Johnson v. Yuma Regional Medical Center

Opinion

WO

Brittney Johnson, No. CV-22-01061-PHX-SMB

Plaintiff, ORDER

v.

Yuma Regional Medical Center,

Defendant. This lawsuit arises out of a ransomware attack on Defendant Yuma Regional Medical Center’s (“Yuma Regional”)1 data storage systems resulting in a breach and the hackers gaining access to its patients’ sensitive information. The fourteen Named Plaintiffs here represent individuals who had their information stolen. Following the Court’s dismissal of the Consolidated Class Action Complaint (Doc. 81; Doc. 68), Plaintiffs filed their First Amended Consolidated Class Action Complaint (“FAC”) (Doc. 83). Yuma Regional now moves to dismiss all claims asserted in the FAC (Doc. 90) for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). The parties have fully briefed the Motion to Dismiss (Doc. 92 (Plaintiffs’ Response); Doc. 94 (Yuma Regional’s Reply.) Yuma Regional requested oral argument (Doc. 83 at 1), the Court, however, finds it unnecessary and resolve the Motion without oral argument. See LRCiv 7.2(f). Having reviewed the parties’ briefs and the applicable law, the Court will grant Yuma Regional’s 1 Defendant notes that it now operates under the name “Onvida Health,” however, continues to refer to itself under its prior name. (Doc. 90 at 6 n.1.) The Court will do the same. Motion in part. The Court derives the following allegations as pleaded in Plaintiffs’ FAC. (See generally Doc. 83.) Plaintiffs are a collection of current and former patients that received medical care from Yuma Regional, a hospital in Yuma, Arizona. To receive treatment, Plaintiffs were required to disclose various types of personal and confidential medical information. Yuma Regional maintains that information within its systems. In April 2022, cybercriminals breached Yuma Regional’s data security systems, gaining unrestricted access to its files for the next few days. Hackers were able to extract highly sensitive files containing data on an estimated 700,000 of its patients. Four days after the breach, Yuma Regional identified the hackers had gained access. In the weeks that followed, the Named Plaintiffs received a notice letter, dated June 9, 2022, from Yuma Regional. The notice provided assurances that Yuma Regional was strengthening its system, enhancing its protocols, and offering its patients free credit monitoring and identity theft protection services for an unknown duration. After the breach, some of the Plaintiffs received word that their information wound up on the dark web. Plaintiffs’ class action lawsuit followed. This Court previously dismissed Plaintiffs initial Complaint with leave to amend. (See Doc. 81.) Plaintiffs filed their FAC shortly thereafter. (Doc. 83.) Plaintiffs’ FAC asserts claims for (1) Negligence; (2) Breach of Implied Contract/Implied Duty of Good Faith and Fair Dealing; (3) Unjust Enrichment; (4) Breach of Fiduciary Duty; and (5) Consumer Fraud, Ariz. Rev. Stat. § 44-1521. To survive a Rule 12(b)(6) motion for failure to state a claim, a complaint must meet the requirements of Rule 8(a)(2). Rule 8(a)(2) requires a “short and plain statement of the claim showing that the pleader is entitled to relief,” providing “fair notice of what the . . . claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957)). This exists if the pleader sets forth “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Dismissal under Rule 12(b)(6) “can be based on the lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory.” Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1988). A cognizable legal theory must state a claim to relief that is “plausible on its face.