Stephani W. Humrickhouse, United States Bankruptcy Judge.
The matter before the court is the motion to dismiss this adversary proceeding pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure, made applicable to this adversary proceeding by Federal Rule of Bankruptcy Procedure 7012, filed by defendant WakeMed f/k/a Wake County Hospital System, Inc. ("WakeMed"), AP Dkt. 9.
Wayne Edward Branch filed a voluntary petition for relief under chapter 7 of the Bankruptcy Code on April 25, 2014. WakeMed filed a proof of claim in the case in the amount of $4,910.00 on August 10, 2015. Claim No. 3-1. The proof of claim included an attachment that listed Mr. Branch's medical record number and patient numbers,
Meanwhile, on December 4, 2015, a miscellaneous proceeding was commenced in which WakeMed filed an Ex Parte Global Motion to Establish a Procedure to Restrict Public Access to Certain Claims Pursuant to 11 U.S.C. § 107(c) and Federal Rule of Bankruptcy Procedure 9037.
On January 15, 2016, WakeMed filed a status report, Misc. Pro. Dkt. 19, indicating that it had moved to restrict access to 2,819 claims in closed cases, 788 claims filed before September 1, 2013 in open cases, and 602 claims filed after September 1, 2013 in open cases. According to the status report, on December 31, 2015, debtors whose protected health information may have been disclosed were sent notices required by the Healthcare Insurance Portability and Accountability Act ("HIPAA"), offering one year of third-party credit monitoring at no charge. Misc. Pro. Dkt. 19 at 3.
On January 7, 2016, a motion for contempt and sanctions was filed on behalf of Mr. Branch. Branch Dkt. 146 (the "Sanctions Motion"). In the Sanctions Motion, Mr. Branch contended that by filing a proof of claim containing personal information that should have been redacted, WakeMed violated Rule 9037 of the Federal Rules of Bankruptcy Procedure, HIPAA, and possibly other obligations to the debtor. After hearing four days of testimony and argument on Mr. Branch's motion and similar motions filed by two other debtors, Mr. Branch's Sanctions Motion was denied in an order dated August 31, 2016, BR Dkt. 174 (the "Sanctions Order"). There, the court found that "the claim filed in Mr. Branch's case did not disclose any information that clearly must be redacted under Rule 9037," and thus "WakeMed has not knowingly violated any provision of the Bankruptcy Code and Rules with respect to Mr. Branch." BR Dkt. 174 at 20. The court specifically declined to consider whether WakeMed violated HIPAA or other non-bankruptcy laws. Id. at 17 ("This court is not a HIPAA compliance tribunal, and will limit its inquiry to whether the Bankruptcy Code or Rules have been violated and, if so, what remedy is available for those violations under the bankruptcy laws.").
On September 15, 2016, Mr. Branch filed the complaint in this adversary proceeding, seeking
AP Dkt. 1 at ¶ 1. Specifically, Mr. Branch contends that the attachment to the proof of claim included Mr. Branch's patient account number, medical record number, and admission and discharge dates, and that the inclusion of this information on a publicly-available document violated WakeMed's duty to protect certain health information under HIPAA and was grossly
WakeMed seeks dismissal on two grounds: first, that Mr. Branch lacks standing to pursue the action because he has suffered no actual injury; and second, that Mr. Branch has failed to state a claim for negligence because WakeMed has breached no duty to Mr. Branch. AP Dkt. 9, 10. WakeMed also raised a concern with respect to the court's jurisdiction under Stern v. Marshall, 564 U.S. 462, 131 S.Ct. 2594, 180 L.Ed.2d 475 (2011), see AP Dkt. 17; however, because the district court retains de novo appellate jurisdiction over any legal conclusions this court might reach in its ruling on a motion to dismiss, any Stern concerns are alleviated.
WakeMed first contends that this court lacks subject-matter jurisdiction over this adversary proceeding because Mr. Branch lacks standing to pursue the claim. Specifically, WakeMed contends that the injury that Mr. Branch asserts — that he "has been, and continues to be, exposed to an increased likelihood that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose" — is insufficient to establish an "injury in fact" as required to confer standing upon him. WakeMed maintains that the risk of actual damages is speculative, that Mr. Branch cannot seek recovery for his alleged mitigation costs, and that he cannot recover attorney fees for either the prior action or the present one. Mr. Branch, on the other hand, disagrees that he has not been injured and that he cannot recover all of the damages he seeks, but contends that at a minimum he suffered damages in the nature of fees and costs incurred to restrict access to the proof of claim filed by WakeMed.
