
766 N.W.2d 787 (2009)
John DOE, Appellant,
v.
CENTRAL IOWA HEALTH SYSTEM d/b/a Iowa Health Des Moines d/b/a Iowa Methodist Medical Center and d/b/a Iowa Lutheran Hospital, Appellees.
No. 07-1017.
Supreme Court of Iowa.
May 15, 2009.
Rehearing Denied June 28, 2009.
*788 Gretchen R. Jensen and Jeffrey L. Goodman of Goodman & Associates, P.C., West Des Moines, for appellant.
Frank B. Harty, Thomas W. Foley, and Hannah M. Rogers of Nyemaster, Goode, West, Hansell & O'Brien, P.C., Des Moines, for appellees.
WIGGINS, Justice.
In this appeal, we must decide whether the district court was correct when it granted the defendants' motion for judgment notwithstanding the verdict. Because the plaintiff failed to produce sufficient evidence to support his claim that the disclosures of his mental health records were the cause of his emotional distress, we affirm the judgment of the district court.

I. Prior Proceedings.
John Doe, an employee of Central Iowa Health System, brought an action against Central Iowa Health System, Iowa Health System, Iowa Methodist Medical Center, and Iowa Lutheran Hospital[1] alleging that in 2003 they unlawfully disclosed his medical and/or mental health information to Doe's coemployees. Doe alleged Iowa Health violated the privacy rules of the Federal Health Insurance Portability and Accountability Act, breached its fiduciary duty, and violated the privacy rules of Iowa Code chapter 228 covering the disclosure of mental health and psychological information. Doe further alleged these violations caused him to suffer humiliation, embarrassment, mental anguish, fear of social ostracism, fear regarding job security, and other severe emotional distress.
The case proceeded to trial on the alleged violation of chapter 228. The Code provides in relevant part:
1. Except as specifically authorized in section 228.3, 228.5, 228.6, 228.7, or 228.8, a mental health professional, data collector, or employee or agent of a mental *789 health professional, of a data collector, or of or for a mental health facility shall not disclose or permit the disclosure of mental health information.
2. Upon disclosure of mental health information pursuant to section 228.3, 228.5, 228.6, 228.7, or 228.8, the person disclosing the mental health information shall enter a notation on and maintain the notation with the individual's record of mental health information, stating the date of the disclosure and the name of the recipient of mental health information.
The person disclosing the mental health information shall give the recipient of the information a statement which informs the recipient that disclosures may only be made pursuant to the written authorization of an individual or an individual's legal representative, or as otherwise provided in this chapter, that the unauthorized disclosure of mental health information is unlawful, and that civil damages and criminal penalties may be applicable to the unauthorized disclosure of mental health information.
3. A recipient of mental health information shall not disclose the information received, except as specifically authorized for initial disclosure in section 228.3, 228.5, 228.6, 228.7, or 228.8. However, mental health information may be transferred at any time to another facility, physician, or mental health professional in cases of a medical emergency or if the individual or the individual's legal representative requests the transfer in writing for the purposes of receipt of medical or mental health professional services, at which time the requirements of subsection 2 shall be followed.
Iowa Code § 228.2 (2003).
At the close of Doe's case, Iowa Health moved for a directed verdict. In their motion for a directed verdict they made the following claims: (1) Iowa Code chapter 228 does not provide Doe with a private cause of action; (2) if chapter 228 does provide a private cause of action, Iowa Health did not violate chapter 228 because any disclosures made were not in violation of chapter 228; (3) any disclosures made by Iowa Health employees was done outside the scope of their employment; (4) Doe failed to present substantial evidence that he suffered any emotional distress caused by the actions of Iowa Health employees.
The court overruled the motion for a directed verdict. In doing so, the court stated it believed chapter 228 created a private cause of action for emotional distress without a showing of physical injury or a showing of outrageous conduct. However, the court did state that in its mind "there is a huge issue in this case about the sufficiency of the evidence to prove emotional distress." The court reserved ruling on the sufficiency of the evidence issue.
At the close of all the evidence, Iowa Health renewed its motion for directed verdict. The court renewed the ruling it made at the end of Doe's evidence and decided to submit the case to the jury. The court used the following marshalling instruction to instruct the jury on the elements Doe had to prove to recover under a private cause of action under section 228.2.
INSTRUCTION NO. 12
In order to recover on his claim of unlawful disclosure of mental health information the Plaintiff must prove all of the following propositions:
1. That an employee of the Defendant disclosed the Plaintiff's mental health information. The term "disclosed" is defined in Instruction No. 13. The term "mental health information" *790 is defined in Instruction No. 13.
