Dinerstein v. Google, LLCDinerstein v. Google, LLC
In 2017, Defendants The University of Chicago and The University of Chicago Medical Center (collectively “the University“) and Google began a research partnership in which they used machine-learning techniques to create predictive health models aimed at reducing hospital readmissions and anticipating future medical events. As part of this research, the University disclosed to Google the “de-identified” electronic health records of all adult patients treated at its hospital from January 1, 2010 through June 30, 2016. Plaintiff Matt Dinerstein was an inpatient at the University in June 2015 and, asserting a variety of state-law claims, brings this suit pursuant to the Class Action Fairness Act (“CAFA“) on behalf of all patients whose medical information was disclosed for Defendants’ research. The University and Google have both filed motions to dismiss [43, 45]. In addition, the University has moved to strike the class allegations [49]. For the following reasons, Defendants’ motions to dismiss are granted, and the University‘s motion to strike is terminated as moot.
BACKGROUND
The amended class action complaint (“AC“) [42] alleges the following facts, assumed true for the purposes of this analysis. Plaintiff Matt Dinerstein had two separate hospital stays as a patient at the University‘s hospital in June 2015. (AC ¶ 92.) Each stay lasted for a few days (id.),
The Admission and Outpatient Agreement and Authorization (“the Authorization“), a copy of which was attached as an exhibit to the amended complaint, contains two paragraphs relevant to the present dispute:
I understand and agree that my medical information in any form and any tissue, fluids, cells and other specimens that may be collected during this hospitalization and/or period of treatment may be used and shared for research that has been approved by the University of Chicago Institutional Review Board (IRB) and that has been found to pose a minimal risk. I acknowledge that such research by the University of Chicago Medical Center may have commercial value and, in that event, I understand that I will not be entitled to any compensation, regardless of the value of such research or any products or inventions developed therefrom.
I understand that all efforts will be made to protect my privacy and that any use of my medical information will be in compliance with federal and state laws, including all laws that govern patient confidentiality, and the University of Chicago Medical Center Notice of Privacy Practices. I further understand that my identity and the identity of my medical records will not be included in any research findings or reports.
(Outpatient Agreement & Authorization § III, Ex. 2 to AC [42-2].) See
The Notice of Privacy Practices (“the NPP“) contains the following provisions that are also important to the instant case:
We respect the privacy of your medical information. Each time you visit us, we record information about the care you receive, including external information we
receive about your health care and information to seek payment for our services (your “medical information“). This medical information is also called your “Protected Health Information“) (“PHI“). These records may be kept on paper, electronically on a computer, or stored by other media. [The University Chicago Medical Center (“UCMC“)] is required by law to:
- Maintain the privacy and security of your PHI;
- Notify you following a breach of your unsecured PHI, if required by law;
- Provide this Notice to you and describe the ways we may use and share your PHI;
- Notify you of your rights regarding your PHI;
- Follow the terms of this Notice.
. . .
We perform research at UCMC. Our researchers may use or share your information without your authorization (a) if the group that oversees research gives them permission to do so, (b) if the patient data is being used to prepare for a research study, or (c) if the research is limited to data of deceased patients.
. . .
We will not use or share your medical information for any reason other than those described in this Notice without a written authorization signed by you or your personal representative. An authorization is a document that you sign that directs us to use or disclose specific information for a specific purpose. . . .
We will obtain your written permission:
. . .
- For the sale of your medical information.
(NPP at 1–2, 4, 5, Ex. 1 to Univ. Mem. in Supp. of Mot. to Dismiss [44-1].)1
In May 2017, Google announced that it had partnered with the University to use “machine learning” to identify patients’ health problems and predict future medical events. (AC ¶ 58.) To conduct this study, the University transferred electronic health records (“EHRs“) to Google. (Id. ¶ 59.) This transfer was made pursuant to a December 2016 Data Use Agreement (“DUA“) under which the University would transfer to Google the EHRs of every patient, age eighteen or older,
Plaintiff alleges that while Google retains all rights to the software created using the EHRs, the DUA granted the University a perpetual license to use that software. (Id. ¶ 66.) Google disputes this characterization of the DUA. (Google Mem. in Supp. of Mot. to Dismiss [46] at 3 n.3.) In fact, it is not apparent to the court what exactly has been granted to the University. See Bytska v. Swiss Int‘l Air Lines, Ltd., No. 15 C 483, 2016 WL 792314, at *3 (N.D. Ill. Mar. 1, 2016) (explaining that if “an exhibit incontrovertibly contradicts the allegations in the complaint, the exhibit ordinarily controls, even when considering a motion to dismiss“). The DUA grants to the University, “for internal non-commercial research purposes,” “a nonexclusive, perpetual license to use the [ ] Trained Models and Predictions” created by Google. (DUA § 3.12.) The Trained Model refers to the model created via machine learning conducted on the EHRs, and Predictions are the results of the model‘s computations. Specifically, the DUA defines “Trained Model” as “the Model parameters arranged in accordance with the Model‘s mathematical form,” which are determined by using “the Limited Data Set“—the EHRs disclosed by the University to Google—“as Input Data” to “train” the Model. (Id. § 1.12.) Training a model means “using Model Software to create Model parameters for a Model form using Input Data.” (Id. § 1.12.) And the “Model Software” is “used to Train a Model and compute Predictions,” (id. § 1.7), where “Predictions” are the outputs “of a Model for a given set of Input Data.” (Id. § 1.6.)
These disclosures, Plaintiff alleges, violate HIPAA because the University either did not make an expert determination that the risk of re-identifying the data was very small or, if such a
Mr. Dinerstein brings this action on behalf of himself and all individuals in the United States whose EHRs were transferred by the University to Google. (Id. ¶ 99.) According to the amended complaint (id. ¶ 18), the court has jurisdiction under CAFA because at least one member of the proposed class is a citizen of a different state than Defendants and the amount in controversy exceeds $5,000,000.
The University and Google have both filed motions to dismiss [43, 45], contending that Plaintiff lacks standing and has failed to state a claim upon which relief can be granted. See
DISCUSSION
I. Subject Matter Jurisdiction
A motion to dismiss for lack of standing tests the jurisdictional sufficiency of the complaint.
A. Breach of Contract
First, Plaintiff argues that he has standing because he alleged that the University breached a contract—namely, the promises the University made in the Authorization and NPP he received when admitted to the hospital. (See Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss [65] at 5.) An alleged breach of contract, Mr. Dinerstein insists, confers Article III standing even if the breach is not claimed to have resulted in any “monetary loss or other concrete harm.” (Id. at 4–5 (quoting J.P. Morgan Chase Bank, N.A. v. McDonald, 760 F.3d 646, 650–51 (7th Cir. 2014).) The University responds that such an injury is purely a legal one and hence neither concrete nor even an injury in fact. (Univ. Reply Mem. in Supp. of Mot. to Dismiss [71] at 1–2 (citing Spokeo, 136 S. Ct. at 1549).)
