Petta v. Christie Bus. Holding Co.

• Court: Appellate Court of Illinois
• Writing for the Court: JUSTICE MOORE delivered the judgment of the court, with opinion.
• Citation: Petta v. Christie Bus. Holding Co., 230 N.E.3d 162 (Ill. App. 2023)
• Docket Number: 5-22-0742
• Decision Date: 28 November 2023
• Parties: Rebecca PETTA, on Her Own Behalf and on Behalf of Those Similarly Situated, and Jane Doe, on Her Own Behalf and on Behalf of Those Similarly Situated, Plaintiffs-Appellants, v. CHRISTIE BUSINESS HOLDING COMPANY, P.C., d/b/a Christie Clinic, Defendant-Appellee.

230 N.E.3d 162

2023 IL App (5th) 220742

Rebecca PETTA, on Her Own Behalf and on Behalf of Those Similarly Situated, and Jane Doe, on Her Own Behalf and on Behalf of Those Similarly Situated, Plaintiffs-Appellants,

v.CHRISTIE BUSINESS HOLDING COMPANY, P.C., d/b/a Christie Clinic, Defendant-Appellee.

NO. 5-22-0742

Appellate Court of Illinois, Fifth District.

Filed November 28, 2023

Appeal from the Circuit Court of Champaign County. No. 22-LA-51, Honorable Jason M. Bohm, Judge, presiding.

David Cates, of Cates Law Firm, LLC, of Swansea, Brian C. Gudmundson (pro hac vice), David M. Cialkowski, Michael J. Laird, (pro hac vice), and Rachel K. Tack (pro hac vice), of Zimmerman Reed LLP, of Minneapolis, Minnesota, Christopher D. Jennings (pro hac vice), of Johnson Firm, of Little Rock, Arkansas, Samuel J. Strauss and Raina C. Borrelli, of Turke & Strauss LLP, of Madison, Wisconsin, Lynn Toops, Lisa M. La Fomara, and Arend J. Abel, of Cohen & Malad, LLP, of Indianapolis, Indiana, and J. Gerard Stranch IV, of Branstetter, Stranch & Jennings, PLLC, of Nashville Tennessee, for appellants.

Jonathan B. Amarilio, Jeffrey M. Schieber, and Jaimin H. Shah, of Taft Stettinius & Hollister LLP, of Chicago, for appellee.

OPINION

JUSTICE MOORE delivered the judgment of the court, with opinion.

¶ 1 In this matter, the plaintiffs, Rebecca Petta and Jane Doe, appeal the circuit court of Champaign County’s October 28, 2022, order, dismissing their complaints pursuant to sections 2-615 and 2-619, respectively, of the Code of Civil Procedure (Code) (735 ILCS 5/2-615, 2-619 (West 2022)). The circuit court dismissed Doe’s complaint for lack of standing and did not consider her substantive claims. The circuit court dismissed Petta’s negligence claims and claim for violation of the Personal Information Protection Act (815 ILCS 530/45(a) (West 2022)) for failure to state a claim. On appeal, the plaintiffs challenge the circuit court’s dismissals. For the following reasons, we affirm.

¶ 2 I. BACKGROUND

¶ 3 The defendant is a physician-owned medical group that provides medical services throughout Illinois. As a part of its medical services, the defendant gathers and stores patient identification information and health information. Sometime between July 14 and August 19, 2021, a cybercriminal compromised one of the defendant’s business e-mail accounts via a phishing attack. When the defendant discovered the Illicit monitoring of the business e-mail account, it "launched an internal investigation to determine the nature and scope of this incident, and contacted federal law enforcement and worked with them to mitigate the impact of the unauthorized access."

¶ 4 Following the investigation, the defendant "provided written notice to all affected individuals whose information "was identified in its review." It further notified the U.S. Department of Health and Human Services, the attorneys general in the affected states, and the Montana Office of Consumer Protection. According to a notification letter sent by the defendant, which was attached to the plaintiffs’ complaints, "there was unauthorized access to the affected email account from July 14, 2021 to August 19, 2021," and based upon the defendant’s forensic review of the illicit activity, patient names, addresses, Social Security numbers, medical information, and health insurance information may have been stolen. The extent of the access gained by the cybercriminal is somewhat disputed, with the defendant’s disclosure stating that the "unauthorized actor did not have access to the electronic medical record, MyChristie patient portal, or Christie Clinic’s network" but also indicating that "the extent of the access is unknown and cannot be determined." Additionally, the defendant offered free credit monitoring services for 12 to 24 months to potentially affected individuals.

¶ 5 Following the notification, Doe filed a lawsuit against the defendant alleging claims of negligence, breach of implied contract, unjust enrichment, violation of the Consumer Fraud and Deceptive Business Practices Act (Consumer Fraud Act) (815 ILCS 505/1 et seq. (West 2020)), breach of fiduciary duty, and invasion of privacy. She alleged that she spent time and effort to mitigate any risk duo to the breach but did not provide any. further specifics, Doe alleged only that the information was improperly accessed in the general sense and did not allege any specific acts of identity theft or identity fraud of her personal information.

