1. What Makes Information Legally Confidential in New York
Not all private or sensitive information carries legal protection. For a confidentiality obligation to exist under New York law, the information must fit into one of three recognized categories, and courts are fairly strict about where that line falls.
The first is contractually protected information: data covered by a non-disclosure agreement, employment contract, or confidentiality clause. The second is professionally protected information, arising from relationships that carry an inherent legal duty of confidence, such as between a physician and patient, or an attorney and client. The third is information protected by statute, including patient health data under HIPAA and certain financial records subject to state and federal regulatory requirements.
General knowledge, publicly available information, and facts already known to the recipient typically do not qualify. Courts focus on whether the information carried a quality of secrecy at the time it was shared.
2. The Four Elements of a Breach of Confidentiality Claim
New York courts apply a four-part test when evaluating these claims. Every element must be satisfied; three out of four is not enough.
The Information Was Confidential
The information must have had a genuine quality of secrecy when it was disclosed. Courts look at whether it was labeled confidential, shared in circumstances that implied privacy, or inherently sensitive by its nature. General business knowledge and information in the public domain will not meet this standard.
A Reasonable Expectation of Privacy Existed
Both parties must have understood, expressly or by implication, that the information was to remain private. A signed NDA establishes this directly. In professional relationships, the law imposes the expectation regardless of any written agreement. In other situations, courts examine the surrounding circumstances to determine whether a reasonable person in your position would have expected confidentiality to apply.
The Disclosure or Use Was Unauthorized
The other party must have shared or used the information beyond what was permitted. This includes disclosing it to third parties, using it to compete against you, or sharing it for personal gain. Disclosures that were careless rather than deliberate can still satisfy this element when the breach resulted from a failure to exercise reasonable care.
You Suffered Actual Harm
Harm must be real and identifiable. New York courts recognize financial losses, lost competitive advantage, disruption to business relationships, and reputational damage. Speculative harm is not enough.
3. How the Applicable Standards Differ by Context
Breach of confidentiality is not a single cause of action with a single set of rules. The legal framework that governs your claim depends on the relationship in which the disclosure occurred, and that context shapes both the nature of the duty and the remedies available to you.
Workplace and Employment Breaches
Employee confidentiality obligations arise from signed agreements, implied contractual duties, and sometimes statute. When a current or former employee discloses client data, internal business strategies, or proprietary information to a competitor, that disclosure can support civil liability and, in more serious cases, criminal exposure. Employee misconduct of this kind is among the confidentiality disputes our firm handles most often.
Healthcare and Hipaa Violations
Medical providers, insurers, and their business associates are required under HIPAA to protect patient health information. HIPAA does not give patients a direct right to sue under federal law, but New York recognizes breach of confidentiality claims under state common law when a provider discloses records without authorization. HIPAA litigation can result in civil damages alongside federal regulatory penalties.
Attorney-Client Privilege Breaches
New York attorneys are bound by Rule 1.6 of the New York Rules of Professional Conduct, which prohibits disclosing client information without consent. A violation may support a legal malpractice claim or a disciplinary complaint to the state grievance committee, depending on the nature and impact of the disclosure. This area overlaps with professional licensing consequences that go beyond ordinary civil liability.
Business and Trade Secret Disclosures
When a former partner, contractor, or employee discloses proprietary formulas, client lists, pricing models, or business strategies, the claim often overlaps with trade secret misappropriation. New York applies common law standards for these claims, focusing on whether the information was genuinely kept secret and whether the holder took reasonable steps to protect it. The federal Defend Trade Secrets Act may apply concurrently where the disclosure affects interstate commerce.
4. Legal Consequences and Remedies in New York
The remedies available in a breach of confidentiality case depend on how the claim is framed, what harm occurred, and how quickly you act. New York law provides several distinct forms of relief, and it is often appropriate to pursue more than one.
Injunctive Relief
If a breach is ongoing or future disclosure appears imminent, a court can issue a temporary restraining order or preliminary injunction to halt further dissemination. In trade secret and employment cases, this is frequently the most urgent step, because once information reaches the wrong hands, damages alone may not undo the harm.
Monetary Damages
Recoverable damages may include lost profits, costs incurred to mitigate the harm, and the defendant's unjust enrichment. Where the breach was willful or malicious, punitive damages may also be available. The amount recoverable depends on what you can document.
Criminal Liability
Certain confidentiality breaches carry criminal exposure. The criminal provisions of HIPAA (42 U.S.C. §1320d-6) impose federal penalties for knowingly obtaining or disclosing protected health information without authorization. Separate liability may arise under the Computer Fraud and Abuse Act when confidential information is obtained through unauthorized system access.
Statute of Limitations
In New York, breach of contract claims carry a six-year limitations period under CPLR §213. Tort-based confidentiality claims, including breach of fiduciary duty seeking monetary damages, typically carry a three-year period under CPLR §214. Federal trade secret claims under the Defend Trade Secrets Act carry a three-year period measured from the date of discovery. Waiting costs you options.
5. What to Do after a Breach
If you believe your confidential information was disclosed without authorization, how you respond in the days that follow matters more than people expect.
Start by preserving everything you have: emails, contracts, messages, and any record of who received the information. Evidence disappears faster than people expect, particularly in digital environments. Try to identify the scope as clearly as possible, including what was disclosed, to whom, and when. Document financial losses, disrupted business relationships, and any reputational damage while the details are still fresh.
One thing to avoid: contacting the other party without legal advice. A poorly worded demand or informal confrontation can complicate your claim before it has a chance to develop properly.
Our attorneys can evaluate whether your situation meets the legal threshold for a claim, identify the appropriate theory of liability, and advise on next steps. Contact us through our breach of confidentiality practice page to discuss your situation.
6. Frequently Asked Questions
These are the questions that come up most often when someone first consults with us about a potential breach of confidentiality claim.
Does breach of confidentiality require a written agreement?
No. New York courts recognize confidentiality obligations arising from the nature of a relationship and the circumstances of a disclosure, even without a signed NDA. Written agreements make proving the obligation considerably easier, but they are not a prerequisite.
What is the difference between breach of confidentiality and breach of contract?
The two often overlap. When a confidentiality clause is part of a signed contract, a violation can support both claims simultaneously. But breach of confidentiality can also arise entirely outside any contract, through professional duties or statutory obligations.
What if the disclosure was accidental?
Intent is not a required element. If a party failed to exercise reasonable care in protecting confidential information and that failure caused the disclosure, a negligence-based confidentiality claim may still be viable.
How quickly do I need to act?
As soon as possible. The limitations period runs from the date of the breach or the date it was discovered, depending on how the claim is framed. Beyond the legal deadline, delay can allow evidence to disappear and harm to compound in ways that are difficult to reverse.
16 Jul, 2025
