting Co., 106 Wash.2d 466, 722 P.2d 1295 (1986). Similarly, the Supreme Court of California recognized the inherent similarities between false light invasion of privacy and defamation in Fellows v. National Enquirer, Inc., 42 CaL.3d 234, 228 Cal.Rptr. 215, 721 P.2d 97 (1986). See also Covington v. The Houston Post, 743 S.W.2d 345, 348 (Tex. Ct. App. 1987) (holding that personal injury statute of limitations applied to false light defamation).
[Id. at 180-81, 649 A.2d 853.]

After confirming that “[t]he limitations periods applicable to actions involving other types of invasion of privacy [i.e., not involuntary stalkings or threats of violence] are not before us[,]” id. at 183, 649 A.2d 853 (emphasis added), the Court stated in dicta:

Invasion-of-privacy actions based on appropriation remain governed by the six-year statute of limitations period set forth in N.J.S.A 2A:14-1. See Canessa, supra, 97 N.J.Super. at [355], 235 A.2d 62. Regarding actions for public disclosure of private facts or placing one in a false light, ease law in other jurisdictions indicates that such actions are subject to the limitations period for defamation claims, which is one year in New Jersey. N.J.S.A 2A:14-3.
[Ibid, (emphasis added).]

In Swan, supra, 407 N.J.Super. at 122-23, 969 A.2d 1145, we held that plaintiffs false light invasion of privacy claim was subject to the one-year statute of limitations for defamation actions imposed by N.J.S.A. 2A:14-3. In reaching that decision, we noted that the motion judge found that plaintiffs false light claim “was similar to defamation in that it ‘subjected] the victim to the consequences of defamation without the explicit nature of the claim.’ ” Id. at 121, 969 A.2d 1145. We then emphasized:

Based on our analysis of the record and the applicable law, we, too, are persuaded that the nature of plaintiffs invasion of privacy claim is essentially one of defamation, and [based on the facts presented] that the type of alleged objectionable conduct by defendant is dissimilar to that giving rise to the two-year statute of limitations (“intrusion on seclusion”), Rumbauskas, supra, or six-year limitations period (“appropriation”), Canessa, supra. After considering Dean Prosser’s analysis and its review of the case law in New Jersey and other jurisdictions, the Rumbauskas Court was clearly of the opinion that different statutes of limitations would apply depending on the actual nature of the “invasion of privacy” claim. The Court quoted approvingly of decisions in other jurisdictions that applied the same statute of limitations to false light and defamation claims, Rumbauskas, supra, 138 N.J. at 180-82, 649 A.2d 853, giving the reader every reason to believe that although the Court did not have to reach the issue, it also would conclude that the one-year statute of limitations governing defamation actions would be applied in a “false light” action that was clearly grounded in allegations which were defamatory in nature.
Neither law nor logic justifies why Count Two of plaintiffs complaint labelled “Defamation” should be subject to a one-year statute of limitations while the same claims re-labelled “False Light/Invasion of Privacy” in Count Three should be governed by a longer limitations period.
[Id. at 121-23, 969 A.2d 1145 (emphasis added).]

Defendants argue that plaintiffs invasion of privacy claim is based on words rather than intrusive conduct, and, therefore, are analogous to placing plaintiff in a false light and defamation, thus subjecting plaintiffs claims to a one-year statute of limitations. We disagree.

Unlike a typical defamation claim, the confidential information allegedly disclosed by Dr. Datla to a third person was true, not false. The disclosed medical information did not place plaintiff in a false light. Here, plaintiff does not allege and did not plead defamation. He does not claim that the disclosure that he was HIV-positive was false or placed him in a false light.

The LAD prohibits discrimination based on an individual’s disability, including their HIV/AIDS status. N.J.S.A. 10:5—5(q). See Estate of Behringer v. The Med. Ctr. at Princeton, 249 N.J.Super. 597, 642-44, 592 A.2d 1251 (Law Div. 1991); see also Poff v. Caro, 228 N.J.Super. 370, 376-78, 549 A.2d 900 (Law. Div. 1987). LAD claims are subject to the two-year statute of limitations. Montells, supra, 133 N.J. at 298, 627 A.2d 654.

