STEVEN J. McAULIFFE, District Judge.
Wentworth-Douglass Hospital ("WDH" or "the hospital") brought suit against several physicians and a professional association, under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (Counts I-III) and under New Hampshire statutory and common law (Counts IV-V). The hospital says it declined to renew defendants' contract to provide pathology services, whereupon defendants misappropriated and erased important computer data belonging to the hospital. Defendants, in turn, assert counterclaims against the hospital for invasion of privacy (false light), defamation, misappropriation of trade secrets, and conversion. Defendant Moore says, among other things, that the hospital portrayed her in a false light by publically, and falsely, stating that the College of American Pathologists placed the hospital's pathology laboratory on probation because she, as Laboratory Director, failed to provide proper oversight. Three defendants claim the hospital defamed them when, in a public statement, its spokeswoman characterized electronic data in the possession of Drs. Moore and Littell (later returned to the hospital) as having been "stolen" from the hospital.
Before the court are the parties' motions for summary judgment, document nos. 79, 81, and 84.
When ruling on a motion for summary judgment, the court must "view the entire record in the light most hospitable to the party opposing summary judgment, indulging all reasonable inferences in that party's favor."
Most of the relevant facts in this case are set out in this court's prior orders (document nos. 33 and 54), and need not be recounted in detail here. Additional or specific facts relevant to the disposition of the parties' motions for summary judgment are discussed as appropriate.
The hospital moves for summary judgment on Counts I through IV of its amended complaint, and on defendants' third and fourth counterclaims, primarily on grounds that the hospital's IM-09 policy both governed defendants' conduct and established or confirmed the hospital's ownership rights in certain documents and data. Defendants cross-move for summary judgment on all the hospital's claims (Counts I through V), asserting primarily that, regardless of any factual dispute over the applicability of the IM-09 policy, federal privacy laws required them to remove or delete data from the lab computers.
The hospital also moves for summary judgment on defendants' counterclaims for invasion of privacy and defamation (first and second counterclaims). It seeks a judicial determination that Drs. Moore and Littell are limited-purpose public figures who cannot establish that the hospital acted with malice.
In Count I, the hospital alleges defendants violated § 1030(a)(2)(c) of the Computer Fraud and Abuse Act ("CFAA"), 18 U.S.C. § 1030(a)(2)(c), when they attached a removable storage device to the pathology lab's computers and copied, downloaded, and deleted data. Section 1030(a)(2)(c) provides a private right of action to any person who suffers damage or loss when another "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer."
The hospital thinks it undisputed that the restrictions described in its IM-09 policy governed the defendants' access to, and use of, hospital computers, and that defendants' conduct plainly exceeded those limitations. But defendants counter, in part, that a material factual dispute exists as to whether the IM-09 policy applied to them.
Defendants' point is well taken. Even assuming, as the hospital contends, that defendants were typically governed by IM-09, a factual question remains as to whether the hospital's Senior Vice President of Operations, Daniel Dunn, waived or modified the policy or otherwise agreed to different restrictions during the closing-out of the Young & Novis pathology lab (i.e., during the "Transition"). The relevant evidence consists of the parties' recollections of face-to-face meetings between defendants and Dunn; Dunn's follow-up letters; and contradictory deposition testimony as to what the parties, at the time, understood Dunn to have authorized.
Accordingly, the hospital's motion for summary judgment with respect to Count I is denied.
Under the hospital's theory of the case, Counts II, III, and IV, like Count I, are premised on alleged conduct by the defendants that violated the hospital's IM-09 policy — a policy that establishes computer access and use rules, and defines property rights in data and computerized databases. In Count II, brought under Section 1030(a)(5)(A) of CFAA, the hospital alleges that defendants damaged its computers and networks when they "violated IM-09" (document no. 81-1, at 16) by installing DriveScrubber 3 software and/or issuing commands that deleted information from the C Drives of three pathology lab computers as well as the H, K, and P Drives of the hospital's computer network.
