1 

UNITED STATES DISTRICT COURT 

EASTERN DISTRICT OF TEXAS 

SHERMAN DIVISION 

RICHARD SMITH, on behalf of himself and all 

others similarly situated, 

Plaintiff, 

v. 

AMERICAN PAIN AND WELLNESS, PLLC, 

Defendant. 

NO. 4:23-cv-00295

CLASS ACTION COMPLAINT

 DEMAND FOR JURY TRIAL 

Richard Smith (“Plaintiff”), through his attorneys, individually and on behalf of all others

similarly situated, brings this Class Action Complaint against Defendant American Pain and 

Wellness, PLLC (“Defendant”), and its present, former, or future direct and indirect parent 

companies, subsidiaries, affiliates, agents, and/or other related entities. Plaintiff alleges the 

following on information and belief—except as to his own actions, counsel’s investigations, and 

facts of public record. 

NATURE OF ACTION 

1. This class action arises from Defendant’s failure to protect highly sensitive data.

2. Defendant is a healthcare provider specializing in back and spine pain management.

3. As such, Defendant stores a litany of highly sensitive personal identifiable

information (“PII”) and protected health information (“PHI”)—together “PII/PHI”—about its 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 1 of 32 PageID #: 1
2 

current and former patients. But Defendant lost control over that data when cybercriminals 

infiltrated its insufficiently protected computer systems in a data breach (the “Data Breach”) 

4. It is unknown for precisely how long the cybercriminals had access to Defendant’s 

network before the breach was discovered. In other words, Defendant had no effective means to 

prevent, detect, stop, or mitigate breaches of its systems—thereby allowing cybercriminals 

unrestricted access to patient PII/PHI. 

5. On information and belief, cybercriminals were able to breach Defendant’s systems 

because Defendant failed to adequately train its employees on cybersecurity and failed to maintain 

reasonable security safeguards or protocols to protect the Class’s PII/PHI. In short, Defendant’s 

failures placed the Class’s PII/PHI in a vulnerable position—rendering them easy targets for 

cybercriminals. 

6. Plaintiff is a Data Breach victim, having received a breach notice. He brings this 

class action on behalf of himself, and all others harmed by Defendant’s misconduct. 

7. The exposure of one’s PII/PHI to cybercriminals is a bell that cannot be unrung. 

Before this data breach, patients’ private information was exactly that—private. Not anymore. 

Now, patients’ private information is forever exposed and unsecure. 

PARTIES 

8. Plaintiff, Richard Smith, is natural person and citizen of Texas. He resides in North 

Richland Hills, Texas, where he intends to remain. 

9. Defendant, American Pain and Wellness, PLLC, is a Texas professional limited 

liability company located in the Sherman Division of the Eastern District of Texas. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 2 of 32 PageID #: 2
3 

JURISDICTION AND VENUE 

10. This Court has subject matter jurisdiction over this action under the Class Action 

Fairness Act, 28 U.S.C. § 1332(d)(2). The amount in controversy exceeds $5 million, exclusive of 

interest and costs. Upon information and belief, many members of the proposed class are from 

different states than Defendant. And there are over 100 putative Class members. 

11. This Court has personal jurisdiction over Defendant because it is headquartered in 

the Sherman Division of the Eastern District of Texas, regularly conducts business in Texas, and 

has sufficient minimum contacts in Texas. The registered agent for service of process is attorney 

William Meier, III, a partner at Hallett & Perrin, P.C., 1445 Ross Ave., Suite 2400, Dallas, Texas 

75201. 

12. Venue is proper in this Court because Defendant’s principal place of business is in 

this District, and because a substantial part of the events, acts, and omissions giving rise to 

Plaintiff’s claims occurred in this District. 

BACKGROUND 

Defendant Collected and Stored the PII/PHI of Plaintiff and the Class 

13. Defendant is a healthcare provider specializing in back and spine pain. It has 

multiple locations in Texas. 

14. In collecting and maintaining the PII/PHI, Defendant agreed it would safeguard the 

data in accordance with its internal policies, state law, and federal law. After all, Plaintiff and Class 

members themselves took reasonable steps to secure their PII/PHI. 

15. As part of its business, Defendant receives and maintains the PII/PHI of thousands 

of current and former patients. In doing so, Defendant implicitly promises to safeguard their 

PII/PHI. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 3 of 32 PageID #: 3
4 

16. Under state and federal law, businesses like Defendant have duties to protect 

patients’ PII/PHI and to notify them about breaches. 

17. Defendant recognizes these duties, declaring that: 

a. “We will not use or share your information with anyone except as described 

in [our] Privacy Policy;”1

 and 

b. “The security of your Personal Information is important to us;”2 

Defendant’s Data Breach 

18. On November 10, 2022, Defendant was hacked.3 But Defendant did not realize that 

it was hacked until seventeen days later on November 27, 2022.4 

19. Defendant admits that patient PII/PHI was compromised as “all files on [our] 

network, including all backups, were encrypted with malicious ransomware.”5

20. Because of Defendant’s Data Breach, at least the following types of PII/PHI were 

compromised: 

a. names; 

b. Social Security numbers; 

c. medical information; 

d. health insurance information; and 

1 Privacy Policy, AMERICAN PAIN & WELLNESS (June 30, 2015) 

https://www.painandwellness.com/privacy-policy-american-pain-and-wellness-in-texas. 

2 Id. 3 Data Breach Notifications, MAINE ATTY GEN., 

https://apps.web.maine.gov/online/aeviewer/ME/40/5f0af895-9bce-434f-86f0-

20256aa4d93c.shtml (last visited Mar. 31, 2023). 

4 Id. 5 Id. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 4 of 32 PageID #: 4
5 

e. “other” information (as vaguely reported by Defendant).6

 

21. In total, Defendant injured 7,457 persons—via the exposure of their PII/PHI—in 

the Data Breach. Upon information and belief, these 7,457 persons include current and former 

patients. 

