SI XTH DIVI SI ON Dec ember

30, 2010

No. 1-09-1215 J ACQUEL I

NE COONEY , EMMA MARTI N, MI CHEL E HARDI N, GWENDOLYN JONES, KAREN SOPR YCH, THOMAS B AL EK, ROB ERT GIANCARL O and EU L ETT COX, on Be half of T hemselves a nd All Others Similarly Situated, Plaintiffs-Appellants, v. CHI CAGO PUBL I C SC HOOL S; THE BOA RD OF EDUCATI ON OF THE CI TY OF CHI CAGO; and AL L PRI NTI NG AND GRAPHI CS, I

NC., Def endants-A

ppellees.

________________________________________________ J AN MORGAN- WUL F; AL L I SON PADEL FORD a nd PAULRI EGER et al ., Indiv. and on B ehalf of All Persons and Entities Simi larly

Situated, Plaintiffs-Appellants, v. THE B OARD OF EDUCATI ON OF THE CI TY OF CHI CAGO and A L LPRI NTI NG AND GRAPHI CS, I

NC., Def endants-A

ppellees. ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) Appea l from the Circuit Court of Cook County

Nos. 06 CH 25694 06 L012902

Honora ble Rita Novak, J udg e Presiding

. J USTI CE CAHI L Ldelivere d the opinion of the cour t: Plaintiffs appea l the circ uit court’s orde r dismissing claims stemming f rom disclosure of the per sonal information of a pproxi mately

1,700 former

Chicag o Public School (CP S) employ ees. We a ffirm.1-09-1215

Def endant All Printing & Gra phics, Inc., wa s retaine d by the B oard of

Education of the City of Chicag o (B oard) to print, packa g e and ma il a “Chicag o Public Schools-COBRA Open Enrollment L ist” to over 1,700 for mer CPS employ ees. The mailing, se nt sometime betwee n November

23, 2006, and Nove mber 27, 2006, infor med the for

mer e mploy ees tha

t as COBRA participa nts, they could cha

ng e their insura

nce be nefit plans. The list sent to each plaintiff contained the names of a ll 1,750 plaintiffs, alongwith their addre sses, social sec urity numbers, marital status, medica l and dental insure rs and he alth insurance plan information (COB RA list). On Novembe r 26, 2006, the B oard le arne d of the disclosure of the pe rsonal information. The followingday

the B oard se nt a letter to the f ormer e mploy ees, a sking the m to return the COBRA list or destroy

it. On Dec ember

8, 2006, the B oard ma iled the forme r employ ees a letter off eringone year of fr ee c redit protec tion insurance. Some of the for

mer e mploy ees f

iled individual and class ac tion lawsuits, and the case s

wer e later consolidated. The complaints alleg e: (1) violation of the Personal Information Protection Act (the Act) ( 815 I L CS 530/ 1 et seq. (West 2006)); (2) violation of the Consumer Fr aud and D ece ptive Business Pra ctices A ct (Consurmer Fr aud Ac t) (815 I L CS 505/ 1 et seq. (West 2006)); (3) violation of the Hea lth I nsuranc e Portability and Ac countability

Act of 1996 (HI PAA) (42 U.S.C. 1320d-6 (2006) ) under 42 U.S.C. §1983; (4) violation of the common law rig ht to privacy ; (5) violation of the I llinois Constit ution’s privacy clause (I ll. Const . 1970, art. I , §6); (6) ne g lige nt infliction of emotional distress; (7) neg lige nce; a nd (8) br eac h of fiducia

ry duty . Def endants moved to dismiss the complaints under sec tions 2-615 and 2-619 of the I llinois 21-09-1215

Code of Civil P roce dure ( 735 I L CS 5/ 2-615, 2-619 ( West 2006)). The tria l court dismissed the complaints with prejudice. Plaintiffs appea l the dismiss al of a ll claims with the ex ception of the alleg ed violation of the I llinois Constit ution’s privacy clause

