Stasi v. Inmediata Health Grp. Corp.
Decision Date | 19 November 2020 |
Docket Number | Case No.: 19cv2353 JM (LL) |
Citation | 501 F.Supp.3d 898 |
Parties | Vicki STASI, Shane White, and Crystal Garcia, individually and on behalf of all others similarly situated, Plaintiffs, v. INMEDIATA HEALTH GROUP CORP., Defendant. |
Court | U.S. District Court — Southern District of California |
Andrew W. Ferich, Pro Hac Vice, Benjamin F. Johns, Pro Hac Vice, Chimicles Schwartz Kriner & Donaldson-Smith LLP, Haverford, PA, Cornelius Pellman Dukelow, Pro Hac Vice, Abington Cole + Ellery, Tulsa, OK, Tina Wolfson, Bradley K. King, Ahdoot & Wolfson, PC, Burbank, CA, for Plaintiffs.
Jon Peter Kardassakis, Lewis Brisbois Bisgaard & Smith LLP, Los Angeles, CA, for Defendant.
ORDER ON DEFENDANT'S MOTION TO DISMISS PLAINTIFFS’ FIRST AMENDED COMPLAINT
Defendant Inmediata Health Group Corp. ("Inmediata") moves under Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6) to dismiss the First Amended Complaint ("FAC") of Plaintiffs Vicki Stasi, Shane White, and Crystal Garcia. (Doc. No. 17-1.) The motion has been briefed and the court finds it suitable for submission without oral argument in accordance with Civil Local Rule 7.1(d)(1). For the below reasons, Inmediata's motion to dismiss under Rule 12(b)(1) is DENIED , and Inmediata's motion to dismiss under Rule 12(b)(6) is DENIED IN PART and GRANTED IN PART .
According to Plaintiffs’ FAC,1 Inmediata provides billing and health record software and service solutions to healthcare providers. (FAC ¶¶ 17, 19.) In January of 2019, Inmediata first learned it was experiencing a "large data breach" resulting in the "unauthorized acquisition, access, use, or disclosure of unsecured protected health information and personal information" of 1,565,338 individuals. (¶ 2.)2 Plaintiffs’ information was "posted on the Internet" and "searchable and findable by anyone with access to an internet search engine such as Google[.]" (¶ 7.) Plaintiffs’ information was "disclosed and released to the entire world – it was viewable online by anyone in the world, printable by anyone in the world, copiable by anyone in the world, and downloadable by anyone in the world." (¶ 8.) The breach did not involve data thieves or hackers. (¶ 9.) Rather, the exposure was "[d]ue to a webpage setting that permitted search engines to index webpages Inmediata uses for business operations[.]" (¶ 7.)
By letter dated April 22, 2019, Inmediata notified Plaintiffs of a "data security incident that may have resulted in the potential disclosure of [their] personal and medical information." (¶ 24; see also Doc. Nos. 16-3, 16-4, 16-5.) Inmediata also filed sample "notice of data security incident" letters with various state attorneys general that mirrored the language of the letters sent to Plaintiffs. (¶ 26.) There were two versions of the letter – one for persons whose social security numbers were part of the breach, and another version for persons whose social security numbers were not part of the breach. (¶ 26 n.1.) Plaintiffs received the version for persons whose social security numbers were not part of the breach. (Id. ) The letters stated that "[i]n January 2019, Inmediata became aware that some of its member patients’ electronic patient health information was publicly available online as a result of a webpage setting that permitted search engines to index pages that are part of an internal website [Inmediata] use[s] for .... business operations." (¶ 27.) The letters also stated that "information potentially impacted by this incident may have included your name, address, date of birth, gender, and medical claim information including dates of service, diagnosis codes, procedure codes and treating physician." (¶ 29.) Inmediata did not offer Plaintiffs fraud insurance or identity monitoring services. (¶ 34.)
On December 9, 2019, Plaintiffs filed a putative class action. On May 5, 2020, Plaintiffs’ initial Complaint was dismissed under Rule 12(b)(1). (Doc. No. 15.) On May 19, 2020, Plaintiffs filed their FAC, which included claims for: (1) negligence; (2) breach of contract; (3) unjust enrichment; (4) violation of the California Confidentiality of Medical Information Act; (5) violation of the California Consumer Privacy Act; (6) violation of the California Consumer Records Act; (7) violation of the Minnesota Health Records Act; and (8) invasion of privacy and violation of the California Constitution. (¶¶ 212-324.) Plaintiffs seek to certify a nationwide class consisting of "[a]ll persons .... whose [p]ersonal and [m]edical [i]nformation was compromised as a result of the [d]ata [b]reach announced by Inmediata on or around April 24, 2019." (¶ 199.) Plaintiffs alternatively seek to certify statewide classes for California, Minnesota, and Florida. (¶ 200.)
Rule 12(b)(1) allows a party to move for dismissal of an action based on lack of subject matter jurisdiction. "Dismissal for lack of subject matter jurisdiction is appropriate if the complaint, considered in its entirety, on its face fails to allege facts sufficient to establish subject matter jurisdiction." In re Dynamic Random Access Memory Antitrust Litig. , 546 F.3d 981, 984-85 (9th Cir. 2008) (citation omitted). The plaintiff bears the burden of establishing subject matter jurisdiction. United States v. Orr Water Ditch Co. , 600 F.3d 1152, 1157 (9th Cir. 2010). If the court finds it lacks subject matter jurisdiction at any time, it must dismiss the action. Fed. R. Civ. P. 12(h)(3). In a facial attack on the pleadings under Rule 12(b)(1), the court accepts the allegations in the complaint as true and draws all reasonable inferences in the plaintiff's favor. Wolfe v. Strankman , 392 F.3d 358, 362 (9th Cir. 2004).