22. And yet, Defendant waited until March 24, 2023, before it began notifying the 

class—a full 117 days after Defendant discovered its Data Breach.7 

23. Thus, Defendant kept the Class in the dark—thereby depriving the Class of the 

opportunity to try and mitigate their injuries in a timely manner. 

24. And when Defendant did notify Plaintiff and the Class of the Data Breach, 

Defendant acknowledged that their Data Breach created a present, continuing, and significant risk 

of suffering identity theft, warning Plaintiff and the Class to: 

a. “remain vigilant for incidents of fraud and identity theft by reviewing 

account statements and monitoring free credit reports;”8

b. “place a fraud alert and security freeze on one’s credit file;”9

c. “contact the Federal Trade Commission, their state Attorney General, and 

law enforcement to report attempted or actual identity theft and fraud;”10

and 

6 Data Security Breach Reports, ATTY GEN. TEXAS, 

https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage (last visited 

Mar. 31, 2023). 

7 Data Breach Notifications, MAINE ATTY GEN., 

https://apps.web.maine.gov/online/aeviewer/ME/40/5f0af895-9bce-434f-86f0-

20256aa4d93c.shtml (last visited Mar. 31, 2023). 

8 Id. 9 Id. 10 Id. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 5 of 32 PageID #: 5
6 

d. “educate yourself regarding identity theft, fraud alerts, credit freezes, and 

the steps you can take to protect your personal information by contacting 

the consumer reporting bureaus, the Federal Trade Commission, or your 

state Attorney General.”11

25. Defendant failed its duties when its inadequate security practices caused the Data 

Breach. In other words, Defendant’s negligence is evidenced by its failure to prevent the Data 

Breach and stop cybercriminals from accessing the PII/PHI. And thus, Defendant caused 

widespread injury and monetary damages. 

26. Since the breach, Defendant has been “working to implement additional safeguards 

and training to its employees.”12 But this is too little too late. Simply put, these measures—which 

Defendant now recognizes as necessary—should have been implemented before the Data Breach. 

27. On information and belief, Defendant failed to adequately train its employees on 

reasonable cybersecurity protocols or implement reasonable security measures. 

28. Further, the Notice of Data Breach shows that Defendant cannot—or will not—

determine the full scope of the Data Breach, as Defendant has been unable to determine precisely 

what information was stolen and when. 

29. Defendant has done nothing to remedy its Data Breach. Defendant has not offered 

its victims even simple credit monitoring services. Rather, Defendant blatantly disregards the 

injuries that it inflicted upon Plaintiff and the Class. 

11 Id. 12 Id. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 6 of 32 PageID #: 6
7 

30. Because of Defendant’s Data Breach, the sensitive PII/PHI of Plaintiff and Class 

members was placed into the hands of cybercriminals—inflicting numerous injuries and 

significant damages upon Plaintiff and Class members. 

Plaintiff’s Experiences and Injuries 

31. Plaintiff Richard Smith is a current patient of Defendant. He began receiving 

medical services from Defendant approximately fifteen years ago. 

32. Thus, Defendant obtained and maintained Plaintiff’s PII/PHI. 

33. As a result, Plaintiff Richard Smith was injured by Defendant’s Data Breach. 

34. As a condition of receiving medical services, Plaintiff provided Defendant with his

PII/PHI. Defendant used that PII/PHI to facilitate its provision of services and its collection of 

payment. 

35. In providing his PII/PHI to Defendant, Plaintiff trusted that Defendant would use 

reasonable measures to protect it according to Defendant’s internal policies, as well as state and 

federal law. Defendant obtained and continues to maintain Plaintiff’s PII/PHI and has a continuing 

legal duty and obligation to protect that PII/PHI from unauthorized access and disclosure. 

36. Plaintiff reasonably understood that a portion of the funds paid to Defendant would 

be used to pay for adequate cybersecurity and protection of PII/PHI. 

37. Plaintiff received a Notice of Data Breach on March 28, 2023. 

38. Through its Data Breach, Defendant compromised Plaintiff’s: 

a. name; 

b. home address; 

c. date of birth; 

d. Social Security number; 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 7 of 32 PageID #: 7
8 

e. medical history; 

f. health insurance information; 

g. treating physician; and 

h. diagnosis information. 

39. Plaintiff has spent—and will continue to spend—significant time and effort 

monitoring his accounts to protect himself from identity theft. After all, Defendant directed 

Plaintiff to take those steps in its breach notice. 

40. Plaintiff fears for his personal financial security and worries about what information 

was exposed in the Data Breach. 

41. Because of Defendant’s Data Breach, Plaintiff has suffered—and will continue to 

suffer from—anxiety, sleep disruption, stress, fear, and frustration. Such injuries go far beyond 

allegations of mere worry or inconvenience. Rather, Plaintiff’s injuries are precisely the type of 

injuries that the law contemplates and addresses. 

42. Plaintiff suffered actual injury from the exposure and theft of his PII/PHI—which 

violates his rights to privacy. 

43. Plaintiff suffered actual injury in the form of damages to and diminution in the 

value of his PII/PHI. After all, PII/PHI is a form of intangible property—property that Defendant 

was required to adequately protect. 

44. Plaintiff suffered imminent and impending injury arising from the substantially 

increased risk of fraud, misuse, and identity theft—all because Defendant’s Data Breach placed 

Plaintiff’s PII/PHI right in the hands of criminals. 

45. Because of the Data Breach, Plaintiff anticipates spending considerable amounts of 

time and money to try and mitigate his injuries. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 8 of 32 PageID #: 8
9 

46. Today, Plaintiff has a continuing interest in ensuring that his PII/PHI—which, upon 

information and belief, remains backed up in Defendant’s possession—is protected and 

safeguarded from additional breaches. 