2. That the employee who disclosed the Plaintiff's mental health information did so:
a. within the scope of his or her employment. The phrase "within the scope of employment" is defined in Instruction No. 14; or
b. with the authorization of a managerial employee of the Defendant.
3. The disclosure was unlawful. The term "unlawful" is defined in Instruction No. 15.
4. That the unlawful disclosure was the proximate cause of emotional distress to the Plaintiff. The term "emotional distress" is defined in Instruction No. 16.
5. The amount of damage.
If the Plaintiff has failed to prove any of these propositions, the Plaintiff is not entitled to recover damages. If the Plaintiff has proved all of these propositions, he is entitled to recover some amount of damages as explained in Instruction No. 17.
The court further instructed the jury that the only element of damages upon which the jury could return a verdict was for Doe's emotional distress.
The jury found Doe proved all the elements as required by the marshalling instruction and returned a verdict in favor of Doe for $175,000. Iowa Health then filed a motion for judgment notwithstanding the verdict or in the alternative a motion for new trial or remittitur. Iowa Health raised the same issues as it raised in its motion for directed verdict. The district court sustained Iowa Health's motion for judgment notwithstanding the verdict claiming the disclosures by four of Iowa Health's employees were not the proximate cause of any emotional distress to Doe and there was not substantial evidence tending to prove the fifth employee made any disclosure of mental health information while acting within the scope of employment.

II. Issue.
Doe appeals the district court order granting Iowa Health's judgment notwithstanding the verdict. In response to Doe's brief, Iowa Health continues to raise the issue that chapter 228 does not imply a private cause of action and Doe failed to establish that any violation by Iowa Health of chapter 228 caused Doe's emotional distress. Iowa Health's claimDoe failed to establish that any violation by Iowa Health of chapter 228 caused the emotional distress suffered by Doeis dispositive of this appeal. Therefore, for purposes of this appeal, we will assume without deciding, that Iowa Code section 228.2 implies a private cause of action and that chapter 228 allows recovery for emotional distress without physical injury or a showing of outrageous conduct. In other words, we will assume the court properly instructed the jury on the law and the instructions are the law of the case.

III. Scope of Review.
We review the district court's grant of a motion for judgment notwithstanding the verdict for correction of errors at law. Maxim Techs., Inc. v. City of Dubuque, 690 N.W.2d 896, 900 (Iowa 2005). Our task is to determine whether substantial evidence exists to support the elements of the plaintiff's claim, justifying the court to submit the case to the jury. Gibson v. ITT Hartford Ins. Co., 621 N.W.2d 388, 391 (Iowa 2001). In doing so, we review the evidence in the light most favorable to the nonmoving party. Id. Evidence is substantial when reasonable minds would accept the evidence as adequate to reach the same findings. Easton v. Howard, 751 N.W.2d 1, 5 (Iowa 2008).


*791 III. Analysis.
Examining the evidence in the light most favorable to Doe, we find the evidence as follows. On December 4, 2003, Doe attempted suicide by taking an overdose of aspirin. He wanted to die because he did not care about life anymore and he thought it would be the best thing for him. One cause of his emotional distress leading to his suicide attempt was the fact his mother had just passed away of a massive heart attack. Another cause was that his car was repossessed on the day he attempted suicide.
After taking the overdose, Doe sent a text message to one of his friends telling her goodbye. He also thought he might have called or sent a text message to another friend relaying the same information. Another friend actually spoke to Doe and told him that he needed to get to the hospital or she was going to call 911. Doe agreed to go to the hospital and had his father take him. He was admitted to the mental health unit. Doe then had his friends inform his supervisor that he would not be at work because of his hospitalization.
Doe's supervisor came to Lutheran Hospital and visited him in the mental health unit. Doe gave his supervisor permission to tell two of his coemployees that he was in the unit and they could come visit him. At this point, at least two coemployees and his supervisor knew Doe was in the mental health unit. Doe did not tell his coemployees that they were not to disclose his situation or that he was in the mental health unit.
On December 15, his first day back at work, Doe received a phone call from a former employee. This former employee was a sister of a person who worked at Iowa Health. Based on this phone call, Doe had a suspicion that an employee of Iowa Health accessed his records and told this person about his mental health problems. Doe also became suspicious that other people may have known about his hospitalization by the way another employee treated him when he returned to his job at Iowa Health. Based on his suspicions, Doe made a complaint to the privacy officer at Iowa Health concerning the unauthorized access and disclosure of his records.
