United States District Court EASTERN DISTRICT OF TEXAS SHERMAN DIVISION
RICHARD SMITH and SHAE LOFTICE, § on behalf of themselves and all others § similarly situated, § § Plaintiffs, § Civil Action No. 4:23-CV-295 § Judge Mazzant v. § § AMERICAN PAIN AND WELLNESS, § PLLC, § Defendant. § §
MEMORANDUM OPINION AND ORDER Pending before the Court is Defendant’s Rule 12(b)(1) and (6) Motion to Dismiss (Dkt. #8). Having considered the motion and the relevant pleadings, the Court finds that the motion should be GRANTED in part and DENIED in part. BACKGROUND Defendant American Pain and Wellness, PLLC (“American Pain”) is a healthcare provider (Dkt. #4 at p. 3). As part of its operations, American Pain collects and maintains personal identifiable information (“PII”) and protected health information (“PHI”) (collectively, “PII/PHI”) about current and former patients seen at its facilities (Dkt. #4 at p. 3). American Pain is alleged to have “agreed it would safeguard the data in accordance with its internal policies, state law, and federal law” (Dkt. #4 at p. 3). On November 10, 2022, cybercriminals are alleged to have breached American Pain’s systems and gained access to patient PII/PHI (the “Data Breach”) (Dkt. #4 at p. 4). However, “Defendant has been unable to determine precisely what information was stolen and when” (Dkt. 34 at p. 6). Plaintiff Richard Smith (“Smith”) and Plaintiff Shae Loftice (“Loftice”) (collectively, “Named Plaintiffs”) allege that their PII/PHI was accessed as a result of the Data Breach (Dkt. #4 at p. 2). American Pain notified Named Plaintiffs of the Data Breach on March 24, 2023 (Dkt. #4
at p. 5). In a letter notifying Named Plaintiffs of the Data Breach, American Pain encouraged Named Plaintiffs to “remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring free credit reports;” “place a fraud alert and security freeze on one’s credit file;” “contact the Federal Trade Commission, their state Attorney General, and law enforcement to report attempted or actual identity theft and fraud;” “educate yourself regarding identity theft, fraud alerts, credit freezes, and the steps you can take to protect your personal
information by contacting the consumer reporting bureaus, the Federal Trade Commission, or your state Attorney General” (Dkt. #4 at p. 5) (citing Data Breach Notifications, MAINE ATTY GEN.,.https://apps.web.maine.gov/online/aeviewer/ME/40/5f0af895-9bce-434f-86f0- 20256aa4d93c.shtml (last visited Mar. 31, 2023)). Smith alleges that his “[] name; [] home address; [] date of birth; [] Social Security number; [] medical history; [] health insurance information; [] treating physician; and [] diagnosis information” was compromised” (Dkt. #4 at p. 7). Smith further alleges that he has and will
continue to spend time and effort monitoring his account to protect himself from identity theft (Dkt. #4 at pp. 7–8). As a result of the Data Breach, Smith alleges that he has suffered from “anxiety, sleep disruption, stress, fear, and frustration” (Dkt. #4 at p. 8). And Smith alleges he has suffered from the diminution in the value of his PII/PHI and an increased risk of identity theft (Dkt. #4 at p. 8) Loftice alleges that her “[] name; [] home address; [] date of birth; [] medical history; [] health insurance information; [] treating physician; and [] diagnosis information” was compromised” (Dkt. #4 at p. 9). Loftice further alleges that she has spent at least 20 hours on the
Data Breach and will continue to spend time and effort monitoring her account to protect himself from identity theft (Dkt. #4 at p. 9). As a result of the Data Breach, Loftice alleges that she has suffered from “anxiety, sleep disruption, stress, fear, and frustration” (Dkt. #4 at p. 10). And Loftice alleges she has suffered from the diminution in the value of her PII/PHI and an increased risk of identity theft (Dkt. #4 at p. 9) Loftice further alleges that, “following the Data Breach, in March 2023, [she] was notified
by Credit Wise, a credit and identity protection service, of a fraudulent attempt to open a credit line with JP Morgan Chase & Co.” (Dkt. #4 at p. 10). And she has “experienced an increase in spam texts and phone calls since the Data Breach” (Dkt. #4 at p. 10). Named Plaintiffs bring this class action on behalf of themselves and all others allegedly harmed by American Pain’s conduct and the resulting Data Breach (Dkt. #4 at p. 2). Smith is a citizen of Texas, residing in Tarrant County, Texas (Dkt. #4 at p. 2). Loftice is a citizen of Texas, residing in Grayson County, Texas (Dkt. #4 at p. 2). American Pain is a professional limited liability
