598 F.Supp.3d 1145
D.N.M.2022Background
- Plaintiffs filed a putative class action after a January–February 2021 ransomware attack on Rehoboth McKinley Christian Health Care Services that exposed patient PII and PHI; defendant discovered the breach Feb. 16 and began notice May 19.
- Plaintiffs allege RMCHCS failed to follow FTC guidance, industry standards, and HIPAA security obligations, causing heightened risk of identity fraud, increased phishing/scam calls, time spent monitoring accounts, anxiety, and loss of value of private information.
- Causes of action asserted: negligence, intrusion upon seclusion (intentional privacy tort), negligence per se (based on FTCA standards), breach of implied contract, breach of fiduciary duty, unjust enrichment, New Mexico Unfair Practices Act (UPA), and Arizona Consumer Fraud Act (ACFA).
- RMCHCS moved to dismiss, arguing (inter alia) it owed no duty to protect data from third‑party criminals, Plaintiffs lack cognizable damages, and multiple counts fail under pleading rules and applicable law.
- The magistrate judge denied the no‑duty argument, found Plaintiffs adequately pleaded damages at the motion‑to‑dismiss stage (time spent monitoring, phishing incidents), sustained several claims (negligence, negligence per se, fiduciary duty, unjust enrichment, UPA, ACFA omissions), and dismissed without prejudice counts for intrusion (intentional tort), breach of implied contract (for failure to allege consideration by named plaintiffs), and ACFA affirmative misrepresentations; leave to amend was granted.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Duty to protect data from third‑party hackers | RMCHCS had a duty of ordinary care to protect patients' PII/PHI (special relationship, industry/HIPAA/FTC standards inform duty) | No actionable duty because defendant could not control third‑party hackers and statutes only require notice | Court: duty of ordinary care exists; reject no‑duty defense (policy questions reserved to court but foreseeability is for factfinder) |
| Damages / standing | Plaintiffs spent time monitoring accounts, received phishing calls, suffered anxiety and loss of value of data | Alleged harms are speculative; Plaintiffs did not allege actual damages or fraud | Court: allegations of increased time monitoring and phishing calls are sufficient at pleading stage; causation and proof are factual issues |
| Negligence per se (FTCA) | FTCA standards (Section 5) can define the applicable standard of care for negligence/negligence per se even absent a private right of action | FTCA provides no private right and targets deceptive acts only, so it cannot support negligence per se | Court: rejects requirement that FTCA create a private right or that deception is required; negligence per se theory may proceed |
| ACFA (Arizona) — affirmative vs omission | Plaintiffs alleged affirmative misrepresentations about data protection and omissions about noncompliance | Rule 9(b) requires particularity for fraud; affirmative misstatements are too general | Court: affirmative‑misrepresentation ACFA claim dismissed for failure to meet Rule 9(b); omission‑based ACFA claims survive (sufficiently pleaded) |
| Breach of implied contract | Plaintiffs paid for services and implicitly bargained for protection of private data | Complaint fails to allege named Plaintiffs paid consideration (allegations speak only of class members) | Court: implied contract count dismissed without prejudice for failure to plead consideration by named plaintiffs; amendment permitted |
| Intrusion into private affairs (intentional tort) | Defendant intentionally failed to protect/disclosed private information | Allegations show negligence, not intentional intrusion; no specific facts of intent | Court: intentional intrusion claim dismissed for lack of factual allegations showing intent |
Key Cases Cited
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (pleading must be plausible)
- Ashcroft v. Iqbal, 556 U.S. 662 (courts need not accept legal conclusions as true)
- Rodriguez v. Del Sol Shopping Ctr. Assocs., L.P., 326 P.3d 465 (N.M. 2014) (New Mexico: duty of ordinary care applies unless court limits duty on policy grounds; foreseeability is for the factfinder)
- Grover v. Stechel, 45 P.3d 80 (N.M. Ct. App. 2002) (third‑party criminal conduct and foreseeability analysis—limited by Rodriguez)
- Burnett v. Mortg. Elec. Registration Sys., Inc., 706 F.3d 1231 (10th Cir. 2013) (pleading must give defendant fair notice of claim and grounds)
- Warth v. Seldin, 422 U.S. 490 (1975) (plaintiffs must allege personal injury, not just injury to class)
- Sanchez v. Martinez, 653 P.2d 897 (N.M. Ct. App. 1982) (damages cannot be speculative)
- Oakey, Estate of Lucero v. May Maple Pharmacy, Inc., 399 P.3d 939 (N.M. Ct. App. 2017) (statutes/regulations can inform standard of care)