Polanco v. Omnicell, Inc.

• Decision Date: 26 December 2013
• Docket Number: Civ. No. 13–1417 (NLH/KMW).
• Citation: 988 F.Supp.2d 451
• Parties: Bobbi POLANCO, on behalf of herself and all others similarly situated, et al., Plaintiffs, v. OMNICELL, INC., et al., Defendants.
• Court: U.S. District Court — District of New Jersey

988 F.Supp.2d 451

Bobbi POLANCO, on behalf of herself and all others similarly situated, et al., Plaintiffs,

v.OMNICELL, INC., et al., Defendants.

Civ. No. 13–1417 (NLH/KMW).

United States District Court, D. New Jersey.

Dec. 26, 2013.

Mark L. Rhoades, Esquire, Haviland Hughes, Philadelphia, PA, Attorney for Plaintiff Bobbi Polanco.

Landon Young Jones, Esquire, Buchanan Ingersoll & Rooney PC, Philadelphia, PA, Attorney for Defendant Omnicell, Inc.

Theodore Joseph Kobus, III, Esquire, Deborah H. Renner, Esquire, Judith A. Selby, Esquire, Baker & Hostetler LLP, New York, NY, Attorney for Defendant Sentara Healthcare.

Robert D. Balin, Esquire, Davis Wright Tremaine LLP, New York, NY, Attorney for Defendants South Jersey Health System, Inc. and Inspira Health Network, Inc.

Stephen F. Payerle, Esquire, McElroy, Deutsch, Mulvaney & Carpenter, LLP, Newark, NJ, Attorneys for Defendant Board of Regents of the University of Michigan.

OPINION

HILLMAN, District Judge.

This matter comes before the Court by way of several motions [Doc. Nos. 28, 29, 30, 31] seeking to dismiss Plaintiff's First Amended Class Action Complaint (the “Amended Complaint”) [Doc. No. 12] pursuant to Federal Rules of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction and 12(b)(6) for failure to state a claim upon which relief can be granted made by Defendants Omnicell, Inc., Sentara Healthcare, South Jersey Health System, Inc., Inspira Health Network, Inc., and the Board of Regents of the University of Michigan.

Plaintiff opposes all of the pending motions to dismiss, and filed an omnibus response in opposition. The Court has considered the parties' submissions, and decides this matter pursuant to Federal Rule of Civil Procedure 78. For the reasons expressed below, Defendants' motions will be granted.

I. JURISDICTION

The Court exercises jurisdiction over this putative class action pursuant to 28 U.S.C. § 1332(d)(2)(A),¹ the Class Action Fairness Act (“CAFA”) because the aggregate amount in controversy exceeds $5 million and minimal diversity exists between Plaintiff, a citizen of New Jersey, and Defendants, citizens of Delaware, California, New Jersey, Virginia, and Michigan.

II. BACKGROUND

Plaintiff Bobbi Polanco brings this putative class action on behalf of herself and all others similarly situated asserting claims for: (1) breaches of state security notification laws; (2) violations of consumer fraud laws in New Jersey, Virginia, and Michigan; (3) fraud; (4) negligence; and (5) conspiracy.² (Am. Compl. ¶¶ 78–116.) Plaintiff's Amended Complaint names several Defendants. Defendant Omnicell, Inc. (“Omnicell”) is a corporation that “sells automatic and analytics solutions designed to enable healthcare facilities to acquire, manage, dispense and administer medications and medical-surgical supplies.” (Am. Compl. ¶ 15.) According to the Amended Complaint, Omnicell's “systems provide medication control and dispensing starting from the point of entry into the hospital and other health care providers, through the central pharmacy, to the nursing station and to the patient's bedside.” ( Id.) Plaintiff asserts that Omnicell's medication-use products are in more than 2,500 healthcare facilities across the country. ( Id. ¶ 16.)

The remaining Defendants are hospitals or healthcare providers for which Omnicell provides automated medication dispensing services. By virtue of the nature of the services it provides to hospitals and healthcare providers, Omnicell is entrusted with patient information. The specifichospitals or healthcare providers named as Defendants in this suit are as follows. Defendant Sentara Healthcare (“Sentara”) is a Virginia corporation that owns and operates approximately twelve (12) hospitals throughout the state of Virginia. ( Id. ¶¶ 24–25.) Defendant the Board of Regents of the University of Michigan (“the Board of Regents”) is “the body corporate of the University of Michigan” which supervises, controls, and authorizes the actions of the departments of the University including the Department of Medicine. ( Id. ¶¶ 26–27.) The University of Michigan owns and operates a medical center known as the University of Michigan Health System ³ which provides medical care for “over 1.8 million outpatient and emergency visits, 44,000 hospital stays, 46,000 surgeries and 4,000 births” in a typical year. ( Id. ¶¶ 28–29.)