. We review de novo a dismissal under sec tions 2-615 and 2-619 of the Code. Solaia Tec hnology , L L C v. Speciality Publis hing Co., 221 I ll. 2d 558, 578-79, 852 N.E.2d 825 (2006). A complaint is proper ly

dismiss ed under

section 2-615 of

the Code whe re the re is no set of f acts that if proven w ould entitle the plaintiff to rec overy . Marsha ll v. Burg er K ing Corp., 222 I ll. 2d 422, 429, 856 N.E.2d 1048 (2006) . A complaint is proper ly dismiss ed under

section 2-619 of

the Code wher e no g enuine issue of materia l fac t exi sts and the def endant is entitled to judg ment as a matter of la

w. Doyle v. Holy

Cross Hospital, 186 I ll. 2d 104, 109-10, 708 N.E.2d 1140 (1999). Plaintiffs first argue that the tria l court er red in dismissing their c ommon law and statutory neg lige nce c laims. To succe ed on their ne g lige nce c laims, plaintiffs must allege and prove that (1) defe ndants owed a

duty to plaintiffs; (2) def

endants bre ache d that duty ; and (3) the brea ch ca used injury to plaintiffs. First Spring field B ank & Trust v. Galman, 188 I ll. 2d 252, 256, 720 N.E.2d 1068 (1999). We must first decide whe ther the B oard ha d a duty to safeguard pla intiffs’ per sonal information under

a statutory

direc tive, beca

use whe re no duty

is owed, there is no neg lige nce. Washington v. City

of Chicag o, 188 I ll. 2d 235, 239, 720 N.E.2d 1030 (1999). Plaintiffs ar gue 31-09-1215

that HI PAA (42 U.S.C. §1320d-6 (2006)) provides a statutory basis for the c reation of a new duty . A violation of a statute de signe d to protect human life and prope rty may be used a s prima facie evidenc e of ne g lige nce. K alata v. Anheuser -B usch Cos., 144 I ll. 2d 425, 434-35, 581 N.E.2d 656 (1991) . HI PAA prohibits the disclosure of “ individually identifiable he alth information to another

person.” 42 U.S.C. 1320d-6(a)( 3) (2006) . But, “ employ ment rec ords held by a cove red e ntity

in its role as employ er” are specific ally excluded from HI PAA protec tion. 45 C.F.R. §160.103 (2006). B eca use the B oard he ld plaintiffs’ hea lth insurance elec tions in i ts role as a

n employ er, the Boa

rd’s disclosure falls outside HI PAA’s cove rag e. Plaintiffs also contend that the Ac t (815 I L CS 530/ 1 et seq. (West 2006)) cr eate s a leg al duty . The Ac t provides:

“Any data c ollector that maintains computer ized data that includes pe rsonal information that the data

collector does not own or lice nse shall notify the owner

or licensee of the infor

mation of any

brea ch of the secur ity

of the data immediately followingdiscovery , if the per sonal information wa s, or is rea sonably believed to have been, a cquire d by

an unauthor ized person.” 815 I L CS 530/ 10(b) ( West 2006). The “ ‘[b] rea ch of the secur ity of the sy stem data’ me ans unauthorized ac quisiti on of computerized data

that compromises the sec urity , confide ntiality , or integ rity of per sonal information [including social se curity numbers] maintained by

the data c ollector.” 815 I L CS 530/5 (West 2006). In defining“data collector ,” the Ac t includes “g overnme nt ag encie s *** and any other e ntity

that, for a

ny purpose, ha

ndles, collec ts, disseminates, or otherwise deals with

41-09-1215

nonpublic persona l information.” 815 I L CS 530/ 5 (West 2006). Plaintiffs claim that the Boa rd, as a data c ollector, violated the Act bec ause a “bre ach of the sec urity

of the sy stem data” occur red. Plaintiffs ar e cor

rec t, but while the statute define s what a br eac h of sy stem secur ity is, it also codifies the re medy : the data c ollector must provide timely notice of a

secur ity brea ch to the par

ties aff ecte d. 815 I L CS 530/ 10 (West 2006). The Boa rd complied with the statute by timely notifying pla intiffs of the bre ach. Plaintiffs sugg est that we a dopt an expansive rea ding of the Act. The argument can be summarized as follows: in enac ting the A ct, the leg islature intended to pr otect per sonal information from disclosure . I f the only obligation impos ed by

the Act is to provide notice of a brea ch, its purpose would be defe ated be cause entities could repe atedly disclose per sonal information and then e x onerate themselves by providingnotice. So, the statute’s purpose can only be re alized by

penalizing the disc losure itself. Be cause the provisions in the Act ar e cle ar, w e must assume it ref lects leg islative intent to limitdefe ndants’ duty

to providing notice . See Comprehe nsive Communit y Soluti ons, Inc. v. Rockford School District No. 205, 216 I ll. 2d 455, 473, 837 N.E.2d 1 (2005) (“ [t ]he plain languag e of a

statute rema ins the best indication of [the leg islature’s] intent”). Plaintiffs nex t contend that we should recognize a “new common law duty” to safe guard information. They

