Sarah Beck v. North Broward Hospital District

• Court: District Court of Appeal of Florida
• Decided: January 14, 2026
• Docket: 4D2024-1814
• Status: Published

Opinion

DISTRICT COURT OF APPEAL OF THE STATE OF FLORIDA FOURTH DISTRICT

SARAH BECK, TIMOTHY HALE, ANDREA HUNTER, ROSELENE JOSEPH, JAMES KIC, LORI LESLIE, and SANDY R. LEVY, individually and on behalf of all others similarly situated, Appellants,

v.

NORTH BROWARD HOSPITAL DISTRICT d/b/a BROWARD HEALTH, Appellee.

No. 4D2024-1814

[January 14, 2026]

Appeal from the Circuit Court for the Seventeenth Judicial Circuit, Broward County; Jack B. Tuter, Jr., Judge; L.T. Case Nos. CACE22- 000803; CACE22-000857; CACE22-006111.

Dorothy P. Antullis, Stuart A. Davidson, and Facundo Scialpi of Robbins Geller Rudman & Dowd LLP, Boca Raton, and Norman E. Siegel, J. Austin Moore, and Kasey Youngentob of Stueve Siegel Hanson LLP, Kansas City, MO, for appellants.

Peter R. Goldman, Danna Khawam, Nina Welch of Nelson Mullins Riley & Scarborough LLP, Fort Lauderdale, and Beverly A. Pohl of Nelson Mullins Riley & Scarborough LLP, Boca Raton, for appellee.

GROSS, J.

We affirm the circuit court’s order that the defendant below had not waived its entitlement to sovereign immunity.

By an amended class action complaint, the plaintiffs sued North Broward Hospital District (“Broward Health”) for claims arising out of an October 2021 data breach incident. The plaintiffs were former patients of Broward Health. Broward Health is a public, not-for-profit health care system organized under the laws of Florida. It operates four major hospitals and more than 30 locations and offices.

The complaint alleged two counts, negligence and breach of contract, arising from the exposure of the patients’ private information 1 to unauthorized third parties.

The plaintiffs pleaded the existence of an express contract with Broward Health cobbled together from a Patient’s Bill of Rights and Responsibilities, a Notice of Privacy Practices for Protected Health Information, bylaws of the medical staff, and a code of conduct.

For the negligence count, the plaintiffs alleged that Broward Health failed to exercise due care in collecting, storing, and using the plaintiffs’ private information. The plaintiffs specified that the following harm was caused by such negligence:

1. loss of control over their private information, which has marketable value;

2. diminished personal and economic value of their private information;

3. diminished transactional or barter value of their private information;

4. loss of inherent privacy value assigned to keeping their private information confidential;

5. actual identity theft;

6. out-of-pocket expenses associated with protecting their property interests; and

7. future costs in terms of time, effort, and money that will be expended to prevent, detect, contest, and repair the impact of the private information compromised as a result.

Broward Health moved to dismiss the operative complaint.

Regarding the negligence claim, Broward Health argued that the complaint should be dismissed with prejudice because the plaintiffs’ claim was barred by sovereign immunity, as the limited statutory waiver of sovereign immunity does not extend to the plaintiffs’ damages, which did not arise out of “injury or loss of property, personal injury, or death” as

1 This private information included personal identification, insurance, medical,

and other information.

2 provided by section 768.28(1), Florida Statutes (2021).

Regarding the breach of contract claim, Broward Health argued that under Pan-Am Tobacco Corp. v. Department of Corrections, 471 So. 2d 4, 6 (Fla. 1984), the waiver of sovereign immunity applied only to express, written contracts, not to the pamphlet-style informational notices at issue in this case.

The trial court granted Broward Health’s motion to dismiss with prejudice. The court held that the plaintiffs “[did not] seek relief based on an ‘injury or loss of property, personal injury or death.’ Instead, they seek economic damages which are barred.” Thus, the court explained: “The statute in question does not provide a remedy for ‘economic’ damages. Such a remedy would have to come from the Florida Legislature.” The court later entered a final order of dismissal.

Discussion

“In Florida, sovereign immunity is the rule, rather than the exception[.]” Pan-Am Tobacco, 471 So. 2d at 5. “Article X, section 13 of the Florida Constitution provides ‘absolute sovereign immunity for the state and its agencies absent waiver by legislative enactment or constitutional amendment.’” Orlando v. Broward Cnty., Fla., 920 So. 2d 54, 57 (Fla. 4th DCA 2005) (quoting Cir. Ct. of Twelfth Jud. Cir. v. Dep’t of Nat. Res., 339 So. 2d 1113, 1114 (Fla. 1976)).

