Graham v. Universal Health Serv., Inc.

539 F.Supp.3d 481

Barry K. GRAHAM, et al.

v.UNIVERSAL HEALTH SERVICE, INC.

CIVIL ACTION NO. 20-5375

United States District Court, E.D. Pennsylvania.

Filed May 17, 2021

John A. Yanchunis, Morgan & Morgan, Tampa, FL, for Stephen Motkowicz.

Mark S. Melodia, Holland & Knight LLP, New York, NY, Nipun J. Patel, Paul Bond, Holland & Knight LLP, Philadelphia, PA, for Universal Health Services, Inc.

MEMORANDUM

McHUGH, United States District Judge

This is a putative class action arising out of a data breach that occurred when a health care company was subjected to a ransomware attack. Plaintiffs Barry K. Graham, Angela Morgan, and Stephen Motkowicz allege that Universal Health Services failed to safeguard their protected health information ("PHI"), with the result that their PHI was exposed to hackers in September 2020. The issue is whether Plaintiffs can show injuries sufficient to confer standing. Two of the three named Plaintiffs allege only increased risk of identity theft, as well as additional expenditures of time and money to monitor accounts for fraud. Their claims fail because of the narrow definition of injury the Third Circuit adopted for data breach cases in Reilly v. Ceridian Corp , 664 F.3d 38 (3d Cir. 2011). The remaining Plaintiff, Stephen Motkowicz, alleges an additional, novel injury—that the data theft delayed his surgery, which caused his employer-provided insurance to lapse and required him to purchase alternative insurance at a higher premium. As to this claim, the economic loss qualifies as a concrete injury, but further development of the record is required to determine whether there is a sufficient causal relationship to confer standing.

I. Factual Background

Defendant Universal operates "one of the largest healthcare companies in North America," First Am. Compl. ¶ 37, ECF 13, and "[i]n its ordinary course of business, ... maintains PHI, including the name, address, zip code, date of birth, Social Security number, medical diagnoses, insurance information, and other sensitive and confidential information for current and former customers/patients." Id. ¶ 38. In late September 2020, Defendant announced that its facilities were "currently offline due to an IT security issue." Id. ¶ 2. Plaintiffs contend that Defendant's systems were inaccessible because of a malicious ransomware attack. Id.

Barry Graham, Angela Morgan, and Stephen Motkowicz are customers of Defendant. Id. ¶¶ 12, 14, 16. They claim their PHI was compromised in the September attack due to "Defendant's failure to implement and follow appropriate security procedures." Id. ¶ 5. Plaintiffs further allege that they have (1) experienced an increased risk of identity theft, id. ¶ 53; (2) expended additional time and money to monitor their personal and financial records for fraud, id. ¶ 62; (3) suffered the lost or diminished value of their PHI, id. ¶ 181; and (4) received a "diminished value of the services they paid Defendant to provide," as Defendant represented that it would protect the confidentiality of their PHI. Id. ¶ 6.

In addition to the injuries described above, Plaintiff Motkowicz also claims financial harms, in the form of increased insurance expenses. Id. ¶ 65. He avers that he was scheduled for a surgical procedure on September 28, 2020, but that Defendant canceled his procedure on account of the ransomware attack. Id. Motkowicz's surgery was rescheduled for six weeks later, which caused him to miss additional time at work. Id. Because he could not return to work, Plaintiff's insurance lapsed, requiring him to procure alternative insurance at an increased cost. Id.

Plaintiffs’ suit claims that Defendant has engaged in negligence ("Count I"), breach of implied contract ("Count II"), breach of fiduciary duty ("Count III"), and breach of confidence ("Count IV"). Defendant counters with a Motion to Dismiss pursuant to Fed. R. Civ. P. 12(b)(1) and 12(b)(6), arguing that Plaintiffs lack standing and that they have otherwise failed to state a claim.

II. Standard of Review

Slightly different standards of review apply for motions to dismiss claims pursuant to Federal Rules 12(b)(1) and (6). Within the Third Circuit, motions to dismiss under Fed. R. Civ. P. 12(b)(6) are governed by the well-established standard set forth in Fowler v. UPMC Shadyside , 578 F.3d 203, 210 (3d Cir. 2009).