As discussed, a factual dispute exists with respect to whether the IM-09 policy applied to defendants as written, or whether, during the Transition, Dunn authorized them to exercise control over certain data or documents without assistance from the hospital or its IT department. It cannot be said, as a matter of law, then, (1) that damage caused by defendants, if any, to the hospital's computers was intentional or without authorization (Count II); (2) that defendants conspired to commit the wrongful acts alleged in Counts I and II (Count III); or (3) that defendants intentionally exercised dominion or control over hospital property, as described in the IM-09 policy. Summary judgment on Counts II-IV is also precluded by the existence of a material factual dispute regarding whether Dr. Littell deleted hospital data from the network drives.
For these reasons, the hospital is not entitled to summary judgment on Counts II, III, and IV.
Defendants move for summary judgment on Counts I, II, III, and IV, on two broad grounds. They first contend that documents removed from the computers "belonged to them" under both the common law and their agreement with the hospital. That may be so, but relevant material facts are genuinely disputed — specifically, whether the IM-09 policy or some modified version of it applied to defendants during the Transition.
Defendants argue, in the alternative, that, regardless of any factual dispute as to private agreements or policies governing their behavior, "they were obliged to maintain" the documents under state law and federal privacy law. Document No. 84-1, at 2. Whether state corporation laws required defendants to remove documents depends on resolution of material factual issues, such as the character of documents actually deleted or removed. Similarly, whether federal HIPAA regulations, 45 C.F.R. § 164.310, required defendants to download and delete particular computer files turns, in part, on whether the IM-09 policy applied to them. As the hospital argues, the IM-09 policy, if applicable, may have served to satisfy the regulation's requirements by vesting responsibility for the "final disposition of electronic protected health information" or "media re-use," 45 C.F.R. § 164.310 (d)(1),(2), in its own Security Officer, Jeff Pollack (and not in individual users such as Drs. Moore and Littell). Because applicability of the IM-09 policy to defendants during the Transition period is genuinely disputed, it cannot be said, as a matter of federal privacy law, that defendants were legally obligated to delete data.
For these reasons, defendants are not entitled to summary judgment in their favor on Counts I, II, III, and IV.
The hospital alleges in Count V that defendants committed unfair and deceptive trade practices, in violation of N.H. Rev. Stat. Ann. ("RSA") ch. 358-A, by "scrubbing and removing patient data" in order to "thwart the efforts of [the hospital] to provide pathology services to [hospital] patients." Document No. 94-1, at 39. Defendants say they are entitled to summary judgment on Count V because the actions allegedly taken by them, even if assumed to be true, do not meet the "rascality" test of
New Hampshire's Consumer Protection Act makes it "unlawful for any person to use any unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within this state." RSA 358-A:2. The Act describes several specific business practices falling within its scope,
The CPA is applicable to transactions "involving ultimate consumers," and may be applied to business-to-business transactions.
In the "rough and tumble" business world in which the hospital operates, disputes over electronic data ownership, possession, copying, and deletion that arise during the break-up of long-term contractual relationships among professional service providers are probably to be expected, and ordinarily will not rise to a level sufficient to support a claim under the Act. That numerous other statutory and common law remedies are readily available to aggrieved parties in such circumstances also tends to confirm the ordinary nature of these disputes.
The record, as developed, bears that out. Even accepting the hospital's weak, inferential evidence that defendants deleted data for improper purposes, the nature of the conduct
Accordingly, because defendants' conduct, as alleged, does not rise to the level of rascality necessary to support a cause of action under New Hampshire's Consumer Protection Act, defendants' motion for summary judgment on the hospital's Consumer Protection Act claim, Count V, is granted.
In their Third Counterclaim, defendants allege that the hospital violated New Hampshire's Uniform Trade Secrets Act ("NHUTSA"), RSA 350:B, by misappropriating Young & Novis' trade secrets contained in the so-called "Gross Boilerplate" document. The hospital moves for summary judgment.
New Hampshire's trade secret law defines a "trade secret" as:
RSA 350-B:1.
In its motion, the hospital argues that the Gross Boilerplate document does not meet the last part of the statutory definition of "trade secret."
While disputes about the efforts undertaken by defendants are only minor ones, still, whether those efforts were "reasonable" must be resolved by the jury, since "what is reasonable is itself a fact for purposes of Rule 56 of the civil rules."