claim a duty

is justi fied by

the sensitive nature of per sonal data suc h as date s of birth and soc ial secur ity numbers. Plaintiffs do not cite to an I llinois case that supports this argument. Whil e we do not minim ize the importance of protec ting this information, we do not believe that the cre ation of a ne w leg al duty beyond leg islative require ments alrea dy in place is 51-09-1215

part of our

role on a ppellate r eview. A s noted, the leg islature has spe cifica lly addre ssed the issue and only require d the B oard to provide notice of the disclosure. All Printi ngalso had no duty to protect plaintiffs’ information from disclosure . All Printing met its contrac tual obligations by printing a

nd mailing the B oard’ s information pac kets. Plaintiffs cite to no authority for the pr oposition that All Printing had a duty to inspect the contents of the pa ckets or inf orm the B oard of

any irregularity . Absent a duty , there is no neg lige nce. Washing ton, 188 I ll. 2d at 239. We affir m the trial court’ s dismis sal of plaintiffs’ neg lige nce c laims. Plaintiffs nex t seek re cover y for ne g lige nt infliction of emotional distress. A plaintiff claimingto be a dire ct victim of neg lige ntly inflicted emotional distress must establish the traditional eleme nts of neg lige nce: duty , brea ch, ca usation and injury . Corg an v. Muehling , 143 I ll. 2d 296, 306, 574 N.E.2d 602 (1991). B eca use plaintiffs fa iled to establish a duty on the par

t of either defe ndant, their ne g lige nt infliction of emotional distress claim must fail with their g ener al neg lige nce c laims. Plaintiffs nex t assert that the B oard, a s their forme r employ er, ha d a fiduc iary duty to avoid disclosure of

persona l information. “To state a cause of ac tion for a br eac h of a f iduciary relationship, a plaintiff must allege that the def endant owe d a fiduc iary

duty to the plaintiff, and that duty must ex ist as a matter of

law.” D ames & Moore v. B axter & Woodman, Inc., 21 F

. Supp. 2d 817, 823 (N.D. I ll. 1998), citing Mid-America National B ank of Chica g o v. First Savings & L oan Ass’n of South Holland, 161 I ll. App. 3d 531, 538, 515 N.E.2d 176 (1987). Plaintiffs’ sole contention is that a fiduc iary duty was c reated when the y

provided the B oard w ith 61-09-1215

information “in conf

idence .” Plaintiffs cite to no authority supporting suc h a duty . See Ec kiss v. McVa igh, 261 I ll. App. 3d 778, 786, 634 N.E.2d 476 (1994) ( “[m] ere contentions without argument or citation of a

uthority do not merit consideration on appeal” ). We aff irm the trial court’s dismissal of this claim. Next, plainti ffs c ontend that the trial c ourt err ed in dismissi ngtheir ca uses of a ction under 42 U.S.C. §1983 for a

violation of HI PAA (42 U.S.C. §1320d-6 (2006)) and the f ourth amendment to the United States Constitution (U.S. C onst., amend. IV). To establish municipal liability under se ction 1983 of Title 42 of the United States Code (42 U.S.C. §1983 (2006)), a plaintiff must alleg e that he ha s been de prived of a constitutionally protec ted rig ht and that depr ivation was ca used by a municipal policy , custom or pra ctice. Waters v. City

of Chicag o, 580 F.3d 575, 580 ( 7th Cir. 2009), citing Mone ll v. Depar tment of Social Service s, 436 U.S. 658, 694, 56 L . Ed. 2d 611, 638, 98 S. Ct. 2018, 2037-38 (1978); see also Weimann v. County

of Ka ne, 150 I ll. App. 3d 962, 965, 502 N.E.2d 373 (1986). " A plaintiff may

establish municipal liability by showing' (1) a

n express policy

that cause s a constitutional deprivation when e nforc ed; (2) a widespre ad pra ctice that is so permanent a nd well-settled that it constitutes a custom or pr actice ; or (3) a n alleg ation that the constitutional injury was c aused by

a per son with final policy makingauthority .’ ” Water s, 580 F.3d at 581, quoting Estate of Sims ex rel. Sims v. Count y of B urea u, 506 F.3d 509, 515 ( 7th Cir. 2007). Non-state a ctors, such a s All Printi nghere , may be found liable wher e they have c onspired or acte d in conce rt with state ac tors to deprive a person of his civil rights. Pesek v. Ma rzullo, 566 F. Supp. 2d 834, 839 (N.D . I ll. 2008) (mem. op.), c iting Adicke s v. S.H. Kress & Co., 398 U.S. 71-09-1215

