Cybersecurity Policy Report, E.D. Pa.: Patients survive dismissal of some claims pertinent to data allegedly stolen in cyberattack, (Aug 13, 2024)

By Justin Marcus Smith, J.D.

Allegations that hackers posted stolen patient data for sale on the dark web were key to the court’s analysis of standing and plausibility questions.

Patients who alleged that their stolen personal data appeared for sale on the dark web could proceed with some class action claims against a healthcare provider that provided notice of a successful cyberattack, held a federal district court in Philadelphia. The alleged posting of stolen data for sale on the dark web was crucial to if not completely dispositive of most of the court’s Fed. R. Civ. P. 12(b)(1) and 12(b)(6) analyses. First, the court denied the healthcare provider’s facial attack on patient standing based on a distinction the Third Circuit drew between two earlier cases. The patients’ claims of negligence, violation of the California Confidentiality of Medical Information Act (CMIA), and unfair competition survived the medical group’s motion to dismiss. The patients could proceed with negligence per se as a theory, but not where articulated as a separate count of the complaint. The court held the patients’ implied contract claim failed because the healthcare provider never promised anything about safeguarding the patients’ data. The patients’ privacy claims failed because the hackers, not the healthcare provider, intruded on the patients’ privacy (Roma v. Prospect Medical Holdings, Inc., No. 2:23-cv-03216-WB (E.D. Pa. Aug. 6, 2024)).

Background. A group of healthcare patients (patients) brought a putative class action lawsuit on behalf of a nationwide class and a California subclass against a medical group, Prospect Medical Holdings, Inc. (medical group), in connection with a cyberattack and data breach. According to the court opinion, in August 2023, the medical group reported a cyberattack to the Connecticut public health department. Almost two months later, the medical group began to notify the state Attorneys General. The medical group offered its patient customers free credit monitoring and identity protection services.

The patients contended the type and sophistication of the cyberattack indicated an unauthorized third party successfully exfiltrated their personally identifying information (PII) and personal health information (PHI) for criminal purposes. Six of the patients alleged they saw evidence that unauthorized parties tried to execute financial transactions in their name or behalf.

The patients asserted the following claims: 1) negligent breach of duty of care; 2) violation of the Federal Trade Commission Act (FTC Act), 15 U.S.C. § 45, based on negligence per se; 3) breach of implied contract; 4) intentional intrusion of privacy; 5) violation of the California Confidentiality of Medical Information Act (CMIA), Cal. Civ. Code § 56 et seq.; 6) violation of the California Unfair Competition Act (UCL), Cal. Bus. & Prof. Code § 17200 et seq.; and 7) violation of the California Constitution, Cal. Const. Art I, § 1 right to privacy. The patients withdrew a count for violation of the California Customer Records Act, Cal. Civ. Code § 1798.80 et seq.

The medical group moved to dismiss the patients’ amended complaint on two grounds: 1) none of the named plaintiffs had Article III standing; 2) the plaintiffs failed to allege plausible entitlement to relief under any of their common law or statutory claims.

Standing. The court denied the medical group’s facial attack on the patients’ standing. The court found the patients alleged plausible cognizable concrete and imminent injuries. Specifically, two of the patients’ alleged actual injuries, while the others alleged ongoing risk of identity theft. The court referenced the “actual or imminent” distinction the Third Circuit drew in two cases, Reilly v. Ceridian Corp., 664 F.3d 38, 40 (3d Cir. 2011), which found no hacking injury in fact, and Clemens v. ExecuPharm Inc., 48 F.4th 146, 152-53 (3d Cir. 2022), which did. The Third Circuit reasoned that Reilly relied on speculative future injury, while Clemens involved stolen plaintiff data actually offered for sale on the dark web. The Clemens plaintiff characterized her injury-in-fact as both risk of identity theft and fraud and the time required to mitigate. These things were not hypothetical. In the instant matter, the court said the patients alleged injuries similar to those in Clemens because the hacking group in this matter allegedly offered the medical groups for sale on the dark web. The court added that two of the instant plaintiffs identified actual injuries, in the form of fraudulent charges, a few months after the hacking group posted the stolen data for sale. Those alleged injuries independently satisfied Article III standing.

