K.A. v. Children's Mercy Hospital

• Court: District Court, W.D. Missouri
• Decided: May 16, 2019
• Docket: 4:18-cv-00514
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF MISSOURI WESTERN DIVISION K.A., BY AND THROUGH HER ) NEXT FRIEND B.W. INDIVIDUALLY ) AND ON BEHALF OF ALL OTHERS ) SIMILARLY SITUATED; ) ) Case No. 4:18-00514-CV-RK Plaintiff, ) ) v. ) ) CHILDREN’S MERCY HOSPITAL, ) ) Defendant. ) ORDER Plaintiff K.A., a minor, by her next friend and mother, B.W., brings this putative class action for damages against Defendant Children’s Mercy Hospital. Before the Court is a motion for judgment on the pleadings filed by Defendant. (Doc. 15.) The motion is fully briefed. (Docs. 16, 22, 23.) Supplemental briefing has been filed and oral argument held on the issue of Article III standing. (Docs. 29, 30.) For the reasons below, the motion is GRANTED in part. The Court concludes that Plaintiff’s Complaint fails to state a claim for breach of contract in Count III. Plaintiff may file a motion for leave to amend the Complaint that complies with Local Rule 15.1 within thirty days from the date of this Order. (Doc. 27.) If Plaintiff cannot cure the deficiencies in Count III by an amended complaint, Counts III will be dismissed. Background Defendant is a health care provider that offers healthcare and medical treatment services. As a health care provider, Defendant generates and stores medical records, including Plaintiff’s medical records, which include sensitive information concerning patients’ treatment and identification. Defendant posts a notice on its website regarding its privacy practices.1

1 The notice states: Our Responsibilities Children’s Mercy Hospital is required to: • Keep your child’s health information private • Provide you with a notice (this document) of the hospital’s legal duties and privacy practices with respect to information it collects and maintains about your child • Follow the terms of this notice In March 2017, an employee of Defendant created an unauthorized website that contained patients’ private treatment and identification information (the “Website”). Two months later, Defendant sent Plaintiff a letter notifying her of the Website. Plaintiff then filed suit in Missouri state court on behalf of a putative class asserting the following claims against Defendant: violation of Missouri’s Merchandising Practices Act (“MMPA”) (Count I), breach of fiduciary duty (Count II), breach of contract (Count III), negligent training, hiring, and supervision (Count IV), and negligence (Count V). Defendant removed the case pursuant to this Court’s diversity jurisdiction under the Class Action Fairness Act, 28 U.S.C. § 1332(d), answered the allegations and now moves this Court for judgment on the pleadings under Federal Rule of Civil Procedure 12(c). Discussion The Court begins by addressing the issue of standing because standing is jurisdictional and required to open the door to federal court. See Doe v. Chao, 540 U.S. 614, 624-25 (2004). Then, the Court turns to instant motion in which Defendant challenges the factual and legal sufficiency of Plaintiff’s state law claims. It is undisputed that Plaintiff’s claims are governed by Missouri substantive law. See Shady Grove Orthopedic Assocs., P.A. v. Allstate Ins. Co., 559 U.S. 393, 417 (2010) (“[F]ederal courts sitting in diversity apply state substantive law and federal procedural law.”) (citation and internal quotations omitted).

• Notify you if the hospital is unable to agree to a limit requested by you on the use or disclosure of your child’s health information • Try to meet reasonable requests you may have to communicate health information by other means or at other locations The hospital reserves the right to change its practices and to be sure the new practices keep all health information safe. Should the hospital’s health information practices change, it will post a revised notice on its web page (www.childrensmercy.org <>), throughout its facilities, and will have copies available for you to take with you. The hospital will apply any changes to all health information regardless of when created or received.

