Cybersecurity Policy Report, D. Colo.: Multiple claims in fertility clinic data breach case survive dismissal, (May 8, 2026)

By Justin Marcus Smith, J.D.

The court declined to dismiss the negligence per se claims of the one patient who bought credit monitoring based on alleged violations of HIPAA and its underlying regulations.

Fertility patients can proceed to discovery on a subset of their many claims against a fertility clinic in connection with the loss of their personal data in a hacking incident, held the federal district court in Denver, Colorado. Negligence and per se negligence claims survived only with respect to the alleged injury of out-of-pocket expenses incurred by one patient. Other purported injuries were too generalized and attenuated. More specifically, the negligence per se claims survived only in connection with purported violations of the Health Insurance Portability and Accountability Act (HIPAA), not the Federal Trade Commission Act or the Colorado Security Breach Notification Act. The implied breach of contract claim survived in its entirety, as did the breach of fiduciary duty claim and the request for declaratory judgment. The invasion of privacy claim failed with respect to intrusion-on-seclusion, but it survived as to public disclosure of private facts. The court dismissed the equitable claim of unjust enrichment because the patients did not allege conferral of an unjustly retained benefit. Having pleaded facts describing conduct believed to be unlawful under the Colorado consumer protection statute, the patients properly alleged a deceptive practice as a matter of law; however, they could not assert a breach of the consumer protection statute for clinic conduct after the data breach. All dismissals were without prejudice (Doe v. Conceptions Reproductive Associates, Inc., No. 1:25-cv-00009-NYW-CYC (D. Colo. Apr. 28, 2026)).

Background. Patients sued fertility clinic Conceptions Reproductive Associates, Inc. (Conceptions) and its owner-operator, IVI America, LLC (collectively, the clinic entities), for alleged failure to comply with industry and regulatory standards for the protection of personally identifiable information (PII) and personal health information (PHI).

In April 2024, cybercriminals allegedly hacked the clinic entities’ computer systems and accessed the PII and PHI of thousands of current and former patients. The cybercriminals allegedly made an attempt to extort the clinic entities and soon thereafter published all of the stolen patient data on the dark web. The clinic entities notified affected patients in November 2024. The complaining patients claimed the notice letter “misleadingly” downplayed the severity of the data breach insofar as the stolen PII and PHI had already been published on the dark web.

The instant patients said they expected the clinic entities to protect their data. They alleged a spike in spam and scam messages by email, text, and phone after the data breach. They said they had to spend significant time and effort monitoring their personal accounts for fraud or identity theft and also experienced personal stress, anxiety, sleep disruption, fear, and frustration. One patient, Jane Doe, said she received notices that unknown parties were attempting to access her various online accounts. Another patient said he enrolled in dark web monitoring at an outlay of over $100 per year.

The patients filed a consolidated putative class action complaint asserting eight claims: (1) negligence; (2) negligence per se, based on alleged violations of HIPAA, the Federal Trade Commission (FTC) Act, and the Colorado Security Breach Notification Act (CSBNA), Colo. Rev. Stat. § 6-1-716; (3) breach of implied contract; (4) invasion of privacy; (5) unjust enrichment; (6) breach of fiduciary duty; (7) violation of the Colorado Consumer Protection Act (CCPA), Colo. Rev. Stat. §§ 6-1-105, -113; and (8) declaratory judgment. The clinic entities moved to dismiss under Fed. R. Civ. P. 12(b)(6) for failure to state a claim.

Negligence claims. The clinic entities argued the patients’ negligence per se claim failed because they failed to identify an appropriate statute and did not adequately allege injuries, apart from a standing concern, and causation. The patients said they adequately alleged physical manifestations, emotional injuries, misuse of their data, invasions of privacy, increased risk of identity theft and fraud, lost time, property damage, and out-of-pocket losses.

The court noted a party may suffer constitutionally sufficient injury-in-fact yet still lack an injury cognizable under a particular theory of liability, i.e., a legal interest. The court found the patients’ allegations of emotional distress were conclusory. They only alleged generalized symptoms, like headaches or insomnia, that were not enough to recover for economic damages. They failed to explain what Colorado law would hold that misuse of data, invasions of privacy, and so forth, could sustain a negligence claim absent actual physical or economic injury, even despite allegations of “property damage” and “out-of-pocket” losses. The patients merely alleged “broad spectrum” damages. The court declined to make the patients’ arguments about misuse of PII and PHI, and risk of future harm was not enough on its own to sustain a negligence claim. There were no cases on point about “lost time,” and there is no national consensus about it. Some courts have approved a lost value of data theory, but the patients submitted no theory. Except for the allegations of out-of-pocket loss for credit monitoring, the allegations of injury were too speculative and attenuated. The court granted dismissal of the negligence and per se claims except as to the one patient based on his alleged out-of-pocket expenses.

As for causation, the court concluded the patients adequately alleged the out-of-pocket expenses would not have occurred but-for the data breach. The court reached the same conclusion about proximate causation. The data breach was a substantial factor in causing the credit monitoring expenses, but the patients failed to allege adequate causation based on the CSBNA because there was no allegation that delayed notice played a role in the decision of the singular patient to buy credit monitoring.

The clinic entities argued the patients could not bring negligence per se claims based on HIPAA and the FTC Act because neither statute contained a private right of action, but they did not point to any Colorado law on-point. They conceded that other courts in the district have allowed negligence per se keyed to violations of statutes that do not have a private right of action. After all, negligence per se claims based on violations of traffic laws are commonplace.