The United States Constitution protects individuals from governmental disclosure of their infection by the AIDS virus. Doe v. Barrington, 729 F.Supp. 376, 382 (D.N.J. 1990). “Disclosure of a family member’s medical condition, especially exposure to or infection with the AIDS virus is a disclosure of a ‘personal matter.’ ” Ibid. Patients have a privacy right in their medical records and medical information. United States v. Westinghouse, 638 F.2d 570, 577 (3d Cir. 1980) (employee medical records clearly within zone of privacy protection); see also In re Search (Sealed), 810 F.2d 67, 71 (3d Cir.) (medical records clearly within constitutional sphere of right to privacy), cert. denied, 483 U.S. 1007, 107 S.Ct. 3233, 97 L.Ed.2d 739 (1987). The heightened privacy interest of an individual’s HIV-positive status rises to a constitutional dimension when the improper disclosure of that information is committed by a law enforcement officer acting under color of law, subjecting the officer to liability under Section 1983 for violating the individual’s constitutional right to privacy. Doe, supra, 729 F.Supp. at 385. Claims under Section 1983 are subject to a two-year statute of limitations. Montgomery, supra, 159 F.3d at 126 n.4.

We find that claims for unauthorized disclosure of a person’s HIV-positive status align more closely with discrimination claims based on improper disclosure of an individual’s HIV/AIDS status brought under LAD, NJCRA, and Section 1983, all of which are subject to a two-year statute of limitations.

We further find that claims for unauthorized disclosure of a person’s HIV-positive status also more closely align to an intrusion on plaintiffs solitude or seclusion than defamation or invasion of privacy by placing plaintiff in a false light. In that regard, we note that a false light claim involves the publication of misleading information and is akin to defamation. Defendants’ conduct did not involve publishing false or misleading statements about plaintiff. The Court’s dictum in Rumbauskas, supra, 138 N.J. at 183, 649 A.2d 853, observing that “case law in other jurisdictions” applies the same limitations period for false light claims as for tortious disclosure of private facts, does not require such equivalency in our State, especially given the type of claim that has been factually presented here.

Accordingly, we hold that plaintiffs claim for invasion of privacy by public disclosure of private facts is subject to the two-year statute of limitations imposed by N.J.S.A. 2A:14-2.

B. THE ACT

The Act provides that a record maintained by a health care provider, health care facility, or laboratory, “which contains identifying information about a person who has or is suspected of having AIDS or HIV infection is confidential and shall be disclosed only for the purposes authorized by [the Act].” N.J.S.A. 26:5C-7. Contents of such confidential records may be disclosed without the “prior written informed consent” of the person who is the subject of the confidential record only under limited circumstances. N.J.S.A. 26:5C-8 to -13. “Any record disclosed under [the Act] shall be held confidential by the recipient of the record and shall not be released unless the conditions of [the Act] are met.” N.J.S.A. 26:5C-11.

The Act provides for a private right of action and a wide-range of relief for the improper disclosure of a person’s HIV-positive status:

A person who has or is suspected of having AIDS or HIV infection who is aggrieved as a result of the violation of this act may commence a civil action against the individual or institution who committed the violation to obtain appropriate relief, including actual damages, equitable relief and reasonable attorney’s fees and court costs. Punitive damages may be awarded when the violation evidences wantonly reckless or intentionally malicious conduct by the person or institution who committed the violation.
[N.J.S.A 26:5C-14(a).]

“Each disclosure” made in violation of the Act “is a separate and actionable offense.” N.J.S.A. 26:5C-14(b).

In order to recover for a violation of the Act, plaintiff must prove that defendants failed to maintain the confidentiality of his medical records, which disclosed his HIV-positive status without his prior written informed consent. N.J.S.A. 26:5C-8; see Behringer, supra, 249 N.J.Super. at 634 n.11, 592 A.2d 1251.

