Cybersecurity Policy Report, N.D. Ill.: Court allows some claims to proceed in large PII/PHI data breach action, (Oct 3, 2025)

By Sherri M. Schroeder, J.D.

The allegations stem from a 2024 data breach wherein the personal information of almost 800,000 current and former patients of Lurie Children’s Hospital was exposed.

An Illinois district court has dismissed some of the claims made against Lurie Children’s Hospital of Chicago concerning a Jan. 2024 cyberattack that gained access to the personally identifiable information (PII) and personal health information (PHI) of nearly 800,000 of Lurie’s patients. Each plaintiff in the Consolidated Amended Class Action Complaint (CAC) is a current or former Lurie patients or the parent or guardian of one. They claim that the exposure of their private personal and medical information was due to Lurie’s failure to implement and maintain reasonable data security practices and protections. Their 11-count action asserts Illinois state law claims (e.g., negligence, breach of contract, invasion of privacy) and claims for violations of Illinois’ privacy and consumer protection laws. When Lurie moved to dismiss the complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction and, alternately, 12(b)(6) for inadequately pleaded claims, the court granted in part and denied in part the motion (In re: Lurie Children’s Hospital Data Security Litigation, No. 24-cv-05503 (N.D. Ill. Sept. 27, 2025)).

CAFA. Lurie first moved to dismiss the CAC under Rule 12(b)(1) by arguing that the court should abstain from exercising jurisdiction pursuant to the home-state exception under the Class Action Fairness Act (CAFA), which requires a district court to decline to exercise jurisdiction where two-thirds or more of the class members and the primary defendants are citizens of the state where the action was originally filed. However, as the only evidence of citizenship offered by Lurie was the Illinois mailing addresses of a significant portion of the class members and the fact that they received medical care in the state, the court found that the burden of establishing the exception’s applicability was not met. The court found the exception to be “framed entirely in terms of the parties’ citizenship,” and "citizenship” meant domicile or the person’s long-term plan for a state of habitation rather than just current residence.

Standing. Stating that the Supreme Court’s decision in TransUnion LLC v. Ramirez foreclosed the patients from predicating their standing solely on the imminent risk of identity theft that they claim to face from unauthorized disclosure of their PII and PHI in the data breach, the court nevertheless found the patients had standing. “There is no reason to think that TransUnion undermines the Seventh Circuit’s recognition... that mitigation efforts may constitute concrete injuries in fact,” stated the court. “The Court therefore concludes that, when paired with an imminent risk of identity theft, Plaintiffs’ mitigation efforts can provide the separate concrete harm needed for standing after TransUnion.” Furthermore, the court noted that since Lurie collected and maintained social security numbers and driver’s license numbers, the CAC had sufficiently pleaded that the information exposed in the data breach was sensitive enough to warrant the mitigation efforts undertaken by the patients. The court also agreed with the patients that their loss of confidentiality in the exposed PII and PHI, itself, constituted an injury in fact giving them standing.

Inadequate pleadings. Having found no basis to dismiss the CAC for lack of subject matter jurisdiction, the court then addressed Lurie’s arguments that the patients had not stated plausible claims as to certain of the counts laid out in their CAC. The court found as follows on these claims:

• Negligence: Count I alleged Lurie’s negligent data security practices resulted in exposure of the patients’ PII and PHI. Lurie argued the patients failed to allege adequately both the duty and proximate case elements of this count. Because the 2017 amendments to Illinois’ Personal Information Protection Act (PIPA) imposed a duty to maintain reasonable security measures and the CAC’s allegations precluded it from deciding proximate cause as a matter of law, the court declined to dismiss the negligence claim.

• Negligence per se: The court dismissed Count II because the patients failed to argue that the Federal Trade Commission Act or HIPAA are strict liability statutes and a “violation of a statute only constitutes negligence per se (which would mean strict liability) if the legislature clearly intends for the act to impose strict liability.”

• Breach of fiduciary duty: As to Count III, Lurie denied that it owed a fiduciary duty to the patients. The court agreed, finding that the patients improperly used “the fiduciary duty a treating physician owes their patients to bootstrap into Illinois law a fiduciary duty owed to patients by the healthcare facility at which their treating physician practices.”

• Breach of contract: Counts IV and V alleged breach of express and implied contracts. Here the court found that the CAC failed to plead an express contract as to data security because neither of Lurie’s privacy policies laid out with any specificity the terms by which Lurie agreed to be bound. The court did, however, find that CAC’s allegations provided adequate support for an implied contract and that it alleged actual money damages caused by the breach.

• Unjust enrichment: The court dismissed Count VI because the CAC did not show that Lurie unjustly retained any benefit conferred by the patients. Any monetary benefit conferred upon Lurie was for health care services, and the CAC did not claim that there was any separate outlay for data security.

• Invasion of privacy: The CAC’s claim for public disclosure of private facts failed because it did not allege any public disclosure. It simply alleged that the patients’ private data was obtained by criminal actors and offered for sale on the dark web, which fell “well short of a public disclosure” in the court’s eyes.

• ICFA: Count VIII and IX’s allegations as to violation of PIPA and the Illinois Consumer Fraud and Deceptive Practices Act (ICFA) for failure to timely notify the patients of the breach were allowed to proceed only as to the four patients that had already experienced identity theft because the other patients failed to plausibly identify what pecuniary harms they could have avoided had they known of the data breach earlier. The ICFA claim failed because it was not pleaded with the particularity required under Rule 9(b).

• IUDTPA: The Illinois Uniform Deceptive Trade Practices Act (IUDTPA) claim based on Lurie’s misrepresentations about its data security practices failed to plead a related, ongoing or future harm. Although the patients argued their data remained vulnerable and at-risk, the court found this involved only risk of harm from the data breach, not a risk of harm they faced if Lurie continued to misrepresent its protective measures. Therefore, the court dismissed this claim.

The case is No. 24-cv-05503.

Judge: Wood, A.

Attorneys: Edward W. Ciolko (Sterlington, PLLC) for C.K. Matthew M.K. Stein (Glovsky and Popeo, P.C.) for Ann & Robert H. Lurie Children's Hospital of Chicago.

Companies: Ann & Robert H. Lurie Children's Hospital of Chicago

MainStory: TopStory CaseDecisions CyberPrivacyFeed DataPrivacy DataSecurity EHRNews HITNews GCNNews HealthReformNews IllinoisNews