Source: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-almd-1_14-cv-00324/USCOURTS-almd-1_14-cv-00324-1/pdf.json

Nature of Suit Code: 480
Nature of Suit: Consumer Credit
Cause of Action: 15:1681 Fair Credit Reporting Act

---

IN THE UNITED STATES DISTRICT COURT

MIDDLE DISTRICT OF ALABAMA

SOUTHERN DIVISION

BRADLEY S. SMITH, )

JULIE S. MCGEE, )

ADAM PARKER, )

SANDRA W. HALL, and )

JACK WHITTLE, )

)

Plaintiffs, )

)

v. ) Case No. 1:14-cv-324-WKW-PWG

)

TRIAD OF ALABAMA, LLC, )

)

Defendant. )

REPORT AND RECOMMENDATION

This Fair Credit Reporting Act (“FCRA”) case arises from the theft of the

1

Plaintiffs’ personally identifiable information and personal health information

(“PII/PHI”) from Defendant Triad of Alabama LLC d/b/a Flowers Hospital

(“Defendant”) by an employee of Defendant and an unknown accomplice.

This putative class action is brought by Plaintiffs Bradley S. Smith (“Plaintiff

Smith”), Julie S. McGee (“Plaintiff McGee”), Adam Parker (“Plaintiff Parker”),

Sandra W. Hall (“Plaintiff Hall”), and Jack Whittle (“Plaintiff Whittle”) (collectively

“Plaintiffs”), individually and on behalf of all others similarly situated. There are six

 15 U.S.C. 1681 et seq. 1

1

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 1 of 35
counts set out in the Second Amended Complaint, which is the operative pleading.

(Doc. 25). There are two federal claims: willful violation of the FCRA (Count I) and

negligent violation of the FCRA (Count II). The remaining claims arise under

Alabama law and are as follows: negligence/wantonness (Count III); negligence per

se (Count IV); invasion of privacy by public disclosure of private facts (Count V);

and breach of express or implied contract (Second Count V ). 2

Before the court is Defendant’s motion to dismiss Plaintiffs’ Second Amended

Complaint (Doc. 26) and brief in support thereof (Doc. 27). 

I. JURISDICTION

Though contested by the Defendant on the basis of standing, subject matter

jurisdiction over Plaintiffs’ federal claims is conferred by 28 U.S.C. § 1331. The

court may exercise supplemental jurisdiction over Plaintiffs’ state law claims

pursuant to 28 U.S.C. § 1367. The parties do not dispute venue or personal

jurisdiction, and there are adequate allegations in Plaintiffs’ Second Amended

Complaint to support both. On November 25, 2014, this matter was referred to the

undersigned by Chief U.S. District Judge William Keith Watkins for disposition or

recommendation on all pretrial matters. (Doc. 31). See also 28 U.S.C. § 636(b); Rule

72, Fed. R. Civ. P.; United States v. Raddatz, 447 U.S. 667 (1980); Jeffrey S. v. State

 There are two counts identified in the Second Amended Complaint as “Count V.” 2

2

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 2 of 35
Board of Education of State of Georgia, 896 F.2d 507 (11th Cir. 1990). 

For the reasons stated herein, the Magistrate Judge RECOMMENDS that

Defendant’s motion to dismiss is due to be GRANTED in part and DENIED in part. 

II. BACKGROUND AND FACTS3

Defendant is a hospital and in the regular course of its business, collects and

maintains possession, custody, and control of personal and confidential information

of its patients, including names, addresses, dates of birth, Social Security numbers,

treating physician and/or departments for each patient, and each patient’s medical

diagnoses, record numbers, medicalservice codes, and health insurance information.

(Doc. 25 at ¶¶ 27, 28). 

Plaintiffs are all individuals who received some formof medical attention from

Defendant during the time period of June 2013 until approximately February 2014. 

(Doc. 25 at ¶¶ 2; 12-13; 15-16; 18-19; 21-22; 24-25). Plaintiffs Smith, McGee, Hall

and Whittle were treated at the Defendant Hospital. Plaintiff Parker was a patient at

another healthcare facility, but his lab work was forward to Defendant for analysis. 

(Doc. 25 at ¶¶ 12; 15; 18; 21; 24) ) 

During the course of their treatment during that time period, Plaintiffs supplied

 These are the facts for purposes of recommending a ruling on the pending motion to 3

dismiss. They are gleaned exclusively from the allegations in the Second Amended Complaint.

3

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 3 of 35
their PII/PHI to Defendant. (Doc. 25 at ¶¶ 13; 16; 19; 22; 25). Defendant stored

Plaintiffs’ PII/PHI in an unprotected, unguarded, unsecured room on Defendant’s

premises. The room had little or no security to prevent unauthorized access. (Doc. 25

at ¶¶ 29; 30). The Plaintiffs’ PII/PHI was not encrypted. (Doc. 25 at ¶ 29). 

During the relevant time period, an employee and/or his unknown accomplice

stole from the unsecured room an untold number of laboratory reports and/or files

containing Plaintiffs’ unencrypted PII/PHI. (Doc. 25 at ¶ 31). The employee has

been charged by the State of Alabama with trafficking in stolen identities. (Doc. 25

at ¶ 31). Plaintiffs have all since learned that their Social Security numbers were used

by unknown individuals to file in their respective namesfraudulent tax returns. (Doc.

25 at ¶¶ 12; 15; 18; 21; 24). 

Plaintiffs allege that as a result of Defendant’s failure to secure their PII/PHI,

they have incurred economic losses related to the theft of their Social Security

number and the filing of a fraudulent tax return in their respective names. (Doc. 25

at ¶¶ 14, 17, 20, 23, 26, 34). They also aver that they have incurred out-of-pocket

expenses related to mitigation of the increased risk of identity theft and/or identity

fraud. (Doc. 25 at ¶ 34). In addition, Plaintiffs allege they have suffered emotional

distress and anxiety. Id. 

Plaintiffs further allege that personal information is a commodity on the so4

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 4 of 35
called “cyber black market,” and that because their Social Security numbers have

been compromised, they face a significantly heightened risk of identity theft, identity

fraud, and medical fraud. They state that the risk of identity theft or fraud isimminent

and immediate. (Doc. 25 at ¶36; 40). Plaintiffs aver that because of the data breach,

they will be required to spend money and time mitigating its effects, and specifically

enumerate several activities that they will have to engage in to protect themselves

from future harm which they contend is imminent, including the following: placing

“freezes” and “alerts” with the credit reporting agencies, closing or modifying

financial accounts, scrutinizing their bank and credit accounts, and purchasing

products to monitor their credit reports and accounts for unauthorized activity. Id. 

Defendant has offered to Plaintiffs one year’s worth of credit monitoring. (Doc.

25 at ¶35). 

III. MOTION TO DISMISS STANDARDS OF REVIEW

Defendant’s motion to dismiss is brought pursuant to both Federal Rules of

Civil Procedure 12(b)(1) and 12(b)(6). 

