STEPHANI W. HUMRICKHOUSE, Bankruptcy Judge.
The matters before the court are the motions for contempt and sanctions filed by the debtors against WakeMed or WakeMed Physician Practices (collectively "WakeMed"), specifically, Branch, Case No. 14-02379-5-SWH Dkt.146 (WakeMed) filed on January 7, 2016, Bostick, Case No. 15-5318-5-SWH Dkt. 12 (WakeMed Physician Practices) filed on November 17, 2015, and Clark, Case No. 15-01265-5-SWH Dkt. 23 (WakeMed) filed on November 24, 2015. Hearings were conducted on the motions in Raleigh, North Carolina on February 4, February 11, February 25, and March 10, 2016. Affidavits of Attorneys' Fees were submitted in each of the cases after the March 10, 2016 hearing date. At issue is whether WakeMed should be sanctioned for including in its proofs of claim personal information of the debtors that should have been redacted pursuant to Federal Rule of Bankruptcy Procedure 9037. The parties attempted to resolve the motion after the conclusion of the hearing, but advised the court on or about June 3, 2016, that an impasse had been reached. Accordingly, this matter is ripe for decision.
Wayne Edward Branch filed a voluntary petition for relief under chapter 7 of the Bankruptcy Code on April 25, 2014. WakeMed filed a proof of claim in the case in the amount of $4,910.00 on August 10, 2015. Branch Claim No. 3-1. The proof of claim included an attachment that listed Mr. Branch's medical record number and patient numbers.
Carla Lynette Bostick filed a voluntary petition for relief under chapter 13 of the Bankruptcy Code on October 1, 2015. WakeMed filed a proof of claim in the case on October 2, 2015 in the amount of $2,171.48. Bostick Claim No. 1-1. The proof of claim included an attachment that listed Ms. Bostick's social security number (listed as "Guarantor No.") and patient account numbers. WakeMed Physician Practices also filed a proof of claim in the case on October 2, 2015 in the amount of $246.00. Bostick Claim No. 2-1. That claim included an attachment listing Ms. Bostick's date of birth and an "account ID" for each billed entry. On November 2, 2015, Ms. Bostick, through counsel, filed an Ex-Parte Motion to Seal Proof of Claim No. 2,
Janis Monroe Clark filed a voluntary petition for relief under chapter 13 of the Bankruptcy Code on March 6, 2015. WakeMed filed a proof of claim in the case on March 10, 2015 in the amount of $553.00. Clark Claim No. 1-1. The proof of claim included an attachment that disclosed Ms. Clark's date of birth, full social security number, patient number, and medical record number. On November 11, 2015, Ms. Clark through counsel filed an Ex-Parte Motion to Seal Proof of Claim No. 1, Clark Dkt. 20, which was allowed by order dated November 12, 2015, Clark Dkt. 21. On November 24, 2016, the instant motion for contempt and sanctions was filed on behalf of Ms. Clark. Clark Dkt. 23. WakeMed amended its claim on December 7, 2015, omitting the attachment. Clark Claim No. 1-2.
Including Ms. Clark's case, counsel for Ms. Clark indicates that from November 11, 2015 through November 17, 2015, his firm filed 158 motions to restrict access or motions to seal claims filed by WakeMed in cases filed in this district. On December 4, 2015, after receiving a copy of one of the motions for sanctions, a local television station, WRAL, published a news story discussing WakeMed's disclosure of personal information in bankruptcy filings. On the same day, a miscellaneous proceeding was commenced in which WakeMed filed an Ex Parte Global Motion to Establish a Procedure to Restrict Public Access to Certain Claims Pursuant to 11 U.S.C. § 107(c) and Federal Rule of Bankruptcy Procedure 9037.
On January 15, 2016, WakeMed filed a status report, Misc. Pro. Dkt. 19, indicating that it had moved to restrict access to 2,819 claims in closed cases, 788 claims filed before September 1, 2013 in open cases, and 602 claims filed after September 1, 2013 in open cases. In closed cases and for claims filed before September 1, 2013 in open cases, WakeMed sought to restrict access without regard to whether personal identifiers or protected health information was actually contained in the claims. Because any distributions had already occurred in the closed cases and because WakeMed did not believe there were any attachments in the claims filed before September 1, 2013 in open cases, WakeMed did not intend to re-file its claims in those cases. With respect to claims filed after September 1, 2013 in open cases, WakeMed sought to restrict access only if the claim actually contained information that might be protected under Rule 9037 or the Healthcare Insurance Portability and Accountability Act ("HIPAA"). WakeMed did intend to file redacted claims in those cases. According to the status report, debtors whose protected health information may have been disclosed were sent notices required by HIPAA, offering one year of third-party credit monitoring at no charge. The status report also reflected that WakeMed had taken similar steps with respect to claims filed in the United States Bankruptcy Courts for the Middle and Western Districts of North Carolina. In addition, the status report outlined steps taken by WakeMed to prevent further filings containing protected information, as well as notices and reports made or to be made to regulators on this issue. WakeMed's status report indicated that as of January 15, 2016, it had incurred filing fees of $107,550 for the motions to restrict public access, and $214,123.20 in fees and costs for its bankruptcy counsel. Additional motions to restrict access were filed after the date of the status report. Misc. Pro. Dkts. 22, 27.