Plaintiff and the Proposed Class Face Significant Risk of Continued Identity Theft 

47. Because of Defendant’s failure to prevent the Data Breach, Plaintiff and Class 

members suffered—and will continue to suffer—damages. These damages include, inter alia, 

monetary losses, lost time, anxiety, and emotional distress. Also, they suffered or are at an 

increased risk of suffering: 

a. loss of the opportunity to control how their PII/PHI is used; 

b. diminution in value of their PII/PHI; 

c. compromise and continuing publication of their PII/PHI; 

d. out-of-pocket costs from trying to prevent, detect, and recovery from 

identity theft and fraud; 

e. lost opportunity costs and wages from spending time trying to mitigate the 

fallout of the Data Breach by, inter alia, preventing, detecting, contesting, 

and recovering from identify theft and fraud; 

f. delay in receipt of tax refund monies; 

g. unauthorized use of their stolen PII/PHI; and 

h. continued risk to their PII/PHI—which remains in Defendant’s 

possession—and is thus as risk for futures breaches so long as Defendant 

fails to take appropriate measures to protect the PII/PHI. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 9 of 32 PageID #: 9
10 

48. Stolen PII/PHI is one of the most valuable commodities on the criminal information 

black market. According to Experian, a credit-monitoring service, stolen PII/PHI can be worth up 

to $1,000.00 depending on the type of information obtained. 

49. The value of Plaintiff and Class’s PII/PHI on the black market is considerable. 

Stolen PII/PHI trades on the black market for years. And criminals frequently post and sell stolen 

information openly and directly on the “dark web”—further exposing the information. 

50. It can take victims years to discover such identity theft and fraud. This gives 

criminals plenty of time to sell the PII/PHI far and wide. 

51. One way that criminals profit from stolen PII/PHI is by creating comprehensive 

dossiers on individuals called “Fullz” packages. These dossiers are both shockingly accurate and 

comprehensive. Criminals create them by cross-referencing and combining two sources of data—

first the stolen PII/PHI, and second, unregulated data found elsewhere on the internet (like phone 

numbers, emails, addresses, etc.). 

52. The development of “Fullz” packages means that the PII/PHI exposed in the Data 

Breach can easily be linked to data of Plaintiff and the Class that is available on the internet. 

53. In other words, even if certain information such as emails, phone numbers, or credit 

card numbers may not be included in the PII/PHI stolen by the cyber-criminals in the Data Breach, 

criminals can easily create a Fullz package and sell it at a higher price to unscrupulous operators 

and criminals (such as illegal and scam telemarketers) over and over. That is exactly what is 

happening to Plaintiff and Class members, and it is reasonable for any trier of fact, including this 

Court or a jury, to find that Plaintiff and other Class members’ stolen PII/PHI is being misused, 

and that such misuse is fairly traceable to the Data Breach. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 10 of 32 PageID #: 10
11 

54. Defendant disclosed the PII/PHI of Plaintiff and Class members for criminals to 

use in the conduct of criminal activity. Specifically, Defendant opened up, disclosed, and exposed 

the PII/PHI of Plaintiff and Class members to people engaged in disruptive and unlawful business 

practices and tactics, including online account hacking, unauthorized use of financial accounts, 

and fraudulent attempts to open unauthorized financial accounts (i.e., identity fraud), all using the 

stolen PII/PHI. 

55. Defendant’s failure to promptly and properly notify Plaintiff and Class members of 

the Data Breach exacerbated Plaintiff and Class members’ injury by depriving them of the earliest 

ability to take appropriate measures to protect their PII/PHI and take other necessary steps to 

mitigate the harm caused by the Data Breach. 

Defendant Knew—Or Should Have Known—of the Risk of a Data Breach 

56. Defendant’s data security obligations were particularly important given the 

substantial increase in cyberattacks and or data breaches in recent years. 

57. In 2021, a record 1,862 data breaches occurred, exposing approximately 

293,927,708 sensitive records—a 68% increase from 2020.13 Of the 1,862 recorded data breaches, 

330 of them, or 17.7% were in the medical or healthcare industry.14 Those 330 reported breaches 

exposed nearly 30 million sensitive records (28,045,658), compared to only 306 breaches that 

exposed nearly 10 million sensitive records (9,700,238) in 2020.15

58. Indeed, cyberattacks have become so notorious that the Federal Bureau of 

Investigation (“FBI”) and U.S. Secret Service issue warnings to potential targets, so they are aware 

13 See 2021 Data Breach Annual Report, IDENTITY THEFT RESOURCE CENTER (Jan. 2022) 

https://notified.idtheftcenter.org/s/. 

14 Id. 15 Id. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 11 of 32 PageID #: 11
12 

of, and prepared for, a potential attack. As one report explained, “[e]ntities like smaller 

municipalities and hospitals are attractive to ransomware criminals . . . because they often have 

lesser IT defenses and a high incentive to regain access to their data quickly.”16

59. In fact, according to the cybersecurity firm Mimecast, 90% of healthcare 

organizations experienced cyberattacks in the past year.17

60. Therefore, the increase in such attacks, and attendant risk of future attacks, was 

widely known to the public and to anyone in Defendant’s industry, including Defendant. 

Defendant Failed to Follow FTC Guidelines 

61. According to the Federal Trade Commission (“FTC”), the need for data security 

should be factored into all business decision-making. Thus, the FTC issued numerous guidelines 

identifying best data security practices that businesses—like Defendant—should use to protect 

against unlawful data exposure. 

62. In 2016, the FTC updated its publication, Protecting Personal Information: A 

Guide for Business. There, the FTC set guidelines for what data security principles and practices 

businesses must use.18 The FTC declared that, inter alia, businesses must: 

a. protect the personal customer information that they keep; 

b. properly dispose of personal information that is no longer needed; 

c. encrypt information stored on computer networks; 

16 Ben Kochman, FBI, Secret Service Warn of Targeted Ransomware, LAW360 (Nov. 18, 

2019), https://www.law360.com/articles/1220974/fbi-secret-service-warn-of-targetedransomware.

17 See Maria Henriquez, Iowa City Hospital Suffers Phishing Attack, SECURITY MAGAZINE (Nov. 

23, 2020), https://www.securitymagazine.com/articles/93988-iowa-city-hospital-suffersphishing-attack (last visited July 31, 2022). 

