Princeton Community Hospital Association Inc. v. Nuance Communications, Inc.

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF WEST VIRGINIA AT BLUEFIELD PRINCETON COMMUNITY HOSPITAL ASSOCIATION, INC., Plaintiff, v. CIVIL ACTION NO. 1:19-00265 NUANCE COMMUNICATIONS, INC., Defendant. AMENDED MEMORANDUM OPINION On March 31, 2020, the court denied defendant’s motion to dismiss. The reasons for that decision follow. I. Background This civil action arises out of a data breach that occurred on June 27, 2017. See Complaint ¶ 1. Plaintiff Princeton Community Hospital Association, Inc. (“PCH”) alleges that software from defendant Nuance Communications, Inc. (“Nuance”) was integrated into PCH’s hospital computer network. See id. at ¶ 2. According to PCH, the “Nuance system was infected by malicious malware that embedded and destroyed all data. Shortly thereafter, the same malicious malware encrypted PCH’s entire computer health network and destroyed all data content.” Id. at ¶ 3. PCH contends that Nuance is responsible for PCH’s total damages in the amount of approximately $6.8 million, net of payments from PCH’s insurers. See id. at ¶ 4. The complaint alleges breach of contract and negligence on the part of Nuance. See id. at ¶¶ 75-86. Nuance removed the case to this court on the basis of diversity jurisdiction. PCH moved to remand the case to state court and, on March 31, 2020, the remand motion was denied. A Healthcare Master Agreement (“Master Agreement”) establishes the contractual obligations of the parties. The Master Agreement provides in relevant part: 12. LIMITATION OF LIABILITY 12.1 The following provisions set out the exclusions and limitations of liability of Nuance and its Affiliates, and their respective officers, agents, contractors and employees, to [PCH] . . ., under or in connection with this Agreement, and/or in connection with any tortious act or omission including without limitation negligence and/or breach of duty including statutory duty arising under or in connection with this Agreement. 12.2 Nothing in this Agreement shall be taken to exclude or limit Nuance’s liability for fraud or fraudulent misrepresentation, for intentional or criminal misconduct; for death, personal injury or tangible property damage caused by its negligence in providing services at Company locations; or to the extent that such exclusion or limitation is not otherwise permitted by law. 12.3 Subject to the foregoing provisions of this Section, Nuance shall not be liable for loss of profits or revenues, loss of anticipated savings, loss of customers, or loss of use of any software or Data, nor for any special, consequential or indirect loss or damage, costs, expenses or other claims for consequential compensation, however caused, which arise out of or in connection with this Agreement or the Services. 12.4 Save for Nuance’s liability under the second subsection of this Section 12 (“Limitation of Liability”), which shall not be excluded or limited under this Agreement, the Parties, having assessed the risks, agree that Nuance’s total liability shall not 2 exceed for each consecutive 12 months period (“Annual Period”) of this Agreement (the first period commencing on the Effective Date) an aggregate amount equal to 100% of the amount paid by the Company during the corresponding Annual Period. * * * 14. MISCELLANEOUS * * * 14.2 Force Majeure. Except for the obligation to make payments, nonperformance of either Party shall be excluded to the extent that performance is rendered impossible by strike, fire, flood, acts of God, governmental acts or orders or restrictions, acts of terrorism, war, failure of suppliers, or any other reason where failure to perform is beyond the reasonable control of the nonperforming Party and not due to its fault or negligence. * * * 14.5 Governing Law. This Agreement shall be governed by the laws of the State of West Virginia, USA, without regard to choice of law rules, and Company hereby submits to the jurisdiction of the federal and state courts located in said State and the applicable service of process. . . . * * * 14.9 Entire Agreement; Headings; Counterparts. This Agreement, its Schedules, Exhibits, Amendments, and all Orders issued hereunder constitute the entire agreement and understanding