MATT DINERSTEIN, Individually and on behalf of all others similarly situated, Plaintiff, v. GOOGLE, LLC, a Delaware limited liability company, THE UNIVERSITY OF CHICAGO MEDICAL CENTER, an Illinois not-for-profit corporation, and THE UNIVERSITY OF CHICAGO, an Illinois not-for-profit corporation, Defendants.
Case: 1:19-cv-04311
UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION
Filed: 09/04/20
MEMORANDUM OPINION AND ORDER
In 2017, Defendants The University of Chicago and The University of Chicago Medical Center (collectively “the University“) and Google began a research partnership in which they used machine-learning techniques to create predictive health models aimed at reducing hospital readmissions and anticipating future medical events. As part of this research, the University disclosed to Google the “de-identified” electronic health records of all adult patients treated at its hospital from January 1, 2010 through June 30, 2016. Plaintiff Matt Dinerstein was an inpatient at the University in June 2015 and, asserting a variety of state-law claims, brings this suit pursuant to the
BACKGROUND
The amended class action complaint (“AC“) [42] alleges the following facts, assumed true for the purposes of this analysis. Plaintiff Matt Dinerstein had two separate hospital stays as a patient at the University‘s hospital in June 2015. (AC ¶ 92.) Each stay lasted for a few days (id.), and Plaintiff paid premiums and other fees to health insurers who provided coverage for the treatment and services he received. (Id. ¶ 98.) During his stays at the hospital and throughout 2015, Mr. Dinerstein maintained an account with Defendant Google and used a smartphone with Google applications on it, which, he alleges, collected and transmitted to Google his geolocation information. (Id. ¶ 94.) Also during these stays, the University generated and maintained health records for Plaintiff, which included such sensitive information as his demographic data, vital signs, diagnoses, procedures, and prescriptions. (Id. ¶ 93.) Mr. Dinerstein received two forms relevant to this sensitive information: the Admission and Outpatient Agreement and Authorization form, and the Notice of Privacy Practices. (Id. ¶ 61.)
The Admission and Outpatient Agreement and Authorization (“the Authorization“), a copy of which was attached as an exhibit to the amended complaint, contains two paragraphs relevant to the present dispute:
I understand and agree that my medical information in any form and any tissue, fluids, cells and other specimens that may be collected during this hospitalization and/or period of treatment may be used and shared for research that has been approved by the University of Chicago Institutional Review Board (IRB) and that has been found to pose a minimal risk. I acknowledge that such research by the University of Chicago Medical Center may have commercial value and, in that event, I understand that I will not be entitled to any compensation, regardless of the value of such research or any products or inventions developed therefrom. I understand that all efforts will be made to protect my privacy and that any use of my medical information will be in compliance with federal and state laws, including all laws that govern patient confidentiality, and the University of Chicago Medical Center Notice of Privacy Practices. I further understand that my identity and the identity of my medical records will not be included in any research findings or reports.
(Outpatient Agreement & Authorization § III, Ex. 2 to AC [42-2].) See
The Notice of Privacy Practices (“the NPP“) contains the following provisions that are also important to the instant case:
We respect the privacy of your medical information. Each time you visit us, we record information about the care you receive, including external information we receive about your health care and information to seek payment for our services (your “medical information“). This medical information is also called your “Protected Health Information“) (“PHI“). These records may be kept on paper, electronically on a computer, or stored by other media.
[The University Chicago Medical Center (“UCMC“)] is required by law to:
- Maintain the privacy and security of your PHI;
- Notify you following a breach of your unsecured PHI, if required by law;
- Provide this Notice to you and describe the ways we may use and share your PHI;
- Notify you of your rights regarding your PHI;
- Follow the terms of this Notice.
. . .
We perform research at UCMC. Our researchers may use or share your information without your authorization (a) if the group that oversees research gives them permission to do so, (b) if the patient data is being used to prepare for a research study, or (c) if the research is limited to data of deceased patients.
. . .
We will not use or share your medical information for any reason other than those described in this Notice without a written authorization signed by you or your personal representative. An authorization is a document that you sign that directs us to use or disclose specific information for a specific purpose. . . .
We will obtain your written permission:
- For the sale of your medical information.
(NPP at 1-2, 4, 5, Ex. 1 to Univ. Mem. in Supp. of Mot. to Dismiss [44-1].)1
Plaintiff alleges that while Google retains all rights to the software created using the EHRs, the DUA granted the University a perpetual license to use that software. (Id. ¶ 66.) Google disputes this characterization of the DUA. (Google Mem. in Supp. of Mot. to Dismiss [46] at 3 n.3.) In fact, it is not apparent to the court what exactly has been granted to the University. See Bytska v. Swiss Int‘l Air Lines, Ltd., No. 15 C 483, 2016 WL 792314, at *3 (N.D. Ill. Mar. 1, 2016) (explaining that if “an exhibit incontrovertibly contradicts the allegations in the complaint, the exhibit ordinarily controls, even when considering a motion to dismiss“). The DUA grants to the University, “for internal non-commercial research purposes,” “a nonexclusive, perpetual license to use the [] Trained Models and Predictions” created by Google. (DUA § 3.12.) The Trained Model refers to the model created via machine learning conducted on the EHRs, and Predictions are the results of the model‘s computations. Specifically, the DUA defines “Trained Model” as “the Model parameters arranged in accordance with the Model‘s mathematical form,” which are determined by using “the Limited Data Set“—the EHRs disclosed by the University to Google—“as Input Data” to “train” the Model. (Id. § 1.12.) Training a model means “using Model Software to create Model parameters for a Model form using Input Data.” (Id. § 1.12.) And the “Model Software” is “used to Train a Model and compute Predictions,” (id. § 1.7), where “Predictions” are the outputs “of a Model for a given set of Input Data.” (Id. § 1.6.)
In early 2018, Defendants published a study discussing the results of their research and methodology. (AC ¶ 64; see Alvin Rajkomar et al., Scalable and Accurate Deep Learning with Electronic Health Records, 1 NPJ Digital Media (January 2018), https://www.nature.com /articles/s41746-018-0029-1 (last visited Sept. 1, 2020).) The article explains that the study used EHRs provided by Defendant University and the University of California, San Francisco (“UCSF“) that included the following “de-identified” information: “patient demographics, provider orders, diagnoses, procedures, medications,
These disclosures, Plaintiff alleges, violate HIPAA because the University either did not make an expert determination that the risk of re-identifying the data was very small or, if such a determination was made, it was incorrect.2 (Id. ¶ 70.) Plaintiff suggests that the risk of re-identification was in fact substantial because of the information Google already possesses about individuals through the other services it provides.3 Specifically, the amended complaint refers to Google as “one of the largest and most comprehensive data mining companies in the world, drawing data from thousands of sources and compiling information about individuals’ personal traits (gender, age, sexuality, race), personal habits, purchases, and associations.” (Id. ¶ 76). Google has “create[d] detailed profiles of millions of Americans,” including public and nonpublic information, and “possess[es] detailed geolocation information
***
Mr. Dinerstein brings this action on behalf of himself and all individuals in the United States whose EHRs were transferred by the University to Google. (Id. ¶ 99.) According to the amended complaint (id. ¶ 18), the court has jurisdiction under CAFA because at least one member of the proposed class is a citizen of a different state than Defendants and the amount in controversy exceeds $5,000,000.
The University and Google have both filed motions to dismiss [43, 45], contending that Plaintiff lacks standing and has failed to state a claim upon which relief can be granted. See
DISCUSSION
I. Subject Matter Jurisdiction
A motion to dismiss for lack of standing tests the jurisdictional sufficiency of the complaint.
