DOE v. HENRY FORD HEALTH SYSTEM
Docket Nos. 317973 and 317975
Court of Appeals of Michigan
Submitted December 9, 2014. Decided December 18, 2014.
308 MICH APP 592
Leave to appeal sought.
Jane Doe brought a class action in the Wayne Circuit Court against Henry Ford Health System and two of its medical transcription providers, Perry Johnson and Associates, Inc., and C Tech LLC, after her medical records and those of others were inadvertently made available on the Internet. The complaint alleged negligence, invasion of privacy by public disclosure of private facts, and breach of contract in connection with separate breaches by Perry Johnson and C Tech. Although the complaint sought all damages suffered by Doe and those similarly situated, during discovery, Doe acknowledged that she was seeking only the damages that could be presumed from the invasion of her privacy and the cost of a credit-monitoring service to protect her from identity theft. The court, David J. Allen, J., certified a class of 320 plaintiffs under
The Court of Appeals held:
1. The trial court erred by denying defendants’ motion for summary disposition of plaintiffs’ claim for invasion of privacy. Invasion of privacy is an intentional tort, and the undisputed facts indicated that plaintiffs’ medical information was disclosed unintentionally.
2. The trial court erred by denying defendants’ motion fоr summary disposition of plaintiffs’ remaining claims because Doe did not identify any cognizable damages from the disclosure of her medical information. Doe had no evidence that her information was viewed by anyone or used for an improper purpose. Accordingly, the costs of having her credit monitored were incurred in anticipation of a possible future injury and did not constitute the actual present injury required to recover in a negligence action. Similarly, the costs of the credit-monitoring services related to damages that were speculative and derived from a possible future harm that might not occur, and therefore they could not form the basis of a breach-of-contract action. Contrary to Doe‘s argument, a court will not presume the existence of damages for an invasion of privacy to establish damages for purposes of estаblishing a claim for negligence or breach of contract.
3. The trial court abused its discretion by certifying the class because Doe had no individual claims to pursue against the defendants and was therefore not a member of the class she sought to certify. For this reason, plaintiff‘s assertion on cross-appeal that the class size should have been larger was without merit.
Reversed and remanded for summary disposition in favor of defendаnts.
1. TORTS - INVASION OF PRIVACY - PUBLIC DISCLOSURE OF PRIVATE FACTS - NEGLIGENT DISCLOSURE.
A plaintiff who seeks to maintain a cause of action for invasion of privacy through the public disclosure of private facts must establish that the disclosure was intentional.
2. DAMAGES - NEGLIGENCE - BREACH OF CONTRACT - PUBLIC DISCLOSURE OF PRIVATE FACTS - CREDIT-MONITORING SERVICES.
The costs of engaging a credit-monitoring service after one‘s private information has been publicly disclosed are not themselves damages on which an action for negligence or breach of contract can be based.
3. DAMAGES - NEGLIGENCE - BREACH OF CONTRACT - PUBLIC DISCLOSURE OF PRIVATE FACTS.
A court will not presume the existence of damages in a claim for negligence or breach of contract based on an invasion of privacy through the public disclosure of private facts.
Straub, Seaman & Allen, PC (by Joseph R. Enslen and Nicholas V. Dondzila), and Pilchak Cohen & Tice PC (by Daniel G. Cohen) for Perry Johnson and Associates.
Kitch Drutchas Wagner Valitutti & Sherbrook (by Christina A. Ginter and John M. Sier) for Henry Ford Health System.
Before: MURRAY, P.J., and SAAD and HOEKSTRA, JJ.
