
89 P.3d 800 (2004)
Diana BRYSON, Petitioner/Cross-Respondent,
v.
BANNER HEALTH SYSTEM d/b/a Fairbanks Memorial Hospital d/b/a Family Recovery Center and Guy Patterson, Respondents/Cross-Petitioners.
Nos. S-10653, S-10673.
Supreme Court of Alaska.
April 23, 2004.
*801 Kenneth P. Ringstad, Paskvan, Ringstad, Parrish, P.C., Fairbanks, for Petitioner/Cross-Respondent.
Howard A. Lazar and Ann B. Black, Delaney, Wiles, Hayes, Gerety, Ellis & Young, Inc., Anchorage, for Respondents/Cross-Petitioners.
Before: BRYNER, Chief Justice, MATTHEWS, FABE, and CARPENETI, Justices.

OPINION
PER CURIAM.

I. INTRODUCTION
The Family Recovery Center placed Diana Bryson and Laurence Kompkoff in the same continuing care substance abuse treatment group. According to Bryson, as part of the treatment, the Center encouraged all members of the group to contact and assist each other outside of the group setting. The Center knew that Kompkoff had an extensive criminal history of alcohol-related crimes of violence, including sexual assaults. Kompkoff relapsed into drinking while being treated. He called Bryson for a ride, attempted to rape her, and shot her in the ensuing struggle. Bryson sued the Center, alleging that it negligently failed to warn and protect her against harm from Kompkoff. The superior court ruled on summary judgment that the Center owed Bryson an actionable duty of due care to protect her from harm in the course of her treatmentincluding foreseeable harm by other patients. Both parties petitioned for review, contesting the superior court's ruling on the existence and scope of the Center's duty. We granted review, and now affirm the superior court's decision.

II. FACTS AND PROCEEDINGS[1]
The Family Recovery Center provides outpatient substance abuse treatment in Fairbanks.[2] The Center placed both Diana Bryson and Laurence Kompkoff in its continuing care self-help group after each had independently completed an intensive substance abuse program. As part of their admission to the Center, each signed documents acknowledging that their records were confidential and that unauthorized disclosure was a crime under federal law.
When Kompkoff enrolled in the Center's program, he had an extensive criminal history involving alcohol abuse and sexual violence:
 He was first convicted of felony assault with a dangerous weapon in 1973 for stabbing another person multiple times. Kompkoff was incarcerated for the offense until February 1976.
 In July 1976, about five months after his release, Kompkoff slashed his step-father's neck with a knife. He was again convicted of felony assault with a dangerous weapon, but received only five years of probation on the condition that he abstain from alcohol and complete substance abuse treatment.
 In April 1978 Kompkoff violated his probation by drinking and possessing a butcher knife.
 In July 1979 Kompkoff broke into the home of a woman he had met at an Alcoholics Anonymous meeting and raped her. Upon conviction, Kompkoff was sentenced to fifteen years in prison.[3] He remained *802 incarcerated until August 1989, and then resided at halfway houses until August of 1990, when he was released on parole.
 Three months later, in December 1990, Kompkoff broke into a neighboring woman's home, put a knife to her throat, and threatened to kill her. Kompkoff was convicted of first-degree burglary for this offense and was sentenced to serve ten years in prison, with two-and-a-half years suspended. After serving the unsuspended portion of his sentence, he was released on probation in December 1995.
 Over the next four years, Kompkoff violated the conditions of his probation on at least three separate occasions.
Kompkoff decided to enroll in the Center's program in September 1999 at the encouragement of his probation officer, after he was arrested for consuming alcohol and driving while intoxicatedhis third probation violation. At a probation revocation hearing in November 1999, his probation officer reported that Kompkoff was in the final stages of his substance abuse treatment at the Center and seemed to be doing well. Based on this report, the superior court revoked only a short period of Kompkoff's total suspended term and allowed him to resume probation on the condition that he complete the Center's outpatient continuing care program.