The hospital will not use or disclose your child's health information without your or your child’s permission, except as described in this notice or allowed by law

https://www.childrensmercy.org/HealthInformationPractices/ (Doc. 1-2 at 2-3) (emphasis in original). I. Standing Although both parties assert that Plaintiff has standing, the Court is “under an independent obligation to examine [its] own jurisdiction, and standing is perhaps the most important of the jurisdictional doctrines.” Nolles v. State Comm. for the Reorganization of Sch. Dists, 524 F.3d 892, 897 (8th Cir. 2008); see Carlsen v. GameStop, Inc., 833 F.3d 903, 908 (8th Cir. 2016) (“[I]f a plaintiff lacks standing to sue, the district court has no subject-matter jurisdiction.”). “Federal courts are courts of limited jurisdiction, cabined by the authority granted to them by Article III of the United States Constitution.” Nolles, 524 F.3d at 897. Article III limits federal courts’ jurisdiction to deciding cases and controversies. U.S. Const. art III, § 2. “One of the controlling elements in the definition of a case or controversy under Article III is standing.” Id. at 897-98. (citations and internal quotations omitted). “Constitutional standing requires a showing of: (1) an injury in fact, which is an invasion of a legally protected interest that is concrete, particularized, and either actual or imminent; (2) causation; and (3) redressability.” Curry v. Regents of the Univ., 167 F.3d 420, 422 (8th Cir. 1999). In this case, the issue implicated by the parties’ briefs is whether Plaintiff suffered an injury in fact. “A plaintiff who has ‘produced facts indicating it was a party to a breached contract’ has a judicially cognizable interest for standing purposes, regardless of the merits of the breach alleged.” Carlsen, 833 F.3d at 909 (citation omitted). Here, in accordance with Eighth Circuit case law, Plaintiff’s allegations are sufficient to confer Article III standing regarding her breach of contract claim. Plaintiff alleged that Defendant’s notice constitutes an agreement with its patients. Plaintiff alleged that Defendant breached its agreement with Plaintiff when it failed to implement security measures to fulfill its agreement, which resulted in Plaintiff suffering the diminished value of her bargain. Although the allegations contained in the Complaint are broad and conclusory, facts establishing the legal conclusion of a valid, enforceable contract are not required to assert standing in a breach-of-contract claim. Carlsen, 833 F.3d at 909. Further, the Court is bound by the Eighth Circuit’s admonishment that “[i]t is crucial . . . not to conflate Article III’s requirement of injury in fact with a plaintiff’s potential causes of action, for the concepts are not coextensive.”2 Id.; see Kuhns v. Scottrade, Inc., 868 F.3d 711, 715-716 (8th Cir. 2017) (analyzing standing for breach of contract claims in data breach case) (Carlsen is controlling).

2 For this reason, despite addressing standing sua sponte, the Court disagrees with Plaintiff that Defendant’s motion is essentially a challenge to standing. (Doc. 22 at 9-10.) The Court further concludes that Plaintiff has standing to bring her other claims. As to the claim brought under the MMPA, the statute “provides a private right of action to any person who sustains ascertainable loss in connection with the purchase or lease of merchandise as a result of certain practices declared unlawful.” Kuhns v. Scottrade, Inc., 868 F.3d 711, 719 (8th Cir. 2017) (citing RSMo. § 407.025(1)). Here, Plaintiff alleges she overpaid for health care services from Defendant due to the inadequate protection of her medical records, and she therefore has standing to bring her claim under the MMPA. (Doc. 1-2 at ¶ 35.) See Carlsen, 833 F.3d at 910 (finding standing to bring Minnesota consumer protection claim based on similar allegations). Additionally, for each of her claims, Plaintiff alleges she was injured due to inadequate protection of her medical records because she thereby lost the benefit of her bargain. See Kuhns, 868 F.3d at 716 (finding standing for breach of contract claims as well as statutory consumer protection claim after determining that plaintiff had standing regarding his breach of contract claims).3 The Court now turns to the instant motion for judgment on the pleadings. II. Motion for Judgment on the Pleadings A. Legal Standard “After the pleadings are closed—but early enough not to delay trial—a party may move for judgment on the pleadings.” Fed. R. Civ. P. 12(c). “A defense of failure to state a claim may be raised in such a motion, see Fed. R. Civ. P. 12(h), and we employ the same standard that we would have employed had the motion been brought under Rule 12(b)(6).” St. Paul Ramsey Cty. Med. Ctr. v. Pennington Cty., 857 F.2d 1185, 1187 (8th Cir. 1988). To survive a motion to dismiss under Rule 12(b)(6), a complaint must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is plausible if “the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).