The Act is a remedial statute that promotes a strong public policy of the State and, therefore, should be construed liberally to effectuate its important social goal. See Battaglia v. United Parcel Serv., Inc., 214 N.J. 518, 555, 70 A.3d 602 (2013) (citing Abbamont v. Piscataway Twp. Bd. of Educ., 138 N.J. 405, 431, 650 A.2d 958 (1994)) (involving the Conscientious Employee Protection Act); Nini v. Mercer Cnty. Cmty. Coll., 202 N.J. 98, 108-09, 995 A.2d 1094 (2010) (involving the Law Against Discrimination). Because it is remedial in nature, the Act must be applied “to the full extent of its facial coverage.” See Bergen Commercial Bank v. Sisler, 157 N.J. 188, 216, 723 A.2d 944 (1999) (quoting Peper v. Princeton Univ. Bd. of Trs., 77 N.J. 55, 68, 389 A.2d 465 (1978)).

Notably, the Act does not contain a statute of limitations. We find no published opinion determining the appropriate statute of limitations to apply to the Act.

We further note that defamation claims are subject to the single publication rule. Barres v. Holt, Rinehart & Winston, Inc., 131 N.J.Super. 371, 330 A.2d 38 (Law Div. 1974), aff'd o.b., 141 N.J.Super. 563, 359 A.2d 501 (App. Div. 1976), aff'd o.b., 74 N.J. 461, 378 A.2d 1148 (1977). In Barres, the court found that the reasons underlying the single publication rule are consistent with the Legislature’s determination to impose a short, one-year period of limitation for libel. Id. at 387, 330 A.2d 38. In stark contrast, each disclosure made in violation of the Act is a separate and actionable offense. N.J.S.A. 26:5C-14(b).

In addition, in contrast to a defamation claim where a lawsuit provides the opportunity for the defamed person to vindicate his or her reputation, the profound damage that can result from an unauthorized disclosure of an individual’s HIV-positive status cannot be adequately remedied by ordinary damages for reputational harm recoverable in a defamation lawsuit. Thus, the Act provides for the right to recover actual damages, equitable relief, punitive damages, and attorney’s fees. N.J.S.A 26:5C-14(a). Moreover, the interest protected by the Act is not the reputation of the HIV-positive individual, but instead that person’s right to control access to his or her private medical information.

Plaintiffs claim for violation of the Act is most analogous to the category of invasion of privacy claims that are grounded on an allegation that defendant improperly disclosed private facts concerning the plaintiff to a third party. Accordingly, for the reasons set forth above, we hold that plaintiffs claim for violation of the Act is subject to the two-year statute of limitations imposed by N.J.S.A. 2A:14-2.

C. MEDICAL MALPRACTICE

“In a medical-malpractice action, the plaintiff has the burden of proving the relevant standard of care governing the defendant-doctor, a deviation from that standard, an injury proximately caused by the deviation, and damages suffered from the defendant-doctor’s negligence.” Komlodi v. Picciano, 217 N.J. 387, 409, 89 A.3d 1234 (2014).

HIPAA requires health care providers and health care facilities to protect personal medical information from unauthorized disclosure. See 42 U.S.C.A. § 1320d-6(a)(3); Cmty. Hosp. Grp., supra, 381 N.J.Super. at 125, 885 A.2d 18. Health care providers and health care facilities are also required by the Act to maintain the confidentiality of medical records containing “identifying information about a person who has or is suspected of having AIDS or HIV infection[.]” N.J.S.A. 26:5C-7.

Aside from the confidentiality requirements imposed by the Act and HIPPA, physicians are also under a common law duty to maintain the confidentiality of patient records and information.

The physician-patient privilege has a strong tradition in New Jersey. The privilege imposes an obligation on the physician to maintain the confidentiality of a patient’s communications. Stempler v. Speidell, 100 N.J. 368, 495 A.2d 857 (1985). This obligation of confidentiality applies to patient records and information and applies not only to physicians but to hospitals as well. Unick v. Kessler Memorial Hosp., 107 N.J.Super. 121, 257 A.2d 134 (Law Div. 1969). This duty of confidentiality has been the subject of legislative codification, which reflects the public policy of this State. N.J.S.A. 2A:84A-22.1 et seq. The patient must be able “to secure medical services without fear of betrayal and unwarranted embarrassment and detrimental disclosure.... ” Piller v. Kovarsky, 194 N.J.Super. 392, 396, 476 A.2d 1279 (Law Div. 1984).
[Behringer, supra, 249 N.J.Super, at 632, 592 A.2d 1251.]

