Doe v. N. Ca Fertility Med. Ctr.

1

JANE DOE, on behalf of herself and all others similarly situated, Plaintiff, v. NORTHERN CALIFORNIA FERTILITY MEDICAL CENTER, Defendant.

No. 22-cv-01861-DAD-JDP

United States District Court, E.D. California

January 22, 2024

ORDER DENYING DEFENDANT'S MOTION TO DISMISS PLAINTIFF'S FIRST AMENDED COMPLAINT (DOC. NO 23)

DALE A. DROZD, UNITED STATES DISTRICT JUDGE.

This matter is before the court on the motion to dismiss filed by defendant Northern California Fertility Medical Center on January 1, 2023. (Doc No. 23.) On March 22, 2023, the pending motion was taken under submission on the papers. (Doc. No 32.) For the reasons explained below, defendant's motion to dismiss will be denied.

BACKGROUND

On December 19, 2022, plaintiff Jane Doe filed her operative first amended complaint (“FAC”), alleging that defendant failed to safeguard her sensitive medical information from cybercriminals. (Doc. No. 16.) In her FAC plaintiff alleges the following.

Defendant is a fertility clinic offering a full range of infertility services, including reversals of tubal ligations or vasectomies, ovulation induction, artificial insemination, in vitro fertilization (“IVF”), and IVF with egg donation and egg freezing. (Id. at ¶ 9.) As a healthcare provider, defendant creates, maintains, preserves, and stores highly sensitive information regarding its patients' fertility treatments. (Id. at ¶¶ 11-12.)

Plaintiff is a former patient of defendant's and paid defendant in exchange for fertility treatment. (Id. at ¶¶ 2, 81.) In order to receive this treatment, plaintiff was required to provide sensitive information to defendant and permit it to store that information in digital files. (Id. at ¶ 82.) Plaintiff believed that defendant would implement reasonable safeguards to keep her information secure. (Id. at ¶ 83.) Had plaintiff known defendant would fail to do so, she never would have contracted with defendant, let alone paid the full market price for defendant's services. (Id. at ¶ 84.) Concerned about the privacy of her information, plaintiff instructed defendant to delete her data and cease all contact with her in or around 2020. (Id. at ¶ 2.)

Given the type of data that defendant collected and stored, it was highly foreseeable that criminals would attempt to access defendant's servers. (Id. at ¶ 13.) Hackers are drawn to databases containing information with high value on secondary black markets, such as intimate and health-related data. (Id. at ¶ 14.) Indeed, the healthcare industry has faced more data breaches than any other industry, and data breaches are a well-known threat in the field. (Id. at ¶¶ 16-17.)

Despite this risk, defendant failed to adequately train its employees on basic cybersecurity protocols, including: password management and encryption protocols such as multi-factor authentication; locking, encrypting, and limiting access to files containing sensitive information; implementing guidelines for maintaining and communicating sensitive data; implementing protocols on how to request and respond to requests for the transfer of sensitive information; how to securely send sensitive information through a secure file transfer system to only known recipients; and providing cybersecurity training programs. (Id. at ¶ 26.) Instead, defendant continued to use outdated and insecure computer systems that are easily hacked. (Id. at ¶ 28.)

At some time in 2022, cybercriminals accessed defendant's servers and protected health information regarding defendant's patients, including the patients' names, whether the patients had received an ultrasound from defendant, and whether they had “cryopreserved tissue” (e.g., frozen eggs) stored with defendant (collectively, “the PHI”). (Id. at ¶ 21.) Cybercriminals must view the information they access during a data breach in order to determine its value on the black market, and the cybercriminals actually viewed plaintiff's PHI. (Id. at ¶ 22.)

Defendant claims to have discovered the data breach on July 24, 2022, though plaintiff was not notified of the breach until September 28, 2022. (Id. at ¶¶ 23-24.) She experienced extreme distress and anxiety upon learning that the information she had requested be deleted two years earlier had instead been accessed by third parties. (Id. at ¶¶ 31, 37.) Even having one's name associated with a fertility clinic such as defendant would constitute the revelation of the most intimate of health and family planning information. (Id. at ¶ 21.) Moreover, certain fertility treatments are controversial within many religious traditions, and a patient's reputation within their religious community could be compromised if it were discovered that the patient received treatment from a clinic such as defendant. (Id. at ¶ 36.)