The debtors in these cases, Mr. Branch, Ms. Bostick, and Ms. Clark, seek sanctions including actual damages, punitive damages, and attorneys' fees for WakeMed's failure to properly redact their personal information before filing the attachments to WakeMed's proofs of claim. The debtors contend that because the public has access to this information through the court's Public Access to Court Electronic Records ("PACER"), they are at risk of having their personal and medical information stolen.
The debtors did not specify in their motions under what statute or rule they seek relief. However, the contentions in the motions suggest that the debtors seek sanctions for violations of Federal Rule of Bankruptcy Procedure 9037, HIPAA, and, possibly, 11 U.S.C. § 107.
The E-Government Act of 2002, Pub. L. 107-347, 116 Stat. 2899, required courts to develop provisions for the public to have electronic access to court records, as well as to protect confidential and personal information. As a result, the Judicial Conference revised its policies in 2003 to require personal identifiers to be redacted from filings. Those policies went into effect on December 1, 2003. Prior to this time, full social security numbers were included on the petition, schedules and statements, and, often, on motions and orders entered in bankruptcy cases. The full names of dependents were listed in the schedules. The official forms were amended to comply with the Judicial Conference's policy as of December 1, 2003 (by, for example, asking for the last four digits of the debtor's social security number, rather than the full social security number, on the petition), but the Rule requiring filers to redact personal information was not effective until four years later.
The court's electronic records are available through PACER, a password protected system. In general, a user must register with PACER and log in to obtain access to the records. Additional access is available to the public through terminals at the court's clerk's office, where one can search court records without a PACER account during the court's business hours. The records are not, however, generally available to the public through, for example, an internet browser search.
Section 107(c) of the Bankruptcy Code was added effective October 17, 2005, and provides, in relevant part:
11 U.S.C. § 107(c) (2005). Accordingly, as of October 2005, a party could ask the court to restrict access to any document that contained personal identifiers.
Federal Rule of Bankruptcy Procedure 9037, effective December 1, 2007, requires parties to redact certain information in filings with the court. It provides, in relevant part:
Fed. R. Bankr. P. 9037 (2007).
On September 14, 2010, the Judicial Conference amended the policy on privacy and public access to electronic case files by restricting public access through PACER to all documents in bankruptcy cases that were filed before December 1, 2003, and had been closed for more than one year, with the following conditions:
This restriction was accomplished through a nationwide upgrade to the federal courts' electronic filing program, CM/ECF. Accordingly, all documents (regardless of when filed) in cases filed in this court before December 1, 2003 that were closed on or before September 14, 2009 have been restricted from public view since 2010, but are accessible to any party who filed a notice of appearance in the case or to anyone who physically goes to the clerk's office to review the file.
Meanwhile, this court's procedures for filing claims changed as well. Prior to February 2007, proofs of claim were submitted in paper form. Claims in chapter 7 and 11 cases were filed with the court, and, in cases filed as early as January 1, 1997, were scanned and docketed by the clerk into the electronic court file. Claims in chapter 12 and 13 cases were sent to the chapter 12 and 13 trustees, respectively, until February 3, 2007, when those claims were required to be filed with the court.
In addition, until the motions to restrict access were filed in this case in November 2015, the court's procedure for restricting public access was to provide the offending party with 30 days to redact the information before the court would actually restrict access. Prior to filing their 158 motions to restrict access, Ms. Clark's counsel contacted the court and suggested that the procedure was a poor one, as there would be notice on the record that this information was available for 30 days, giving anyone of questionable moral character an opportunity to mine the information from the court's website during that period. As a result of Ms. Clark's counsel's prompting, the court adjusted its procedure to restrict access upon receipt of the motion, while also entering an order directing the filer to redact the offending document.
The claims filed in these three cases, and most — if not all — of the claims addressed in the remaining 157 motions to restrict access, were filed on behalf of WakeMed by Valeria Soles. Ms. Soles was employed by WakeMed in its patient financial services and collection department for over 33 years, having retired on December 18, 2015. Over the years, Ms. Soles was one of several people who filed bankruptcy claims, but it became solely her responsibility in September 2012. Ms. Soles was familiar with both electronic filing and filing of claims in paper form with the trustees, as opposed to the court.
The proof of claim form, Official Form 10, as effective December 1, 2008, includes instructions on page 2 that provide, in relevant part:
See, e.g., Ex. 8 at 2 (emphasis added). Below the instructions are definitions, including the following:
Id.
The court's electronic filing system (CM/ECF) requires a series of steps to submit a claim. One of those steps is to check a box that indicates that a filer has read the redaction rules and has redacted the documents to be filed. Specifically, when one logs in to file in CM/ECF, the screen includes the following:
See, e.g., Ex. 8 at 3. A user may not move to the next step without checking the box.