144, 152, 26 L . Ed. 2d 142, 151, 90 S. Ct. 1598, 1605-06 (1970). Plaintiffs have not cited to a case that supports the asser tion of these rights in the context of a pr ivate right of ac tion under HI PAA. See B ag ent v. B lessing Ca re Corp., 363 I ll. App. 3d 916, 919-20, 844 N.E.2d 469 ( 2006) (“ [HI PAA] *** does not support a private c ause of action”) , overruled on othe r grounds , 224 I ll. 2d 154, 862 N.E.2d 985 (2007); Univer sity of Colorado Hospital Authority

v. Denve r Publishing Co., 340 F. Supp. 2d 1142, 1145 (D. Colo. 2004) (findingHI PAA prec ludes “implication of a pr ivate right of ac tion” and citingother fe dera l decisions findingno private r ight of action under

HI PAA); Doe v. B oard of Trustee s of University

of I llinois , 429 F. Supp. 2d 930, 944 (N.D . I ll. 2006) (“[e]very court to have considere d the issue *** has c oncluded that HI PAA does not authorize a pr ivate right of ac tion”);

see a lso Gonzaga

University

v. Doe, 536 U.S. 273, 284, 153 L . Ed. 2d 309, 321-22, 122 S. Ct. 2268, 2275-76 (2002) (“a plaintiff suing under a

n implied right of a ction must sti ll show that the statute manifests an intent ‘ to cre ate not just a private right , but a private reme dy ’ ”) (empha sis in orig inal), quotingAlexander v. Sandova l, 532 U.S. 275, 286, 149 L . Ed. 2d 517, 528, 121 S. Ct. 1511, 1519 (2001). We also find that plaintiffs have forf eited the a

ppeal of their four th amendment cla im. Plaintiff Cooney

mentioned the four

th amendment in her

third amende d complaint but never briefe d or ar gued the issue be fore the trial cour t. The trial cour

t “completely

ignor ed” the fourth amendment c laim beca

use Cooney

failed to bringit before the cour t. See People v. Phipps, 238 I ll. 2d 54, 62, 933 N.E.2d 1186, 1191 (2010), c iting People v. B lair, 215 I ll. 2d 427, 443-44, 831 N.E.2d 604 (2005) (for feiture applies to issues that could have been r aised but we re not). 81-09-1215

We turn nextto plaintiffs’ claims under the Consurmer F raud A ct. 815 I L CS 505/ 1 et seq. (West 2006). Section 2QQ of the Consurmer F raud A ct provides that a “per son” may

not “[p] ublicly

post or publicly

display in any manner an individual’s social sec urity number.” 815 I L CS 505/ 2QQ(a )(1) (West 2006) (re numbere d as 505/2RR in W est 2008). It defines “ [t o]

' publicly post' or ' publicly display ' ” as “ to intentionally communicate or

otherwise make available to the g ener al public.” 815 I L CS 505/ 2QQ(a )(1) (West 2006). The statute de fines a “ person” as “a ny natura l person or his leg al re prese ntative, partne rship, corpor ation (domestic and f oreign), compa

ny , trust, business entity

or assoc iation, and [ag ents and re prese ntatives of these entities].” 815 I L CS 505/ 1(c) (West 2006). The B oard, as a body politic, is nota “pe rson” within the mea ning of the Consurmer F raud A ct and ther efor e cannot be held liable for

a violation of the statute. B oard of Education v. A, C & S, Inc., 131 I ll. 2d 428, 467-68, 546 N.E.2d 580 ( 1989). Unlike the B oard, A ll Print ing is a domestic corpor ation and qualifie s as a “ person” within the meaningof the Consurmer Fr aud Ac t. See 815 I L CS 505/ 1(c) (West 2006). But, plaintiffs must alleg e ac tual damag es to bringa Consurmer F raud A ct ac tion. See 815 I L CS 505/10a(a ) (West 2006) (“ [a] ny person who suf

fer s actua l damag e as a

result of a

violation of this Act committed by

any other pe rson may

bringan ac tion ag ainst such per son”); see Morris v. Har vey Cy cle & Camper, Inc., 392 I ll. App. 3d 399, 402, 911 N.E.2d 1049 (2009) ( “[t] he fa ilure to alleg e spec ific, ac tual damag es pre cludes a claim brought under the Consurmer Fr aud Ac t”). To support a Consurmer