To have standing to bring a claim in federal court, a "plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins, ___ U.S. ___, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992)). An injury in fact requires both a "concrete" and "particularized" harm, which must be "actual or imminent,
The following allegations of the Complaint set forth Mr. Branch's asserted injury:
AP Dkt. 1. The prayer for relief requests an order for, among other things, the following:
AP Dkt. 1 at 19.
In his Response and Memorandum of Law in Opposition to Motion to Dismiss ("Response"), Mr. Branch clarifies the damages he seeks in an effort to establish that they are actual and concrete: his information was in a proof of claim that was available to the public for at least 141 days, and
AP Dkt. 23 at 2-3 (emphasis in original). (Of course, the statement that the information would still be on the public record but for Mr. Branch's motion to restrict access is an exaggeration, as WakeMed was taking steps to restrict access to all of its filed claims beginning in December 2015,
WakeMed asserts that Mr. Branch's allegations do not establish actual injury for purposes of standing for three reasons:
AP Dkts. 9, 10.
Just last month, and after the hearing on this matter, the United States Court of Appeals for the Fourth Circuit considered whether "the harm from the increased risk of future identity theft and the cost of measures to protect against it" was sufficient to establish Article III standing where two data breaches at a Veterans Affairs medical center compromised the plaintiffs' personal information. Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017). In Beck, two putative class actions were filed related to two separate data breaches: one involved a stolen laptop containing unencrypted personal information, while the other involved misplaced or stolen long-term storage boxes of pathology reports containing patients' identifying information. In both cases, the plaintiffs sought declaratory relief and monetary damages under the Privacy Act of 1974, 5 U.S.C. § 552a et seq., the Administrative Procedures Act, and damages for common-law negligence. Specifically, the plaintiffs alleged that
848 F.3d at 267.
In the first case, the defendants moved to dismiss the complaint for lack of subject-matter jurisdiction or, in the alternative, for failure to state a claim. The district court dismissed the common-law negligence claim, but did not dismiss the remaining claims. On summary judgment, however, the defendants renewed their motion to dismiss for lack of subject-matter jurisdiction, which was allowed for lack of standing because the plaintiffs' fear of harm from future identity theft was "`contingent on a chain of attenuated hypothetical events and actions by third parties independent of the defendants.'" Id. at 268. In the second case, the district court dismissed the complaint for lack of subject-matter jurisdiction because the plaintiff "`ha[d] not alleged that there ha[d] been any actual or attempted misuse of her personal information,' thus rendering her allegation that her information `will eventually be misused as a result of the disappearance of the boxes ... speculative.'" Id. at 269.
Reviewing the matters de novo, the Fourth Circuit affirmed the dismissals. After first considering the tenets established with respect to "threatened injury" in Clapper v. Amnesty International USA, 568 U.S. 398, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013), the Beck court determined that the theft of the laptop and boxes containing the personal information, without any allegation that the plaintiffs' personal information had been accessed or misused or that the plaintiffs had suffered identity theft, was insufficient to confer standing for purposes of Article III:
848 F.3d at 275. The court also rejected the plaintiffs' contention that because the defendants offered free credit monitoring to the plaintiffs, the defendants conceded that the theft constituted a reasonable risk of harm to the plaintiffs. Id.
The Beck court then turned to whether the plaintiffs suffered an injury in fact because they incurred "the cost of measures to guard against identity theft, including the costs of credit monitoring services." Id. at 276. Because the harm the plaintiffs sought to mitigate was speculative, the court found that mitigation costs were also insufficient to confer standing:
848 F.3d at 276-77.
This court also noted the speculative nature of potential identity theft as an appropriate basis for damages in its Sanctions Order.
BR Dkt. 174 at 24.
