Cybersecurity Policy Report, Theft of PHI in a data breach yields viable common-law claims against nursing facilities by residents, (Sep 21, 2026)

By Nadine E. Roddy, J.D.

The residents’ information was subsequently found on the “dark web,” and they had experienced a “sharp uptick” in suspicious spam calls, texts, and emails.

Nursing home residents whose protected health information (PHI) was accessed in a data breach sufficiently alleged claims of negligence, breach of implied contract, and unjust enrichment against the nursing facilities, as well as a claim of negligence against a service provider to whom the PHI had been supplied by the facilities, the federal district court in Maryland has ruled. Accordingly, the court denied the facilities’ and service provider’s motion to dismiss (Anderson v. Fundamental Administrative Services, LLC, No. 1:25-cv-02754-ABA (D. Md. Sept 14, 2026)).

Data breach. Three current or former nursing home residents, individually and on behalf of putative class members, brought suit against three corporate defendants—two nursing and rehabilitation facilities (facilities) and one company retained by the facilities to provide unspecified services (service provider). The residents claimed that the defendants were responsible for a data breach that resulted in the theft of their PHI. They asserted theories of (1) negligence against all three defendants, (2) breach of implied contract against the facilities, and (3) unjust enrichment against the facilities.

The complaint alleged that in order to receive services from the facilities, the residents were required to provide their PHI, including their names, dates of birth, driver’s license numbers, Social Security numbers, financial account information, medical treatment information, health insurance and Medicaid/Medicare information, and other sensitive data. The facilities in turn transmitted the PHI to the service provider in order to receive services. On January 20, 2025, the service provider discovered that its networks had been breached between October 27, 2024, and January 13, 2025—a breach that involved the theft of the PHI of the facilities’ residents, including that of the plaintiffs.

One of the residents alleged that after the data breach, she was notified by her bank that someone had attempted (unsuccessfully) to purchase $500-worth of furniture in Spain by charging it to her account. Another resident claimed that he received multiple notifications from credit monitoring services that his PHI was found on the “dark web,” and that he experienced a “sharp uptick” in suspicious spam calls, texts, and emails. All three residents alleged that, “[u]pon information and belief, [their] Private Information is available on the dark web as a result of the Data Breach.” In addition, they had lost time and resources attempting to mitigate the risk of identity fraud, their private information had diminished in value, and they had suffered a loss of privacy.

The defendants moved to dismiss the complaint pursuant to Rules 12(b)(1), 12(b)(2), and 12(b)(6).

Preliminary issues. The court determined that the residents had alleged injury-in-fact sufficient for Article III standing. To establish such standing in the context of a data breach, a plaintiff must allege “a nonspeculative increased risk of identity theft” that is “sufficiently imminent.” The Fourth Circuit had recently held that an allegation that personal information has been made available on the dark web due to a data breach is adequate injury-in-fact for standing purposes. Further, the residents’ allegations that they had provided their PHI to the facilities and were injured when that information was stolen in the data breach were sufficient to allege causation for standing purposes.

The court also had specific personal jurisdiction over the facilities. One of the facilities was located in Texas, the state of residence of two of the plaintiffs, and the other facility was located in Nevada, the state of residence of the third plaintiff. The facilities had purposefully availed themselves of the services of a company headquartered in Maryland, and the services had been performed by the company’s employees in Maryland.

Negligence. After determining that Texas law applied to the Texas residents’ claims and Nevada law applied to the Nevada resident’s claims, the court noted that Texas and Nevada share the same elements for negligence. On the first element of a duty owed, the court acknowledged that no privity existed between the service provider and the residents. But the complaint sufficiently alleged a privity equivalent—an intimate nexus—in that the service provider knew or should have known the residents were relying on it to keep their PHI secure. Likewise, the service provider knew that it needed to protect the PHI because it was highly sought after by persons seeking to misappropriate it. Further, the complaint sufficiently alleged that the facilities had a duty to ensure that their vendors and affiliates maintained adequate security of the PHI provided.

The court then determined that allegations concerning the data breach were sufficient to meet the element of breach of duty, and those concerning the subsequent harms the residents suffered and were likely to continue to suffer adequately pleaded proximately caused damages.

Breach of implied contract. The facilities argued that there was no consideration for any alleged implied contract because “a promise to fulfill a duty imposed by law is not valid consideration.” They pointed to their statutory duty to protect the residents’ PHI under the federal Health Insurance Portability and Accountability Act. The residents countered that the consideration at issue was not just the promise to fulfill a duty; it also included the residents’ supplying their PHI to the facilities and the facilities’ providing services to the residents, both of which had value. The court agreed with the residents.

Unjust enrichment. The residents claimed that by providing the facilities with their PHI, they had conferred a benefit on the facilities that unjustly enriched them. The court noted other data breach cases in which claims of unjust enrichment were allowed to proceed when a company accepted money and then failed to safeguard bargained-for data security. At this stage of the case, the court concluded that the residents had adequately alleged an unjust enrichment claim, “at least as an alternative should the legal remedies prove inadequate.”

For these reasons, the court denied the motion to dismiss, except for other claims the residents had abandoned.

The case is No. 1:25-cv-02754-ABA.

Judge: Abelson, A.

Attorneys: Gary F. Lynch (Lynch Carpenter, LLP) for Virgina Anderson. Timothy J. Lowe (McDonald Hopkins LLC) for Fundamental Administrative Services, LLC.

Companies: Fundamental Administrative Services, LLC

Cases: CaseDecisions FederalLegislation EHRNews GeneralNews HIPAANews LTCHNews CyberPrivacyFeed DataPrivacy DataBreach MarylandNews DataSecurity