Dobson v. SimonMed Imaging LLC

Opinion

WO

Star Do bson, ) No. CV-25-00527-PHX-SPL ) ) No. CV-25-00548-PHX-SPL (cons.) Plaintiff, ) No. CV-25-00601-PHX-SPL (cons.) vs. ) ) ORDER ) SimonMed Imaging LLC, ) ) Defendant. ) ) )

Before the Court is Defendant SimonMed Imaging, LLC’s (“SimonMed’s”) Motion to Dismiss (Doc. 17), Plaintiff’s Response (Doc. 19), and Defendant’s Reply (Doc. 22). The Court now rules as follows.1 This is a putative class action lawsuit brought pursuant to the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332(d)(2). (Doc. 13 ¶ 19). Plaintiff Star Dobson, as well as consolidated plaintiffs Andree Guest, Albert Dumas, Rosemary Hamermaster, and other putative class members (collectively, “Plaintiffs”) are current and former patients at Defendant SimonMed, a healthcare provider that employs approximately 200 radiologists across 11 states. (Id. ¶¶ 27–28). SimonMed collects and electronically files private information from its patients, including names, dates of birth, addresses, passport

1 Because it would not assist in resolution of the instant issues, the Court finds the pending motion is suitable for decision without oral argument. See LRCiv. 7.2(f); Fed. R. Civ. P. 78(b); Partridge v. Reich, 141 F.3d 920, 926 (9th Cir. 1998). information, and Social Security numbers. (Id. ¶¶ 30, 35, 53–54). In February 2025, SimonMed fell victim to a data breach (the “Data Breach”) from the ransomware group Medusa, who claimed to have exfiltrated over 200 gigabytes of data from their systems, including files that contained patients’ and employees’ full names, dates of birth, mailing addresses, telephone numbers, email addresses, driver’s licenses, diagnostic images, passports, identification cards, Social Security numbers, health insurance details, medical records, payroll information, corporate emails, and more. (Id. ¶ 35). The putative plaintiffs allege that SimonMed “did not use reasonable security procedures and practices appropriate to the nature of the sensitive information they were maintaining,” and that the Data Breach was therefore preventable. (Id. ¶¶ 40, 44). Furthermore, they allege that they believe the stolen information has been sold on the dark web since the Data Breach occurred. (Id. ¶ 42). Plaintiffs also allege a number of individualized injuries they believe to be related to the Data Breach. Plaintiff Andree Guest “received notice that data related to her 401K account had been accessed and was required to reset her passwords.” (Id. ¶ 174). Plaintiff Albert Dumas received two unauthorized inquiries to his credit report. (Id. ¶ 185). Rosemary Hamermaster “experienced suspicious spam communications using Private Information compromised in the Data Breach.” (Id. ¶ 196). Plaintiffs’ Consolidated Class Action Complaint asserts claims for (1) negligence (id. ¶¶ 215–49), (2) negligence per se (id. ¶¶ 250–64), (3) breach of implied contract (id. ¶¶ 265–84), (4) breach of fiduciary duty (id. ¶¶ 285–93), and (5) unjust enrichment (id. ¶¶ 294–306). The proposed class consists of “[a]ll individuals residing in the United States whose Private Information was accessed and/or acquired by an unauthorized party as a result of the data breach that occurred at Defendant.” (Id. ¶ 201). To survive a motion to dismiss under Rule 12(b)(6), a complaint must contain “a short and plain statement of the claim showing that the pleader is entitled to relief” so that the defendant is given fair notice of the claim and the grounds upon which it rests. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (quoting Fed. R. Civ. P. 8(a)(2)). A court may dismiss a complaint for failure to state a claim under Rule 12(b)(6) for two reasons: (1) lack of a cognizable legal theory, or (2) insufficient facts alleged under a cognizable legal theory. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990). When deciding a motion to dismiss, all allegations of material fact in the complaint are taken as true and construed in the light most favorable to the nonmoving party. Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). A. Negligence “To establish a claim for negligence, a plaintiff must prove four elements: (1) a duty requiring the defendant to conform to a certain standard of care; (2) a breach by the defendant of that standard; (3) a causal connection between the defendant’s conduct and the resulting injury; and (4) actual damages.” Gipson v. Kasey, 150 P.3d 228, 230 (Ariz. 2007). In its Motion to Dismiss, SimonMed argues that (1) Plaintiffs have not adequately alleged a duty of care, (2) Plaintiffs have not claimed an actual, cognizable injury resulting from any breach, and (3) Plaintiffs’ allegations of causation are conclusory and insufficient. (Doc. 17 at 6–11). Plaintiffs make two arguments to support their claim that SimonMed had a duty to protect their private information: (1) because of the special provider-patient relationship, which may give rise to a duty in tort, and (2) because of a common-law duty based on the “public policy of preventing wrongful disclosures of Private Information and identity theft.” (Doc. 19 at 11–12); see Quinalty v. FocusIT LLC, No. CV-23-00207-PHX-JJT, 2024 WL 342454, at *3 (D. Ariz. Jan. 30, 2024) (“In Arizona, several special relationships can give rise to a duty, including relationships based on contract, familial relations, or conduct undertaken by the defendant.”); see also Cal-Am Props. Inc. v. Edais Eng’g Inc., 509 P.3d 386, 389 (Ariz. 2022) (“Special relationships that give rise to a duty in negligence include legally recognized common law relationships and those formed by contract, familial relationship, or joint undertaking.”). SimonMed asserts a slightly different argument with respect to duty, arguing that Plaintiffs’ claims are premised not on a special relationship or public policy considerations, but on SimonMed voluntarily undertaking the responsibility to store their private data. (Doc. 17 at 6); see Quinalty, 2024 WL 342454, at *3. If so, as SimonMed argues, their negligence claim must fail, because Arizona requires a showing of physical harm to support a claim based on negligent undertaking. (Doc. 17 at 6). SimonMed is correct that if Plaintiffs are alleging a duty of care based on SimonMed voluntarily undertaking the responsibility to protect their private information, that claim must fail, as they have not alleged any physical harm caused by SimonMed’s negligence. See Cal-Am Props. Inc. v. Edais Eng’g Inc., 253 Ariz. 78, 83 (2022). Regarding the physician-patient special relationship, SimonMed argues that Plaintiffs have not cited “any Arizona authority extending a purported physician-patient duty to the data breach context.” (Doc. 22 at 2). This argument is somewhat persuasive. As the Arizona Court of Appeals has explained, “[t]he physician-patient relationship . . . creates a presumption that physicians will marshal information in their possession, pertinent to a patient’s health, to protect the patient from that risk of harm.” Doe I by & through Fleming & Curti, PLC v. Lenzner Med. Servs., LLC, 570 P.3d 977, 992 (Ariz. Ct. App. 2025) (Eckerstrom, J., dissenting). The question here, then, is whether SimonMed, in the course of its physician-patient relationship with its customers, had a duty to protect those patients from the risk of harm suffered, i.e., that their personal information was exposed in a data breach.2 As observed in another recent medical data breach class action in this District, “it is unclear how a physician’s Hippocratic Oath covers a hospital’s data security and Plaintiffs are not suing the physicians.” Johnson v. Yuma Reg’l Med. Ctr., No. CV-22-01061-PHX-SMB, 2025 WL 2337120, at *3 (D. Ariz. Aug. 13, 2025) (hereafter “Johnson II”). In other words, even if the relationship between SimonMed and Plaintiffs is

2 SimonMed is not a physician itself, but rather “a healthcare provider that employs approximately 200 radiologists across 11 states.” (Doc. 13 ¶ 2). the kind of special relationship giving rise to a duty of care, it is unclear whether the type of harm alleged here is the type of risk a party in that special relationship has a duty to protect against. Plaintiffs seek to bolster their claim by arguing that HIPAA and the Federal Trade Commission Act (“FTCA”) provide an “additional source of Defendant’s liability” as references to the relevant standard of care. (Id. at 12). “[P]ublic policy, through state and federal statutes, can be a source of duty.” Quinalty, 2024 WL 342454, at *4. However, Arizona courts have been clear that both HIPAA and FTCA “have their own enforcement mechanisms and were not intended to provide a private right of action.” Gannon v. Truly Nolen of Am. Inc., No. CV 22-428-TUC-JAS, 2023 WL 6536477, at *2 (D. Ariz. Aug. 31, 2023). Plaintiffs’ argument that their claim is not brought under HIPAA or the FTCA, but rather that the statutes help define the duty of care, fares no better. See Skinner v. Tel-Drug, Inc., No. CV1600236TUCJGZBGM, 2017 WL 1076376, at *3 (D. Ariz. Jan. 27, 2017), report and recommendation adopted, No. CV1600236TUCJGZBGM, 2017 WL 1075029 (D. Ariz. Mar. 22, 2017) (rejecting a plaintiff’s argument that “he is not making an independent HIPAA claim, but rather is relying on HIPAA to ‘evidence the duty of care owed by Defendant with respect to the privacy of Plaintiff’s medical records.’”). Here, Plaintiffs argue