Maglio v. Advocate Health & Hosps. Corp.

• Court: Appellate Court of Illinois
• Writing for the Court: Justice JORGENSEN delivered the judgment of the court, with opinion.
• Citation: Maglio v. Advocate Health & Hosps. Corp., 40 N.E.3d 746 (Ill. App. 2015)
• Decision Date: 06 August 2015
• Docket Number: Nos. 2–14–0782,2–14–0998 cons.,s. 2–14–0782
• Parties: Matias MAGLIO, Individually and as Father and Next Friend of Macailee Maglio, a Minor, and on Behalf of All Others Similarly Situated, and Alexander Gil, Individually and on Behalf of All Others Similarly Situated, Plaintiffs–Appellants, v. ADVOCATE HEALTH AND HOSPITALS CORPORATION, Individually and d/b/a Advocate Medical Group, Defendants–Appellees. Veronica Vides, Individually and as Mother and Next Friend of I.X.A. and B.K.A., Minors, Peter Sink, Paula Wisniowicz, Gregg Wisniowicz, Shari Slavin, Arthur Cohen, David Cohen, Jennifer Cohen, Marianna Cohen, Audrey Friedland, Julie Marder, Eric Marder, Amy Friedland, Lori Friedland, Scott Friedland, Michael Friedland, Renee Rouse, Robin Fields, Mitchel A. Fields, Individually and on Behalf of All others Similarly Situated, Plaintiffs–Appellants, v. Advocate Health and Hospitals Corporation, d/b/a Advocate Medical Group, Defendant–Appellee.

40 N.E.3d 746

Matias MAGLIO, Individually and as Father and Next Friend of Macailee Maglio, a Minor, and on Behalf of All Others Similarly Situated, and Alexander Gil, Individually and on Behalf of All Others Similarly Situated, Plaintiffs–Appellants

v.ADVOCATE HEALTH AND HOSPITALS CORPORATION, Individually and d/b/a Advocate Medical Group, Defendants–Appellees.

Veronica Vides, Individually and as Mother and Next Friend of I.X.A. and B.K.A., Minors, Peter Sink, Paula Wisniowicz, Gregg Wisniowicz, Shari Slavin, Arthur Cohen, David Cohen, Jennifer Cohen, Marianna Cohen, Audrey Friedland, Julie Marder, Eric Marder, Amy Friedland, Lori Friedland, Scott Friedland, Michael Friedland, Renee Rouse, Robin Fields, Mitchel A. Fields, Individually and on Behalf of All others Similarly Situated, Plaintiffs–Appellants

v.Advocate Health and Hospitals Corporation, d/b/a Advocate Medical Group, Defendant–Appellee.

Nos. 2–14–0782

2–14–0998 cons.

Appellate Court of Illinois, Second District.

Aug. 6, 2015.

Robert M. Foote and Matthew J. Herman, Foote Mielke Chavez & O'Neill, LLC, Geneva, and Mark F. Slavin, Nancy Richter, and Katharine Barnes, Slavin & Slavin, Chicago, for appellants.

George J. Tzanetopoulos and David M. Friebus, Baker & Hostetler, LLP, Chicago, and Daniel R. Warren, Baker & Hostetler, LLP, Cleveland, Ohio, for appellees.

OPINION

Justice JORGENSEN delivered the judgment of the court, with opinion.

¶ 1 In these consolidated cases, plaintiffs filed putative class actions against defendant, Advocate Health and Hospitals Corporation, individually and d/b/a Advocate Medical Group (Advocate), raising claims of negligence, violations of the Personal Information Protection Act (Protection Act) (815 ILCS 530/1 et seq. (West 2014)), the Consumer Fraud and Deceptive Business Practices Act (Fraud Act) (815 ILCS 505/1 et seq. (West 2014)), and invasion of privacy, after four computers containing patient information were stolen from Advocate's offices. Plaintiffs did not allege that their personal information was used in any unauthorized manner as a result of the burglary, but they claimed that they face an increased risk of identity theft and/or identity fraud. In each case Advocate moved to dismiss under section 2–619.1 of the Code of Civil Procedure (Code) (735 ILCS 5/2–619.1 (West 2014) ) and the trial court dismissed plaintiffs' complaint, with prejudice, pursuant to: (1) section 2–619(a)(9)

of the Code, finding that the disclosure of confidential information did not constitute an injury-in-fact sufficient to confer standing to pursue an action against Advocate; and, alternatively, (2) section 2–615 of the Code, finding that the complaint failed to state a claim upon which relief could be granted. Plaintiffs appeal. We affirm.

¶ 2 I. BACKGROUND

¶ 3 Advocate is a network of affiliated doctors and hospitals that treat patients throughout the state. On July 15, 2013, burglars stole from Advocate's administrative building in Park Ridge four password-protected computers that contained certain information relating to about 4 million patients. Advocate subsequently notified the patients about the incident, set up a call center to answer their questions, and offered them one year of free credit-monitoring services, including identity theft resolution assistance and identity theft insurance.

¶ 4 On September 25, 2013, several plaintiffs sued Advocate in the circuit court of Lake County (appeal No. 2–14–0998). On October 24, 2013, several plaintiffs sued Advocate in the circuit court of Kane County (appeal No. 2–14–0782). Both actions were brought as putative class actions.