Fr aud Ac t claim, actua l damag es must arise f rom “pure ly

economic injuries.” Morr is, 392 I ll. App. 3d at 402. 91-09-1215

Plaintiffs contend that they alleg ed ac tual damag es bec ause the disclosure put them at incre ased r isk of future ide ntity theft. In Yu v. International Business Mac hines Corp., 314 I ll. App. 3d 892, 732 N.E.2d 1173 (2000) , we he ld that alleg ations of potential har m arisingfrom a softwar e def

ect we re insuff

icient to support a Consurmer F raud A ct claim, justifying a section 2-615 dismissal. W ithout actual injury or dama g e, the plaintiff’ s claims “constitute[d] conjec ture and spec ulation.” Yu, 314 I ll. App. 3d at 897. See also Willi ams v. Manche ster, 228 I ll. 2d 404, 425, 888 N.E.2d 1 (2008) (“a s a matter of law, an inc rea sed risk of f uture ha rm is an eleme nt of damages that can be rec overe d for a prese nt injury

- it is not the injury

itself”) ( emphasis in orig inal); Pisciotta v. Old National Ba ncorp, 499 F .3d 629, 639 (7th Cir. 2007) (“ [w] ithout more than alleg ations of incre ased r isk of future ide ntity theft, the plaintiffs have not suffe red a harm that the law is pre pare d to remedy”); Morr is, 392 I ll. App. 3d at 403, citing Xydakis v. Tar g et, Inc., 333 F . Supp. 2d 686, 688 (N.D. I ll. 2004) (“[t] here is no cause of action under

the Consurmer F raud A ct when a plaintiff alleg es only

ag g ravation and not actual damag es”)

. Plaintiffs also alleg e ac tual economic injury : the purcha se by some plaintiffs of c redit monitoring ser

vices. The y

claim that the B oard’ s offe r of c redit monitoring se rvice s constitutes an admission of ac tual damag es. Whil e neither

party has direc ted us to I llinois authority addre ssing whe ther the pur chase of cr edit monitoring ser

vices c onstitut es an e conomic injury under the Consurmer F raud A ct, there is feder al authority

on this iss ue supportingthe position that the purchase of these se rvice s, without more, is not an economic injury . See Rowe v. Unicar e L ife & Hea lth Insuranc e Co., No. 09 C 2286 (N.D. I ll. J anuar y 5, 2010) (findingthe provision of cr edit monitoring ser vices by the 101-09-1215

defe ndants “doe s not resolve the que stion of whether cre dit monit oringcosts are actua l damag es” and findingthat “the c osts of cre dit monit oringservice s are not a pre sent harm in and of themselves”) ; Aliano v. Texas Roadhouse Holding s L L C, No. 07 C 4108 (N.D. I ll. Dece mber 23, 2008) (f inding that the pur chase of cr edit monitoring ser vices doe s not constitute actual dama g es and citingdistrict courts in Michig an, Minnesota, Ohio a nd New Y ork in agree ment); see a lso Har ris v. Wal-Mart Stores Inc., No. 07 C 02561 (N.D . I ll. November 25, 2008) (re jectingclaim for da mag es under

the Credit and De bit Card Rece ipt Cl arific ation Act of 2007, Pub. L . No. 110- 241, 122 Stat. 1565 (2008) (c odified at 15 U.S.C. §1681) for the cost of c redit monitoring service s). We aff

irm the trial cour

t’s dismiss al of plaintiffs’ Consurmer F raud A ct claims. Finally , we a ddress plaintiffs’ invasion of privac y claims. I llinois courts re cog nize four way s to state a ca

use of a ction for invasion of pr ivacy : “(1) intrusion upon the se clusion of another ; (2) appr opriation of anothe r’s name or likene ss; (3) public disclosure of private f acts; and (4) publicity

placinganother

in a fa lse light.” Busse v. Motorola, Inc., 351 I ll. App. 3d 67, 71, 813 N.E.2d 1013 (2004) . Plaintiffs alleg e fa cts to support the first and third theor ies: intrusion upon seclusion and public disclosure of private f acts. To support the intrusion theory , plaintiffs must alleg e: (1) a n unauthorized intrusion into seclusion; (2) the intrusion would be hig hly offe nsive to a re asonable person; (3) the matter intruded upon wa s private; and ( 4) the intrusion ca used the plaintiffs a

nguish and suffe ring

. Busse , 351 I ll. App. 3d at 71. Public disclosure of private fa cts requir es that “( 1) publicity was g iven to the disclosure of private f acts; (2) the fa cts wer e private, and not public, fa cts; and (3) the matter ma de public wa s such as to be highly offe nsive to a re asonable person.” Miller v. 111-09-1215