Ms. Soles testified that she received limited to no training with respect to filing bankruptcy claims. One of her colleagues showed her how to file electronically, telling her to "check the box" and then how to enter the claim information. When Ms. Soles first began filing electronic claims, she did not include attachments to the claims. Accordingly, at that time, there was nothing to redact. However, around September 2013, Ms. Soles began receiving objections to WakeMed's claims for lack of supporting documentation. She sought assistance from within WakeMed for how to save and upload documents from the billing system, and began attaching documents to the proofs of claim that showed the account information. Although many of these documents included personal information such as social security numbers and dates of birth, Ms. Soles did not read the redaction rules or make any effort to learn what was to be redacted, nor did she redact the attachments prior to filing. Ms. Soles further testified that while she had annual training regarding the requirements of HIPAA, she had no training with respect to filing bankruptcy proofs of claim. The HIPAA training did not cover bankruptcy claims filing. Ms. Soles also had no supervision with respect to filing claims, and testified that no one else in her department knew how to file bankruptcy claims. There was no audit system in place, and Ms. Soles had no direct contact with the legal department of WakeMed. Ms. Soles also testified that while she kept some copies of the claims she filed, she did not keep all of them nor did she appear to have any guidelines for when she did or did not keep copies.
With respect to HIPAA requirements, Ms. Soles testified that she understood that there was an exception to its disclosure requirements related to payment collection. Specifically, she understood that she could disclose social security numbers and other information to "authorized persons." It was her belief that the trustee, the debtor's attorney, and the court would be "authorized persons," and that filing a proof of claim was a collection activity that fell within the HIPAA exception. Ms. Soles was not aware that electronically filed claims were more broadly available than those she had filed with the trustee in the past. Ms. Soles did not know what PACER is, and did not have PACER access. She accessed information regarding bankruptcy filings through the court's telephonic information system (VCIS) if she had questions about a bankruptcy notice she received.
All mail from the bankruptcy court or regarding bankruptcy claims went to Ms. Soles. Ms. Soles also received the electronic filing notices from the bankruptcy court. When the first of the 160 motions to restrict access came to her attention, she turned them over to her supervisor, Liz Watson, who instructed her not to include attachments with claims filed with the bankruptcy court until she received further instructions from the legal department. Thereafter, Ms. Soles prepared some redacted attachments, but did not file them. She did not receive any further instructions before her retirement in December 2015.
Meanwhile, WakeMed hired Susan James, its new Vice President/Chief Legal Officer, on October 19, 2015, just a few weeks before the first motion to restrict access was filed. Ms. James testified that she had no bankruptcy experience or training, and had not appeared in federal court for at least 19 years (prior to electronic filing). Ms. James testified that she first became aware that unredacted claims were filed when she received a copy of one of the motions for sanctions on December 1, 2015. One of the motions to restrict access was brought to her attention the next day, December 2, 2015. Ms. James could not explain why the motions were not brought to her attention sooner, speculating only that because she was new, people in the mailroom did not know who she was.
Ms. James testified that she was not familiar with the rules requiring redaction of personal information in proofs of claim until she received the motion for sanctions. When she first received the motion on December 1, 2015, only every other page was provided. She began piecing together the allegations, and because an article about Duke University Healthcare's filing unredacted claims was attached to the motion, she reached out to a colleague at Duke to ask for a recommendation for counsel. Ms. James retained bankruptcy counsel on December 2, 2015 to review the motions and begin taking remedial action. Ms. James testified that she became aware that WRAL was preparing a story on the issue on December 3, 2015. On December 4, 2015, WakeMed filed its motion to establish a procedure to restrict access to all of the claims. At the same time, WakeMed retained HIPAA counsel to investigate whether the unredacted claims violated HIPAA and what actions needed to be taken with respect to any HIPAA disclosures.
Ms. James testified that the motion for sanctions caused her to open an investigation. She further testified that the sanctions motion was the first notice she received of the issue, and that she would also have opened an investigation had she received a call to the compliance line or to herself, or had she seen one of the motions to restrict access before she saw the motion for sanctions.
Ms. James testified that WakeMed discontinued filing proofs of claim during the investigation. She further explained her four-step approach to an investigation of any compliance issue, including the approach taken here:
Ms. James testified that as of the hearing dates, WakeMed had been focused on determining the scope of the problem, restricting access to filed claims, redacting and filing amended claims, and creating new procedures for going forward. It had not yet started looking backwards to determine either the failures that contributed to the improper filings in the first place or the communications lapses that created the delay between the filing of the motions to restrict access and the issue being brought to the attention of Ms. James (or other corrective action being taken).
In the course of the investigation, Ms. James had spoken or emailed with Liz Watson and Dudley Harrington, both of whom work in the billing department, but she did not speak to Ms. Soles until January 2016. Ms. James testified that she relied upon WakeMed's counsel to determine the scope of the unredacted filings and to take the actions required with the bankruptcy court, and that she "authorized counsel to take all steps as quickly as humanly possible to comply" with the rules. She further testified that the scope of the investigation was limited to December 1, 2007 forward because that was the effective date of the rule requiring redaction, and that the September 1, 2013 date was used for some cases because that is the date Ms. Soles began including attachments to filed proofs of claim.
On December 31, 2015, WakeMed sent letters to 413 debtors whose social security number may have been disclosed, describing what happened, actions taken by WakeMed after discovery of the disclosure, a phone number for questions and how to obtain credit monitoring at no cost to the debtors. See, e.g., Ex. 6. Ms. James testified that these letters were required by HIPAA. Certain errors in the letter were illuminated on cross examination: for example, the letter indicated that only those registered to use PACER could access the information, but a person who goes to the clerk's office can access the information by logging onto the court's computer terminal. In addition, the letter indicated that a person would have to search a specific debtor's name, but a person could search "WakeMed" and find all of the claims filed by WakeMed. Ms. James testified that she was unaware of this potential access, but that she did not believe it was necessary to send a new letter.