The legislative waiver of sovereign immunity in section 768.28, Florida Statutes provides:

In accordance with s. 13, Art. X of the State Constitution, the state, for itself and for its agencies or subdivisions, hereby waives sovereign immunity for liability for torts, but only to the extent specified in this act. Actions at law against the state or any of its agencies or subdivisions to recover damages in tort for money damages against the state or its agencies or subdivisions for injury or loss of property, personal injury, or death caused by the negligent or wrongful act or omission of any employee of the agency or subdivision[,] . . . if a private person, would be liable to the claimant, in accordance with the general laws of this state, may be prosecuted subject to the limitations specified in this act.

§ 768.28(1), Fla. Stat. (2021).

3 While the legislature explicitly waived sovereign immunity in tort in section 768.28, “[t]here is no analogous waiver in contract.” Pan-Am Tobacco, 471 So. 2d at 5. “Nonetheless, the legislature has, by general law, explicitly empowered various state agencies to enter into contracts.” Id. “Additionally, it has authorized certain goals and activities which can only be achieved if state agencies have the power to contract for necessary goods and services.” Id.

To determine whether sovereign immunity bars the plaintiffs from bringing a breach of contract claim against Broward Health, the key questions are (1) “whether the Legislature has waived immunity [and (2)] whether an express, written contract exists between [the parties].” Heine v. Fla. Atl. Univ. Bd. of Trs., 360 So. 3d 412, 418 (Fla. 4th DCA 2023). For sovereign immunity purposes, an express contract includes those “implied covenants and conditions that do not contradict, supplant, or override express contract provisions[.]” Rojas v. Univ. of Fla. Bd. of Trs., 419 So. 3d 593, 606 (Fla. 2025). If the answer to either question is affirmative, Broward Health “cannot invoke sovereign immunity to bar” the plaintiffs’ breach of contract claim. Heine, 360 So. 3d at 418 (citing Pan-Am Tobacco, 471 So. 2d at 5).

The legislature has not explicitly waived sovereign immunity regarding the privacy issues implicated by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) or the Florida Patient’s Bill of Rights and Responsibilities. Neither statute creates a cause of action against a governmental entity. No private cause of action exists under HIPAA. See Acara v. Banks, 470 F.3d 569, 570, 572 (5th Cir. 2006) (affirming motion to dismiss plaintiff’s suit against doctor for violating HIPAA by disclosing her medical information without consent and holding that “there is no private cause of action under HIPAA”). Similarly, section 381.026(3) provides that the Florida Patient’s Bill of Rights “shall not be used for any purpose in any civil or administrative action and neither expands nor limits any rights or remedies provided under any other law.” § 381.026(3), Fla. Stat. (2021); see also Murthy v. N. Sinha Corp., 644 So. 2d 983, 986 (Fla. 1994) (“declin[ing] to infer any civil liability” in construction industry regulatory and penal statutes “as there is no evidence in the language or the legislative history . . . of a legislative intent” to create “a private right of action”).

Furthermore, the documents relied upon by the plaintiffs did not create an “express written contract” as required by Rojas and Pan-Am Tobacco.

Broward Health provided patients with notice required by federal and state statutes. Section 381.026, Florida Statutes, requires a health care

4 provider to “adopt and make available to the patient, in writing, a statement of the rights and responsibilities of patients[.]” § 381.026(6), Fla. Stat. (2021). Both the Patient’s Bill of Rights and the Privacy Notice used by Broward Health are informational documents designed to promote the understanding and well-being of patients, to give patients “a general understanding of the procedures to be performed on them and to provide information pertaining to their health care so that they may make decisions in an informed manner after considering the information relating to their condition, the available treatment alternatives, and substantial risks and hazards inherent in the treatments.” § 381.026(3), Fla. Stat. (2021).

Such informational notices disseminated to patients do not give rise to express written contractual obligations binding the health care provider and the patient. See Brush v. Mia. Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1367 (S.D. Fla. 2017) (holding that provisions in the defendant healthcare group’s Notice of Privacy Practices, Patient Rights and Responsibilities, and Patient Visitation Rights “are not contractual in nature. Instead, these provisions inform patients of their rights” under HIPAA and “the duties imposed upon the Defendants by these statutory provisions.”).

The plaintiffs argue that the Florida Supreme Court’s recent Rojas decision compels reversal of the trial court’s order dismissing their breach of contract claim. We distinguish Rojas because that case involved a specific, written financial liability agreement.

Rojas determined that the financial liability agreement was an express contract between the students and the university and that provision of on- campus services and facilities are “permissible implied obligations that do not have . . . a directly antagonistic relationship with the text of a contract.” 419 So. 3d at 604.

The Court determined the plain language of the financial liability agreement at issue in Rojas shows that it was intended to be a binding agreement between the university and the enrolled students. That agreement stated:

I agree to pay all UF debts and charges pursuant to UF policies. I understand that the university is advancing value to me in the form of educational services and that my right to register is expressly conditioned upon my agreement to pay the costs of tuition, fees, and other charges and any additional costs when those charges become due . . . . This agreement

5 shall be construed in accordance with Florida law and any lawsuit to collect unpaid fees may be brought in the appropriate court sitting in Alachua County, Florida, regardless of my domicile at the time of bringing such suit.