PER CURIAM. The present consolidated cases involve a class action concerning allegations of negligence, breach of contract, and invasion of privacy. Defendants Perry Johnson and
Plaintiff and the other members of the certified class are a group of 159 patients who had doctor‘s visits at Henry Ford between June 3 and July 18, 2008. Perry Johnson provides transcription services involving patient records for Henry Ford, and the present case arises from an error by Perry Johnson‘s subcontractor, Vingspan, that led to the availability of patient records on the Internet. Specifically, Vingspan mаde a configuration change to their server that left certain patient records “unprotected.” As a result, “Googlebot,” Google‘s automated web crawler, indexed the information, thereby making it possible to find patient information through Google‘s search engine. The information made
accessible included the patient‘s name, medical record number, the date of the patient‘s visit, the location of the visit, the physician‘s name, and a summary of the visit. In plaintiff‘s particular case, this information included diagnoses of “Cervical dysplasia secondary to HPV (Human Papillomavirus)“—a sexually transmitted disease—and alopecia, i.e., baldness.
After Henry Ford learned of the problem, all information was made inaccessible on the Internet, the affected patients were notified, and steps were taken to more adequately protect patient information. Notably, there is no indication in the lower court record that the information in question was viewed by a third party on the Internet2 or that it was used inappropriately. Henry Ford established a “hotline” following the incident and received no report, through the hotline or otherwise, that patient information had been viewed online or used for identity-theft purposes. Plaintiff likewise conceded at her deposition that she had no indication thаt anyone saw, or used, any of her information that had been made visible on the Internet.
Following Henry Ford‘s notification to the patients, plaintiff filed the current lawsuit and sought class certification. Her suit includes three claims: (1) negligence, (2) invasion of privacy in the form of public disclosure of private facts, and (3) breach of contract under the theory that she was a third-party beneficiary of Henry Ford‘s agreement with Perry Johnson. Plaintiff‘s complaint sought “all damages” suffered by her and those similarly situated. When asked during discovery particularly what harm she had suffered and damages she intended to pursue, plaintiff advanced a theory
of “presumed damages” and generally indicated that she and the others were “entitled to compensation as a result of the Defendant‘s invasion of their common interest in privacy.” However, the only actual losses she identified were those incurrеd for the procurement of monitoring to guard against identity theft. In total, plaintiff‘s attorney paid $275 to a company
Over objections from Perry Johnson and Henry Ford, the trial court granted class certification. Initially the class consisted of 320 individuals, but the trial court later reduced that number to the 159 members mentioned earlier.3 Both Perry Johnson and Henry Ford moved for summary disposition, and the trial court denied those motions. Henry Ford and Perry Johnson now both appeal by leave granted the denial of their respective motions for summary disposition. Also, plaintiff filed a cross-appeal, contesting the trial court‘s reduction of the class from 320 individuals to 159.
Appellate review of a motion for summary disposition is de novo. Spiek v Dep‘t of Transp, 456 Mich 331, 337; 572 NW2d 201 (1998). A motion for summary disposition under
exists to warrant a trial. Id. This Court considers the pleadings, affidavits, depositions, admissions and other evidence submitted by the parties in a light most favorable to the nonmoving party. Maiden v Rozwood, 461 Mich 109, 120; 597 NW2d 817 (1999);
When reviewing a trial court‘s certification of a class, we review the trial court‘s findings of fact for clear error and its discretionary decisions for an abuse of discretion. Duncan v Michigan, 300 Mich App 176, 185; 832 NW2d 761 (2013). The interpretation and application of a court rule involves questions of law that this Court reviews de novo. Id.
On appeal, we first consider whether a material question of fact remains in regard to plaintiff‘s claim for invasion of privacy in the form of public disclosure of private facts. Among other arguments regarding this claim, we are asked to address whether it must be dismissed because invasion of privacy is an intentional tort and it is undisputed that the information in question became accessible on the Internet through negligence. Plaintiff, in contrast, maintains that invasion of privacy may be established without regard for whether the disclosure of information was intentional.