As noted above, by January 15, 2016, WakeMed had moved in this district to restrict access to 2,819 claims in closed cases, 788 claims filed before September 1, 2013 in open cases, and 602 claims filed after September 1, 2013 in open cases, and had incurred filing fees of $107,550 for the motions to restrict public access and $214,123.20 in fees and costs for its bankruptcy counsel. At the same time, WakeMed took actions in the Middle and Western Districts to resolve issues with unredacted claims filed in those districts. In addition, Ms. James testified that WakeMed had taken other measures to prevent further violations in the future, as well as to resolve the issues with timely delivery of legal documents to her office, including:
Ms. James also testified that she has talked to many other professionals in her industry, none of whom were familiar with Rule 9037. She commented that training on the bankruptcy requirements should be implemented throughout the healthcare industry.
Ms. Clark's counsel, Travis Sasser, testified that he had reviewed the court's docket at the break during the hearing on February 25, 2016, and that several claims filed by WakeMed remained unrestricted on the docket containing unredacted social security numbers, dates of birth, and names of minors. See Ex. 11. WakeMed's counsel made a proffer, which was supported by Ms. James' testimony, that counsel had been instructed to continue with a quality check to make sure that every claim had been properly restricted and redacted, and that the check was ongoing.
In addition to the testimony of Ms. Soles, Ms. James, and Mr. Sasser, the court heard from one of the debtors in these cases. Ms. Clark testified that she was "very sensitive" about social security numbers and other private information being publicly available, and as a human resources professional she was "outraged" that WakeMed would file a document including her social security number. Ms. Clark's full social security number and date of birth were included in the claim filed by WakeMed, and although she did not actually know if a third party had obtained the information from the court's website, she "needed some protection." Ms. Clark testified that her debit card had been canceled more than one time because her accounts had been compromised, but she could not directly link the compromise of her accounts to the disclosures in the proof of claim. Ms. Clark was not interested in the credit monitoring offered by WakeMed in its December 31, 2015 letter, but instead wanted WakeMed to pay for her to obtain protection from LifeLock Identity Theft Protection at a cost of $300-400 per year for the rest of her life or until WakeMed could prove that her information was "really not on the internet anymore." Ms. Clark further testified that she had taken vacation days to appear in court, that she had incurred parking fees of $12 per day and attorney's fees to pursue the motion to restrict access and motion for sanctions, and that she suffered anxiety from the loss of privacy that had occurred from WakeMed's violation and the litigation surrounding the issue. Ms. Clark submitted a post-hearing declaration more specifically itemizing her requested damages, as discussed below.
As noted above, the debtors did not specify in their motions under what statute or rule they seek relief. However, the contentions in the motions suggest that the debtors seek sanctions for violations of Federal Rule of Bankruptcy Procedure 9037, HIPAA, and, possibly, 11 U.S.C. § 107. This court is not a HIPAA compliance tribunal, and the court questions whether it has jurisdiction to opine on or determine sanctions for violations of HIPAA. Accordingly, the court will limit its inquiry to whether the Bankruptcy Code or Rules have been violated and, if so, what remedy is available for those violations under the bankruptcy laws.
The case law overwhelmingly holds that there is no private right of action under HIPAA or § 107, and that the remedy under Rule 9037 is for the offending information to be restricted from public view. See Maple v. Colonial Orthopaedics, Inc. (In re Maple), 434 B.R. 363 (Bankr. E.D. Va. 2010); French v. Am. Gen. Fin. Servs. (In re French), 401 B.R. 295, 307 (Bankr. E.D. Tenn. 2009); Barnhart v. Union Bank, Inc. (In re Barnhart), No. 09-ap-00109, 2010 WL 724703, at *3-4 (Bankr. N.D. W. Va. Feb. 26, 2010); Carter v. Flagler Hospital, Inc. (In re Carter), 411 B.R. 730 (Bankr. M.D. Fla. 2009); Matthys v. Green Tree Servicing, LLC (In re Matthys), Adv. Pro. No. 09-16585-AJM-13, 2010 WL 2176086 (Bankr. S.D. Ind. May 26, 2010); Lenz v. Auto Acceptance (in re Lenz), 448 B.R. 832 (Bankr. D. Ore. 2011); Newton v. ACC of Enter. (In re Newton), A.P. No. 08-1106-DHW, 2009 WL 277437 (Bankr. M.D. Ala. Jan. 29, 2009).
However, many courts have held that § 105(a) gives the bankruptcy court the authority to sanction parties for contempt for violations of Rule 9037 under appropriate circumstances — specifically, "where it was shown that a creditor flaunted the law with knowledge of its proscriptions, failed to take remedial action once violations were discovered, or acted deliberately as opposed to mistakenly or inadvertently." Carter, 411 B.R. at 738 (quoting Newton, 2009 WL 277437, at *5); see also Ricker v. Athens Reg'l Med. Ctr. (In re Ricker), Adv. Pro. No. 12-1032, 2012 WL 2562760 (Bankr. E.D. Tenn. June 29, 2012); Maple, 434 B.R. at 374-75; Barnhart, 2010 WL 724703, at *3-4.