A. Breach of Contract
First, Plaintiff argues that he has standing because he alleged that the University breached a contract—namely, the promises the University made in the Authorization and NPP he received when admitted to the hospital. (See Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss [65] at 5.) An alleged breach of contract, Mr. Dinerstein insists, confers Article III standing even if the breach is not claimed to have resulted in any “monetary loss or other concrete harm.” (Id. at 4–5 (quoting J.P. Morgan Chase Bank, N.A. v. McDonald, 760 F.3d 646, 650–51 (7th Cir. 2014).) The University responds that such an injury is purely a legal one and hence neither concrete nor even an injury in fact. (Univ. Reply Mem. in Supp. of Mot. to Dismiss [71] at 1-2 (citing Spokeo, 136 S. Ct. at 1549).)
Whether alleging breach of contract—without actual damages—is enough to confer standing is a close call. There is authority on both sides of the issue, but the court concludes that Plaintiff has the better argument. The Supreme Court in Spokeo, 136 S. Ct. at 1549, wrote that for a court engaging in standing analysis, “it is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” There is common law authority for the proposition that a plaintiff may sue for breach of contract even where the breach resulted in no harm. See, e.g., RESTATEMENT (FIRST) OF CONTRACTS ch. 12, topic 2, § 328 (AM. LAW INST. 1932) (“Where a right of action for breach exists, but no harm was caused by the breach, . . . judgment will be given for nominal damages, a small sum fixed without regard to the amount of harm.“); see also Spokeo, 136 S. Ct. at 1551 (Thomas, J., concurring) (“Historically, common-law courts possessed broad power to adjudicate suits involving the alleged violation of private rights, even when plaintiffs alleged only the violation of those rights and nothing more. . . . ‘Private rights’ have traditionally included rights of personal security (including security of reputation), property rights, and contract rights.“). After the parties submitted their briefs, however, the Supreme Court issued an opinion in Thole holding that participants in a defined-benefit retirement plan, which the Court observed is “in the nature of a contract,” lack standing to sue a plan manager for breach of fiduciary duties because they had suffered no monetary injury. 140 S. Ct. at 1618, 1620. This could be construed to mean that breach of contract, without monetary harm, does not confer standing. Indeed, that appears to be how, in dissent, Justice Sotomayor interpreted that portion of the majority opinion. See id. at 1630 (Sotomayor, J., dissenting). Thole concerned a cause of action under ERISA and does not correctly control the analysis of the issue here.
The McDonalds’ attempt to arbitrate appears to have violated the clause of their contract with the Bank, and the Bank‘s claim of the violation is enough to give the Bank standing to bring this action to enforce the clause. Formation of a bilateral contract requires each party to take on one or more legally binding obligations in exchange for the other party doing the same. When one party fails to honor its commitments, the other party to the contract suffers a legal injury sufficient to create standing even where that party seems not to have incurred monetary loss or other concrete harm.
Id. at 650-51. True, J.P. Morgan Chase Bank was decided before Spokeo, 136 S. Ct. at 1548, where the Court made clear that for an injury to satisfy the concreteness requirement, it “must actually exist” and cannot be “abstract.” But Defendants have cited no post-Spokeo Seventh Circuit case that revisits or is at odds with J.P. Morgan Chase Bank.
The court acknowledges pre-Spokeo Seventh Circuit cases cited by the University that are in some tension with J.P. Morgan Chase Bank, but finds those cases distinguishable. In Silha, 807 F.3d at 171, students sued administrators of the ACT and SAT tests because, even though the plaintiffs had consented to the administrators sharing their personal information with educational organizations, the administrators had not told the students that their information would be sold. Among the claims asserted was an alleged breach of contract, but the Court of Appeals concluded the plaintiffs lacked standing. Id. at 172, 174–75. In contrast with the case before this court, where Mr. Dinerstein has adequately alleged the existence of a contract and identified the terms he claims were breached, the well-pleaded factual allegations in Silha included neither. Id. at 174–75. Indeed, in the district court, the Silha plaintiffs had not identified a contract breach as one of their injuries. Silha v. ACT, Inc., No. 14 C 0505, 2014 WL 11370440, at *2 (N.D. Ill. Sept. 2, 2014).
The University also relies on language from two Seventh Circuit data breach cases, but these too are inapposite. In Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 692–94 (7th Cir. 2015), plaintiffs, whose credit card numbers had been stolen when the defendant department store‘s servers were hacked, alleged that they had “overpaid for the products at Neiman Marcus because the store failed to invest in an adequate security system.” Id. at 694. The court found these plaintiffs had standing—but not on the basis of plaintiffs’ overpayment theory. Instead, the court noted other claims: that plaintiffs faced an increased risk of future fraudulent charges, greater susceptibility to identity theft, and lost time and money expended to protect themselves from future identity theft and fraudulent charges. The court did note that overpayment can sometimes confer standing,
Plaintiffs claim that the cost of their meals is an injury because they would not have dined at P.F. Chang‘s had they known of its poor data security. As we noted in Remijas, such arguments have been adopted by courts only where the product itself was defective or dangerous and consumers claim they would not have bought it (or paid a premium for it) had they known of the defect. The plaintiffs here make no such allegations, and we are not inclined to push this theory beyond its current scope.
The University argues that these two cases support the proposition that being denied the benefit of his bargain is insufficient to confer standing on Plaintiff. (Univ. Reply Mem. in Supp. of Mot. to Dismiss at 3.) As the University sees it, the theory rejected in Remijas and Lewert concerned breaches of implied contract, which is no different from Mr. Dinerstein‘s breach of express contract theory. (Id. at 3 n.3.) But in those cases, the Seventh Circuit appeared to doubt that the implied contract between the plaintiff patrons and defendant stores included a promise that the stores would implement better information security practices. See Lewert, 819 F.3d at 968 (noting that the plaintiffs made no allegations that they would not have dined at P.F. Chang‘s had they known of their security practices). In this case, in contrast, Plaintiff alleges that the University expressly made certain promises about privacy to Plaintiff, which he has alleged were breached.
Out-of-circuit caselaw generally—albeit not universally—confirms this court‘s view that Plaintiff has standing to pursue his contract claims. See Springer v. Cleveland Clinic Emp. Health Plan Total Care, 900 F.3d 284, 287 (6th Cir. 2018) (citations omitted) (“Like any private contract claim, his injury does not depend on allegation of financial loss. His injury is that he was denied the benefit of his bargain.... The injury therefore stemmed from traditional principles of contract law that did not depend on financial harm.“); Kuhns v. Scottrade, Inc., 868 F.3d 711, 716 (8th Cir. 2017) (quoting Carlsen v. GameStop, Inc., 833 F.3d 903, 909 (8th Cir. 2016)) (“[A] party to a breached contract has a judicially cognizable interest for standing purposes, regardless of the merits of the breach alleged.“); In re Facebook Internet Tracking Litig., 263 F. Supp. 3d 836, 844 (N.D. Cal. 2017) (“Actual damages are not required to establish standing for contractual claims.“), aff‘d in part, rev‘d in part, 956 F.3d 589 (9th Cir. 2020). But see Case v. Miami Beach Healthcare Grp., Ltd., 166 F. Supp. 3d 1315, 1318–20 (S.D. Fla. 2016) (holding that plaintiff did not have standing even though she alleged that the defendants “breached their contractual obligation to protect her sensitive information“); Svenson v. Google Inc., No. 13 C 04080, 2016 WL 8943301, at *10 (N.D. Cal. Dec. 21, 2016).
