PAUL v. PROVIDENCE HEALTH SYSTEM-Or.

• Decision Date: 06 October 2010
• Docket Number: A137930.,060101059
• Citation: 237 Or.App. 584,240 P.3d 1110
• Parties: Laurie PAUL, Plaintiff, and Russell Gibson and William Weiller, DDS, individually and on behalf of all similarly-situated individuals, Plaintiffs-Appellants, v. PROVIDENCE HEALTH SYSTEM-OREGON, an Oregon corporation, Defendant-Respondent.
• Court: Oregon Court of Appeals

237 Or.App. 584

240 P.3d 1110

Laurie PAUL, Plaintiff, and Russell Gibson and William Weiller, DDS, individually and on behalf of all similarly-situated individuals, Plaintiffs-Appellants, v. PROVIDENCE HEALTH SYSTEM-OREGON, an Oregon corporation, Defendant-Respondent.

060101059; A137930.

Court of Appeals of Oregon.

Argued and Submitted April 02, 2009.

Decided Oct. 6, 2010.

COPYRIGHT MATERIAL OMITTED.

David F. Sugerman, Portland, argued the cause for appellants. With him on the briefs were Paul & Sugerman, PC, Brian S. Campf, and Brian S. Campf, P.C.

John F. McGrory, Jr., Portland, argued the cause for respondent. With him on the brief were Gregory A. Chaimov and Davis Wright Tremaine LLP.

Before HASELTON, Presiding Judge, and ARMSTRONG, Judge, and ROSENBLUM, Judge.

ARMSTRONG, J.

Plaintiffs brought this class action after unencrypted records containing personal, medical, and financial information of an estimated 365,000 patients were stolen from the car of one of defendant's employees. Plaintiffs alleged that defendant had negligently failed to safeguard those records and that defendant had violated the Unlawful Trade Practices Act (UTPA) by representing that it would keep patient information confidential when it knew that it had not taken sufficient steps to ensure that. Plaintiffs sought injunctive relief and damages for past and future costs of credit-monitoring services to protect against identity theft and for emotional distress. The trial court granted defendant's ORCP 21 A(8) motions to dismiss plaintiffs' complaint for failure to state a claim, concluding that the relief sought was barred by Lowe v. Philip Morris USA, Inc., 207 Or.App. 532, 142 P.3d 1079 (2006) ( Lowe I ), aff'd, 344 Or. 403, 183 P.3d 181 (2008) ( Lowe II ). The court also granted defendant's motion under ORCP 32 I to strike the class allegations from the complaint. Plaintiffs appeal, assigning error to both rulings. On appeal, we affirm the trial court's dismissal of plaintiffs' claims and, accordingly, do not reach plaintiffs' contention that the court erred in striking the class allegations.

I. BACKGROUND

When reviewing an order granting a motion to dismiss for failure to state a claim, we accept as true all well-pleaded facts in the complaint and give the party opposing the motion the benefit of all reasonable inferences that can be drawn from those facts. Caba v. Barker, 341 Or. 534, 536, 145 P.3d 174 (2006). Accordingly, we take the facts from plaintiffs' third amended complaint.

The facts alleged in this case are few: An employee of defendant, a medical care provider, took computer disks and tapes home and left them in his car overnight, and they were stolen. The disks and tapes contained unencrypted patient records for approximately 365,000 individuals; the records included names, addresses, phone numbers, Social Security numbers, and patient care information. Approximately three-and-one-half weeks after the theft, defendant sent letters to each person whose information was contained on thestolen disks and tapes, alerting them to the loss of data and advising them to take precautions to protect themselves. Plaintiffs subsequently filed this action as a class action on behalf of all people whose information was contained on the disks and tapes.

As a result of the theft, plaintiffs and class members allege that they have been exposed to “loss of privacy, to past and future out-of-pocket losses associated with monitoring credit reports and placing and maintaining fraud alerts, to credit injuries inherent in credit monitoring and placing and maintaining fraud alerts, and to repair costs of credit damage caused by the theft of data.” Their complaint pleaded two claims for relief: negligence and violation of the UTPA.

In their claim for negligence, plaintiffs sought relief under theories of negligence per se and common-law negligence. The former was predicated on defendant's alleged failure to comply with federal and state law providing for the protection of medical information, specifically ORS 192.518 et seq. and 45 C.F.R. Parts 160 and 164. With regard to the latter claim, plaintiffs alleged that defendant was negligent “in failing to safeguard the data, in failing to encrypt it, in allowing its agent or employee to store such data in his or her car, and in failing to put in place policies that would protect such data from theft and disclosure.” The injury alleged with respect to both theories was the same

“financial injury in the form of past and future costs to monitor credit reports, recurringfuture costs to notify and re-notify credit bureaus of fraud alerts, costs of notification to the Social Security Administration, the Immigration and Naturalization Agency, the Internal Revenue Service, State and Local law enforcement agencies and possible future costs of repair of identity theft.”