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 570). Plausibility does not equal “probability,” but requires “more than a sheer possibility that a defendant has acted unlawfully.” Id. The Court views the well-pled factual allegations as true and construes them in the light most favorable to the nonmoving party. Cousins v. Lockyer, 568 F.3d 1063, 1067 (9th Cir. 2009). But legal conclusions couched as factual allegations are not given a presumption of truthfulness, and “conclusory allegations of law and unwarranted inferences are not sufficient to defeat a motion to dismiss.” Pareto v. FDIC, 139 F.3d 696, 699 (9th Cir. 1998). A. Negligence Under Arizona law, to state a claim for negligence “a plaintiff must prove: (1) a duty requiring the defendant to conform to a certain standard of care; (2) breach of that standard; (3) a causal connection between the breach and the resulting injury; and (4) actual damages.” CVS Pharmacy, Inc. v. Bostwick ex rel., 494 F.3d 572, 578 (Ariz. 2021) (quoting Quiroz v. ALCOA Inc., 416 P.3d 824, 827–28 (Ariz. 2018)). Yuma Regional moves to dismiss Plaintiffs’ negligence claim, arguing they failed to (1) establish a legal duty exists; (2) demonstrate a breached of the duty of care owed to Plaintiffs, and (2) adequately plead cognizable damages. (Doc. 90 at 9, 11.) 1. Duty In Arizona, a plaintiff bears the burden of establishing a duty exists. Quiroz, 416 P.3d at 838. As a legal matter, “the issue of duty involves generalizations about categories of cases.” Gipson v. Kasey, 150 P.3d 228, 230 (Ariz. 2007). A duty is an “obligation, recognized by law, which requires the defendant to conform to a particular standard of conduct.” Id. Absent some duty, there can be no negligence action. Id. Duties are based either on special relationships recognized by the common law or on relationships shaped by public policy. Perez v. Circle K Convenience Stores, Inc., 564 P.3d 623, 627 (Ariz. 2025). Special relationships also include those based on contract, familial relations, or conduct undertaken by the defendant. Cal-Am Props. Inc. v. Edais Eng’g Inc., 509 P.3d 386, 389 (Ariz. 2022). Generally, a court determines whether a legal duty exists before considering the case-specific facts and irrespective of whether a defendant’s conduct creates an unreasonable risk of harm for foreseeable plaintiffs. Quiroz, 416 P.3d at 828–29 (noting foreseeability remains relevant to breach and causation). But a court may consider case-specific facts to determine “whether a special relationship existed between the plaintiff and defendant, and if so, whether the risk of harm alleged to have injured plaintiff arose within that relationship.” Perez, 564 P.3d at 628–30 (noting the purpose of examining case-specific facts is to determine the “when and where” the alleged risk of harm arose). Similarly, whether a defendant assumed a duty based on its conduct necessitates a fact-specific inquiry. Dabush v. Seacret Direct LLC, 478 P.3d 695, 703 (Ariz. 2021) (noting the existence and extent of an assumed duty is generally a question of fact). “A duty may be assumed expressly or by conduct.” Id. But that duty “is limited to the extent of the specific undertaking.” Id. Plaintiffs allege that Yuma Regional owes a legal duty to safeguard and protect their information from unauthorized access or disclosure based on an “assumed responsibility” and under “common law” and assert that the Federal Trade Commission Act (“FTCA”), 15 U.S.C. § 45, HIPAA regulations, a physician’s Hippocratic Oath, Arizona Revised Statute § 12-2292(A), and Yuma Regional’s policies support or provide such legal duties. (Doc. 83 ¶¶ 215–22, 228.) Yuma Regional argues none of these provide a basis to establish it owed a legal duty to Plaintiffs. (Doc. 90 at 9–11; Doc. 94 at 10–11.) Plaintiffs disagree, arguing a legal duty exists based on a negligent undertaking, also known as an assumed a duty, in collecting their private information and public policy “favors imposition of a duty.” (Doc. 92 at 8–10.) Plaintiffs do not argue any duty arises under recognized categorical relationships. See, e.g., Gipson, 150 P.3d at 232 (providing these categories typically include landowner-invitee relationships, tavern owner-patron relationships, and relationships that create a duty to control the actions of another). Plaintiffs have not adequately established public policy imposes a legal duty. Plaintiffs do not provide any explanation as to why the FTCA, HIPAA, and Arizona Revised Statute § 12-2292 declare a public policy sufficient to create a tort duty. Arizona courts “exercise great restraint in declaring public policy.” Quiroz, 416 P.3d at 830. For a statute to create a civil duty, it must be “designed to protect the class of persons, in which the plaintiff is included, against the risk of the type of harm which has in fact occurred as result of the violation.” Gipson, 150 P.3d at 233; see also Sanchez-Ravuelta v. Yavapai