Health Law Daily Wrap Up, ELECTRONIC HEALTH RECORDS—M.D. Fla.: Suit against physical therapy clinic franchisor over data breach can proceed, (Jul 9, 2026)

By Donielle Tigay Stutland, J.D.

The court denied the motion to dismiss claims for negligence and breach of implied contract in a class action related to a cyberattack that compromised sensitive patient data.

The federal district court for the Middle District of Florida denied in part a motion to dismiss claims brought against physical therapy clinic franchisor Fyzical Acquisition Holdings, LLC alleging that the franchisor failed to protect its patients’ personal information in a cyberattack. After concluding that the patients had standing, the court found the patients adequately alleged claims for negligence and breach of implied contract. The court granted the franchisor’s motion to dismiss the account holders’ claims for negligence per se and unjust enrichment but granted the patients leave to amend their claims (Herrera v. Fyzical Acquisition Holdings, LLC, No. 8:25-cv-3551-TPB-SPF (M.D. Fla. June 29, 2026)).

Background. Fyzical Acquisition Holdings, LLC is a franchisor of a chain of physical and occupational therapy clinics that provide therapy for orthopedic, neurologic, and geriatric conditions. Members of the class bringing suit are patients of one of the franchisor’s clinics who were required to provide their therapy clinic with their personal information, including their credit card and health insurance information in setting up an account at the clinic.

On or about December 9, 2024, the franchisor noticed unusual activity within its internal system. On November 25, 2025, following a review, the franchisor determined that the following patient information was breached by a criminal actor: names, dates of birth, social security numbers, driver’s license or state identification numbers, financial account information, credit card information, health insurance information, and medical health information. On December 19, 2025, the franchisor began notifying its patients and purported class members that their information had been breached.

On March 2, 2026, the class members filed their consolidated class action complaint asserting claims for: negligence and negligence per se (Count I); breach of implied contract (Count II); and unjust enrichment (Count III). The franchisor moved to dismiss.

Standing. The court first determined that the patients had standing to bring the class action. Here, the franchisor argued the patients lacked standing because they did not show an injury. The court outlined that the patients have alleged that their private information was compromised in the data breach and that their information has already been misused on the dark web, resulting in an uptick in spam calls, texts, and emails. Other courts have found that allegations of actual misuse of personal data, including increased spam, are sufficient to confer Article III standing as to claim for injunctive relief. In addition, one claimant alleged that his private information was allegedly already used to commit identity theft and fraud. Other patients also claim they have suffered mitigation costs and lost time, loss of privacy, emotional distress, and diminished value of private information. The court found such allegations were sufficient to state cognizable injuries-in-fact for the named claimants.

The court also rejected the franchisor’s argument that the patients could not show traceability. Here, the patients alleged that their information was compromised in the data breach and was misused. The court outlined that a potential speculative other cause for the suffered harms does not mean that the account holders have not established traceability for the purpose of standing.

Negligence. The court began by finding that the account holders have sufficiently alleged that the franchisor had a duty to safeguard their information, and that it breached that duty by failing to exercise reasonable care in safeguarding and protecting the private information. The court denied the motion to dismiss the negligence claim. However, the court granted the motion for negligence per se. The court noted that the account holders’ claims of negligence per se were premised on a breach of the Federal Trade Commission Act, but there is no private cause of action implied under the Act. The court did grant the claimants leave to amend their complaint on this claim.

Breach of implied contract. The court denied the motion to dismiss this claim. The court rejected the franchisor’s argument that the breach of implied contract claim fails because the claimants did not allege that the defendant agreed to protect their personal information in exchange for payment. The court noted that the claimants pleaded that they were required to submit their personal information to obtain services, and that the franchisor impliedly promised to maintain safeguards to protect the private information. Additionally, the claimants alleged that the franchisor failed to safeguard the information, and that they would have not entrusted their information and paid the franchisor for its services if the franchisor had not implicitly promised to safeguard the information. The court highlighted other cases which found that a plaintiff had sufficiently alleged a breach of implied contract claim where he was required to hand over sensitive information to receive a service because he “presumably expect[s] to receive an implicit assurance that the information will be protected.” The court also found that the patients here had adequately pleaded this claim.

Unjust enrichment. The court granted the franchisor’s motion to dismiss this claim. The court concluded that the account holders failed to allege that they paid the franchisor specifically to safeguard their private information, so no benefit was conferred on the franchisor for that purpose. The court did give the claimants leave to amend this claim.

The case is No. 8:25-cv-3551-TPB-SPF.

Judge: Barber, T.

Attorneys: Jeff Ostrow (Kopelowitz Ostrow P.A.) for Richard Herrera. Joseph Michael Paulino (Gordon & Rees LLP) for Fyzical Acquisition Holdings, LLC.

Companies: Fyzical Acquisition Holdings, LLC

Cases: CaseDecisions EHRNews GeneralNews HITNews FloridaNews