3 The Complaint’s allegations of heightened risk of identity theft are insufficient to confer standing on Plaintiff. Despite Defendant’s characterization (Doc. 29 at 4), Plaintiff does not allege that her personal information was stolen or actually disclosed to anyone. These allegations are not adequate to demonstrate that plaintiff faces a “certainly impending” or “substantial risk” of identity theft as a result of the Website. Alleruzzo, 870 F.3d at 769 (internal quotations omitted). Accordingly, the Court concludes that the Complaint’s allegations of future injury are speculative, and do not support standing. See Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (“Although imminence is concededly a somewhat elastic concept, it cannot be stretched beyond its purpose, which is to ensure that the alleged injury is not too speculative for Article III purposes--that the injury is certainly impending.”) (emphasis in original); id. at 410 (objectively reasonable likelihood of harm is insufficient). The Court “accept[s] the well-pled allegations in the complaint as true and draw[s] all reasonable inferences in the plaintiff’s favor.” Meiners v. Wells Fargo & Co., 898 F.3d 820, 821 (8th Cir. 2018). “[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct, the complaint has alleged—but it has not ‘show[n]’—‘that the pleader is entitled to relief.’” Iqbal, 556 U.S. at 679; Twombly, 550 U.S. at 570 (factual allegations must “cross the line from conceivable to plausible”). B. Breach of Contract Claim (Count III) “A breach of contract action includes the following essential elements: (1) the existence and terms of a contract; (2) that plaintiff performed or tendered performance pursuant to the contract; (3) breach of the contract by the defendant; and (4) damages suffered by the plaintiff.” Keveney v. Mo. Military Acad., 304 S.W.3d 98, 104 (Mo. banc. 2010). “The elements required to form a valid contract in Missouri are ‘offer, acceptance, and bargained for consideration.’” Whitworth v. McBride & Son Homes, Inc., 344 S.W.3d 730, 737 (Mo. App. 2011) (quoting Johnson v. McDonnell Douglas Corp., 745 S.W.2d 661, 662 (Mo. banc 1988)). Defendant argues that Plaintiff’s breach of contract claim fails because Plaintiff fails to plausibly allege the existence of a contract. Plaintiff alleges, in conclusory fashion, that the online notice of privacy practices posted on Defendant’s website constitutes a contract between her and Defendant. Plaintiff pleads no facts to show that statements in the notice created a contractual relationship. Plaintiff pleads no facts to show offer, acceptance, or consideration. Apart from the notice, Plaintiff does not attach or plead the existence of a contract. Plaintiff fails to allege facts from which the Court can reasonably infer the existence of a contract between Plaintiff and Defendant. See Iqbal, 556 U.S. at 678 (plausibility standard asks for more than a sheer possibility that a defendant has acted unlawfully). In responding to Defendant’s motion, Plaintiff asserts that a contract was formed when Plaintiff submitted patient data to Defendant, but fails to provide authority or discussion of the required contract elements to support this position.4 Accepting the

4 Plaintiff appears to be creating contractual terms from the privacy practices notice which Defendant is required to provide under the privacy regulations of Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Compare 45 C.F.R. §§ 164.520(b)(1)(ii)(E), 164.520(b)(1)(v)(A)- (C), 164.522(b)(1)(i), with Doc. 1-2 at ¶ 10 (Children’s Mercy Hospital is required to . . . Provide you with a notice (this document) of the hospital’s legal duties and privacy practices with respect to information it collects and maintains about your child). HIPAA does not create a private right of action but allows patients to file complaints alleging HIPAA violations with the federal government which could result in the imposition of money penalties on the violating covered entity (e.g., health care provider), 54 CFR Part 160, Subpart D. Although a patient can sue over an alleged HIPAA violation and obtain damages for violations well-pled allegations as true and viewing them in Plaintiff’s favor, Plaintiff fails to plausibly allege the existence of a contract between Plaintiff and Defendant.5 C. MMPA Claim (Count I) “The MMPA provides a private right of action to any person who sustains ascertainable loss in connection with the purchase or lease of merchandise as a result of certain practices declared unlawful.” Kuhns v. Scottrade, Inc., 868 F.3d 711, 719 (8th Cir. 2017) (citing RSMo. § 407.025(1)). “The MMPA requires plaintiffs to prove that they . . . suffered an ascertainable loss of money or property as a result of an act declared unlawful under RSMo. § 407.020.” Binkley v. Am. Equity Mortg., Inc., 447 S.W.3d 194, 198 (Mo. banc. 2014). Defendant raises two arguments for why Plaintiff’s MMPA claim fails: (1) because Plaintiff fails to plausibly allege an ascertainable pecuniary loss, and (2) because Plaintiff fails connect any such loss to an actionable misrepresentation or practice. Neither argument is sufficiently supported. First, to determine whether a plaintiff has suffered an ascertainable loss, Missouri courts apply the benefit-of-the-bargain rule. Kelly v. Cape Cod Potato Chip Co., 81 F. Supp. 3d 754, 758 (W.D. Mo. 2015) (citing Sunset Pools v. Schaefer, 869 S.W.2d 883, 886 (Mo. App. 1994)); Plubell v. Merck & Co., 289 S.W.3d 707, 715 (Mo. App. 2009) (benefit-of-the-bargain rule applicable in MMPA cases to meet the element of ascertainable loss). Under the benefit of the bargain rule as applied to MMPA claims, a plaintiff can recover damages for “the difference between the actual value of the property and what its value would have been if it had been as represented.” Id. Here, Plaintiff alleges that Defendant’s privacy practices posted on its website stated that “[e]fforts to maintain the privacy and confidentiality of medical records are part of the healthcare services[;]”and that as a result of Defendant’s unlawful practices, she suffered by paying more for