In basic terms, to prove invasion of privacy through the public disclosure of private facts, a plaintiff must show “(1) the disclosure of information (2) that is highly offensive to a reasonable person and (3) that is of no legitimate concern to the public.” Doe v Mills, 212 Mich App 73, 80; 536 NW2d 824 (1995). The information revealed must relate to the individual‘s private as
opposed to public life. Lansing Ass‘n of Sch Adm‘rs v Lansing Sch Dist Bd of Ed, 216 Mich App 79, 89; 549 NW2d 15 (1996). “Liability will not be imposed for giving publicity to matters that are already of public record or otherwise
We are not aware of a Michigan case that overtly considered whether the disclosure of private information to the public must have been done intentionally, but our review оf Michigan caselaw leads us to conclude that it is in fact an intentional tort. Specifically, we find it notable that the public disclosure of private facts has been discussed by the Michigan Supreme Court as an intentional tort. See, e.g., Smith v Calvary Christian Church, 462 Mich 679, 680, 688-689; 614 NW2d 590 (2000). Further, we are not aware of—nor has plaintiff presented us with—any Michigan case in which an action alleging invasion of privacy proceeded on the basis of negligent disclosure. The conduct involved has instead been the intentional disclosure of private facts. See, e.g., id. (considering a pastor‘s announcement of a parishioner‘s sins during church services); Doe, 212 Mich App at 77 (involving protestors’ display of signs informing public about specific women‘s intentions to undergo abortions); Winstead v Sweeney, 205 Mich App 664, 673; 517 NW2d 874 (1994) (discussing publication of a newspaper article detailing facts about the plaintiff‘s sex life). Given that no Michigan authority discusses a cause of action for invasion of рrivacy premised on negligent conduct, the logical conclusion is that such
a cause of action does not exist in Michigan. Cf. Price v High Pointe Oil Co, Inc, 493 Mich 238, 250; 828 NW2d 660 (2013) (concluding that noneconomic damages for negligent destruction of property not available in Michigan when such damages had never before been contemplated in Michigan‘s caselaw). Consequently, we conclude that to establish an invasion of privacy through the disclosure of private facts, a plaintiff must show that the disclosure of those facts was intentional.4 Because the undisputed facts in this case indicate nothing more than a negligent disclosure of private information, no material question of fact remains and summary disposition should have been granted regarding plaintiff‘s invasion-of-privacy claim.
Regarding plaintiff‘s claims for negligence and breach of contract, on appeal, the parties dispute the availability of damages to compensate fоr the procurement of identity-theft protection. Henry Ford and Perry Johnson both contend that, in the absence of evidence of present injury to plaintiff‘s person or property, such damages are not recoverable in negligence, breach of contract, or invasion of privacy.5 Plaintiff, in contrast, maintains that the
may recover costs associated with LifeLoсk‘s services. For the reasons described below, we agree with Henry Ford and Perry Johnson, and we hold that plaintiff‘s identity-theft-protection services are not cognizable damages in the absence of a present injury.
Specifically, in the negligence context, in order to establish a claim for negligence, plaintiffs must prove: “(1) that defendant owed them a duty of care, (2) that defendant breached that duty, (3) that plaintiffs were injured, and (4) that defendant‘s breach caused plaintiffs’ injuries.” Henry v Dow Chem Co, 473 Mich 63, 71-72; 701 NW2d 684 (2005). Stated differently, in a negligence action, plaintiffs must show “duty, breach of that duty, causation, and damages.” Id. at 72 (quotation marks omitted). Underlying these four elements is the issue of injury, and it is well settled that, in Michigan, the injury complained of in a negligence action must be an actual, present injury. Id. at 74-76. “It is a present injury, not fear of an injury in the future, that gives rise to a cause of action under negligence theory.” Id. at 73. Consеquently, damages “incurred in anticipation of possible future injury rather than in response to present injuries” are not cognizable under Michigan law. Id. Thus, for example, in Henry, the Court determined that the plaintiffs, individuals living and working in the Tittabawassee floodplain, could not pursue damages for medical monitoring services when there was no indication, as of yet, that anyone had been harmed by the release of dioxin into the floodplain. Id. at 68-70.
