Brush v. Miami Beach Healthcare Grp. Ltd.

• Decision Date: 17 February 2017
• Docket Number: CASE NO. 16–21373–CIV–LENARD/GOODMAN
• Citation: 238 F.Supp.3d 1359
• Parties: Barbara BRUSH, Plaintiff, v. MIAMI BEACH HEALTHCARE GROUP LTD., et al., Defendants.
• Court: U.S. District Court — Southern District of Florida

238 F.Supp.3d 1359

Barbara BRUSH, Plaintiff,

v.MIAMI BEACH HEALTHCARE GROUP LTD., et al., Defendants.

CASE NO. 16–21373–CIV–LENARD/GOODMAN

United States District Court, S.D. Florida.

Signed February 17, 2017

Benjamin S. Thomassen, Eve–Lynn J. Rapp, pro hac vice, Edelson PC, Chicago, IL, Steven R. Jaffe, Farmer Jaffe Weissing Edwards Fistos & Lehrman PL, Fort Lauderdale, FL, for Plaintiff.

Stephen Jay Bronis, Gavrila Alexa Brotz, Magda Christina Rodriguez, Walter J. Tache, Tache, Bronis, Christianson and Descalzo, P.A., Adam Michael Schachter, Daniel S. Gelber, Freddy Funes, Gelber Schachter & Greenberg, P.A., Miami, FL, for Defendants.

ORDER GRANTING IN PART AND DENYING IN PART DEFENDANTS' MOTION TO DISMISS (D.E. 21) AND DISMISSING COUNTS TWO, THREE AND FOUR WITHOUT PREJUDICE

JOAN A. LENARD, UNITED STATES DISTRICT JUDGE

THIS CAUSE is before the Court on Miami Beach Healthcare Group, LTD and HCA–EmCare Holdings, LLC's (hereinafter, "Defendants") Motion to Dismiss (D.E. 21), filed on June 10, 2016. Barbara Brush (hereinafter, "Plaintiff") filed her Response in Opposition (D.E. 44) on July 8, 2016. Defendants filed their Reply on July 25, 2016. (D.E. 51.) Having reviewed the Motion to Dismiss and response and reply thereto, the Court finds as follows.

I. Background

Defendants jointly provide healthcare services to patients at Aventura Hospital and Medical Center in South Florida. (D.E. 1, Pl.'s Compl. at ¶¶ 13 and 14). In October 2008, Plaintiff was admitted to Defendants' hospital to receive medical treatment. (Id. at ¶ 43). As part of the patient-admission process, she provided Defendants with sensitive information, including, among other things: her name, date of birth, social security number and protected health information. (Id. at ¶¶ 44 and 90.) Plaintiff paid Defendants for their services. (Id. at ¶ 33.)

In September 2014, nearly six years after Plaintiff had received treatment, Defendants informed their patients that a hospital employee, who was unauthorized to do so, had been accessing patients' sensitive information. (Id. at ¶ 8.) This security breach persisted between September 13, 2012 and June 9, 2014. (Id. )

Defendants' employee subsequently disclosed and/or sold Plaintiff's information to a third party. (Id. at ¶ 50.) Thereafter, the third party used Plaintiff's personal data to steal her identity and file a fraudulent tax return using her name and Social Security number. (Id. )

After her identity was stolen, Plaintiff spent (and continues to spend) time and resources remedying the harmful effects and mitigating future harm. (Id. at ¶ 51.) Prior to her visit to Defendants' hospital, Plaintiff's identity had never been stolen and she took considerable precautions to protect her private data. (Id. at ¶ 52–53.) Specifically, Plaintiff avoided transmitting her sensitive information over insecure sources, she stored documents containing private data in a safe and secure location and she destroyed any documents that she received in the mail that contained any identifying information. (Id. )

On April 18, 2016, Plaintiff filed a four-count Complaint for negligence, breach of contract, breach of implied contract and unjust enrichment. (D.E. 1.) She claims that:

Defendants [failed to] comply with safeguards mandated by HIPAA regulations, Florida law or industry standards.

...

Defendants failed to implement sufficient information security policies and procedures to (1) protect (e.g., via encryption) or otherwise safeguard their patients' electronically-stored Sensitive Information; (2) restrict access (i.e., segment) their electronic database to limit access to such Sensitive Information to only those employees and personnel that need to access such information for treatment related reasons; and (3) supervise employees and personnel with access to patient Sensitive Information and enforce their data protection and confidentiality policies.

(Id. at ¶ 28.) Plaintiff claims that because of the Defendants' security failures, her identity was stolen. She seeks damages for the purported economic and non-economic damages she has suffered as a result of a third party stealing her identity and filing a false tax return in her name.