of state laws, the door to federal court is not available in lawsuits where the plaintiff does not have Article III standing.

5 In addition to arguing insufficient existence of a contract, Defendant also argues that Plaintiff’s breach of contract claim separately fails for lack of damages. Based on the authority and discussion presented, Defendant does not persuasively support this argument. Defendant relies on Carlsen v. Gamestop, Inc., 833 F.3d 903, 907 (8th Cir. 2016). Defendant’s reliance is misplaced because in Carlsen, the Eighth Circuit affirmed the dismissal of a breach of contract claim based on a 12(b)(6) analysis not for lack of damages, but because the express terms of the privacy policy, which was the purported contract, did not encompass the information that was wrongfully disclosed. Id. at 911. medical record privacy protections than she otherwise would have and by paying for medical record privacy protections that she did not receive. (Doc. 1-2 at ¶¶ 35, 40.) Accepting the well- pled allegations as true and viewing them in Plaintiff’s favor, as it must, the Court finds that Plaintiff has plausibly alleged an ascertainable loss. See Kelly, 81 F. Supp. 3d at 759 (“Plaintiff need only allege that the actual value of the product as purchased was less than the value of the product as represented to state a claim for an ascertainable loss.”) Defendant also argues that Plaintiff’s MMPA claim fails because Plaintiff has not connected a pecuniary loss to any actionable practice. Based on the authority and discussion presented, Defendant does not persuasively support this argument. Defendant relies on two district court decisions: Amburgy v. Express Scripts, Inc., 671 F. Supp. 2d 1046 (E.D. Mo. 2009) (applying Missouri law) (plaintiff’s MMPA claim fails to state a claim where he does not allege that his loss was in relation to his purchase) and Cox v. Valley Hope Ass’n, 2016 U.S. Dist. LEXIS 119663 (W.D. Mo. Sep. 6, 2016) (determining that similar allegations of overpayment under an MMPA claim did not confer standing). Defendant does not, however, discuss how Missouri courts have construed the MMPA’s requirement that “an unlawful act [must be] committed ‘in connection with’ the sale.” Conway v. Citimortgage, Inc., 438 S.W.3d 410, 414 (Mo. banc 2014) (citing RSMo. § 407.020(1)); id. at 416 (concluding that the MMPA’s phrase “in connection with” does not require a plaintiff to have a direct contractual relationship). Therefore, Defendant’s motion to dismiss Count I is denied. D. Common Law Tort Claims (Counts II, IV, and V) “Any action for negligence requires the plaintiff to establish that . . . the plaintiff’s injury was proximately caused by the defendant’s failure.” Jarrett v. Jones, 258 S.W.3d 442, 448 (Mo. banc 2008). Similarly, “[t]o prevail on a claim of breach of fiduciary duty, a plaintiff must show . . . harm.” Brown v. Brown, 530 S.W.3d 35, 41 (Mo. App. 2017). Defendant argues that Plaintiff’s tort claims fail because Plaintiff has not alleged a compensable injury under Missouri law for two reasons. First, Defendant argues that Plaintiff’s damages theory of heightened future risk of identity theft fails as a matter of law. This argument is now moot because the argument is merits-based, however, the Court has determined that the Complaint’s allegations of heightened risk of identity theft are insufficient to confer standing on Plaintiff. See supra note 3. Therefore, Plaintiff cannot pursue this relief. Second, Defendant argues that Plaintiff’s damages theory of lost benefit of the bargain is barred by Missouri’s economic loss doctrine. “The economic loss doctrine prohibits a party from seeking to recover in tort for economic losses that are contractual in nature.” Graham Constr. Servs. v. Hammer & Steel Inc., 755 F.3d 611, 616 (8th Cir. 2014) (citation and internal quotations omitted). However, Defendant’s economic loss doctrine argument is inapplicable because as determined above in section II.B, Plaintiff has not plausibly pled a breach of contract claim. The Court notes that were the economic loss doctrine to apply, Defendant does not address the exception to the economic loss doctrine relied on by Plaintiff. See Web Innovations & Tech. Servs. v. Bridges to Dig. Excellence, Inc., 69 F. Supp. 3d 928, 932 (E.D. Mo. 2014) (citing Bruce Martin Constr., Inc. v. CTB, Inc., No. 1:10CV205 SNLJ, 2012 WL 718624, at *3 (E.D. Mo. Mar. 6, 2012)) (exception to the economic loss doctrine where tort claims either involve a fiduciary relationship or rendering of professional services). Moreover, regarding Plaintiff’s tort claims, Plaintiff has also pleaded that she has suffered other damages including embarrassment, humiliation, and loss of enjoyment of life. Defendant does not address or challenge these alleged damages. Therefore, Defendant’s motion to dismiss Plaintiff’s tort claims in Counts II, IV, and V is denied.6