“The requirement of confidentiality is to protect the patient.” Id. at 638, 592 A.2d 1251. Indeed, the purpose of the patient-physician privilege is to enable the patient to secure medical services without fear of unwarranted detrimental disclosure of information “which might deter him from revealing his symptoms to a doctor to the detriment of his health.” Piller, supra, 194 N. J.Super. at 396, 476 A.2d 1279. The Hospital Patients Bill of Rights Act incorporates the privilege and protects the right of hospital patients to privacy and confidentiality of their medical records to the extent consistent with providing adequate medical care. N.J.S.A 26:2H-12.8(f), (g); Kinsella v. N.Y.T. Television, 382 N. J.Super. 102, 107, 887 A.2d 1144 (App. Div. 2005).

In Behringer, the court held that a medical center’s failure to take such reasonable measures as are necessary to ensure confidentiality of HIV test results was a breach of the duty and obligation to keep such records confidential, rendering the medical center liable for damages caused by this negligent breach. Behringer, supra, 249 N.J.Super. at 638, 641-42, 592 A.2d 1251.

Medical records revealing a patient’s HIV-positive status are afforded heightened confidentiality.

The sensitive nature of medical information about AIDS makes a compelling argument for keeping this information confidential. Society’s moral judgments about the high-risk activities associated with the disease, including sexual relations and drug use, make the information of the most personal kind. Also, the privacy interest in one’s exposure to the AIDS virus is even greater than one’s privacy interest in ordinary medical records because of the stigma that attaches with the disease. The potential for harm in the event of a nonconsensual disclosure is substantial; plaintiffs brief details the stigma and harassment that comes with public knowledge of one’s affliction with AIDS.
[Doe, supra, 729 F.Supp. at 384.]

Defendants argue that because plaintiffs claim for medical malpractice arises out of the same operative facts as his claim for invasion of privacy, they are subject to the same one-year statute of limitation. We disagree.

Subject to the application of the discovery rule, claims for medical malpractice are generally subject to the two-year statute of limitations imposed by N.J.S.A. 2A:14r-2, and must be filed within two years of the accrual of the cause of action. Caravaggio v. D’Agostini, 166 N.J. 237, 244-46, 765 A.2d 182 (2001); Troum, supra, 338 N.J.Super. at 15-16, 768 A.2d 177 (citing Vispisiano v. Ashland Chem. Co., 107 N.J. 416, 426-27, 527 A.2d 66 (1987)).

The breach of a physician’s duty to maintain the confidentiality of his patient’s medical records is a deviation from the standard of care, giving rise to a personal injury claim based upon negligence, not defamation or placing plaintiff in a false light.

In addition, plaintiffs claim for medical malpractice is most analogous to the category of invasion of privacy claims that are grounded on an allegation that defendant improperly disclosed private facts concerning the plaintiff to a third party.

For these reasons, we hold that plaintiffs medical malpractice claim asserted in count two is subject to the two-year statute of limitations imposed by N.J.S.A. 2A:14-2.

IV.

In summary, viewing the pleaded facts in a light most favorable to plaintiff, we find the improper disclosure of plaintiffs HIV-positive status to a third-party without plaintiffs prior informed consent to constitute a violation of the Act, an invasion of privacy by public disclosure of private facts, and medical malpractice. Regardless of the tort specifically pled, defendant’s conduct “struck directly at the personhood of plaintiff.” Rumbauskas, supra, 138 N.J. at 182, 649 A.2d 853. Here, like the claims in Montells and Rumbauskas, defendant’s conduct “cuts most deeply at the personal level.” See ibid. Accordingly, we hold that an action for invasion of privacy by public disclosure of private facts that is premised on conduct such as the unauthorized disclosure of plaintiffs HIV-positive status present here constitutes a claim for “injury to the person” of the plaintiff and is governed by the two-year statute of limitations set forth in N.J.S.A. 2A:14-2. See ibid. We further hold that plaintiffs claims for medical malpractice and violation of the Act, which arise from the same operative facts, are likewise governed by the two-year statute of limitations set forth in N.J.S.A. 2A:14-2.

