Cybersecurity Policy Report, ELECTRONIC HEALTH RECORDS—D. Kan.: Lack of Article III standing prevents data breach victim, provider from litigating action in federal court, (Apr 2, 2024)

By Melanie Hirschfelder, J.D.

The victim, who lacks standing because the complaint failed to allege a concrete injury, must instead pursue the case in state court.

A patient whose personal health information (PHI) and personally identifiable information (PII) were subject to a data breach did not have Article III standing to sue his healthcare provider because he could not show an “injury in fact” from the breach, a federal court in Kansas ruled. Consequently, the court—which was without subject matter jurisdiction over the action—could not address the merits of the provider’s motion to dismiss and instead remanded the case back to state court for litigation (F.S. v. Captify Health, Inc., March 26, 2024, Crabtree, D.).

The healthcare provider, Captify Health, Inc., sent notice to its patients that there had been an “unauthorized disclosure” of their PHI and PII. One of the victims brought a suit alleging state law tort claims for a number of alleged injuries, including loss of the benefit of the bargain, exposure to a heightened future risk of identity theft, loss of privacy and confidentiality, embarrassment, humiliation, and other emotional distress, loss of enjoyment of life, untimely and/or inadequate notification of the data breach, improper disclosure of plaintiff’s PHI and PII, out-of-pocket expenses incurred to mitigate the increased risk of identity theft or fraud, and time spent mitigating the increased risk of identity theft or fraud.

The healthcare provider removed the case to federal court under the Class Action Fairness Act and moved to dismiss the complaint for failure to state a claim.

Before the federal court could address the merits of the motion to dismiss, it found that the patient did not have federal standing under Article III to sue because he could not show an injury in fact. It explained that, to establish injury in fact, “a plaintiff must show that he or she suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” In data breach cases where plaintiffs often seek to recover for the risk of future injury, the issue of standing usually rests on whether the plaintiffs have suffered a concrete, as opposed to a hypothetical, injury. In this case, the plaintiff failed to do so.

The easiest way to allege concrete, present injury would be to show actual misuse of the data, which the victim here did not do. Misuse, explained the court, might involve actions such as fraudulent charges or bank fees from authorized account access. Furthermore, when PII is misused, it also shows “an increased risk of identity theft or identify fraud” in the future. In this case, however, the victim of the data breach did not allege misuse of his data or indeed of the data of any of the healthcare provider’s patients.

Having established that the victim did not allege misuse of his PHI and PII, the court next considered whether he alleged any other facts showing another present harm. It found that the victim could not show a present harm merely by alleging the loss of the “benefit of the bargain” with the healthcare provider because the court previously rejected this exact basis for standing. Other alleged present harms, such as loss of privacy and confidentiality, are present in every data breach case and do not confer standing by themselves. Moreover, the plaintiff did not allege any actual injury stemming from the delay in being notified of the data breach.

Finally, the court explained that the victim’s other allegations of injury could only confer standing if they demonstrated a concrete risk of future material harm. It used a three-factor test that considered: (1) whether the victims’ data has been exposed as the result of a targeted attempt to obtain the data; (2) whether any portion of the dataset has already been misused, even if the victims themselves have not yet experienced identity theft or fraud; and (3) whether the type of data that has been exposed is sensitive such that there is a high risk of identity theft or fraud.

In this case, the victim did not allege that his data had been taken as part of a targeted attempt to steal it, only that the healthcare provider sent him notice that his PII and PHI had been subject to unauthorized disclosure. And since he had not alleged any misuse of the data, the only factor in his favor was his allegation that PHI and PII including his social security number, name and date of birth were part of the data breach. But this was not enough to show an imminent risk of harm. And without that threat of harm, the victim’s emotional injuries or the time and expense he spent to mitigate the risk of identity theft were not enough to confer Article III standing. As the court explained, plaintiffs “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.”

Because the victim lacked standing, the court was without subject matter jurisdiction to decide the motion to dismiss. Accordingly, the court remanded the case back to state court.

The case is No. 23-1142-DDC-BGS.

Attorneys: Lucy McShane (McShane & Brady, LLC) for F.S. Cameron E. Grant (Gordon Rees Scully Mansukhani, LLP) for Captify Health, Inc.

Companies: Captify Health, Inc.

Cases: CaseDecisions FederalLegislation EHRNews GCNNews HIPAANews CyberPrivacyFeed DataSecurity DataBreach KansasNews DataPrivacy