Chabot v. Spectrum Healthcare Partners, P.A.

CourtSuperior Court of Maine
DecidedJanuary 14, 2021
DocketCUMbcd-cv-20-18
StatusUnpublished

This text of Chabot v. Spectrum Healthcare Partners, P.A. (Chabot v. Spectrum Healthcare Partners, P.A.) is published on Counsel Stack Legal Research, covering Superior Court of Maine primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Chabot v. Spectrum Healthcare Partners, P.A., (Me. Super. Ct. 2021).

Opinion

STATE OF MAINE BUSINESS & CONSUMER DOCKET CUMBERLAND, ss. DOCKET NO. BCDWB-CV-2020-18

DAWN CHABOT and TAMARA ) BISBEE, individually and all others ) similarly situated, ) ) Plaintiffs, ) ORDER GRANTING CENTRAL ) MAINE ORTHOPAEDICS’ MOTION v. ) TO DISMISS PLAINTIFFS’ CLASS ) ACTION COMPLAINT SPECTRUM HEALTHCARE ) PARTNERS, P.A. d/b/a CENTRAL ) MAINE ORTHOPAEDICS, ) ) Defendant. )

Plaintiffs Dawn Chabot (“Chabot”) and Tamara Bisbee (“Bisbee”) (“Plaintiffs”),

individually and on behalf all other patients similarly situated, have brought a five count Class

Action Complaint against Defendant Spectrum Healthcare Partners, P.A., d/b/a Central Maine

Orthopaedics (“CMO”) stemming from a phishing attack. 1 Plaintiffs allege inter alia that they

have been harmed by a phishing attack on a CMO employee’s email, that CMO’s failure to prevent

the phishing attack constitutes a trespass of chattels, and that the theft of their data constitutes a

bailment breach. In response to the Class Action Complaint, CMO has filed a Motion to Dismiss

contending that Plaintiffs have not pled actual harm, and that Plaintiffs have failed to plead

elements necessary to their property tort claims. This case presents the question of what constitutes

legally cognizable, actual injury to patients in the wake of a phishing attack on a health care

provider’s email. For the reasons discussed below, the Court grants CMO’s Motion to Dismiss.

1 Plaintiffs have since filed a First Amended Complaint, also with five counts. The five counts are as follows:

Court I: Negligence – Including Negligence Per Se; Count II: Invasion of Privacy; Count III: Breach of Contract; Count IV: Trespass of Chattel; Count V: Bailment.

1 STANDARD OF REVIEW

In reviewing a motion to dismiss under Rule 12(b)(6), courts “consider the facts in the

complaint as if they were admitted.” Bonney v. Stephens Mem. Hosp., 2011 ME 46, ¶ 16, 17 A.3d

123. The complaint is viewed “in the light most favorable to the plaintiff to determine whether it

sets forth elements of a cause of action or alleges facts that would entitle the plaintiff to relief

pursuant to some legal theory.” Id. (quoting Saunders v. Tisher, 2006 ME 94, ¶ 8, 902 A.2d 830).

“Dismissal is warranted when it appears beyond a doubt that the plaintiff is not entitled to relief

under any set of facts that he might prove in support of his claim.” Id. Although Maine’s notice

pleading requirements are forgiving, Desjardins v. Reynolds, 2017 Me 99, ¶ 17, 162 A.3d 228,

conclusory statements, even if factually true, are legally deficient to ward off dismissal if a plaintiff

fails to allege sufficient facts. Carey v. Bd. of Overseers of Bar, 2018 ME 119, ¶ 23, 192 A.3d

589, as corrected (October 11, 2018). Further, a court is not bound to accept legal conclusions.

Id.A complaint must allege facts sufficient to demonstrate that a plaintiff has been injured in a

legally cognizable way. America v. Sunspray Condo. Ass’n, 2013 ME 19, ¶ 20, 61 A.3d 1249

(quoting Burns v. Architectural Doors & Windows, 2011 ME 61, ¶ 17, 19 A.3d 823).

FACTS

The operative pleading in this case is the First Amended Complaint (“Amended

Complaint” or “Pl.’s Amd. Compl.”). According to the Amended Complaint, Spectrum Health

Partners, P.A. (“Spectrum”) is a Maine corporation with a principal office in Portland, Maine.

Plaintiff’s Amended Complaint (Pl.’s Amd. Compl.) ¶ 7. Spectrum is Maine’s largest statewide

multispecialty, physician-owned and -directed professional organization. (Pl.’s Amd. Compl. ¶ 8.)

CMO is one of Spectrum’s offices and is located in Auburn, Maine. (Pl.’s Amd. Compl. ¶ 9.)

Chabot and Bisbee are both current patients of CMO. (Pl.’s Amd. Compl. ¶¶ 5-6.)

2 On or about November 5, 2019, an unauthorized individual gained access to a CMO

employee’s email account. (Pl.’s Amd. Compl. ¶¶ 28, 29, Exh. B.) CMO detected the unauthorized

access on November 14, 2019. (Pl.’s Amd. Compl. ¶ 30, Exh. B.) CMO conducted an investigation

and determined that information about the Plaintiffs may have been contained in the email account.

(Pl.’s Amd. Compl. ¶ 27, Exh. B.) The information may have included Plaintiffs’ names, dates of

birth, addresses, amounts owed to CMO, health insurance information, and other clinical and

treatment information related to care received at CMO (the “Information”). (Pl.’s Amd. Compl. ¶

28, Exh. B.) By letters dated January 10, 2020, CMO notified Plaintiffs of the incident. (Pl.’s

Amd. Compl. ¶ 27, Exh. B.)