18 Protecting Personal Information: A Guide for Business, FEDERAL TRADE COMMISSION

(Oct. 2016) https://www.ftc.gov/system/files/documents/plain-language/pdf-0136_protetingpersonal-information.pdf. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 12 of 32 PageID #: 12
13 

d. understand their network’s vulnerabilities; and 

e. implement policies to correct security problems. 

63. The guidelines also recommend that businesses watch for the transmission of large 

amounts of data out of the system—and then have a response plan ready for such a breach. 

64. Furthermore, the FTC explains that companies must: 

a. not maintain information longer than is needed to authorize a transaction; 

b. limit access to sensitive data; 

c. require complex passwords to be used on networks; 

d. use industry-tested methods for security; 

e. monitor for suspicious activity on the network; and 

f. verify that third-party service providers use reasonable security measures. 

65. The FTC brings enforcement actions against businesses for failing to protect 

customer data adequately and reasonably. Thus, the FTC treats the failure—to use reasonable and 

appropriate measures to protect against unauthorized access to confidential consumer data—as an 

unfair act or practice prohibited by Section 5 of the Federal Trade Commission Act (“FTCA”), 15 

U.S.C. § 45. Orders resulting from these actions further clarify the measures businesses must take 

to meet their data security obligations. 

66. In short, Defendant’s failure to use reasonable and appropriate measures to protect 

against unauthorized access to patients’ data constitutes an unfair act or practice prohibited by 

Section 5 of the FTCA, 15 U.S.C. § 45. 

Defendant Failed to Follow Industry Standards 

67. Several best practices have been identified that—at a minimum—should be 

implemented by businesses like Defendant. These industry standards include: educating all 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 13 of 32 PageID #: 13
14 

employees; strong passwords; multi-layer security, including firewalls, anti-virus, and antimalware software; encryption (making data unreadable without a key); multi-factor authentication; 

backup data; and limiting which employees can access sensitive data. 

68. Other industry standard best practices include: installing appropriate malware 

detection software; monitoring and limiting the network ports; protecting web browsers and email 

management systems; setting up network systems such as firewalls, switches, and routers; 

monitoring and protection of physical security systems; protection against any possible 

communication system; and training staff regarding critical points. 

69. Defendant failed to meet the minimum standards of any of the following 

frameworks: the NIST Cybersecurity Framework Version 1.1 (including without limitation 

PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.AT-1, PR.DS-1, PR.DS-5, 

PR.PT-1, PR.PT-3, DE.CM-1, DE.CM-4, DE.CM-7, DE.CM-8, and RS.CO-2), and the Center for 

Internet Security’s Critical Security Controls (CIS CSC), which are all established standards in 

reasonable cybersecurity readiness. 

70. These frameworks are applicable and accepted industry standards. And by failing 

to comply with these accepted standards, Defendant opened the door to the criminals—thereby 

causing the Data Breach. 

Defendant Violated HIPAA 

71. HIPAA circumscribes security provisions and data privacy responsibilities 

designed to keep patients’ medical information safe. HIPAA compliance provisions, commonly 

known as the Administrative Simplification Rules, establish national standards for electronic 

transactions and code sets to maintain the privacy and security of protected health information.19

19 HIPAA lists 18 types of information that qualify as PHI according to guidance from the 

Department of Health and Human Services Office for Civil Rights, and includes, inter alia: names, 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 14 of 32 PageID #: 14
15 

72. HIPAA provides specific privacy rules that require comprehensive administrative, 

physical, and technical safeguards to ensure the confidentiality, integrity, and security of PII/PHI 

and PHI is properly maintained.20

73. The Data Breach itself resulted from a combination of inadequacies showing 

Defendant failed to comply with safeguards mandated by HIPAA. Defendant’s security failures 

include, but are not limited to: 

a. failing to ensure the confidentiality and integrity of electronic PHI that it 

creates, receives, maintains and transmits in violation of 45 C.F.R. § 

164.306(a)(1); 

b. failing to protect against any reasonably-anticipated threats or hazards to 

the security or integrity of electronic PHI in violation of 45 C.F.R. § 

164.306(a)(2); 

c. failing to protect against any reasonably anticipated uses or disclosures of 

electronic PHI that are not permitted under the privacy rules regarding 

individually identifiable health information in violation of 45 C.F.R. § 

164.306(a)(3); 

d. failing to ensure compliance with HIPAA security standards by Defendant’s 

workforce in violation of 45 C.F.R. § 164.306(a)(4); 

e. failing to implement technical policies and procedures for electronic 

information systems that maintain electronic PHI to allow access only to 

addresses, any dates including dates of birth, Social Security numbers, and medical record 

numbers. 

20 See 45 C.F.R. § 164.306 (security standards and general rules); 45 C.F.R. § 164.308 

(administrative safeguards); 45 C.F.R. § 164.310 (physical safeguards); 45 C.F.R. § 164.312 

(technical safeguards). 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 15 of 32 PageID #: 15
16 

those persons or software programs that have been granted access rights in 

violation of 45 C.F.R. § 164.312(a)(1); 

f. failing to implement policies and procedures to prevent, detect, contain and 

correct security violations in violation of 45 C.F.R. § 164.308(a)(1); 

g. failing to identify and respond to suspected or known security incidents and 

failing to mitigate, to the extent practicable, harmful effects of security 

incidents that are known to the covered entity in violation of 45 C.F.R. § 

164.308(a)(6)(ii); 

h. failing to effectively train all staff members on the policies and procedures 

with respect to PHI as necessary and appropriate for staff members to carry 

out their functions and to maintain security of PHI in violation of 45 C.F.R. 

§ 164.530(b) and 45 C.F.R. § 164.308(a)(5); and 

i. failing to design, implement, and enforce policies and procedures 

establishing physical and administrative safeguards to reasonably safeguard 

PHI, in compliance with 45 C.F.R. § 164.530(c). 

74. Simply put, the Data Breach resulted from a combination of insufficiencies that 

demonstrate Defendant failed to comply with safeguards mandated by HIPAA regulations. 