As to whether the alleged mitigation injuries, based on risk of identity theft, were sufficiently concrete to satisfy Clemens, the court said Clemens did not establish such a rule. In Clemens, the Third Circuit treated “emotional distress,” “therapy costs,” and the “time and money” involved in mitigating data breach fallout as sufficiently concrete under Norman v. Trans Union, LLC, 669 F. Supp.3d 351, 371 (E.D. Pa. 2023). Each named plaintiff in this matter alleged similar injuries.

The court said Clemens also pointed the way on traceability. The instant patients’ allegations were nearly identical as to the medical group’s alleged failure to have adequate security leading to stolen data on the dark web. The court rejected the medical group’s contention that the patients’ alleged injuries were “isolated events” because the complaint alleged a causal link between medical group conduct and the mass posting of its data on the dark web. It was reasonable to infer the publication on the dark web included the patients’ personal information. The court denied the medical group’s Fed. R. Civ. P. 12(b)(1) motion to dismiss accordingly.

Negligence. As to the negligence claims, the court found the allegations in this matter cleared the bar set in Kirsten v. Cal. Pizza Kitchen, Inc., 2022 WL 16894503, at *8 (C.D. Cal. July 29, 2022) (citation omitted). Again, alleged publication of PII on the dark web was key. After the breach, the patients all alleged having to spend time dealing with consequences, like actual financial losses. The court reasoned that none of the alleged consequences were common in daily life without a data breach. Courts have also recognized them as forms of damages in data breach cases. The court held the patients alleged they suffered cognizable tort damages and declined to dismiss the patients’ negligence claims accordingly.

Negligence per se. The court granted the medical group’s motion to dismiss the patients’ separate count alleging negligence per se, but denied wholesale dismissal of that theory. The court acknowledged the medical group’s argument that Third Circuit courts routinely dismiss negligence per se claims as subsumed within standard negligence claims, but the court said that did not address the broader viability of the patients’ theory of liability. The court said there was “every reason to allow discovery on both theories[]” where the proper remedy was not dismissal of negligence per se, as a theory, but “simply dismissal of any separate count in the operative complaint.”

The court also acknowledged the medical group’s argument that the FTC Act does not authorize a private right of action; however, the court said neither Pennsylvania nor California courts require a private right of action for a statute to serve as the “hook” for negligence per se. The court noted here that the patients here were “consumers” who fell within the class of persons the FTC Act was meant to protect.

Implied contract. The court held the patients failed to plead the existence of an implied contract. The court adopted the Third Circuit opinion in Longenecker-Wells v. Benecard Servs., Inc., 658 F. App’x 659, 662 (3d Cir. 2016) (not precedential) that the mere requirement that customers share personal information does not give rise to an implied contract. The most important point here was the patients did not point to any promise of the medical group to safeguard their information.

Privacy. The court held all of the patients’ common law and California constitutional privacy claims failed because the patients failed to show a legally protected privacy interest or reasonable expectation of privacy under the circumstances. This was so because the hackers, not the medical provider, did the intruding. Moreover, the configuration of data security systems was not the conduct to be proven for an intentional invasion of privacy claim. Again, only the hackers intruded.

CMIA. The court denied dismissal of the patients’ CMIA claim. The court concluded it was more than reasonable to infer that the patients’ information was wrongfully viewed or accessed, based on the posting of the data on the dark web and the medical group’s own security incident letter. Likewise, it was plausible to infer the information was individually identifiable as to patient medical history. It was therefore medical information.

Unfair competition. The court declined to grant the medical provider’s motion to dismiss the UCL claim on standing grounds. The patients alleged enough about money or property lost. However, the court granted the medical provider’s motion to dismiss the UCL claim on the basis that the complaint failed to allege a lack of adequate legal remedy.

The case is No. 2:23-cv-03216-WB.

Judge: Beetlestone, J.

Attorneys: Amina A. Thomas (Cohen & Malad, LLP) for Joanne Roma, Joshua Stradinger, Rodney Hoggro, Lorelei Phillips, Shamoon Khandia, Yolanda Boyle, Mario Robles, Jay Goldstein, Laura Doverspike and Latoya Pratcher. Gerald L. Maatman, Jr. (Duane Morris LLP) for Prospect Medical Holdings, Inc.

Companies: Prospect Medical Holdings, Inc.

Cases: CaseDecisions FederalLegislation CyberPrivacyFeed EHRNews GCNNews GeneralNews DataSecurity DataBreach PennsylvaniaNews DataPrivacy