County, 569 P.3d 47, 58 (Ariz. 2025) (“A statute cannot be the basis of a public policy duty if it does not require or prohibit certain conduct.”). “A public policy-based tort duty does not arise from the existence of an entire statutory scheme that implicitly seeks to protect the public at large from general types of harm.” Sanchez-Ravuelta, 569 P.3d at 60. The primary source for public policy tort duties in Arizona comes from state statute. Id. at 58. First, Arizona Revised Statute § 12-2292 relates to evidence in the courts and civil proceedings. Section 12-2292(A) provides medical and payment records are confidential and privileged and that “[a] health care provider may only disclose that part or all of a patient’s medical records and payment records as authorized by state or federal law or written authorization signed by the patient or the patient’s health care decision maker.” The statute covers a provider’s disclosures, i.e., some sort of affirmative disclosure, not the risk that a patient’s information is stolen and then disclosed by bad actors, nor does it require any relevant security measures to ensure confidentiality. See Perez, 564 P.3d at 630 (explaining a court may consider case-specific facts to determine whether a statute applies to a circumstance to give rise to a duty). Second, it is unclear how a physician’s Hippocratic Oath covers a hospital’s data security and Plaintiffs are not suing the physicians. Cf. Stanley v. McCarver, 92 P.3d 849, 854 n.6 (Ariz. 2004) (noting that while ethical rules may illuminate a standard of care, they do not provide a basis to impose a duty). And finally, this Court has found HIPAA and the FTCA do not establish a tort duty. Gannon v. Truly Nolen of Am. Inc., No. CV 22-428- TUC-JAS, 2023 WL 6536477, at *2 (D. Ariz. Aug. 31, 2023); see also Shepherd v. Costco Wholesale Corp., 482 P.3d 390, 396 (Ariz. 2021) (explaining that HIPAA may inform the standard of care but does not provide a private right of action). Given Plaintiffs’ lack of argument on the issue and the Court’s reasoning thus far, the Court declines to find public policy declares Yuma Regional owed a legal duty to Plaintiffs. In turn, Plaintiffs must then rely on their assumed duty theory. To inform whether a party has assumed a duty of care for the protection of another, Arizona courts look to the Restatement (Second) of Torts § 323 (1965). Dabush, 478 P.3d at 703 (citing § 323). Section 323 provides: One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of the other’s person or things, is subject to liability to the other for physical harm resulting from his failure to exercise reasonable care to perform his undertaking, if

(a) His failure to exercise such care increases the risk of such harm, or (b) The harm is suffered because of the other’s reliance upon the undertaking. Restatement (Second) of Torts § 323 (1965). This assumed duty is limited to the extent of the specific undertaking and is no broader than the undertaking actually assumed. Dabush, 478 P.3d at 704 (noting “the nature of the services undertaken must be for the specific purpose protecting against harm”). Assuming the Plaintiff’s allegations are sufficient for Yuma Regional to have undertaken an act to protect Plaintiffs from some type of harm, that harm is purely economic and not sufficient to trigger an actionable tort duty. (See Doc. 83 ¶¶ 231–32.) The Arizona Supreme Court has disavowed that § 323 provides a basis to establish liability for purely economic harm as opposed to claims involving physical harm to a person or property. See Cal-Am Properties, 509 P.3d at 391 n.1; see also Lips v. Scottsdale Healthcare Corp., 229 P.3d 1008, 1011 (Ariz. 2010) (noting the court’s reluctance to broadly recognize a duty to avoid causing purely economic loss); Calcut v. Paramount Residential Mortg. Grp. Inc., No. CV-22-01215-PHX-JJT, 2024 WL 233175, at *6 (D. Ariz. Jan. 22, 2024) (“[A] plaintiff alleging negligent performance of an undertaking must allege some sort of physical harm.”), aff’d, No. 24-764, 2025 WL 1341672 (9th Cir. May 8, 2025). Plaintiff has failed to establish sufficient grounds to find Yuma Regional assumed a duty to protect Plaintiffs against purely economic harms and thus has failed to state a negligence claim. B. Breach of Implied Contract