The Center knew of Kompkoff's criminal history when it placed him together with Bryson in the same self-help group, but did not consider his history to rule out the placement because Kompkoff had successfully completed the Center's intensive treatment program. In admitting Kompkoff to the program, the Center failed to warn Bryson or any other group members that he might be dangerous if he resumed drinking; nor did the Center take any other precautions to protect group members on account of Kompkoff's history of relapse and violence.
As part of its group treatment program, the Center encouraged all members of the groupincluding Kompkoffto rely on other group members for help and support between group meetings. To assist the group in maintaining contact outside of the group setting, the Center compiled and distributed a list of members and their telephone numbers.
Bryson and Kompkoff participated in three self-help group sessions together: on December 28, 1999, December 30, 1999, and January 4, 2000. On January 10 or 11, Kompkoff's probation officer called and warned the Center of reports that Kompkoff might be drinking. The Center made no attempt to alert its group members concerning these reports.
On January 11 Kompkoff called Bryson for a ride to the bank and the credit union. Bryson agreed and arranged to pick him up at a local grocery store; when she arrived, Kompkoff asked if she would take him to his apartment first, so that he could make some phone calls. At Kompkoff's insistence, Bryson accompanied him into his apartment. Kompkoff walked into his bedroom; Bryson stayed behind. She noticed a large bottle of vodka on a table; just as she saw the bottle, Kompkoff stepped out of the bedroom, armed with a gun. He ordered Bryson to get in the bedroom and take her clothes off. When she failed to comply, Kompkoff grabbed her by the jacket, threw her onto the bedroom floor, and struggled to remove her pants. As Bryson fought Kompkoff for control of the gun, it fired; the bullet struck her hand, severing a finger. Bryson then managed to escape.
As a result of this incident, Bryson sued Kompkoff and the Center for damages. In her claim against the Center, she alleged negligence in failing to warn her that Kompkoff was dangerous and in failing to protect her from his assaultive behavior.
The Center moved for summary judgment, arguing that it had no duty to protect or warn Bryson about Kompkoff. Specifically, the Center maintained that federal regulations governing the confidentiality of its treatment records precluded it from divulging Kompkoff's criminal history, thus leaving the Center with no duty to warn other patients.
In response to the Center's motion, Bryson cross-moved for summary judgment on the issue of duty. Advancing alternative legal theories, Bryson argued that, under the facts alleged in her complaint, the Center had an *803 actionable duty to warn her of and protect her from Kompkoff.
The superior court partly granted and partly denied the parties' cross-motions. As a threshold matter, the court recognized that federal and Alaska law barred the Center from disclosing Kompkoff's treatment records. The court also recognized that neither the Center's knowledge of Kompkoff's background nor its relationship to Kompkoff as his treatment provider gave rise to a duty requiring the Center to control his conduct or protect the general public against his dangerous propensities; absent evidence that Kompkoff posed a specific threat to Bryson, the court found no actionable duty arising from these factors.
After ruling for the Center on these points, the superior court proceeded to consider the Center's relationship with Bryson as a potential source of duty. The court determined that Bryson's status as the Center's patient created a special relationship between Bryson and the Centera relationship that required the Center to exercise due care to avoid exposing Bryson to an unreasonable risk of harm in the treatment settingincluding an unreasonable risk of harm from other patients. Because the court believed that it might have been possible for the Center to have taken additional steps to protect Bryson from Kompkoff without violating its statutory duty to maintain the confidentiality of his records, the court reasoned that a triable question of fact existed as to the Center's compliance with this relation-specific duty toward Bryson. On this limited basis, the superior court decided the issue of duty in Bryson's favor, concluding:
Alaska law and federal law prohibit the kinds of warnings that Bryson claims were owed to her. There was, however, a "special relationship" formed between the Defendants and Bryson. The Defendants did not have a duty to warn based on a general knowledge of Kompkoff's criminal history because [the Center was not] "on notice" that Kompkoff posed a specific threat to anyone at the time of the assault on Bryson. However, this special relationship between Defendants and Bryson, combined with Defendants' inability to disclose confidential information regarding patients to other patients, created a limited duty on Defendants' part to reasonably safeguard patients from one another such that patients did not become particularly vulnerable to other patients by virtue of their participation in the program. By encouraging interaction outside the residential treatment setting, [the Center] had a duty to establish reasonable guidelines and general warnings that may have prevented this incident.