Whether alleging breach of contract—without actual damages—is enough to confer standing is a close call. There is authority on both sides of the issue, but the court concludes that Plaintiff has the better argument. The Supreme Court in Spokeo, 136 S. Ct. at 1549, wrote that
There is conflicting precedent, but the Seventh Circuit seems to have endorsed Plaintiff‘s standing theory. J.P. Morgan Chase Bank, 760 F.3d at 650–652, which Plaintiff cites, is on point. In that case, the McDonalds, two customers of J.P. Morgan Chase Bank (“the Bank“), had filed an arbitration demand against an affiliate of the Bank, J.P. Morgan Securities (“JPMS“), even though the losses suffered by the McDonalds were in an account held with the Bank itself. Id. at 648–49. The McDonalds’ contract with JPMS required arbitration, but their agreement with the Bank did not have such a provision and instead included a forum-selection clause that required
The McDonalds’ attempt to arbitrate appears to have violated the clause of their contract with the Bank, and the Bank‘s claim of the violation is enough to give the Bank standing to bring this action to enforce the clause. Formation of a bilateral contract requires each party to take on one or more legally binding obligations in exchange for the other party doing the same. When one party fails to honor its commitments, the other party to the contract suffers a legal injury sufficient to create standing even where that party seems not to have incurred monetary loss or other concrete harm.
Id. at 650–51. True, J.P. Morgan Chase Bank was decided before Spokeo, 136 S. Ct. at 1548, where the Court made clear that for an injury to satisfy the concreteness requirement, it “must actually exist” and cannot be “abstract.” But Defendants have cited no post-Spokeo Seventh Circuit case that revisits or is at odds with J.P. Morgan Chase Bank.
The court acknowledges pre-Spokeo Seventh Circuit cases cited by the University that are in some tension with J.P. Morgan Chase Bank, but finds those cases distinguishable. In Silha, 807 F.3d at 171, students sued administrators of the ACT and SAT tests because, even though the plaintiffs had consented to the administrators sharing their personal information with educational organizations, the administrators had not told the students that their information would be sold. Among the claims asserted was an alleged breach of contract, but the Court of Appeals concluded the plaintiffs lacked standing. Id. at 172, 174–75. In contrast with the case before this court, where Mr. Dinerstein has adequately alleged the existence of a contract and identified the terms he claims were breached, the well-pleaded factual allegations in Silha included neither. Id. at 174–75. Indeed, in the district court, the Silha plaintiffs had not identified a contract breach as one of their injuries. Silha v. ACT, Inc., No. 14 C 0505, 2014 WL 11370440, at *2 (N.D. Ill. Sept. 2, 2014).
The University also relies on language from two Seventh Circuit data breach cases, but these too are inapposite. In Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 692–94 (7th Cir. 2015), plaintiffs, whose credit card numbers had been stolen when the defendant department store‘s servers were hacked, alleged that they had “overpaid for the products at Neiman Marcus
Plaintiffs claim that the cost of their meals is an injury because they would not have dined at P.F. Chang‘s had they known of its poor data security. As we noted in Remijas, such arguments have been adopted by courts only where the product itself was defective or dangerous and consumers claim they would not have bought it (or paid a premium for it) had they known of the defect. The plaintiffs here make no such allegations, and we are not inclined to push this theory beyond its current scope.
The University argues that these two cases support the proposition that being denied the benefit of his bargain is insufficient to confer standing on Plaintiff. (Univ. Reply Mem. in Supp. of Mot. to Dismiss at 3.) As the University sees it, the theory rejected in Remijas and Lewert concerned breaches of implied contract, which is no different from Mr. Dinerstein‘s breach of express contract theory. (Id. at 3 n.3.) But in those cases, the Seventh Circuit appeared to doubt that the implied contract between the plaintiff patrons and defendant stores included a promise that the stores would implement better information security practices. See Lewert, 819 F.3d at 968 (noting that the plaintiffs made no allegations that they would not have dined at P.F. Chang‘s had they known of their security practices). In this case, in contrast, Plaintiff alleges that the University expressly made certain promises about privacy to Plaintiff, which he has alleged were breached.
In a footnote, the University has cited a number of cases in which courts dismissed cases for lack of standing, but none of those cases considered claims of standing based on a breach of contract theory. See Strautins v. Trustwave Holdings, Inc., 27 F. Supp. 3d 871, 879 (N.D. Ill. 2014); Fero v. Excellus Health Plan, Inc., 236 F. Supp. 3d 735, 754 (W.D.N.Y. 2017); Kahn v. Children‘s Nat‘l Health Sys., 188 F. Supp. 3d 524, 533 (D. Md. 2016); In re Sci. Applications Int‘l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 24–31 (D.D.C. 2014). In fact, these were data breach cases where the courts rejected theories similar to the overpayment theory considered by the Seventh Circuit in Remijas and Lewert, which the court has already noted are not on point here. See Fero, 236 F. Supp. 3d at 754 (citation omitted) (“The Excellus Defendants argue that Plaintiffs cannot establish injury-in-fact based on their alleged overpayment for health insurance. The Court agrees.“); Kahn, 188 F. Supp. 3d at 533 (rejecting
The weight of authority supports the conclusion that Mr. Dinerstein‘s allegation that the University breached an express contract is sufficient for Article III standing purposes. Standing, however, “‘is not dispensed in gross.’ To the contrary, ‘a plaintiff must demonstrate standing for each claim he seeks to press and for each form of relief that is sought.‘” Town of Chester, N.Y. v. Laroe Estates, Inc., 137 S. Ct. 1645, 1650 (2017) (citations omitted) (quoting Davis v. Fed. Election Comm‘n, 554 U.S. 724, 734 (2008)). Plaintiff therefore has standing to pursue his contract claims, including his interference of contract claim against Google,5 but the court will review his other injuries independently to determine whether he has standing to pursue his intrusion-upon-seclusion and ICFA claims.