1. 12(b)(1) motion to dismiss standard of review.

“Motions to dismiss on grounds of an ‘injury in fact’ implicate constitutional

standing principles and are therefore predicated upon Rule 12(b)(1) [...].” JWS

Samuel LLC v. Hillsborough County, Fla., 2012 WL 3291831 at fn. 2 (S. D. Fla. Aug.

5

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 5 of 35
13, 2012).

The Rule 12(b(1) standard of review was summarized in Greenwell v.

University of Alabama Bd. of Trustees, 2012 WL 3637768 (N. D. Ala. Aug. 22,

2012). The court explained:

Challenges to subject-matter jurisdiction under Rule 12(b)(1) of

the Federal Rules of Civil Procedure can exist in two substantially

different forms: facial attacks and factual attacks. Sinaltrainal v.

Coca–Cola Co., 578 F.3d 1252, 1260 (11th Cir. 2009). When presented

with a facial attack on the complaint, the court determines whether the

complaint has sufficiently alleged subject-matter jurisdiction.

Sinaltrainal, 578 F.3d at 1260. The court proceeds as if it were

evaluating a Rule 12(b)(6) motion; that is, it views the complaint in the

light most favorable to the plaintiff and accepts all well-pled facts

alleged in the complaint as true. Id.

On the other hand, factual attacks question “the existence of

subject matter jurisdiction in fact, irrespective of the pleadings, and

matters outside the pleadings, such as testimony and affidavits, are

considered.” Id. (citing Lawrence v. Dunbar, 919 F.2d 1525, 1529 (11th

Cir. 1990)). When a court is confronted with a factual attack, the

standard of review diverges considerably:

[T]he trial court may proceed as it never could under

12(b)(6) or Fed.R.Civ.P. 56. Because at issue in a factual

12(b)(1) motion is the trial court's jurisdiction—its very

power to hear the case—there is substantial authority that

the trial court is free to weigh the evidence and satisfy

itself as to the existence of its power to hear the case. In

short, no presumptive truthfulness attaches to plaintiff's

allegations, and the existence of disputed material facts

will not preclude the trial court from evaluating for itself

the merits of jurisdictional claims.

6

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 6 of 35
Lawrence, 919 F.2d at 1529 (citing Williamson v. Tucker, 645 F.2d 404,

412 (5th Cir.), cert. denied, 454 U.S. 897 (1981)). When a district court

has pending before it both a 12(b)(1) motion and a 12(b)(6) motion, the

generally preferable approach, if the 12(b)(1) motion essentially

challenges the existence of a federal cause of action, is for the court to

find jurisdiction and then decide the 12(b)(6) motion. Jones v. State of

Ga., 725 F .2d 622, 623 (11th Cir.1984).

Greenwell at *5. (alterations in original). 

Defendant’s motion to dismiss presents a facial attack because it is “based

4

solely on the allegations in the complaint.” FCCI Ins. Co. v. McLendon Enterprises,

Inc., 2013 WL 1898159 at *1 (S.D. Ga. May 7, 2013)(quoting Gibbs v. United States,

865 F. Supp. 2d 1127, 1135 (S.D. Fla. 2012)(in turn quoting Morrison v. Amway

Corp., 323 F.3d 920, 924 n. 5 (11th Cir. 2005). Thus, the factual allegations in

Plaintiffs’ complaint will be taken as true and construed in the light most favorable

to Plaintiffs. See JWS Samuel, supra, at *1. See also Carmichael v. Kellogg, Brown,

and Root Servs., Inc., 572 F.3d 1271, 1279 (11th Cir. 2009)(a Rule 12(b)(1) facial

 Defendant argues in its motion to dismiss that “Plaintiffs’ Second Amended Complaint 4

fails to allege facts that would establish that Plaintiffs have suffered an injury in fact that is fairly

traceable to the Hospital, [therefore] Plaintiffs lack standing to bring the claims they assert.”

(Doc. 26 at p. 1)(emphasis supplied). In its brief, it argues that “[t]he law requires certain

allegations to be pled in order for a civil lawsuit to be maintained against the Hospital in a case

such as this” and that the Second Amended Complaint “fails to make necessary allegations that

would allow this lawsuit to proceed.” (Doc. 27 at p. 2). Defendant, however, includes in its

standard of review section law relevant to factual attacks, which as explained above, trigger

consideration of information outside of the pleadings. (Doc. 27 at pp. 3-4). Such consideration of

outside materials is unwarranted in this case, and the factual allegations of the Second Amended

Complaint will be taken as true at this pleading stage. 

7

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 7 of 35
challenge applies a Rule 12(b)(6) perspective); Lawrence v. Dunbar, supra at 1528-

29 (a facial attack requires the court to accept plaintiff’s allegations as true and

determine if the complaintsufficiently alleges a basis for subject matter jurisdiction). 

2. 12(b)(6) motion to dismiss standard of review.

A Rule 12(b)(6) motion to dismiss tests the sufficiency of the Complaint

against the legal standard set forth in Rule 8: “a short and plain statement of the claim

showing that the pleader is entitled to relief.” Fed. R. Civ. P. 8(a)(2).

When evaluating a motion to dismiss pursuant to Rule 12(b)(6), the court must

take “the factual allegations in the complaint as true and construe them in the light

most favorable to the plaintiff.” Pielage v. McConnell, 516 F.3d 1282, 1284 (11th

Cir. 2008). However, “the tenet that a court must accept as true all of the allegations

contained in a complaint isinapplicable to legal conclusions.” Ashcroft v. Iqbal, 556

U.S. 662, 663 (2009). “[A] plaintiff’s obligation to provide the ‘grounds’ of his

‘entitle[ment] to relief’ requires more than labels and conclusions, and a formulaic

recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at

555.

“To survive a motion to dismiss, a complaint must contain sufficient factual

matter, accepted astrue, to ‘state a claim to relief that is plausible on its face.’” Iqbal,

556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). 

8

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 8 of 35
“Determining whether a complaint states a plausible claim for relief [is] ... a

context-specific task that requires the reviewing court to draw on its judicial

experience and common sense.” Id. at 663 (alteration in original) (citation omitted). 

“[F]acial plausibility” exists “when the plaintiff pleads factual content that allows the

court to draw the reasonable inference that the defendant is liable for the misconduct

alleged.” Id. (citing Twombly, 550 U.S. at 556). The standard also “calls for enough

facts to raise a reasonable expectation that discovery will reveal evidence” of the

claim. Twombly, 550 U.S. at 556. While the complaint need not set out “detailed

factual allegations,” it must provide sufficient factual amplification “to raise a right

to relief above the speculative level.” Id. at 555.

“So, when the allegations in a complaint, however true, could not raise a claim

of entitlement to relief, ‘this basic deficiency should ... be exposed at the point of

minimum expenditure of time and money by the parties and the court.’” Twombly,

550 U.S. 558 (quoting 5 Wight & Miller § 1216, at 233-34 (quoting in turn Daves v.

Hawaiian Dredging Co., 114 F.Supp. 643, 645 (D. Haw. 1953)) (alteration original). 

