Farmer v. Humana, Inc.

582 F.Supp.3d 1176

Steven K. FARMER, on behalf of himself and all others similarly situated, Plaintiff,

v.HUMANA, INC., a Delaware corporation, and Cotiviti, Inc., Delaware corporation, Defendants.

Case No. 8:21-cv-1478-MSS-SPF

United States District Court, M.D. Florida, Tampa Division.

Signed January 25, 2022

John Allen Yanchunis, Morgan & Morgan, PA, Ryan D. Maxey, Ryan Maxey Law, P.A., Tampa, FL, for Plaintiff.

Kimberly J. Donovan, Jason Daniel Joffe, Squire Patton Boggs (US) LLP, Miami, FL, for Defendant Humana Inc.

Julie Singer Brady, Baker & Hostetler, LLP, Orlando, FL, Michelle R. Gomez, Paul G. Karlsgodt, Pro Hac Vice, Baker & Hostetler LLP, Denver, CO, for Defendant Cotiviti, Inc.

ORDER

MARY S. SCRIVEN, UNITED STATES DISTRICT JUDGE

THIS CAUSE comes before the Court for consideration of Defendants’ Motions to Dismiss Plaintiff's Complaint, (Dkts. 15, 16), and Plaintiff's response in opposition thereto. (Dkt. 26) Upon consideration of all relevant filings, case law, and being otherwise fully advised, the Court GRANTS IN PART and DENIES IN PART the Motions to Dismiss.

I. BACKGROUND

A. Factual Background

This putative class action arises out of a data breach affecting customers of Humana, Inc., a medical benefit plan provider. (Dkt. 1-1 at ¶¶ 1, 3) In January 2019, Steven K. Farmer became a Humana member through his Medicare Advantage plan. (Id. at ¶ 54) To become a Humana member, Farmer was required to provide personally identifiable information ("PII"), including his name, Social Security number, and date of birth. (Id. ) Farmer alleges that he is "very careful" about sharing his PII, storing documents with such information in a "safe and secure location" and destroying them when necessary. (Id. at ¶ 57)

In December 2020, Humana learned that PII and protected health information ("PHI") of approximately 62,000 members had been exposed to "unauthorized individuals." (Id. at ¶ 3) Cotiviti, Inc., a Humana vendor, had collected members’ PII and PHI in order to verify data reported to the Centers for Medicare and Medicaid Services. (Id. at ¶ 21) Cotiviti, in turn, shared the PII and PHI with Visionary, a subcontractor hired to review medical records. (Id. at ¶¶ 25, 31) From October 2020 to December 2020, a Visionary employee disclosed medical records containing Humana members’ PII and PHI to "unauthorized individuals in an effort to provide medical coding training to those individuals for a personal coding business endeavor." (Id. at ¶ 25)

In March 2021, Humana sent Farmer a "Notice of Privacy Incident" that disclosed the data breach. (Id. ) Humana informed Farmer that unauthorized persons had obtained access to a wide variety of PII and PHI, including Social Security numbers, names, dates of birth, addresses, phone numbers, dates of service, medical record numbers, treatment-related information, and x-rays. (Id. )

Farmer alleges that Humana and Cotiviti failed to take "appropriate steps" to protect his and other Humana members’ PII and PHI. (Id. at ¶ 36) According to Farmer, the data breach would not have occurred if Humana and Cotiviti had implemented "appropriate technical safeguards" before sharing the PII and PHI with Visionary. (Id. at ¶ 35) Farmer also claims that, at the time of the data breach, Humana and Cotiviti departed from "standard industry rules, regulations, and practices" concerning the protection of PII and PHI. (Id. at ¶ 99)

Farmer identifies several injuries he and other unnamed class members allegedly suffered due to the data breach. (Id. at ¶¶ 11, 54-62) The injuries include (i) a "substantially increased risk of fraud" and "identity theft," (ii) "damages to and diminution in the value of [the] PII and PHI," (iii) "out-of-pocket expenses associated with the prevention, detection, and recovery from identity theft, tax fraud, and/or unauthorized use of [the] PII and PHI," (iv) time spent "dealing with the consequences of" the data breach, and (v) "anxiety and increased concerns for the loss of [ ] privacy." (Id. )

B. Procedural History

Farmer brought this putative class action against Humana and Cotiviti in Florida state court, asserting claims against both Defendants for negligence, invasion of privacy, breach of confidence, and violations of the Florida Deceptive and Unfair Trade Practices Act ("FDUTPA"), and a claim against Humana for breach of implied contract. (Dkt. 1; Dkt. 1-1) Farmer seeks to represent a nationwide class of Humana members whose PII and PHI were compromised in the data breach; he also seeks to represent a Florida subclass. (Dkt. 1-1 at ¶¶ 64-65) Defendants removed the action to federal court and moved to dismiss the Complaint for failure to state a claim. (Dkts. 1, 15, 16)

II. LEGAL STANDARD

A. Rule 12(b)(1)

Federal courts are courts of limited jurisdiction. "[B]ecause a federal court is powerless to act beyond its statutory grant of subject matter jurisdiction, a court must zealously ensure that jurisdiction exists over a case, and should itself raise the question of subject matter jurisdiction at any point in the litigation where a doubt about jurisdiction arises." Smith v. GTE Corp., 236 F.3d 1292, 1299 (11th Cir. 2001).