Defendant South Jersey Health System, Inc. (“SJHS”) is a non-profit corporation, which, prior to November 1, 2012, owned and operated two hospitals—SJHS's Regional Medical Center in Vineland, New Jersey, and SJHS's Elmer Hospital in Elmer, New Jersey. ( Id. ¶¶ 17, 19–20.) On November 1, 2012, SJHS merged with Underwood–Memorial Health Systems, Inc., resulting in the formation of a new company now known as Inspira Health Network, Inc. (“Inspira”). ( Id. ¶¶ 18–20.) After the merger, SJHS's Regional Medical Center in Vineland was renamed Inspira Medical Center Vineland, and SJHS's Elmer Hospital was renamed Inspira Medical Center Elmer.⁴ ( Id. ¶ 21.)

According to Plaintiff, her claims and the claims of the putative Class arise out of the November 14, 2012 theft of a laptop computer, owned by Omnicell, which was stolen out of the locked vehicle of an Omnicell employee. (Am. Compl. ¶¶ 2, 42–43.) Plaintiff alleges that the stolen laptop computer contained the unencrypted Personal Confidential Information (“PCI”) of Plaintiff, and thousands of other individuals, all of whom provided their information to Defendants Sentara, Inspira, and the University of Michigan during the course of seeking healthcare treatment for themselves and their loved ones at these medical institutions.⁵ ( Id. ¶¶ 2, 43, 45.) Plaintiff apparently learned of the data breach associated with the laptop in question by receipt of a letter from Omnicell dated December 31, 2012, attached as Exhibit A to the Amended Complaint. (Ex. A to Pl.'s Am. Compl. [Doc. No. 12–1], 1–2.) Plaintiff alleges that tens of thousands of patients were affected by Omnicell's data breach including 8,500 patients of SJHS, 4,000 patients of the University of Michigan Health System, and 56,000 patients from Sentara. ( Id. ¶ 48.)

Plaintiff asserts that the unencrypted PCI contained on the laptop in question included a patient's: name, date of birth, gender, allergies, patient number, medical record number, hospital room number, treatment site, physician's name, admission and/or discharge dates, and patient type (i.e., inpatient, emergency room, outpatient). ( Id. ¶ 45.) In addition to this general information, Plaintiff asserts that the unencrypted PCI also included the names of the medications used to treat the patient, as well as the dosage amount, the rate, the route (i.e., oral, infusion, etc.), the frequency, administration instructions, and start/stop times for the medication.⁶ ( Id.)

Plaintiff claims that her PCI came to be stored on the Omnicell laptop in question in connection with medical treatment Plaintiff sought for her minor daughter at two SJHS hospitals now owned and operated by Inspira. Specifically, Plaintiff alleges that on at least five occasions since 2011, she brought her daughter to the emergency room of either the SJHS Regional Medical Center or SJHS's Elmer Hospital for treatment of sudden on-set symptoms for upper respiratory infections, bronchitis, fevers, and throat-swelling episodes. ( Id. ¶¶ 35–37.) As part of her treatment, Plaintiff's daughter received antibiotics which were administered intravenously. ( Id. ¶ 39.) During her initial visit to a SJHS hospital, Plaintiff provided SJHS with her Social Security number, her insurance information, dates of birth for her and her daughter, and a summary of the medical condition giving rise to that visit. ( Id. ¶ 40.) On each subsequent visit, Plaintiff was asked to confirm the accuracy of the information she had previously provided and to provide a summary of the reason for her daughter's current visit. ( Id.)

The Amended Complaint does not explicitly allege that one of Omnicell's automation and analytics systems or products was utilized to administer antibiotics to Plaintiff's daughter during her treatments at these two SJHS hospitals. However, the December 31, 2012 letter from Omnicell to Plaintiff makes clear that Omnicell “provides automated medication dispensing services on behalf of various healthcare providers, including” SJHS (now Inspira) and that in doing so, “Omnicell is entrusted with patient information.” (Ex. A to Pl.'s Am. Compl. [Doc. No. 12–1], 1–2.)

By filing this action, Plaintiff now “seeks to remedy the harmful effects of the breach of ... privacy interests of Plaintiff and the Class, the failure to timely and reasonably notify [Plaintiff and the Class] of such breach ..., and the misleading and deceptive notification sent on December 31, 2012.” ( Id. ¶ 6.)

III. DISCUSSION

In general, Defendants now move to dismiss Plaintiff's complaint pursuant to Federal Rules of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction, 12(b)(2) for lack of personal jurisdiction, and 12(b)(6) for failure to state a claim upon which relief can be granted.

A. Standard for Dismissal Under Rule 12(b)(1)

A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) challenges the existence of a federal court's subject matter jurisdiction. “ ‘When subject matter jurisdiction is challenged under Rule 12(b)(1), the plaintiff must bear the burden of persuasion.’ ” Symczyk v. Genesis HealthCare Corp., 656 F.3d 189, 191 n. 4 (3d Cir.2011) (citing Kehr Packages, Inc. v. Fidelcor, Inc., 926 F.2d 1406, 1409 (3d Cir.1991)).

A motion to dismiss for lack of subject matter jurisdiction may either (1) “attack the complaint on its face” or (2) “attack the existence of subject matter jurisdiction in fact, quite apart from any pleadings.” Mortensen v. First Fed. Sav. & Loan Ass'n, 549 F.2d 884, 891 (3d Cir.1977). “The defendant may facially challenge subject matter jurisdiction by arguing that the...