Tot v. eClinicalWorks, LLC

• Court: District Court, D. Massachusetts
• Decided: March 27, 2019
• Docket: 1:18-cv-11658
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

CIVIL ACTION NO. 18-11658-RGS

ROBERT AMRHEIN, as Administrator of the Estate of STJEPAN TOT, and RANDY STERN, as Executor of the Estate of ANNETTE MONACHELLI, on behalf of themselves and all others similarly situated

v.

ECLINICAL WORKS, LLC

MEMORANDUM AND ORDER ON DEFENDANT’S MOTION TO DISMISS AND MOTION TO STRIKE NATIONWIDE CLASS ALLEGATIONS

March 27, 2019

STEARNS, D.J. Robert Amrhein, as Administrator of Stjepan Tot’s Estate,1 and Randy Stern, as Executor of Annette Monachelli’s Estate, bring this putative class action against eClinical Works, LLC (ECW), for failing to protect theirs and other patients’ healthcare records.2 The Amended Complaint sets out five claims: breach of fiduciary duty and constructive fraud (Count I), negligence

1 Robert Amrhein was substituted for Kristina Tot. See Dkt # 39.

2 ECW is incorporated in Delaware and headquartered in Massachusetts. At the time of their deaths, Tot was a citizen of New York, and Monachelli was a citizen of Vermont. Plaintiffs allege over $5 million in damages. Am. Compl. (Dkt # 22) ¶¶ 11-13. See 28 U.S.C. §§ 1332(d)(2), (5)(B). (Count II), breach of express warranty (Count III), breach of implied warranty of merchantability and fitness for intended purpose (Count IV),

and unfair or deceptive business practices in violation of Mass. Gen. Laws ch. 93A, §§ 2, 9 (Count V).3 ECW moves to dismiss the Amended Complaint for lack of subject-matter jurisdiction and for failure to state a claim. ECW also moves to strike the nationwide class allegations. For the reasons to be

explained, ECW’s motion to dismiss will be allowed for lack of standing and ECW’s motion to strike will be denied as moot. BACKGROUND

The facts, viewed in the light most favorable to plaintiffs as the nonmoving party, are as follows. ECW is “a leading cloud-based Electronic Health Records (‘EHR’) vendor in the U.S. used by hospitals, doctors, health groups and other healthcare and medical providers.” Am. Compl. (Dkt # 22)

¶ 1. ECW’s software is used by 130,000 physicians nationwide and is chosen by “up to 90% of healthcare providers.” Id. ¶¶ 12, 62. Plaintiffs allege that ECW violated its duty to patients by “fail[ing] to provide, secure and safeguard the[ir] healthcare records.” Id. ¶ 1. Plaintiffs also allege that

“ECW falsely represented to healthcare providers, its certifying bodies and

3 The Amended Complaint incorrectly numbers the counts by failing to include a “Count IV.” the federal government that its software complied with the requirements for certification.”4 Id. ¶ 5. According to the Amended Complaint, ECW’s

software displayed incorrect medical information, presented multiple patients’ information at once, failed to properly display medical history, and did not accurately record the users’ actions. As a result, ECW compromised plaintiffs’ healthcare records, and those of “millions of patients nationwide.”

Id. ¶ 9.5 In 2016, before his death, Tot learned that his physician could not “deactivate” inaccurately recorded “active” problems. Id. ¶¶ 39-40. After

Annette Monachelli died as a result of a cerebral aneurism in February of 2013, Stern learned that her physician had ordered a magnetic resonance angiogram (MRA) that was never performed. Although a Diagnostic Image (DI) entry showed that her physician had placed the order, “the entry was

not in the DI tab, indicating that the ECW software either dropped the order

4 Under the Meaningful Use Program, which was established pursuant to the Health Information Technology for Economic and Clinical Health (HITECH) Act, 42 U.S.C. §§ 17901-17953, the Centers for Medicare & Medicaid Services (CMS) provides incentive payments to healthcare providers that demonstrate “meaningful use” of certified EHR technology. To qualify, healthcare providers must certify annually that their software can perform certain functions.