Contracts may be express or implied. Barmat v. John & Jane Doe Partners A-D, 747 P.2d 1218, 1220–21 (Ariz. 1987) (“The distinction between an express contract and one implied in fact is that in the former the undertaking is made by words written or spoken, while in the latter conduct rather than words conveys the necessary assent and undertakings.”); Carroll v. Lee, 712 P.2d 923, 926 (Ariz. 1986) (noting there is no difference in legal effect between an express and implied contract). Plaintiffs carry the burden to prove existence of a contract, its breach, and the resulting damages. Thomas v. Montelucia Villas, LLC, 302 P.3d 617, 621 (Ariz. 2013). A valid contract requires “offer, acceptance of the offer, consideration, sufficient specification of terms so that the obligations involved can be ascertained, and the parties must have intended to be bound by the agreement.” Day v. LSI Corp., 174 F. Supp. 3d 1130, 1153 (D. Ariz. 2016) (citations omitted). Plaintiffs assert and argue that they provided Yuma Regional with money in exchange for care and by doing so, they entered into an implied contract in which Yuma Regional was obligated to deploy adequate security practices and safeguard their information. (See Doc. 83 ¶¶ 31–32, 233–48; Doc. 92 at 14.) Yuma Regional argues Plaintiffs’ claim fails because (1) they did not allege they actually read or relied on Yuma Regional’s Privacy Policy; (2) that Privacy Policy did not promise that a breach would not occur; and (3) any promise merely reflects Yuma Regional’s preexisting legal obligations. (Doc. 90 at 17–19.) Whether Yuma Regional promised to deploy “adequate” security measures is a conclusion unsupported by any alleged facts. Plaintiff’s main hook for their claim lies in Yuma Regional’s Notice of Privacy Practices and its Privacy Policy, which, as alleged, states that Yuma Regional is “committed to protecting the confidentiality of [its patients’] medical information” and that the patients should “expect that treatment records are confidential” unless they give permission to release the information. (Doc. 83 ¶¶ 31–32.) “Contract terms cannot be vaguely pleaded.” Griffey v. Magellan Health Inc., 562 F. Supp. 3d 34, 51 (D. Ariz. 2021); Jarvis v. Traka USA LLC, No. CV-24-08111-PCT- SMM, 2024 WL 4651937, at *11 (D. Ariz. Nov. 1, 2024). The vague reference that Yuma Regional is “committed to protecting” Plaintiffs’ information fails to provide any basis to infer how Yuma Regional would fulfill its commitment to protect the information. The Court cannot be left to “guess” how a party failed to perform its contractual obligations. Griffey, 562 F. Supp. 3d at 51. Plaintiffs do not plead any facts that support a contractual duty to prevent a data breach all together or that Yuma Regional promised to do anything beyond what it was already obligated to do under HIPAA or the FTCA. See, e.g., id. at 52 (finding a general promise to protect the plaintiffs’ information under a privacy policy did not suggest a promise beyond any pre-existing legal obligations and did not support a breach of implied contract claim); Gannon v. Truly Nolen of Am. Inc., No. CV 22-428- TUC-JAS, 2023 WL 6536477, at *3 (D. Ariz. Aug. 31, 2023); cf. Durgan v. U-Haul Int’l Inc., No. CV-22-01565-PHX-MTL, 2023 WL 7114622, at *4 (D. Ariz. Oct. 27, 2023) (finding that the plaintiffs adequately alleged the terms of an implied contract where the defendant’s privacy policy represented that it would use “commercially reasonable” precautions to safeguard the plaintiffs’ information and its systems).2 Therefore, there is

2 Plaintiffs cite Dearing v. Magellan Health Inc., No. CV 2020-013648, 2021 WL 7186207 (Ariz. Super. May 6, 2021) as its only relevant case out of Arizona in which the Superior Court stated, “it is difficult to imagine how, in our day and age of data and identity theft, the mandatory receipt of . . . sensitive personal information would not imply the recipient’s assent to protect the information sufficiently.” 