Motorola, Inc., 202 I ll. App. 3d 976, 978, 560 N.E.2d 900 (1990), c iting W. Prosser, Torts §117 (5th ed. 1984). While the theor ies contain diff ere nt elements, both the intrusion and public disclosure torts re quire “ private” matters or f acts. In Busse , we sug g ested that “ [i ]n t he abse nce of an I llinois law def

ining soc ial secur ity numbers as pr ivate information, we ca nnot say that defe ndants’ use of

this number fulfills the privac y element ne cessa

ry to plead intrusion upon seclusion.” B usse, 351 I ll. App. 3d at 73. We also noted that matters of public rec ord such a s names and dates of birth have not been he ld to be private f acts. B usse, 351 I ll. App. 3d at 72, citing G eisberg er v. Willuhn, 72 I ll. App. 3d 435, 439, 390 N.E.2d 945 (1979)

. Plaintiffs contend that, af ter B usse, the leg islature def ined social sec urity

numbers as private f acts, ove rrulingthat holding. The y ag ain re ly

on the Act, whic h includes social se curity numbers in its definition of “per sonal information.” 815 I L CS 530/ 5 (West 2006). By equating “per sonal” with “pr ivate” inf ormation, plaintiffs ig nore the distinction we relied on in B usse. See B usse, 351 I ll. App. 3d at 72 (“[h]ere, none of the ‘pe rsonal’ infor

mation furnished by

the customers *** ha s been he ld to be private f acts” ). The la

nguag e of the Act is consistent with Busse , which distinguished pe rsonal information, such as names a nd social sec urity

numbers, from private fa cts, which a re f acia lly embar rassingand hig hly

offe nsive if disclosed. See 815 I L CS 530/ 5 (West 2006); Busse, 351 I ll. App. 3d at 72-73, compa ringJ ohnson v. K mart Corp., 311 I ll. App. 3d 573, 578-79, 723 N.E.2d 1192 (2000) (private fac ts were clea rly alleg ed); see also Phill ips v. Grenda

hl, 312 F.3d 357, 373 (8th Cir. 2002); Andr ews v. TRW, I nc., 225 F .3d 1063, 1067 (9th Cir. 2000), rev’d on other grounds , 534 U.S. 19, 151 L . Ed. 2d 339, 122 S. Ct. 121-09-1215

441 (2001). Havingfound no viable c auses of action, ther e is no nee d for us to addr ess the applicability

of the L ocal Gove rnmental a nd Gover nmental Employees Tor

t I mmunity

Act. 745 I L CS 10/ 1-101 et seq. (West 2006). For the fore g oing r easons we aff irm the trial cour

t’s dismiss al of plaintiffs’ complaints. Affir med. GARCI A, P.J ., concur s. R.E. GORDON, J., dis sents.

131-09-1215

J USTI CE ROBERT E. GORDO N, dissenting: In the ca se at ba

r, def endants sent e ach a

nd ever y class member

a complete list of over 1,700 former

employ ees’ first and last name s, addre sses, marital status, social sec urity numbers, medical a nd dental insurer s, and other he alth car e insuranc e informa tion. That mea

ns, for e very 1 class member , over 1,700 pe ople re ceive d his or her pe rsonal information. I n other wor ds, approximately

1,700 people r ece ived the per sonal information of a pproxi mately

1,700 other people. Most of the conc lusions in t he majority opinion are de pendent on its first conc lusion. I f the first conc lusion is removed, then the other depende nt conclusions become unpersua sive. The majority ’s first conc lusion is t hat the B oard’ s disclosure fa lls outsi de of H I PAA’s

cover ag e. The majority

bases this conc lusion entirely on an exclusion in the Code of Fe dera l Regulation. This ex clusion states that “e mploy ment rec ords held by

a cove red e ntity

in its role as employ er” are excluded from HI PAA’s protec tion. (Emphasis added.) 45 C.F.R. §160.103 (West 2006); see slip op. at 4. What the majority

misses is that there is a wor ld of diffe renc e betwe en “he ld” and

Paragraph 10 of

the Cooney

second a mended c omplaint alleg ed that the mailingincluded 1 “addr esses, socia l security numbers and spe cific he alth insurance plan selec tion information.” Paragrapn 10 of

the Morg an-Wulf third amende d complaint alleg ed that the mailingincluded “first a nd last names, addr esses, dates of qualific ation, medical a nd dental insurer s and marital status,” as we ll as social sec urity numbers. The two case s were consolidated.