In a footnote, the University has cited a number of cases in which courts dismissed cases for lack of standing, but none of those cases considered claims of standing based on a breach of contract theory. See Strautins v. Trustwave Holdings, Inc., 27 F. Supp. 3d 871, 879 (N.D. Ill. 2014); Fero v. Excellus Health Plan, Inc., 236 F. Supp. 3d 735, 754 (W.D.N.Y. 2017); Kahn v. Children‘s Nat‘l Health Sys., 188 F. Supp. 3d 524, 533 (D. Md. 2016); In re Sci. Applications Int‘l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 24–31 (D.D.C. 2014). In fact, these were data breach cases where the courts rejected theories similar to the overpayment theory considered by the Seventh Circuit in Remijas and Lewert, which the court has already noted are not on point here. See Fero, 236 F. Supp. 3d at 754 (citation omitted) (“The Excellus Defendants argue that Plaintiffs cannot establish injury-in-fact based on their alleged overpayment for health insurance. The Court agrees.“); Kahn, 188 F. Supp. 3d at 533 (rejecting
the plaintiff‘s claim that she was deprived the full value of her bargain because she did “not allege any facts showing that she overpaid for those services or that she would have sought those services from another provider had she been aware of the hospital‘s allegedly lax data security“); SAIC, 45 F. Supp. 3d at 30 (“Plaintiffs have not alleged facts that show that the market value of their insurance coverage (plus security services) was somehow less than what they paid. Nothing in the Complaint makes a plausible case that Plaintiffs were cheated out of their premiums.“).
The weight of authority supports the conclusion that Mr. Dinerstein‘s allegation that the University breached an express contract is sufficient for Article III standing purposes. Standing, however, “‘is not dispensed in gross.’ To the contrary, ‘a plaintiff must demonstrate standing for each claim he seeks to press and for each form of relief that is sought.‘” Town of Chester, N.Y. v. Laroe Estates, Inc., 137 S. Ct. 1645, 1650 (2017) (citations omitted) (quoting Davis v. Fed. Election Comm’n, 554 U.S. 724, 734 (2008)). Plaintiff therefore has standing to pursue his contract claims, including his interference of contract claim against Google,5 but the court will review his other injuries independently to determine whether he has standing to pursue his intrusion-upon-seclusion and ICFA claims.
B. Invasion of Privacy
Second, Plaintiff contends that an invasion of his privacy is an injury in fact sufficient for Article III standing. (See Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 6–8.) Specifically, Mr. Dinerstein alleges that the University disclosed, at Google‘s behest, his confidential medical records. (Id. at 6.) Defendants assert that this injury is too abstract for Article III standing. (See, e.g., Univ. Mem. in Supp. of Mot. to Dismiss at 7.) Here, too, there is mixed authority with little clear appellate court guidance, but the court again finds Plaintiff‘s position to be more persuasive, at least for his common law intrusion-upon-seclusion claim.6
As noted in the court‘s discussion of Spokeo, courts faced with standing challenges must consider whether “the common law permitted suit in analogous circumstances.” Groshek v. Time Warner Cable, Inc., 865 F.3d 884, 887 (7th Cir. 2017). Important for the present case, many courts have observed that “[i]nvasion of privacy lawsuits are nothing new; at common law, violations of the right to privacy have been recognized as a valid basis for suit.” Dixon v. Washington & Jane Smith Cmty.–Beverly, No. 17 C 8033, 2018 WL 2445292, at *9 (N.D. Ill. May 31, 2018) (citing Cox Broad. Corp. v. Cohn, 420 U.S. 469, 488 (1975); Eichenberger v. ESPN, Inc., 876 F.3d 979, 983 (9th Cir. 2017)); see also C.S. Wang & Assoc. v. Wells Fargo Bank, N.A., 305 F. Supp. 3d 864, 880 (N.D. Ill. 2018) (“Invasion of privacy is actionable at common law.“). “[T]he Supreme Court has noted that ‘both the common law and the literal understanding of privacy encompass the individual‘s control of information concerning his or her person.‘” Eichenberger, 876 F.3d at 983 (quoting U.S. Dep‘t of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 763 (1989)). In recognizing that “there is a common law tradition of lawsuits for invasion of privacy,” the Eighth Circuit has stated that “the retention of information lawfully obtained, without further disclosure, traditionally has not provided the basis for a lawsuit in American courts.” Braitberg v. Charter Commc‘ns, Inc., 836 F.3d 925, 930 (8th Cir. 2016). That language implies that the common law would recognize suits where private information was further disclosed.
A recent Seventh Circuit case, not cited by the parties, is consistent with this understanding. Bryant v. Compass Grp. USA, Inc., 958 F.3d 617, 619–20 (7th Cir. 2020), was a suit brought under the
Justice Thomas joined the majority‘s opinion [in Spokeo], but he added a concurrence that drew a useful distinction between two types of injuries. The first, he said, arises when a private plaintiff asserts a violation of her own rights [which is permissible]; the second occurs when a private plaintiff seeks to vindicate public rights [which is not]. As examples of the first, he mentioned actions for trespass, infringement of intellectual property rights, and unjust enrichment; as examples of the second, he pointed to actions seeking to abate a public nuisance, or disputes over the use of public land.
Applying Justice Thomas‘s rubric, we have no trouble concluding that Bryant was asserting a violation of her own rights—her fingerprints, her private information—and that this is enough to show injury-in-fact without further tangible consequences. This was no bare procedural violation; it was an invasion of her private domain, much like an act of trespass would be.
Id. at 624 (citations omitted). Here, Mr. Dinerstein asserts the wrongful disclosure of his private information—a violation of his own rights. “[T]his is enough to show injury-in-fact,” according to the Seventh Circuit. Id.
This case, of course, differs from Bryant and others cited above, which involved statutes that created private rights of action. The two statutes relevant to this case—HIPAA and the Illinois’
This court concludes that for Plaintiff‘s common law intrusion-upon-seclusion claim, an invasion of Plaintiff‘s privacy is an injury-in-fact that can support standing. See In re Facebook Internet Tracking Litig., 263 F. Supp. 3d at 843 (citations omitted) (“[A] plaintiff need not show actual loss to establish standing for common-law claims of invasion of privacy and intrusion upon seclusion. The Court finds that Plaintiffs’ alleged privacy violations are sufficient to establish standing for Plaintiffs’ privacy tort claims.“) True, other courts have denied standing for plaintiffs who alleged that their personal information was wrongfully disclosed. See, e.g., Jackson v. Loews Hotels, Inc., No. ED CV 18-827-DMG (JCx), 2019 WL 2619656, at *3–5 (C.D. Cal. Jan. 4, 2019).7 But the court is persuaded that Mr. Dinerstein has pleaded an injury in fact, in light of the common law tradition‘s recognition that an individual has standing to challenge an invasion of his privacy rights. See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 598 (9th Cir. 2020) (finding that a violation of the right to privacy is a concrete and particularized injury in fact); Browner, 355 F. Supp. 3d at 736 (“[A]n invasion of privacy is similar to the harm involved in the traditional tort of intrusion upon
seclusion which holds a person liable for intentionally intruding, physically or otherwise, upon the solitude or seclusion of another or his private affairs.“); see also Bryant, 958 F.3d at 624 (holding that the plaintiff had standing because the alleged injury “was an invasion of her private domain, much like an act of trespass would be“). In short, the
Defendants’ other arguments on this issue are unavailing. Both argue that this case differs from those where courts recognized invasions of privacy as injuries in fact because of the nature of the information disclosed. (Univ. Mem. in Supp. of Mot. to Dismiss at 6–8; Google Mem. in Reply in Supp. of Mot. to Dismiss [70] at 4.) This contention has some basis: those cases concerned stolen credit card information, Lewert, 819 F.3d at 965, secretly recorded phone calls, C.S. Wang & Assoc., 305 F. Supp. 3d at 873, and biometric data such as fingerprints, Dixon, 2018 WL 2445292, at *1. While Plaintiff charges the University with disclosing de-identified information such as patient demographics and diagnoses, as well as date stamps and free-text notes, Plaintiff also claims this information was not sufficiently anonymized. (See AC ¶¶ 64–69.) For many persons, disclosure of insufficiently anonymized health records is more invasive and disturbing than disclosure of credit records or fingerprints. In any case, the court is skeptical that the gravity of the information disclosed is what matters for standing; just as, for example, “trespass occurs whenever property interest is invaded” and does not require actual damages, Chicago Title Land Tr. Co. v. JS II, LLC, 2012 IL App (1st) 063420, ¶¶ 77, 977 N.E.2d 198, 218 (1st Dist. 2012), so the invasion of Mr. Dinerstein‘s privacy depends not on the magnitude of the harm but the fact that this private right was invaded at all.