¶ 6 Plaintiff Petta also filed a lawsuit against the defendant following the data breach. Petta brought claims for negligence, negligence per se based on the Federal Trade Commission Act (15 U.S.C. § 45 (2018)), negligence per se based on the Health Insurance Portability and Accountability Act of 1996 (45 C.F.R. § 160.102 (2013)), violation of the Personal Information Protection Act (815 ILCS 530/10 (West 2020)), and injunctive relief. Petta alleged damages of "ongoing and imminent threat of identity theft crimes; out-of-pocket expenses incurred to mitigate the increased risk of identity theft and/or fraud; credit, debit, and financial monitoring to prevent and/or mitigate theft, identity theft, and/or fraud incurred or likely to occur as a result of Defendant’s security failures; the value of her time and resources spent mitigating the identity theft and/or fraud; decreased credit scores and ratings; and irrevocable financial losses due to fraud."

¶ 7 Following the filing of both cases, the defendant moved to consolidate the matters, and the circuit court granted the defendant’s motion. Then the defendant filed a combined section 2-615 and 2-619 motion to dismiss both of the complaints wherein the defendant argued that, pursuant to section 2-619(a)(9) of the Code (735 ILCS 5/2-619(a)(9) (West 2022)), both Doe and Petta lacked standing to bring the lawsuit because neither of them suffered an actual injury and, additionally, pursuant to section 2-615, each of the claims brought by Doe and Petta are insufficient as a matter of law.

¶ 8 After completion of pleadings and argument on the matter, the circuit court granted the defendant’s motion and dismissed both complaints in a detailed 13-page order. The circuit court dismissed Doe’s complaint based upon a lack of standing because it found Doe’s allegations of wrongdoing and injury too speculative and the harm not to be imminent. The circuit court found Petta’s standing-related allegations "less speculative" and instead dismissed the complaint based upon a failure to state valid claims.

¶ 9 This appeal followed.

¶ 10 II. ANALYSIS

[1] ¶ 11 Both Doe and Petta challenge the dismissal of them complaints on appeal. Thus, there are essentially two overarching issues presently before this court. First is whether the plaintiffs have standing to bring their claims. Second is whether the claims as stated by the plaintiffs are sufficient as a matter of law. The circuit court found that Doe lacked standing and that Petta failed to state a legally sufficient claim. In evaluating motions to dismiss, the circuit court must "interpret all of the pleadings and supporting documents in the light most favorable to the nonmoving party," accepting as true "all well-pled allegations in the complaint and reasonable inferences to be drawn from the facts." Kopchar v. City of Chicago, 395 Ill. App. 3d 762, 772, 335 Ill.Dec. 555, 919 N.E.2d 76 (2009).

[2, 3] ¶ 12 The United States Supreme Court has held that a court may not decide a cause of action on the merits prior to determining whether the plaintiff has standing to bring the claim. Steel Co. v. Citizens for a Better Environment, 523 U.S. 83, 94-95, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998). This is because " ‘[w]ithout ju- risdiction the court cannot proceed at all in any cause. Jurisdiction is power to declare the law, and when it ceases to exist, the only function remaining to the court is that of announcing the fact and dismissing the cause.’ " Id. at 94, 118 S.Ct. 1003 (quoting Ex parte McCardle, 74 U.S. 506, 514, 7 Wall. 506, 19, L.Ed. 264 (1868)). Thus, we first look to the issue of standing to determine whether the circuit court was correct in dismissing Doe's claim for lack of standing and finding that Petta alleged sufficient facts for standing to be found.

[4–8] ¶ 13 We first examine the circuit court’s determination that Doe lacked standing to bring her claims. "Lack of standing is an ‘affirmative matter’ that is properly raised under section 2-619(a)(9)." Glisson v. City of Marion, 188 Ill. 2d 211, 220, 242 Ill.Dec. 79, 720 N.E.2d 1034 (1999). "An order granting this type of motion to dismiss is given de novo review on appeal." Id. Illinois courts have "set forth the general principle that standing requires some injury in fact to a legally cognizable interest in Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462, 492 [120 Ill.Dec. 531, 524 N.E.2d 561] (1988)." Id. at 221, 242 Ill.Dec. 79, 720 N.E.2d 1034. "The claimed injury may be actual or threatened, and it must be (1) distinct and palpable; (2) fairly traceable to the defendant’s actions; and (3) substantially likely to be prevented or redressed by the grant of the requested relief." Id. Any threatened injury must be "certainly impending" or must create a "substantial risk" of harm, as opposed to being merely "possible." Maglio v. Advocate Health, & Hospitals Corp., 2015 IL App (2d) 140782, ¶¶ 25, 26, 29, 396 Ill.Dec. 861, 40 N.E.3d 746. "This court has held that a party cannot gain standing merely through a self-proclaimed interest or concern about an issue, no matter how sincere." Glisson, 188 Ill. 2d at 231, 242 Ill.Dec. 79, 720 N.E.2d 1034.

¶ 14 When conducting our analysis of the standing issue, we find the case of Maglio, 2015 IL App (2d) 140782, 396 Ill. Dec. 861, 40 N.E.3d 746, to be instructive and factually similar. In Maglio, burglars broke into an administrative building of the defendant, a network of affiliated doctors and hospitals in...