The privacy officer conducted an investigation and determined six people, who were not authorized to access Doe's records, had accessed his records. Each of those persons received a level three discipline. A level three discipline is the highest level of discipline a person could receive and is just shy of termination. Doe requested the privacy officer to confirm whether any Iowa Health employees accessed his records without authorization. The privacy officer told him under Iowa Health's policy she was unable to confirm whether the records were accessed. Doe was not aware of any unauthorized access of his records until after he filed the lawsuit.
In February 2004, a coemployee made a sexual harassment complaint against Doe. The complaint alleged Doe made graphic remarks about wanting to have sex with the complainant. The complaint was investigated by Iowa Health and determined to be founded. Iowa Health disciplined Doe for violating its sexual harassment policies.
After receiving his discipline for the sexual harassment violation, Doe transferred from Iowa Methodist to Iowa Lutheran Hospital. He transferred to Lutheran Hospital partly because his coemployees at Methodist made him feel uncomfortable and partly because of the sexual harassment complaint. After his transfer, Doe received a note from one of his coemployees. The note stated
[Doe], your pen is now mine. Do notI repeatdo not try to retrieve it. If you *792 do you will suffer the utmost excruciating pain you have ever experienced, except for that one night when you thought it might be fun to experiment withwhoops, did I mention that? Sucka.
This note was from a coemployee who accessed Doe's records without authorization.
At trial, Doe told the jury he was not asking for any lost wages or medical expenses, rather he was only asking for emotional distress. He testified that after he learned someone had disclosed his records that he became less social. He further stated he became more introverted, because he did not share personal information as much as he had before these disclosures. He also testified that after the disclosures his sex drive diminished significantly. He felt socializing with his fellow employees after the disclosures triggered an increase in emotional distress because he felt uncomfortable knowing that his coemployees knew about his suicide attempt.
Doe further testified he did not seek professional treatment for his condition because he figured he would have to go to a doctor connected with Iowa Health and the privacy of his records would be at risk. The only evidence presented at trial to corroborate Doe's damage claim was from one of his coemployees, who testified that when Doe returned to work after his suicide attempt he was acting differently. This coworker testified this change took place when he came back to work, but she did not relate any change to the unauthorized disclosures of information.
Assuming Iowa Code section 228.2 implies a private cause of action, section 228.2 creates the duty or standard of care a person must follow. See Seeman v. Liberty Mut. Ins. Co., 322 N.W.2d 35, 37 (Iowa 1982) (stating "[s]tatutory enactment is one of the means by which such duty or standard of care may be created"); Restatement (Second) of Torts § 286 (1965). A breach of that duty is negligence and gives rise to a tort action.[2]Seeman, 322 N.W.2d at 37. As instructed by the district court, a plaintiff in a tort action based on negligence can only recover damages for those injuries suffered as a proximate cause of the defendant's negligence. See Kolbe v. State, 625 N.W.2d 721, 725 (Iowa 2001) (listing elements of a negligence action). Therefore, in order for Doe to succeed, he must prove the unauthorized disclosures of his records caused the emotional distress he testified to at trial. However, before the court can submit his claim that the disclosures of his records caused his emotional distress to the jury, the record must contain substantial evidence to support the submission. Gibson, 621 N.W.2d at 391.
The longstanding Iowa rule is that in a tort action the necessity of expert testimony or the quality of necessary expert testimony determines whether substantial evidence supports the submission of the causal relationship between the act of the wrongdoer and the injury. Mark McCormick, Opinion Evidence in Iowa, 19 Drake L.Rev. 245, 260 (1970). We use the necessity of expert testimony or the quality of necessary expert testimony to determine whether substantial evidence supports causation of a medical condition because, for substantial evidence to exist on causation, the plaintiff must show something more than the evidence is consistent with the plaintiff's theory of causation. *793 Ramberg v. Morgan, 209 Iowa 474, 482, 218 N.W. 492, 497 (1928). The evidence must show the plaintiff's theory of causation is "reasonably probablenot merely possible, and more probable than any other hypothesis based on such evidence." Id. The evidence, however, need not be conclusive of causation. Soreide v. Vilas & Co., 247 Iowa 1139, 1143, 78 N.W.2d 41, 43-44 (1956).