5 On May 31, 2017, ECW settled with the U.S. Department of Justice (DOJ) for $155 million over allegations that it, among other things, falsely obtained certification for its EHR software. or failed to populate the appropriate screens through which orders are communicated and tracked.” Id. ¶ 44. Stern contends that had Monachelli

undergone an MRA, her brain aneurysm could have been detected before it ruptured, and possibly repaired.6 DISCUSSION Article III standing addresses whether the plaintiff has “such a

personal stake in the outcome of the controversy as to assure that concrete adverseness which sharpens the presentation of issues upon which the court so largely depends for illumination.” Baker v. Carr, 369 U.S. 186, 204

(1962).7 “[A]t the pleading stage, the plaintiff bears the burden of

6 Plaintiffs also assert allegations on behalf of a putative class “of all persons residing in the U.S. whose healthcare providers used ECW software to record and store their medical records from Jan. 17, 2007 to May 31, 2017.” Am. Compl. (Dkt # 22) ¶ 51. Because the court will ultimately grant ECW’s motion to dismiss, it does not reach the merits of the class action allegations.

7 As ECW seeks dismissal of the Amended Complaint for lack of subject-matter jurisdiction under Fed. R. Civ. P. 12(b)(1) and for failure to state a claim under Fed. R. Civ. P. 12(b)(6), the court proceeds first to determine jurisdiction by addressing standing. See Ne. Erectors Ass’n of BTEA v. Sec’y of Labor, Occupational Safety & Health Admin., 62 F.3d 37, 39 (1st Cir. 1995) (“When faced with motions to dismiss under both 12(b)(1) and 12(b)(6), a district court, absent good reason to do otherwise, should ordinarily decide the 12(b)(1) motion first.”). The court “glean[s] the relevant background information from the plaintiffs’ amended complaint, accepting the well-pleaded factual averments contained therein and indulging all reasonable inferences in the plaintiffs’ favor.” Muniz-Rivera v. United States, 326 F.3d 8, 11 (1st Cir. 2003). establishing sufficient factual matter to plausibly demonstrate his standing to bring the action.” Hochendoner v. Genzyme Corp., 823 F.3d 724, 731 (1st

Cir. 2016). To do so, the plaintiff “must establish each part of a familiar triad: injury, causation, and redressability.” Katz v. Pershing, LLC, 672 F.3d 64, 71 (1st Cir. 2012). To prove an injury-in-fact, the plaintiff must show “an invasion of a legally-protected interest that is both concrete and

particularized, and actual or imminent.” Benjamin v. Aroostook Med. Ctr., Inc., 57 F.3d 101, 104 (1st Cir. 1995). “The requirement of an actual or imminent injury ensures that the harm has either happened or is sufficiently

threatening; it is not enough that the harm might occur at some future time.” Katz, 672 F.3d at 71, citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 564 (1992). Plaintiffs contend that they have Article III standing because ECW’s

failure to maintain accurate and reliable medical records not only creates a risk of future injury, but also constitutes an injury itself. See Baur v. Veneman, 352 F.3d 625, 633 (2d Cir. 2003) (“[T]he courts of appeals have generally recognized that threatened harm in the form of an increased risk

of future injury may serve as injury-in-fact for Article III standing purposes.”). In support, plaintiffs primarily rely on identity theft and data breach cases. See, e.g., Hutton v. Nat’l Bd. of Examiners in Optometry, Inc., 892 F.3d 613, 622 (4th Cir. 2018) (“Plaintiffs have sufficiently alleged an imminent threat of injury to satisfy Article III standing” because they “allege

that they have already suffered actual harm in the form of identity theft and credit card fraud.”); Galaria v. Nationwide Mut. Ins. Co., 663 F. App’x 384, 388 (6th Cir. 2016) (finding Article III standing because “[w]here a data breach targets personal information, a reasonable inference can be drawn

that the hackers will use the victims’ data for the fraudulent purposes alleged in Plaintiffs’ complaints”). According to plaintiffs, while “[d]efendants in the data breach cases merely exposed confidential data to third parties who

would likely use it to harm plaintiffs,” here “ECW’s abuse of the confidential data is more direct” because “ECW took confidential medical information and ta[m]pered with it, altered it, through negligence or recklessness, and destroyed its reliability.” Opp’n (Dkt # 40) at 10.