To survive a motion to dismiss under Rule 12(b)(6), the complaint must contain sufficient facts to state a claim for relief that is plausible on its face. Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. at 678, 129 S.Ct. 1937. The allegations must be construed in the light most favorable to plaintiff. Schueneman v. Arena Pharm., Inc. , 840 F.3d 698, 704 (9th Cir. 2016). While a court must take all factual allegations in the complaint as true, it is "not bound to accept as true a legal conclusion couched as a factual allegation." Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). "Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Iqbal , 556 U.S. at 678, 129 S.Ct. 1937. In resolving the motion, the court does not weigh evidence, evaluate witness credibility, or consider the likelihood that a plaintiff will prevail at trial. Twombly , 550 U.S. at 556, 127 S.Ct. 1955 (). Although the court generally cannot consider facts outside the complaint in ruling on a Rule 12(b)(6) motion to dismiss, Arpin v. Santa Clara Valley Transp. Agency , 261 F.3d 912, 925 (9th Cir. 2001), it may consider documents that are referenced in the complaint, No. 84 Employer-Teamster Joint Council Pension Trust Fund v. Am. W. Holding Corp. , 320 F.3d 920, 925 n.2 (9th Cir. 2003).
"A suit brought by a plaintiff without Article III standing is not a and an Article III federal court therefore lacks subject matter jurisdiction over the suit." Cetacean Cmty. v. Bush , 386 F.3d 1169, 1174 (9th Cir. 2004) (citation omitted). Standing requires the plaintiff to have suffered an injury in fact that is fairly traceable to the challenged conduct of the defendant, and is likely to be redressed by a favorable judicial decision. Lujan v. Defenders of Wildlife , 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). An injury in fact is an invasion of a legally protected interest which is concrete and particularized, actual or imminent, and not conjectural or hypothetical. Id. at 560, 112 S.Ct. 2130.
The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing the elements of Article III jurisdiction. FW/PBS, Inc. v. Dallas , 493 U.S. 215, 231, 110 S.Ct. 596, 107 L.Ed.2d 603 (1990). At the motion to dismiss stage, standing is demonstrated through allegations of specific facts plausibly explaining that standing requirements are met. Barnum Timber Co. v. Envtl. Prot. Agency , 633 F.3d 894, 899 (9th Cir. 2011) ; see also Warth v. Seldin , 422 U.S. 490, 518, 95 S.Ct. 2197, 45 L.Ed.2d 343 (1975) (). However, "the court is to ‘accept as true all material allegations of the complaint, and .... construe the complaint in favor of the complaining party.’ " Levine v. Vilsack , 587 F.3d 986, 991 (9th Cir. 2009) (quoting Thomas v. Mundell , 572 F.3d 756, 760 (9th Cir. 2009) ). "[G]eneral factual allegations of injury resulting from the defendant's conduct may suffice," and the court "presume[s] that general allegations embrace those specific facts that are necessary to support the claim." Lujan , 504 U.S. at 561, 112 S.Ct. 2130 (quotation and alteration omitted). The question of standing is "distinct from the merits" of the plaintiff's claim. Maya v. Centex Corp. , 658 F.3d 1060, 1068 (9th Cir. 2011) ; see also Warth , 422 U.S. at 500, 95 S.Ct. 2197 ().
Intangible injuries based on violation of a statute can be...
To continue reading
Request your trial-
Finlay v. MyLife.com Inc.
...widely available online through a defendant's website. See, e.g. , Stasi v. Inmediata Health Grp. Corp. , No. 19cv2353 JM (LL), 501 F.Supp.3d 898, 905-06, 2020 U.S. Dist. LEXIS 217097, at *12 (S.D. Cal. Nov. 19, 2020) (holding that it was "reasonable to infer" that plaintiffs’ personal info......
-
Vigil v. Muir Med. Grp. Ipa, Inc.
...of the information was breached because of the health care provider's negligence.Vigil cites Stasi v. Inmediata Health Grp. Corp. (S.D.Cal. 2020) 501 F.Supp.3d 898 ( Stasi ) as support for her argument. There, the defendant posted confidential medical information on the internet, "making it......
-
In re Ambry Genetics Data Breach Litig.
...(See, e.g., id. ¶¶ 115, 122, 127, 134, 139, 146, 153, 159, 166, 183, 190, 198, 203, 210); see also Stasi v. Inmediata Health Grp. Corp. , 501 F.Supp.3d 898, 913 (S.D. Cal. 2020) ("[T]ime spent responding to a data breach is a non-economic injury, that when alleged to support a negligence cl......
-
In re Blackbaud, Inc., Customer Data Breach Litig.
... ... Protected Health Information (“PHI”) from its ... customers' ... Ohio 2012); McGuffie v. Mead Corp. , 733 F.Supp.2d ... 592, 594 (E.D. Pa. 2010) ... Stasi v. Inmediata Health Grp. Corp. , 501 F.Supp.3d ... ...