6 The Court is allowing the common law tort claims to go forward. In doing so, the Court recognizes that although proof of monetary damages may not be required for a breach of fiduciary duty claim, see Fierstein v. Depaul Health Ctr., 24 S.W.3d 220, 224 (Mo. App. 2000), Plaintiff has not persuasively argued her position that she can claim presumed damages. For instance, Plaintiff cites Munden v. Harris, 134 S.W. 1076, 1077-1078 (Mo. App. 1911) and Y.G., et al. v. Jewish Hospital of St. Louis, 795 S.W.2d 488, 500 (Mo. App. 1990), which involve the tort of invasion of privacy, which is a separate from negligence, Hyde v. City of Columbia, 637 S.W.2d 251, 267 (Mo. App. 1982). Plaintiff also cites cases that recognize the existence and elements of a cause of action for a physician or healthcare provider’s wrongful disclosures of medical information. Brandt v. Med. Def. Assocs., 856 S.W.2d 667, 674 (Mo. 1993) (“a physician has a fiduciary duty of confidentiality not to disclose any medical information received in connection with the treatment of the patient”); Fierstein v. Depaul Health Ctr., 24 S.W.3d 220, 224 (Mo. App. 2000) (breach of fiduciary duty claim against healthcare provider where plaintiff’s medical records were disclosed to a third party without plaintiff’s authorization). First, Plaintiff does not allege that her personal information was stolen or actually disclosed to anyone. Assuming arguendo that Plaintiff had plead an actual disclosure, none of the cases support that wrongful disclosure of medical information, in and of itself, gives rise to a cognizable theory of damages under Missouri law. In fact, the Court of Appeals in Fierstein upheld a verdict director which required proof that “as a direct result of such disclosure, [p]laintiff suffered damage.” 24 S.W.3d at 226. Conclusion Defendant’s motion for judgment on the pleadings is therefore GRANTED in part. (Doc. 15.) The Court concludes that Plaintiff’s Complaint fails to state a claim for breach of contract in Count III. Plaintiff may file a motion for leave to amend the Complaint that complies with Local Rule 15.1 within thirty days from the date of this Order. (Doc. 27.) If Plaintiff cannot cure the deficiencies in Count III by an amended complaint, Count III will be dismissed. IT IS SO ORDERED. s/ Roseann A. Ketchmark ROSEANN A. KETCHMARK, JUDGE UNITED STATES DISTRICT COURT DATED: May 16, 2019