Larry Tabata v. Charleston Area Medical Center
759 S.E.2d 459
W. Va.2014Background
- CAMC disclosed online, by error, a database containing personal and medical data for 3,655 patients (names, contact info, SSNs, DOBs, limited respiratory-care data); data remained publicly accessible Sept 2010–Feb 2011 and CAMC offered one year of credit monitoring.
- Five named plaintiffs sued CAMC and CAMC Health Foundation individually and on behalf of a putative class, alleging breach of confidentiality, invasion of privacy (intrusion/unreasonable publicity), and negligence.
- Discovery showed no evidence that any unauthorized party accessed the records, no identity theft, and no economic loss to the named plaintiffs or known class members.
- The circuit court denied class certification, finding plaintiffs lacked standing (no concrete injury) and failed Rule 23 commonality, typicality, and predominance.
- The West Virginia Supreme Court reversed: held plaintiffs have standing for breach of confidentiality and invasion of privacy claims and that the circuit court abused its discretion in denying class certification on commonality, typicality, and predominance grounds.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing to sue after exposure of medical data | Exposure of confidential medical data and increased risk of identity theft constitute legally protected, concrete injuries (breach of confidentiality and invasion of privacy) | No concrete, particularized injury; risk of future identity theft is conjectural and insufficient for standing | Plaintiffs have standing to pursue breach of confidentiality and invasion of privacy claims; risk alone insufficient but the recognized privacy/confidentiality interests are concrete and particularized |
| Commonality under Rule 23(a)(2) | Claims arise from same disclosure event and common legal questions (duty/confidentiality breach; privacy invasion) | Individualized facts and harms make common issues insufficient | Common nucleus of operative fact and law exists; commonality satisfied; circuit court abused its discretion in denying on this ground |
| Typicality under Rule 23(a)(3) | Representatives’ claims arise from same event and legal theories as putative class | Variations among class members’ injuries defeat typicality | Typicality satisfied because claims arise from same event and legal theory; factual variations do not defeat typicality |
| Predominance under Rule 23(b)(3) | Common legal questions (duty, breach, privacy invasion) predominate over individual damages/causation questions | Individual issues of causation, damages, and remedies will predominate, making class action inappropriate | Common questions of law and fact predominate; class certification requirements (commonality, typicality, predominance) met; remand for further proceedings |
Key Cases Cited
- Zikos v. Clark, 214 W.Va. 235, 588 S.E.2d 400 (W. Va. 2003) (standing is a legal question reviewed de novo)
- In re W. Va. Rezulin Litigation, 214 W.Va. 52, 585 S.E.2d 52 (W. Va. 2003) (standard and prerequisites for Rule 23 class certification; abuse of discretion review)
- Findley v. State Farm Mut. Auto. Ins. Co., 213 W.Va. 80, 576 S.E.2d 807 (W. Va. 2002) (articulation of standing elements)
- Morris v. Consol. Coal Co., 191 W.Va. 426, 446 S.E.2d 648 (W. Va. 1994) (recognition of patient cause of action for breach of duty of confidentiality)
- R.K. v. St. Mary’s Med. Ctr., Inc., 229 W.Va. 712, 735 S.E.2d 715 (W. Va. 2012) (medical/personal health information torts not preempted by HIPAA)
- Roach v. Harper, 143 W.Va. 869, 105 S.E.2d 564 (W. Va. 1958) (right of privacy recognized; no need to plead special damages)
- Crump v. Beckley Newspapers, Inc., 173 W.Va. 699, 320 S.E.2d 70 (W. Va. 1984) (components of invasion-of-privacy tort)