The hospital also argues that it is entitled to summary judgment on defendants' trade secrets claim because the evidence does not establish that it
In its final argument, the hospital contends that there is no evidence that defendants suffered any damage as a result of the alleged misappropriation. But, defendants also assert an implicit claim for equitable relief under RSA 350-B:2, barring the hospital's continued use or disclosure of the Gross Boilerplates document (arising from their prayer for the "return" of their property and for "further relief as may be just and equitable") which entitles them to proceed to trial. The hospital is free, of course, to challenge the sufficiency of the damages evidence at appropriate junctures during trial.
Accordingly, the hospitals's motion for summary judgment on the Third Counterclaim is denied.
The hospital moves for summary judgment on defendants' Fourth Counterclaim for common law conversion. It contends that the IM-09 policy determined the property rights of the parties. As noted, there is a material factual dispute about the applicability of the IM-09 policy before and during the Transition. The motion is, therefore, denied.
To prevail on her false light claim, Dr. Moore must show that the hospital placed her in a "highly offensive" false light, and that it "had knowledge of or acted in reckless disregard as to the falsity of the publicized matter and the false light in which [Moore] would be placed." 2/4/11 Order, document no. 54, at 15. The hospital argues that, even if the jury were to find that its February 2010 statements implied that deficiencies in Dr. Moore's oversight of the lab led to the CAP probation, such an implication would not be false. Moreover, says the hospital, even if such an implication were false, Dr. Moore is a limited-purpose public figure who must, but has failed to, show by clear and convincing proof that the hospital acted with actual malice.
In its earlier ruling,
In addition, defendants have adduced sufficient evidence to create a material factual dispute as to whether the hospital contributed to CAP's concern that laboratory oversight was deficient. For example, a jury could find that, by responding separately to the CAP complaint, the hospital acted as a separate authority over the lab's operations, thereby undermining Dr. Moore's oversight, and at the same time confirming its interference. Although Dr. Moore testified that it was "reasonable for [WDH] to want to participate in the response," document no. 79-9, she avers in her affidavit that it is "highly irregular" for hospital administrators and their attorneys to respond to CAP inquiries, "as it would normally be the responsibility of the Laboratory's Medical Director." C. Moore Aff., document no. 97-5, par. 21. She also states that Dunn "undertook responsibilities within my authority as the Medical Director of the Laboratory" when he wrote to CAP, requesting that all CAP inquiries be directed to him.
For these reasons, on this record, a reasonable jury could find that the statement implying that CAP's probation decision was based on deficiencies in oversight by Dr. Moore was a false statement.
Liability for false light invasion of privacy may turn on whether the injured party is a public or private figure.
There are two types of public figures: those who are public figures for all purposes and those who are limited-purpose public figures.
Here, the hospital says that Dr. Moore thrust herself to the forefront of the CAP controversy, and, by doing so, voluntarily assumed the risk of injury from public statements that might place her in a false light with respect to that controversy.
As an initial matter, the hospital identifies the relevant public concern or controversy as the patient privacy breach and its purported retaliation against defendants (including non-renewal of the lab contract) for their criticism of the hospital's handling of that breach. There is no question that this "breach-retaliation" controversy was of significant public concern. Moreover, it is not seriously disputed that the CAP complaint was a significant part of that broader controversy. The CAP complaint alleged problems with the pathology lab relating to the patient privacy breach, including "inappropriate access to patient's health information" and "unauthorized and inappropriate modification of patient data files." Document No. 79-16. The real point of contention is not the status of those controversies as "public concerns," but whether Dr. Moore placed herself at the forefront of the CAP controversy prior to the hospital's February statements about CAP's probation decision and Dr. Moore's "deficiencies."