2021 WL 7186207, at *4 (quoting Castillo v. Seagate Tech., LLC, 2016 WL 9280242, at *9 (N.D. Cal. Sept. 14, 2016)). Beyond conjecture, the court provided no meaningful analysis of how the assent to protect the information went beyond what the defendant was already legally obligated to perform. This Court has rejected similar reasoning and reliance on Castillo. See, e.g., Griffey, F. Supp. 3d at 52–53. Therefore, the Court finds Dearing unpersuasive and adopts its nothing to support that Yuma Regional assumed a contractual duty to support the claim.3 C. Breach of Fiduciary Duty Plaintiffs’ FAC now asserts a new claim, alleging that Yuma Regional breached a fiduciary duty. (See Doc. 83 ¶¶ 258–64.) Yuma Regional argues Arizona does not recognize that hospitals, as opposed to physicians, owe a fiduciary duty to patients. (Doc. 90 at 20–21 (citing Gonzales v. Palo Verde Mental Health Servs., 783 P.2d 833, 835 (Ariz. Ct. App. 1989)).) As a preliminary matter, the FAC’s allegations on this claim are conclusory and address the physician-patient relationship, not the hospital-patient or -customer relationship. (See Doc. 83 ¶¶ 258–64.) Plaintiffs also do not address Yuma Regional’s argument that, unlike for physicians, Arizona has not recognized that hospitals owe a fiduciary duty to patients. (See Doc. 92 at 19–20.); Gonzales, 783 P.2d at 835 (finding no authority that a hospital owes a fiduciary duty to a patient). Instead, Plaintiffs rely on cases addressing the physician-patient relationship without appreciating the distinction. See, e.g., Duquette v. Superior Court, 778 P.2d 634, 640 (Ariz. Ct. App. 1989); Hales v. Pittman, 576 P.2d 493, 496 (Ariz. 1978). Plaintiffs further rely on inapplicable cases. See, e.g., Taeger v. Cath. Fam. & Cmty. Servs., 995 P.2d 721, 726–30 (Ariz. Ct. App. 1999) (addressing whether there was a fiduciary duty between an adoption agency and adopting parents in which the agency collected information from the biological mother that was inaccessible to the adopting parents); In re Est. of Meinel, No. 2 CA-CV 2016-0032, 2016 WL 6108408, at *2–3 (Ariz. Ct. App. Oct. 19, 2016) (finding there was no fiduciary duty where the defendant facilitated the transfer of funds from the plaintiff’s joint account with her consent without disclosing a change in the beneficiary of the funds). “The law does not create a fiduciary relation in every business transaction involving one party with greater knowledge, skill, or training,

previous reasoning. 3 Because the Court finds no enforceable contract exists, Plaintiffs’ claim for breach of the implied covenant of good faith and fair dealing also necessary fails. In re Banner Health Data Breach Litig., No. CV-16-02696-PHX-SRB, 2017 WL 6763548, at *5 (D. Ariz. Dec. 20, 2017) (explaining a claim based on the implied covenant requires an enforceable promise). but requires peculiar intimacy or an express agreement to serve as a fiduciary.” Cook v. Orkin Exterminating Co., 258 P.3d 149, 152 (Ariz. Ct. App. 2011). It is not clear how a hospital’s collection of data establishes a confidential relationship with its customers or patients to establish a fiduciary duty. See, e.g., id. (noting a fiduciary duty is not established from a plaintiff’s mere trust in another’s competence or integrity). Further, Plaintiffs have not articulated a coherent and plausible basis for establishing a fiduciary duty exists under these circumstances beyond conclusory argument. Cf. id. (“Generally, commercial transactions do not create a fiduciary relationship unless one party agrees to serve in a fiduciary capacity.”). Therefore, the Court finds Plaintiffs have failed to state a claim. D. Unjust Enrichment Under Arizona law, “[u]njust enrichment occurs when one party has and retains money or benefits that in justice and equity belong to another.” Loiselle v. Cosas Mgmt. Group, LLC, 228 P.3d 943, 946 (Ariz. Ct. App. 2010). A party must allege: “(1) an enrichment, (2) an impoverishment, (3) a connection between the enrichment and the impoverishment, (4) the absence of justification for the enrichment and the impoverishment, and (5) the absence of a remedy provided at law.” Span v. Maricopa Cnty. Treasurer, 437 P.3d 881, 886 (Ariz. Ct. App. 2019). As an initial matter, Plaintiffs have not alleged or argued there is an absence of justification. (See Doc. 83 ¶¶ 250–57; Doc. 92 at 17–19.) Plaintiffs allege that Yuma Regional received a “benefit” from the receipt, possession, and use of their information and from compensation they paid for medical services, which they contend that some of the money should have gone to adequate