Plaintiffs’ reliance on identity theft and data breach cases is misplaced. In those cases, data was stolen and at risk of being misused. See Katz, 672 F.3d at 79 (“Without any reference to an identified breach of the plaintiff’s data security, the complaint does not show an injury sufficient to give rise to

Article III standing.”). Here, plaintiffs do not allege that their confidential information was breached by a third party, but only that ECW’s software produced inaccurate and unreliable medical records. While the Amended Complaint omits any suggestion that Tot was personally harmed by his physician’s inability to deactivate inaccurately recorded medical

information, it does suggest that Monachelli may have suffered from the software’s failure to properly register her physician’s request for an MRA. However, the claim for class damages with respect to all five counts is based on the allegation that “no member of the Class can rely on the accuracy and

integrity of their healthcare records maintained on ECW software.” Am. Compl. (Dkt # 22) ¶¶ 66, 71, 77, 84, 93. Consequently, plaintiffs seek class damages consisting of “the cost of investigation and remediation of

compromised healthcare records.” Id. ¶¶ 67, 72. They do not seek damages for personal injury or wrongful death.8 For purposes of standing, however, the problem is this: an inability to rely on the accuracy of personal medical records is not a concrete injury, nor

does it create an imminent risk of harm.9 See Kelen v. Nordstrom, Inc., 259

8 There are inherent difficulties in proving injury under the “loss-of- chance” doctrine, see Matsuyama v. Birnbaum, 452 Mass. 1, 16-17 (2008), presumably the theory under which Monachelli’s estate is pursuing a medical malpractice claim against her healthcare provider, see Mem. (Dkt # 26) at 8 n.4. Even positing such an injury, however, it is unlikely to be one shared by the vast majority of members of the putative class.

9 As ECW asserts in its Reply, “there can be no ‘risk of harm’ to either Mr. Tot or Ms. Monachelli, because both are deceased and thus have no occasion to ‘depend on the accuracy of their medical records’ in the future.” Reply (Dkt # 45) at 1-2 (citations omitted). F. Supp. 3d 75, 80 (S.D.N.Y. 2016) (“[T]he dissemination of incorrect information to a plaintiff does not alone create a risk of real harm to the

plaintiff. Rather, Article III requires some indication that the inaccuracy would harm the plaintiff, and some ‘misinformation may be too trivial to cause harm or present any material risk of harm.’”) (citation omitted). Thus, plaintiffs have failed to plead an injury sufficient to establish standing.10 See

United States v. Students Challenging Regulatory Agency Procedures (SCRAP), 412 U.S. 669, 688-689 (1973) (“A plaintiff must allege that he has been or will in fact be perceptibly harmed . . ., not that he can imagine

circumstances in which he could be affected[.]”). ORDER For the foregoing reasons, defendant’s motion to dismiss for lack of subject-matter jurisdiction is ALLOWED without prejudice.11 Defendant’s

motion to strike nationwide class allegations is DENIED as moot. SO ORDERED. /s/ Richard G. Stearns UNITED STATES DISTRICT JUDGE

10 Having so concluded, the court need not reach ECW’s alternate arguments under the Fed. R. Civ. P. 12(b)(6) or its motion to strike nationwide class allegations.

11 “Because a dismissal for lack of standing is functionally equivalent to a dismissal for lack of jurisdiction, the resulting judgment will . . . operate without prejudice.” Hochendoner, 823 F.3d at 728.