company headquartered in and doing business in Texas (Dkt. #4 at pp. 2–3). LEGAL STANDARD I. 12(b)(1) Motion to Dismiss Federal Rule of Civil Procedure 12(b)(1) authorizes dismissal of a case for lack of subject matter jurisdiction when the district court lacks statutory and constitutional power to adjudicate the case. Home Builders Ass’n of Miss., Inc. v. City of Madison, 143 F.3d 1006, 1010 (5th Cir. 1998). If a Rule 12(b)(1) motion is filed in conjunction with other Rule 12 motions, the Court will consider the jurisdictional attack under Rule 12(b)(1) before addressing any attack on the legal merits. Ramming v. United States, 281 F.3d 158, 161 (5th Cir. 2001).
In deciding the motion, the Court may consider “(1) the complaint alone; (2) the complaint supplemented by the undisputed facts evidenced in the record; or (3) the complaint supplemented by undisputed facts plus the [C]ourt’s resolution of disputed facts.” Lane v. Halliburton, 529 F.3d 548, 557 (5th Cir. 2008) (quoting Barrera-Montenegro v. United States, 74 F.3d 657, 659 (5th Cir. 1996)). The Court will accept as true all well-pleaded allegations set forth in the complaint and construe those allegations in the light most favorable to the plaintiff. Truman v. United States, 26
F.3d 592, 594 (5th Cir. 1994). Once a defendant files a motion to dismiss under Rule 12(b)(1) and challenges jurisdiction, the party invoking jurisdiction has the burden to establish subject matter jurisdiction. See Menchaca v. Chrysler Credit Corp., 613 F.2d 507, 511 (5th Cir. 1980). The Court will grant a motion to dismiss for lack of subject matter jurisdiction only if it appears certain that the claimant cannot prove a plausible set of facts to support a claim that would entitle it to relief. Lane, 529 F.3d at 557. II. 12(b)(6) Motion to Dismiss
The Federal Rules of Civil Procedure require that each claim in a complaint include a “short and plain statement . . . showing that the pleader is entitled to relief.” FED. R. CIV. P. 8(a)(2). Each claim must include enough factual allegations “to raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A Rule 12(b)(6) motion allows a party to move for dismissal of an action when the complaint fails to state a claim upon which relief can be granted. FED. R. CIV. P. 12(b)(6). When considering a motion to dismiss under Rule 12(b)(6), the Court must accept as true all well-pleaded facts in the plaintiff’s complaint and view those facts in the light most favorable to the plaintiff. Bowlby v. City of Aberdeen, 681 F.3d 215, 219 (5th Cir. 2012). The Court may consider “the complaint, any
documents attached to the complaint, and any documents attached to the motion to dismiss that are central to the claim and referenced by the complaint.” Lone Star Fund V (U.S.), L.P. v. Barclays Bank PLC, 594 F.3d 383, 387 (5th Cir. 2010). The Court must then determine whether the complaint states a claim for relief that is plausible on its face. “A claim has facial plausibility when the plaintiff pleads factual content that allows the [C]ourt to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Gonzalez v. Kay, 577 F.3d 600, 603 (5th Cir. 2009)
(quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). “But where the well-pleaded facts do not permit the [C]ourt to infer more than the mere possibility of misconduct, the complaint has alleged—but it has not ‘show[n]’—‘that the pleader is entitled to relief.’” Iqbal, 556 U.S. at 679 (quoting FED. R. CIV. P. 8(a)(2)). In Iqbal, the Supreme Court established a two-step approach for assessing the sufficiency of a complaint in the context of a Rule 12(b)(6) motion. First, the Court should identify and disregard conclusory allegations, for they are “not entitled to the assumption of truth.” Iqbal, 556
U.S. at 664. Second, the Court “consider[s] the factual allegations in [the complaint] to determine if they plausibly suggest an entitlement to relief.” Id. “This standard ‘simply calls for enough facts to raise a reasonable expectation that discovery will reveal evidence of the necessary claims or elements.’” Morgan v. Hubert, 335 F. App’x 466, 470 (5th Cir. 2009) (citation omitted). This evaluation will “be a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. Thus, “[t]o survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.”’ Id. at 678 (quoting Twombly, 550 U.S. at 570).