“[O]nly a complaint that states a plausible claim for relief survives a motion to

dismiss.” Iqbal, 556 U.S. at 679 (citing Twombly, 550 U.S. at 556).

In keeping with these principles a court considering a motion to dismiss

can choose to begin by identifying pleadings that, because they are no

more than conclusions, are not entitled to the assumption of truth. 

9

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 9 of 35
While legal conclusions can provide the framework of a complaint, they

must be supported by factual allegations. When there are well-pleaded

factual allegations, a court should assume their veracity and then

determine whether they plausibly give rise to an entitlement to relief.

Iqbal, 556 U.S. at 679.

IV. DISCUSSION

A. The Fair Credit Reporting Act (FCRA) claims. 

Congress enacted theFCRA“to require that consumer reporting agencies adopt

reasonable procedures for meeting the needs of commerce for consumer credit,

personnel, insurance, and other information in a manner which is fair and equitable

to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper

utilization of such information....” 15 U.S.C. § 1681(b)(2012). “To achieve its

purpose, the [FCRA] places distinct obligations on three types of entities: consumer

reporting agencies, users of consumer reports, and furnishers of information to

consumer reporting agencies.” Burton v. MAPCO Exp., Inc., 47 F. Supp. 3d 1279,

1286 (N. D. Ala 2014)(citing Chipka v. Bank of Am., 355 Fed. Appx. 380, 382 (11th

Cir. 2009)(citing 15 U.S.C. §§ 1681b, 1681m, and 1681s-2). 

Plaintiff alleges that Defendant is a consumer reporting agency as defined by

the FCRA and that it both willfully and/or recklessly (Count I) and negligently

(Count II) violated the FCRA by failing to adopt protective measuresto safeguard the

10

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 10 of 35
Plaintiffs’ PII/PHI. Defendant argues that both FCRA claims are due to be dismissed

because Plaintiff has not alleged the facts required for standing. Defendant does not

contest that it is a consumer reporting agency, and offers no substantive arguments 5

for dismissing the FCRA claims.6

i. Plaintiffs have alleged an actual injury sufficient to confer

Article III standing to assert willful and negligence based

FCRA claims. 

Jurisdiction must be present before this case can be adjudicated on the merits.

To fulfill the minimum requirement that there is a case or controversy under the

Constitution and that there exists standing to assert the claims, a plaintiff must show

that: “(1) it has suffered an ‘injury in fact’ that is (a) concrete and particularized and

(b) actual or imminent, not conjectural or hypothetical; (2) the injury is fairly

traceable to the challenged action of the defendant; and (3) it is likely, as opposed to

merely speculative, that the injury will be redressed by a favorable decision.” Friends

of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc., 528 U.S. 167, 180-81, 120 S.

Ct. 693, 704, 145 L. Ed. 2d 610 (2000). “At the pleading stage, general factual

 Defendant remarks in a footnote in its Supplemental Brief in Support of its Motion to 5

Dismiss (Doc. 33 at fn. 1) that it has “other defenses,” including one that it is not a credit

reporting agency, that it intends to raise at the summary judgment stage. 

 Defendant does not argue that the FCRA claims should be dismissed because it did not 6

violate the FCRA or because Plaintiff has failed to allege facts sufficient to demonstrate a

violation of the FCRA; rather, Defendants solely argue that the claims should be dismissed

because Plaintiffs lack standing. 

11

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 11 of 35
allegations of injury resulting from the defendant’s conduct may suffice” to show

standing, “for on a motion to dismiss [a court] presume[s] that general allegations

embrace those specific facts that are necessary to support the claim. Lujan v.

Defenders of Wildlife, 504 U.S. 555, 561, 112 S. Ct. 2130, 2137, 119 L. Ed. 2d 351

(1992)(internal citations omitted). 

The Eleventh Circuit addressed the issue of whether a victim of actual identity

theft resulting from a data breach has standing to assert a claim in Resnick v. AvMed,

Inc., 693 F.3d 1317 (11th Cir. 2012). In that case, plaintiffs alleged that laptops

7

were stolen fromdefendant health care plan operator’s corporate office and thereafter,

their identities were stolen. One plaintiff learned that his sensitive information was

used by an unknown third party to open an account with E*Trade Financial, which

was then overdrawn. The second plaintiff learned that her sensitive information was

used by an unknown third party to open credit accounts with Bank of America, and

that subsequently issued credit cards were used to make unauthorized purchases in

her name. The second plaintiff also learned that her home address had been changed

with the United States Postal Service. Resnick, supra, at 1322. 

The Eleventh Circuit, in analyzing the plaintiffs’ claims as an issue of first

 The Resnick case did not involve the FCRA. The data breach victims in that case 7

brought seven claims arising under Florida state law. This notwithstanding, the Eleventh

Circuit’s reasoning in the Resnick case is applicable herein. 

12

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 12 of 35
impression, held that plaintiffs had alleged an injury sufficient to confer standing:

Whether a party claiming actual identity theft resulting from a

data breach has standing to bring a suit is an issue of first impression in

this Circuit. Plaintiffs allege that they have become victims of identity

theft and have suffered monetary damages as a result. This constitutes

an injury in fact under the law. Via Mat. Int’l S. Am. Ltd. v. United

States, 446 F.3d 1258, 1263 (11th Cir. 2006)(finding economic harm

sufficient to create standing); see also Lambert v. Hartman, 517 F.3d

433, 437 (6th Cir. 2008). 

Resnick at 1323. The Resnick court did not, however, clarify whether it was the

existence of actual identity theft, or actual identity theft plus monetary damages, that

constituted the injury in fact. In any event, the Resnick court made clear that a victim

of actual identity theft who alleges monetary damages as a result has alleged an injury

in fact sufficient to meet the first prong of the standing analysis. 

The Resnick court then addressed whether the plaintiffs’ injury was “fairly

traceable” to the defendant’s actions. It explained as follows: 

A showing that an injury is fairly traceable requires less than a

showing of‘proximate cause,’Focus on the Family v. Pinellas Suncoast

Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003). Even a showing

that a plaintiff’s injury is indirectly caused by a defendant’s actions

satisfies the fairly traceable requirement. Plaintiffs allege that

[Defendant] failed to secure their information on company laptops, and

that those laptops were subsequently stolen. Despite Plaintiff’s personal

habits of securing their sensitive information, Plaintiffs became victims

of identity theft after the unencrypted laptops containing their sensitive

information were stolen. For purposes of standing, these allegations are

sufficient to ‘fairly trace’ their injury to [Defendant’s] failures.

13

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 13 of 35
Resnick at 1324. 