To decide a motion to dismiss under 12(b)(1), "a court must first determine whether the movant presents a facial or factual attack." In re Schering Plough Corp. Intron/Temodar Consumer Class Action , 678 F.3d 235, 243 (3d Cir. 2012). A facial attack is one that "attack[s] the sufficiency of the consolidated complaint on the grounds that the pleaded facts d[id] not establish constitutional standing." In Re Horizon Healthcare Services Inc. Data Breach Litigation , 846 F.3d 625, 632 (3d Cir. 2017). A factual challenge, by contrast, contests the validity of Plaintiffs’ factual claims. Id. Defendant raises a facial challenge; it does not directly attack Plaintiffs’ pleaded facts but instead argues that "[t]he allegations in Plaintiffs’ Amended Complaint fall far short" of conferring standing. Def.’s Mem. L. Supp. Mot. Dismiss 13, ECF 15-1. Considering this facial attack, I must "accept the Plaintiffs’ well-pleaded factual allegations as true and draw all reasonable inferences from those allegations in the Plaintiffs’ favor." In Re Horizon , 846 F.3d at 633.

III. Discussion

Article III of the Constitution limits federal courts’ jurisdiction to certain "Cases" and "Controversies." U.S. CONST. art. III, § 2. At its core, "the question of standing is whether the litigant is entitled to have the court decide the merits of the dispute or of particular issues." Warth v. Seldin , 422 U.S. 490, 498, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975). To demonstrate standing to file suit, Plaintiffs must show (1) an "injury in fact" or an "invasion of a legally protected interest" that is "concrete and particularized," (2) a "causal connection between the injury and the conduct complained of," and (3) a likelihood "that the injury will be redressed by a favorable decision." Lujan v. Defs. of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992).

These standing requirements also apply in the class action context. "[N]amed plaintiffs who represent a class must allege and show that they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent." Lewis v. Casey , 518 U.S. 343, 357, 116 S.Ct. 2174, 135 L.Ed.2d 606 (1996) (citation and internal quotation marks omitted). "[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class." O'Shea v. Littleton , 414 U.S. 488, 494, 94 S.Ct. 669, 38 L.Ed.2d 674 (1974). Accordingly, at least one of the three named Plaintiffs must have Article III standing to maintain this class action. See Neale v. Volvo Cars of North America, LLC , 794 F.3d 353, 364 (3d Cir. 2015).

A. Injury-in-Fact

Plaintiffs assert five potential injuries-in-fact: (1) increased risk of identity theft; (2) additional expenditures of time and money for monitoring; (3) lost or diminished value of their PHI; (4) a "diminished value of the services they paid Defendant to provide," and (5) Mr. Motkowicz's increased insurance costs. First Am. Compl. ¶¶ 6, 65. Based on the pleadings presented, I find that only Motkowicz has shown injury-in-fact. Because Graham and Morgan's injuries are either speculative or manufactured, their claims are precluded by the Third Circuit's opinion in Reilly v. Ceridian Corp. 664 F.3d 38.

The injury-in-fact requirement is intended to "distinguish a person with a direct stake in the outcome of a litigation—even though small—from a person with a mere interest in the problem." United States v. Students Challenging Regulatory Agency Procedures (SCRAP) , 412 U.S. 669, 689 n.14, 93 S.Ct. 2405, 37 L.Ed.2d 254 (1973). This standard is "not Mount Everest," Danvers Motor Co., Inc. v. Ford Motor Co. , 432 F.3d 286, 294 (3d Cir. 2005), and demands only that the plaintiff "allege some specific, ‘identifiable trifle’ of injury." Cottrell v. Alcon Laboratories , 874 F.3d 154, 163 (3d Cir. 2017) (citing Bowman v. Wilson , 672 F.2d 1145, 1151 (3d Cir. 1982) ) (internal punctuation omitted). Even so, an injury-in-fact "must be concrete in both a qualitative and temporal sense." Reilly , 664 F.3d at 42. For this reason, "allegations of possible future injury," will not suffice, and a plaintiff "lacks standing if his ‘injury’ stems from an indefinite risk of future harms inflicted by unknown third parties." Id.

1. Economic loss in the form of increased insurance premiums

Motkowiczs’ claim for increased insurance payments meets the injury-in-fact requirement. As noted by the Third Circuit, "[t]ypically, a plaintiff's allegations of financial harm will easily satisfy each of these components, as financial harm is a ‘classic’ and ‘paradigmatic form’ of injury in fact." Cottrell , 874 F.3d at 163 (internal punctuation omitted). See also Danvers , 432 F.3d at 293 (stating that where a plaintiff alleges financial harm, standing "is often assumed without discussion"). Plaintiff's injury is not speculative, as his financial expenditures allegedly occurred in response to the data breach and the corresponding cancellation of his surgery. Nor has Plaintiff "manufactured" standing, as his additional insurance payments did not arise due to voluntary prophylactic action on his part. See Clapper v. Amnesty Intern. USA , 568 U.S. 398, 416, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013) (stating that respondents cannot create "standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending"). I therefore conclude that Motkowicz has sufficiently alleged an injury-in-fact.

2...