ANALYSIS I. American Pain’s 12(b)(1) Motion to Dismiss American Pain argues that Named Plaintiff’s claims should be dismissed under Rule 12(b)(1) for lack of subject matter jurisdiction because: 1) there is no diversity jurisdiction; 2) there is no federal question jurisdiction; and 3) Plaintiffs lack Article III standing (see Dkt. #8). The Court considers each argument in turn. A. The Court has diversity jurisdiction over the parties under 28 U.S.C. § 1332(d)(2).
American Pain first contends that the Court does not have subject matter jurisdiction over this suit because there is no diversity between the parties. Because it is undisputed that the Named Plaintiffs are citizens of Texas and American Pain is located in Texas, American Pain argues that the requirements under 28 U.S.C. § 1332(d)(2) have not been met. Moreover, American Pain argues that the Named Plaintiffs did not adequately allege the amount in controversy under the Class Action Fairness Act (“CAFA”). i. There is diversity between parties. According to American Pain, the Court must only look to the named plaintiffs when analyzing whether diversity exists in a class action (Dkt. #8 at p. 5) (emphasis added). In response,
Named Plaintiffs argue that, under CAFA, diversity can exist between any plaintiff class member and any defendant (Dkt. #12 at p. 8) (emphasis added). The Court agrees with Named Plaintiffs. “CAFA does not replace the basic diversity requirements; it supplements them. That means that a class action case not arising under federal law can be lodged in federal court if it meets either the basic diversity requirements or CAFA’s requirements.” 2 W. Rubenstein, Newberg on
Class Actions § 6:6 (5th ed.) (emphasis in original). Federal district courts have jurisdiction over cases in which the amount in controversy exceeds $75,000 and there is diversity of citizenship among the parties. 28 U.S.C. § 1332(a). Alternatively, “CAFA provides district courts with jurisdiction over ‘class action[s]’ in which the matter in controversy exceeds $5,000,000 and at least one class member is a citizen of a State different from the defendant.” Home Depot U.S.A., Inc. v. Jackson, 587 U.S. 435, (2019) (citing § 1332(d)(2)(A)).