Accordingly, we affirm the trial court’s order denying defendants’ motion to dismiss plaintiffs amended complaint.

Affirmed. 
      
       " 'HIV' means the human immunodeficiency virus or any other related virus identified as a probable causative agent of AIDS." N.J.S.A. 26:5C-15. "AIDS” means acquired immune deficiency syndrome. Ibid. "HIV-positive" means having a positive reaction on a "HIV related test" used to detect "any virus, antibody, antigen or etiologic agent thought to cause or to indicate the presence of AIDS." N.J.S.A. 26:5C-5. "HIV-positive” refers to an individual infected with HIV but not yet having AIDS. See Troum v. Newark Beth Israel Med. Ctr., 338 N.J.Super. 1, 6, 10, 14, 768 A.2d 177 (App. Div.) (explaining that HIV and AIDS occur as a seamless progression of a single pathology, with HIV as the infection and AIDS being the manifestation of the disease), certif. denied, 168 N.J. 295, 773 A.2d 1158 (2001).
     
      
       In order to protect his identity, plaintiff is identified fictitiously as John Smith in the public pleadings.
     
      
       The record does not reveal the third party's identity or his or her relationship to plaintiff.
     
      
       HIPAA "concerns the protection of personal medical information and regulates its use and disclosure by 'covered entities.' " Cmty. Hosp. Grp., Inc. v. Blume Goldfaden Berkowitz Donnelly Fried & Forte, P.C., 381 N.J.Super. 119, 125, 885 A.2d 18 (App. Div. 2005).
     
      
      
        Ferreira v. Rancocas Orthopedic Assocs., 178 N.J. 144, 836 A.2d 779 (2003).
     
      
       In Cmty. Hosp. Grp., Inc., supra, 381 N.J.Super. at 126, 885 A.2d 18, we held that a private right of action cannot be maintained under HIPAA. Plaintiff, however, is no longer seeking relief under HIPAA for defendants’ alleged HIPAA violation.
     
      
      
        See also Montells, supra, 133 N.J. at 298, 627 A.2d 654 (two-year personal injury statute of limitations applied to claims under LAD); Labree v. Mobil Oil Corp., 300 N.J.Super. 234, 242-44, 692 A.2d 540 (App. Div.) (two-year personal injury statute of limitations applied to action for retaliatory discharge under Workers' Compensation Act), certif. denied, 151 N.J. 465, 700 A.2d 878 (1997); Goncalvez v. Patuto, 188 N.J.Super. 620, 630, 458 A.2d 146 (App. Div. 1983) (emotional distress claim subject to two-year personal injury statute of limitations); Heavner v. Uniroyal, Inc., 118 N.J.Super. 116, 120, 286 A.2d 718 (App. Div. 1972), aff'd 63 N.J. 130, 305 A.2d 412 (1973) (claim arising out of sales transaction was essentially a personal injury action subject to the two-year statute of limitations); Atl. City Hosp. v. Finkle, 110 N.J.Super. 435, 438, 265 A.2d 853 (Law Div. 1970) (claim for personal injuries under breach of warranty theory subject to two-year statute of limitations); Montgomery v. De Simone, 159 F.3d 120, 126 n.4 (3d Cir. 1998) (civil rights claims under 42 U.S.C.A. § 1983 subject to New Jersey’s two-year statute of limitations for personal injury actions).
     
      
       Given that plaintiff's counsel has clarified to us that his client's claims solely involve defendants' wrongful disclosure of truthful facts, we need not address or resolve here what statute(s) of limitations would apply to a defendant's "mixed” statement that contains both truthful and false elements. For example, a simple version of such a mixed statement might be, "P has AIDS,” if it truthfully revealed that P is HIV-positive but falsely asserted that P has contracted AIDS. The statement's truthful aspect could comprise the tort of invasion of privacy by disclosure, while the false aspect could be regarded as libel or slander. We leave for a future day the resolution of whether such harmful speech, with mixed components of truth and falsity, would trigger a two-year statute of limitations, a one-year period, or both.
     