In response, the Defendants filed a Motion to Dismiss. (D.E. 21.) They argue that the Court should dismiss Plaintiff's Complaint and strike class allegations because: (1) Plaintiff lacks Article III standing to bring this action, see Fed. R. Civ. P. 12(b)(1) ; (2) Plaintiff fails to state claims upon which relief may be granted, see Fed. R. Civ. P. 12(b)(6) ; (3) the statute of limitation bars the Plaintiff from seeking relief; and (4) Plaintiff's class action allegations are atypical of the other members of the class. (Id. )

Plaintiff replied, asserting that she satisfies Article III's standing requirements because she had suffered a concrete injury that can be remedied by this lawsuit. (D.E. 44.) She further argues that she has successfully pleaded the elements of negligence, breach of contract, breach of implied contract and quantum meruit. (Id. )

II. Legal Standards

A. Motion to Dismiss for Lack of Jurisdiction

Federal Rule of Civil Procedure 12(b)(1) governs motions to dismiss for lack of subject matter jurisdiction. Standing to bring suit is an essential component of a federal court's subject matter jurisdiction. Clapper v. Amnesty Int'l USA , 568 U.S. 398, 133 S.Ct. 1138, 1146, 185 L.Ed.2d 264 (2013). Standing "determin[es] the power of the court to entertain the suit." Hollywood Mobile Estates Ltd. v. Seminole Tribe of Florida , 641 F.3d 1259, 1265 (11th Cir. 2011) (quoting Warth v. Seldin , 422 U.S. 490, 498, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975) ); see also Stalley ex rel. United States v. Orlando Reg'l Healthcare Sys., Inc. , 524 F.3d 1229, 1232 (11th Cir. 2008) (per curiam). As in any case, the Court must "first determine whether it has proper subject matter jurisdiction before addressing the substantive issues." Taylor v. Appleton , 30 F.3d 1365, 1366 (11th Cir. 1994).

B. Motion to Dismiss for Failure to State a Claim

Under Federal Rule of Civil Procedure 12(b)(6), a court may dismiss an action for "failure to state a claim upon which relief can be granted." To survive a motion to dismiss, the complaint "must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Bell Atlantic Corp. v. Twombly , 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. "A formulaic recitation of the elements of the cause of action will not do," id. at 1949 (quoting Twombly , 550 U.S. at 555, 127 S.Ct. 1955 ), and the allegations must include "more than an unadorned, the-defendant-unlawfully-harmed-me-accusation." Iqbal 556 U.S. at 678, 129 S.Ct. 1937. When considering whether a complaint should be dismissed, the Court accepts the facts alleged in the Complaint as true, and construes all reasonable inferences in the light most favorable to plaintiffs. See Bank v. Pitt , 928 F.2d 1108, 1109 (11th Cir. 1991).

III. Discussion

A. Standing

To satisfy the basic constitutional requirement that there is an active case or controversy, standing must exist to assert the claims. Hollywood Mobile Estates Ltd. v. Seminole Tribe of Florida , 641 F.3d 1259, 1264 (11th Cir. 2011) (quoting Lujan v. Defenders of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ) ("Article III of the United States Constitution limits the jurisdiction of federal courts to ‘Cases' and ‘Controversies,’ U.S. Const. Art. III, § 2, and the core component of standing is an essential and unchanging part of the case-or-controversy requirement of Article III.") (internal quotations omitted). To establish standing sufficient to maintain a suit, a plaintiff must show that: "(1) [she] has suffered an ‘injury in fact’ that is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision." Friends of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc. , 528 U.S. 167, 180–81, 120 S.Ct. 693, 145 L.Ed.2d 610 (2000) ; see also Hollywood Mobile Estates Ltd. , 641 F.3d at 1265 ("The Supreme Court has explained that the ‘irreducible constitutional minimum’ of standing under Article III consists of three elements: an actual or imminent injury, causation, and redressability.") (citation omitted). "At the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice" to show standing, "for on a motion to dismiss [a court] presume[s] that general allegations embrace those specific facts that are necessary to support the claim." Lujan , 504 U.S. at 561, 112 S.Ct. 2130 (internal citations omitted).

The threshold issues in this case are whether Plaintiff suffered an actual, concrete injury, and if so, whether her injury is fairly traceable to the conduct of the Defendants.

The Eleventh Circuit recently addressed whether a victim of identity theft resulting from a data breach has standing to assert a claim in Resnick v. AvMed, Inc. , 693 F.3d 1317 (11th Cir.2012). In Resnick , the plaintiffs alleged that their personal data was compromised after laptops were stolen from the office of their health care plan operator. One plaintiff's sensitive information was used by an unknown third party to open and overdraw an account with E*Trade Financial and another's personal data was used to open credit accounts with Bank of America and make unauthorized purchases in her name. The Eleventh Circuit held that these plaintiffs had alleged injuries sufficient to confer Article...