The Fifth Circuit has clarified that CAFA is referring to the citizenship of “any class member and any defendant.” In re Katrina Canal Litig. Breaches, 524 F.3d 700 (5th Cir. 2008). In other words, “CAFA, in expanding federal jurisdiction over certain class actions filed in state court, escaped the rule that citizenship of the named representative is controlling.” Id.; see also Hart v. FedEx Ground Package Sys. Inc., 457 F.3d 675, 676-77 (7th Cir. 2006) (“Because [the class representative] too is a citizen of Pennsylvania, in the absence of CAFA nothing would support federal subject-matter jurisdiction over these claims. That is because § 1332 requires ‘complete
diversity,’ meaning that no plaintiff may be from the same state as any defendant, and in class actions only the citizenship of the named plaintiff counts.” (emphasis added)). Even so, CAFA seeks to “draw a delicate balance between making a federal forum available to genuinely national litigation and allowing the state courts to retain cases when the controversy is strongly linked to that state.” Hollinger, 654 F.3d at 570 (citing Hart, 457 F.3d at 682). “Therefore, [CAFA] provides a number of scenarios in which federal courts must abstain from exercising jurisdiction.” Madison v. ADT, L.L.C., 11 F.4th 325, 327 (5th Cir. 2021) (citing Hollinger, 654 F.3d at 570). One such scenario is the “home state” exception, “whereby the court must abstain if ‘two-thirds or more of the members of all proposed plaintiff classes in the aggregate, and
the primary defendants, are citizens of the State in which the action was originally filed.’” Id. (citing Hollinger, 654 F.3d at 570; 28 U.S.C. § 1332(d)(4)(B)). In its Motion, American Pain does not make any argument regarding exceptions to CAFA (see Dkt. #8). However, at a teleconference hearing for a discovery dispute between the parties, counsel for American Pain raised additional arguments related to the home state exception. Because there is nothing in the record supporting those arguments, the Court declines to consider them at this time.1
It is undisputed that American Pain is considered a citizen of Texas. And Named Plaintiffs have alleged that “many members of the proposed class are from different states than [American Pain]” (Dkt. #4 at p. 3). Accordingly, based on the current record, diversity of citizenship exists between the parties under CAFA. ii. Named Plaintiffs sufficiently allege the amount in controversy. In their Complaint, Named Plaintiffs allege that “the amount in controversy exceeds $5
million, exclusive of interest and costs” (Dkt. #4 at p. 3). American Pain argues that Named Plaintiffs’ allegation is “unsupported” and “runs afoul of Iqbal’s pleading requirements” (Dkt. #8 at p. 6). See Iqbal, 556 U.S. at 678. Under CAFA, the aggregate amount in controversy for class or mass actions must exceed $5 million. Mississippi ex rel. Hood v. AU Optronics Corp., 571 U.S. 161, 166 (2014). The plaintiff’s
1 The Court will consider additional arguments related to jurisdiction in the event that they are properly presented. burden to demonstrate the amount in controversy is “[n]ormally . . . satisfied if the plaintiff claims a sum greater than the jurisdictional requirement.” White v. FCI USA, Inc., 319 F.3d 672, 674 (5th Cir. 2003) (citations omitted). “The required demonstration concerns what the plaintiff is
claiming (and thus the amount in controversy between the parties), not whether the plaintiff is likely to win or be awarded everything he seeks.” Robertson v. Exxon Mobil Corp., 814 F.3d 236, 240 (5th Cir. 2015) (citations omitted). “A claim for damages made in apparent good faith controls the jurisdictional question . . . .” Jouett Investments Inc. v. Intuit Inc., No. 3:14–CV–1803–L, 2015 WL 3770715, at *7 (N.D. Tex. June 15, 2015). And the Court can apply common sense when evaluating the amount in controversy claimed. Robertson, 814 F.3d at 240.
Given that Named Plaintiffs have brought this action on behalf of approximately 7,457 persons who were allegedly harmed as a result of the Data Breach (see Dkt. #12 at p. 8), the Court finds that Named Plaintiffs have met their burden to demonstrate that the amount in controversy exceeds $5 million as required under CAFA.2 B. Plaintiffs have standing. American Pain additionally argues that Named Plaintiffs have failed to allege injuries sufficient to confer Article III standing (Dkt. #8 at p. 8). In response, Named Plaintiffs argue that
they have standing to sue based on the following alleged injuries: 1) American Pain disclosed Named Plaintiffs’ private information; 2) American Pain injured Named Plaintiff’s rights under contract; 3) Named Plaintiffs are now exposed to an increased risk for identity theft; 4) Plaintiff
2 Because Named Plaintiffs are not claiming that federal question jurisdiction exists, (see Dkt. #4 at p. 3), and there is currently a basis for diversity jurisdiction (see supra), the Court declines to consider whether it has federal question jurisdiction at this time. Loftice suffered fraud; 5) Named Plaintiffs have spent time and resources mitigating their chances of suffering harm; and 6) Named Plaintiffs fear for their financial security (Dkt. #12 at p. 7). A federal court lacks jurisdiction over a claim if it does not allege an actual case or
controversy. See Attala Cnty. v. Evans, 37 F.4th 1038, 1042 (5th Cir. 2022) (“It is axiomatic that a plaintiff seeking redress in federal court must meet the initial ‘requirement imposed by Article III of the Constitution by alleging an actual case or controversy.’” (citation omitted)). An actual case or controversy requires that a plaintiff have standing to sue. Id. To establish standing, the plaintiff must demonstrate that an injury is “[(1)] concrete, particularized, and actual or imminent; [(2)] fairly traceable to the challenged action; and [(3)] redressable by a favorable ruling.” Id. (quoting
Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 149 (2010)). “At the pleading stage, general factual allegations of injury resulting from the defendant’s conduct may suffice, for on a motion to dismiss we ‘presum[e] that general allegations embrace those specific facts that are necessary to support the claim.’” Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992) (citation omitted). “[S]tanding is not dispensed in gross; rather, plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek (for example, injunctive relief and damages).” TransUnion LLC v. Ramirez, 594 U.S. 413, 431 (2021).