that SimonMed failed to comply with HIPAA guidelines and the FTCA. (See Doc. 13 ¶¶ 94–116). Couching such allegations within the more generalized language of “industry standards,” “public policy,” and “a duty imposed by statute” is irrelevant: at bottom, Plaintiffs are trying to argue that SimonMed had an obligation to comply with the privacy guidelines contained within HIPAA and the FTCA. The source of such obligations are the statutes themselves. To the extent that Plaintiffs believe SimonMed violated those statutes, there is no private right of action for Plaintiffs to enforce them.3 Accordingly, this 3 Furthermore, with respect to the FTCA, Arizona generally follows the Restatement (Second) of Torts, see, e.g., Quinalty, 2024 WL 342454, at *4, which requires that when a standard of conduct is provided by a statute, “the purpose of the statute must be to protect (1) a class of persons that includes the person whose interest is invaded and (2) the particular interest which the plaintiff alleges has been invaded.” In re MCG Health Data attempted backdoor argument does not bolster their negligence claim. Ultimately, the Court does not find that Plaintiffs’ allegations in the Complaint are sufficient to establish a duty of care to protect Plaintiffs from the kind of harm suffered as a result of this data breach. However, given that leave to amend should be liberally granted, Plaintiffs will be given an opportunity to cure their Complaint through the allegation of other facts. See Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000). Because Plaintiff has not adequately alleged a duty of care, the Court will not evaluate Defendant’s arguments regarding the elements of breach, causation, or damages at this juncture. B. Negligence Per Se As many Arizona courts have reiterated, negligence per se is not a standalone cause of action, but rather a doctrine under which plaintiffs may establish the duty and breach elements of a negligence claim based on violation of a statute. See, e.g., Johnson v. Yuma Reg’l Med. Ctr., 769 F. Supp. 3d 936, 954 (D. Ariz. 2024) (“Johnson I”); Griffey v. Magellan Health Inc., 562 F. Supp. 3d 34, 47 (D. Ariz. 2021). The Court will therefore dismiss the negligence per se claim with prejudice to the extent that it is brought as a standalone cause of action. C. Breach of Implied Contract Contracts may be express or implied. See Barmat v. John & Jane Doe Partners A- D, 747 P.2d 1218, 1220–21 (Ariz. 1987). “Plaintiffs carry the burden to prove existence of a contract, its breach, and the resulting damages.” Johnson II, 2025 WL 2337120, at *4 (citing Thomas v. Montelucia Villas, LLC, 302 P.3d 617, 621 (Ariz. 2013)). Here, Plaintiffs argue that they paid money to Defendant in exchange for medical services, and as a condition of receiving those services, they were required to deliver their private Sec. Issue Litig., No. 2:22-CV-849-RSM-DWC, 2023 WL 3057428, at *3 (W.D. Wash. Mar. 27, 2023), report and recommendation adopted, No. 2:22-CV-849-RSM-DWC, 2023 WL 4131746 (W.D. Wash. June 22, 2023). The primary purpose of the FTCA is to protect consumers from unfair trade practices, and it is therefore not designed to protect the class of persons that includes Plaintiffs or the data security interest they allege has been invaded. See id. Plaintiffs’ FTCA arguments are particularly inapposite for this reason. information to Defendant. (Doc. 13 ¶ 266). Plaintiffs contend that they “would not have paid for Defendant’s medical services, or would have paid less for them, had they known that Defendant’s data security practices were substandard.” (Id.). They specifically allege that “Defendant promised to provide confidentiality and adequate security for their data through its applicable privacy policy and through other disclosures in compliance with statutory privacy requirements.” (Id. ¶ 57). Defendants argue that there cannot be an implied contract where there was an express contract, and that Plaintiffs’ own complaint alleges that Defendant “expressly” promised Plaintiffs that it would only disclose their private information under limited circumstances. (Doc. 17 at 12). Furthermore, it argues that Plaintiffs’ allegations cannot support a breach of implied contract claim because “SimonMed is already required to comply with [pre-existing legal] obligations notwithstanding any alleged contract.” (Doc. 22 at 10). In Johnson II, the court adopted this “pre-existing legal obligations” argument, noting that the plaintiffs did not “plead any facts that support a contractual duty to prevent a data breach all together or that Yuma Regional promised to do anything beyond what it was already obligated to do under