So the Connecticut Appellate Court held Tuesday in Doe v. Cochran, by a 4-3 vote; you can read the majority and the dissent. Courts are split on this question (and its analogs), as pp. 11-12 of the dissent note. The majority notes that its opinion is limited, though it's not clear whether the limitations (e.g., to exclusive romantic partners)will remain tenable in future decisions:

[T]he duty that we recognize today … extends only to identifiable third parties who are engaged in an exclusive romantic relationship with a patient at the time of testing and, therefore, may foreseeably be exposed to any STD that a physician fails to diagnose or properly report. And the physician fully satisfies that third-party duty simply by treating the patient according to the prevailing standard of care and accurately informing the patient of the relevant test results. Whether there are other, broader circumstances under which a physician may be held to owe a duty of care to a nonpatient third party who foreseeably contracts an infectious disease as a result of the physician's negligence is a question that we need not resolve today.

I think the majority is generally right: To quote the Restatement (Third) of Torts:

An actor ordinarily has a duty to exercise reasonable care when the actor's conduct creates a risk of physical harm.

A doctor's telling the patient that the patient has tested negative for a sexually transmitted disease creates a risk of physical harm to the patient's sexual partners—it increases the likelihood that the patient will have sex with them, or will have sex with them without proper protection. (The STD here was herpes, which can be spread even if the man wears a condom, but apparently condom use does decrease the risk; also, herpes medication apparently reduces the risk of spreading the virus as well.) And the risk to the third party is certainly foreseeable.

If the doctor or the doctor's employees acted unreasonably—for instance (as alleged in this case), the doctor "misread [the] lab report," or the doctor "misinformed his staff member," or "the staff member misinformed [the patient]"—then they should be held liable. That's not some special new legal duty; it's just the basic duty that all of us have to act reasonably when our actions create a risk of physical harm to others.

The Restatement does note that, "In exceptional cases, when an articulated countervailing principle or policy warrants denying or limiting liability in a particular class of cases, a court may decide that the defendant has no duty or that the ordinary duty of reasonable care requires modification." That's why, for instance, most courts have adopted various so-called "no-duty" or "limited-duty" rules, such as the rule in most states that a social host who serves alcohol to guests can't be liable to third parties who are injured when the guests drive drunk. But I don't see a basis for imposing such a limitation here.