Cybersecurity Policy Report, ELECTRONIC HEALTH RECORDS—D. Mass.: Data breach Patients’ need to continually monitor online accounts for misuse constituted injury in tort, (Mar 15, 2024)

By Jeffrey H. Brochin, J.D.

Economic Loss Doctrine not a bar to negligence claim against surgical services provider where the future ongoing risk of harm satisfied the element of injury and damage.

A federal district court in Massachusetts has granted in part and denied in part the Motion to Dismiss filed by Shields Health Care Group (Shields or Provider) in a putative class action lawsuit brought by Patients whose personally identifiable information (PII) and protected health information (PHI) was accessed during a cyber attack against the Provider. The court determined that their loss was not strictly an economic one, and therefore their negligence claims were not barred under the Economic Loss Doctrine. Although an express contract did not exist due to the Patients’ failure to rely on the Provider’s privacy policy, that same policy established an implied-in-law contract (In Re Shields Health Care Group, Inc. Data Breach Litigation, March 5, 2024, Saris, DJ).

Data breach of PII. Shields provides medical scanning and surgical services to patients in over forty locations throughout the Northeast. On March 7, 2022, hackers launched a cyber-attack on Shields’s systems and gained access to the PII and PHI of an estimated two million patients. The hackers maintained uninterrupted access until March 21, 2022, during which time they exfiltrated patients’ records including Social Security numbers, private health diagnoses, insurance data, and other highly sensitive information. On January 9, 2023, a group of Patients whose PII and PHI was compromised filed suit alleging negligence, breach of express contract, breach of implied contract, and other tort claims. Presently before the court were the Provider’s Motions to Dismiss.

Economic Loss Doctrine. In order to state a claim for negligence, the Patients needed to show (1) a legal duty owed to them by the Provider; (2) a breach of that duty by the Provider; (3) causation; and (4) actual loss by the Patients. Shields argued that the “economic loss doctrine” barred the Patients’ claim. The doctrine prohibits recovery in tort unless the Patients could establish that the injuries they suffered due to the Provider’s negligence involved physical harm or property damage, and not solely economic loss. The Provider argued that the negligence claims were barred by the doctrine.

Provider as fiduciary. The court noted that Massachusetts courts have declined to apply the economic loss doctrine to tort claims against a fiduciary. Here, the Patients plausibly alleged that, because Shields provided them with healthcare, Shields was their fiduciary. The Provider further argued that aside from one Patient who experienced thousands of fraudulent bank charges and credit card fraud, the remaining Patients had failed to plead “actual loss” sufficient to support their negligence claims. The Patients countered that they were now at a heightened risk of exposure because of the breach, and as a result, had to now—and in the future—closely monitor their financial accounts to guard against identity theft. The court agreed with the Patients that they established a substantial risk of harm manifesting in the future, therefore the element of injury and damage was satisfied and the cost of that monitoring was recoverable in tort. Accordingly, the court denied the motion to dismiss the negligence claim.

Express contract claim. To state a claim for breach of contract under Massachusetts law, the Patients needed to allege (1) a valid contract between the parties existed, (2) the Patients were ready, willing, and able to perform, (3) the Provider was in breach of the contract, and (4) the Patients sustained damages as a result. Although the Patients did not specify the terms of any written or oral agreements, they referenced Shields’s online privacy statement, which affirmed Shields’s responsibility to “maintain the privacy of patients’ health information as required by law” and which described how Shields “may use and disclose medical information for each category of uses or disclosures.” However, the Plaintiffs did not allege that they relied on or even read the privacy statement.

Some courts have held that broad statements on a public-facing website, without more, are insufficient to form an express contract with users; however, others have held that a provider’s online privacy statement constitutes an enforceable contract where it includes a specific promise to use “reasonable measures to protect” customers’ personal data and a provision confirming assent by the user to its terms and conditions. Here, the Complaint did not allege that the Patients relied on the privacy statement or assented to any agreement incorporating a privacy protection, and the court therefore dismissed the breach of express contract claim.

Breach of implied contract. Under Massachusetts law, in the absence of an express agreement, an implied contract may be inferred from the conduct and relationship of the parties. To prove an implied-in-fact contract, the Patients could rely on policy directives as evidence of an implied-in-fact contract. Such a contract implied in fact requires the same elements as an express contract and differs only in the method of expressing mutual assent.

Even in the absence of allegations of assent-- either expressly or by conduct—the Patients could prevail if they demonstrated a contract implied in law. The court further observed that a quasi-contract (or a contract implied in law) is an obligation created by law for reasons of justice, without any expression of assent and sometimes even against a clear expression of dissent. In the instant case, the court found that the Patients plausibly demonstrated that they had an implied-in-law contract with Shields to receive medical treatment in exchange for providing confidential health and financial information, which Shields was reasonably expected to keep private consistent with relevant data privacy laws. Accordingly, the court denied the motion to dismiss the implied contract claim.

Implied covenant of good faith, fair dealing. The Patients also claimed that Shields breached the implied covenant of good faith and fair dealing by not faithfully carrying out its contractual obligations to protect their private information according to relevant laws, regulations, and industry standards. In Massachusetts, all contracts are subject to an implied covenant of good faith and fair dealing, and neither party may do anything which will have the effect of destroying or injuring the right of the other party to receive the fruits of the contract.

The Patients alleged that Shields acted with a lack of good faith by taking three to four months to notify patients of the breach, and by eventually providing notice that did not adequately describe the breach’s causes and scope. The court found that these allegations sufficiently pleaded a claim for breach of the implied covenant of good faith and fair dealing, and they therefore denied the motion to dismiss as o that claim.

The case is No. 1:22-cv-10901-PBS.

Attorneys: Carl V. Malmstrom (Wolf Haldenstein Adler Freeman & Herz, LLC) for Lisa Smith. Alex J. Dravillas (Keller Postman LLC) and Jonathan Tucker Merrigan (Sweeney Merrigan Law) for William Biscan. Jordan S. O'Donnell (Mullen Coughlin, LLC) for Shields Health Care Group, Inc.

Companies: Shields Health Care Group, Inc.

Cases: CaseDecisions FederalLegislation EHRNews GCNNews GeneralNews HIPAANews CyberPrivacyFeed DataSecurity DataBreach MassachusettsNews DataPrivacy