The proposed class representatives must have Article III standing. Flecha v. Medicredit, Inc., 946 F.3d 762, 769 (5th Cir. 2020). “[I]f none of the named plaintiffs purporting to represent a class establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf of himself or any other member of the class.” Green v. eBay Inc., No. CIV.A. 14-1688, 2015 WL 2066531, at *3 (E.D. La. May 4, 2015) (citing O’Shea v. Littleton, 414 U.S. 488, 494 (1974)). “After all, if the class representative lacks standing, then there is no Article III suit to begin with—class certification or otherwise.” Flecha, 946 F.3d at 769. The Fifth Circuit has not addressed standing in the data breach context.
i. Named Plaintiffs’ injury is concrete and imminent. The Supreme Court recently addressed standing in a similar, but distinct context. See TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). The U. S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) “maintains a list of ‘specially designated nationals’ who threaten America’s national security.” TransUnion, 594 U.S. at 419. These individuals are generally “terrorists, drug traffickers, or other serious criminals.” Id. In TransUnion, a class of
8,185 plaintiffs filed suit after there were inaccurate OFAC alerts in their credit files. 1,853 of the class members (including the named plaintiff) had their credit reports containing inaccurate OFAC alerts disseminated to third parties during the period specified in the class definition. Id. at 421. The internal credit files of the remaining 6,332 class members were not provided to third parties during the relevant time period. Id. When evaluating whether the plaintiffs had Article III standing, the Supreme Court focused its analysis on whether the plaintiffs had suffered a “concrete harm.” Id. at 417. “Central
to assessing concreteness is whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit . . . .” Id. (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016)). The Supreme Court recognized that various intangible harms can be concrete. Id. at 425. “Those include, for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” Id. at 425. The Supreme Court had “no trouble concluding” that those 1,853 class members whose misleading credit reports were provided to third parties “suffered a harm with a ‘close relationship’ to the harm associated with the tort of defamation such that they had Article III
standing.” Id. at 432. However, the Supreme Court held that the remaining plaintiffs did not have standing because they did not suffer a concrete harm. In a suit for damages, the mere exposure to a risk of future harm alone is insufficient to constitute a concrete injury, unless that exposure caused an independent harm. Id. at 436. The risk of future harm on its own is not enough to support Article III standing. Id. Rather, a plaintiff must “demonstrate that the risk of future harm materialized,”
or a plaintiff must “factually establish a sufficient risk of future harm to support Article III standing.” Id. at 437–38. Because the misleading OFAC alerts were never provided to third parties, nor was there a factually established risk that the credit reports would be provided to third-party businesses, the remaining plaintiffs did not have Article III standing. Id. The Supreme Court went on to note that, had there been evidence that the plaintiffs “suffered some other injury[,] such as emotional injury[,] from the mere risk that their credit reports would be provided to third-party businesses” the plaintiffs could have had Article III
standing. Id. at 437. Following TransUnion, several circuit courts have spoken on the issue of standing in the data breach context. See, e.g., Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023); Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022); Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276 (2d Cir. 2023). In Bohnak, the Second Circuit had “no trouble concluding” that exposure of private PII to unauthorized third parties is “sufficiently concrete” to support a claim for damages. Bohnak, 79 F.4th at 285. To be sure, the Second Circuit held that the plaintiff’s exposure “bears some