B. Invasion of Privacy
Second, Plaintiff contends that an invasion of his privacy is an injury in fact sufficient for Article III standing. (See Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 6–8.) Specifically, Mr. Dinerstein alleges that the University disclosed, at Google‘s behest, his confidential medical records. (Id. at 6.) Defendants assert that this injury is too abstract for Article III standing. (See, e.g., Univ. Mem. in Supp. of Mot. to Dismiss at 7.) Here, too, there is mixed authority with little
As noted in the court‘s discussion of Spokeo, courts faced with standing challenges must consider whether “the common law permitted suit in analogous circumstances.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017). Important for the present case, many courts have observed that “[i]nvasion of privacy lawsuits are nothing new; at common law, violations of the right to privacy have been recognized as a valid basis for suit.” Dixon v. Washington & Jane Smith Cmty.–Beverly, No. 17 C 8033, 2018 WL 2445292, at *9 (N.D. Ill. May 31, 2018) (citing Cox Broad. Corp. v. Cohn, 420 U.S. 469, 488 (1975); Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)); see also C.S. Wang & Assoc. v. Wells Fargo Bank, N.A., 305 F. Supp. 3d 864, 880 (N.D. Ill. 2018) (“Invasion of privacy is actionable at common law.“). “[T]he Supreme Court has noted that ‘both the common law and the literal understanding of privacy encompass the individual‘s control of information concerning his or her person.‘” Eichenberger, 876 F.3d at 983 (quoting U.S. Dep‘t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989)). In recognizing that “there is a common law tradition of lawsuits for invasion of privacy,” the Eighth Circuit has stated that “the retention of information lawfully obtained, without further disclosure, traditionally has not provided the basis for a lawsuit in American courts.” Braitberg v. Charter Commc‘ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016). That language implies that the common law would recognize suits where private information was further disclosed.
A recent Seventh Circuit case, not cited by the parties, is consistent with this understanding. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 619–20 (7th Cir. 2020), was a suit brought under the Illinois Biometric Information Privacy Act (“BIPA“),
Justice Thomas joined the majority‘s opinion [in Spokeo], but he added a concurrence that drew a useful distinction between two types of injuries. The first, he said, arises when a private plaintiff asserts a violation of her own rights [which is permissible]; the second occurs when a private plaintiff seeks to vindicate public rights [which is not]. As examples of the first, he mentioned actions for trespass, infringement of intellectual property rights, and unjust enrichment; as examples of the second, he pointed to actions seeking to abate a public nuisance, or disputes over the use of public land.
Applying Justice Thomas‘s rubric, we have no trouble concluding that Bryant was asserting a violation of her own rights—her fingerprints, her private information—and that this is enough to show injury-in-fact without further tangible consequences. This was no bare procedural violation; it was an invasion of her private domain, much like an act of trespass would be.
Id. at 624 (citations omitted). Here, Mr. Dinerstein asserts the wrongful disclosure of his private information—a violation of his own rights. “[T]his is enough to show injury-in-fact,” according to the Seventh Circuit. Id.
This case, of course, differs from Bryant and others cited above, which involved statutes that created private rights of action. The two statutes relevant to this case—HIPAA and the Illinois’ Medical Patient Rights Act (“MPRA“),
This court concludes that for Plaintiff‘s common law intrusion-upon-seclusion claim, an invasion of Plaintiff‘s privacy is an injury-in-fact that can support standing. See In re Facebook, 263 F. Supp. 3d at 843 (citations omitted) (“[A] plaintiff need not show actual loss to establish standing for common-law claims of invasion of privacy and intrusion upon seclusion. The Court finds that Plaintiffs’ alleged privacy violations are sufficient to establish standing for Plaintiffs’ privacy tort claims.“) True, other courts have denied standing for plaintiffs who alleged that their personal information was wrongfully disclosed. See, e.g., Jackson v. Loews Hotels, Inc., No. ED CV 18-827-DMG (JCx), 2019 WL 2619656, at *3–5 (C.D. Cal. Jan. 4, 2019).7 But the court is persuaded that Mr. Dinerstein has pleaded an injury in fact, in light of the common law tradition‘s recognition that an individual has standing to challenge an invasion of his privacy rights. See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (finding that a violation of the right to privacy is a concrete and particularized injury in fact); Browner, 355 F. Supp. 3d at 736 (“[A]n invasion of privacy is similar to the harm involved in the traditional tort of intrusion upon
Defendants’ other arguments on this issue are unavailing. Both argue that this case differs from those where courts recognized invasions of privacy as injuries in fact because of the nature of the information disclosed. (Univ. Mem. in Supp. of Mot. to Dismiss at 6–8; Google Mem. in Reply in Supp. of Mot. to Dismiss [70] at 4.) This contention has some basis: those cases concerned stolen credit card information, Lewert, 819 F.3d at 965, secretly recorded phone calls, C.S. Wang & Assoc., 305 F. Supp. 3d at 873, and biometric data such as fingerprints, Dixon, 2018 WL 2445292, at *1. While Plaintiff charges the University with disclosing de-identified information such as patient demographics and diagnoses, as well as date stamps and free-text notes, Plaintiff also claims this information was not sufficiently anonymized. (See AC ¶¶ 64–69.) For many persons, disclosure of insufficiently anonymized health records is more invasive and disturbing than disclosure of credit records or fingerprints. In any case, the court is skeptical that the gravity of the information disclosed is what matters for standing; just as, for example, “trespass occurs whenever property interest is invaded” and does not require actual damages, Chicago Title Land Tr. Co. v. JS II, LLC, 2012 IL App (1st) 063420, ¶ 77, 977 N.E.2d 198, 218 (1st Dist. 2012), so the invasion of Mr. Dinerstein‘s privacy depends not on the magnitude of the harm but the fact that this private right was invaded at all.
Finally, Google contends that standing is not conferred by the risk that Google may effectively re-identify the EHRs because it has access to other data. Were this the only injury attributable to Google, the court would agree. See Clapper v. Amnesty Int‘l USA, 568 U.S. 398, 410 (2013) (noting that “threatened injury must be certainly impending“). Yet Plaintiff has alleged that his private information was improperly disclosed to Google, a party with whom he never
C. Value of EHRs
Plaintiff‘s third asserted concrete and particularized harm is the alleged theft of his medical information, which he insists has commercial value and is something he has a legal interest in. (See Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 9–10.) Plaintiff points to Lewert, 819 F.3d at 968, for support, where the Seventh Circuit noted that the statute at issue in Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 623 (7th Cir. 2014), “creates a legally protected interest in a consumer‘s personally identifiable information with respect to video rentals.” Mr. Dinerstein seems to suggest that the statutes at issue here—HIPAA and the MPRA—also create a legal interest in his health information, just as the statute in Sterk did. But the court in Lewert, 819 F.3d at 968, made clear that ”Sterk does not recognize a legal interest in personally identifiable information beyond the video-rental context.” Plaintiff has cited no authority supporting the proposition that HIPAA or the MPRA creates a property interest in health data. Plaintiff also contends, without citations, that the common law and the University‘s contractual obligations also establish his legal interest in his own medical information. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 9.) This assertion relies on little more than arguments the court has already addressed, about whether invasion of privacy and breach of contract are injuries in fact. Mr. Dinerstein has neither developed nor supported a separate argument that the common law or his contract created a legal interest in his data.
