869 F. Supp. 2d 893
N.D. Ill.2012Background
- Worix sues MedAssets, Inc. on behalf of himself and a putative class for failure to safeguard his personal information and for inadequate notification after a hard drive theft containing patient data was stolen.
- The Court previously dismissed Worix’s complaint under Rule 12(b)(6) and allowed amendment; Worix filed a combined motion to reconsider the dismissal of count one and amend counts two and three.
- The theft involved a MedAssets employee’s car, affecting Cook County Health & Hospitals System patients; the Court assumed familiarity with the factual summary from the prior decision.
- The prior decision held the SCA claim failed because the alleged safeguards did not amount to “knowingly divulge” under the statute, and the negligence and ICFA claims failed due to lack of compensable injury.
- Worix’s proposed amendment alleges emotional distress and privacy invasion from the breach and, allegedly, employment consequences; the Court addresses whether to reconsider, and whether to allow amendments to negligence and ICFA claims.
- The case remains set for a status hearing to schedule further proceedings.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether Worix’s SCA claim survives reconsideration | Worix argues discovery could reveal deliberate actions by MedAssets showing knowing disclosure. | MedAssets contends there is no manifest error; no actual knowing disclosure is pled. | Denied; count one remains dismissed. |
| Whether Worix may amend to assert negligence duties and disclosures | Worix contends MedAssets owed a duty to safeguard data and to provide prompt notification. | MedAssets argues no duty exists under common law, HIPAA, or PIPA for Worix as non-owner. | Court denies amendment of count two; no basis under cited authorities. |
| Whether Worix may amend to preserve an ICFA claim | Worix argues unfair practices including failure to prevent risk and improper notification support ICFA liability. | MedAssets contends insufficient injury and reliance on emotional distress absent compensable injury. | Court grants amendment of count three; ICFA claim survives. |
| Whether class allegations are appropriate at this stage | Discovery may show common questions enabling class treatment. | Class certification should be decided later; premature to strike or foreclose class claims. | Not dismissal at this stage; discovery may inform later class certification. |
Key Cases Cited
- Global-Tech Appliances, Inc. v. SEB S.A., 131 S. Ct. 2060 (U.S. 2011) (willful blindness vs. reckless behavior in knowledge)
- Pisciotta v. Old Nat. Bancorp, 499 F.3d 629 (7th Cir. 2007) (limits on novel duties absent clear authority)
- Cooney v. Chicago Public Schools, 407 Ill.App.3d 358, 347 N.E.2d 23 (Ill. App. 2010) (no new common-law duty to safeguard information)
- Hard Rock Cafe Licensing Corp. v. Concession Servs., Inc., 955 F.2d 1143 (7th Cir. 1992) (willful blindness or deliberate failure to investigate can support liability)
- In re TJX Cos. Retail Sec. Breach Litig., 564 F.3d 489 (1st Cir. 2009) (security breach may support unfair practices under consumer protection statute)
- Williams v. Manchester, 228 Ill.2d 404 (Ill. 2008) (increased risk of future harm as recoverable damages in ICFA)
- Morris v. Harvey Cycle and Camper, Inc., 392 Ill.App.3d 399 (Ill. App. 2009) (emotional distress damages recoverable where combined with economic damages)
- In re Michaels Stores Pin Pad Litig., 830 F.Supp.2d 518 (N.D. Ill. 2011) (persuasive but not controlling on ICFA unfairness)
- In re TJX Cos. Retail Sec. Breach Litig., 564 F.3d 489 (1st Cir. 2009) (securing measures and consumer protection principles)