relationship to a well-established common-law analog: public disclosure of private facts.” Id. (citing Restatement (Second) Torts § 652D (“One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of ... privacy, if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.”)). In Bohnak, the Second Circuit further underscored that the Supreme Court in TransUnion
specifically recognized that “disclosure of private information” was an intangible harm “traditionally recognized as providing a basis for lawsuits in American courts.” Id. at 286 (citing TransUnion, 594 U.S. at 417). Thus, an injury arising from such a disclosure is concrete for purposes of Article III standing. Id. Moreover, the Second Circuit held that the plaintiff’s allegations established a concrete injury for a second reason—she suffered concrete harms “as a result of the risk of future harm occasioned by the exposure of her PII.” Id. Specifically, she alleged that she incurred “out-of-pocket expenses associated with the prevention, detection, and recovery
from identity theft” and “lost time” and other “opportunity costs” associated with attempting to mitigate the consequences of the data breach. Id. Thus, the Second Circuit held that “[t]hese separate and concrete harms foreseeably arising from the exposure of [the plaintiff’s] PII to a malign outside actor, giving rise to a material risk of future harm, independently support standing.” Id. In support, in Bohnak, the Second Circuit cited to similar holdings from the First and Third Circuits. Id. at 286–87. In Webb, the plaintiffs brought suit against a pharmacy after their PII was allegedly exposed in a data breach. 72 F.4th at 369. One of the plaintiffs alleged actual misuse of
her PII. Id. Another plaintiff alleged that, based on the allegations of actual misuse, there is a material risk of future misuse. Id. at 375. The First Circuit held that both plaintiffs plausibly alleged a concrete harm “based on an imminent and substantial risk of future harm as well as a present and concrete harm resulting from the exposure to this risk.” Id. at 369. The Third Circuit in Clemens similarly concluded: Following TransUnion’s guidance, we hold that in the data breach context, where the asserted theory of injury is a substantial risk of identity theft or fraud, a plaintiff suing for damages can satisfy concreteness as long as [the plaintiff] alleges that the exposure to that substantial risk caused additional, currently felt concrete harms. For example, if the plaintiff’s knowledge of the substantial risk of identity theft causes [the plaintiff] to presently experience emotional distress or spend money on mitigation measures like credit monitoring services, the plaintiff has alleged a concrete injury.
Clemens, 48 F.4th at 155-56.
The Court finds these holdings in Bohnak, Webb, and Clemens persuasive. Here, Named Plaintiffs assert six causes of action, each of which encompass at least one of the harms that satisfies Article III standing. Named Plaintiffs allege that their PII/PHI was exposed to a third party. This exposure bears some relationship to a well-established common-law analog: public disclosure of private facts. And the Supreme Court in TransUnion found that the disclosure of private information was an intangible harm traditionally recognized as providing a basis for suit. TransUnion, 594 U.S. at 425. Accordingly, Named Plaintiffs sufficiently allege a concrete injury for standing purposes under Article III. Further, Named Plaintiffs allege that they spent time and money mitigating their risks of identity theft. In Bohnak, the Second Circuit held that the plaintiff alleged concrete harms when she alleged that she incurred “out of pocket expenses associated with the prevention, detection,
and recover from identity theft” and “lost time” as well as “opportunity costs” associated with mitigating the data breach’s impact. Bohnak, 79 F.4th 286. In this case, American Pain encouraged Named Plaintiffs to take precautions due to the Data Breach (Dkt. #4 at p. 5), and Named Plaintiffs allege they expended time and money to protect themselves against identity theft. Named Plaintiffs could have expended their time and money on other things; however, the Data Breach forced them to take precautions they otherwise would not have taken. See Webb, 72 F.4th at 377 (“[T]ime spent