between the Parties with respect to the subject matter hereof, and supersede all prior agreements, arrangements and undertakings between the Parties. No addition to or modification of any provision of this Agreement shall be binding upon the Parties unless made by a written instrument signed by a duly authorized representative of each of the Parties. . . . * * * 3 14.10 Order of Precedence. In the event of a conflict between or among the provisions in this Agreement, the order of precedence shall be as follows: (i) Schedules, (ii) General Terms and Conditions, (iii) Business Associate Terms and Conditions, (iv) Maintenance Service terms, and (v) each Order. . . . See ECF No. 1-2. Attached as Exhibit A to the Master Agreement is the HIPPA Business Associate Addendum (“Addendum”). See id. That Addendum “serves to establish the responsibilities of both Parties regarding Protected Health Information (“PHI”), and to bring this [Master] Agreement into compliance with HIPAA.” Id. In the Addendum, Nuance agrees “to use appropriate safeguards, and to comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement.” Id. The Addendum also contains the following indemnification provision: [Nuance] shall reimburse, indemnify and hold harmless [PCH] for all costs, expenses (including reasonable attorneys’ fees), damages and other losses resulting directly from any negligent breach of this Business Associate Addendum, Security Incident or Breach of PHI maintained by [Nuance] . . . , subject to the provisions of the Agreement. The foregoing includes, without limitation: fines or settlement amounts owed to a state or federal government agency; the cost of any notifications to individuals or government agencies; credit monitoring for affected individuals; or other mitigation steps taken by Covered Entity to comply with HIPPA or state law. 4 Id. PCH’s breach of contract claim is grounded, at least in part, in Nuance’s alleged breach of the Addendum’s Indemnification provision. See Complaint ¶ 76. According to Nuance, dismissal of the complaint is warranted because: 1) the Master Agreement’s Limitation of Liability Provision defeats all PCH’s claims; 2) the Indemnfication provision of the Addendum does not apply to the losses PCH claims; 3) alternatively, the Master Agreement’s Limitation of Liability provides a cap on damages; 4) the Force Majeure Clause excuses Nuance from liability; 5) PCH’s negligence claim is barred by the gist of the action doctrine; and 6) PCH’s negligence claim is barred by the economic loss rule. II. Standard of Review "[A] motion to dismiss for failure to state a claim for relief should not be granted unless it appears to a certainty

that the plaintiff would be entitled to no relief under any state of facts which could be proved in support of his claim." Rogers v. Jefferson-Pilot Life Ins. Co., 883 F.2d 324, 325 (4th Cir. 1989) (citation omitted) (quoting Conley v. Gibson, 355 U.S. 41, 48 (1957), and Johnson v. Mueller, 415 F.2d 354, 355 (4th Cir. 1969)). "In considering a motion to dismiss, the court should accept as true all well-pleaded allegations and should view the complaint in a light most favorable to the plaintiff." Mylan Laboratories, Inc. v. Matkari, 7 F.3d 1130, 1134 (4th Cir. 1993); 5 see also Ibarra v. United States, 120 F.3d 474, 474 (4th Cir. 1997). In evaluating the sufficiency of a pleading, the cases of Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007), and Ashcroft v. Iqbal, 556 U.S. 662 (2009), provide guidance. When reviewing a motion to dismiss, under Federal Rule of Civil Procedure 12(b)(6), for failure to state a claim upon which relief may be granted, a court must determine whether the factual allegations contained in the complaint “give the defendant fair notice of what the . . . claim is and the grounds upon which it rests,” and, when accepted as true, “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555 (quoting Conley v. Gibson, 355 U.S. 41, 47 (1957); 5 Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 1216 (3d ed. 2004)). “[O]nce a claim has been stated adequately, it may be supported