Plaintiff has pleaded two concrete and particularized injuries in fact to support his contract and common law claims asserted against the University and Google. The other requirements for Article III standing are met for those claims as well, because the alleged breach of contract and invasion of privacy are fairly traceable to the University‘s and Google‘s conduct and could be redressed by some of the relief that Mr. Dinerstein seeks.
Plaintiff‘s ICFA claim differs. A claim under that statute requires a showing of actual damages,
II. Failure to State a Claim upon which Relief Can Be Granted
A motion to dismiss under
A. Express Contract Claim
“Under Illinois law, the elements of a breach of contract cause of action are ‘(1) offer and acceptance, (2) consideration, (3) definite and certain terms, (4) performance by the plaintiff of all required conditions, (5) breach, and (6) damages.” Ass‘n Ben. Servs., Inc. v. Caremark RX, Inc., 493 F.3d 841, 849 (7th Cir. 2007) (quoting MC Baldwin Fin. Co. v. DiMaggio, Rosario & Veraja, LLC, 364 Ill. App. 3d 6, 14, 845 N.E.2d 22, 30 (1st Dist. 2006)). Three elements are at issue for Mr. Dinerstein‘s contract claim: whether he has pleaded that the University breached the contract, whether the agreement was supported by valid consideration, and whether he has alleged damages.
1. Alleged Breaches
Plaintiff asserts that the University‘s disclosure of his medical information to Google violated four terms of the contract: (1) that “all efforts” would be made to protect his privacy, (2) that any use of his medical information would comply with federal law, (3) that any use of his
a. “All Efforts”
To begin, the parties disagree about whether an “all efforts” or “best efforts” clause is enforceable in Illinois. (Compare Univ. Mem. in Supp. of Mot. to Dismiss at 9, with Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 15–16.) Having reviewed the case law on this question, the court concludes that while Mr. Dinerstein is correct that Illinois courts have enforced all-efforts or best-efforts clauses in certain circumstances, Res. Dealer Grp., Inc. v. Exec. Servs., Ltd., No. 97 C 4343, 1997 WL 790737, at *3 (N.D. Ill. Dec. 18, 1997) (“Illinois courts have enforced best efforts clauses in a variety of contracts.“), this is not one of those circumstances.
Wald v. Chicago Shippers Ass‘n, 175 Ill. App. 3d 607, 529 N.E.2d 1138 (1st Dist. 1988), is instructive. The Wald plaintiffs sued to enforce a clause in a contract that required the defendant shipping association to use its best efforts to route the largest possible volume of freight through the plaintiffs’ facilities. Id. at 610–14, 529 N.E.2d at 1140–43. That clause, the court found, was “too indefinite to be enforceable” because it failed to set forth any specific terms regarding, for example, the contract‘s duration or the quantity of freight to be shipped through those facilities. Id. at 617, 529 N.E.2d at 1145. No other part of the contract contained terms clarifying this obligation, either. Id. Though the court noted that ambiguities in contracts may be resolved by extrinsic evidence or prior course of dealings, such evidence did not effectively clarify the “best efforts” clause. Id. at 618–20, 529 N.E.2d at 1146–47; see also Beraha v. Baxter Health Care Corp., 956 F.2d 1436, 1441 (7th Cir. 1992) (holding that the defendant‘s “statement that it would ‘do [its] very best to make this project a success’ is merely a vague expression of goodwill; it is not an enforceable contractual promise“); Penzell v. Taylor, 219 Ill. App. 3d 680, 688, 579 N.E.2d 956, 961 (1st Dist. 1991) (stating that “this court has held that the phrase ‘best efforts’ is too indefinite and uncertain to be an enforceable standard” and finding that “[the counter
As in Wald, the “all efforts” language in the Authorization is too indefinite to enforce. It does not include or refer to essential terms, such as what efforts the University was expected to engage in. And no other parts of the contract provide terms that could be construed to supply the definiteness necessary for this clause to be enforceable. Moreover, Mr. Dinerstein has not pointed to any extrinsic evidence or other facts that would help the court determine what all efforts is supposed to mean. Cf. Res. Dealer Grp., 1997 WL 790737, at *3–4 (declining to dismiss a contract claim concerning “best efforts” language in a “detailed, nineteen page contract” where that clause was one of “four separate and specific obligations that the parties intended [the counter-defendant] to perform, not merely precatory language“).
In the court‘s view, Plaintiff‘s “best efforts” claim is an odd fit in this context. When such clauses are held to be enforceable, they are most typically used to impose affirmative obligations in commercial contracts in which one party is obliged to promote the business of another. See, e.g., id. at *3 (concerning a clause that required the plaintiff to use “best efforts” in marketing the defendant‘s business); Ralph v. Karr Mfg. Co., 20 Ill. App. 3d 450, 453–54, 314 N.E.2d 219, 221–23 (1st Dist. 1974) (analyzing a clause that required the plaintiff to “put forth his best efforts and to diligently provide the management of [the defendant‘s] sales and marketing program and with such efforts to increase [the defendant‘s] sales“). In such cases, the party so obliged must “diligently direct[ ] his efforts on [his counterparty‘s] behalf.” Ralph, 20 Ill. App. 3d at 454, 314 N.E.2d at 222. Here, in contrast, Plaintiff does not claim that the University failed to take appropriate affirmative actions to protect his privacy. He instead contends that the University‘s conduct actually violated his privacy.