responding to a data breach can constitute a concrete injury sufficient to confer standing, at least when that time would otherwise have been put to profitable use.”) As such, Named Plaintiffs sufficiently allege a concrete injury for standing purposes under Article III. Named Plaintiffs also allege they suffer from emotional distress because of the Data Breach. Relying on TransUnion, the Third Circuit in Clemens recognized that “if the plaintiff’s knowledge of the substantial risk of identity theft causes [the plaintiff] to presently experience emotion distress…the plaintiff has alleged a sufficiently concrete injury.” Clemens, 48 F.4th at 156. Here,
Named Plaintiffs allege the exposure of their PII/PHI caused them emotional distress—namely anxiety, sleep disruption, stress, fear, and frustration (Dkt. #4 at pp. 8-10). Accordingly, Named Plaintiffs sufficiently allege a concrete injury for standing purposes. Thus, Named Plaintiffs’ sufficiently allege concrete and particularized injuries for standing purposes under Article III. For Article III standing, an injury in fact must also be “actual or imminent, not conjectural or hypothetical.” Stringer v. Whitley, 942 F.3d 715, 721 (5th Cir. 2019). “For a threatened future injury to satisfy the imminence requirement, there must be at least a ‘substantial risk’ that the
injury will occur.” Id. Here, American Pain advised Named Plaintiffs to, among other things, “remain vigilant for incidents of fraud and identity theft,” to place fraud alerts and credit freezes on their reports, as well as report suspicious activity to the appropriate law enforcement agencies (See Dkt. #4 at p. 5). The suggested precautions are telling. American Pain realized Named Plaintiffs faced an actual or imminent harm from the Data Breach since third parties may use the PII/PHI for nefarious purposes. Notably, Loftice alleges that following the Data Breach she was
notified “of a fraudulent attempt to open a credit line with JP Morgan Chase & Co.” (Dkt. #4 at p. 10). Thus, the Court is satisfied that there is a substantial risk that the Named Plaintiffs will suffer identity theft as a result of the Data Breach. In conclusion, Named Plaintiffs sufficiently allege concrete and particularized injuries that are imminent or actual. ii. Named Plaintiffs’ injury is traceable to the Data Breach and their injury is redressable.
American Pain focuses solely on the argument that Named Plaintiffs have not alleged a concrete and particularized injury to satisfy Article III standing (Dkt. #8 at p. 7). Therefore, the Court will just briefly address the additional requirements for standing—traceability and redressability. A plaintiff’s alleged injury must be “fairly traceable to the defendant’s allegedly unlawful conduct.” Hein v. Freedom From Religion Found., Inc., 551 U.S. 587, 598 (2007). And “Article III standing requires identification of a remedy that will redress the individual plaintiffs’ injuries.” California v. Texas, 593 U.S. 659, 660 (2021). Here, Named Plaintiff’s alleges that American Pain’s actions led to the disclosure of their
private information. Thus, the Court is satisfied that Named Plaintiff’s injury is fairly traceable to American Pain’s alleged conduct at this stage. And Named Plaintiffs have alleged that monetary relief would compensate them, which renders their injury redressable. II. American Pain’s 12(b)(6) Motion to Dismiss American Pain argues that Named Plaintiff’s claims should be dismissed under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim (Dkt. #8 at p. 11). Having considered
the motion and the relevant pleadings, the Court finds that Named Plaintiffs have stated plausible claims for purposes of defeating a Rule 12(b)(6) motion for the following claims: 1) negligence; 2) breach of contract; 3) breach of fiduciary duty; 4) intrusion upon seclusion; and 5) unjust enrichment. However, Named Plaintiffs do not state a plausible claim for negligence per se. Named Plaintiffs allege a claim for negligence per se, arguing that American Pain “violated [the Health Insurance Portability and Accountability Act (“HIPAA”)] by failing to comply with mandated safeguards and Section 5 of the [Federal Trade Commission Act (“FTC Act”)] by