Finally, the Resnick court addressed whether plaintiffs had shown that a

favorable resolution of the case in their favor could redress their alleged injuries. The

court stated: “Plaintiffs allege a monetary injury and an award of compensatory

damages would redress that injury. Plaintiffs have alleged sufficient facts to confer

standin[g].” Id. at 1324. 

In the instant case, Defendant argues that Plaintiffs have failed to demonstrate

the existence of the three factors necessary for standing. Though they were given

careful consideration, Defendant’s arguments are ultimately unpersuasive. 

a. Plaintiffs have alleged an injury in fact. 

In their Second Amended Complaint, Plaintiffs allege that during the relevant

time period, an employee and/or his unknown accomplice stole from the unsecured

room an untold number of laboratory reports and/or files containing Plaintiffs’

unencrypted PII/PHI. (Doc. 25 at ¶ 31). Plaintiffs have all since learned that their

Social Security numbers were used by unknown individuals to file in their respective

names fraudulent tax returns. (Doc. 25 at ¶¶ 12; 15; 18; 21; 24). Plaintiffs further

allege that as a result of Defendant’s failure to secure their PII/PHI, they have

incurred economic losses/damagesrelated to the theft oftheir Social Security number

and the filing of a fraudulent tax return in their respective names. (Doc. 25 at ¶ 14).

14

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 14 of 35
They also aver that they have incurred out-of-pocket expenses related to mitigation

of the increased risk of identity theft and/or identity fraud. (Doc. 25 at ¶ 34). In

addition, Plaintiffs allege they have suffered emotional distress and anxiety. Id. 

Plaintiffs further allege that personal information is a commodity on the socalled “cyber black market,” and that because their Social Security numbers have

been compromised, they face a significantly heightened risk of identity theft, identity

fraud, and medical fraud. They state that the risk of identity theft or fraud isimminent

and immediate. (Doc. 25 at ¶ 36; 40). Plaintiffs aver that because of the data breach,

they will be required to spend money and time mitigating its effects, and specifically

enumerate several activities that they will have to engage in to protect themselves

from future harm which they contend is imminent, including the following: placing

“freezes” and “alerts” with the credit reporting agencies, closing or modifying

financial accounts, scrutinizing their bank and credit accounts, and purchasing

products to monitor their credit reports and accounts for unauthorized activity. Id. 

Defendant contendsthe above allegations fail to show an actual injury and that

Plaintiffs’ reliance “in part” on possible future injuries to substantiate their FCRA

claims isinsufficient for standing purposes. (Doc. 27 at pp. 6). Defendant admits that

Plaintiffs allege that their Social Security numbers were used to file fraudulent tax

returns in their names, but argues that because Plaintiffs have not alleged that the

15

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 15 of 35
filing of the fraudulent tax returns “resulted in any monetary loss,” they have failed

to plead facts sufficient to conclude that they have suffered an injury in fact.

Defendant also argues that in order to establish standing, Plaintiffs must allege that

their respective identities were “misused because of the breach and also that they

suffered some un-reimbursed or out of pocket expense.” (Doc. 27 at p. 7). 

Defendant relies on Resnick for its contention that a plaintiff must allege

economic damages in FCRA cases in order to have standing. As an initial matter,

Defendant stretches the Eleventh Circuit’s holding in Resnick beyond its limits. The

Eleventh Circuit’s holding with regard to the plaintiffs’ efforts to meet the injury in

fact requirement was notably succinct. It held: “Plaintiffs allege that they have

become victims of identity theft and have suffered monetary damages as a result. 

This constitutes an injury in fact under the law.” Resnick at 1323. The Eleventh

Circuit did not hold—as Defendant contends—that FCRA claims “requir[e] actual

economic damages in order to confer standing on an alleged identity theft victim.”

(Doc. 27 at p. 7). Moreover, this court does not read the Resnick court’s holding to

stand for such a blanket statement of law. 

8

 In light of its holding that the plaintiffs’ allegations of identity theft and economic 8

damage were sufficient to allege an injury in fact, the Eleventh Circuit did not address whether

allegations of damages of a non-economic nature would be sufficient for standing purposes. As

noted, supra, the Resnick court did not make clear whether it was the existence of actual identity

theft or the existence of identity theft and monetary damages that led the court to determine the

plaintiffs had standing. The Resnick court noted that several circuit courts had found that the

16

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 16 of 35
Defendant relies on Burton v. MAPCO Exp., Inc., 47 F. Supp. 3d 1279 (N. D.

Ala. 2014) for its contention that “in order for a consumer to have standing to pursue

claims resulting from a data breach, the consumer must not only allege his or her

identity was actually misused as a result of the breach, but the consumer must also

allege that he/she suffered some un-reimbursed or out-of-pocket expense.” (Doc. 27

at p. 7) . Defendant also stretches the holding in the Burton case past its intended

9

limits. This notwithstanding, even if the Burton decision explicitly espoused the

10

“threat of future identity theft is sufficient to confer standing in similar circumstances,” but

explained that because the plaintiffs “have alleged only actual—not speculative—identity theft,

we need not address the issue of whether speculative identity theft would be sufficient to confer

standing.” Resnick, supra, at fn. 1. 

 The other, out-of-circuit case that Defendant cites for this principle was recently 9

reversed. See Remijas v. Neiman Marcus Group, LLC, 2015 WL 4394814 (7th Cir. July 20,

2015)(reversing district court’s decision that victims of identity theft whose credit cards were

compromised had suffered no injury in fact sufficient for standing because they had been

reimbursed for the unauthorized charges). 

 The Burton court, before denying the defendant’s motion to dismiss and ordering the 10

plaintiff to re-file his complaint, opined that if plaintiff could not “plausibly allege and ultimately

prove his actual damages (for example, an allegation that the charges on his account were not

forgiven, and he had to pay for the charges), then the Court must dismiss the claim for lack of

subject matter jurisdiction.” Burton at 1285. The Burton court then stated the plaintiff’s “current

allegation that his debit card was used for just under $300.00 of unauthorized purchases” is “not

sufficient to survive a Rule 12(b)(1) challenge.” Id. The Burton court did not—as Defendant

contends— explicitly hold that a plaintiff must allege in a complaint that “he/she suffered some

un-reimbursed or out-of-pocket expense.” (Doc. 27 at p. 7). Moreover, the court’s statements

were in the context of explaining to the plaintiff how he should re-plead his claim in a new

complaint, and as such are dicta. 

But, assuming the language is not dicta and the Burton court’s holding indeed stands for

the above proposition, this court is unaware of any binding precedent holding the same,

especially in light of the Supreme Court’s holding in Lujan that at the pleading stage, general

allegations of injury may be sufficient for standing purposes. See Lujan at 561.

17

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 17 of 35
principle as stated by Defendant, the Burton case is not binding on the court.

Nonetheless, because it is from within the Eleventh Circuit, it bears a brief analysis. 

The Burton court, in analyzing a negligence claim arising under Alabama law,

held that the plaintiff’s allegations of identity theft and unauthorized use of his debit

card were not sufficient to survive a 12(b)(1) challenge to subject matter jurisdiction.