HIPAA or the FTCA.” Johnson II, 2025 WL 2337120, at *4. Here, the Notice of Privacy Practices Plaintiffs rely on in their Complaint states that “We are required by law to maintain the privacy and security of your protected health information,” but there is no allegation that Defendant made any additional promises to, e.g., use additional “commercially reasonable” precautions to safeguard Plaintiffs’ ignoration. Cf. Durgan v. U-Haul Int’l Inc., No. CV-22-01565-PHX-MTL, 2023 WL 7114622, at *4 (D. Ariz. Oct. 27, 2023) (adequately alleging a breach of implied contract where defendant represented that it would use “commercially reasonable physical, managerial, and technical safeguards to preserve the integrity and security” of plaintiffs’ information); see also In re Banner Health Data Breach Litig., No. CV-16-02696-PHX- SRB, 2017 WL 6763548, at *3 (D. Ariz. Dec. 20, 2017) (“Under Arizona law, ‘the performance or promise to do something that a party is already legally obligated to do is not valid consideration for a contract.’” (citation omitted)). Because Plaintiffs have not alleged that Defendant made any promises beyond what they were already legally obligated to do, this claim will be dismissed with leave to amend. D. Breach of Fiduciary Duty Defendant argues that this claim should be dismissed because “Plaintiffs did not adequately plead a fiduciary relationship.” (Doc. 17 at 13). This Court agrees, and it adopts much of the reasoning in the recent Johnson II decision. See Johnson II, 2025 WL 2337120, at *5 (“It is not clear how a hospital’s collection of data establishes a confidential relationship with its customers or patients to establish a fiduciary duty.”). The existence of a commercial relationship between SimonMed and its customers is not sufficient to establish a fiduciary duty, and there are no other facts in the pleading to suggest that Defendant agreed to serve as a fiduciary. Cook v. Orkin Exterminating Co., 258 P.3d 149, 152 (Ariz. Ct. App. 2011) (“Generally, commercial transactions do not create a fiduciary relationship unless one party agrees to serve in a fiduciary capacity.). While it is “not abundantly clear to the Court” how these deficiencies will be remedied, in the interest of justice, this claim will nonetheless be dismissed with leave to amend. See Johnson I, 769 F. Supp. 3d at 959. E. Unjust Enrichment Plaintiffs assert a claim for unjust enrichment in the alternative to their breach of implied contract claim. (Doc. 13 ¶ 295). To state a claim for unjust enrichment under Arizona law, a party must allege: “(1) an enrichment, (2) an impoverishment, (3) a connection between the enrichment and the impoverishment, (4) the absence of justification for the enrichment and the impoverishment, and (5) the absence of a remedy provided at law.” Span v. Maricopa Cnty. Treasurer, 437 P.3d 881, 886 (Ariz. Ct. App. 2019). “[T]o determine whether unjust enrichment has occurred, courts view the parties’ obligations to one another in view of the larger context of their transaction.” Johnson II, 2025 WL 2337120, at *6. Here, Plaintiffs allege that as part of their transaction with Defendant for medical 1 services, Defendant “should have had their Private Information protected with adequate data security.” (Doc. 13 § 296). Like in Johnson IU, “[a]t bottom, Plaintiffs’ allegations are the [defendant] spent the money on its security systems, albeit those systems were inadequate to prevent the breach. [Defendant’s] ineffective use of the funds does not provide a plausible basis to find it retained some benefit to Plaintiffs’ detriment.” Johnson Il, 2025 WL 2337120, at *7. Accordingly, the claim will be dismissed without prejudice. When granting a motion to dismiss, a court is generally required to grant a plaintiff leave to amend. See Fed. R. Civ. P. 15(a)(2). Plaintiffs therefore will be granted leave to amend their Complaint as to all claims except for negligence per se (which is not a standalone cause of action). Accordingly, IT IS ORDERED that Defendant’s Motion to Dismiss (Doc. 17) is granted as follows: Plaintiffs’ claims for Negligence (Count I), Breach of Implied Contract (Count IID), Breach of Fiduciary Duty (Count IV), and Unjust Enrichment (Count V) are dismissed without prejudice and with leave to amend. Plaintiffs’ claim for Negligence Per Se (Count ID is dismissed with prejudice. Plaintiffs shall have until September 19, 2025 to file an amended complaint in accordance with Rule 15.1 of the Local Rules of Civil Procedure. Plaintiffs are warned that failure to file an amended complaint will result in the 90 dismissal of this action. Dated this 21st day of August, 2025. Ae United States District Ladue