by showing any set of facts consistent with the allegations in the complaint.” Twombly, 127 S. Ct. at 1969. As the Fourth Circuit has explained, “to withstand a motion to dismiss, a complaint must allege ‘enough facts to state a claim to relief that is plausible on its face.’” Painter’s Mill Grille, LLC v. Brown, 716 F.3d 342, 350 (4th Cir. 2013) (quoting Twombly, 550 U.S. at 570). According to Iqbal and the interpretation given it by our appeals court, 6 [L]egal conclusions, elements of a cause of action, and bare assertions devoid of further factual enhancement fail to constitute well-pled facts for Rule 12(b)(6) purposes. See Iqbal, 129 S.Ct. at 1949. We also decline to consider “unwarranted inferences, unreasonable conclusions, or arguments.” Wahi v. Charleston Area Med. Ctr., Inc., 562 F.3d 599, 615 n. 26 (4th Cir. 2009); see also Iqbal, 129 S. Ct. at 1951-52. Ultimately, a complaint must contain “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 129 S.Ct. at 1949 (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007)). Facial plausibility is established once the factual content of a complaint “allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. In other words, the complaint's factual allegations must produce an inference of liability strong enough to nudge the plaintiff's claims “‘across the line from conceivable to plausible.’” Id. at 1952 (quoting Twombly, 550 U.S. at 570, 127 S.Ct. 1955). Satisfying this “context-specific” test does not require “detailed factual allegations.” Id. at 1949-50 (quotations omitted). The complaint must, however, plead sufficient facts to allow a court, drawing on “judicial experience and common sense,” to infer “more than the mere possibility of misconduct.” Id. at 1950. Without such “heft,” id. at 1947, the plaintiff's claims cannot establish a valid entitlement to relief, as facts that are “merely consistent with a defendant's liability,” id. at 1949, fail to nudge claims “across the line from conceivable to plausible.” Id. at 1951. Nemet Chevrolet, LTD v. Consumeraffairs.com, Inc., 591 F.3d 250, 255-56 (4th Cir. 2009); see also Midgal v. Rowe Price-Fleming Int’l, Inc., 248 F.3d 321, 326 (4th Cir. 2001) (“The presence of a few conclusory legal terms does not insulate a complaint from dismissal under Rule 12(b)(6) when the facts alleged in the complaint cannot support the legal conclusion.”). 7 III. Analysis A. Limitation of Liability Section 12.3 of the Master Agreement provides that “Nuance shall not be liable for loss of profits or revenues, loss of anticipated savings, loss of customers, or loss of use of any software or Data, nor for any special, consequential or indirect loss or damage, costs, expenses or other claims for consequential compensation, however caused, which arise out of or in connection with this Agreement or the Services.” According to Nuance, all the damages claimed by PCH fall within the foregoing limitation of liability. The foregoing provision is limited however by § 12.2 which states that “[n]othing in this Agreement shall be taken to exclude or limit Nuance’s liability for . . . tangible property damage caused by its negligence in providing services at Company locations; or to the extent that such exclusions or limitation is not otherwise permitted by law.” According to PCH, dismissal of it complaint is not warranted because it has alleged tangible property damage or, alternatively, public policy precludes application of the limitation of liability provisions in this

case. PCH alleges that its “computer systems were all shut down and destroyed.” Complaint at ¶ 33. Such an allegation and the reasonable inferences that flow therefrom sufficiently alleges 8 damage to the computers themselves and, therefore, “tangible property damage” caused by Nuance’s negligence. See Eyeblaster, Inc. v. Fed. Ins. Co., 613 F.3d 797, 802 (8th Cir. 2010) (“The plain meaning of tangible property includes computers, and the Sefton complaint alleges repeatedly the “loss of use” of his computer.”); America Online, Inc. v. St. Paul Mercury Ins. Co., 347 F.3d 89, 99 (4th Cir. 2003) (“[T]he allegations of the underlying complaint sufficiently allege damage to the computers themselves, thus bringing the claims against AOL within the scope of the policy’s coverage for claims of `physical damage to tangible property of others.’”) (Traxler, J., dissenting). Accordingly, even if plaintiff’s claims are limited by Section 12.3, it still may have a claim that would fall outside that limitation of liability provision. Because of this, at this juncture, the court cannot say that all plaintiff’s claims are barred by the Master Agreement’s limitation of liability provisions. Therefore, PCH has at least stated a claim that is plausible on its face and that is not barred by the limitation of liability provision. B. Reimbursement and Indemnity Provision