CLASS ACTION ALLEGATIONS 

75. Plaintiff brings this class action under Fed. R. Civ. P. 23(a), 23(b)(2), and 23(b)(3), 

individually and on behalf of all members of the following class: 

All individuals residing in the United States whose PII/PHI was 

compromised in the Data Breach discovered by American Pain and 

Wellness, PLLC in November 2022. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 16 of 32 PageID #: 16
17 

76. Excluded from the Class are Defendant, its agents, affiliates, parents, subsidiaries, 

any entity in which Defendant has a controlling interest, any Defendant officer or director, any 

successor or assign, and any Judge who adjudicates this case, including their staff and immediate 

family. 

77. Plaintiff reserves the right to amend the class definition. 

78. Certification of Plaintiff’s claims for class-wide treatment is appropriate because 

Plaintiff can prove the elements of his claims on class-wide bases using the same evidence as 

would be used to prove those elements in individual actions asserting the same claims. 

79. Ascertainability. All members of the proposed Class are readily ascertainable from 

information in Defendant’s custody and control. After all, Defendant already identified some 

individuals and sent them data breach notices. 

80. Numerosity. The Class members are so numerous that joinder of all Class members 

is impracticable. Upon information and belief, the proposed Class includes at least 7,457 members. 

81. Typicality. Plaintiff’s claims are typical of Class members’ claims as each arises 

from the same Data Breach, the same alleged violations by Defendant, and the same unreasonable 

manner of notifying individuals about the Data Breach. 

82. Adequacy. Plaintiff will fairly and adequately protect the proposed Class’s 

common interests. his interests do not conflict with Class members’ interests. And Plaintiff has 

retained counsel—including lead counsel—that is experienced in complex class action litigation 

and data privacy to prosecute this action on the Class’s behalf. 

83. Commonality and Predominance. Plaintiff and the Class’s claims raise 

predominantly common fact and legal questions—which predominate over any questions affecting 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 17 of 32 PageID #: 17
18 

individual Class members—for which a class wide proceeding can answer for all Class members. 

In fact, a class wide proceeding is necessary to answer the following questions: 

a. if Defendant had a duty to use reasonable care in safeguarding Plaintiff’s 

and the Class’s PII/PHI; 

b. if Defendant failed to implement and maintain reasonable security 

procedures and practices appropriate to the nature and scope of the 

information compromised in the Data Breach; 

c. if Defendant were negligent in maintaining, protecting, and securing 

PII/PHI; 

d. if Defendant breached contract promises to safeguard Plaintiff and the 

Class’s PII/PHI; 

e. if Defendant took reasonable measures to determine the extent of the Data 

Breach after discovering it; 

f. if Defendant’s Breach Notice was reasonable; 

g. if the Data Breach caused Plaintiff and the Class injuries; 

h. what the proper damages measure is; and 

i. if Plaintiff and the Class are entitled to damages, treble damages, and or 

injunctive relief. 

84. Superiority. A class action is superior to all other available means for the fair and 

efficient adjudication of this controversy. The damages or other financial detriment suffered by 

individual Class members are relatively small compared to the burden and expense that individual 

litigation against Defendant would require. Thus, it would be practically impossible for Class 

members, on an individual basis, to obtain effective redress for their injuries. Not only would 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 18 of 32 PageID #: 18
19 

individualized litigation increase the delay and expense to all parties and the courts, but 

individualized litigation would also create the danger of inconsistent or contradictory judgments 

arising from the same set of facts. By contrast, the class action device provides the benefits of 

adjudication of these issues in a single proceeding, ensures economies of scale, provides 

comprehensive supervision by a single court, and presents no unusual management difficulties. 

FIRST CAUSE OF ACTION 

Negligence 

(On Behalf of Plaintiff and the Class) 

85. Plaintiff incorporates by reference all other paragraphs as if fully set forth herein. 

86. Plaintiff and the Class entrusted their PII/PHI to Defendant on the premise and with 

the understanding that Defendant would safeguard their PII/PHI, use their PII/PHI for business 

purposes only, and/or not disclose their PII/PHI to unauthorized third parties. 

87. Defendant owed a duty of care to Plaintiff and Class members because it was 

foreseeable that Defendant’s failure—to use adequate data security in accordance with industry 

standards for data security—would compromise their PII/PHI in a data breach. And here, that 

foreseeable danger came to pass. 

88. Defendant has full knowledge of the sensitivity of the PII/PHI and the types of harm 

that Plaintiff and the Class could and would suffer if their PII/PHI was wrongfully disclosed. 

89. Defendant owed these duties to Plaintiff and Class members because they are 

members of a well-defined, foreseeable, and probable class of individuals whom Defendant knew 

or should have known would suffer injury-in-fact from Defendant’s inadequate security practices. 

After all, Defendant actively sought and obtained Plaintiff and Class members’ PII/PHI. 

90. Defendant owed—to Plaintiff and Class members—at least the following duties to: 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 19 of 32 PageID #: 19
20 

a. exercise reasonable care in handling and using the PII/PHI in its care and 

custody; 

b. implement industry-standard security procedures sufficient to reasonably 

protect the information from a data breach, theft, and unauthorized; 

c. promptly detect attempts at unauthorized access; 

d. notify Plaintiff and Class members within a reasonable timeframe of any 

breach to the security of their PII/PHI. 

91. Thus, Defendant owed a duty to timely and accurately disclose to Plaintiff and 

Class members the scope, nature, and occurrence of the Data Breach. After all, this duty is required 

and necessary for Plaintiff and Class members to take appropriate measures to protect their 

PII/PHI, to be vigilant in the face of an increased risk of harm, and to take other necessary steps to 

mitigate the harm caused by the Data Breach. 

92. Defendant also had a duty to exercise appropriate clearinghouse practices to remove 

PII/PHI it was no longer required to retain under applicable regulations. 

93. Defendant knew or reasonably should have known that the failure to exercise due 

care in the collecting, storing, and using of the PII/PHI of Plaintiff and the Class involved an 

unreasonable risk of harm to Plaintiff and the Class, even if the harm occurred through the criminal 

acts of a third party. 

