Perkins v. CommonSpirit Health

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION LEEROY PERKINS; MARCIA JACOBS; JOSE ANTONIO KOCH; JOHN DOE, a Minor, through his Guardian, JOSE ANTONIO KOCH; and JAMES DOE, a Minor, through his Guardian, JOSE ANTONIO KOCH, on behalf of Case No. 22 C 7313 themselves and all others similarly situated, Judge Harry D. Leinenweber Plaintiffs, v. COMMONSPIRIT HEALTH, Defendant. MEMORANDUM OPINION AND ORDER This case involves a data breach that was part of a ransomware attack on Defendant CommonSpirit Health (“Defendant”). Defendant is one of the largest non-profit health systems in the United States with over 1,000 sites coast to coast serving upwards of 20 million patients. Two of the sites involved in the data breach are located in the state of Washington: Franciscan Medical Group and Franciscan Health. The Plaintiffs Leroy Perkins, Marcia Jacobs, Jose Antonio Koch, and John and James Doe, sons of Koch, (“Plaintiffs”), are all alleged to have been at one time or another patients of Defendant’s Washington facilities and received notice of the data breach. They seek, via their 226-paragraph Amended Class Action Complaint, to represent a class of similarly situated patients of Defendant who were affected by the breach. Their Complaint alleges five causes of action: first, negligence; second, negligence per se; third, breach of implied contract; fourth, Unjust Enrichment; and fifth, Declaratory Judgment. They seek certification of a class under Federal Rule of Civil Procedure 23, appointment as representatives of the Class, monetary damages, restitution, and injunctive relief. In response, Defendant has furnished the affidavits of Lori Lamb (“Lamb”), Defendant’s Systems Privacy Officer, who oversaw the identification of individuals whose data was impacted by the breach described in Plaintiffs’ Complaint. According to the affidavits, after completing her investigation, Lamb has declared that there is no record that Plaintiff, Jose Antonio Koch, was notified that his personal information was impacted by the breach. She further declared that the information disclosed as a result of the breach concerning Koch’s two sons John and James Doe, and Plaintiffs Leeroy Perkins, and Marcia Jacobs consisted only of non-sensitive demographic information, including names, addresses, phone numbers, and dates of birth. She further declared that the breach did not include Plaintiffs’ diagnostic information, facility associated account/encounter number, health insurance information, or social security numbers. She further declared, that, while some patients of Defendant did receive notification of disclosures of sensitive personal information, none of the Plaintiffs were among those so notified. Based on these affidavits, Defendant has moved to dismiss based on lack of federal jurisdiction due to a lack of Article III standing. II. ARTICLE III STANDING Any standing discussion must of course start with Spokeo v. Robins, 136 S.Ct. 1540 (2021). That case holds that the “irreducible constitutional minimum” for standing as set forth in Lujan v. Defenders of Wildlife, 112 S.Ct. 2130 (1992), is an “injury in fact.” Id. at 1548. An injury in fact, the Supreme Court “has made [. . .] clear time and time again,” must be both “concrete and particularized.” Id. To be concrete it must be “de facto.” Id. That is, it must exist and be “actual or imminent, not conjectural or speculative.” While Spokeo involved an alleged statutory violation, the Seventh Circuit has applied Spokeo to the situation, as here, where Plaintiffs suffered data breaches of records of private businesses. See Remijas v. Neiman Marcus Group, LLC., 794 F.3d 688 (7th Cir. 2015). III. DISCUSSION In Remijas, the plaintiff was a victim of a data breach at Neiman Marcus and claimed four alleged injuries and “imminent” injuries. The four actual injuries claimed by Remijas were (1) lost time and money resolving fraudulent charges, (2) lost time and money protecting from future identity theft, (3) buying an item she would not have purchased had plaintiff known about the store’s negligence, and (4) lost control over personal information. The two alleged imminent injuries included (1) future fraudulent charges, and (2) greater susceptibility for identity theft. The court distinguished Spokeo because Remijas did, in fact, suffer identity theft and experienced actual fraud in the form of unauthorized purchases that occurred on her Neiman Marcus account. So, her actual injuries went far beyond Spokeo, which were considered speculative and conjectural. The court said that the threat of imminent injuries was real enough because the plaintiff had actually experienced fraudulent activity caused by the data breach. The court in passing did speak skeptically about the alleged actual losses numbers (3) and (4) described above. In contrast to Remijas, the Plaintiffs here have not suffered a breach of their sensitive information, such as social security numbers and credit card information that would make future losses not only possible but imminent. Plaintiffs do not allege that they have suffered any fraudulent activity to date, that could require the taking of protective actions such as those taken by Remijas to avoid imminent losses. The distinction between imminent losses and “possible” losses was the focal point of the Supreme Court case of Clapper v. Amnesty International USA, 568 U.S. 398 (2013). The court in Clapper held that, where future losses may be possible but not imminent or impending, there is no Article III standing and no federal claim for costs of time and money taking defensive actions such as replacing credit cards because the risk of loss is not imminent. The court held that one cannot create standing by incurring costs in anticipation of non-imminent harm. Plaintiffs contend here that, as Remijas claimed, they were forced to incur time and money in protecting themselves from possible future losses, but as Clapper put it, such expenses do not create standing. Plaintiffs argue that Defendant has not agreed to jurisdictional discovery. But they did not seek leave of the court to do so. Under Seventh Circuit law, it is up to the discretion of the district court to allow a plaintiff to conduct limited discovery in order to establish jurisdiction. Sanderson v. Spectrum Labs, Inc., 248 F.3d 1159 (7th Cir. 2000). However, a plaintiff must establish a colorable or prima facie showing of personal jurisdiction before discovery is to be permitted. Cent. States Southeast and Southwest Pension Fund v. Reimer Express World Corp., 230 F.3d 934 , 946 (7th Cir. 2000). “[A] plaintiff seeking jurisdictional discovery” must advance “proof to a reasonable probability” of the facts necessary to establish federal jurisdiction. Anthony v. Sec. Pac. Finance Services, Inc., 75 F.3d 311, 316 (7th Cir. 1996). The Plaintiffs here have not sought jurisdictional discovery, so it has been waived. IIt. CONCLUSION For the reasons stated herein, Defendant’s Motion to Dismiss Amended Consolidated Complaint is granted. The case is dismissed without prejudice for a lack of jurisdictional standing. IT IS SO ORDERED. Harry D. Leinenweber, Judge United States District Court Dated: 10/5/2023 =- 6 =-