When the causal connection between the tortfeasor's actions and the plaintiff's injury is within the knowledge and experience of an ordinary layperson, the plaintiff does not need expert testimony to create a jury question on causation. Stickleman v. Synhorst, 243 Iowa 872, 877-78, 52 N.W.2d 504, 507-08 (1952). In Stickleman, a physician needed to stick a needle in the patient's throat to inject an opaque oily substance into the trachea so the substance would enter her lungs. Id. at 874, 52 N.W.2d at 506. After the substance entered her lungs, the physician was going to take an x-ray of the lungs to reveal her bronchial tubes. Id. On his first attempt, the physician missed her trachea. Id. On the second attempt, he was successful in introducing the substance into the trachea. Id. at 875, 52 N.W.2d at 506. Upon returning home, the patient started to bleed profusely from the puncture wounds. Id. It took three procedures and four pints of blood to stop her from bleeding to death. Id. The physician claimed there was insufficient evidence to submit the case to the jury because the patient failed to produce any expert medical testimony to establish the puncture wounds on her neck caused the excessive bleeding. Id. at 878, 52 N.W.2d at 508. Our court disagreed. Id.
The court stated, "[i]t is sufficient if under the evidence and facts of common knowledge plaintiff's theory is reasonably probable, not merely possible, and more probable than any other theory based thereon." Id. at 877, 52 N.W.2d at 507 (emphasis added). The evidence showed that several important arteries and veins are in the throat and they carry a considerable amount of blood. Id. The court also found it is common knowledge that if a person's throat is cut, a person can suffer a serious injury due to the danger from the loss of blood. Id. Consequently, our court held there was no requirement that the cause of her throat injury be shown by expert medical testimony. Id. at 878, 52 N.W.2d at 508.
When the causal connection between the tortfeasor's actions and the plaintiff's injury is not within the knowledge and experience of an ordinary layperson, the plaintiff needs expert testimony to create a jury question on causation. Bradshaw v. Iowa Methodist Hosp., 251 Iowa 375, 382-83, 101 N.W.2d 167, 171 (1960). In Bradshaw, a patient entered the hospital complaining that his back was very sore and that he could not sleep. Id. at 378, 101 N.W.2d at 169. While in the hospital, the patient fell in the physiotherapy room. Id. at 377, 101 N.W.2d at 168. The patient brought an action against the hospital, and the jury returned a verdict in his favor. Id. The hospital appealed the verdict. Id.
Approximately six months prior to the fall, the patient injured his back in a work-related incident. Id. Because of his work-related injury, doctors removed a protruding intervertebral disc at the fifth lumbar interspace. Id. at 378, 101 N.W.2d at 168-69. Eight months after his fall in the hospital, the Mayo Clinic removed a protruding degenerated disc at the fourth lumbar space and fused his fourth and fifth lumbar vertebrae. Id. at 379, 101 N.W.2d at 169. The patient claimed the fall at the hospital was the cause of the condition treated at Mayo. Id. At trial, the Mayo surgeon testified the fall at the hospital was possibly the cause of the condition. Id. at 379, 101 N.W.2d at 170. The surgeon *794 could not testify the fall at the hospital was probably the cause of the condition. Id.
Our court reversed the judgment of the district court. Id. at 390, 101 N.W.2d at 176. Our court held the causal connection between the patient's fall in the hospital and the condition Mayo treated him for was not within the knowledge and experience of an ordinary layperson. Id. at 382-83, 101 N.W.2d at 171. The court also held that if the Mayo surgeon's testimony, expressed in the term of possibility, was accompanied by lay testimony that the patient was not afflicted with a back injury prior to the fall at the hospital, a jury question would be generated as to the causation issue. Id. at 380, 101 N.W.2d at 170. Absent this additional testimony, the patient was required to present expert testimony in the term of probability causally relating the fall to the condition treated at Mayo. Id. at 383, 101 N.W.2d at 171-72.
We have applied the rule that a plaintiff needs expert testimony to prove causation of emotional distress damages unless the causation is so obvious that it is within the common knowledge and experience of a layperson. Vaughn v. Ag Processing, Inc., 459 N.W.2d 627, 637 (Iowa 1990). In Vaughn, the plaintiff brought an action for intentional infliction of emotional distress arising out of religious harassment. Id. at 630. The primary evidence of the plaintiff's emotional distress was his own testimony and conclusions that the harassment at work caused him to lose fifty pounds and become ill with colitis. Id. at 637. We held the causal relationship between the harassment and the plaintiff's symptoms was not within the common experience of a jury. Id. We further stated, "[i]n many cases where we have held that a fact question was engendered on the issue of emotional harm and causation, we have relied on the testimony of physicians and psychiatrists." Id. (citations omitted).