Plaintiff argues that a best-efforts clause is just an obligation to act in good faith and that whether a party has acted in good faith is a question of fact. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 16.) Plaintiff may well be technically correct about this, see, e.g., Coleman v. Madison Two Assocs., 307 Ill. App. 3d 570, 578, 718 N.E.2d 668, 674 (1st Dist. 1999), but the argument is still inapt. “The obligation of good faith and fair dealing primarily is used to determine the intent of the parties where a contract is susceptible to two conflicting constructions. Parties to a contract are entitled to enforce the terms of the contract to the letter and an implied covenant of good faith cannot override or modify the express terms of that contract.” Id., 718 N.E.2d at 675 (emphasis added) (citation omitted); see also M.S. Distrib. Co. v. Web Records, Inc., No. 00 C 1436, 2003 WL 21087961, at *9 (N.D. Ill. May 13, 2003) (the “best efforts undertaking . . . does not form the basis for an independent cause of action“). The court does not read the Authorization as permitting two conflicting constructions; indeed, Plaintiff advances no argument that it does. And the Authorization expressly permits sharing Plaintiff‘s medical information in at least some circumstances. Plaintiff agreed that his “medical information in any form . . . may be used and shared for research that has been approved by the University of Chicago Institutional Review Board (IRB) and that has been found to pose a minimal risk.” (Outpatient Agreement & Authorization § III.) The Authorization also provides, immediately after the “all efforts” language, that “any use of medical information will be in compliance with federal and state laws.” (Id.) Notably, both HIPAA and the MPRA expressly permit disclosures of personal information in certain contexts. See, e.g.,
The court declines to interpret the phrase “all efforts” to impose some indefinite obligation on the University that could conflict with other, more specific portions of the Authorization. See Beraha, 956 F.2d at 1441 (“[Courts] do not lightly find implied obligations of any kind unless those implied obligations serve to effect the clear intentions of the parties derived from the express terms of the contract.“); Alberto-Culver Co. v. Aon Corp., 351 Ill. App. 3d 123, 135, 812 N.E.2d 369, 380 (1st Dist. 2004) (“Where an inconsistency arises between a clause that is general and one that is more specific, the latter prevails.“). Because the clause in question is not
b. Compliance with Federal Law
Plaintiff asserts that the University‘s disclosure of his medical information to Google violated HIPAA and, therefore, breached the Authorization‘s requirement that “any use of medical information will be in compliance with federal . . . laws.” (Outpatient Agreement & Authorization § III.)
An initial matter is whether an alleged violation of HIPAA can support a breach of contract claim at all. The statute does not create a private right of action. See Carpenter v. Phillips, 419 F. App‘x 658, 659 (7th Cir. 2011). The University is correct that courts in other jurisdictions have held that a HIPAA claim cannot be pursued as a breach of contract claim—that is, a contract claim cannot be used to create a right of action that Congress declined to establish. See Brush v. Miami Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1368 (S.D. Fla. 2017) (“Plaintiff cannot mask a HIPAA claim as a breach of contract claim.“); Cairel v. Jessamine Cty. Fiscal Court, No. 5:15-CV-186-JMH, 2015 WL 8967884, at *4 (E.D. Ky. Dec. 15, 2015) (“Plaintiff attempts to circumvent the fact that no private right of action exists under HIPAA by characterizing her claim thereunder as one for breach of contract. Regardless of whether the contract included a HIPAA provision, there simply is no private right of action for violations of HIPAA, at the state or federal level.“); Sheldon v. Kettering Health Network, 2015-Ohio-3268, ¶ 30, 40 N.E.3d 661, 674 (Ohio Ct. App. 2015) (“[T]o the extent that HIPAA universally has been held not to authorize a private right of action, to permit HIPAA regulations to define per se the duty and liability for breach is no less than a private action to enforce HIPAA, which is precluded.“). Those opinions, however, lack in-depth
The Seventh Circuit has dealt with similar issues with other statutes and found that the fact that there is no right of action under a federal statute does not preempt or otherwise bar a viable state law claim. Wigod v. Wells Fargo Bank, N.A., 673 F.3d 547, 554–55 (7th Cir. 2012), concerned several Illinois state law claims, including a contract claim, brought against the plaintiff‘s mortgage servicer, Wells Fargo, for violating the federal Home Affordable Mortgage Program. Wells Fargo argued that the plaintiff should not be able to use a contract claim to make an “end run” around the lack of a private right of action in the relevant federal law. The court rejected this reasoning:
The end-run theory is built on the novel assumption that where Congress does not create a private right of action for violation of a federal law, no right of action may exist under state law, either. . . . The absence of a private right of action from a federal statute provides no reason to dismiss a claim under a state law just because it refers to or incorporates some element of the federal law. To find otherwise would require adopting the novel presumption that where Congress provides no remedy under federal law, state law may not afford one in its stead.
Id. at 581 (citations omitted). In fact, “[w]hen the federal court‘s jurisdiction over state-law claims is based on diversity of citizenship . . . the absence of a private right of action in a federal statute actually weighs against preemption.” Id. at 582 (emphasis in original); see also Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 634 (7th Cir. 2007) (noting that in a case “invoking CAFA‘s special rules for diversity jurisdiction,” the court‘s duty with respect to state law is the same “as in every diversity case“). The Seventh Circuit considered a similar issue with respect to the Higher Education Act and reached the same conclusion. Bible v. United Student Aid Funds, Inc., 799 F.3d 633, 652–54 (7th Cir. 2015) (holding that the lack of a private cause of action did not displace the plaintiff‘s contract claim and calling the defendant‘s theory “mistaken at its core“). The logic of Wigod and Bible applies here: that HIPAA lacks a private right of action does not foreclose Plaintiff‘s ability to pursue a contract claim.
Moreover, Plaintiff is correct that HIPAA addresses only conflict preemption. See
Now to the substance of the contract claim: Has Plaintiff actually pleaded that Defendants breached the contract by violating HIPAA? Three parts of the HIPAA Privacy Rule are at issue here. Two of these are safe harbors that permit the disclosure of medical information under certain circumstances: First, a covered entity, such as the University, may disclose a “limited data set” if it excludes certain direct identifiers;9 is used for “research, public health, or health care operations“; and the disclosure is made pursuant to a “data use agreement” that includes certain provisions governing the use of the medical information.10
The parties have devoted little attention to this procedural question; that is, they have barely addressed whether a HIPAA regulation permitting disclosure is an affirmative defense, which Defendants must prove, or an element of a violation that Mr. Dinerstein must establish. Nor could the court find case law on this issue, likely owing to the fact that HIPAA does not have a private right of action and thus has not generated private suits. Yet the court believes that Defendants have the better view. Plaintiff‘s claim is an action for breach of contract, and none of the affirmative defenses to such a claim resemble the safe harbors that that Plaintiff asks the court to recognize as defenses. See Ill. Pattern Jury Instr.-Civ. 700.12 (affirmative defenses for incompetence, duress, misrepresentation, fraud, frustration of purpose, impossibility of performance, and undue influence). Moreover, the court agrees with Google that there is a Twombly-like concern in Plaintiff‘s pleading; his allegations are equally consistent with compliance with HIPAA as with an alleged HIPAA violation. (Google Mem. in Reply in Supp. of Mot. to Dismiss at 7.) In order to meet pleading standards, allegations must “plausibly suggest[ ]” a claim for relief—not be “merely consistent with” one. Twombly, 550 U.S. at 557.