data security. (Doc. 83 ¶¶ 251–52.) Mere receipt of a benefit is insufficient to establish a claim for unjust enrichment. Murdock-Bryant Const., Inc. v. Pearson, 703 P.2d 1197, 1203 (Ariz. 1985). A plaintiff must demonstrate that through receipt of that benefit, the defendant was unjustly enriched at the plaintiff’s expense. Pyeatte v. Pyeatte, 661 P.2d 196, 202 (Ariz. Ct. App. 1982). Plaintiffs allege that Yuma Regional “wrongfully accepted and retained benefits at [their] expense. This enrichment is at [their] expense, and is unjust.” (Id.) These allegations are conclusory and do not provide factual support for any purported detriment and benefit. (See Doc. 83 ¶ 256.) As a general matter, to determine whether unjust enrichment has occurred, courts view the parties’ obligations to one another in view of the larger context of their transaction. Span, 437 P.3d at 886. First, Plaintiffs have failed to articulate how mere receipt, as opposed to inadvertent disclosure, of their information and Yuma Regional’s use of that information to provide them with medical care and to facilitate payment collection for both of their benefits caused any detriment or expense to Plaintiffs that they did not willingly incur. Plaintiffs’ alleged detriment seemingly lies in the reduced value of their information after the breach. But any value Yuma Regional derived from receipt and retention of the information is long gone after the hospital-customer relationship ceased, i.e., after Yuma Regional’s provision of medical care and payment services to Plaintiffs. Plaintiffs do not allege that Yuma Regional derives any quantifiable benefit from that information beyond the initial hospital-customer relationship. To extent Yuma Regional possibly derives some sort of abstract benefit from the continued retention of the information after the breach, any lost value to that information caused by the breach reasonably affected the value of the information in the hands of both Plaintiffs and Yuma Regional. In other words, Yuma Regional was not unjustly enriched at Plaintiffs’ expense based on collection and retention of information alone. See Pyeatte, 661 P.2d at 202. Second, any benefit purportedly conveyed to Yuma Regional based on monies Plaintiffs paid for medical services they intended to cover adequate security measures calls for rank speculation that unjust enrichment has occurred. Plaintiffs’ allegations that they intended for a portion of the amount they paid to Yuma Regional for medical services to also cover adequate security measures is irrelevant. Murdock-Bryant, 703 P.2d at 1203 (“[T]he duty to compensate for unjust enrichment is an obligation implied by law without reference to the intention of the parties.”). And even if they expected that a portion of the payment to go to security, there are no allegations to support that Plaintiffs expected to be repaid some amount of this money upon a data breach in the effect those security measures proved to be inadequate. See, e.g., Pyeatte, 661 P.2d at 203 (noting a duty to compensate may not be imposed “if it is clear that there was indeed no expectation of payment” (citation omitted)). Plaintiffs cite Hannibal-Fisher v. Grand Canyon Univ., 523 F. Supp. 3d 1087 (D. Ariz. 2021) for the proposition that alleging that they did not receive what they paid for is sufficient to state a claim. (See Doc. 92 at 18–19.) In that case, the plaintiffs paid for housing costs and fees but that the defendants did not provide housing during the COVID-19 pandemic and effectively required students to return home, including the plaintiffs, without refunding the amounts paid. See Hannibal-Fisher, 523 F. Supp. 3d at 1096, 1097–98. This Court reasoned that the plaintiffs did not receive what they paid for, and so the impoverishment was directly linked to the defendant’s enrichment. Id. Compared to the circumstances here, the issue in Hannibal-Fisher was fairly straight- forward—the plaintiffs did not receive the housing for which they paid. Here, Plaintiffs’ issue lies in the adequacy of the security they received, not the lack of security all together. This is an important distinction in this case. Perhaps if Yuma Regional retained the funds that had been specifically earmarked for data security this case would be different. But