565 F.Supp.3d 101
D. Mass.2021Background
- Zoll Medical (parent) and Zoll Services (subsidiary) used Apptix/Fusion to host emails containing PHI for ~277,000 patients; Apptix licensed Sonian’s email-archiving tech under an OEM Agreement; Sonian was later acquired by Barracuda.
- On Nov. 8, 2018, during a data migration, a Barracuda employee allegedly left a data port open; unauthorized access to emails occurred and was not detected until ~Dec. 28, 2018.
- Barracuda notified Apptix in January 2019 but allegedly minimized the breach and did not disclose the length of exposure; Zoll hired outside forensics and disclosed the breach publicly.
- A class action by affected patients in West Virginia was filed and settled, leaving Zoll Services potentially liable to its patients; Zoll seeks to recover costs and liability from Barracuda/Sonian.
- In Nov. 2020 Zoll sued Barracuda and Sonian alleging negligence; breach of implied warranties (merchantability and fitness); breach of written contract as a third-party beneficiary; and equitable indemnity. Defendants moved to dismiss.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Negligence / Economic-loss rule | Zoll says a noncontractual duty (common-law privacy or HIPAA-based) or reliance on Barracuda’s promise to Fusion allows tort recovery of economic losses. | Economic-loss doctrine bars purely economic tort recovery; no independent tort duty exists outside contract; Zoll didn’t rely on Barracuda’s promise. | Claim dismissed. Economic-loss doctrine applies; no pleaded independent tort duty and reliance exception inapplicable. |
| HIPAA as tort duty | HIPAA obligations create a separate legal duty to protect PHI supporting negligence. | HIPAA does not create a private tort cause of action or independent tort duty. | Court rejects HIPAA-as-tort-duty theory (no authority that HIPAA creates a tort duty). |
| Breach of implied warranties (merchantability & fitness) | Plaintiffs say Sonian’s archived-product was defective and warranties apply despite OEM labeling. | OEM Agreement disclaims and conspicuously waives implied warranties. | Claims dismissed. Written, conspicuous disclaimers waived implied warranties. |
| Third-party beneficiary (written contract) | Zoll claims it was an intended beneficiary of the OEM Agreement between Barracuda/Sonian and Apptix. | OEM Agreement shows parties intended Apptix/Fusion to manage downstream customer relationships; Zoll not intended beneficiary. | Claim dismissed. Agreement does not clearly and definitely intend to benefit Zoll. |
| Equitable indemnity | Zoll seeks tort-based indemnity for liability to patients caused by Barracuda’s negligence. | Barracuda argues Zoll bears fault too. | Claim survives. Zoll plausibly alleges passive/vicarious fault and entitlement to equitable indemnity at pleading stage. |
| Motion to amend complaint | Zoll sought leave to amend to cure deficiencies. | Defendants oppose amendment. | Request to amend denied. |
Key Cases Cited
- Ashcroft v. Iqbal, 556 U.S. 662 (2009) (plausibility pleading standard)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007) (pleading must state plausible claim)
- Ocasio-Hernandez v. Fortuno-Burset, 640 F.3d 1 (1st Cir. 2011) (pleading and inference principles)
- FMR Corp. v. Boston Edison Co., 613 N.E.2d 902 (Mass. 1993) (economic-loss doctrine bars purely economic tort recovery)
- Cumis Ins. Soc'y, Inc. v. BJ's Wholesale Club, 918 N.E.2d 36 (Mass. 2009) (reliance exception to economic-loss doctrine requires plaintiff's reasonable reliance)
- Wyman v. Ayer Props., LLC, 11 N.E.3d 1074 (Mass. 2014) (contractual allocation can preclude tort recovery)
- Miller v. Nichols, 586 F.3d 53 (1st Cir. 2009) (no private right of action under HIPAA)
- Theos & Sons, Inc. v. Mack Trucks, Inc., 729 N.E.2d 1113 (Mass. 2000) (successor/purchaser cannot have greater warranty rights than original buyer)
- Araujo v. Woods Hole, Martha's Vineyard, Nantucket Steamship Auth., 693 F.2d 1 (1st Cir. 1982) (standards for tort-based equitable indemnity)