Analogously, in this case, plaintiff hаs not shown that the costs for the credit-monitoring services relate to a present, actual injury. She has in fact conceded that she has no evidence that her information was viewed by anyone on the Internet or used for an improper purpose
such as identity theft. Absent some such indication of present injury to her credit or identity, it is clear that these damages for credit monitoring were incurred in anticipation of possible future injury. See id. at 73. Because “these economic losses are wholly derivative of a possible, future injury rather than an actual, present injury,” id. at 78, the costs of these credit-monitoring services are not cognizable under Michigan‘s negligence law.6
Similarly, in regard to breach of contract, a party claiming a breach must establish (1) that there was a contract, (2) that the other party breached the contract, and (3) that the party asserting breach of contract suffered damages as a result of the breach. Dunn v Bennett, 303 Mich App 767, 774; 846 NW2d 75 (2013). The measure of damages in relation to a breach of contract is “‘the pecuniary value of the benefits the aggrieved party would have received if the contract had not been
667 NW2d 379 (2003). Thus, in contrast, the damages “must not be conjectural or speculative in their nature, or dependent upon the chances of business or other contingencies....” McEwen v McKinnon, 48 Mich 106, 108; 11 NW 828 (1882). See also Body Rustproofing, Inc v Mich Bell Tel Co, 149 Mich App 385, 390; 385 NW2d 797 (1986).
In this case, assuming arguendo that plaintiff could seek damages for breach of the contract in question, plaintiff‘s claim for credit-monitoring services are speculative insofar as they dо not arise from the purported breach of contract but depend entirely on the occurrence of multiple contingencies which might or might not occur at some point in the future. That is, the alleged breach has not caused plaintiff to suffer an injury to her identity or credit. Rather, any injury is entirely contingent on the hypothetical possibility that some unknown person viewed the information and at some unknown time in the future might make use of it for nefаrious purposes. Because her speculative damages derive from a possible future harm that might or might not occur, rather than directly from the breach of contract, plaintiff may not recover under contract law for the cost of credit-monitoring services. See McEwen, 48 Mich at 108. See also Hendricks v DSW Shoe Warehouse, Inc, 444 F Supp 2d 775, 780 (WD Mich, 2006).
In regard to both negligence and breach of contract, plaintiff offers the assertion on appeal that, because she has suffered an invasion оf privacy, injury is presumed and she may therefore recover “presumed” damages. Plaintiff‘s assertion is entirely unsupported given that plaintiff is required to prove “all” damages in a negligence action, Adams v Cleveland-Cliffs Iron Co, 237 Mich App 51, 72; 602 NW2d 215 (1999), and to demon-
strate the existence of an actual, present injury, Henry, 473 Mich at 74-76. In short, setting aside that plaintiff does not have a viable invasion of privacy claim, damages will not be presumed in a negligence action for an alleged invasion of privacy. Cf. Amburgy v Express Scripts, Inc, 671 F Supp 2d 1046, 1055 (ED Mo, 2009). Likewise, damages are not presumed in relation tо contracts, in which cases a plaintiff is instead required to prove the measure of damages with “reasonable certainty.” Alan Custom Homes, 256 Mich App at 512.
In sum, we will not presume damages from plaintiff‘s purported invasion of privacy, and plaintiff‘s claim for credit monitoring is not cognizable. Because plaintiff has failed to identify any other damages she wishes to pursue in relation to negligence or breach of contract,7 she has not
Having determined that plaintiff has no individual claims to pursue against either Henry Ford or Perry Johnson, we also conclude that the trial court‘s grant of clаss certification must be reversed. See
Reversed and remanded for entry of summary dispоsition for Henry Ford and Perry Johnson.
MURRAY, P.J., and SAAD and HOEKSTRA, JJ., concurred.