In his brief and at the hearing on this matter, Mr. Branch attempted to distinguish Clapper and other cases relied upon by WakeMed with respect to whether Mr. Branch asserted an injury in fact. However, the Beck court's subsequent reliance on Clapper on facts analogous to these, as well as its specific conclusions related to the speculative risk of identity theft and mitigation costs and its distinction of those cases in which allegations "sufficed to push the threatened injury of future identity theft beyond the speculative to the sufficiently imminent," Beck, 848 F.3d at 274,
Mr. Branch's Complaint does not allege that anyone actually accessed the proof of claim filed in his case before it was restricted from public view, nor that the information contained on the proof of claim has been used in any way. In addition, the Complaint does not contain any facts that explain what risk Mr. Branch faces as a result of the disclosure of the particular types of data contained on the proof of claim filed by WakeMed in his case. The proof of claim did not contain Mr. Branch's
Based on the reasoning set forth by the Fourth Circuit in Beck, the court finds that the injury asserted by Mr. Branch of "increased likelihood of that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose," including the damages "associated with protecting and safeguarding his private, non-public, personal, and protected information," and the "costs associated with future credit monitoring, ... and protecting his personal, private and protected information," is too speculative to support standing under Article III.
WakeMed contends that Mr. Branch's alleged mitigation costs, which include attorneys' fees and costs related to the Motion to Restrict Access and the Sanctions Motion, are also insufficient to confer standing on Mr. Branch for three reasons: (a) the court has already determined that Mr. Branch is not entitled to attorneys' fees incurred in pursuing the Sanctions Motion, and Mr. Branch is barred by issue preclusion from re-litigating the issue; (b) North Carolina law does not allow plaintiffs to recover past litigation fees and costs as damages; and (c) mitigation costs for speculative future risks cannot create standing. The court will consider each of these arguments in turn.
WakeMed contends that this court has already determined that Mr. Branch is not entitled to recover his attorneys' fees and costs incurred in connection with the Sanctions Motion, and thus he is barred by collateral estoppel from seeking recovery of those fees (or asserting them as an element of his damages) in this adversary proceeding. At first blush, that argument is compelling. The court heard evidence for days, including evidence about whether HIPAA allowed the disclosure of certain information in connection with collection on an account.
However, collateral estoppel requires four elements to be met to limit relitigation of an issue:
Combs v. Richardson, 838 F.2d 112, 115 (4th Cir. 1988)(citations omitted). In the Sanctions Order, the court limited its review to "whether the Bankruptcy Code or Rules have been violated and, if so, what remedy is available for those violations under the bankruptcy laws." BR Dkt. 174 at 17. Finding that there was no violation of the Bankruptcy Code or Rules, the court found no basis to award attorneys'
Mr. Branch contends that he is entitled to recover his fees and expenses incurred in connection with the Motion to Restrict Access and the Sanctions Motion because he would not have incurred those costs but for WakeMed's negligence, and that they are necessary to "make him whole." WakeMed contends that North Carolina law does not support recovery of those fees and costs, and thus they cannot be considered an "injury in fact." In support of this argument, WakeMed relies on Robinson v. Hope, 216 N.C. App. 573, 719 S.E.2d 66 (2011), which held that attorneys' fees from a prior action cannot serve as damages in a later action unless there is independent statutory authority for an award of those fees. There, the court rejected the same argument advanced by Mr. Branch: but for the defendant's actions, the fees would not have been incurred, and the award would make the plaintiff whole. 216 N.C. App. at 578, 719 S.E.2d at 69. Indeed, the Robinson court acknowledged that it had, in the past, allowed fees and costs associated with litigation to remedy an attorneys' malpractice in Gram v. Davis, 128 N.C. App. 484, 495 S.E.2d 384 (1998), but specifically declined to extend the Gram holding beyond attorney malpractice actions. Robinson, 216 N.C. App. at 578, 719 S.E.2d at 69.
Mr. Branch failed to address why Robinson is distinguishable or inapplicable, and given the North Carolina Court of Appeals' explicit reiteration of North Carolina's longstanding rule disallowing attorney's fees in civil cases absent a statute or contractual agreement, the court finds no relevant distinction or basis upon which to depart from its holding. Accordingly, the court finds that recovery of past fees and costs cannot support standing in this case.
WakeMed contends that none of the expenses, costs, and fees sought are recoverable because they were mitigation costs related to a speculative future risk. As noted above, the Beck court specifically addressed whether mitigation costs related to the risk of identity theft were sufficient to confer standing, and held that they are not. 848 F.3d at 276. Because the harm the plaintiffs sought to mitigate was not imminent, the court found that mitigation costs were "self-imposed" and insufficient to confer standing. Id. The same is true here. The fees and costs for which Mr. Branch seeks to recover are those he asserts were necessary to "protect[ ] and safeguard[ ] his private, non-public, personal, and protected information" from "an increased likelihood that his information will be manipulated, transferred, stolen, or otherwise
For the reasons outlined above and as dictated by the holding in Beck, the court finds that Mr. Branch's asserted mitigation costs — the cost of identity theft protection, and the costs and attorneys' fees associated with the Motion to Restrict Access and the Sanctions Motion — were incurred with respect to a speculative future risk of (unspecified) harm from the disclosure of information that there is no allegation was ever discovered by a third party, and thus cannot support an injury in fact.