94. Defendant’s duty to use reasonable security measures arose because of the special 

relationship that existed between Defendant and Plaintiff and the Class. That special relationship 

arose because Plaintiff and the Class entrusted Defendant with their confidential PII/PHI, a 

necessary part of obtaining services from Defendant. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 20 of 32 PageID #: 20
21 

95. The risk that unauthorized persons would attempt to gain access to the PII/PHI and 

misuse it was foreseeable. Given that Defendant holds vast amounts of PII/PHI, it was inevitable 

that unauthorized individuals would attempt to access Defendant’s databases containing the 

PII/PHI —whether by malware or otherwise. 

96. PII/PHI is highly valuable, and Defendant knew, or should have known, the risk in 

obtaining, using, handling, emailing, and storing the PII/PHI of Plaintiff and Class members’ and 

the importance of exercising reasonable care in handling it. 

97. Defendant improperly and inadequately safeguarded the PII/PHI of Plaintiffs and 

the Class in deviation of standard industry rules, regulations, and practices at the time of the Data 

Breach. 

98. Defendant breached these duties as evidenced by the Data Breach. 

99. Defendant acted with wanton and reckless disregard for the security and 

confidentiality of Plaintiff and Class members’ PII/PHI by: 

a. disclosing and providing access to this information to third parties and 

b. failing to properly supervise both the way the PII/PHI was stored, used, and 

exchanged, and those in its employ who were responsible for making that 

happen. 

100. Defendant breached its duties by failing to exercise reasonable care in supervising 

its agents, contractors, vendors, and suppliers, and in handling and securing the personal 

information and PII/PHI of Plaintiff and Class members which actually and proximately caused 

the Data Breach and Plaintiff and Class members’ injury. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 21 of 32 PageID #: 21
22 

101. Defendant further breached its duties by failing to provide reasonably timely notice 

of the Data Breach to Plaintiff and Class members, which actually and proximately caused and 

exacerbated the harm from the Data Breach and Plaintiff and Class members’ injuries-in-fact. 

102. Defendant has admitted that the PII/PHI of Plaintiff and the Class was wrongfully 

lost and disclosed to unauthorized third persons because of the Data Breach. 

103. As a direct and traceable result of Defendant’s negligence and/or negligent 

supervision, Plaintiff and Class members have suffered or will suffer damages, including monetary 

damages, increased risk of future harm, embarrassment, humiliation, frustration, and emotional 

distress. 

104. Defendant’s breach of its common-law duties to exercise reasonable care and its 

failures and negligence actually and proximately caused Plaintiff and Class members actual, 

tangible, injury-in-fact and damages, including, without limitation, the theft of their PII/PHI by 

criminals, improper disclosure of their PII/PHI, lost benefit of their bargain, lost value of their 

PII/PHI, and lost time and money incurred to mitigate and remediate the effects of the Data Breach 

that resulted from and were caused by Defendant’s negligence, which injury-in-fact and damages 

are ongoing, imminent, immediate, and which they continue to face. 

SECOND CAUSE OF ACTION 

Negligence per se

(On Behalf of Plaintiff and the Class) 

105. Plaintiff incorporates by reference all other paragraphs as if fully set forth herein. 

106. Under the FTC Act, 15 U.S.C. § 45, Defendant had a duty to use fair and adequate 

computer systems and data security practices to safeguard Plaintiff and Class members’ PII/PHI. 

107. Section 5 of the FTC Act prohibits “unfair . . . practices in or affecting commerce,” 

including, as interpreted and enforced by the FTC, the unfair act or practice by businesses, such as 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 22 of 32 PageID #: 22
23 

Defendant, of failing to use reasonable measures to protect the PII/PHI entrusted to it. The FTC 

publications and orders promulgated pursuant to the FTC Act also form part of the basis of 

Defendant’s duty to protect Plaintiff and the Class members’ sensitive PII/PHI. 

108. Defendant breached its respective duties to Plaintiff and Class members under the 

FTC Act by failing to provide fair, reasonable, or adequate computer systems and data security 

practices to safeguard PII/PHI. 

109. Defendant violated its duty under Section 5 of the FTC Act by failing to use 

reasonable measures to protect PII/PHI and not complying with applicable industry standards as 

described in detail herein. Defendant’s conduct was particularly unreasonable given the nature and 

amount of PII/PHI Defendant had collected and stored and the foreseeable consequences of a data 

breach, including, specifically, the immense damages that would result to individuals in the event 

of a breach, which ultimately came to pass. 

110. The harm that has occurred is the type of harm the FTC Act is intended to guard 

against. Indeed, the FTC has pursued numerous enforcement actions against businesses that, 

because of their failure to employ reasonable data security measures and avoid unfair and deceptive 

practices, caused the same harm as that suffered by Plaintiff and members of the Class. 

111. But for Defendant’s wrongful and negligent breach of its duties owed, Plaintiff and 

Class members would not have been injured. 

112. The injury and harm suffered by Plaintiff and Class members was the reasonably 

foreseeable result of Defendant’s breach of their duties. Defendant knew or should have known 

that Defendant was failing to meet its duties and that its breach would cause Plaintiff and members 

of the Class to suffer the foreseeable harms associated with the exposure of their PII/PHI. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 23 of 32 PageID #: 23
24 

113. Similarly, under HIPAA, Defendant had a duty to follow HIPAA standards for 

privacy and security practices—as to protect Plaintiff’s and Class members’ PHI. 

114. Defendant violated its duty under HIPAA by failing to use reasonable measures to 

protect its PHI and by not complying with applicable regulations detailed supra. Here too, 

Defendant’s conduct was particularly unreasonable given the nature and amount of PHI that 

Defendant collected and stored and the foreseeable consequences of a data breach, including, 

specifically, the immense damages that would result to individuals in the event of a breach, which 

ultimately came to pass. 

115. Defendant’s various violations and its failure to comply with applicable laws and 

regulations constitutes negligence per se. 

116. As a direct and proximate result of Defendant’s negligence per se, Plaintiff and 

Class members have suffered and will continue to suffer numerous injuries (as detailed supra). 