that is not Plaintiffs’ claim. The Court finds no basis to conclude that Yuma Regional unjustly retained a benefit. At bottom, Plaintiffs’ allegations are the Yuma Regional spent the money on its security systems, albeit those systems were inadequate to prevent the breach. Yuma Regional’s ineffective use of the funds does not provide a plausible basis to find it retained some benefit to Plaintiffs’ detriment. Yuma Regional did not retain the money, it spent the money in part to protect Plaintiffs’ information. See Wang Elec., Inc. v. Smoke Tree Resort, LLC, 283 P.3d 45, 50–51 (Ariz. Ct. App. 2012) (noting “unjust enrichment should not be used to saddle entities with expenses they chose not to incur”). Whatever benefit remains is unidentified. Plaintiffs’ conclusion that Yuma Regional was somehow unjustly enriched under these circumstances lacks factual support and does not squarely fit the claim. Under the ACFA, it is unlawful for any person to use or employ “any deception, deceptive or unfair act or practice, fraud, false pretense, false promise, misrepresentation, or concealment, suppression or omission of any material fact with intent that others rely on such concealment, suppression or omission, in connection with the sale or advertisement of any merchandise.” Ariz. Rev. Stat. § 44-1522(A). Generally, like common law fraud claims, claims under this statute are based on affirmative misrepresentations, concealment, or omission of material fact. Tavilla v. Cephalon, Inc., 870 F. Supp. 2d 759, 776 (D. Ariz. 2012), on reconsideration in part (May 30, 2012). To state a claim under the ACFA, “a plaintiff must show (1) a false promise or misrepresentation made in connection with the sale or advertisement of ‘merchandise,’ and (2) consequent and proximate injury resulting from the misrepresentation.” Watts v. Medicis Pharmaceutical Corp., 365 P.3d 944, 953 (Ariz. 2016) (citing Kuehn v. Stanley, 91 P.3d 346, 351 (Ariz. Ct. App. 2004)). Federal Rule of Civil Procedure 9(b)’s particularity requirement applies to state law causes of action relating to fraud. Irving Firemen’s Relief & Ret. Fund v. Uber Techs., Inc., 998 F.3d 397, 404 (9th Cir. 2021) (citation omitted) (noting the pleading must give ample notice of the loss causation theory and provide the court some assurance the theory has a basis in fact). A plaintiff filing a ACFA fraud-by-omission claim, however, “faces a slightly more relaxed burden, due to the fraud-by-omission plaintiff’s inherent inability to specify the time, place, and specific content of an omission in quite as precise a manner.” Griffey, 562 F. Supp. 3d at 53–54. These plaintiffs must articulate the “how.” Id. at 54. Plaintiffs appear to assert their claim based on nearly all conceivable theories—deceptive acts, deceptive practices, omissions, and concealment. (See Doc. 83 ¶ 268.) The parties dispute centers on the disclosures, or lack thereof, within Yuma Regional’s Notice of Privacy Practices and Privacy Policy and its alleged concealment or omission of the inadequacies of its security systems. (Doc. 90 at 22; Doc. 92 at 20–21; Doc. 83 ¶¶ 269–71.) As noted, Yuma Regional’s Notice of Privacy Practices states that it is “committed to protecting the confidentiality” of its patient’s medical information and its Privacy Policy on its website indicated that the patients could “expect that treatment records are confidential” absent their permission to release them. (Doc. 83 ¶¶ 31–32.) The Court begins with Plaintiffs’ allegations to the extent they are based on affirmative deceptive acts or practices. An affirmative misrepresentation requires that the plaintiff to have actually relied on the statement even if that reliance is unreasonable. Cheatham v. ADT Corp., 161 F. Supp. 3d 815, 825–26 (D. Ariz. 2016) (distinguishing this requirement from common law fraud claims). There are no factual allegations to support that Plaintiffs relied on any statements in the Privacy Policy listed on Yuma Regional’s website. (See, e.g., Doc. 83 ¶¶ 33, 275 (stating vaguely and in general terms that Plaintiffs “relied on these representations” and “relied on the concealed facts”). For each Plaintiff, their allegations are nearly identical and assert that they were “provided and reviewed” only the Notice of Privacy Practices when receiving