Rule 9037 requires redaction of "an individual's social-security number, taxpayer-identification number, or birth date, the name of an individual, other than the debtor, known to be and identified as a minor, [and] a financial-account number," specifying what portions of those identifiers may be included in a filing. Fed. R. Bankr. P. 9037(a). The remedy set forth in the Rule for a failure to comply is that the court may by order "limit or prohibit a nonparty's remote electronic access to a document filed with the court." Fed. R. Bankr. P. 9037(d). Even absent a remedy in Rule 9037, however, the court has inherent authority to sanction a party for contempt, and equitable powers to enforce a specific provision of the Bankruptcy Code under § 105(a). See In re Lunden, 524 B.R. 410, 417 (Bankr. D. Mass. 2010).
WakeMed submitted claims that included full social security numbers and dates of birth, which clearly is prohibited by Rule 9037. Those violations occurred in both Ms. Clark's case and Ms. Bostick's case, as well as in thousands of other cases. The evidence presented at the hearing, taken together with the motions to restrict access filed both by Ms. Clark's counsel and WakeMed itself in the Miscellaneous Proceeding, showed that WakeMed also filed claims after December 1, 2007 that included the full name of a minor (who should have been known by WakeMed to be a minor due to WakeMed's access to birthdates), which claims also violate Rule 9037 but were not filed in any of the three cases in which the motions for sanctions were filed.
Some of the debtors complained that WakeMed included their address on its claims. Rule 9037 does not prohibit the inclusion of the debtor's address; indeed, the debtor's address appears on the first page of the bankruptcy petition and is readily available to the public through numerous sources. Similarly, the inclusion of a telephone number does not violate Rule 9037.
A murkier questions is whether the "account IDs" or "patient numbers" included on the claims fail to comply with Rule 9037, which requires redaction of all but the last four digits of "a financial-account number." Rule 9037 does not define the term "financial-account number." The only case of which the court is aware that discusses what might be encompassed by this term is In re Brown, Case No. 11-30384, 2012 WL 2576473, at *4 (Bankr. W.D.N.C. July 3, 2012). There, the court considered whether customers' cable account numbers fell within the parameters of Rule 9037. Noting that nothing in the Rule limits its applicability to financial institutions, the court held that the account numbers were, indeed, "financial-account numbers." However, because there was a reasonable argument that these numbers were not required by Rule 9037 to be redacted, the court declined to award attorney's fees for listing the full numbers on the cable company's proofs of claim. The court did admonish the cable company to redact the numbers going forward.
In this case, Ms. Soles testified that the "account IDs" and "patient numbers" correspond to a particular billing entry, and that a new account number is generated for every visit.
Although the court has now determined based on the evidence before it that the disclosure of these numbers did not violate Rule 9037, WakeMed began redacting all but the last four digits of these numbers prior to the hearings. To resolve any question about the applicability of Rule 9037 to these numbers, WakeMed should continue to redact all but the last four digits of the patient numbers and account IDs.
The debtors also complain about the inclusion of dates of admission and discharge, medical record numbers, and other medical information. Rule 9037 does not address the redaction or disclosure of any of these items. While it is possible that this information is protected under a non-bankruptcy law or regulation, there is no evidence that any of it puts the debtors at risk of identity theft or other damage as contemplated by § 107(c), and is otherwise not addressed in the Bankruptcy Code and Rules. As noted, this is not a HIPAA compliance court. Accordingly, the court declines to find that the disclosure of this information is sanctionable under § 105(a). See Law v. Siegel, 134 S.Ct. 1188, 1194-95 (2014) (equitable powers of the bankruptcy court must only be exercised within the confines of the Bankruptcy Code) (citations omitted).
Because the claim filed in Mr. Branch's case did not disclose any information that clearly must be redacted under Rule 9037, the court finds that WakeMed has not knowingly violated any provision of the Bankruptcy Code and Rules with respect to Mr. Branch. As noted above, however, WakeMed did violate Rule 9037 with respect to Ms. Clark and Ms. Bostick when it included unredacted social security numbers and dates of birth in claims filed in their cases.
As noted above, courts overwhelmingly hold that sanctions are appropriate "where it is shown that a creditor flaunted the law with knowledge of its proscriptions, failed to take remedial action once violations were discovered, or acted deliberately as opposed to mistakenly or inadvertently." Maple, 434 B.R. at 374 (citations omitted). Ms. Soles, who filed the claims on behalf of WakeMed, may not have had actual knowledge of the redaction requirements, but she did "check the box" with every filing that indicated that she had read and complied with the rules regarding redaction. There is no evidence that anyone else at WakeMed had any understanding of what is required to file claims in bankruptcy cases. It is difficult to say that Ms. Soles (and by extension, WakeMed) "flaunted" the law, or acted deliberately. But the magnitude of the violation, and the fact that there was no supervision or training, indicates that WakeMed was more than negligent. An institution that participates in the bankruptcy process as frequently as WakeMed simply cannot ignore the requirements of the court; the Code and Rules are of equal importance to the requirements of HIPAA and other regulations that govern WakeMed's business practices, and the fact that no one was reviewing the rules that might apply is unforgivable.
