Foster v. Health Recovery Servs., Inc., Case No. 2:19-CV-4453

• Decision Date: 07 October 2020
• Docket Number: Case No. 2:19-CV-4453
• Citation: 493 F.Supp.3d 622
• Parties: Troy FOSTER, individually, and on behalf of all others similarly situated, Plaintiff, v. HEALTH RECOVERY SERVICES, INC., Defendant.
• Court: U.S. District Court — Southern District of Ohio

493 F.Supp.3d 622

Troy FOSTER, individually, and on behalf of all others similarly situated, Plaintiff,

v.HEALTH RECOVERY SERVICES, INC., Defendant.

Case No. 2:19-CV-4453

United States District Court, S.D. Ohio, Eastern Division.

Signed October 7, 2020

Michael Fradin, Fradin Law Office, Athens, OH, for Plaintiff.

Lisa Pierce Reisz, Christopher Logan Ingram, Elizabeth S. Alexander, Vorys, Sater, Seymour and Pease LLP, Columbus, OH, for Defendant.

OPINION & ORDER

ALGENON L. MARBLEY, CHIEF UNITED STATES DISTRICT JUDGE

This matter is before the Court on Defendant's Motion to Dismiss. (ECF No. 9). Plaintiff has filed a response opposing the motion to dismiss (ECF No. 15) and Defendant has filed a reply (ECF No. 17). For the reasons set forth below, this Court GRANTS in part and DENIES in part Defendant's Motion to Dismiss.

I. BACKGROUND

Plaintiff, Troy Foster, is an Ohio resident who received services from Defendant, Health Recovery Services. (ECF No. 6 at 2). Health Recovery Services ("HRS") is a non-profit that provides services to those suffering from mental illness or substance abuse issues. Id. On February 5, 2019, HRS learned that its network had been breached since November 2018 when an unauthorized IP address remotely accessed its computer network containing the personal information of clients, including Plaintiff and the class he seeks to represent. Id. at 3. Defendant alleges that it sent notice of this data breach on April 5, 2019 and in that notice stated that it has no evidence that the unauthorized IP address had accessed or acquired protected health information. (ECF No. 9 at 2-3). In that notice, Defendant offered free credit monitoring services for clients affected by the data breach. Id. at 3.

On October 6, 2019, Mr. Foster filed a complaint for damages against HRS on behalf of a class of similarly situated individuals alleging that HRS's failure to maintain "reasonable and adequate procedures to protect and secure" his personal information as well as the failure to discover timely the data breach resulted in financial injuries to himself and other class members and placed them at risk of identity theft and other fraud and abuse. (ECF No. 6 at 4). Plaintiff alleges that as a result of the data breach, there is a strong possibility that entire batches of personal information will be "dumped on the black market," his privacy (and the privacy of class members) has been invaded, he has been forced to spend time and money to monitor his credit, and Plaintiff has suffered severe emotional distress from having his most sensitive health information disclosed. Id. at 6-7.

Plaintiff brings ten causes of action under state and federal law in his personal capacity and on behalf of a class, including: (1) breach of confidence based on an unauthorized disclosure to third parties; (2) violation of Ohio Consumer Sales Practices Act, Oh. Rev. C. § 1345.01 ; (3) negligence; (4) breach of contract; (5) breach of implied contract; (6) unjust enrichment; (7) Oh. Rev. C. § 2307.60 Civil Action for Damages for Criminal Act; (8) Willful Violation of the Fair Credit Reporting Act, 15 U.S.C. § 1681 ; (9) Negligent Violation of the Fair Credit Reporting Act, 15 U.S.C. § 1681 ; and (10) Violation of Oh. Rev. C. § 3701.243 for the disclosure of HIV status. (ECF No. 6). Defendant has moved to dismiss Plaintiff's complaint, arguing that this Court does not have jurisdiction because Plaintiff has alleged no injury and cannot establish standing and that Plaintiff also has failed to state a claim for relief on each of the ten counts. (ECF No. 9). Plaintiff has responded opposing Defendant's Motion to Dismiss (ECF No. 15), and Defendant has timely replied (ECF No. 17).

II. STANDARD OF REVIEW

A. 12(b)(1)

When subject matter jurisdiction is challenged pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure, the plaintiff has the burden of proving jurisdiction. Moir v. Greater Cleveland Reg'l Transit Auth. , 895 F.2d 266, 269 (6th Cir. 1990) (citing Rogers v. Stratton Industries, Inc. , 798 F.2d 913, 915 (6th Cir. 1986) ). Federal Rule of Civil Procedure 12(b)(1) motions to dismiss based upon subject matter jurisdiction generally come in two varieties: (1) a facial attack on subject matter jurisdiction; and (2) a factual attack on subject matter jurisdiction. See Ohio Nat'l Life Ins. Co. v. United States , 922 F.2d 320, 325 (6th Cir. 1990) (identifying the two types of 12(b)(1) motions to dismiss). Facial attacks on subject matter jurisdiction "merely question the sufficiency of the pleading." Id. A facial attack on subject matter jurisdiction is reviewed under the same standard as a 12(b)(6) motion to dismiss. Id.