THIRD CAUSE OF ACTION 

Breach of Implied Contract 

(On Behalf of Plaintiff and the Class) 

117. Plaintiff incorporates by reference all other paragraphs as if fully set forth herein. 

118. Plaintiff and Class members were required to provide their PII/PHI to Defendant as 

a condition of receiving medical services provided by Defendant. Plaintiff and Class members 

provided their PII/PHI to Defendant or its third-party agents in exchange for Defendant’s medical 

services. 

119. Plaintiff and Class members reasonably understood that a portion of the funds they 

paid Defendant would be used to pay for adequate cybersecurity measures. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 24 of 32 PageID #: 24
25 

120. Plaintiff and Class members reasonably understood that Defendant would use 

adequate cybersecurity measures to protect the PII/PHI that they were required to provide based 

on Defendant’s duties under state and federal law and its internal policies. 

121. Plaintiff and the Class members accepted Defendant’s offers by disclosing their 

PII/PHI to Defendant or its third-party agents in exchange for medical services. 

122. In turn, and through internal policies, Defendant agreed to protect and not disclose 

the PII/PHI to unauthorized persons. 

123. In its Privacy Policy, Defendant represented that they had a legal duty to protect 

Plaintiff’s and Class Member’s PII/PHI. 

124. Implicit in the parties’ agreement was that Defendant would provide Plaintiff and 

Class members with prompt and adequate notice of all unauthorized access and/or theft of their 

PII/PHI. 

125. After all, Plaintiff and Class members would not have entrusted their PII/PHI to 

Defendant or its third-party agents in the absence of such an agreement with Defendant. 

126. Plaintiff and the Class fully performed their obligations under the implied 

contracts with Defendant. 

127. The covenant of good faith and fair dealing is an element of every contract. Thus, 

parties must act with honesty in fact in the conduct or transactions concerned. Good faith and fair 

dealing, in connection with executing contracts and discharging performance and other duties 

according to their terms, means preserving the spirit—and not merely the letter—of the bargain. 

In short, the parties to a contract are mutually obligated to comply with the substance of their 

contract in addition to its form. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 25 of 32 PageID #: 25
26 

128. Subterfuge and evasion violate the duty of good faith in performance even when an 

actor believes their conduct to be justified. Bad faith may be overt or consist of inaction. And fair 

dealing may require more than honesty. 

129. Defendant materially breached the contracts it entered with Plaintiff and Class 

members by: 

a. failing to safeguard their information; 

b. failing to notify them promptly of the intrusion into its computer systems 

that compromised such information. 

c. failing to comply with industry standards; 

d. failing to comply with the legal obligations necessarily incorporated into 

the agreements; and 

e. failing to ensure the confidentiality and integrity of the electronic PII/PHI 

that Defendant created, received, maintained, and transmitted. 

130. In these and other ways, Defendant violated its duty of good faith and fair dealing. 

131. Defendant’s material breaches were the direct and proximate cause of Plaintiff and 

Class members’ injuries (as detailed supra). 

132. Plaintiff and Class members performed as required under the relevant agreements, 

or such performance was waived by Defendant’s conduct. 

FOURTH CAUSE OF ACTION 

Breach of Fiduciary Duty 

(On Behalf of Plaintiff and the Class) 

133. Plaintiff incorporates by reference all other paragraphs as if fully set forth herein. 

134. Given the relationship between Defendant and Plaintiff and Class members, where 

Defendant became guardian of Plaintiff and Class members' PII/PHI, Defendant became a 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 26 of 32 PageID #: 26
27 

fiduciary by its undertaking and guardianship of the PII/PHI, to act primarily for Plaintiff and Class 

members, (1) for the safeguarding of Plaintiff and Class members' PII/PHI; (2) to timely notify 

Plaintiff and Class members of a Data Breach and disclosure; and (3) to maintain complete and 

accurate records of what information (and where) Defendant did and does store. 

135. Defendant has a fiduciary duty to act for the benefit of Plaintiff and Class members 

upon matters within the scope of Defendant’s relationship with them—especially to secure their 

PII/PHI. 

136. Because of the highly sensitive nature of the PII/PHI, Plaintiff and Class members 

would not have entrusted Defendant, or anyone in Defendant’s position, to retain their PII/PHI had 

they known the reality of Defendant’s inadequate data security practices. 

137. Defendant breached its fiduciary duties to Plaintiff and Class members by failing 

to sufficiently encrypt or otherwise protect Plaintiff and Class members' PII/PHI. 

138. Defendant also breached its fiduciary duties to Plaintiff and Class members by 

failing to diligently discover, investigate, and give notice of the Data Breach in a reasonable and 

practicable period. 

139. As a direct and proximate result of Defendant's breach of its fiduciary duties, 

Plaintiff and Class members have suffered and will continue to suffer numerous injuries (as 

detailed supra). 

FIFTH CAUSE OF ACTION 

Intrusion upon Seclusion/Invasion of Privacy 

(On Behalf of Plaintiff and the Class) 

140. Plaintiff incorporates by reference all other paragraphs as if fully set forth herein. 

141. The State of Texas recognizes the tort of Intrusion upon Seclusion, and adopts the 

formulation of that tort found in the Restatement (Second) of Torts, which states: 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 27 of 32 PageID #: 27
28 

One who intentionally intrudes, physically or otherwise, upon the 

solitude or seclusion of another or his private affairs or 

concerns, is subject to liability to the other for invasion of his 

privacy, if the intrusion would be highly offensive to a 

reasonable person. 

Restatement (Second) of Torts§ 652B (1977). 

142. Plaintiff and the Class had a legitimate expectation of privacy regarding their highly 

sensitive and confidential PII/PHI and were accordingly entitled to the protection of this 

information against disclosure to unauthorized third parties. 

143. Defendant owed a duty to its current and former patients, including Plaintiff and 

the Class, to keep this information confidential. 

144. The unauthorized acquisition (i.e., theft) by a third party of Plaintiff and Class 

members’ PII/PHI is highly offensive to a reasonable person. 