¶ 5 The complaints asserted substantially similar allegations. Plaintiffs, who were patients or former patients of Advocate, alleged that the personal information contained in the four stolen computers, which have not been located, included their names, addresses, dates of birth, social security numbers, health insurance data, Medicare and Medicaid data, medical diagnoses, diagnosis codes, and medical record numbers. Advocate learned of the burglary on July 15, 2013, and notified plaintiffs on August 23, 2013. Plaintiffs alleged that the theft was caused by Advocate's failure to meet its obligation to abide by the best practices and industry standards concerning the security of personal information and the computers associated therewith. They also alleged that Advocate failed to timely notify them of the data breach and that Advocate's computers were not secure or encrypted. Thus, they further alleged, Advocate facilitated and allowed for the unlawful disclosure of patients' private and confidential health information. (Plaintiffs did not allege that anyone had improperly accessed or used the information that was on the stolen computers or that they have suffered identity theft and/or identity fraud as a result of the burglary.)

¶ 6 Specifically, in their negligence counts, plaintiffs alleged that Advocate had a duty, pursuant to federal and state law, including the Protection Act and the Fraud Act, to securely maintain and to not disclose or disseminate, without patient authorization, the personal information at issue. They alleged that Advocate breached this duty when it used unsecured, unencrypted computers to store such information and thus permitted the unlawful and unauthorized disclosure of the information. Plaintiffs asserted that, as a result of Advocate's breach, they suffered personal and pecuniary damages.

¶ 7 In their Protection Act counts, plaintiffs alleged that Advocate was a “data collector” (815 ILCS 530/5 (West 2014) (defined as an “entity that, for any purpose, handles, collects, disseminates, or otherwise deals with nonpublic personal information”)) and did not timely notify them of the breach (815 ILCS 530/10(a) (West 2014) (notice to be given “in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system”)). Plaintiffs sought an injunction to require Advocate to comply with the statute.

¶ 8 In their counts pursuant to the Fraud Act, plaintiffs alleged that Advocate committed unfair trade practices by failing to maintain reasonable procedures to protect against unauthorized access to plaintiffs' personal information, that Advocate violated public policy because class members had no choice but to submit their information, that Advocate intended that members rely on its unfair practices, and that the practices were willful, wanton, continuing, and widespread. Also, plaintiffs noted that a Protection Act violation constituted an unlawful practice under the Fraud Act. 815 ILCS 530/20 (West 2014).

¶ 9 In their counts alleging invasion of privacy, plaintiffs asserted that Advocate's impermissible and unauthorized disclosure and dissemination constituted an unauthorized intrusion into plaintiffs' privacy and seclusion, which was highly offensive to them and would be so to a reasonable person. Plaintiffs also alleged that Advocate's intrusion was an invasion of private matters, causing them anguish and suffering. Additionally, the Lake County plaintiffs included a count asserting intentional infliction of emotional distress. All plaintiffs sought class certification, damages, attorney fees, costs, statutory interest, penalties, and injunctive and/or declaratory relief.

¶ 10 Advocate moved to dismiss plaintiffs' complaints, arguing that: (1) plaintiffs lacked standing because they did not suffer the requisite injury-in-fact (735 ILCS 5/2–619(a)(9) (West 2014)), where their claimed injury—merely that the information was stolen—was insufficient and any claim that plaintiffs face an increased risk of identity theft and identity fraud was speculative; and (2) each count failed to state a claim upon which relief could be granted (735 ILCS 5/2–615 (West 2014) ).

¶ 11 On May 27, 2014, the Lake County circuit court dismissed, with prejudice, plaintiffs' complaint. The court found that allegations of possible future injury were insufficient to confer standing. Plaintiffs did not allege facts that “would plausibly establish an ‘imminent’ or ‘certainly impending’ risk that they will be victimized.” The court further noted that “the harm that Plaintiffs fear is contingent on a chain of attenuated hypothetical events and actions by third parties independent of the defendant,” noting that these included: whether their data was actually taken after the burglary, whether it was subsequently sold or otherwise transferred, whether anyone attempted to use it, and whether they succeeded. The increased risk that plaintiffs will be identity theft victims at some indeterminate point in the future, the court determined, did not constitute an injury sufficient to confer standing, where the occurrence of such future injury rested on the criminal actions of independent decision-makers and where the complaint lacked sufficient factual allegations that such future injury was imminent or certainly impending.

¶ 12 Addressing the Protection Act and the Fraud Act claims, and even assuming that Advocate violated the statutes by inadequately notifying plaintiffs, the court found that the violations, without any actual damages due to the data breach, were insufficient to establish standing. The time and expenses that plaintiffs incurred to mitigate the risk of identity theft were also insufficient to confer standing, because they involved a response to a speculative threat. Next, addressing plaintiffs' allegations concerning anxiety and emotional distress, the court found that these, too, were insufficient to establish standing, as they were not based on an imminent threat; rather, they alleged only speculative future criminal acts. Also, the court found that plaintiffs' loss-of-privacy allegations were insufficient to establish standing, where they did not plead that the information was disclosed.

¶ 13 Next, the trial court...