Indeed, even reading his allegations as consistent with a violation, the amended complaint also appears to “set forth everything necessary to satisfy the affirmative defense.” Hyson USA, Inc. v. Hyson 2U, Ltd., 821 F.3d 935, 939 (7th Cir. 2016) (quoting United States v. Lewis, 411 F.3d 838, 842 (7th Cir. 2005)). As noted,
The third relevant part of the Privacy Rule is more complicated. This component requires written authorization for the “sale of protected health information.”
As for whether Mr. Dinerstein‘s PHI was subject to a “sale,” his claim appears to be on firm ground here as well. According to the rule, a sale of PHI means “a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information.”
The University‘s arguments that Plaintiff has not pleaded that it engaged in an impermissible sale are unsatisfying. The University notes that the amended complaint contains no allegations about “a reasonable cost-based fee.” (Univ. Reply Mem. in Supp. of Mot. to Dismiss at 7 n.9.) That is true, but it is also irrelevant; what matters is that the amended complaint
Google‘s contentions on this point are no more compelling. Google notes that the DUA “allows the University to share in the medical advancements that Google develops from the research data,” which “confirms the primary purpose of the parties’ relationship—the mutual exchange of research information.” (Google Mem. in Reply in Supp. of Mot. to Dismiss at 8.) Like the University, however, Google fails to explain why this exchange of research information must be understood to constitute a reasonable cost-based fee rather than direct or indirect remuneration. Google also correctly notes that under the DUA, the University retains the right to have the EHRs returned or destroyed by Google. (Id.) But again, “sale” refers to a disclosure of protected health information made in exchange for direct or indirect remuneration.
In sum, Mr. Dinerstein has plausibly alleged that the University breached its contractual promise to comply with federal law when it exchanged protected health information for the license to use Trained Models and Predictions developed by Google.
Next, Plaintiff asserts that the University breached the promise to comply with state law.11 (AC ¶ 132.) Specifically, Plaintiff alleges that the University violated § 3.1 of the MPRA. See
any individual who may be exposed to the possibility of injury, including physical, psychological, or social injury, as a consequence of participation as a subject in any research, development, or related activity that significantly departs from the application of those established and accepted methods necessary to meet his or her needs, or that increases the ordinary risks of daily life, including the recognized risks inherent in a chosen occupation or field of service
Plaintiff‘s allegations do not establish a violation of these state law provisions. The research conducted by the University and Google was not a research program as defined in the above regulation. The project did concern the creation of “new medical or scientific information,” but it did not “involve[e] medical, surgical, manipulative, or psychiatric diagnosis or treatment of human subjects who are inpatients or outpatients of a hospital.”
d. Compliance with the Notice of Privacy Practices
Finally, the Authorization states that “any use of [Plaintiff‘s] medical information will be in compliance with . . . the University of Chicago Medical Center Notice of Privacy Practices.” (Outpatient Agreement & Authorization § III.) The NPP promises that the University would obtain Plaintiff‘s “written permission” “[f]or the sale of your medical information.” (NPP at 5.) As discussed in relation to HIPAA, Plaintiff contends that the University and Google engaged in a sale of his medical information that violates the NPP and, therefore, the Authorization. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 15, 18.)
The parties spent little time discussing what this provision means in relation to the HIPAA Privacy Rule‘s prohibition on the sale of PHI. Should this section of the NPP be interpreted to be consistent with, or more or less stringent than, the HIPAA Privacy Rule? On the one hand, the NPP does not include any definition of “sale“; if the HIPAA Rule‘s broad definition, which covers disclosures in exchange for direct or indirect remuneration, does not apply, there may be no violation of NPP. On the other hand, the NPP bans all sales; it makes no exceptions, as HIPAA does, for sales in connection with research where the only consideration is a reasonable cost-based fee. The NPP could therefore be understood as imposing a stricter requirement than the HIPAA regulation. Indeed, were the NPP to be interpreted as merely consistent with preexisting regulatory requirements, the Authorization‘s statement that the University would comply with the
2. Consideration
Next, the University insists that the agreement with Plaintiff lacked consideration because it obligated the University to do no more than comply with state and federal law, which are preexisting duties. “As a general rule, a promise to perform an act which the promisor is already bound to perform cannot constitute consideration to support an enforceable contract.” 17A AM. JUR. 2D CONTRACTS § 149. That is, because the University is already obligated to comply with HIPAA, any agreement promising to follow HIPAA lacks consideration. (See Univ. Mem. in Supp. of Mot. to Dismiss at 10 (“[A]ny purported contractual obligation to comply with HIPAA (or to comply with ‘federal and state law‘) merely parrots a pre-existing legal duty and is therefore not an enforceable contractual promise as a matter of law.“).) In response, Plaintiff contends that a promisor under a preexisting duty still breaches a contract when it fails to comply with its promise; the rule only precludes such a promisor from using its preexisting duty as consideration to extract an enforceable promise from the promisee. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 13.) In other words, as Plaintiff sees it, while the rule apparently could preclude the University from enforcing the contract against him, it does not prevent him from asserting a breach of contract claim against the University. There is some authority for this proposition. See, e.g., 17A AM. JUR. 2D CONTRACTS § 149 (“Some authority holds that although a promise to do a thing that the promisor is legally bound to do is not generally sufficient consideration to support a reciprocal undertaking by the promisee, such promise may be enforced against the promisor,
Indeed, this is, again, an argument (this time, made by the University) that makes for an odd fit in this case. Typically, the preexisting duty rule is raised by the party who claims its obligations are excused because its opponent failed to give valid consideration. See, e.g., White v. Vill. of Homewood, 256 Ill. App. 3d 354, 357, 628 N.E.2d 616, 618 (1st Dist. 1993) (citations omitted) (“The pre-existing duty rule provides that where a party does what it is already legally obligated to do, there is no consideration as there is no detriment. For example, where a guest was by statute entitled to use a hotel safe to store valuables, a promise by the guest to limit the liability of the hotel in exchange for using the safe is not supported by consideration because of the pre-existing duty rule.“). There is, however, Illinois case law suggesting that a preexisting duty means that a contractual promise to carry out that duty may not be challenged as a breach of contract. See, e.g., Marque Medicos Fullerton, LLC v. Zurich Am. Ins. Co., 2017 IL App (1st) 160756, ¶ 67, 83 N.E.3d 1027, 1044 (1st Dist. 2017) (citation omitted) (“Plaintiffs’ own complaints therefore concede that defendants’ purported consideration for any asserted implied-in-fact contracts was to be performed pursuant to preexisting legal duties. Because valid consideration, on the part of both parties, is one of the essential requirements for the formation of a contract, and because consideration cannot flow from an act performed pursuant to preexisting legal duty, the circuit court properly dismissed plaintiffs’ claims that that defendants breached an implied-in-fact contracts to comply with the interest provision of section 8.2(d)(3) of the Act.“).