Finally, Google contends that standing is not conferred by the risk that Google may effectively re-identify the EHRs because it has access to other data. Were this the only injury attributable to Google, the court would agree. See Clapper v. Amnesty Int‘l USA, 568 U.S. 398, 410 (2013) (noting that “threatened injury must be certainly impending“). Yet Plaintiff has alleged that his private information was improperly disclosed to Google, a party with whom he never authorized sharing his medical data, and that the University also disclosed this information at Google‘s behest. (See, e.g., AC ¶ 9. (“Ultimately, by getting the University to turn over these records, Google quietly pulled off a feat that other tech giants (like Facebook) have had to abandon under mounting public pressure for other gross privacy violations.“).) That is, Plaintiff claims Google participated in the University‘s invasion of his privacy, and its continued possession of his information is part and parcel of the harm. This is enough of an injury for Plaintiff to assert his intrusion-upon-seclusion claim against Google.
C. Value of EHRs
Plaintiff‘s third asserted concrete and particularized harm is the alleged theft of his medical information, which he insists has commercial value and is something he has a legal interest in. (See Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 9–10.) Plaintiff points to Lewert, 819 F.3d at 968, for support, where the Seventh Circuit noted that the statute at issue in Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 623 (7th Cir. 2014), “creates a legally protected interest in a consumer‘s personally identifiable information with respect to video rentals.” Mr. Dinerstein seems to suggest that the statutes at issue here—HIPAA and the MPRA—also create a legal interest in his health information, just as the statute in Sterk did. But the court in Lewert, 819 F.3d at 968, made clear that ”Sterk does not recognize a legal interest in personally identifiable information beyond the video-rental context.” Plaintiff has cited no authority supporting the proposition
Even if Mr. Dinerstein has a property interest in medical information, his allegations do not support an inference that the value of that property has been diminished by the University‘s or Google‘s actions. See Remijas, 794 F.3d at 695 (finding that the loss of personal information, which the plaintiffs “characterize[d] as an intangible commodity,” did not support standing, “particularly since the complaint does not suggest that the plaintiffs could sell their personal information for value“); Welborn v. Internal Revenue Serv., 218 F. Supp. 3d 64, 78 (D.D.C. 2016) (“Courts have routinely rejected the proposition that an individual‘s personal identifying information has an independent monetary value.“). Trying to circumvent this obstacle, Plaintiff argues that even if his personal information suffered no diminution in value, he still has an injury in the form of a lost royalty—that is, he suggests that Google or the University would have agreed to pay him a royalty if they had negotiated in good faith for his medical records. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 9–10.) In support, Mr. Dinerstein cites a patent case, Zegers v. Zegers, Inc., 458 F.2d 726, 730 (7th Cir. 1972), and a case concerning the theft of proprietary information, Vojdani v. Pharmasan Labs, Inc., 741 F.3d 777 (7th Cir. 2013). But the court agrees with the University that these are inapposite because the aggrieved parties in those cases, unlike Plaintiff, had recognized legal interests in the information in question. (See Univ. Reply Mem. in Supp. of Mot. to Dismiss at 5 n.5.) Moreover, the Seventh Circuit foreclosed this theory in Silha, 807 F.3d at 174–75 (citation omitted), where it reasoned that “a plaintiff‘s claim of injury in fact cannot be based solely on a defendant‘s gain; it must be based on a plaintiff‘s loss.”8 Here, as in Silha, Plaintiff “ha[s] not alleged that [he] lost anything of value as a result of the alleged misconduct.” Id. at 175.
***
Plaintiff has pleaded two concrete and particularized injuries in fact to support his contract and common law claims asserted against the University and Google. The other requirements for Article III standing are met for those claims as well, because the alleged breach of contract and invasion of privacy are fairly traceable to the University‘s and Google‘s conduct and could be redressed by some of the relief that Mr. Dinerstein seeks.
or that they could have obtained a better price elsewhere). Plaintiff‘s ICFA claim (Count I) is therefore dismissed.
II. Failure to State a Claim upon which Relief Can Be Granted
A motion to dismiss under
A. Express Contract Claim
“Under Illinois law, the elements of a breach of contract cause of action are ‘(1) offer and acceptance, (2) consideration, (3) definite and certain terms, (4) performance by the plaintiff of all required conditions, (5) breach, and (6) damages.‘” Ass‘n Ben. Servs., Inc. v. Caremark RX, Inc., 493 F.3d 841, 849 (7th Cir. 2007) (quoting MC Baldwin Fin. Co. v. DiMaggio, Rosario & Veraja, LLC, 364 Ill. App. 3d 6, 14, 845 N.E.2d 22, 30 (1st Dist. 2006)). Three elements are at issue for Mr. Dinerstein‘s contract claim: whether he has pleaded that the University breached the contract, whether the agreement was supported by valid consideration,
1. Alleged Breaches
Plaintiff asserts that the University‘s disclosure of his medical information to Google violated four terms of the contract: (1) that “all efforts” would be made to protect his privacy, (2) that any use of his medical information would comply with federal law, (3) that any use of his medical information would comply with state law, and (4) that it would comply with the NPP. (AC ¶¶ 130–32; Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 11.)
a. “All Efforts”
To begin, the parties disagree about whether an “all efforts” or “best efforts” clause is enforceable in Illinois. (Compare Univ. Mem. in Supp. of Mot. to Dismiss at 9, with Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 15–16.) Having reviewed the case law on this question, the court concludes that while Mr. Dinerstein is correct that Illinois courts have enforced all-efforts or best-efforts clauses in certain circumstances, Res. Dealer Grp., Inc. v. Exec. Servs., Ltd., No. 97 C 4343, 1997 WL 790737, at *3 (N.D. Ill. Dec. 18, 1997) (“Illinois courts have enforced best efforts clauses in a variety of contracts.“), this is not one of those circumstances.
Wald v. Chicago Shippers Ass‘n, 175 Ill. App. 3d 607, 529 N.E.2d 1138 (1st Dist. 1988), is instructive. The Wald plaintiffs sued to enforce a clause in a contract that required the defendant shipping association to use its best efforts to route the largest possible volume of freight through the plaintiffs’ facilities. Id. at 610–14, 529 N.E.2d at 1140–43. That clause, the court found, was “too indefinite to be enforceable” because it failed to set forth any specific terms regarding, for example, the contract‘s duration or the quantity of freight to be shipped through those facilities. Id. at 617, 529 N.E.2d at 1145. No other part of the contract contained terms clarifying this obligation, either. Id. Though the court noted that ambiguities in contracts may be resolved by extrinsic evidence or prior course of dealings, such evidence did not effectively clarify the “best efforts” clause. Id. at 618–20, 529 N.E.2d at 1146–47; see also Beraha v. Baxter Health Care Corp., 956 F.2d 1436, 1441 (7th Cir. 1992) (holding that the defendant‘s “statement that it would ‘do [its] very best to make this project a success’ is merely a vague expression of goodwill; it is not an enforceable contractual promise“); Penzell v. Taylor, 219 Ill. App. 3d 680, 688, 579 N.E.2d 956, 961 (1st Dist. 1991) (stating that “this court has held that the phrase ‘best efforts’ is too indefinite and uncertain to be an enforceable standard” and finding that “[the counter-claimant‘s] claim for breach of contract fails because the best effort required to be expended by [the counter-defendant] is too vague to ascertain“).