Both parties petitioned for interlocutory reviewthe Center insisting that the superior court erred in declining to grant its motion for summary judgment completely, and Bryson arguing that the court erred in unduly restricting the scope of the Center's duty. We granted review and ordered full briefing.

III. DISCUSSION
The Center argues that the superior court erred in finding that it had an actionable duty to protect Bryson from danger. Because federal and state confidentiality law prohibited the Center from disclosing Kompkoff's criminal history, it reasons that no duty to warn Bryson could have arisen. In contrast, Bryson faults the superior court for unduly limiting the Center's actionable duty. Pointing to language in the summary judgment order suggesting that the Center owed Bryson only "a limited duty" and that this duty only required the Center "to establish reasonable guidelines and general warnings," Bryson maintains that the court too narrowly defined the protective measures that could potentially fall within the Center's duty to use due care in providing treatment. We separately address the parties' divergent positions concerning the duty's existence and its scope.[4]
*804 A. Existence of the Center's Duty Toward Bryson
The superior court noted that because federal and Alaska laws obliged the Center to keep the treatment records of its patients confidential,[5] no duty to warn or protect Bryson from Kompkoff arose under their provisions. Relying on this finding, the Center insists that the confidentiality statutes shielded it from liability by precluding any actionable duty from arising. We find the Center's argument unpersuasive. As the superior court recognized, the Center could not be held accountable for failing to take protective actions that would have violated applicable confidentiality laws. Yet nothing in these laws expressly or implicitly absolves health care providers of the responsibility for protecting their patients by reasonably available means that comply with the laws' requirements. If the Center could have taken legally permissible measures to protect Bryson, the confidentiality statutes would not rule out an actionable duty.
The superior court concluded that such measures did potentially exist, finding that Bryson raised triable questions of fact regarding the availability of lawful steps that the Center might have taken to protect her from unreasonable risk in the course of her group treatment with Kompkoff. The record, in our view, supports this conclusion. The critical question, then, is whether the Center actually owed Bryson an actionable duty.
To determine whether an actionable duty exists in a given case we look first for statutes, rules, or existing precedent creating a duty.[6] The superior court found no actionable duty arising by statute but concluded that the Center had a duty to use due care to protect Bryson under our existing precedent, which has followed the approach taken by the Restatement (Second) of Torts.[7]
In the absence of a special relationship, the Restatement ordinarily recognizes no duty requiring one person to protect another from a third party.[8] But § 315 of the Restatement states that when "a defendant stands in a special relationship to either the dangerous person or the potential victim, the defendant is required to control the dangerous person or warn or otherwise protect the victim."[9] Restatement §§ 323 and 299A supplement this provision. Section 323 broadly describes the kind of special relationship at issue here, providing that one who undertakes "to render services to another which he should recognize as necessary for the protection of the other's person or things" may be held liable for failing to exercise reasonable care in performing such services.[10] Section 299A more narrowly provides that "one who undertakes *805 to render services in the practice of a profession or trade is required to exercise the skill and knowledge normally possessed by members of that profession or trade in good standing in similar communities."[11] These provisions reflect the Restatement's overarching view that "undertakings can create a duty of care" and that "one who voluntarily assumes a duty must then perform that duty with reasonable care."[12]
The superior court reasoned that, by undertaking to provide substance abuse treatment to Bryson, the Center formed a special relationship requiring it to take reasonable care to protect Bryson from danger in the course of her treatmentincluding foreseeable danger from her fellow patients. We agree. The Center undertook to provide substance abuse treatment to Bryson, and by doing so it assumed a duty to treat her with reasonable care. We thus affirm the superior court's conclusion that the Center owed Bryson an actionable duty of due care.