In the present case, Doe presented no expert witness to testify that there was a connection between the unauthorized disclosures of his records and the changes in his behavior. Therefore, we must determine if the causation issue is within the knowledge and experience of an ordinary layperson. However, before addressing that issue, we must comment on Doe's claim that Iowa Health did not raise the necessity of expert testimony issue in the district court and is precluded from doing so on appeal.
What Doe fails to realize is that the necessity or the quality of necessary expert testimony determines whether the evidence is substantial when dealing with the causation of a medical condition. Mark McCormick, Opinion Evidence in Iowa, 19 Drake L.Rev. at 260. If the causal connection is within the knowledge and experience of an ordinary layperson, expert testimony is not needed to generate a jury question on causation. On the other hand, if the causal connection is not within the knowledge and experience of an ordinary layperson, expert testimony is necessary to generate a jury question on causation. Id. Therefore, Iowa Health's motion for directed verdict stating Doe failed to present substantial evidence that he suffered any emotional distress caused by the action of Iowa Health employees preserves the error.
On the merits of the issue, the evidence establishes Doe attempted to commit suicide by taking an overdose of aspirin. Doe was suffering from emotional distress at the time of his attempted suicide. His medical condition was such that he needed to be hospitalized in a mental health unit. The record does not disclose the extent to which the treatment Doe received after the suicide attempt resolved or relieved his preexisting emotional distress. We do not know the state of his *795 mental condition on his release from the hospital.
After the unauthorized disclosures of his records, Doe testified he believed the disclosures caused him to become less social, more introverted, and less sexually active. All the evidence of Doe's emotional distress claim consisted exclusively of his own conclusory statements. He did not articulate at what point in time after the unauthorized disclosures he became less social, more introverted, and less sexually active. He did not testify if these conditions progressed or regressed over time. He did not obtain any medication or treatment to combat his condition. His friend testified that he was different after the hospitalization, but did not attribute Doe's change in condition to the unauthorized disclosures of his records.
Doe is not required to produce expert testimony to submit the causation of his subjective complaints of emotional distress to the jury if causation is so obvious that it is within the common knowledge and experience of a layperson. The evidence here, however, is insufficient to allow a layperson to determine whether the unauthorized disclosures of the records caused Doe's alleged emotional distress. Doe did not present evidence as to his mental condition on his release from the mental health unit. Doe did not reasonably and sufficiently explain the circumstances and progression of his emotional distress. He merely relied on conclusory statements to support his claim. The jury had no basis upon which to determine if his emotional distress was caused by the unauthorized disclosures of the records or by the preexisting condition that led to his suicide attempt.
Applying the Bradshaw analysis, we conclude the lay jurors, unaided by expert testimony, could not distinguish the emotional distress, if any, arising from the unauthorized disclosures of Doe's records from the preexisting emotional distress. The only difference between the facts in Bradshaw and the facts in this case is that the plaintiff in Bradshaw suffered from a physical health condition while Doe suffers from a mental health condition.
Therefore, we do not believe it is within the knowledge and experience of ordinary lay jurors to determine which aspects of Doe's emotional distress were related to the unauthorized disclosures of his records, and which were related to preexisting factors. Because of his preexisting condition and the conclusory nature of his testimony, without expert testimony relating Doe's condition to the unauthorized disclosures of his records, the jury was left to speculate as to what part of Doe's emotional distress, if any, was actually related to the unauthorized disclosures. Doe's bare assertions of causation do not show his theory of causation is reasonably probablenot merely possible, and more probable than any other hypothesis based on the evidence. Accordingly, substantial evidence did not exist to submit the issue of causation to the jury.

V. Disposition.
Because substantial evidence does not support a finding that Doe suffered emotional distress caused by the action of Iowa Health employees, the district court should have granted Iowa Health's judgment notwithstanding the verdict. Therefore, we affirm the judgment of the district court granting the motion for judgment notwithstanding the verdict, setting aside the jury verdict, and dismissing Doe's petition.
AFFIRMED.
All justices concur except TERNUS, C.J., and APPEL, J., who take no part.
NOTES
[1]  These defendants will be collectively referred to as "Iowa Health."
[2]  Doe never alleged a common law cause of action such as invasion of privacy. Therefore, we will only analyze this case under negligence theory created by violation of a statute.