As in Wald, the “all efforts” language in the Authorization is too indefinite to enforce. It does not include or refer to essential terms, such as what efforts the University was expected to engage in. And no other parts of the contract provide terms that could be construed to supply the definiteness necessary for this clause to be enforceable. Moreover, Mr. Dinerstein has not pointed to any extrinsic evidence or other facts that would help the court determine what all efforts is supposed to mean. Cf. Res. Dealer Grp., 1997 WL 790737, at *3–4 (declining to dismiss a contract claim concerning “best efforts” language in a “detailed, nineteen page contract” where that clause was one of “four separate and specific obligations that the
In the court‘s view, Plaintiff‘s “best efforts” claim is an odd fit in this context. When such clauses are held to be enforceable, they are most typically used to impose affirmative obligations in commercial contracts in which one party is obliged to promote the business of another. See, e.g., id. at *3 (concerning a clause that required the plaintiff to use “best efforts” in marketing the defendant‘s business); Ralph v. Karr Mfg. Co., 20 Ill. App. 3d 450, 453–54, 314 N.E.2d 219, 221–23 (1st Dist. 1974) (analyzing a clause that required the plaintiff to “put forth his best efforts and to diligently provide the management of [the defendant‘s] sales and marketing program and with such efforts to increase [the defendant‘s] sales“). In such cases, the party so obliged must “diligently direct[] his efforts on [his counterparty‘s] behalf.” Ralph, 20 Ill. App. 3d at 454, 314 N.E.2d at 222. Here, in contrast, Plaintiff does not claim that the University failed to take appropriate affirmative actions to protect his privacy. He instead contends that the University‘s conduct actually violated his privacy.
Plaintiff argues that a best-efforts clause is just an obligation to act in good faith and that whether a party has acted in good faith is a question of fact. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 16.) Plaintiff may well be technically correct about this, see, e.g., Coleman v. Madison Two Assocs., 307 Ill. App. 3d 570, 578, 718 N.E.2d 668, 674 (1st Dist. 1999), but the argument is still inapt. “The obligation of good faith and fair dealing primarily is used to determine the intent of the parties where a contract is susceptible to two conflicting constructions. Parties to a contract are entitled to enforce the terms of the contract to the letter and an implied covenant of good faith cannot override or modify the express terms of that contract.” Id., 718 N.E.2d at 675 (emphasis added) (citation omitted); see also M.S. Distrib. Co. v. Web Records, Inc., No. 00 C 1436, 2003 WL 21087961, at *9 (N.D. Ill. May 13, 2003) (the “best efforts undertaking . . . does not form the basis for an independent cause of action“). The court does not read the Authorization as permitting two conflicting constructions; indeed, Plaintiff advances no argument that it does. And the Authorization expressly permits sharing Plaintiff‘s medical information in at least some circumstances. Plaintiff agreed that his “medical information in any form . . . may be used and shared for research that has been approved by the University of Chicago Institutional Review Board (IRB) and that has been found to pose a minimal risk.” (Outpatient Agreement & Authorization § III.) The Authorization also provides, immediately after the “all efforts” language, that “any use of medical information will be in compliance with federal and state laws.” (Id.) Notably, both HIPAA and the MPRA expressly permit disclosures of personal information in certain contexts. See, e.g.,
The court declines to interpret the phrase “all efforts” to impose some indefinite obligation on the University that could conflict with other, more specific portions of the Authorization. See Beraha, 956 F.2d at 1441 (“[Courts] do not lightly find implied obligations of any kind unless those implied obligations serve to effect the clear intentions of the parties derived from the express terms of the contract.“); Alberto-Culver Co. v. Aon Corp., 351 Ill. App. 3d 123, 135, 812 N.E.2d 369, 380 (1st Dist. 2004) (“Where an inconsistency arises between a clause that is general and one that is more specific, the latter prevails.“). Because the clause in question is not independently enforceable, there is no issue of fact to be resolved later in the proceedings. Compare Res. Dealer Grp., 1997 WL 790737, at *4 (declining to dismiss a claim that one party failed to use best efforts to market the other party‘s services, concluding that the best efforts clause was reasonably specific), with Wald, 175 Ill. App. 3d at 617, 529 N.E.2d at 1145 (finding that the best effort clause “is ambiguous as a matter of law” and that “[i]ts terms are obscure and indefinite in meaning“).
b. Compliance with Federal Law
Plaintiff asserts that the University‘s disclosure of his medical information to Google violated HIPAA and, therefore, breached the Authorization‘s requirement that “any use of medical information will be in compliance with federal . . . laws.” (Outpatient Agreement & Authorization § III.)
An initial matter is whether an alleged violation of HIPAA can support a breach of contract claim at all. The statute does not create a private right of action. See Carpenter v. Phillips, 419 F. App‘x 658, 659 (7th Cir. 2011). The University is correct that courts in other jurisdictions have held that a HIPAA claim cannot be pursued as a breach of contract claim—that is, a contract claim cannot be used to create a right of action that Congress declined to establish. See Brush v. Miami Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1368 (S.D. Fla. 2017) (“Plaintiff cannot mask a HIPAA claim as a breach of contract claim.“); Cairel v. Jessamine Cty. Fiscal Court, No. 5:15-CV-186-JMH, 2015 WL 8967884, at *4 (E.D. Ky. Dec. 15, 2015) (“Plaintiff attempts to circumvent the fact that no private right of action exists under HIPAA by characterizing her claim thereunder as one for breach of contract. Regardless of whether the contract included a HIPAA provision, there simply is no private right of action for violations of HIPAA, at the state or federal level.“); Sheldon v. Kettering Health Network, 2015-Ohio-3268, ¶¶ 30, 40 N.E.3d 661, 674 (Ohio Ct. App. 2015) (“[T]o the extent that HIPAA universally has been held not to authorize a private right of action, to permit HIPAA regulations to define per se the duty and liability for breach is no less than a private action to enforce HIPAA, which is precluded.“). Those opinions, however, lack in-depth analysis of the issue and are not binding on this court; as discussed below, the court concludes that HIPAA does not preempt a state common law claim like that asserted here by Mr. Dinerstein.
The Seventh Circuit has dealt with similar issues with other statutes and found that the fact that there is no right of action under a federal statute does not preempt or otherwise bar a viable state law claim. Wigod v. Wells Fargo Bank, N.A., 673 F.3d 547, 554–55 (7th Cir. 2012), concerned several Illinois state law claims, including a contract claim, brought against the plaintiff‘s mortgage servicer, Wells Fargo, for violating the federal Home Affordable Mortgage Program. Wells Fargo argued that the plaintiff should not be able to use a contract claim to make an “end run” around the lack of a private right of action in the relevant federal law. The court rejected this reasoning:
The end-run theory is built on the novel assumption that where Congress does not create a private right of action for violation of a federal law, no right of action may exist under state law, either. . . . The absence of a private right of action from a federal statute provides no reason to dismiss a claim under a
state law just because it refers to or incorporates some element of the federal law. To find otherwise would require adopting the novel presumption that where Congress provides no remedy under federal law, state law may not afford one in its stead.