It appears to be undisputed that Dr. Moore's husband, and not Dr. Moore, filed the CAP complaint. In addition, Dr. Moore says that at the time CAP contacted her in mid-November of 2009 about its investigation, she was "unaware of the source of the complaint." C. Moore. Aff., Document No. 97-5, par. 17. Nevertheless, the hospital contends that Dr. Moore publically and voluntarily placed herself at the forefront of the CAP controversy by using the fact of the CAP complaint to bolster her position in her public communications about the breach-retaliation dispute. The hospital relies primarily on Dr. Moore's concession that she and Littell told
Dr. Moore's status as a limited public figure with respect to the CAP complaint remains an open question. A factual dispute exists with respect to the nature and extent of Dr. Moore's participation in the public dispute about the CAP complaint. After her initial meeting with reporters in November — but before the hospital's February 2010 statements about her "deficiencies" — Dr. Moore acted in ways that a jury may find amounted to continued participation in the growing public debate about the CAP controversy. For instance, after November, Dr. Moore continued to grant media interviews about the breach-retaliation dispute. She was interviewed for articles that appeared on December 4, December 23, and January 27. Dr. Moore's (arguably) extensive engagement with the press during that time coincided with publication of numerous articles and editorials that continued to link the CAP complaint with Dr. Moore's breach-retaliation dispute with the hospital. Resolution of competing inferences about the extent to which Dr. Moore induced or encouraged growing media attention to the CAP controversy is likely for the jury to decide. Accordingly, the court cannot conclude on this record, and as a matter of law, that Dr. Moore was a limited public figure for purposes of the CAP complaint and related controversy.
Even assuming, however, that Dr. Moore was a limited-purpose public figure, who must establish actual malice by clear and convincing proof, there is sufficient evidence from which a jury could make such a finding. Viewed in a light most favorable to Dr. Moore, the evidence suggests that the hospital published its statements about Dr. Moore without having made basic inquiries (including of CAP)
For these reasons, plaintiffs' motion for summary judgment as to the First Counterclaim is denied.
In their second counterclaim, defendants allege that the hospital defamed them when its spokesperson, Noreen Biehl, told a
Defendants respond that they were not public figures because the controversy over the missing data was and remains a private contractual dispute and does not rise to the level of public concern. As noted earlier, however, defendants themselves publically linked the parties' troubled business relationship with the patient privacy breach, and there appears to be no clear division between the events giving rise to the data dispute and the hospital's alleged retaliation.
Defendants did thrust themselves to the forefront of the breach-retaliation dispute. As noted, Dr. Moore spoke with reporters on several occasions regarding that controversy. Dr. Littell's voluntary communications with the media were even more extensive. From November of 2009 through mid-February of 2010, Dr. Littell engaged in 41 e-mail exchanges with a
For these reasons, Dr. Moore and Dr. Littell were limited public figures for purposes of the breach-retaliation dispute, a dispute which included the events on the last day of the Transition relating to data copying and deletion.
The hospital, however, is not entitled to summary judgment on the defamation claim. First, a jury could reasonably find by clear and convincing evidence that the hospital acted with actual malice when its spokesperson (purportedly) told a Foster's reporter that defendants had "stolen" hospital data. Viewing the facts of record, and indulging all reasonable inferences, in defendants' favor, a rational jury could find that the hospital had a vested interest in, and pursued a public relations campaign to, discredit defendants publically. Moreover, the high degree of hostility between the parties, beginning as early as mid-2009, is undisputed. While summary disposition may sometimes be appropriate on the issue of actual malice,
Second, a material factual dispute exists as to whether, in the reporter's words, Biehl "described [the data] as being stolen from the hospital." Document No. 79-2. Biehl has denied that she did. But, the evidence also shows that Biehl did not, in this instance, follow her usual practice of asking the newspaper to correct the alleged misstatement. Defendants have produced a minimally sufficient record to support their allegation that Biehl made the statement, and they are entitled to have a jury determine Biehl's credibility.
Accordingly, defendants are not entitled to summary judgment on defendants' defamation claim.
For the reasons given, defendants' motion for summary judgment (document no. 84) is granted in part (as to Count V), and denied in part (as to all other counts). Plaintiff's motions for summary judgment (document nos. 79 and 81) are denied.
Importantly, both parties ask this court to accept the ruling in
The hospital has marshaled considerable circumstantial evidence tending to contradict Dr. Littell's averment. But whether Dr. Littell's contradictory testimony is worthy of belief is a matter for the jury.