Univ. of Fla. Bd. of Trs. v. Rojas, 351 So. 3d 1167, 1171 n.4 (Fla. 1st DCA 2022).

Language similar to the binding contract in Rojas is absent from the informational privacy materials upon which the plaintiffs rely in this case. Because there was no “express written contract” that would bring this case within the waiver of sovereign immunity authorized in Rojas and Pan-Am Tobacco, the trial court did not err in dismissing plaintiffs’ breach of contract claim with prejudice.

As to the negligence count, this court has strictly construed section 768.28(1) to require a waiver of sovereign immunity to be clear and unambiguous. See Dep’t of Fin. Servs. v. Barnett, 262 So. 3d 750, 752, 754 (Fla. 4th DCA 2018) (“[B]ecause waiver is an abrogation of the sovereignty of the state, courts have strictly construed any statute waiving immunity to protect the public purse.”).

This case is controlled by our decision in City of Pembroke Pines v. Corrections Corp. of America, Inc., 274 So. 3d 1105 (Fla. 4th DCA 2019) (“Pembroke Pines II”).

The factual background of Pembroke Pines II was set forth in Corrections Corporation of America, Inc. v. City of Pembroke Pines, 230 So. 3d 477 (Fla. 4th DCA 2017) (“Pembroke Pines I”). Pembroke Pines II, 274 So. 3d at 1107. Pembroke Pines I involved a dispute between the City of Pembroke Pines and Corrections Corporation of America, Inc. (“CCA”). Id. The City sought declaratory judgment regarding whether the City had a duty to provide sewer and water services to an area outside of its boundary, where CCA and the Town of Southwest Ranches entered into a contract regarding the development of a correctional facility. Id. at 1108.

The trial court ruled that the City had no such duty, even though the City and Southwest Ranches had entered into agreements that the City would not interfere with the development or operation of the CCA’s jail facility and agreed that the City had sufficient capacity to provide water and sewer service to the future CCA facility site. Id. at 1108–09. While the appeal of that trial court order was pending, Southwest Ranches received notification that a detention center would not be built on the CCA site. Id. at 1109.

6 “With no detention center to build, CCA sold the CCA site to Southwest Ranches” and “filed [a] second amended counterclaim against the City.” Id. CCA alleged four counts relevant to that appeal: “Count I for declaratory judgment; Count II for promissory estoppel; Count V for tortious interference with contract; and Count VI [for] tortious interference with advantageous business relationship.” Id. at 1110. For the tort claims in Counts V and VI, CCA claimed “damages, including lost profits and costs.” Id.

The trial court denied the City’s motion to dismiss based upon sovereign immunity. Id. This court reversed, holding that the City was entitled to sovereign immunity. Id. at 1111. We observed that “section 768.28’s limited waiver of sovereign immunity does not apply to CCA’s state law tort claims which are not based on ‘injury or loss of property, personal injury, or death caused by the negligent or wrongful act or omission of any employee of the agency or subdivision while acting within the scope of the employee’s office or employment . . . .’” Id. at 1112 (quoting § 768.28(1), Fla. Stat.). Significantly, we explained that “[t]he waiver of sovereign immunity has not been extended to include the claim upon which CCA relies here – economic damages framed in counts for declaratory relief, promissory estoppel, tortious interference with contract, and tortious interference with advantageous business relationship.” Id. at 1113; see also City of Fort Lauderdale v. Tropical Paradise Resorts, LLC, 372 So. 3d 663, 667 (Fla. 4th DCA 2023) (holding that City was entitled to sovereign immunity for claims seeking “economic damages for defense of litigation” and not for “injury or loss of property, personal injury, or death” under section 768.28(1)).

Consistent with Pembroke Pines II, we hold that the damages the plaintiffs claim from the use of their personal and health information involve economic damages falling outside of the section 768.28(1) limited waiver of sovereign immunity, because there was no actual damage to tangible property. The damage to privacy rights here is akin to the damages in Pembroke Pines II arising from interference with a contractual or business relationship.

Affirmed.

SHEPHERD, J., concurs. FORST, J., concurs specially with opinion.

FORST, J., concurring specially.

7 I concur with the affirmance of the trial court’s dismissal of appellants’ complaint on the basis of appellee’s assertion of sovereign immunity. My only disagreement with the majority opinion is its holding that “[t]his case is controlled by our decision in City of Pembroke Pines v. Corrections Corp. of America, Inc., 274 So. 3d 1105 (Fla. 4th DCA 2019) (“Pembroke Pines II”).” Due to the differences in the “injury or loss of property” claims in the two cases, I find Pembroke Pines II to be “instructive” rather than “controlling.” I otherwise agree with the majority opinion’s analysis and holding.

* * *

Not final until disposition of timely-filed motion for rehearing.