To the extent Defendant intends this court to apply the Burton court’s reasoning

regarding the state law negligence claim in that case, it is difficult to reconcile the

Burton court’s reasoning with the Eleventh Circuit’s holding in Resnick. There is 11

no precedent binding on this court stating that for standing purposes, a victim of

identity theft must allege that he or she suffered economic damages or that he/she

suffered an un-reimbursed or out-of-pocket expense, and this court will not so hold. 

The Eleventh Circuit in Resnick held that a victim of actual identity theft who

alleges monetary damage has alleged an injury in fact sufficient to meet the first

prong of the standing analysis. Though sparse the Plaintiffs’ allegations may be, the

 The Burton court does not explain how it came to the conclusion that monetary 11

damages in the amount of $300.00 are insufficient to allege an injury for standing purposes. It

appears the Burton court, in applying Alabama law regarding negligence claims, may have

equated the amount of $300.00 with “nominal damages.” This court is unaware of binding

precedent holding that nominal damages are insufficient to confer standing on a victim of identity

theft pursuing a FCRA claim or that plaintiffs pursuing a FCRA claim must allege a threshold

amount of monetary damages in order to establish standing. The Eleventh Circuit in Resnick held

that a data breach victim who alleges monetary damages—not monetary damages of a certain

amount—has stated an injury in fact sufficient for standing purposes. 

18

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 18 of 35
Plaintiffs allege that they entrusted their PII/PHI to Defendant, that their PII/PHI was

left unsecured, that a data breach occurred, that fraudulent tax returns were

subsequently filed, and that they suffered economic damage/losses as a result. In light

of the Supreme Court’s holding in Lujan that at the pleading stage, general

allegations of injury may be sufficient for standing purposes and the Eleventh

Circuit’s holding in Resnick, these allegations, which are taken as true at this

juncture, are sufficient to survive Defendant’s motion to dismiss. The case should

proceed to discovery. The court recognizes that Plaintiffs may eventually not be able

to provide an adequate factual basis for the inference, but they have no such burden

at the 12(b)(1) stage. The Defendant may investigate the nature and extent of 12

Plaintiffs’ alleged economic damage and if it so desires, raise the issue of standing

at that time.13

In part due to this court’s order for supplemental briefing on the issue of an

actual injury in fact, the parties engaged in significant briefing regarding whether 14

See Remijas v. Neiman Marcus Group, LLC, 2015 WL 4394814 (7th Cir. 2015). 12

 Defendant spends considerable time briefing the issue of whether an identity theft 13

victim whose information was used to file a fraudulent tax return can even allege that the

fraudulent filing resulted in economic loss to them, because the IRS provides refunds to victim

taxpayers, though sometimes with a delay. This issue is, of course, fact-dependent. Defendant is

entitled to discovery regarding the same, after which it may again raise the issue. 

See Doc. 32. 14

19

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 19 of 35
a data breach victim who alleges imminent, prospective injuries resulting from

expected future identity theft has alleged an injury in fact sufficient to establish

standing. The EleventhCircuit has not addressed this question, and courts nationwide

that have addressed the issue have reached divergent conclusions. The parties also 15

briefed the issue of whether or not monetary expenditures for prophylactic measures

to prevent future identity theft (such as credit monitoring) are sufficient to satisfy the

injury in fact prong of the standing analysis. The Eleventh Circuit has not weighed

in on this issue, and courts nationwide are split on the issue. Finally, the parties 16

briefed the issue of whether Plaintiffs have standing by sheer virtue of having alleged

a violation of the FCRA. Again, the Eleventh Circuit has not weighed in on thisissue,

and courts nationwide disagree. Nevertheless, because Plaintiffs have alleged actual

17

 See e.g., Krottner v. Starbucks Corp., 628 F.3d 1139, 1142-43 (9th Cir. 2010)(finding 15

an injury in fact where plaintiffs alleged a data breach and threat of identity theft, but no actual

identity theft); Pisciotta v. Old Nat’l Bancorp., 499 F.3d 629, 634 (7th Cir. 2007)(same); Cf.

Reilly v. Ceridian Corp., 664 F.3d 38 (3rd Cir. 2011)(holding that allegations of an increased risk

of identity theft resulting from a security breach are insufficient to confer standing); Galaria v.

Nationwide Mut. Ins. Co., 998 F. Supp. 2d 646 (S.D. Ohio 2014)(same). 

 See e.g., In re Sony Gaming Networks and Customer Data Security Breach Litigation,

16

903 F. Supp. 2d 942 (S. D. Ca. 2012)(holding that data breach victims who alleged that their

sensitive personal information was wrongfully disseminated, thereby increasing the risk of future

harm to them, had standing as the future harm was a cognizable loss sufficient to satisfy the

injury in fact requirement); Cf. In re Science Applications International Corp. (SAIC) Backup

Tape Data Theft Litigation, 45 F. Supp. 3d 14 (D. D.C. 2014)(holding that the cost of credit

monitoring and other preventative measures taken subsequent to a data breach cannot create

standing). 

See e.g., Robins v. Spokeo, Inc., 742 F.3d 409 (9th Cir. 2014)(holding that with regard 17

to willful violations of the FCRA, a plaintiff is not required to show actual harm and need only

20

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 20 of 35
identity theft and an economic injury, which together constitute an injury in fact

sufficient to meet the first prong of the standing analysis, it is not necessary to reach

the questions of whether Plaintiffs would have standing on other,independent bases.18

b. Plaintiffs’ alleged injury is fairly traceable to alleged

actions of Defendant.

“A showing that an injury is fairly traceable requires less than a showing of

‘proximate cause.’” Resnick at 1324 (citing Focus on the Family v. Pinellas

19

Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003)). “Even a showing that

a plaintiff’s injury is indirectly caused by a defendant’s actions satisfies the fairly

traceable requirement.” Id. 

20

allege a violation of the FCRA to have standing); Beaudry v. TeleCheck Servs., Inc., 579 F.3d

702, 705-707 (ruling that the FCRA “permits recovery when there are no identifiable or

measurable actual damages”); Murray v. GMAC Mortg. Corp., 434 F.3d 948, 952-53 (7th Cir.

2006)(ruling that the FCRA “provide[s] for modest damages without proof of injury.”); Hammer

v. Sam’s East, Inc., 754 F.3d 492 (8th Cir. 2014)(similar holding regarding the Fair and Accurate

Credit Transactions Act (FACTA)). Cf. Sterk v. Best Buy Stores, L.P., et al., 2012 WL 5197901

(N.D. Ill. Oct. 17, 2012)(holding in the context of the Video Privacy Protection Act (VPPA) that

data breach victims did not have standing solely because the VPPA provided for statutory

penalties). 

 The parties are not precluded from raising these issues at the summary judgment stage. 18

 Defendant repeatedly refers to “causation” in its argument that Plaintiffs have failed to 19

show that their injuries are fairly traceable to Defendant’s actions. (Doc. 27 at pp. 11-12).