Regardless, the court agrees with Mr. Dinerstein that there was consideration for this contract because the contract requires the University to meet a higher standard than simply
The cases the University cites are distinguishable. In re Banner Health Data Breach Litig., No. CV-16-02696-PHX-SRB, 2017 WL 6763548, at *4 (D. Ariz. Dec. 20, 2017), held that a contract lacked consideration because the defendant‘s privacy notice “cannot be read as a promise to do anything above and beyond what is already required by law.” Here, in contrast, the NPP‘s provision mandating that the University obtain written permission before selling Plaintiff‘s PHI did not merely restate HIPAA‘s requirements. For the same reason, another opinion the University cites, in which the privacy notice merely “inform[ed] patients of their rights under federal law” and thus was “not contractual in nature,” is distinguishable as well. Brush, 238 F. Supp. 3d at 1367.
The University‘s other arguments are also unpersuasive. Citing Brush, 238 F. Supp 3d at 1367, the University insists that even if had made “extra-statutory promises,” the pre-existing duty rule would still bar a contract claim based on noncompliance with HIPAA. (Univ. Reply Mem. in Supp. of Mot. to Dismiss at 8.) But Brush says no such thing; there, the court held that the contract lacked consideration and did not consider whether the plaintiff could pursue a contract claim if the
Because at least part of the University‘s promises to Plaintiff went beyond its obligations under federal law, the Authorization, which incorporated the NPP, was supported by valid consideration.
3. Damages
As discussed above the court has concluded that Plaintiff‘s allegations state a claim for breach of a contract that was supported by consideration. Has he plausibly alleged that this breach caused him damages? In the amended complaint, Plaintiff alleges that he has suffered non-economic damages, such as anxiety and emotional distress. (AC ¶ 136.) His response to Defendants’ motions does not characterize these harms as part of his contract damages, however. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 19–21). As the University notes, Illinois does not recognize emotional distress damages for breaches of contract, “except where the breach was wanton or reckless and caused bodily harm, or where defendant had reason to know, when the contract was made, that its breach would cause mental suffering for reasons other than mere pecuniary loss.” Parks v. Wells Fargo Home Mortg., Inc., 398 F.3d 937, 940–41 (7th Cir. 2005) (quoting Maere v. Churchill, 116 Ill. App. 3d 939, 944, 452 N.E.2d 694, 697 (3d Dist. 1983)). Plaintiff has not pleaded that the University‘s conduct meets that standard.
As for money damages, the Authorization contained the following provision in which Plaintiff disclaimed the right to receive compensation from the University‘s research: “I acknowledge that such research by the University of Chicago Medical Center may have commercial value and, in that event, I understand that I will not be entitled to any compensation, regardless of the value of such research or any products or inventions developed therefrom.”
Plaintiff responds that the University cannot take advantage of that provision because Illinois courts have said that “[a] party who materially breaches a contract cannot take advantage of the terms of the contract that benefit him.” James v. Lifeline Mobile Medics, 341 Ill. App. 3d 451, 455, 792 N.E.2d 461, 464 (4th Dist. 2003). For its part, the University argues that Plaintiff has not pleaded that the University‘s breach was a material one. See InsureOne Indep. Ins. Agency, LLC v. Hallberg, 2012 IL App (1st) 092385, ¶ 43, 976 N.E.2d 1014, 1027 (1st Dist. 2012) (citation omitted) (quoting Vill. of Fox Lake v. Aetna Cas. & Sur. Co., 178 Ill. App. 3d 887, 900–01, 534 N.E.2d 133 (2d Dist. 1989)) (“The test of whether a breach is ‘material’ is whether it is ‘so substantial and fundamental as to defeat the objects of the parties in making the agreement, or whether the failure to perform renders performance of the rest of the contract different in substance from the original agreement.’ ‘The breach must be so material and important to justify the injured party in regarding the whole transaction at an end.‘“) The University may be right that its exchange of Plaintiff‘s PHI for Trained Models and Predictions for internal non-commercial research purposes was not a material breach and that it substantially performed its contract with Plaintiff. Nevertheless, according to Illinois law, “[t]he determination of what constitutes a material breach is a question of fact which involves a fairly detailed inquiry, which should be left for the trial.” Enter. Warehousing Sols., Inc. v. Capital One Servs., Inc., No. 01 C 7725, 2002 WL 406976, at *3 (N.D. Ill. Mar. 15, 2002).
For pleading purposes, the court will therefore assume Plaintiff has alleged a material breach on the part of the University. The court concludes the claim nevertheless fails for another reason: none of his theories for money damages is adequate. He asserts that he is entitled to “restitution on the basis that he did not receive the full benefits of his payments to the University.” (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 20.) At most, this allegation suggests that some indeterminate amount of the price he paid for his treatments represents the cost of the University‘s
Alternatively, Mr. Dinerstein claims that the University owes him a reasonable royalty for the use of his PHI. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 21.) For the reasons discussed in its standing analysis, the court disagrees. A royalty is normally appropriate only for interference with a property right. See, e.g., RESTATEMENT (THIRD) OF RESTITUTION AND UNJUST ENRICHMENT § 42 cmt. f (AM. LAW INST. 2011) (emphasis added) (“In the context of intellectual property, what is ‘taken’ is often an unauthorized use; the value of the use may often be determined—depending on the nature of the property—by a reasonable royalty or by the market price of a license.“). And Plaintiff has not plausibly alleged that he has any such right in his PHI. See Remijas, 794 F.3d at 695 (rejecting the plaintiffs’ argument that federal law recognizes a property right in their private information). That is why his reliance on Vojdani, 741 F.3d at 784–
Plaintiff has not adequately pleaded that the University‘s breach of contract caused him economic damages. His theories in support of his claim for money damages are inadequate. Because Mr. Dinerstein has not pleaded that the University‘s breach caused him economic damage, his express contract claim (Count II) is dismissed for failure to state a claim for relief.