failing to provide fair, reasonable or adequate computer systems and data security practices to safeguard PII/PHI” (Dkt. #12 at p. 21). American Pain moves to dismiss Named Plaintiff’s claim for negligence per se under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim (Dkt. #8 at p. 13). In support, American Pain argues that there is no private right of action under the FTC Act or HIPAA, so “it would be inconsistent with the legislative intent to impose private civil liability for a violation thereof” (Dkt. #8 at p. 13). “Negligence per se is a common-law doctrine in which a duty is imposed based on a standard of conduct created by a penal statute rather than on the reasonably prudent person test used in pure negligence claims.” Smith v. Merritt, 940 S.W.2d 602, 607 (Tex. 1997). “Under Texas
law, when a legislative body declines to provide for an individual private right of action in a statute and instead provides a comprehensive regulatory scheme with limited private remedies, that statute will not be an appropriate basis for a negligence per se claim.” Armstrong v. Sw. Airlines Co., No. 3:20-CV-3610-BT, 2021 WL 4391247, at *3 (N.D. Tex. Sept. 24, 2021) (citing Smith, 940 S.W.2d at 607–08; Reeder v. Daniel, 61 S.W.3d 359, 362–63 (Tex. 2001)). When “determine[ing] whether a given statute may be the basis for a negligence per se claim, Texas courts must ‘consider
whether recognizing such an accompanying civil action would be inconsistent with legislative intent.’” Id. (quoting Reeder, 61 S.W.3d at 362). “Texas courts ‘will not disturb the Legislature’s regulatory scheme by judicially recognizing a cause of action’ not contemplated in the statute.” Id. (quoting Reeder, 61 S.W.3d at 364). The FTC Act does not create a private cause of action. Thomas v. Culpepper, No. 4:18-CV- 814-ALM-CAN, 2019 WL 6037992 (E.D. Tex. July 29, 2019), report and recommendation adopted, No. 4:18-CV-814, 2019 WL 4564837 (E.D. Tex. Sept. 20, 2019) (citing Fulton v. Hecht, 580 F.2d
1243, 1248 n.2 (5th Cir. 1978)). Likewise, “there is no private cause of action under HIPAA.” Acara v. Banks, 470 F.3d 569, 572 (5th Cir. 2006). Other Texas state courts and federal courts applying Texas law have declined to recognize negligence per se claims based upon statutes that do not create a private right of action. See, e.g., Smith, 940 S.W.2d at 607 (holding that violating section 106.06 of the Texas Alcohol Beverage Code “does not create a negligence per se cause of action” because “[t]o hold otherwise would ignore the intent and policies of the Legislature.”); Baker v. Smith & Nephew Richards, Inc., No. 95-58737, 1999 WL 811334, at *18 (152nd Dist. Ct., Harris County, Tex. June 7, 1999), aff’d sub nom. McMahon v. Smith & Nephew Richards, Inc., No. 14-99-00616-CV, 2000 WL 991697 (Tex. App.—Houston [14th Dist.] July 20, 2000, no pet.)
(mem. op., not designated for publication) (holding where there is “Congressional prohibition of private rights of action” under a statute, allowing negligence per se claims based upon that statute would be “both legally improper and ill-advised”); Armstrong, 2021 WL 4391247, at *4 (holding the Air Carrier Access Act that “precludes a private right of action ... is not a proper basis for a negligence per se claim under Texas law”); Walters v. Blue Cross & Blue Shield of Texas, Inc., No. 3:21-CV-981-L, 2022 WL 902735, at *6 (N.D. Tex. Mar. 28, 2022) (holding that HIPAA is not a
proper basis for a negligence per se claim under Texas law because the statute does not contain a private right of action). Given these prior rulings, the Court finds that neither the FTC Act nor HIPAA is an appropriate basis for a negligence per se claim. Named Plaintiffs’ negligence per se claims should be dismissed. CONCLUSION For the foregoing reason, Defendant’s Rule 12(b)(1) and (6) Motion to Dismiss (Dkt. #8) is hereby GRANTED in part and DENIED in part.
Specifically, it is ORDERED that Plaintiffs Richard Smith’s and Shae Loftice’s claims for negligence per se are DISMISSED with prejudice. It is further ORDERED that Defendant American Pain and Wellness, PLLC’s Rule 12(b)(1) and (6) Motion to Dismiss is DENIED in all other respects. IT IS SO ORDERED.