At some point subsequent to the incident, 2 an unknown actor attempted to login to Chabot’s

Facebook account. (Pl.’s Amd. Compl. ¶ 73.) Chabot’s primary Facebook login credential is her

email, which she provided to CMO in the past. Id. In order to mitigate the risk of identity theft,

Chabot has purchased identity theft protection through McAfee. (Pl.’s Amd. Compl. ¶ 74.) In

addition to her out-of-pocket expense, Chabot has expended time and effort to mitigate the risk of

identity theft. (Pl.’s Amd. Compl. ¶ 75.)

In December 2019, someone attempted to use Bisbee’s debit card five times to get an Uber.

(Pl.’s Amd. Compl. ¶ 76(a).) Only one of the five charges went through, but she was reimbursed

by the bank. Id. Sometime between December 2019 and January 2020, Bisbee’s credit card was

compromised, but she does not specify how. (Pl.’s Amd. Compl. ¶ 76(b).) Recently, upon applying

for a car loan, the credit union informed Bisbee that five additional social security numbers were

associated with her name. (Pl.’s Amd. Compl. ¶ 76(c).) Bisbee also reports that she receives

notifications that her Apple and Amazon accounts have been compromised (Pl.’s Amd. Compl. ¶

2 The Amended Complaint does not disclose when.

3 76(d)), although the Complaint does not specify the manner in which they were compromised.

Both accounts use the name, address and email address she provided to CMO. (Pl.’s Amd. Compl.

¶ 76(d).) Finally, Bisbee received a notification from Credit Karma on April 2, 2020 that her data

had been compromised, but the Amended Complaint does not specify how or what data was

compromised. (Pl.’s Amd. Compl. ¶ 76(e).) In an attempt to mitigate these incidents, Bisbee has

purchased identity theft protection through LifeLock. (Pl.’s Amd. Compl. ¶ 77.)

According to the Amended Complaint, CMO wrongfully failed to safeguard its employee’s

email account and embedded information from unauthorized access. (Pl.’s Amd. Compl. ¶¶ 32,

48, 49-58.) As a result, Plaintiffs (and those similarly situated) claim they now face and will

continue to face, a heightened risk of identity theft and fraud for the rest of their lives. (Pl.’s Amd.

Compl. ¶ 67.) In particular, Plaintiffs claim they have suffered or are at increased risk of suffering:

loss of the opportunity to control how their Information is used; diminution in value of their

Information; compromise, publication and theft of their Information; out-of-pocket costs

associated with the prevention, detection, recovery, and remediation from identity theft or fraud,

including the purchase of identity theft protection insurance and detection services; lost

opportunity costs and lost wages associated with the time and effort expended and the loss of

productivity from addressing and attempting to mitigate the actual and future consequences of the

data disclosure, including but not limited to efforts spent researching how to prevent, detect,

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Saunders v. Tisher
2006 ME 94 (Supreme Judicial Court of Maine, 2006)
Snow v. Villacci
2000 ME 127 (Supreme Judicial Court of Maine, 2000)
Bernier v. Raymark Industries, Inc.
516 A.2d 534 (Supreme Judicial Court of Maine, 1986)
Levasseur v. Field
332 A.2d 765 (Supreme Judicial Court of Maine, 1975)
Bahre v. Pearl
595 A.2d 1027 (Supreme Judicial Court of Maine, 1991)
Ginn v. Penobscot Company
334 A.2d 874 (Supreme Judicial Court of Maine, 1975)
Colquhoun v. Webber
684 A.2d 405 (Supreme Judicial Court of Maine, 1996)
Michaud v. Steckino
390 A.2d 524 (Supreme Judicial Court of Maine, 1978)
Nelson v. Times
373 A.2d 1221 (Supreme Judicial Court of Maine, 1977)
In Re Hannaford Bros. Co. Customer Data Security Breach Litigation
2010 ME 93 (Supreme Judicial Court of Maine, 2010)
Pearl Investments, LLC v. Standard I/O, Inc.
257 F. Supp. 2d 326 (D. Maine, 2003)
America Online, Inc. v. IMS
24 F. Supp. 2d 548 (E.D. Virginia, 1998)
Burns v. Architectural Doors and Windows
2011 ME 61 (Supreme Judicial Court of Maine, 2011)
Bonney v. Stephens Memorial Hospital
2011 ME 46 (Supreme Judicial Court of Maine, 2011)
Philip C. Tobin v. Philip N. Barter
2014 ME 51 (Supreme Judicial Court of Maine, 2014)
Timothy Bell v. Randall Dawson
2013 ME 108 (Supreme Judicial Court of Maine, 2013)
Vitorino America v. Sunspray Condominium Association
2013 ME 19 (Supreme Judicial Court of Maine, 2013)
Dana Desjardins v. Michael Reynolds
2017 ME 99 (Supreme Judicial Court of Maine, 2017)
Seth T. Carey v. Board of Overseers of the Bar
2018 ME 119 (Supreme Judicial Court of Maine, 2018)
Chouinard v. Berube
126 A. 180 (Supreme Judicial Court of Maine, 1924)

Cite This Page — Counsel Stack

Bluebook (online)
Chabot v. Spectrum Healthcare Partners, P.A., Counsel Stack Legal Research, https://law.counselstack.com/opinion/chabot-v-spectrum-healthcare-partners-pa-mesuperct-2021.