Whether proximate cause is present is not the salient question with regard to the “fairly

traceable” inquiry.

 Defendant takes liberties in its summary of Resnick’s reasoning with regard to the 20

“fairly traceable” requirement. Defendant states in its motion to dismiss that the Resnick court

reasoned that the following must be shown in order to show that an injury is fairly traceable to a

defendant’s action: “(1) that the plaintiff gave the defendant his/her personal information; (2) the

21

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 21 of 35
Plaintiffs allege that they entrusted their PII/PHI to Defendant and that

Defendant did not secure it. They allege that a data breach resulted, and that their

information was among that which was stolen. They further allege that their

information was subsequently used to file fraudulent tax returns in their respective

names. Plaintiffs have alleged sufficient facts to show that their injuries can be fairly

traced (whether directly or indirectly) to Defendant’s actionsin failing to secure their

Plaintiffs’ identity theft occurred in a time period after a data breach involving the defendant

occurred; and (3) the plaintiff previously has not suffered any such incidents of identity theft.” 

The Resnick court did not so hold with regard to the “fairly traceable” requirement. It

stated—in full—the following regarding the second prong of the standing analysis: 

A showing that an injury is fairly traceable requires less than a showing of

‘proximate cause,’ Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d

1263, 1273 (11th Cir. 2003). Even a showing that a plaintiff’s injury is indirectly

caused by a defendant’s actions satisfies the fairly traceable requirement. Plaintiffs

allege that [Defendant] failed to secure their information on company laptops, and

that those laptops were subsequently stolen. Despite Plaintiff’s personal habits of

securing their sensitive information, Plaintiffs became victims of identity theft after

the unencrypted laptops containing their sensitive information were stolen. For

purposes of standing, these allegations are sufficient to ‘fairly trace’ their injury to

[Defendant’s] failures. 

Resnick at 1324. Defendant extracted the above “factors” from the Resnick court’s analysis—in a

separate section of the opinion—regarding whether the plaintiffs had pled sufficient facts of

causation to have stated various claims arising under Florida law relating to identity theft.

Resnick at 1325-1327. The Resnick court was not discussing the “fairly traceable” requirement at

that time and did not hold that plaintiffs must allege the three factors enumerated in Defendant’s

brief in order to establish standing. 

Again, Defendant does not raise such a 12(b)(6) challenge to the FCRA claims, arguing

that the claims should be dismissed solely because Plaintiffs lack of standing. 

22

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 22 of 35
PII/PHI. Plaintiffs have met the second prong of the standing analysis.21

c. A favorable resolution could redress Plaintiffs’ alleged

injuries. 

As noted above, the Resnick court addressed whether plaintiffs had shown that

a favorable resolution of the case in their favor could redress their alleged injuries.

The court stated: “Plaintiffs allege a monetary injury and an award of compensatory

damages would redress that injury. Plaintiffs have alleged sufficient facts to confer

standin[g].” Resnick at 1324. The Plaintiffs herein have alleged economic injuries

and as in Resnick, an award of compensatory damages would redress an economic

injury. Plaintiffs have met the third prong of the standing analysis.

B. The state law claims. 

Plaintiffs’ complaint contains claims the following claims arising under

Alabama law: negligence/wantonness (Count III); negligence per se (Count IV);

invasion of privacy by public disclosure of private facts (Count V); and breach of

 Defendant’s arguments that Plaintiffs’ injuries are not fairly traceable because they fail 21

to allege “a sequential connection”of the use of their personal information after the data breach is

unpersuasive. Plaintiffs allege that they entrusted their PII/PHI to Defendant between June 2013

and February 2014 and that they recently learned that fraudulent tax returns had been filed in

their name. They have alleged sufficient facts to show that the tax returns were filed after the

breach. Defendant’s argument that Plaintiffs’ claim is not fairly traceable because they fail to

allege that they have never before been victims of identity theft is also not persuasive. Defendant

cites no binding case law holding that such an allegation is required. While Resnick

acknowledged that Plaintiffs had not been victims of identity theft before, it did not base its

holding that they possessed standing on that fact. 

23

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 23 of 35
express or implied contract (Second Count V). 

Though Defendant does not make it entirely clear, to the extent it intends its

argument regarding standing to apply equally to the state law claims as it does the

FCRA claims, the motion to dismiss is due to be denied. Plaintiffs have alleged

sufficient facts to establish standing at the 12(b)(1) stage. 

Defendant does not make a 12(b)(6) challenge to Plaintiffs’

negligence/wantonness claim, but makes challengesto Plaintiffs’ remaining state law

claims for negligence per se, invasion of privacy, and breach of contract. Each is

discussed in turn hereinbelow. 

i. Plaintiffs have plausibly alleged a claim for negligence per

se.

Plaintiffs allege The Health Insurance Portability and Accountability Act

(HIPAA) sets forth and otherwise establishes “duties in the industry that were 22

applicable to [Defendant].” (Doc. 25 at ¶ 88). Plaintiffs further allege that

23

Defendant’s failure to safeguard and protect the Plaintiffs’ PII/PHI, which violated

 45 C.F.R. § 160. 22

 Plaintiffs also allege in their Second Amended Complaint that “Alabama state law 23

referenced above,” places duties on Defendant and serves as the standard for their negligence per

se claim; however, they later abandon this basis for their claim. (Doc. 25 at ¶ 88). Plaintiffs

concede in their brief opposing Defendant’s motion to dismiss that they failed “to cite the

Alabama state law providing one of the foundations for their negligence per se claim,” and state,

“Plaintiffs have nevertheless pled all required elements of a valid claim of negligence per se

resulting from a violation of [HIPAA].” (Doc. 29 at p. 9). 

24

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 24 of 35
HIPAA and resulted in the unauthorized disclosure of their information and

subsequent damages, constituted negligence per se. (Doc. 25 at ¶ 88-94). 

Defendants challenge the validity of the claim, arguing that HIPAA does not

provide a private cause of action or a standard of care that could serve as the basis for

Plaintiffs’ negligence per se claim. Plaintiffs do not dispute Defendants’ first

argument, and confirm that they are not seeking to assert a private cause of action

under HIPAA, but argue HIPAA is a proper basis for a negligence per se claim. 

Defendant presents no binding precedent holding that a HIPAA violation is not

a proper basis for a negligence per se claim under Alabama law. This court has

24

undertaken a brief search of law from within Alabama and the Eleventh Circuit has

been unable to find case law which speaks directly to this issue. There is, however,

Alabama case law holding that even where a private right of action is not

contemplated by a statute, the statute can still serve as the basis of a negligence per

se claim. See Allen v. Delchamps, Inc., 624 So.2d 1065, 1067-68 (Ala.