WakeMed also contends that the attorneys' fees incurred in this action do not constitute actual damages, because there is no basis upon which to shift fees and because standing requires prior harm. Mr. Branch's response brief does not directly address this argument, but the Complaint does seem to ask for "all the actual and compensatory damages suffered as a result of the course of conduct of Defendant... and prosecution of this action against Defendant, which includes, but is not limited to, those reasonable attorneys' fees and costs incurred by Plaintiff...." AP Dkt. 1 at 19, ¶ 1 (emphasis added). The court is unaware of any basis for awarding fees to the plaintiff in a negligence action, and Mr. Branch has provided no authority for the same. See also Eakes v. Eakes, 194 N.C. App. 303, 312, 669 S.E.2d 891, 897 (2008) ("It is settled law in North Carolina that ordinarily attorneys fees are not recoverable as an item of damages or of costs, absent express statutory authority for fixing and awarding them.") (citations and internal quotation marks omitted).
Further, WakeMed cites to persuasive authority that fees for this action cannot create an injury for purposes of standing. See Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 107, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998) (plaintiff "cannot achieve standing to litigate a substantive issue by bringing suit for the cost of bringing suit."); see also Davis v. Eagle Legacy Credit Union (In re Davis), 430 B.R. 902, 907 (Bankr. D. Colo 2010) (rejecting claim for attorneys' fees for filing adversary proceeding to recover damages for filing a proof of claim containing personal information). Absent any authority that would support recovery of Mr. Branch's fees for this action, the court agrees that the costs and expenses of this litigation do not constitute an injury in fact sufficient to confer standing.
Rule 8(a)(2) of the Federal Rules of Civil Procedure provides that "[a] pleading that states a claim for relief must contain ... a short and plain statement of the claim showing that the pleader is entitled to relief." If a complaint fails to meet this threshold obligation, the action should be dismissed under Rule 12(b)(6) for "failure to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). For purposes of Rule 12(b)(6), all allegations of fact contained in a complaint must be accepted as true. E.I. du Pont de Nemours & Co. v. Kolon Indus., Inc., 637 F.3d 435, 440 (4th Cir. 2011).
In Bell Atlantic Corp. v. Twombly, the Supreme Court of the United States held that a complaint must include "enough facts to state a claim to relief that is plausible on its face." 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). The Court elaborated in Ashcroft v. Iqbal
A claim has facial plausibility when the plaintiff pleads enough "factual content to allow the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Clatterbuck v. City of Charlottesville, 708 F.3d 549, 554 (4th Cir. 2013). "The plausibility standard is not akin to a `probability requirement,' but it asks for more than a sheer possibility that a defendant has acted unlawfully." Iqbal, 129 S.Ct. at 1949. Thus, dismissal under Rule 12(b)(6) is proper when, from the face of the complaint, it is clear that the plaintiff's claims are not supported by law, that one or more facts necessary to assert a valid claim have not been pled, or that facts exist that necessarily defeat the plaintiff's claims.
To state a claim for negligence under North Carolina law, a plaintiff must allege facts to support the following elements: (1) legal duty; (2) breach of that duty; (3) actual and proximate causation; and (4) injury. Mabrey v. Smith, 144 N.C. App. 119, 122, 548 S.E.2d 183, 186, disc. rev. denied, 354 N.C. 219, 554 S.E.2d 340 (2001). Here, Mr. Branch's Complaint generally alleges that WakeMed breached its duty to him as derived from three sources: HIPAA, Rule 9037 of the Federal Rules of Bankruptcy Procedure, and the WakeMed Joint Notice of Privacy Practices. AP Dkt. 1 at ¶ 67. He alleges that he has suffered "significant financial harm" as a result of WakeMed's negligence, AP Dkt. 1 at ¶ 70, presumably tied back to the expenses, costs, and fees related to protecting and safeguarding his private information as outlined above.