According to Nuance, the Reimbursement and Indemnity provision in the Addendum does not apply to PCH’s first-party claims. That provision provides that Nuance “shall reimburse, indemnify and hold harmless [PCH] for all costs, expenses 9 (including reasonable attorneys’ fees), damages and other losses resulting directly from any negligent breach of this Business Associate Addendum, Security Incident or Breach of PHI maintained by [Nuance] . . . , subject to the provisions of the Agreement.” The language of the Addendum does not expressly limit PCH’s ability to recover first-party losses from Nuance. See, e.g., Helming & Co., P.C. v. RTR Techs., Inc., 76 F. Supp.3d 363, 370 (D. Mass. 2015) (holding that indemnification provision did not only apply to third party claims, in part, because of the language used in indemnity clause which was “extensively drawn” and “broad”). The clause also uses the word “reimburse” in addition to “indemnify”. See, e.g., Amoco Oil Co. v. Liberty Auto and Elec. Co., 810 A.2d 259, 265 (Conn. 2002) (“Although Amoco seeks ‘indemnification’ from Liberty in the first count of its complaint, Amoco effectively seeks enforcement of a specific contract provision that provides reimbursement for loss.”). At this juncture, the court finds that PCH’s claims arguably fall within the indemnification provision. Furthermore, even if the indemnification provision is limited by the Master Agreement’s limitation of liability provision, as noted above,

PCH has arguably stated a claim that it suffered “tangible property damage”. Finally, there is at least an argument that the indemnification provision is ambiguous as to whether it covers first-party claims. 10 LH argues that the “Obligation to Indemnify” provision does not operate to require it to indemnify CCI for first-party claims, or in other words claims between LH and CCI. Instead, it asserts that this provision applies only to claims between CCI and a third party. CCI counters that the provision clearly requires LH to indemnify it with respect to both first- and third-party claims. We conclude that the indemnity provision of the MCA is ambiguous on the question of whether it covers first-party claims. The general legal understanding of indemnity clauses is that they cover the risk of harm sustained by third persons that might be caused by either the indemnitor or the indemnitee. It shifts the financial burden for the ultimate payment of damages from the indemnitee to the indemnitor. * * * This is not to say that there is an absolute prohibition against one party agreeing to indemnify the other party for claims arising between those parties, or first-party claims. L.H. Controls, Inc. v. Custom Conveyor, Inc., 974 N.E.2d 1031, 1047-48 (Ind. 2012) (emphasis in original) (internal citations and quotations omitted). At this stage of the proceedings, the court is unable to resolve an ambiguity in the language should one exist. C. Cap on Damages Nuance asks the court to find as a matter of law that Section 12.4 of the Master Agreement’s Limitation of Liability Provision applies to cap the amount of damages available to PCH. The court declines to do so on a Rule 12(b)(6) motion. If, however, Nuance believes that it is entitled to judgment as a 11 matter of law on this point it may renew its request via a motion for partial summary judgment. D. Force Majeure The force majeure clause excuses Nuance’s “nonperformance” if “that performance is rendered impossible by . . . governmental acts or orders or restrictions, acts of terrorism, war. . .” Nuance contends that the NotPetya malware attack clearly fits within the language of the force majeure clause. Assuming for the purposes of this motion that the NotPetya attack was a “governmental act or order”, “act of terrorism”, and/or “act of war”, Nuance must still convince the court that its actions constitute “nonperformance” within the meaning of the force majeure clause. At this stage of the litigation, it is not clear to the court that the force majeure clause applies. “Naturally, when a party claims force majeure, impracticability or impossibility as a defense, discovery is appropriate to refute those claims.” United Propane Gas, Inc. v. Pincelli & Assoc., Inc., CASE No. 5:13-CV-00190-TBR-LLK, 2016 WL 9583871, *5-6 (W.D. Ky. Dec. 29, 2016), magistrate’s decision reversed in part on other grounds, 2017 WL 3880773 (W.D. Ky. Sept. 5, 2017) (“Where a