141-09-1215

“disclosed.” No one objec ts to the fact that the B oard “ held” the r ecor ds. The B oard’ s ability to hold and maintain these r ecor ds is not at issue here. I f the B oard ha d simply held the re cords -

- and held on to them -- there would be no lawsuit. B ut the Boa rd did not hold on to them. I t is their disclosure, not their

holding, that is at issue in this case

. 2 This disti nction betwee n holding a nd maintenanc e on the one hand, and disc losing on the other, wa s made c lear

by the re cent a

mendment to section 1320d-6. Ac t Feb. 17, 2009, P.L . 111- 5, Div. A, Title XI I I , Subtit le D, Part 1, §13409, 123 Stat. 271 (ef fec tive Fe b. 17, 2010). Although this ame ndment was not in eff ect on the date of the disclosure in question, the amendment mer ely

clar ifies the existi ngstatute, rathe r than a dding to it. The a mendment clar ifies that an individual “sha ll be considere d” to have disclosed individually identifiable he alth information in violation of this section, if a cove red e ntity both “maintained” the information and then subsequently

“disclosed” it. The amendme nt thus recognizes what we would have assumed

even w ithout it , that there is a world of diff ere nce be tween ma intaining or holding on the one hand, and disc losing on the othe r. Thus, the exclusion for “he ld” re cords, quoted by the majority , does not apply to the case at bar . As a re sult, the majority ’s first conc lusion, that there is no duty beca use of this exclusion, is incorre ct. The majority

seems to imply

that, but for this exclusion, t here would be a duty , and we

The dictionar

y define s “hold” a s “to have and kee p in one’s g rasp.” The Ame rica n 2 Her itag e Dictionar

y , College Edition 616 (2d ed. 1982). 151-09-1215

ag ree . See also Moss v. Amira, 356 I ll. App. 3d 701, 712 (2005) (Q uinn, J ., specia lly

concur ring ) (obse rvingthat I llinois law conc erningdisclosure is g ener ally “fa r more r estrictive” than HI PPA); 215 I L CS 5/ 1021(B ) (2006) (providinga priva te ca use of a ction and dama g es for the unauthorized disclosure of persona l information by

“an insura

nce institution, ag ent or insurance -support org anization”). The majority

corr ectly states: “We must first decide whether the B oard ha d a duty

to safeguard plaintiffs’ per sonal information under a statutory

direc tive, beca

use wher e no duty

is owed, there is no neg lige nce. Washing ton v. City of Chicag o, 188 I ll. 2d 235, 239 (1999). Plaintiffs argue that HI PPA (42 U.S.C. §1320d-6 (West 2006)) provides a statutory 3 basis for the c reation of a new duty . A violation of a statute desig ned to protec t human life and pr operty may be used a s prima fac ie evidenc e of ne g lige nce. K alata v. Anheuser -B usch

Section 1320d-6(a )provides tha t “[a] person who knowing ly and in violation of this part 3 *** discloses individually identifiable he alth information to another person, sha ll be punished as provided in subsec tion b” of this section. 42 U.S. C. §1320d-6 (a) (West 2006). Subsection b provides that for

a base offe nse, which is a disc losure committed without false pr etense s and without an intent to sell, then the punishment can be up to one y ear in jail and may

include up to a $50,000 fine . 42 U.S. C. §1320d-6 (a) ( West 2006). 161-09-1215 Companies, Inc., 144 I ll. 2d 425, 434-35 (1991). HI PPA prohibit s 4 the disclosure of

‘individually

identifiable he alth information to another person.’ 42 U.S.C. §1320d-6(a)( 3) (West 2006).” Slip op. at 3-4. This court has a lrea dy

held that the ter

m “individually

identifiable he alth information” in HI PPA includes names, addr esses a nd social sec urity

numbers. Giang iulio v. I ng alls, 365 I ll. App. 3d 823, 839 (2006). Spec ifically , in Giang iulio, we found that this term “include s common identifiers such a s name, a ddress, birth date , and socia l security numbers.” G iang iulio, 365 I ll. App. 3d at 839. See also In re: B extra and Celebr ex Marketing , 2008 U.S. Dist. L exis 111875, 187 (N.D. Cal. 2008) (interpr etingthe term to include soc ial secur ity numbers). Our holdingin Giang iulio, that the term includes names, a ddresse s and social se curity numbers, is also supported by the def inition provided for the ter m. The term “ individually identifiable he alth information,” a s used in HI PPA, is define d in both the statute and in the Code of F eder al Regulations. 42 U.S.C. §1320d(6); 45 C.F.R. §160.103 (West 2006). This definition includes “de mogr aphic infor mation” (1) that is rece ived by an employer; (2) that relates to the provision of or pay