The debtors maintain that WakeMed failed to timely take remedial action, contending that it is "too big to care" and that the possibility of sanctions (or possibly the media attention) was required to entice WakeMed to take any action. The first motion to restrict access to a proof of claim was filed on November 2, 2015. From November 11 through November 18, 2015, 158 motions to restrict access were filed. On November 24, 2015, the first of the three motions for sanctions was filed. For some reason, none of these documents reached Ms. James until December 1, 2015, 29 days after the first motion to restrict access. The next day, Ms. James on behalf of WakeMed retained counsel to address the issue, and on December 5, 2015, the Motion to Establish a Procedure was filed. Based on the sheer volume and the limitations on the ability of the court staff to restrict access to more than 1,410 claims on any given day, it took several weeks for all of the claims to be restricted and/or redacted.
WakeMed apparently did not have procedures in place to have 159
The court does not find the actions of WakeMed to be intentional or malicious, but the failure to have proper procedures in place resulted in WakeMed's failure to take immediate action when the initial motions to restrict access were filed. This case is also distinguishable from others by the sheer volume of the problem, the length of time that it went unnoticed (also by debtors and their counsel, apparently), and the lack of oversight or training for an entity that files hundreds of bankruptcy claims each year. Accordingly, while the court does not view this case as meriting large punitive sanctions, it does find that some compensatory and punitive award as well as non-monetary relief is appropriate.
Ms. Clark is the only debtor who appeared and presented evidence to the court. She could not demonstrate that she had suffered any actual harm from the failure to redact her personal information, but she did testify that she took three days of vacation to attend the hearings, spent several hours consulting with her counsel about the issue and the hearings, and incurred mileage and parking expenses. Ms. Clark submitted a declaration after the hearing detailing those expenses as follows:
As described below, Ms. Clark and her counsel did the court and the public a service by bringing this matter to the attention of the court. The court will award Ms. Clark her actual expenses for pursuing this matter, as detailed above in the amount of $1,140.69. Ms. Clark also incurred attorneys' fees, which are addressed below.
Ms. Clark's testimony and declaration further noted that she has not quantified her "distress and anxiety over this situation," and she further believes that WakeMed should pay for LifeLock Ultimate Plus identity theft protection for ten years at a cost of $3,298.90. The identity theft protection request is addressed below. Under these facts, the court can find no basis in the law to compensate Ms. Clark for general "distress and anxiety." See Sloane v. Equifax Info. Servs., LLC, 510 F.3d 495, 503 (4th Cir. 2007) (explaining that to recover for emotional distress a party must "reasonably and sufficiently explain the circumstances of [the] injury and not resort to mere conclusory statements.") (citations omitted); Knussman v. Maryland, 272 F.3d 625, 640 (4th Cir. 2001) (factors properly considered in reviewing an award for emotional distress include the factual context in which the emotional distress arose; evidence corroborating the testimony of the plaintiff; the nexus between the conduct of the defendant and the emotional distress; the degree of such mental distress; mitigating circumstances, if any; physical injuries suffered due to the emotional distress; medical attention resulting from the emotional duress; psychiatric or psychological treatment; and the loss of income, if any) (citations omitted).
Although there is no evidence that the information included on WakeMed's claims has been used for nefarious purposes, the debtors have requested that WakeMed be required to provide credit monitoring for those debtors whose personal information was disclosed. At the hearing, Ms. Clark suggested that it should be provided for the rest of her life, but her declaration requests protection for 10 years. Most courts have rejected credit monitoring as an appropriate remedy, as "potential identity theft" is too speculative. See, e.g., Barnhart, 2010 Bankr. LEXIS 471, 2010 WL 724703 (claim included social security number, date of birth, loan account number; risk that information could be used in the future too speculative to allege actual damages), Killian v. Green Tree Servicing, LLC, (In re Killian), Adv. Proc. No. 08-80250-HB, 2009 Bankr. LEXIS 2030, at *29 (Bankr. D.S.C. July 23, 2009) (dismissing claim for damages on the grounds that potential identity theft and costs of credit monitoring are speculative damages); Davis v. Eagle Legacy Credit Union (In re Davis), 430 B.R. 902 (Bankr. D. Colo. 2010) (social security number, date of birth, and driver's license number included in claim; "the harm Plaintiff asserts is not `actual' or `imminent,' for there is no evidence that Plaintiff's personal information has been accessed or misused by an unauthorized third party during the six days when it was viewable by the public on PACER, nor that it will be. In the absence of such evidence, Plaintiff's need for credit monitoring is conjectural or hypothetical. Thus, there is no injury in fact and Plaintiff lacks standing to bring any cause of action against Defendant."); but see In re Lunden, 524 B.R. 410 (Bankr. D. Mass. 2015) (awarding attorney's fees, punitive damages of $1,000, and credit monitoring for one year where social security number and date of birth not redacted).