Motions to dismiss for lack of subject matter jurisdiction pursuant to Rule 12(b)(1) may attack jurisdiction facially or factually. Morrison v. Amway Corp., 323 F.3d 920, 924 n.5 (11th Cir. 2003). "Facial attacks" on the complaint require the Court to examine the four corners of the complaint to determine if the plaintiff has sufficiently alleged a basis for subject matter jurisdiction, and the allegations in the complaint are taken as true for the purposes of the motion. Lawrence v. Dunbar, 919 F.2d 1525, 1528-29 (11th Cir. 1990). "Factual attacks," on the other hand, permit the Court to look outside the four corners of the complaint to determine if jurisdiction exists. Eaton v. Dorchester Dev., Inc., 692 F.2d 727, 732 (11th Cir. 1982). In a factual attack, the presumption of truthfulness afforded to a plaintiff under Rule 12(b)(6) does not attach. Scarfo v. Ginsberg, 175 F.3d 957, 960 (11th Cir. 1999) (citing Lawrence, 919 F.2d at 1529 ). Because the Court's authority to hear the case is at issue in a Rule 12(b)(1) motion, the Court is free to weigh evidence outside the complaint. Eaton, 692 F.2d at 732.

B. Rule 12(b)(6)

The threshold for surviving a motion to dismiss for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6) is a low one. Quality Foods de Centro Am., S.A. v. Latin Am. Agribusiness Dev. Corp., S.A., et al., 711 F.2d 989, 995 (11th Cir. 1983). A plaintiff must plead only enough facts to state a claim to relief that is plausible on its face. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 127 S. Ct. 1955, 1968-69, 167 L.Ed.2d 929 (2007) (abrogating the "no set of facts" standard for evaluating a motion to dismiss established in Conley v. Gibson, 355 U.S. 41, 45-46, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957) ). Although a complaint challenged by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff is still obligated to provide the "grounds" for his entitlement to relief, and "a formulaic recitation of the elements of a cause of action will not do." Berry v. Budget Rent A Car Sys., Inc., 497 F. Supp. 2d 1361, 1364 (S.D. Fla. 2007) (quoting Twombly, 127 S. Ct. at 1964-65 ). In evaluating the sufficiency of a complaint in light of a motion to dismiss, the well pleaded facts must be accepted as true and construed in the light most favorable to the plaintiff. Quality Foods, 711 F.2d at 994-95. However, the court should not assume that the plaintiff can prove facts that were not alleged. Id. Thus, dismissal is warranted if, assuming the truth of the factual allegations of the plaintiff's complaint, there is a dispositive legal issue that precludes relief. Neitzke v. Williams, 490 U.S. 319, 326, 109 S.Ct. 1827, 104 L.Ed.2d 338 (1989).

III. DISCUSSION

A. Standing

Neither side argues that Farmer lacks standing to pursue his claims. Farmer contends, however, that in seeking dismissal of his negligence claim for failure to allege damages, Defendants have raised an "ill-disguised [standing] argument." (Dkt. 26 at 7) Although Farmer does not brief standing, he asks this Court to address the issue before turning to the merits of his claims. (Id. at 5-6) Regardless of whether the Parties raise standing, the Court "is obligated to inquire into subject matter jurisdiction sua sponte whenever it may be lacking." Univ. of S. Alabama v. Am. Tobacco Co., 168 F.3d 405, 410 (11th Cir. 1999). The Court concludes that Farmer has standing to bring his claims.

The "irreducible constitutional minimum of standing consists of three elements": "[t]he plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, 578 U.S. 330, 338, 136 S.Ct. 1540, 194 L.Ed.2d 635 (2016). A plaintiff experiences an injury in fact when the plaintiff "suffer[s] an invasion of a legally protected interest that is concrete and particularized and actual or imminent, not conjectural or hypothetical." Id. at 339, 136 S.Ct. 1540. "For an injury to be ‘particularized,’ it must affect the plaintiff in a personal and individual way." Id.

For an injury to be "concrete," it "must be ‘de facto ’; that is, it must actually exist." Id. at 340, 136 S.Ct. 1540. "Economic injuries are ‘[c]ertainly’ concrete." In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1262 (11th Cir. 2021) (quoting Debernardis v. IQ Formulations, LLC, 942 F.3d 1076, 1084 (11th Cir. 2019) ). "So are identity theft and damages resulting from such theft, as well as wasted time." Id. "A plaintiff can also satisfy the concreteness element by showing a ‘material’ risk of harm." Id. "Material" is "a familiar word that, in this context, means ‘important; essential; relevant.’ " Muransky v. Godiva Chocolatier, Inc., 979 F.3d...