B. Implied Contract Claim
As an alternative to his express breach of contract claim, Mr. Dinerstein asserts a claim against the University for breaching an implied contract to keep his medical information private. (AC ¶ 139.) In Illinois, the elements of an implied contract “substantially overlap” with those of an express contract. Landale Signs & Neon, Ltd. v. Runnion Equip. Co., 274 F. Supp. 3d 787, 792 (N.D. Ill. 2017); New v. Verizon Commc‘ns, Inc., 635 F. Supp. 2d 773, 782–83 (N.D. Ill. 2008) (“In Illinois, in order to prove an implied contract the party asserting the contract must show the same elements as an express contract, as well as a meeting of the minds and a mutual intent to
C. Tortious Interference Claim
“To state a claim for tortious interference with contract, [Plaintiff] must allege enough facts to establish: ‘(1) a valid contract, (2) defendant‘s knowledge of the contract, (3) defendant‘s intentional and unjustified inducement of a breach of contract, (4) a subsequent breach of contract caused by defendant‘s wrongful conduct, and (5) damages.” Gen. Elec. Co. v. Uptake Techs., Inc., 394 F. Supp. 3d 815, 834 (N.D. Ill. 2019) (quoting Webb v. Frawley, 906 F.3d 569, 577 (7th Cir. 2018)). The parties have not addressed the question whether Plaintiff may pursue this claim absent an adequate claim for damages for breach of contract. But the court need not address the issue, as it concludes he has not sufficiently pleaded that Google engaged in the intentional conduct needed to state a tortious interference claim.
“A necessary prerequisite to the maintenance of an action for tortious interference with contract is a defendant‘s intentional and unjustified inducement of a breach of contract.” Illinois Bell Tel. Co. v. Plote, Inc., 334 Ill. App. 3d 796, 806, 778 N.E.2d 1203, 1211 (1st Dist. 2002) (quoting Strosberg v. Brauvin Realty Servs., Inc., 295 Ill. App. 3d 17, 33, 691 N.E.2d 834, 845 (1st Dist. 1998)). That is, Plaintiff must plead that Google ”intentionally caused” the University to breach its contract or that Google ”intended to cause [Plaintiff] harm.” Id. (emphasis in original). He has not done so. Instead, Mr. Dinerstein merely states that “Google intentionally and without justification interfered with the University‘s contracts with its patients.” (AC ¶ 157.) Such “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Nor is Plaintiff‘s allegation that Google had “actual or constructive knowledge of Plaintiff‘s and the Class members’ contracts” adequate to plead that Google intended to induce the University‘s breach of contract. (AC ¶ 156.) Undermining any inference that could be made about intentionality is the fact that the University specifically represented to Google in the DUA that it had “the right to disclose the [PHI] . . . and is in compliance with applicable laws and regulations.” (DUA § 2.2.)
Plaintiff does not respond to these issues in his brief. In a footnote, he argues only that his tortious interference claim does not require pleading wrongful or malicious intent. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 11 n.4.) That is true, but it does not obviate the need to plead intent at all. See Illinois Bell Tel., 334 Ill. App. 3d at 806, 778 N.E.2d at 1211 (citation omitted) (while a plaintiff “does not need to prove that the defendant‘s conduct was malicious or unjustified unless that defendant‘s conduct was privileged,” the plaintiff is still “required to plead that [the defendant] acted intentionally“). “The essential thing is the purpose to cause the result.” RESTATEMENT (FIRST) OF TORTS § 766 cmt. d (AM. LAW INST. 1939). Because Plaintiff has not pleaded that Google acted with such a purpose, this claim (Count IV) is dismissed.
D. Intrusion upon Seclusion / Breach of Confidentiality
Next, Plaintiff asserts a common law claim for intrusion upon seclusion against both Defendants because of the University‘s disclosure and Google‘s receipt of his PHI. (AC ¶¶ 161–64.) The Illinois Supreme Court has explained that “the core of this tort is the offensive prying into the private domain of another” and that “[t]he basis of the tort is not publication or publicity.” Lovgren v. Citizens First Nat. Bank of Princeton, 126 Ill. 2d 411, 417, 534 N.E.2d 987, 989 (1989).
Likely recognizing that this case law forecloses his ability to pursue this claim, Mr. Dinerstein abandons his intrusion-upon-seclusion theory in his brief and tries to reframe it as a breach-of-confidentiality tort. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 24.) There is a consensus among many state courts, he argues, that a common law cause of action for breach of confidentiality exists for the unauthorized disclosure of a patient‘s medical information. (Id.) In fact, a number of state courts have recognized such a tort. See, e.g., Lawson v. Halpern-Reiss, 212 A.3d 1213, 1217–18 (Vt. 2019); Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 175 A.3d 1, 15 (Conn. 2018). Illinois courts have not, as Plaintiff acknowledges. He instead invites this court to recognize such a cause of action, but the court declines the invitation.
Courts sitting in diversity and facing an unsettled state law question are tasked with predicting how the Illinois Supreme Court would decide the issue. Cmty. Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803, 811 (7th Cir. 2018) (citing Erie R.R. Co. v. Tompkins, 304 U.S. 64 (1938)). Yet the Seventh Circuit “consistently ha[s] held that ‘it is not our role to break new ground in state law.‘” Sabrina Roppo v. Travelers Commercial Ins. Co., 869 F.3d 568, 596 (7th Cir. 2017) (quoting Lopardo v. Fleming Cos., Inc., 97 F.3d 921, 930 (7th Cir. 1996)). None of Plaintiff‘s arguments persuade the court to ignore this counsel. First, Plaintiff notes that the Seventh Circuit has said, “When state law on a question is unclear, which is surely the proper characterization here, the best guess is that the state‘s highest court, should it ever be presented with the issues, will line up with the majority of the states.” Vigortone AG Prods., Inc. v. PM AG Prods., Inc., 316 F.3d 641, 644 (7th Cir. 2002). But Plaintiff has not shown that this tort is the
E. Unjust Enrichment
Finally, Plaintiff‘s unjust enrichment claims are dismissed as well. “Unjust enrichment is not a separate cause of action under Illinois law.” Horist v. Sudler & Co., 941 F.3d 274, 281 (7th Cir. 2019). “[I]f an unjust enrichment claim rests on the same improper conduct alleged in another claim, then the unjust enrichment claim will be tied to this related claim—and, of course, unjust enrichment will stand or fall with the related claim.” Cleary v. Philip Morris Inc., 656 F.3d 511, 517 (7th Cir. 2011). Plaintiff acknowledges that his unjust enrichment claims depend on the other theories he asserted against the University and Google. (See Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 10 n.3.) Because Plaintiff‘s other claims have been dismissed, so should his unjust enrichment claims. Counts VI and VII are dismissed.
CONCLUSION
For the reasons stated above, the court grants Defendant University‘s and Defendant Google‘s motions to dismiss [43, 45] Plaintiff Matt Dinerstein‘s amended class action complaint [42] pursuant to
ENTER:
Dated: September 4, 2020
REBECCA R. PALLMEYER
United States District Judge