In their second claim for relief, plaintiffs alleged that defendant had violated the UTPA ¹ by (1) “representing that all information gathered to sell its services or goods would be safeguarded and kept confidential when it knew that itlacked adequate means to safeguard such information” and (2) “representing that the business of sale of services and goods would include privacy and confidentiality when it knew that the transactions were not confidential due to its inadequate data protection program.”

With respect to both their negligence and UTPA claims, plaintiffs sought (1) injunctive relief, requiring defendant to “pay for ongoing monitoring of credit reports, notify Social Security of the data loss, fund recurring credit bureau fraud alerts and pay for the future cost of possible loss and damage due to identity theft”; (2) economic damages for “past out-of-pocket expenses for credit monitoring services, credit injury, postage, long distance and time loss from employment to address these issues”; and (3) noneconomic damages for “impairment of access to credit inherent in placing and maintaining fraud alerts, as well as worry and emotional distress associated with the initial disclosure and the risk of any subsequent identity theft.” Plaintiffs did not allege that they or class members have been victims of fraud or identity theft as a result of the stolen disks and tapes or that the information stolen has otherwise been compromised.

Defendant moved under ORCP 21 A(8) to dismiss both of plaintiffs' claims on the basis that each failed to “state ultimate facts sufficient to state a claim”; it also moved to strike plaintiffs' class allegations pursuant to ORCP 32 I and 32 E(4). The trial court granted defendant's motions and subsequently entered a judgment dismissing plaintiffs' complaint with prejudice. As noted, plaintiffs challenge both rulings on appeal; however, our disposition with respect to the former-that the trial court was correct in dismissing plaintiffs' claims under ORCP 21 A(8)-obviates the need to address the latter.

II. ANALYSIS

A. Plaintiffs' Negligence Claim

Citing our opinion in Lowe I, the trial court concluded that plaintiffs had failed to state a claim for negligence because “the damages prayed for [are] not compensable under Oregon law.” ² Thus, the issue on appeal reduces towhether plaintiffs' complaint alleged an injury cognizable under Oregon negligence law. Zehr v. Haugen, 318 Or. 647, 656, 871 P.2d 1006 (1994) (harm to the plaintiff measurable in damages is a necessary element of negligence). As a result, although plaintiffs pleaded theories of common-law negligence and negligence per se, the distinction between the two has limited bearing on our analysis. See Fazzolari v. Portland School Dist. No. 1J, 303 Or. 1, 17, 734 P.2d 1326 (1987) (in common-law negligence actions, “the issue of liability for harm actually resulting from defendant's conduct properly depends on whether that conduct unreasonably created a foreseeable risk to a protected interest of the kind of harm that befell the plaintiff”); Abraham v. T. Henry Construction, Inc., 230 Or.App. 564, 573, 217 P.3d 212 (2009), rev. allowed, 348 Or. 523, 236 P.3d 151 (2010) (“Negligence per se * * * is not a distinct cause of action; it is a negligence claim based on violation of a standard of care set out by statute or rule.”).

To recover in negligence, a plaintiff must suffer harm “to an interest of a kind that the law protects against negligent invasion.” Solberg v. Johnson, 306 Or. 484, 490, 760 P.2d 867 (1988). In Lowe II, the Supreme Court considered that principle in the context of a long-time cigarette smoker who brought an action for negligence against cigarette manufacturers. The complaint did not allege that the plaintiff had suffered any present physical harm; rather, it alleged that, as a result of the defendants' negligent manufacture and sale of cigarettes, the plaintiff (and all similarly situated Oregonians) suffered a “ ‘significantly increased risk of developing lung cancer.’ ” 344 Or. at 408, 183 P.3d 181. That risk, the plaintiff alleged, created a need for periodic medical monitoring and smoking-cessation treatment, including public education. She sought injunctive relief ordering the defendants to provide that monitoring and treatment. The trial court dismissed the complaint on the basis that, because the plaintiff had not alleged a present physical injury, the complaint failed to state a claim for negligence. Id. at 407, 183 P.3d 181.

On appeal, the Supreme Court considered two questions: (1) whether a significantly increased risk of future physical injury is, by itself, a sufficient harm to state a claim in negligence; and (2) whether the economic cost ofundergoing periodic medical screening constitutes a sufficient harm for that purpose. Id. at 419, 183 P.3d 181.

The court readily resolved the first question in the negative, based on its earlier precedents, particularly Zehr, 318 Or. at 656, 871 P.2d 1006, in which the court had held that “the threat of future harm, by itself, is insufficient as an...