Id. at 581 (citations omitted). In fact, “[w]hen the federal court‘s jurisdiction over state-law claims is based on diversity of citizenship . . . the absence of a private right of action in a federal statute actually weighs against preemption.” Id. at 582 (emphasis in original); see also Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 634 (7th Cir. 2007) (noting that in a case “invoking CAFA‘s special rules for diversity jurisdiction,” the court‘s duty with respect to state law is the same “as in every diversity case“). The Seventh Circuit considered a similar issue with respect to the Higher Education Act and reached the same conclusion. Bible v. United Student Aid Funds, Inc., 799 F.3d 633, 652–54 (7th Cir. 2015) (holding that the lack of a private cause of action did not displace the plaintiff‘s contract claim and calling the defendant‘s theory “mistaken at its core“). The logic of Wigod and Bible applies here: that HIPAA lacks a private right of action does not foreclose Plaintiff‘s ability to pursue a contract claim. HIPAA also does not preempt Plaintiff‘s claim. See Wigod, 673 F.3d at 576–80 (finding that the Home Owners Loan Act did not preempt a state law claim); Bible, 799 F.3d at 652 (determining that the plaintiff‘s contract claim did not conflict with the Higher Education Act). The University cites
Moreover, Plaintiff is correct that HIPAA addresses only conflict preemption. See
Now to the substance of the contract claim: Has Plaintiff actually pleaded that Defendants breached the contract by violating HIPAA? Three parts of the HIPAA Privacy Rule are at issue here. Two of these are safe harbors that permit the disclosure of medical information under certain circumstances: First, a covered entity, such as the University, may disclose a “limited data set” if it excludes certain direct identifiers;9 is used for “research, public health, or health care operations“; and the disclosure is made pursuant to a “data use agreement” that includes certain provisions governing the use of the medical information.10
their requirements can be determined only after discovery. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 17.)
The parties have devoted little attention to this procedural question; that is, they have barely addressed whether a HIPAA regulation permitting disclosure is an affirmative defense, which Defendants must prove, or an element of a violation that Mr. Dinerstein must establish. Nor could the court find case law on this issue, likely owing to the fact that HIPAA does not have a private right of action and thus has not generated private suits. Yet the court believes that Defendants have the better view. Plaintiff‘s claim is an action for breach of contract, and none of the affirmative defenses to such a claim resemble the safe harbors that that Plaintiff asks the court to recognize as defenses. See III. Pattern Jury Instr.-Civ. 700.12 (affirmative defenses for incompetence, duress, misrepresentation, fraud, frustration of purpose, impossibility of performance, and undue influence). Moreover, the court agrees with
Indeed, even reading his allegations as consistent with a violation, the amended complaint also appears to “set forth everything necessary to satisfy the affirmative defense.” Hyson USA, Inc. v. Hyson 2U, Ltd., 821 F.3d 935, 939 (7th Cir. 2016) (quoting United States v. Lewis, 411 F.3d 838, 842 (7th Cir. 2005)). As noted,
The third relevant part of the Privacy Rule is more complicated. This component requires written authorization for the “sale of protected health information.”
As for whether Mr. Dinerstein‘s PHI was subject to a “sale,” his claim appears to be on firm ground here as well. According to the rule, a sale of PHI means “a disclosure of protected health information by a covered entity or business associate, if applicable, where the covered entity or business associate directly or indirectly receives remuneration from or on behalf of the recipient of the protected health information in exchange for the protected health information.”
The University‘s arguments that Plaintiff has not pleaded that it engaged in an impermissible sale are unsatisfying. The University notes that the amended complaint contains no allegations about “a reasonable cost-based fee.” (Univ. Reply Mem. in Supp. of Mot. to Dismiss at 7 n.9.) That is true, but it is also irrelevant; what matters is that the amended complaint has alleged that the University received something other than a reasonable cost-based fee, which it plainly does. The University also notes that, in Black‘s Law Dictionary, “sale” involves a payment of money. (Id. at 9.) But the HIPAA regulation in question includes a broader definition of sale: “a disclosure of [PHI] by a covered entity . . . where the covered entity . . . directly or indirectly receives remuneration from or on behalf of the recipient of the [PHI] in exchange for the [PHI].”
Google‘s contentions on this point are no more compelling. Google notes that the DUA “allows the University to share in the medical advancements that Google develops from the research data,” which “confirms the primary purpose of the parties’
In sum, Mr. Dinerstein has plausibly alleged that the University breached its contractual promise to comply with federal law when it exchanged protected health information for the license to use Trained Models and Predictions developed by Google.
C. Compliance with State Law
Next, Plaintiff asserts that the University breached the promise to comply with state law.11 (AC ¶ 132.) Specifically, Plaintiff alleges that the University violated § 3.1 of the MPRA. See
any individual who may be exposed to the possibility of injury, including physical, psychological, or social injury, as a consequence of participation as a subject in any research, development, or related activity that significantly departs from the application of those established and accepted methods necessary to meet his or her needs, or that increases the ordinary risks of daily life, including the recognized risks inherent in a chosen occupation or field of service
Plaintiff‘s allegations do not establish a violation of these state law provisions. The research conducted by the University and Google was not a research program as defined in the above regulation. The project did concern the creation of “new medical or scientific information,” but it did not “involve[e] medical, surgical, manipulative, or psychiatric diagnosis or treatment of human subjects who are inpatients or outpatients of a hospital.”
does not read the phrase “involving . . . diagnosis or treatment of human subjects” to include review of health records comprising information about diagnosis or treatment. That is, “research program” refers only to the direct diagnosis or treatment of a patient, not research on records concerning past diagnoses or treatments. Because Defendants’ study in question does not qualify as a “research program” under the relevant regulation,12 Plaintiff has not pleaded that the University failed to comply with state law.
d. Compliance with the Notice of Privacy Practices
Finally, the Authorization states that “any use of [Plaintiff‘s] medical information will be in compliance with . . . the University of Chicago Medical Center Notice of Privacy Practices.” (Outpatient Agreement & Authorization § III.) The NPP promises that the University would obtain Plaintiff‘s “written permission” “[f]or the sale of your medical information.” (NPP at 5.) As discussed in relation to HIPAA, Plaintiff contends that the University and Google engaged in a sale of his medical information that violates the NPP and, therefore, the Authorization. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 15, 18.)
The parties spent little time discussing what this provision means in relation to the HIPAA Privacy Rule‘s prohibition on the sale of PHI. Should this section of the NPP be interpreted to be consistent with, or more or less stringent than, the HIPAA Privacy Rule? On the one hand, the NPP does not include any definition of “sale“; if the HIPAA Rule‘s broad definition, which covers disclosures in exchange for direct or indirect remuneration, does not apply, there may be no violation of NPP. On the other hand, the NPP bans all sales; it makes no exceptions, as HIPAA does, for sales in connection with research where the only consideration is a reasonable cost-based fee. The NPP could therefore be understood as imposing a stricter requirement than the HIPAA regulation. Indeed, were the NPP to be interpreted as merely consistent with preexisting regulatory requirements, the Authorization‘s statement that the University would comply with the NPP would be mere surplusage because the University also promises to comply with federal law in the Authorization. See Premier Title Co. v. Donahue, 328 Ill. App. 3d 161, 166–67, 765 N.E.2d 513, 518 (2nd Dist. 2002) (noting the “principle that requires that a contract be construed such that none of its terms are regarded as mere surplusage“). The court finds this latter view more persuasive. Hence, as analyzed above with respect to the University‘s compliance with federal law, Plaintiff has plausibly alleged that his information was sold without his prior authorization in violation of the NPP and, therefore, in breach of the Authorization.