Based on the above allegations, plaintiff asserts the following four claims against defendant in her FAC: (1) negligence; (2) invasion of privacy in violation of the California Constitution; (3) negligent storage of medical information in violation of California's Confidentiality of Medical Information Act (“CMIA”), California Civil Code §§ 56, et seq.; and (4) unlawful and unfair business practices in violation of California's Unfair Competition Law (“UCL”), California Business and Professions Code §§ 17200, et seq. (Id. at ¶¶ 51-87.)

On January 3, 2023, defendant filed its pending motion to dismiss plaintiff's FAC, arguing that plaintiff lacks Article III standing as to each of her claims; that she has failed to sufficiently allege negligence, invasion of privacy, and violation of the CMIA; and that she lacks standing to assert her UCL claim. (Doc. No. 23.) On January 17, 2023, plaintiff filed her opposition, and defendant filed its reply thereto on January 27, 2023. (Doc. Nos. 24, 26.)

LEGAL STANDARD

A. Motion to Dismiss Under Rule 12(b)(1)

Federal Rule of Civil Procedure 12(b)(1) permits a party to “challenge a federal court's jurisdiction over the subject matter of the complaint.” Nat'l Photo Grp., LLC v. Allvoices, Inc., No. 13-cv-03627-JSC, 2014 WL 280391, at *1 (N.D. Cal. Jan. 24, 2014). “A Rule 12(b)(1) jurisdictional attack may be facial or factual. In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004) (internal citation omitted). Here, because defendant argues that the allegations in plaintiff's FAC, even if assumed to be true, are insufficient to invoke federal jurisdiction over plaintiff's claims, defendant mounts a facial attack. (See Doc. No. 23 at 10.)

“The district court resolves a facial attack as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff's allegations as true and drawing all reasonable inferences in the plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court's jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014). However, the court need not assume the truth of legal conclusions cast in the form of factual allegations. Warren v. Fox Fam. Worldwide, Inc., 328 F.3d 1136, 1139 (9th Cir. 2003).

B. Motion to Dismiss Under Rule 12(b)(6)

The purpose of a motion to dismiss pursuant to Rule 12(b)(6) is to test the legal sufficiency of the complaint. N. Star Int'l v. Ariz. Corp. Comm'n, 720 F.2d 578, 581 (9th Cir. 1983). “Dismissal can be based on the lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory.” Balistreri v. Pacifica Police Dep't, 901 F.2d 696, 699 (9th Cir. 1990). A plaintiff is required to allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).

In determining whether a complaint states a claim on which relief may be granted, the court accepts as true the allegations in the complaint and construes the allegations in the light most favorable to the plaintiff. Hishon v. King & Spalding, 467 U.S. 69, 73 (1984). However, the court need not assume the truth of legal conclusions cast in the form of factual allegations. U.S. ex rel. Chunie v. Ringrose, 788 F.2d 638, 643 n.2 (9th Cir. 1986). While Rule 8(a) does not require detailed factual allegations, “it demands more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Iqbal, 556 U.S. at 678. A pleading is insufficient if it offers mere “labels and conclusions” or “a formulaic recitation of the elements of a cause of action.” Twombly, 550 U.S. at 555; see also Iqbal, 556 U.S. at 678 (“Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.”). It is inappropriate to assume that the plaintiff “can prove facts that it has not alleged or that the defendants have violated the . . . laws in ways that have not been alleged.” Associated Gen. Contractors of Cal., Inc. v. Cal. State Council of Carpenters, 459 U.S. 519, 526 (1983).

ANALYSIS

A. Standing

To have standing, a plaintiff “must satisfy the threshhold [sic] requirement imposed by Article III of the Constitution by alleging an actual case or controversy.” City of Los Angeles v. Lyons, 461 U.S. 95, 101 (1983). “In a class action, standing is satisfied if at least one named plaintiff meets the requirements.” Bates v. United Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007). “[S]tanding requires that (1) the plaintiff suffered an injury in fact, i.e., one that is sufficiently ‘concrete and...