As for whether Section 5 of the FTC Act was too broad to sustain a negligence per se claim, the court said the clinic entities were correct that the statute in question must be specifically proscriptive or prescriptive for clarity. The patients did not directly address this issue. The court agreed with the clinic entities that the FTC Act was too insufficiently specific.

Turning to regulations and guidelines that were not “statutory in nature,” the court noted regulations can sometimes establish a standard of care for negligence actions. Even non-binding guidelines can serve to inform a trier of fact about a possible standard of care. The court declined to dismiss the negligence per se claims of the patient who bought credit monitoring based on alleged violations of HIPAA and its underlying regulations.

Breach. The patients adequately alleged a claim for breach of implied contract. The clinic entities argued the patients failed to allege the existence of an implied contract for lack of mutual assent to an agreement for adequate cybersecurity, hence there could be no breach of implied contract. Mutual assent was an irresolvable question of fact at the dismissal stage, but the patients plausibly alleged the existence of an implied contract pertinent to adequate protection of PII and PHI. The clinic entities failed to develop the idea that the patients failed to allege a breach of that implied contract, and Colorado law permitted recovery for only nominal damages. For now, the court declined to explore what contract damages might be available.

Privacy invasion. As for the intrusion on seclusion claim, the clinic entities said the patients failed to allege intent. The court agreed that the patients did not offer anything more than speculation that the clinic entities actually knew or believed that a data loss was substantially certain to occur. The patients only alleged the clinic entities should have known better. The court dismissed the intrusion on seclusion claim because the patients did not allege substantial certainty. Mere recklessness was not enough.

As for disclosure of private facts, the outcome with respect to intent was different. Intent could turn on mere reckless disregard. The patients adequately alleged disclosure on the dark web. The court denied dismissal of the disclosure of private facts facet of the invasion of privacy claim.

Unjust enrichment. The patients alleged an “overpayment” theory of unjust enrichment. Their “expectations” and “understandings” about the clinic entities’ data security did not state a plausible unjust enrichment claim where they only paid for fertility treatment services while incidentally expecting a certain level of data security. They needed to allege more than an understanding that part of what they paid for fertility services would go toward adequate protection of PII and PHI. The court respectfully concluded the patients did not allege conferral of an unjustly retained benefit.

Fiduciary breach. The court began its breach of fiduciary analysis by exploring whether the patients pleaded the facial existence of a fiduciary relationship. The parties tacitly agreed Colorado has not recognized that physician-patient relationships are fiduciary as a matter of law. As to whether a fiduciary relationship existed on the facts, the court declined to dismiss at this early stage. The court acknowledged that buying medical care is more involved than buying a burrito. Arguments about failure to allege an abuse of unique trust failed to tip the scale in favor of dismissal. The patients also plausibly alleged IVI could be held vicariously liable for Conceptions’s acts as IVI’s agent.

As for damages and causation here, the clinic entities did not explain why the breach of fiduciary duty claims arose solely from a negligence theory and were thus subject to negligence damages rules. The court declined to dismiss breach of fiduciary duty claims.

CCPA. The court agreed with the clinic entities that Fed. R. Civ. P. 9(b) applied at least to the existence of an unfair or deceptive trade practice cognizable under the CCPA. The CCPA sets out a comprehensive list of deceptive trade practices, but the court said it must follow the Tenth Circuit instruction to take allegations as a whole. The patients did not need to plead specific statutory definitions of deceptive trade practice. Federal pleading involves the pleading of facts, not legal theories. Having pleaded facts describing conduct believed to be unlawful under the CCPA, the patients properly argued in opposition to dismissal that the conduct they alleged was a deceptive practice as a matter of law.

As for the consumer fraud allegations themselves, the patients alleged specific clinic entity representations about adequate data security practices and ways in which those practices were not in fact adequate. The allegations comprised a deceptive trade practice based on knowing or recklessness misrepresentation of service characteristics.

The clinic entities contended there were no allegations of “actually false” statements. The court saw the patients proceeded on an “information and belief” basis, but that did not necessarily doom the CCPA claim where facts were peculiarly within the knowledge of the opposing party. Cybersecurity practices were presumably non-public information within the clinic entities’ exclusive control. The patients adequately alleged a deceptive trade practice.

The CCPA injury requirement only went as far as the standing doctrine used by Colorado courts. Because the clinic entities disclaimed any standing challenge, the court did not need to go further there.

As for causation, the court declined to make either party’s arguments. The patients alleged the clinic entities representations about data security caused them to pay for fertility treatments, and the clinic entities did not challenge this theory of causation and injury. The court dismissed the CCPA claim only as to conduct after the data breach.

Declaratory judgment. The court declined to dismiss the declaratory judgment request for relief at this time. The clinic entities argued a declaratory judgment claim was not necessary because the patients’ alleged injuries already occurred and their legal rights would be resolved through their other claims. The court said the patients appeared to be seeking certain forward-looking declaratory relief that would not be available through their other claims.

Punitive damages. The patients tacitly conceded that Colorado law does not permit a claim for punitive damages. The parties had yet to comply with initial discovery disclosures and the patients did not seek leave to amend. The court dismissed the punitive damages claim or request for relief without prejudice.

The case is No. 1:25-cv-00009-NYW-CYC.

Judge: Wang, N.

Attorneys: Danielle Lynn Perry (Mason & Perry LLP) for Jane Doe. David Quinn Gacioch (McDermott Will & Schulte LLP) for Conceptions Reproductive Associates, Inc.

Companies: Conceptions Reproductive Associates, Inc.

Cases: CaseDecisions FederalLegislation EHRNews HIPAANews ReproductiveHealthCareNews CyberPrivacyFeed DataBreach ColoradoNews DataPrivacy DataSecurity