145. The intrusion was into a place or thing which was private and entitled to be private. 

Plaintiff and the Class disclosed their sensitive and confidential information to Defendant, but did 

so privately, with the intention that their information would be kept confidential and protected 

from unauthorized disclosure. Plaintiff and the Class were reasonable in their belief that such 

information would be kept private and would not be disclosed without their authorization. 

146. The Data Breach constitutes an intentional interference with Plaintiff and the 

Class’s interest in solitude or seclusion, either as to their person or as to their private affairs or 

concerns, of a kind that would be highly offensive to a reasonable person. 

147. Defendant acted with a knowing state of mind when it permitted the Data Breach 

because it knew its information security practices were inadequate. 

148. Defendant acted with a knowing state of mind when it failed to notify Plaintiff and 

the Class in a timely fashion about the Data Breach, thereby materially impairing their mitigation 

efforts. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 28 of 32 PageID #: 28
29 

149. Acting with knowledge, Defendant had notice and knew that its inadequate 

cybersecurity practices would cause injury to Plaintiff and the Class. 

150. As a proximate result of Defendant’s acts and omissions, the private and sensitive 

PII/PHI of Plaintiff and the Class were stolen by a third party and is now available for disclosure 

and redisclosure without authorization, causing Plaintiff and the Class to suffer damages (as 

detailed supra). 

151. Unless and until enjoined and restrained by order of this Court, Defendant’s 

wrongful conduct will continue to cause great and irreparable injury to Plaintiff and the Class since 

their PII/PHI are still maintained by Defendant with their inadequate cybersecurity system and 

policies. 

152. Plaintiff and the Class have no adequate remedy at law for the injuries relating to 

Defendant’s continued possession of their sensitive and confidential records. A judgment for 

monetary damages will not end Defendant’s inability to safeguard the PII/PHI of Plaintiff and the 

Class. 

153. In addition to injunctive relief, Plaintiff, on behalf of himself and the other Class 

members, also seeks compensatory damages for Defendant’s invasion of privacy, which includes 

the value of the privacy interest invaded by Defendant, the costs of future monitoring of their credit 

history for identity theft and fraud, plus prejudgment interest and costs. 

SIXTH CAUSE OF ACTION 

Unjust Enrichment 

(On Behalf of Plaintiff and the Class) 

154. Plaintiff incorporates by reference all other paragraphs as if fully set forth herein. 

155. This claim is pleaded in the alternative to the breach of implied contract claim. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 29 of 32 PageID #: 29
30 

156. Plaintiff and Class members conferred a benefit upon Defendant. After all, 

Defendant benefitted from using their PII/PHI to facilitate its provision of services and its 

collection of payment. 

157. Defendant appreciated or had knowledge of the benefits it received from Plaintiff 

and Class members. And Defendant benefited from receiving Plaintiff and Class members’ 

PII/PHI, as this was used to facilitate its provision of services and its collection of payment. 

158. Plaintiff and Class members reasonably understood that Defendant would use 

adequate cybersecurity measures to protect the PII/PHI that they were required to provide based 

on Defendant’s duties under state and federal law and its internal policies. 

159. Defendant enriched itself by saving the costs they reasonably should have expended 

on data security measures to secure Plaintiff’s and Class members’ PII/PHI. 

160. Instead of providing a reasonable level of security, or retention policies, that would 

have prevented the Data Breach, Defendant instead calculated to avoid its data security obligations 

at the expense of Plaintiff and Class members by utilizing cheaper, ineffective security measures. 

Plaintiff and Class members, on the other hand, suffered as a direct and proximate result of 

Defendant’s failure to provide the requisite security. 

161. Under principles of equity and good conscience, Defendant should not be permitted 

to retain the full value of Plaintiff and Class members’ payment because Defendant failed to 

adequately protect their PII/PHI. 

162. Plaintiff and Class members have no adequate remedy at law. 

163. Defendant should be compelled to disgorge into a common fund—for the benefit 

of Plaintiff and Class members—all unlawful or inequitable proceeds that it received because of 

its misconduct. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 30 of 32 PageID #: 30
31 

164.

PRAYER FOR RELIEF 

Plaintiff and Class members respectfully request judgment against Defendant and that the 

Court enter an order: 

A. Certifying this case as a class action on behalf of Plaintiff and the proposed Class, 

appointing Plaintiff as class representative, and appointing his counsel to represent 

the Class; 

B. Awarding declaratory and other equitable relief as necessary to protect the interests 

of Plaintiff and the Class; 

C. Awarding injunctive relief as necessary to protect the interests of Plaintiff and the 

Class; 

D. Awarding Plaintiff and the Class damages including applicable compensatory, 

exemplary, punitive damages, and statutory damages, as allowed by law; 

E. Awarding restitution and damages to Plaintiff and the Class in an amount to be 

determined at trial; 

F. Awarding attorneys’ fees and costs, as allowed by law; 

G. Awarding prejudgment and post-judgment interest, as provided by law; 

H. Granting Plaintiff and the Class leave to amend this complaint to conform to the 

evidence produced at trial; and 

I. Granting other relief that this Court finds appropriate. 

DEMAND FOR JURY TRIAL 

Plaintiff demands a jury trial for all claims so triable. 

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 31 of 32 PageID #: 31
32 

Date: April 5, 2023 Respectfully submitted, 

 /s/ Joe Kendall 

 JOE KENDALL

Texas Bar No. 11260700 

KENDALL LAW GROUP, PLLC 

3811 Turtle Creek Blvd., Suite 1450 

Dallas, Texas 75219 

214-744-3000 / 214-744-3015 (Facsimile) 

jkendall@kendalllawgroup.com 

TURKE & STRAUSS LLP 

Samuel J. Strauss (pro hac vice to be filed) 

Raina Borrelli (pro hac vice to be filed) 

613 Williamson Street, Suite 201 

Madison, Wisconsin 53703 

Telephone: (608) 237-1775 

Facsimile: (608) 509-4423 

sam@turkestrauss.com 

raina@turkestrauss.com 

Attorneys for Plaintiff and Proposed Class

Case 4:23-cv-00295-ALM Document 1 Filed 04/05/23 Page 32 of 32 PageID #: 32