2. Consideration
Next, the University insists that the agreement with Plaintiff lacked consideration because it obligated the University to do no more than comply with state and federal law, which are preexisting duties. “As a general rule, a promise to perform an act which the promisor is already bound to perform cannot constitute consideration to support an enforceable contract.” 17A
Indeed, this is, again, an argument (this time, made by the University) that makes for an odd fit in this case. Typically, the preexisting duty rule is raised by the party who claims its obligations are excused because its opponent failed to give valid consideration. See, e.g., White v. Vill. of Homewood, 256 Ill. App. 3d 354, 357, 628 N.E.2d 616, 618 (1st Dist. 1993) (citations omitted) (“The pre-existing duty rule provides that where a party does what it is already legally obligated to do, there is no consideration as there is no detriment. For example, where a guest was by statute entitled to use a hotel safe to store valuables, a promise by the guest to limit the liability of the hotel in exchange for using the safe is not supported by consideration because of the pre-existing duty rule.“). There is, however, Illinois case law suggesting that a preexisting duty means that a contractual promise to carry out that duty may not be challenged as a breach of contract. See, e.g., Marque Medicos Fullerton, LLC v. Zurich Am. Ins. Co., 2017 IL App (1st) 160756, ¶ 67, 83 N.E.3d 1027, 1044 (1st Dist. 2017) (citation omitted) (“Plaintiffs’ own complaints therefore concede that defendants’ purported consideration for any asserted implied-in-fact contracts was to be performed pursuant to preexisting legal duties. Because valid consideration, on the part of both parties, is one of the essential requirements for the formation of a contract, and because consideration cannot flow from an act performed pursuant to preexisting legal duty, the circuit court properly dismissed plaintiffs’ claims that that defendants breached an implied-in-fact contracts to comply with the interest provision of section 8.2(d)(3) of the Act.“).
Regardless, the court agrees with Mr. Dinerstein that there was consideration for this contract because the contract requires the University to meet a higher standard than simply meeting its preexisting duty to comply with the law. (Pl.‘s
The cases the University cites are distinguishable. In re Banner Health Data Breach Litig., No. CV-16-02696-PHX-SRB, 2017 WL 6763548, at *4 (D. Ariz. Dec. 20, 2017), held that a contract lacked consideration because the defendant‘s privacy notice “cannot be read as a promise to do anything above and beyond what is already required by law.” Here, in contrast, the NPP‘s provision mandating that the University obtain written permission before selling Plaintiff‘s PHI did not merely restate HIPAA‘s requirements. For the same reason, another opinion the University cites, in which the privacy notice merely “inform[ed] patients of their rights under federal law” and thus was “not contractual in nature,” is distinguishable as well. Brush, 238 F. Supp. 3d at 1367.
The University‘s other arguments are also unpersuasive. Citing Brush, 238 F. Supp 3d at 1367, the University insists that even if had made “extra-statutory promises,” the pre-existing duty rule would still bar a contract claim based on noncompliance with HIPAA. (Univ. Reply Mem. in Supp. of Mot. to Dismiss at 8.) But Brush says no such thing; there, the court held that the contract lacked consideration and did not consider whether the plaintiff could pursue a contract claim if the privacy notice had included extra-statutory promises. The University is correct that other parts of the parties’ agreement, such as the “all efforts” clause, may not be enough to find valid consideration. Yet it is incorrect that the NPP‘s representation that it would obtain written authorization before selling Plaintiff‘s PHI merely arises under HIPAA, as already explained.
Because at least part of the University‘s promises to Plaintiff went beyond its obligations under federal law, the Authorization, which incorporated the NPP, was supported by valid consideration.
3. Damages
As discussed above the court has concluded that Plaintiff‘s allegations state a claim for breach of a contract that was supported by consideration. Has he plausibly alleged that this breach caused him damages? In the amended complaint, Plaintiff alleges that he has suffered non-economic damages, such as anxiety and emotional distress. (AC ¶ 136.) His response to Defendants’ motions does not characterize these harms as part of his contract damages, however. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 19–21). As the University notes, Illinois does not recognize emotional distress damages for breaches of contract, “except where the breach was wanton or reckless and caused bodily harm, or where defendant had reason to know, when the contract was made,
As for money damages, the Authorization contained the following provision in which Plaintiff disclaimed the right to receive compensation from the University‘s research: “I acknowledge that such research by the University of Chicago Medical Center may have commercial value and, in that event, I understand that I will not be entitled to any compensation, regardless of the value of such research or any products or inventions developed therefrom.” (Outpatient Agreement & Authorization § III.) The University argues that this provision bars his claim for economics damages. (Univ. Mem. in Supp. of Mot. to Dismiss at 12.)
Plaintiff responds that the University cannot take advantage of that provision because Illinois courts have said that “[a] party who materially breaches a contract cannot take advantage of the terms of the contract that benefit him.” James v. Lifeline Mobile Medics, 341 Ill. App. 3d 451, 455, 792 N.E.2d 461, 464 (4th Dist. 2003). For its part, the University argues that Plaintiff has not pleaded that the University‘s breach was a material one. See InsureOne Indep. Ins. Agency, LLC v. Hallberg, 2012 IL App (1st) 092385, ¶ 43, 976 N.E.2d 1014, 1027 (1st Dist. 2012) (citation omitted) (quoting Vill. of Fox Lake v. Aetna Cas. & Sur. Co., 178 Ill. App. 3d 887, 900–01, 534 N.E.2d 133 (2d Dist. 1989)) (“The test of whether a breach is ‘material’ is whether it is ‘so substantial and fundamental as to defeat the objects of the parties in making the agreement, or whether the failure to perform renders performance of the rest of the contract different in substance from the original agreement.’ ‘The breach must be so material and important to justify the injured party in regarding the whole transaction at an end.‘“) The University may be right that its exchange of Plaintiff‘s PHI for Trained Models and Predictions for internal non-commercial research purposes was not a material breach and that it substantially performed its contract with Plaintiff. Nevertheless, according to Illinois law, “[t]he determination of what constitutes a material breach is a question of fact which involves a fairly detailed inquiry, which should be left for the trial.” Enter. Warehousing Sols., Inc. v. Capital One Servs., Inc., No. 01 C 7725, 2002 WL 406976, at *3 (N.D. Ill. Mar. 15, 2002).