Here, however, WakeMed has already agreed to pay for one year of credit monitoring for any debtor whose information was disclosed in violation of Rule 9037. Many of those debtors have already received letters from WakeMed outlining the steps they must take to obtain credit monitoring at no cost to the debtors; however, the court will require WakeMed to send a new letter to all of the debtors and any non-debtor minor whose social security number or full date of birth was included in a proof of claim filed on or after December 1, 2007, offering credit monitoring for one year at no cost to those individuals, with instructions for obtaining the same. The court will not dictate which credit monitoring service must be used. The new letter does not need to be HIPAA compliant, and should be limited to (1) the fact that the information was disclosed, (2) WakeMed will provide credit monitoring for one year at no cost, and (3) instructions for obtaining the credit monitoring.
Many courts have found no basis to award attorney fees for violations of Rule 9037. See, e.g., Carter, 411 B.R. 730, Davis, 430 B.R. 902, Brown, 2012 WL 2576473; see also In re Gjestvang, 405 B.R. 316 (Bankr. E.D. Ark. 2009) (no basis to award attorney's fees to restrict public access to a claim under § 107(c); Rule 9037 was not in effect when claim filed). At least one court awarded $300 in attorney's fees, but noted that it was only doing so because the case was one of first impression, and fees may not be awarded in the future on similar motions. Carter v. Checkmate, Cash Advance Ctrs., LLC (In re Carter), Adv. Pro. No. 09-00132-TOM, 2009 WL 3425828, at *4 (Bankr. N.D. Ala. Oct. 23, 2009). The Lunden court awarded attorney's fees where the court found that counsel failed to take remedial measures when the violation was brought to his attention, and then defended his actions with "ex post facto excuses bordering on the frivolous." 524 B.R. at 418.
This court has previously recognized its general authority under § 105(a) to compensate debtors for attorneys' fees incurred in bringing matters of "problematic and recurring practice(s)" of creditors to the attention of the court. In re Campbell, No. 12-06400-8-SWH, 2013 WL 2443377, at *1 (Bankr. E.D.N.C. June 5, 2013). In that case, the debtor demonstrated that the City of Raleigh regularly filed claims as "secured," when, in fact, those claims were unsecured, and the City either (a) corrected them only upon receiving an objection or (b) failed to respond to objections and allowed the misclassification to be corrected by debtor's counsel and the court. The debtor demonstrated that the practice was not "a rare clerical error," but was a common practice that shifted the obligation to debtor's counsel "to determine a claim's secured status, to initiate corrective measures, and to ensure that the claims are corrected." Campbell, 2013 WL 2443377, at *2. The court found that there was a problem with the City's protocol for claim classification that resulted in increased payouts to which it was not entitled and impeded the fair and efficient functioning of the court. Id. at *4. The Campbell court noted that the City had not taken the opportunity to revise its procedures when the issue was first brought to its attention, applauded the new effort to focus on its internal claims-handling process, and credited debtor's counsel's "diligent effort" to bring the matter to light with the City's agreement to correct its "insufficient staff training, lack of attention, general laziness, and . . . troubling indifference to the consequences that these factors imposed on others." Id. at *4.
Here, debtors' counsel likewise acted diligently in "doing the necessary homework to illustrate the scope of the problem to the court." Campbell, 2013 WL 2443377, at *5. Accordingly, "pursuant to the court's inherent powers to issue orders as necessary to ensure the efficient functioning of the court, a compensatory award of fees to counsel is warranted."
The Sasser Law Firm's fee affidavit with respect to Ms. Clark's case showed $117.46 in costs, including filing fees, PACER fees, parking, and mailing costs, and $20,616.50 in attorney and staff time, for a total of $20,733.96. Hourly rates charged were $320 for Mr. Sasser, $295 for Mr. Walker, and $80 for staff. The court finds the rates and the amounts charged to be reasonable. Accordingly, the court will require WakeMed to reimburse the Sasser Law Firm the amount of $20,733.96 for its work on the Clark case.
The Sasser Law Firm also submitted detail relating to the review and filing of its other 157 motions to restrict access, which included staff time reviewing claims for personal information, attorney time for preparing the motions, and attorney time for fielding questions from clients about the issue. That affidavit showed filing fees, PACER fees, postage and copy costs totaling $4,355.74. Attorney and staff fees, at the hourly rates listed above, totaled $12,136. The court finds these amounts to be reasonable, and the court will require WakeMed to reimburse the Sasser Law Firm the amount of $16,491.74 for its work on the other cases.
Mr. Branch and Ms. Bostick were both represented by the firm of Stubbs & Perdue. The claim filed in Mr. Branch's cases did not clearly violate Rule 9037, and the court will not award any fees related to his case. See, e.g., Brown, 2012 WL 2576473, at *4 (denying request for attorney's fees where — prior to court's ruling — cable account numbers were not obviously "financial account numbers" disclosed in violation of Rule 9037). Further, the court notes that the time entries attached to the fee affidavit in Mr. Branch's case indicate that the matter was undertaken on a contingency arrangement, so Mr. Branch will not be responsible for any fees incurred by his counsel in this matter.
Stubbs & Perdue submitted two post-hearing fee affidavits, one in Ms. Bostick's case and one in Mr. Branch's case. The Bostick Affidavit seeks reimbursement of fees in the amount of $15,650 and costs in the amount of $982.46, while the Branch Affidavit seeks reimbursement of fees in the amount of $12,652.25 and costs in the amount of $127.75. For most of the time spent preparing for and attending the hearings, the firm appropriately split its fees and costs between the two cases. Other entries are easily identified as related to one case or the other. In some instances the fees are charged in only one case without sufficient explanation as to why they were not split.