1993)(acknowledging that no private cause of action exists under the Food, Drug and

Cosmetic Act (FDCA), but allowing a negligence per se claim to proceed stating:

“[T]he plaintiffs in this case are not suing directly under the FDCA or its

 Defendant cites out-of-circuit precedent in support of its contention, none of which is 24

binding on this court. 

25

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 25 of 35
accompanying regulations. Rather, they are relying on the regulations to establish a

duty or standard of care.”).

In light of Defendant’s failure to provide precedent binding on this court

holding that HIPAA cannot serve as the basis of a negligence per se claim, coupled

with the Allen decision, which indicates Alabama court’s willingnessto allow statutes

that do not otherwise provide private causes of action to serve as the basis for a

negligence per se claim, Plaintiffs’ negligence per se claim is not due to be dismissed

on the basis that it is not cognizable as a matter of law. 

Defendants argue that even if HIPAA can serve asthe basis of a negligence per

se claim, Plaintiffs have failed to allege facts to satisfy the requisite elements for the

same. “To establish that a violation of a statute constitutes negligence per se, a

plaintiff must meet a four pronged test: ‘(1) the statute must have been enacted to

protect a class of persons, of which the plaintiff is a member; (2) the injury must be

of the type contemplated by the statute; (3) the defendant must have violated the

statute; and (4) the defendant's statutory violation must have proximately caused the

injury.’” Johnson v. Food Giant Supermarkets, Inc., 2015 WL 3629777 at *3 (M. D.

Ala. Jun. 10, 2015)(citing Parker Bldg. Servs. Co. v. Lightsey ex rel. Lightsey, 925

So.2d 927, 931 (Ala.2005)). 

26

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 26 of 35
Defendant contests the first and fourth factors. (Doc. 27 at p. 18). Defendant 25

first argues that HIPAA was not enacted to protect a particular class of citizens. 

Defendant cites no precedent, much less that which is binding, holding that HIPAA

was not enacted to protect a particular class of citizens such that it cannot be

considered the source of a duty or standard of care for a negligence per se claim. 

This court has, again, undertaken a brief a brief search of law from within Alabama

and the Eleventh Circuit has been unable to find case law which speaks directly to

this issue. Defendant has not provided the court with a basis, rooted in controlling

precedent, to dismiss this claim on the basis that HIPAA is not intended to protect a

particular class of citizens; therefore, the claim is not due to be dismissed. 

26

Defendant also argues that Plaintiffs cannot establish causation of damages

resulting from the HIPAA violation. (Doc. 27 at p. 22). Defendant, relying on a case

 Defendant states in a footnote that “Plaintiff cannot meet the third element, which is 25

actually showing a statutory violation under HIPAA,” but states that the third element is not

addressed in the motion. (Doc. 27 at fn. 5). 

 Defendant cites in support of this argument a non-binding case from the Middle District 26

of Alabama holding that the Fair Debt Collection Practices Act (“FDCPA”), which protects

consumers, is not intended to protect a class narrower than the general public and that it therefore

cannot serve as the basis of a negligence per se claim. See Winberry v. United States Collection

Bureau, Inc., 697 F. Supp. 2d 1279. The court is not persuaded that a privacy law designed to

protect patients who receive healthcare and entrust to their provider confidential personal

information is analogous to one designed to protect all consumers. See 15 U.S.C. § 1692a(3)(a

consumer is any natural person obligated or allegedly obligated to pay any debt).

27

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 27 of 35
from the Eastern District of Pennsylvania, argues that the hospital’s failure to 27

safeguard patient information did not proximately cause the Plaintiffs’ claimed

damages because there were “multiple intervening acts [including the theft

perpetrated by the hospital employee] between the alleged HIPAA violation and the

harm alleged by Plaintiffs.” (Doc. 27 at p. 23). The question of whether intervening

causes broke the chain of causation such that Plaintiff cannot sustain a claim of

negligence per se against Defendant is one that necessarily requires a factual inquiry;

therefore, the negligence per se claim is not due to be dismissed on this basis. 

Ultimately, Plaintiffs allege that HIPAA provides for privacy of patients’

confidential information and that theywere such patients. Plaintiffs further allege that

Defendant violated the standard of care regarding privacy established by HIPAA, that

the Defendant’s violation led to their alleged damages. In light of the foregoing, the

Plaintiffs’ negligence per se claim is not due to be dismissed at this juncture.28

 

See Citizens Bank of Pennsylvania v. Reimbursement Technologies, Inc., et al., 2014 27

U.S. Dist. LEXIS 82098 (E.D. Pa. 2014). 

 This recommendation is not to be read as a conclusion that Plaintiff has established that 28

Defendant was negligent per se. Rather, because Defendant has provided no binding precedent

demonstrating that such a claim is not cognizable as a matter of law and because a factual inquiry

is necessary to make a determination as to the balance of Defendant’s arguments, the claim

should proceed to discovery. 

28

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 28 of 35
ii. Plaintiffs have not plausibly alleged a claim for invasion of

privacy by public disclosure of private facts. 

Plaintiffs allege that Defendant’s failure to secure their PII/PHI constituted and

continues to constitute an ongoing invasion oftheir privacy because their PII/PHI has

been publicly disclosed. (Doc. 25 at ¶¶ 95-99). Defendant argues the Plaintiffs have

failed to allege facts sufficient to support the existence of a “public disclosure”

required to establish the tort of invasion of privacy was committed. Defendant further

argues that Plaintiffs “equate theft by an employee with disclosure.” (Doc. 27 at pp.

27-28). Plaintiffs clarify this argument in their reply brief, arguing that if a

29

disclosure was made, it was made by the Defendant’s employee who stole the

information, not by the Defendant itself. (Doc. 30 at pp. 11-14). Defendant’s

argument that Plaintiffs have failed to allege facts to support the existence of a public

disclosure is unpersuasive. However, Defendants’ second argument is well-taken. 

Defendant cites Key v. Compass Bank, Inc., 826 So.2d 159 (Ala. Civ. App.

2001) in support of its argument that Plaintiffs cannot hold Defendant liable for

invasion of privacy absent allegations that the Defendant itself publicly disclosed the

confidential information. In Key, the plaintiffs sought to hold a bank liable for

 Defendant further argues, apparently out of an abundance of caution that 29

in the event that Plaintiffs intended to pursue such a claim, Plaintiffs’ allegations are insufficient

to support a claim of vicarious liability against the Defendant for the actions of its employee.

There does not appear to be such a claim in Plaintiffs’ complaint, and the court interprets

Plaintiffs’ silence on that issue in their reply brief as admission of the same. 

29

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 29 of 35
invasion of privacy because it, as part of an investigation, gave photographs to a

police officer, who then published them to general public. The court held that the

bank had not invaded the privacy of the plaintiffs, explaining: 

We note that the plaintiffs argue that [the Bank] should have

foreseen that [the police officer] would publish the photographs to the

general public through the course of his investigation of the forgery, and

that, therefore, [the Bank] should be liable under this cause of action.