B. Scope of the Center's Duty Toward Bryson
Bryson challenges the superior court's order defining the Center's duty of due care, arguing that it too narrowly limits the duty's scope. Specifically, Bryson points to the order's concluding paragraph, which describes the Center's duty as a "limited" one requiring the Center to give guidelines and warnings:
[The] special relationship between Defendants and Bryson, combined with Defendants' inability to disclose confidential information regarding patients to other patients, created a limited duty on Defendants' part to reasonably safeguard patients from one another such that patients did not become particularly vulnerable to other patients by virtue of their participation in the program. By encouraging interaction outside the residential treatment setting, [the Center] had a duty to establish reasonable guidelines and general warnings that may have prevented this incident.
Bryson reads the court's concluding reference to guidelines and warnings as defining the outer limits of the Center's duty. She maintains that this definition is too restrictive, insisting the Center's duty required it do more than issue "guidelines and general warnings" if other, more effective protective measures were reasonably available. But Bryson's exclusive focus on the summary judgment order's closing remarks overlooks the main body of the order, where the superior court addressed the Center's duty in considerably greater detail:
Plaintiff's exposure to Kompkoff was directly related to Plaintiff's treatment by [the Center]. There was a special relationship between Plaintiff and [the Center] by virtue of this treatment relationship. Arguably, Plaintiff's association with Kompkoff away from the treatment facility was due to the encouragement of [the Center]. If [the Center] encourages its patients to be available to one another outside of the treatment facility, there is a commensurate duty to provide reasonable safeguard or guidelines for its patients when these contacts occur. These might include cautions or restrictions with regard to the public or private places for such meetings, restrictions as to meetings between the sexes, and reminders that the criminal records of co-patients cannot be disclosed, such that traditional safeguards for one's safety should not be set aside when dealing with other members of the treatment group.
The Court accepts [the Center's] contention that it cannot disclose confidential records *806 or be accountable for not incarcerating Kompkoff. The question for the jury in this case seems to be whether it was reasonable for [the Center] to encourage contact between patients outside of treatment given its inability to disclose patient history and, if so, whether there were reasonable steps [the Center] should have taken, given its statutory limitations, that would have prevented this incident.
Reading the superior court's closing remarks in light of the more extensive discussion of duty contained in the body of its decision, we understand the court's concluding reference to guidelines and general warnings to be illustrative, not exclusive. As the superior court indicated in the body of its decision, the Center has a duty "to provide reasonable safeguard[s] or guidelines," and these safeguards or guidelines "might include cautions or restrictions" on contact outside the treatment center. (Emphasis added.) These statements demonstrate that the superior court did not mean to narrowly confine the Center's duty to one of issuing guidelines and general warnings. And we see nothing else in the decision below suggesting that the superior court would preclude Bryson from establishing her claim by proving that the Center negligently failed to take other kinds of precautions. In fact, the body of the decision describes a broader reach for the duty, generally defining the ultimate questions at issue as "whether it was reasonable for [the Center] to encourage contact between patients outside of treatment given its inability to disclose patient history and, if so, whether there were reasonable steps [the Center] should have taken, given its statutory limitations, that would have prevented this incident."
As we interpret it, then, the superior court's definition of the privilege comports with the Restatement's principles. While recognizing that the Center's duty could not require it to take any unlawful actions, the court ruled that the Center owed Bryson a duty of reasonable care to take lawful steps to ensure Bryson's safety. Under the Restatement, the Center's duty of reasonable care must be measured in terms of the skill and knowledge normally used by treatment providers under similar circumstance.[13] In other words, the Center had a duty to act as a reasonable treatment provider under the circumstances. Because this duty arose from the Center's special treatment relationship with Bryson, it is necessarily limited to the treatment context: the Center owed Bryson no duty to protect her from others except in connection with the Center's treatment of Bryson. And the scope of the duty here is also necessarily confined by the Center's obligation to obey applicable confidentiality laws. But under the circumstances at hand, as the superior court properly recognized, whether the Center breached its duty of care by taking or failing to take any particular action presents a question of fact, not a question of duty.[14]

IV. CONCLUSION
We AFFIRM the superior court's summary judgment order.
