In July 2013 burglаrs stole four desktop computers from one of Defendant Advocate Health and Hospitals Corporation’s administrative offices in Illinois. The computers contained unencrypted private data relating tо approximately four million Advocate patients. Six of the affected patients brought this putative class action alleging that Advocate did too little to safeguard their information.
The plaintiffs asserted claims fоr willful and negligent violations of the Fair Credit Reporting Act (the “Act” or “FCRA”), 15 U.S.C. § 1681, et seq., and state-law claims for negligence and invasion of privacy. The district court dismissed the FCRA claims for failure to state a claim; it also found that four of the plaintiffs lacked standing to sue. Then, having dismissed the federal claims, the court relinquished supplemental jurisdiction over the remaining state-law claims. See 28 U.S.C. § 1367(c)(3). The plaintiffs appeal the dismissal of their FCRA claims.
Before turning to the merits, wе briefly address the threshold issue of the’ standing to sue under Article III of the U.S. Constitution. The district court raised this issue sua sponte because it potentially affects our jurisdiction. See Rhodes v. Johnson,
The district court concluded that the four other plaintiffs, however, lacked standing because their injuries were too speculative: the thieves had stolen their information but had not yet misused it. Advocate claims that conclusion was correct; the plaintiffs say it was wrong. There is no need to resolve this dispute because “[wjhere at least one plaintiff hаs standing, jurisdiction is secure and the court will adjudicate the case whether the additional plaintiffs have standing or not.” Ezell v. City of Chicago,
Now to the merits. We review de novo a district court’s dismissal under Federal Rule of Civil Procedure 12(b)(6). Meade v. Moraine Valley Cmty. Coll,
The Act requires every “consumer reporting agency” tо “maintain reasonable procedures” to ensure that it does not “furnish[ ] ... consumer reports” to unauthorized third parties or for impermissible purposes. 15 U.S.C. § 1681e(a). The plaintiffs allege that Advocate did not maintain reasonable procedures and thereby exposed their private information to the thieves. They seek various forms of relief, including statutory damages, which the Act makes available for willful violations even without a showing of actual damages. See id. § 1681n(a); Killingsworth v. HSBC Bank Nev., N.A.,
But the plaintiffs must plausibly allege that the reasonable-procedures provision applies in the first place, which includes, for a start, properly pleading that Advocate is a “consumer reporting agency.” The Act defines that term, in relevant part, to mean:
any person which, [1] for monetary fees, dues, or on a cooperative nonprofit basis, [2] regularly engages in whole or in part in the practiсe of assembling or evaluating consumer credit information or other information on consumers [3] for the purpose of furnishing consumer reports to third parties....
15 U.S.C. § 1681a(f) (numbering added). The complaint alleges that “Advocate is a Consumer Reporting Agency” because it “assembles] information on consumers” on a “cooperative nonprofit basis and/or for
The complaint’s other, more detailed allegations fall short too. The plaintiffs do successfully plead the seсond prong of the statutory .definition: the complaint states that Advocate regularly assembles its patients’ personal and medical information— including, e.g., names, dates of birth, social security numbers, medical diagnoses, and health insurance information.
But the complaint does not satisfy the definition’s first prong because Advocate does not assemble this information “for monetary fees.” 15 U.S.C. § 1681a(f) (emphasis added). The complaint does allege that Advocatе transmits patient information to insurance companies and government agencies (such as Medicare, presumably) in order to get paid. But the payments Advocate • receives are — in the complaint’s own words — “for health care services that its physicians have rendered” (emphasis added). Advocate is not getting paid for assembling patient information. After all, that is not its business. Advocate is, as the complaint acknowledges, a “network of affiliated doctors and hospitals that treat patients” — not a credit or consumer reporting company.
The complaint alleges that Advocate’s patient information serves other purposes as well. The insurance companies and government agencies allegedly usé it to determine eligibility and pricing for health services and to set rates for a variety of insurance products. But, again, none of that shows that Advocate receivеs fees in exchange for compiling and transmitting patient information.
The plaintiffs’ allegations also fail the third prong of the statutory definition. To qualify as a “consumer reporting agency,” Advocate must assemble consumer information “for the purpose of furnishing consumer reports to third parties.” 15 U.S.C. § 1681a(f) (emphasis added). A consumer report includes any communication “bearing on a consumer’s credit worthiness” which is used to establish the consumer’s eligibility for credit, insurance, or othеr listed purposes. Id. § 1681a(d)(l). But the Act expressly excludes from this definition any “report containing information solely as to transactions or experiences between the consumer and the person making the report.” Id. § 1681a(d)(2)(A)(i).
Advоcate does not meet this definition. The information it transmits to insurers is obviously sent to third parties, and it arguably is used to determine eligibility for insurance coverage. But the information concerns Advocate’s experiences with its own patients, including, e.g., personally identifying information, medical diagnoses, and the names of treating physicians. It thus falls within the exclusion. See DiGianni v. Stern’s,
We have found the Act inapplicable in analogous circumstances. In Frederick v. Marquette National Bank, for examрle, the plaintiff contracted to buy a condominium from Marquette National Bank. Marquette asked Frederick for permission to obtain her credit report; when she refused, Marquette ordered it anyway.
We reiterated the point in a different context in Mirfasihi v. Fleet Mortgage Corporation,
Similarly, the Second Circuit concluded in DiGianni that the term “consumer reporting agency” did not include retail department stores that merely received and transmitted information about their own customers.
Nevertheless, the plaintiffs take another shot at fitting Advocatе within the definition of “consumer reporting agency.” In an effort to meet the first prong of the definition, they claim that Advocate assembles and shares its patients’ data “on a cooperative nonprofit basis,” even if not for fees. 15 U.S.C. § 1681a(f) (emphasis added). Speсifically, the complaint alleges that “Advocate, through Advocate Physician Partners, collects, manages, and shares a multitude of patient information ... in a variety of ways.” It then lists several examples: programs tо improve health care quality and efficiency; a Medicare savings program; a “shared savings contract with its biggest commercial insurance partner”; and the hiring of “outpatient care managers.”
Moreover, the allegаtions do not meet the definition’s third prong. Using information internally does not count as “furnishing ... to third parties.” 15 U.S.C. § 1681a(f).' And there is no claim that Advocate shares the information so that the recipient can make determinations of credit or insurance eligibility. In other words, Advocate is not providing “consumer reports.” See id. § 1681a(d)(l).
For these reasons, we conclude that the plaintiffs did not plausibly allege that Advocate is a consumer reporting agency.
Our conclusion does not confine the Act’s reach to the nation’s three major credit bureаus, as the plaintiffs suggest. Other entities outside that mold may act in ways that satisfy the statutory definition of “consumer reporting agency.” See, e.g., Adams v. Nat’l Eng’g Serv. Corp.,
We need not address Advocate’s other statutory defense — that it did not “furnish” any information to the' thieves. Nor dо we need to decide whether the plaintiffs sufficiently pled their claims for willful and negligent FCRA violations under 15 U.S.C. §§ 1681n and 1681o.
The judgment of the district court is AFFIRMED.
Notes
. Section § 1681s-2 does place certain obligations on those who furnish information to consumer reporting agеncies. But the plaintiffs do not allege that Advocate violated those obligations.
. The complaint cites a description of these programs available at http://www. advocatehealth.com/documents/app/2013 ValueReport-Complete.pdf (last visited Aug. 6, 2015).