However, the cause of action for thisformof invasion of privacy [giving

publicity to private information] addresses only the defendant's actual

conduct; it does not address liability for the allegedly foreseeable

consequences of that conduct. This court is not willing to so broadly

expand this cause of action for invasion of privacy [...]. 

Key at 167. In the instant case, Plaintiffs allege that Defendants “intentionally,

willfully, recklessly, negligently, and/or wantonly” failed to take the necessary

precautions to protect Plaintiffs’ PII/PHI and that such failure resulted in their

information being stolen and then disseminated. (Doc. 25 at ¶ 2). However, asin Key,

Plaintiffs do not allege that Defendant itself actually disseminated the information to

the public. The claim is due to be dismissed as a matter of law.

iii. Plaintiffs have plausibly alleged a claim for breach of

express or implied contract. 

Plaintiffs allege that Defendant “had a written understanding with the Plaintiffs

... as set forth in [its] Notice of Privacy Practices that [it] would not disclose

Plaintiffs’ ... confidential information in a manner not authorized by applicable law

30

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 30 of 35
or industry standards.” (Doc. 25 at ¶ 101). Plaintiff argues that the “Notice of

Privacy Practices” constituted an express contract or at the very least created a

meeting of the minds that was inferred from the conduct of the parties.” (Doc. 25 at

¶ 102). Defendants contests the existence of both as well as the breach of the same.

a. Express contract

Defendant attaches to the motion to dismiss the Notice of Privacy Practices in

question and argues that: (1) the notice is simply required by law and is not part of

a contract between Defendant and patients, (2) the wording of the notice is not

negotiated when patients receive care from Defendant, (3) the wording contained in

the notice is mere policy and is not contractual, but required by law, and (4) there is

no consideration for the agreement. (Doc. 27 at pp. 27-30).

“Motions to dismiss under Federal Rule 12(b)(6) are appropriately directed to

the pleadings and not based on documents outside the pleadings.” Nesbit v. Unisys

Corp., 2005 WL 1968828, *2 (M. D. Ala. Aug. 10, 2005)(citing Grossman v.

Nationsbank, N.A., 225 F.3d 1228, 1231 (11th Cir. 2000) (“When considering a

motion to dismiss, all facts set forth in the plaintiff's complaint are to be accepted as

true and the court limits its consideration to the pleadings and exhibits attached

thereto.”)(internal quotations and citation omitted)). Accordingly, “Defendant’s

reliance on evidentiary submissions to argue that the factual predicate for [Plaintiffs’]

31

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 31 of 35
allegations do not exist is not procedurally proper at this stage in the proceedings.”

Id.

Determining the nature of the Notice of Privacy Practices at issue (i.e., whether

it is simply a statement of policy or not), the impact or non-impact of the language

contained therein, the context in which was given to the Plaintiffs, the context in

which it was signed by the Plaintiffs, as well as Plaintiffs’ reliance on the same, are 30

“vital issues in this breach of contract action and should be decided based upon

evidence, not the pleadings.” Id. While all of Defendant’s arguments have been

considered, they require fact-intensive inquiries and are ultimately based on a

document outside of the pleadings. They are, therefore, inappropriate at thisjuncture

in this case. 

Plaintiffs allege that both the Defendant and they understood from the written

Notice of Privacy Practices that Defendant would not disclose their confidential

information. They further allege that Defendant failed to secure their information,

 Under Alabama law, “to become a binding promise, the language used ... must be 30

specific enough to constitute an actual offer rather than a mere general statement of policy.” 

Hoffman-LaRoche, Inc. v. Campbell, 512 So.2d 725, 734 (Ala. 1987). However, even when there

is only a mere statement of policy, if a plaintiff relies on the policy to his or her detriment, the

reliance can give rise to a breach of contract claim. See Jianjun Fu v. Wells Fargo Home Mortg.,

2014 WL 4681543 (N. D. Ala. Sept. 14, 2014)(granting summary judgment because plaintiff

victims of identity theft had failed to demonstrate that they relied on defendant’s e-mail

disclaimer which contained a prohibition against sending confidential or sensitive information). 

32

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 32 of 35
causing it be disclosed, and that the disclosure resulted in damages. Though slight,

taking them as true at this stage in the proceedings, Plaintiffs’ allegations are

sufficient to plausibly raise the inference that Plaintiffs and Defendant entered into

a contract, which Defendant then breached. The claim should proceed to discovery.

b. Implied Contract

Defendant argues that Plaintiffs are prohibited from bringing an implied

contract claim concurrent with an express contract claim. This argument is not

persuasive, as Plaintiff raises the existence of an implied contract as an alternative.

See Federal Rule of Civil Procedure 8(e)(2). 

Defendant further argues that Plaintiffs have failed to allege the requisite facts

to establish the existence of an implied contract. Proof of an implied contract requires

the same basic elements of an express contract. See Stacey v. Peed, 142 So.3d 529,

531 (Ala. 2013). “An implied contract arises where there are circumstances which,

according to the ordinary course of dealing and common understanding, show a

mutual intent to contract.” Broyles v. Brown Eng’g Co., 151 So.2d 767, 770 (Ala.

1963). The implied contract claim is not due to be dismissed for the same reason the

express contract claim is not due to be dismissed. Plaintiffs have alleged sufficient

facts to allow the claim to proceed to discovery, during which the parties may engage

in an investigation regarding the “circumstances” which show or do not show a

33

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 33 of 35
mutual intent to contract. 

V. CONCLUSION AND RECOMMENDATION

Accordingly, for the reasons as stated, it isthe RECOMMENDATION of the

Magistrate Judge that the Defendant’s motion to dismiss (Doc. 26) be GRANTED

IN PART and DENIED IN PART. The state law claim for invasion of privacy by

public disclosure of private facts is due to be dismissed. The motion to dismiss due

to be denied as to the remaining federal and state law claims. 

It is ORDERED that the parties shall file any objections to the said

Recommendation on or before September 16, 2015. Any objections filed must

specificallyidentify the findings in the Magistrate Judge’s Recommendation to which

the party objects. Frivolous, conclusive or general objections will not be considered

by the District Court. The parties are advised that this Recommendation is not a final

order of the court and, therefore, it is not appealable.

Failure to file written objections to the proposed findings and recommendations

in the Magistrate Judge’s report shall bar the party from a de novo determination by

the District Court of issues covered in the report and shall bar the party from

attacking on appeal factual findings in the report accepted or adopted by the District

Court except upon grounds of plain error or manifest injustice. Nettles v. Wainwright,

677 F.2d 404 (5th Cir. 1982). See Stein v. Reynolds Securities, Inc., 667 F.2d 33

34

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 34 of 35
(11th Cir. 1982).

DONE and ORDERED this 2nd day of September, 2015.

 /s/ Paul W. Greene 

United States Magistrate Judge 

35

Case 1:14-cv-00324-WKW-GMB Document 39 Filed 09/02/15 Page 35 of 35