EASTAUGH, Justice, not participating.
NOTES
[1]  Because this case requires us to review a summary judgment order limiting the scope of the Center's actionable duty under the facts advanced by Bryson, we describe the facts in the light most favorable to Bryson.
[2]  The Center operates as the chemical dependency unit of the Fairbanks Memorial Hospital, which is owned and operated by Banner Health Systems. Guy Patterson was an employee of the Center during the time at issue in this case. Our opinion refers to Patterson and these entities collectively as "the Center."
[3]  The court of appeals affirmed Kompkoff's fifteen-year sentence in Kompkoff v. State, 626 P.2d 1091 (Alaska App.1981).
[4]  We review summary judgment rulings de novo to determine whether any genuine issues of material fact exist and whether the moving party is entitled to judgment as a matter of law. Whether a party has a duty of care and, if so, the nature and scope of that duty are questions of law that we also review de novo. See, e.g., State v. Sandsness, 72 P.3d 299, 301 (Alaska 2003); Dore v. City of Fairbanks, 31 P.3d 788, 790 (Alaska 2001).
[5]  See 42 U.S.C. § 290dd-2(a) (2003) ("Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research... shall ... be confidential and be disclosed only [as permitted under this section]."); AS 47.37.210 ("[T]he registration and other records of treatment facilities shall remain confidential and are privileged to the patient.").
[6]  Dore, 31 P.3d at 792; Wongittilin v. State, 36 P.3d 678, 681 (Alaska 2001).
[7]  See, e.g., P.G. and R.G. v. State, 4 P.3d 326 (Alaska 2000); R.E. v. State, 878 P.2d 1341 (Alaska 1994); Division of Corr., Dep't of Health & Soc. Servs. v. Neakok, 721 P.2d 1121, 1126 (Alaska 1986).
[8]  2 DAN B. DOBBS, THE LAW OF TORTS § 314, at 853 (2001); RESTATEMENT (SECOND) OF TORTS § 314 ("The fact that the actor realizes or should realize that action on his part is necessary for another's aid or protection does not of itself impose upon him a duty to take such action.") & cmt. a (recognizing an exception to the general rule based on special relationship with perpetrator or victim) (1965). We have previously looked to the Restatement to aid us in our determination of whether a defendant has an actionable duty. See Dore, 31 P.3d at 793 & n. 32 (cases cited).
[9]  See Neakok, 721 P.2d at 1126.
[10]  RESTATEMENT (SECOND) OF TORTS § 323 (1965) provides:

One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of the other's person or things, is subject to liability to the other for physical harm resulting from his failure to exercise reasonable care to perform his undertaking, if
(a) his failure to exercise such care increases the risk of such harm, or
(b) the harm is suffered because of the other's reliance upon the undertaking.
[11]  RESTATEMENT (SECOND) OF TORTS § 299A (1965); see also RESTATEMENT (SECOND) OF TORTS § 321 (1965) (stating that where the actor knew or should have known that he or she created a risk to another and had an opportunity to minimize the risk before the harm actually occurred, then he or she owed a duty of reasonable care to attempt to avoid the future harm); W. PAGE KEETON, PROSSER AND KEETON ON TORTS § 33, at 203 (5th ed.1984) (stating that in some situations, "the defendant will be held liable because his affirmative conduct has greatly increased the risk of harm to the plaintiff through the criminal acts of others").
[12]  See DOBBS, supra note 8, § 319, at 860-61 ("The general rule that undertakings can create a duty of care is often expressed by saying one who voluntarily assumes a duty must then perform that duty with reasonable care.").
[13]  See id. § 319, at 860-61.
[14]  Because the case before us falls within the class of cases covered by existing precedent and the Restatement framework, we need not consider the issue of duty under the policy analysis adopted in D.S.W. v. Fairbanks North Star Borough School District, 628 P.2d 554 (Alaska 1981).