WakeMed challenges the proffered bases for its duty to Mr. Branch, as well as the allegations that it breached any duty, as a matter of law. In other words, even taking the allegations of the Complaint as true (as the court must, in considering a motion to dismiss pursuant to Rule 12(b)(6)), Mr. Branch is not entitled to recover as a matter of law.
Two of the proffered bases for breach of duty may be disposed of with relative ease. First, this court has already determined that WakeMed did not violate Rule 9037 of the Federal Rules of Bankruptcy Procedure in Mr. Branch's case. Specifically, the court found as follows:
BR Dkt. 174 at 17-18. Further,
BR Dkt. 174 at 20.
Accordingly, the court finds as a matter of law that WakeMed did not violate any duty that might be established by Rule 9037 with respect to Mr. Branch, and that a violation of Rule 9037 cannot form the basis of his negligence claim.
Mr. Branch also asserts that the Joint Notice of Privacy Practices published on WakeMed's website obligated WakeMed to protect health information, AP Dkt. 1. at ¶ 40, that the Privacy Practices established a duty to Mr. Branch to protect that information, id. at ¶ 59, and that the disclosure of Mr. Branch's information on the proof of claim breached that duty. As noted by WakeMed, however, there are no factual allegations that would establish that this document creates any obligations on the part of WakeMed, nor can a breach of contract typically give rise to a negligence action. Kaleel Builders, Inc. v. Ashby, 161 N.C. App. 34, 43, 587 S.E.2d 470, 476 (2003). The court agrees, and, further, Mr. Branch offered no argument with respect to WakeMed's challenge to his reliance on the Privacy Practices and arguably has waived the same.
Mr. Branch's primary basis for contending WakeMed had and breached a duty to him is the limitation on disclosure of private information contained in HIPAA. WakeMed maintains that it did not violate HIPAA as a matter of law, because an entity covered by HIPAA may disclose personal health information for "treatment, payment, or health care operations." 45 C.F.R. § 164.506(a); 45 C.F.R. § 164.502(a)(ii). "Payment" includes "collection activities." 45 C.F.R. § 164.501. In making a permissible disclosure, the entity must "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." 45 C.F.R. § 164.502(b).
WakeMed disclosed the following on the proof of claim filed in Mr. Branch's bankruptcy case: his name, medical record number, patient account numbers, and dates of admission and discharge. Mr. Branch maintains that this is not the minimum
Instead, the court finds as a matter of law that the information disclosed was reasonably limited. This is in keeping with other courts, who have found the disclosure of significantly more private information — including the actual medical services received — not to support a claim against a medical provider. See OhioHealth Corp. v. Ryan, No. 10AP-937, 2012 WL 68733, at *1 (Ohio Ct. App. Jan 10, 2012) (dismissing counterclaim for damages where exhibit attached to complaint to collect unpaid medical bills disclosed private information).
Accordingly, the court finds that the facts alleged by Mr. Branch do not support the essential elements of a claim for negligence — duty and breach of duty — as a matter of law, and the motion to dismiss pursuant to Rule 12(b)(6) will be allowed on that basis.
A plaintiff is also required to set forth sufficient factual allegations in his complaint to establish that he suffered damages as a proximate result of the defendant's conduct. Here, there is no specific allegation that anyone obtained the information while it was publicly available or used that information in any way to harm Mr. Branch, nor is there any allegation of what nefarious use one could make of the information that was disclosed. Instead, there are only conclusory allegations that Mr. Branch is subjected to "an increased likelihood that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose." The court does not have to accept conclusions contained in the complaint as true.
With respect to damages, Mr. Branch alleges that he has suffered "significant financial harm," but the only factual allegations to support any financial impact on Mr. Branch are the attorneys' fees he alleges that he incurred in conjunction with the Motion to Restrict Access and the Sanctions Motion. The court has some concerns about Mr. Branch's apparent effort to recover
Mr. Branch also seems to allege that he has been damaged in the amount of the fees and costs in bringing this action; however, a discussed above, the court is not aware of any theory under which Mr. Branch would be entitled to recover fees against a defendant in a negligence action.
Accordingly, the court finds that Mr. Branch has failed to plead with the required specificity any facts that establish the essential element of damages, and the motion to dismiss pursuant to Rule 12(b)(6) will be allowed on that basis.
Based on the foregoing, WakeMed's motion to dismiss the Complaint pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure, made applicable in this adversary proceeding by Rule 7012
