1. Responsibility for Cook’s negligence
Employee or independent contractor
An employer ordinarily is vicariously liable for an employee’s negligence within the scope of employment, but generally not for an independent contractor’s conduct. Classification turns principally on the right to control the manner and means, with other factors including independent business, equipment, skill, payment, duration, and the parties’ actual relationship.
Cook owns and operates a catering business contracted to provide on-site meals. That supports independent-contractor status. The facts do not state that the hospital directs the details of preparing food or employs her workers. Merely working on hospital premises and complying with a health code does not conclusively establish employee status. If the hospital retained sufficient operational control, an employee or retained-control theory could supply liability, but the contract alone does not prove it.
Nondelegable duties and related exceptions
Even when a contractor performs the work, a principal may remain responsible for breach of a nondelegable statutory or protective duty. Hospitals undertake to care for patients, including furnishing safe food. The health code specifically requires food served in a hospital never to be left unattended to prevent contamination or tampering. A strong argument is that this patient-protection obligation cannot be avoided by outsourcing the kitchen: the hospital remains accountable for its fulfillment even if Cook also bears direct liability.
Cook has already been found negligent for noncompliance. Patrick is a hospital patient and contamination is exactly the risk the statute targets. The hospital may argue that the code addresses the food operator rather than imposing vicarious responsibility on every contracting facility. The statute’s full allocation of duty is not supplied, so its nondelegable character should be argued from its protective purpose and the hospital’s undertaking, not simply assumed from every statutory violation. On these facts that exception is much stronger than treating ordinary catering as inherently dangerous work.
Apparent agency also may apply where a hospital presents services as its own and a patient reasonably looks to it for them without knowing of an independent provider. Meals supplied on site to patients support that inference, but the record gives no explicit representation, notice, or reliance details. Negligent selection or supervision requires an unreasonable choice or retained-control failure attributable to the hospital; no prior notice that Cook was incompetent is given. These routes are possible but should not replace the well-supported nondelegable-duty analysis with invented facts.
2. Duty to protect against Frank
There generally is no duty to protect another from third-party crime absent a qualifying relationship, undertaking, created risk, or other exception. A hospital-patient relationship is a classic protective setting: admitted patients rely on the facility for safety and may be unable to guard themselves. The hospital also controls access to its kitchen and meals. It therefore owes reasonable care against foreseeable harmful interference, not absolute insurance against all crime.
Davis received several threats of a massive attack directed at the hospital. They do not identify Frank, peanuts, or the kitchen, but repeated specific threats to this facility materially strengthen foreseeability beyond a purely hypothetical crime. Reassigning the kitchen guard indicates recognition of a real security problem. Reasonable measures could include warning relevant staff, preserving secure food access, and ensuring compliance with the uninterrupted-attendance rule. The burden and likely efficacy of each precaution should be compared with the gravity and likelihood of harm.
Patrick need not show that the hospital foresaw the exact contaminant or assailant. An intentional act is not automatically a superseding cause when preventing tampering or attacks is the very purpose of the duty. Frank’s intrusion and Cook’s unattended food can operate concurrently with negligent security or communication. Patrick’s serious allergy affects the extent of injury under the ordinary thin-skull principle rather than eliminating causation merely because most patients might not suffer as severely.
The hospital can argue that anonymous messages were nonspecific, increased lobby protection was reasonable, and unforeseeable food sabotage was not preventable by a reasonable facility. Those arguments concern scope and breach, but the special relationship and concrete threats support a duty of reasonable protection. Statutory governmental immunities may separately limit a public hospital’s liability; none is specified, so duty should not be confused with an assumed waiver or blanket sovereign immunity.
3. Davis’s defenses
Reasonable emergency allocation and lack of causation
Davis can argue that she reasonably prioritized the lobby and entrance in response to threats of a massive attack. Resources were limited by the described reassignment, and reasonable care permits choices among risks rather than perfect hindsight. The question does not, however, state that no additional guard could be obtained or that leaving the kitchen unprotected was unavoidable. Her failure to share threat information weakens the claim that the response reasonably protected all vulnerable areas.
She can dispute whether a kitchen patrol would have stopped Frank and point to Cook’s code violation as the immediate lapse. Patrick must prove that a particular breach by Davis was a substantial causal factor; mere bad outcome does not prove it. But a guard’s removal facilitating access is a plausible causal theory, and the very anti-tampering purpose makes Frank’s misconduct a weak automatic superseding-cause defense.
Governmental discretionary-function protection
As a public hospital official making security decisions, Davis may invoke an applicable discretionary-function or public-official immunity. Such protections commonly distinguish genuine policy choices involving allocation of resources and balancing public risks from routine operational negligence. A decision to redeploy security among competing threats presents a substantial policy-allocation argument.
Her title as CEO or the fact that any choice involved judgment is not conclusive. The governing state statute, its coverage, and whether this was protected policymaking rather than negligent implementation must be established. A mandatory statutory food-attendance requirement cannot necessarily be disregarded by calling its implementation discretionary, though that requirement directly addresses the food-service lapse and not necessarily a mandatory guard assignment.
Federal qualified immunity for constitutional damages and the Federal Tort Claims Act are not automatic defenses to this state negligence claim against a state official. Likewise, a general no-duty-to-the-public doctrine is weakened by the particular hospital-patient relationship. Davis has plausible reasonable-care, causation, and statutory discretionary-immunity defenses, with immunity’s actual availability dependent on the governing law and facts rather than assured on the information given.