Polanco v. Omnicell, Inc.
2013 U.S. Dist. LEXIS 180322
D.N.J.2013Background
- Plaintiff Bobbi Polanco filed a putative class action alleging that a laptop owned by Omnicell was stolen on Nov. 14, 2012 and contained unencrypted patient confidential information (PCI), including her daughter’s treatment data; Omnicell provides automated medication-dispensing services to hospitals.
- Defendants: Omnicell (vendor), Sentara (Virginia hospital system), South Jersey Health System / Inspira (NJ hospitals), and the Board of Regents of the University of Michigan (UM). Plaintiff alleges state-law claims (security-notification statutes, consumer-fraud statutes in NJ/VA/MI, fraud, negligence, conspiracy) based on the breach and allegedly misleading notification.
- Omnicell’s December 31, 2012 letter (attached to the complaint) stated that patient medical records, financial information, and Social Security numbers were not on the device and that there was no reason to believe the information was accessed or used improperly.
- Defendants moved to dismiss under Rules 12(b)(1), 12(b)(2), and 12(b)(6). Key threshold dispute: Article III standing (injury-in-fact and causation) and Eleventh Amendment immunity for the Board of Regents.
- The court found the Board of Regents is an arm of the State of Michigan entitled to Eleventh Amendment immunity and dismissed claims against it for lack of jurisdiction. The court also held Polanco lacks Article III standing as to other defendants because her alleged harms were speculative (no misuse of data alleged) and out-of-pocket expenses were prophylactic and not traceable injuries.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Standing — injury-in-fact from data breach | Polanco: her PCI/PHI was lost and she incurred out-of-pocket expenses (sought care elsewhere); statutory violations suffice to show injury | Defendants: no misuse of data alleged; alleged harms are speculative and costs were voluntarily incurred to avoid a risk | Held: No Article III standing — injury is speculative; prophylactic expenses insufficient; complaint dismissed for lack of jurisdiction |
| Standing — causation as to individual defendants (Sentara) | Polanco: seeks classwide relief; defendants’ systems entrusted with patient data | Sentara: Polanco never had any relationship with Sentara and never provided PCI to Sentara, so injury is not traceable to it | Held: Polanco lacks standing to sue Sentara because she did not allege any facts tying her injury to Sentara |
| Eleventh Amendment immunity (Board of Regents / Univ. of Michigan) | Polanco: sovereign immunity abrogated because constitutional privacy rights were violated | Regents: is an arm of the state entitled to immunity; no waiver or abrogation applies; §1983 does not abrogate immunity | Held: Board of Regents is an arm of the State and entitled to Eleventh Amendment immunity; claims dismissed without prejudice for lack of jurisdiction |
| Sufficiency of statutory/HIPAA-based injury | Polanco: violations of data-security/notification laws and HIPAA show injury and justify relief | Defendants: HIPAA provides no private right of action; statutory violation alone is not an Article III injury | Held: Court rejects statutory/HIPAA injury theory — HIPAA provides no private remedy and statutory allegations do not substitute for a concrete Article III injury |
Key Cases Cited
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (U.S. 1992) (establishes Article III standing elements)
- Clapper v. Amnesty Int’l USA, 568 U.S. 398 (U.S. 2013) (speculative future injury is insufficient for standing)
- Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011) (data-breach plaintiffs lack standing absent misuse or concrete harm)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (U.S. 2007) (pleading standard requiring plausible claim)
- Ashcroft v. Iqbal, 556 U.S. 662 (U.S. 2009) (application of Twombly standard to factual and legal conclusions)
- Quern v. Jordan, 440 U.S. 332 (U.S. 1979) (§1983 does not abrogate state sovereign immunity)
- Will v. Michigan Dep’t of State Police, 491 U.S. 58 (U.S. 1989) (states immune from suit for damages under §1983)
- Kovats v. Rutgers, The State Univ., 822 F.2d 1303 (3d Cir. 1987) (factors for Eleventh Amendment immunity for public universities)