care. (See id. ¶¶ 47, 58, 70, 79, 89, 101, 113, 124, 137, 148, 158.) Plaintiffs do not articulate how Yuma Regional stating that it is “committed to protecting” its patients’ confidential information is an actionable or deceptive misstatement of fact. Deceptive acts or practices include representations that have a “tendency or capacity” to convey misleading impressions to consumers. Madsen v. W. Am. Mortg. Co., 694 P.2d 1228, 1232 (Ariz. Ct. App. 1985) (noting “the test is whether the least sophisticated reader would be misled” from “all that is reasonably implied”). Subjective characterizations of a service do not give rise to a fraud claim because they do not describe a specific or absolute characteristic of the service that is objectively verifiable or false. See, e.g., Cheatham, F. Supp. 3d at 827–29 (discussing inactionable “puffery” in the context of an ACFA claim based on an affirmative statement). This Court has found similar statements inactionable as too far removed from being a statement of fact, including a statement that “we are committed to providing you with state-of-the-art equipment and service.” Id. at 822, 829. Here, the Court tends to agree with that outcome. Plaintiffs issue lies not with Yuma Regionals commitment to protecting the information as a matter of objective fact but rather its adequacy in effectuating that commitment.4 Therefore, a theory premised on an affirmative and deceptive misrepresentation does not support Plaintiffs’ ACFA claim. At its core, the substance Plaintiffs’ claim is really premised on Yuma Regional omitting facts pertaining to how it would protect its patients’ confidential information. As such, Plaintiffs face a “slightly more relaxed burden” due to their “inherent inability to specify the time, place, and specific content of an omission in quite as precise a manner.” In re Banner Health Data Breach Litig., 2017 WL 6763548, at *7 (citation omitted). Here, Plaintiffs have specifically identified Yuma Regional’s Notice of Privacy Practices that allegedly omitted information about its inadequate data security systems. (See Doc. 83 ¶ 270.) Plaintiffs have also alleged that they relied on these omissions and were required to provide written acknowledgement that they received the Notice. (See id. ¶¶ 31, 33, 275.) In accepting these allegations as true, which the Court must do at this stage, the Court finds these allegations sufficiently raise a plausible inference that Plaintiffs were aware of Yuma Regional’s privacy practices and would have acted differently had Yuma Regional disclosed the alleged security deficiencies. See, e.g., In re Banner Health Data Breach Litig., 2017 WL 6763548, at *7 (finding the plaintiff adequately stated a claim under similar circumstances). Therefore, the Court will deny Yuma Regional’s Motion to Dismiss on this ground. Accordingly, IT IS HEREBY ORDERED granting in part Defendant’s Motion to Dismiss

4 Additionally, Yuma Regional’s representation is essentially a generic pledge that it was committed to protect Plaintiffs’ information going forward. “When the promise is made without a present intent to perform, an action for fraud will lie.” Correa v. Pecos Valley Dev. Corp., 617 P.2d 767, 771 (Ariz. Ct. App. 1980); but see Powers v. Guar. RV, Inc., 278 P.3d 333, 338 (Ariz. Ct. App. 2012) (noting this does not require a specific intent to deceive). The fact that the breach later occurred does not provide a factual basis to establish intent. See, e.g., McAlister v. Citibank, 829 P.2d 1253, 1260 (Ariz. Ct. App. 1992) (explaining an intent not to perform must be established independent of a showing of a defendant’s failure to perform). All of Plaintiffs allegations relate to inadequacies revealed by the breach itself and based on post-hoc commentary, i.e., that there were gaps in the system, there was a small data security team, and there was allegedly inadequate training for employees. (See Doc. 83 ¶¶ 35–42.) (Doc. 90). The Motion is denied as to Plaintiffs’ ACFA claim and granted as to all other claims. IT IS FURTHER ORDERED dismissing Plaintiffs’ negligence, breach of implied contract, unjust enrichment, and breach of fiduciary duty claims in Doc. 83. Dated this 13th day of August, 2025. . SO ts g A lonorable Susan M. Brnovich United States District Judge

-16-