party alleges a force majeure defense to a breach of contract claim, discovery regarding the events surrounding the alleged force majeure event and those which may render it inapplicable

12 are generally relevant and discoverable.”). Accordingly, the motion to dismiss on this ground was denied. E. Gist of the Action The gist of the action doctrine seeks “to prevent the recasting of a contract claim as a tort claim.” Gaddy Eng'g Co. v. Bowles Rice McDavid Graff & Love, LLP, 746 S.E.2d 568, 577 (2013). “Succinctly stated, whether a tort claim can coexist with a contract claim is determined by examining whether the parties' obligations are defined by the terms of the contract.” Id. This doctrine will bar an action in tort if a party establishes any of the following: (1) where liability arises solely from the contractual relationship between the parties; (2) when the alleged duties breached were grounded in the contract itself; (3) where any liability stems from the contract; and (4) when the tort claim essentially duplicates the breach of contract claim or where the success of the tort claim is dependent on the success of the breach of contract claim. Id. (quoting Star v. Rosenthal, 884 F. Supp.2d 319, 328–29 (E.D. Pa. 2012)). “The ‘gist of the action’ doctrine requires plaintiffs seeking relief in tort to identify a non-contractual duty breached by the alleged tortfeasor.” Dan Ryan Builders, Inc. v. Crystal Ridge Dev., Inc., 783 F.3d 976, 980 (4th Cir. 2015). In arguing that the gist of the action doctrine does not bar its negligence claim, PCH maintains that its negligence cause of action is grounded in Nuance’s violation of the standard of care 13 under HIPPA and not the contract itself. The Complaint alleges that Nuance had a “duty to provide adequate safeguards to protect a Hospital’s PHI” under HIPAA. Complaint at ¶ 15. The Complaint further alleges that Nuance “set up a continuously open tunnel into PCH’s system” that led to the malware attack. Courts have noted the difficulty in applying the gist of the action doctrine on a motion to dismiss. See Kimberton Healthcare Consulting, Inc. v. Primary PhysicianCare, Inc., Civil Action No. 11-4568, 2011 WL 6046923, *8 (E.D. Pa. Dec. 6, 2011) (and authorities cited therein). As the Kimberton court explained: In this case, there appears to be great deal of potential overlap among DPPO's contract claim and its various tort claims, including the PUTSA claim discussed above. However, PPC has not explicitly asserted that the gist of the action doctrine requires DPPO to proceed exclusively in contract, implying that the PUTSA claim survives the gist of the action doctrine. At this stage of the litigation, the Court declines to determine whether the gist of the action doctrine bars any of DPPO's tort claims. “Caution must be exercised in dismissing a tort action on a motion to dismiss because whether tort and contract claims are separate and distinct can be a factually intensive inquiry.” Haymond v. Lundy, Nos. 99–CV–5015, 99–CV–5048, 2000 WL 804432, at *8 (E.D. Pa. June 22, 2000); accord Baker v. Family Credit Counseling Corp., 440 F. Supp.2d 392, 418 (E.D. Pa. 2006). Courts have declined to apply the gist of the action doctrine on a motion to dismiss in similar circumstances. See, e.g., Sensus USA, Inc. v. Elliott Bay Eng'g, Inc., No. 10–CV–1363, 2011 WL 2650028, at *7 (W.D. Pa. July 6, 2011) (“Because the application of the gist of the action doctrine depends on the facts of each particular case and . . . the nature of the relevant trade secrets in this case is currently unclear, this issue is best left for resolution on a post-amendment motion to 14 dismiss or, even more appropriately, on a post-discovery motion for summary