147 F. Supp. 3d 646
E.D. Tex.2015Background
- Baylor Frisco (hospital) required employees to sign confidentiality/security agreements and handbook acknowledgments restricting use, copying, and transmission of confidential patient, peer-review, proprietary, and strategic business information.
- Cindy Bledsoe (COO) and Michael Bledsoe (IT admin) had network access; Cindy installed Dropbox on her Baylor computer shortly after accepting new employment and synced her H: drive to Dropbox, transmitting numerous confidential files to her personal account in late Oct–Nov 2011; Michael installed Dropbox and later wiped an employer iPad.
- Forensic investigations (HP, Navigant, Pathway) found many Baylor Frisco files (peer-review, PHI, business plans, MORs, employee files, licensed training materials) synced to Dropbox and/or present in carved/unallocated space on Bledsoes’ devices; Pathway confirmed Dropbox transfers were intentional.
- Baylor Frisco incurred forensic investigation costs of about $218,000 and attorneys’ fees/expenses exceeding $1.19 million; it sued the Bledsoes (Fraud Lawsuit) and later filed an adversary proceeding seeking nondischargeability under 11 U.S.C. §§ 523(a)(4) and (6).
- Defendants filed no response to Baylor Frisco’s motion for summary judgment; the district court granted summary judgment in favor of Baylor Frisco on all asserted claims and ruled related debts non-dischargeable in bankruptcy.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Violation of CFAA (unauthorized/exceeded authorization access; §1030(a)(2),(4),(5)) | Bledsoes intentionally exceeded authorized access, copied/transferred data via Dropbox causing loss; data value > $5,000; forensic costs are CFAA loss. | (No response filed) Defenses not asserted; contested facts absent. | Court: Grants summary judgment — CFAA violations proven; plaintiff incurred recoverable "loss" (forensic costs) and data misappropriation/damage shown. |
| Violation of ECPA/Stored Communications Act (§2701) | Bledsoes exceeded authorized access to facilities providing electronic communications and obtained communications in electronic storage by transferring files to Dropbox. | (No response filed) | Court: Grants summary judgment — ECPA/SCA violations; damages and attorneys’ fees recoverable under §2707(c). |
| Breach of Contract (confidentiality agreements & handbook) | Bledsoes breached express agreements by unauthorized removal/copying/transmission; breach caused injury (investigation fees, lost confidentiality). | (No response filed) | Court: Grants summary judgment — contractual breach established; plaintiff entitled to attorneys’ fees. |
| Breach of fiduciary duty and bankruptcy nondischargeability (§523(a)(4),(6)) | As employees/COO and IT admin, Bledsoes owed fiduciary duties and breached them by misappropriation and data destruction; conduct was embezzlement and willful/malicious, so debts (including fees) are non-dischargeable. | (No response filed) | Court: Grants summary judgment — fiduciary breach and embezzlement established; debts found non-dischargeable under §523(a)(4) and §523(a)(6); attorneys’ fees relating to fraud/adversary are non-dischargeable. |
Key Cases Cited
- Celotex Corp. v. Catrett, 477 U.S. 317 (summary judgment standard)
- Anderson v. Liberty Lobby, 477 U.S. 242 (materiality and genuine dispute standard for summary judgment)
- Fontenot v. Upjohn Co., 780 F.2d 1190 (movant must establish essential elements when bearing burden at summary judgment)
- Byers v. Dallas Morning News, 209 F.3d 419 (nonmovant must set forth particular facts to create a genuine issue)
- Turner v. Baylor Richardson Med. Ctr., 476 F.3d 337 (court should not make credibility determinations at summary judgment)
- A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630 (forensic investigation costs can constitute CFAA "loss")
- In re Am. Online, Inc., 168 F. Supp. 2d 1359 (data commonly treated as the item of value in CFAA cases)
- Miller v. J.D. Abrams Inc., 156 F.3d 598 (embezzlement definition under §523(a)(4) and implied malice standard for §523(a)(6))
- Kawaauhau v. Geiger, 523 U.S. 57 (definition and scope of §523(a)(6) willful and malicious injury)
- Cohen v. de la Cruz, 523 U.S. 213 (attorneys’ fees awarded for fraud-related judgment are nondischargeable)