Alternatively, when a court reviews a complaint under a factual attack, "no presumptive truthfulness applies to the factual allegations." Id. In deciding a motion to dismiss based upon a factual attack, the district court must "weigh the conflicting evidence to arrive at the factual predicate that subject matter jurisdiction exists or does not exist." Id. ; see also Golden v. Gorno Bros., Inc. , 410 F.3d 879, 881 (6th Cir. 2005) ; Madison–Hughes v. Shalala , 80 F.3d 1121, 1130 (6th Cir. 1996). While weighing conflicting evidence, a trial court has wide discretion to consider affidavits and other documents to resolve disputed jurisdictional facts. Cartwright v. Garner , 751 F.3d 752, 759 (6th Cir. 2014) ; Ohio Nat'l Life Ins. Co. , 922 F.2d at 325. This Court analyzes Defendants’ Rule 12(b)(1) motion to dismiss as a factual attack because the motion challenges Plaintiff's standing based upon evidence Plaintiff does not incorporate into the complaint. See Cartwright , 751 F.3d at 760.

B. 12(b)(6)

This Court may dismiss a cause of action under 12(b)(6) for "failure to state a claim upon which relief can be granted." A 12(b)(6) motion "is a test of the plaintiff's cause of action as stated in the complaint, not a challenge to the plaintiff's factual allegations." Golden v. City of Columbus , 404 F.3d 950, 958-59 (6th Cir. 2005). The Court must construe the complaint in the light most favorable to the non-moving party. Total Benefits Planning Agency, Inc. v. Anthem Blue Cross & Blue Shield , 552 F.3d 430, 434 (6th Cir. 2008). This Court is not required, however, to accept as true mere legal conclusions unsupported by factual allegations. Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). Although liberal, Rule 12(b)(6) requires more than bare assertions of legal conclusions. Allard v. Weitzman, 991 F.2d 1236, 1240 (6th Cir. 1993) (citation omitted). Generally, a complaint must contain a "short and plain statement of the claim showing that the pleader is entitled to relief." Fed. R. Civ. P. 8(a)(2). In short, a complaint's factual allegations "must be enough to raise a right to relief above the speculative level." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). It must contain "enough facts to state a claim to relief that is plausible on its face." Id. at 570, 127 S.Ct. 1955.

III. ANALYSIS

A. 12(b)(1) Lack of Subject Matter Jurisdiction - Standing

Defendant argues that Plaintiff's complaint must be dismissed for lack of subject matter jurisdiction because Plaintiff has not suffered an injury in fact. Defendant argues that Plaintiff has failed to: (1) allege that he suffered any harm resulting from a delayed notification; (2) to allege that his information was actually stolen or that he has suffered any injury; and (3) to allege that he actually provided sensitive health information about himself to HRS. (ECF No. 9 at 6-10). Plaintiff argues he has standing to bring his claims personally and on behalf of a class and that he has sufficiently alleged the threat of a substantial risk of harm. (ECF No.15 at 3-4).

Article III, § 2 of the United States Constitution vests federal courts with jurisdiction to address "actual cases and controversies." Coalition for Gov't Procurement v. Fed. Prison Indus., Inc. , 365 F.3d 435, 458 (6th Cir. 2004) (citing U.S. CONST. art III, § 2). The doctrine of standing, which is derived from Article III, requires a plaintiff to have a "personal stake in the outcome of the controversy." Susan B. Anthony List v. Driehaus , 573 U.S. 149, 158, 134 S.Ct. 2334, 189 L.Ed.2d 246 (2014) (internal citations and quotation marks omitted). The Supreme Court requires a plaintiff to have: "(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S. Ct. 1540, 1547, 194 L.Ed.2d 635 (2016).

This Court will consider each of Defendant's three arguments in turn.

1. Harm From Delayed Notification of Breach

Defendant first argues that Plaintiff has failed to specify what harm he suffered as a result of HRS's failure timely to disclose the data breach. (ECF No. 9 at 6-7). Defendant argues that Plaintiff is required to allege that he suffered damages as a result of the delayed notice. Id. Plaintiff failed to address this argument in his reply and has failed to carry his burden of demonstrating that standing exists. (ECF No. 15).

The plaintiff bears the burden of demonstrating that he or she has standing and is required to allege facts demonstrating the existence of each element of standing. See Galaria v. Nationwide Mut. Ins. Co., 663 Fed. Appx. 384, 387 (6th Cir. 2016). Here, Plaintiff merely alleges that HRS’ failure to discover the breach and notify Plaintiff in a timely manner has "resulted in financial injuries to Plaintiff Foster and Data Breach Class members." (ECF No. 6 at 12). Plaintiff has failed to allege what specific financial injury he suffered from Defendant's delay in notifying him of the data breach. Accordingly, he has failed to carry his burden of demonstrating that he has standing to pursue a claim on the basis of an injury from delayed notification. See Savidge v. Pharm-Save, Inc....