judgment.”); Orthovita, Inc. v. Erbe, No. 07–CV–2395, 2008 WL 423446, at *5 (E.D. Pa. Feb. 14, 2008) (“At this juncture in the litigation, it is too soon to know whether the common law or statutory prohibition against misappropriation will address a broader scope of Orthovita secrets or greater duties than the contract obligation.”); Freedom Med., Inc. v. Gillespie, 634 F. Supp.2d 490, 517 (E.D. Pa. 2007) (refusing to dismiss misappropriation of trade secrets claim because the allegations “could, depending on the facts ultimately proved, give rise to independent duties to refrain from disclosing or misappropriating trade secrets”); Berger & Montague, P.C. v. Scott & Scott, LLC, 153 F. Supp.2d 750, 754 (E.D. Pa.2001) (noting that even if the gist of the action and economic loss doctrines barred conversion claim, “Federal Rule of Civil Procedure 8(d)(2) allows [plaintiff] to plead two or more alternative claims . . . for either breach of contract or conversion, regardless of their consistency”). Here, the appropriate course of action is for the Court to deny the pending motion to dismiss, but to note that the gist of the action doctrine may require the Court, prior to trial, to rule definitively on its application in this case. DPPO shall initiate discovery, as may be appropriate, on all its claims. The Court does not believe that ruling on the gist of the action doctrine now would eliminate any discovery that would be appropriate on the breach of contract claim, and thus PPC is not prejudiced by the Court delaying ruling on its assertion of the gist of the action doctrine. Id. The court is not persuaded that plaintiff’s negligence claim would withstand a motion for summary judgment based upon the gist of the action doctrine. However, considering plaintiff’s allegations regarding Nuance’s negligence, as well as the reasonable inferences that flow therefrom, the court declined to dismiss that count under the gist of the action doctrine. 15 F. Economic Loss Rule In Aikens v. Debow, 541 S.E.2d 576, 589 (W. Va. 2000), West Virginia’s highest court held: We conclude that an individual who sustains purely economic loss from an interruption in commerce caused by another’s negligence may not recover damages in the absence of physical harm to that individual’s person or property, a contractual relationship with the alleged tortfeasor, or some other special relationship between the alleged tortfeasor and the individual who sustains purely economic damages sufficient to compel the conclusion that the tortfeasor had a duty to the particular plaintiff and that the injury complained of was clearly foreseeable to the tortfeasor. PCH’s allegations, “along with the reasonable and favorable inferences that flow from” them, must be accepted on a motion pursuant to Federal Rule of Civil Procedure 12(b)(6). Good v. American Water Works Co., Inc., Civil Action No. 2:14-01374, 2015 WL 3540509, *4 (S.D.W. Va. June 4, 2015) (Copenhaver, J.). PCH has alleged that “malware encryted and destroyed PCH’s entire computer health network” and that “PCH’s computer systems were all shut down and destroyed.” Complaint ¶¶ 32-33. Therefore, at this juncture, the court cannot conclude that PCH has suffered purely economic losses. See, e.g., Good, 2015 WL 3540509 at * 3 (“The primary difficulty with Eastman’s contention [that the economic loss rule applies] at this early stage of the litigation is that it is unclear that purely economic losses are at issue.”). Likewise, at this stage of the litigation, the court cannot definitely say that a special relationship did not exist 16 between Nuance and PCH. See Sigman v. CSX Corp., CIVIL ACTION NO. 3:15-13328, 2016 WL 2622007, *3 (S.D.W. Va. May 5, 2016) (declining to dismiss pursuant to Rule 12(b) (6) based upon economic loss rule “find[ing] that a ‘special relationship’ could exist between” defendants and plaintiffs) (Chambers, J.). For all these reasons, the court declined to find that PCH’s negligence claim is barred by the economic loss rule. For all these reasons, defendant’s motion to dismiss was DENIED. The Clerk is directed to send copies of this Memorandum Opinion to all counsel of record. IT IS SO ORDERED this the 7th day of April, 2020 ENTER: Rautd A Dols David A. Faber Senior United States District Judge