For pleading purposes, the court will therefore assume Plaintiff has alleged a material breach on the part of the University. The court concludes the claim nevertheless fails for another reason: none of his theories for money damages is adequate. He asserts that he is entitled to “restitution on the basis that he did not receive the full benefits of his payments to the University.” (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 20.) At most, this allegation suggests that some indeterminate amount of the price he paid for his treatments represents the cost of the University‘s privacy practices. This court agrees with others that have found such allegations to be insufficient. See Attias v. CareFirst, Inc., 365 F. Supp. 3d 1, 13 (D.D.C. 2019) (citations and quotation marks omitted) (rejecting the plaintiffs’ theory that they had been denied the benefit of their bargain by “broadly alleg[ing] that some indeterminate amount of their health insurance premiums went towards providing data security” and “alleg[ing]
Alternatively, Mr. Dinerstein claims that the University owes him a reasonable royalty for the use of his PHI. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 21.) For the reasons discussed in its standing analysis, the court disagrees. A royalty is normally appropriate only for interference with a property right. See, e.g., RESTATEMENT (THIRD) OF RESTITUTION AND UNJUST ENRICHMENT § 42 cmt. f (AM. LAW INST. 2011) (emphasis added) (“In the context of intellectual property, what is ‘taken’ is often an unauthorized use; the value of the use may often be determined—depending on the nature of the property—by a reasonable royalty or by the market price of a license.“). And Plaintiff has not plausibly alleged that he has any such right in his PHI. See Remijas, 794 F.3d at 695 (rejecting the plaintiffs’ argument that federal law recognizes a property right in their private information). That is why his reliance on Vojdani, 741 F.3d at 784–86, a Seventh Circuit case applying Wisconsin law, is misplaced. In that case, the court suggested that a reasonable royalty could be a remedy for the breach of a confidentiality agreement. Id. at 786. But Vojdani concerned intellectual property, unlike this case. Furthermore, in Vojdani, the stolen confidential information had been “used by the defendant for its own commercial purposes,” id., while the University received only a license to use Trained Models and Predictions for internal non-commercial research purposes. Finally, Plaintiff has not cited, nor did the court find, any Illinois cases in which a reasonable royalty was awarded or considered an appropriate remedy for breach of contract. Cf. Innovation Ventures, LLC v. Custom Nutrition Labs., LLC, 912 F.3d 316, 346 (6th Cir. 2018) (“[The plaintiff] does not, however, cite any Michigan cases, federal cases applying Michigan law, or even secondary sources that contemplate using a reasonable royalty to calculate damages in breach of contract cases.“). And the only state statute authorizing the award of a reasonable royalty is the Illinois Trade Secrets Act,
Plaintiff has not adequately pleaded that the University‘s breach of contract caused him economic damages. His theories in support of his claim for money damages are inadequate. Because Mr. Dinerstein has not pleaded that the University‘s breach caused him economic damage, his express contract claim (Count II) is dismissed for failure to state a claim for relief.
B. Implied Contract Claim
As an alternative to his express breach of contract claim, Mr. Dinerstein
C. Tortious Interference Claim
“To state a claim for tortious interference with contract, [Plaintiff] must allege enough facts to establish: ‘(1) a valid contract, (2) defendant‘s knowledge of the contract, (3) defendant‘s intentional and unjustified inducement of a breach of contract, (4) a subsequent breach of contract caused by defendant‘s wrongful conduct, and (5) damages.‘” Gen. Elec. Co. v. Uptake Techs., Inc., 394 F. Supp. 3d 815, 834 (N.D. Ill. 2019) (quoting Webb v. Frawley, 906 F.3d 569, 577 (7th Cir. 2018)). The parties have not addressed the question whether Plaintiff may pursue this claim absent an adequate claim for damages for breach of contract. But the court need not address the issue, as it concludes he has not sufficiently pleaded that Google engaged in the intentional conduct needed to state a tortious interference claim.
“A necessary prerequisite to the maintenance of an action for tortious interference with contract is a defendant‘s intentional and unjustified inducement of a breach of contract.” Illinois Bell Tel. Co. v. Plote, Inc., 334 Ill. App. 3d 796, 806, 778 N.E.2d 1203, 1211 (1st Dist. 2002) (quoting Strosberg v. Brauvin Realty Servs., Inc., 295 Ill. App. 3d 17, 33, 691 N.E.2d 834, 845 (1st Dist. 1998)). That is, Plaintiff must plead that Google ”intentionally caused” the University to breach its contract or that Google ”intended to cause [Plaintiff] harm.” Id. (emphasis in original). He has not done so. Instead, Mr. Dinerstein merely states that “Google intentionally and without justification interfered with the University‘s contracts with its patients.” (AC ¶ 157.) Such “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Nor is Plaintiff‘s allegation that Google had “actual or constructive knowledge
Plaintiff does not respond to these issues in his brief. In a footnote, he argues only that his tortious interference claim does not require pleading wrongful or malicious intent. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 11 n.4.) That is true, but it does not obviate the need to plead intent at all. See Illinois Bell Tel., 334 Ill. App. 3d at 806, 778 N.E.2d at 1211 (citation omitted) (while a plaintiff “does not need to prove that the defendant‘s conduct was malicious or unjustified unless that defendant‘s conduct was privileged,” the plaintiff is still “required to plead that [the defendant] acted intentionally“). “The essential thing is the purpose to cause the result.” RESTATEMENT (FIRST) OF TORTS § 766 cmt. d (AM. LAW INST. 1939). Because Plaintiff has not pleaded that Google acted with such a purpose, this claim (Count IV) is dismissed.
D. Intrusion upon Seclusion / Breach of Confidentiality
Next, Plaintiff asserts a common law claim for intrusion upon seclusion against both Defendants because of the University‘s disclosure and Google‘s receipt of his PHI. (AC ¶¶ 161–64.) The Illinois Supreme Court has explained that “the core of this tort is the offensive prying into the private domain of another” and that “[t]he basis of the tort is not publication or publicity.” Lovgren v. Citizens First Nat. Bank of Princeton, 126 Ill. 2d 411, 417, 534 N.E.2d 987, 989 (1989). Examples of such “offensive prying” are “invading someone‘s home; an illegal search of someone‘s shopping bag in a store; eavesdropping by wiretapping; peering into the windows of a private home; and persistent and unwanted telephone calls.” Id. The “intrusion” that Plaintiff alleges took place here is unlike these examples. In fact, a court in this district has held that such disclosures of private personal information “do[ ] not support a claim for unauthorized intrusion.” In re Trans Union Corp. Privacy Litig., 326 F. Supp. 2d 893, 902 (N.D. Ill. 2004).
Likely recognizing that this case law forecloses his ability to pursue this claim, Mr. Dinerstein abandons his intrusion-upon-seclusion theory in his brief and tries to reframe it as a breach-of-confidentiality tort. (Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 24.) There is a consensus among many state courts, he argues, that a common law cause of action for breach of confidentiality exists for the unauthorized disclosure of a patient‘s medical information. (Id.) In fact, a number of state courts have recognized such a tort. See, e.g., Lawson v. Halpern-Reiss, 212 A.3d 1213, 1217–18 (Vt. 2019); Byrne v. Avery Ctr. for Obstetrics & Gynecology, P.C., 175 A.3d 1, 15 (Conn. 2018). Illinois courts have not, as Plaintiff acknowledges. He instead invites this court to recognize such a cause of action, but the court declines the invitation.
Courts sitting in diversity and facing an unsettled state law question are tasked with predicting how the Illinois Supreme Court would decide the issue. Cmty. Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803, 811 (7th Cir. 2018) (citing Erie R.R. Co. v. Tompkins, 304 U.S. 64 (1938)). Yet the Seventh Circuit “consistently ha[s] held
E. Unjust Enrichment
Finally, Plaintiff‘s unjust enrichment claims are dismissed as well. “Unjust enrichment is not a separate cause of action under Illinois law.” Horist v. Sudler & Co., 941 F.3d 274, 281 (7th Cir. 2019). “[I]f an unjust enrichment claim rests on the same improper conduct alleged in another claim, then the unjust enrichment claim will be tied to this related claim—and, of course, unjust enrichment will stand or fall with the related claim.” Cleary v. Philip Morris Inc., 656 F.3d 511, 517 (7th Cir. 2011). Plaintiff acknowledges that his unjust enrichment claims depend on the other theories he asserted against the University and Google. (See Pl.‘s Mem. in Opp‘n to Defs.’ Mots. to Dismiss at 10 n.3.) Because Plaintiff‘s other claims have been dismissed, so should his unjust enrichment claims. Counts VI and VII are dismissed.
CONCLUSION
For the reasons stated above, the court grants Defendant University‘s and Defendant Google‘s motions to dismiss [43, 45] Plaintiff Matt Dinerstein‘s amended class action complaint [42] pursuant to
ENTER:
REBECCA R. PALLMEYER
United States District Judge
Dated: September 4, 2020