ment for he alth car e; and ( 3) that identifies a n individual. 42 U.S.C

. §1320d(6); 45 C.F.R. §160.103 (West 2006). De mogr aphic infor mation is widely

understood to

In its brief to this court, defe ndant B oard of Education concede s, as it must, t hat the 4 violation of a statute desig ned to protec t human life or pr operty may be used a s prima fa cie evidenc e of ne g lige nce. 171-09-1215

include socia l security

numbers, as w ell as name s and addr esses. E.g . In re: B extra, 2000 U.S. Dist. L exis at 187 (discussing“name s and addr esses, dates of birth, social se curity numbers *** and other demog raphic information”) ; May field v. U.S., 504 F. Supp. 2d 1023, 1027 (D. O re. 2007) (“ Demog raphic information included na me, date of

birth, sex, race, a

nd social sec urity number” ). In the ca se at ba r, the names, addre sses and socia l security numbers (1) wer e re ceive d by the employ er, ( 2) re lated to the provision of or pa y ment for he alth car e, and ( 3) identified the individual. Thus, our holding in Giang iulio, that the term includes names, a ddresse s and social

secur ity numbers, is also supported by the def inition provided for the ter m. Since the disclosed names, addre sses and socia l security numbers in the ca se at ba r qualify as “individually

identifiable he alth information,” HI PAA applies to the disclosed information. HI PAA also applies to enr ollment and disenrollment decisions. 42 U.S.C. §1320d2(a) (2)( C) (cove red tra

nsactions include “ [e] nrollment and disenrollment in a he alth plan”) ; 45 C.F.R. 160.103. As the majority

alre ady observe d, “[a] viol ation of a statute de signe d to protect human life and pr operty

may be used a s prima fa cie e vidence of neg lige nce.” Slip op. at 3-4, citing Kalata , 144 I ll. 2d at 434-35. See a lso Noy ola v. B oard of Education, 179 I ll. 2d 121, 129 (1997), discusse d rec ently with approva l in Vancua v. Katrus, No. 108652, slip op. at 18-19 ( I ll. October , 7, 2010). F ollowing the ma jority ’s sug g estion, Iwould find that the HI PAA violation

serve s as prima fa cie e vidence of neg lige nce, a nd Iwould not dismi ss at this early stag e of the litigation. Acosta

v. Smit h, 180 N.C. App. 562, 571-72 (N .C. App. Ct. 2006) (HI PAA violation used as e vidence of “the duty” owe d in a neg lige nce c ase)

. 181-09-1215

In short, the majority

and I seem to be in a g ree ment that, but for the e x ception, ther e would be a duty . We differ primarily beca use the majority

believes that the exception applies, and I do not. Most of the rema ining c onclusions in the majority opinion are ba sed on this first conclusion, and thus ar e also fa ulty . For example, later in the opinion, the majority conclude s that plaintiff’s cla im of emotional distress must fail beca use plaintiffs “f

ailed to establish a duty” on the par t of defe ndants. Slip op. at 6. Howeve r, this conclusion depe nds on finding, f irst, that 5 there was no duty

under H I PAA. I f there was a duty then, at this ear ly

stag e, plaintiffs would have only to alleg e, rather than pr ovide evidenc e, of the ir anxiety and emotional distress. Rowe v. Unicar e L ife a

nd Hea lth I nsuranc e Co., 2010 U.S. Dist. L exis 1576, 11-14 (N.D . I ll., E.D.2010) ( althoug h plaintiffs did not alleg e that the disclosure of their soc ial secur ity numbers and other persona l information resulted in unauthor ized acce ss by specific persons, plaintiffs’ alleg ations of anxiety

wer e suff

icient to withstand a motion to dism iss their emotional distress claim, under

I llinois state law)

. Simi larly , the majority

conclude s that plaintiffs failed to e stablish that the Boa rd had a fiduciar y duty to avoid disclosure, be cause the majority finds that plaintiffs cited “ no authority supporting suc h a duty .” Slip op. at 6. Ag ain, this conclusion depends on f inding no duty

under HI PAA

The majority

does not find that plaintiffs fa iled to alleg e emotional distress; rather they 5 simply do not rea ch this issue. Sli p op. at 6. 191-09-1215

Since I find that the exclusion, quoted by the majority , does not apply , I must find that the majority ’s first conc lusion is i ncorr ect. Since tha t first conclusion is the foundation for much of the subsequent opinion, I must respec tfully

dissent. Icannot f ind that HI PAA would allow the disclosure of someone’ s social sec urity number, mar ital status, and insurance information, and lea ve that per son without any rec ourse.

20