The court finds that the fees and costs in the Bostick fee detail are reasonable, and, with a fee enhancement as explained above, the court will award Stubbs & Perdue a total of $22,632.46 in the Bostick case.
The court finds that limited punitive damages are appropriate in this case. While there is no evidence that the disclosure of personal information was malicious or intentional, the scope of the Rule 9037 violations is extreme and resulted from an utter failure of WakeMed to educate itself regarding the requirements of the Bankruptcy Code and Rules, a lack of training and education of the WakeMed staff, and a failure of procedures to bring these matters to the attention of counsel and take immediate corrective actions. In establishing its award of punitive damages, the court has considered the significant cost in filing and attorneys' fees incurred by WakeMed to remedy the violations as punitive in nature. The court has further determined that allocation between the debtors — who provided a significant public service by bringing and prosecuting the motions — and the court is appropriate.
Accordingly, the court finds that a punitive sanction in the amount of $70,000 is appropriate in this case. WakeMed will be directed to pay the amount of $50,000 to the court, and $10,000 each to Ms. Clark and Ms. Bostick for their roles as "stalking horses" in bringing this matter to the attention of the court and forcing corrective action by WakeMed. This is not to say that WakeMed will continue to be subject to sanctions in the future for past transgressions; it appears to the court that compliance with this order and the actions taken to date are sufficient to remedy the past violations absent some evidence of direct, actual damages to a debtor resulting from the disclosure of his or her particular information.
In addition to requiring WakeMed to pay actual damages and attorneys' fees as directed above, the court will require WakeMed to take certain actions to ensure that it complies with the court's rules going forward. The status report filed in the miscellaneous proceeding indicates that as of January 15, 2016, in addition to filing its motions to restrict access to its claims, WakeMed had taken the following steps:
Misc. Pro. Dkt. 19 at 7. In addition, Ms. James testified that as of the hearing dates, additional actions had been taken, including:
These are all positive steps toward ensuring that continuing violations do not occur. WakeMed is directed to demonstrate its continued compliance with these steps by submitting, for the five years following the date of this order, quarterly reports to the Bankruptcy Administrator detailing the training conducted with respect to claims filing, the number of claims filed during that quarter, a certification that those claims were properly redacted, and an outline of office procedures in place with respect to claims filing during that quarter. Further, the court directs WakeMed to maintain electronic copies of all claims submitted on its behalf, and, to the extent required by EDNC LBR 5005-4(7)(a), to maintain paper copies with the original "wet-ink" signature of filed claims. WakeMed is further directed to review and update its procedures for handling incoming mail and electronic notices received from the court or counsel.
Based on the foregoing, the motions are ALLOWED IN PART AND DENIED IN PART. Mr. Branch's motion for sanctions is DENIED, as WakeMed did not violate Rule 9037 in in his case. Ms. Bostick's motion for sanctions and Ms. Clark's motion for sanctions are ALLOWED as set forth below.
Accordingly, it is ORDERED:
WakeMed is directed to send a letter to all of the debtors and any non-debtor minor whose social security number or full date of birth was included in a proof of claim filed on or after December 1, 2007, offering credit monitoring for one year at no cost to those individuals, with instructions for obtaining the same.
WakeMed is directed to submit, for the five years following the date of this order, quarterly reports to the Bankruptcy Administrator detailing the training conducted with respect to claims filing, the number of claims filed during that quarter, a certification that those claims were properly redacted, and an outline of office procedures in place with respect to claims filing during that quarter.
WakeMed is directed to maintain electronic copies of all claims submitted on its behalf, and, to the extent required by EDNC LBR 5005-4(7)(a), to maintain paper copies with the original "wet-ink" signature of filed claims.
WakeMed is further directed to review and update its procedures for handling incoming mail and electronic notices received from the court or counsel.
WakeMed is directed to pay the sum of $11,140.69 to Janis Monroe Clark, in care of her counsel, within ten days of the date of this order at the following address: Sasser Law Firm, 2000 Regency Parkway, Suite 230, Cary, North Carolina 27518.
WakeMed is directed to pay the sum of $10,000.00 to Carla Lynette Bostick, in care of her counsel, within ten days of the date of this order at the following address: Stubbs & Perdue, PA, 9208 Falls of Neuse Road, Suite 201, Raleigh, North Carolina 27615.
WakeMed is directed to pay the sum of $37,225.70 to the Sasser Law Firm within ten days of the date of this order at the following address: Sasser Law Firm, 2000 Regency Parkway, Suite 230, Cary, North Carolina 27518.
WakeMed is further directed to pay the sum of $22,632.46 to Stubbs & Perdue, PA within ten days of the date of this order at the following address: Stubbs & Perdue, PA, 9208 Falls of Neuse Road, Suite 201, Raleigh, North Carolina 27615.
WakeMed is further directed to pay the sum of $50,000 to the Clerk of Court, United States Bankruptcy Court for the Eastern District of North Carolina, within ten days of the date of this order at the following address: 300 Fayetteville Street, Fourth Floor, Raleigh, North Carolina 27602 (by hand or overnight delivery) or PO Box 791, Raleigh, North Carolina 27602 (by mail).
