United States District Court

EASTERN DISTRICT OF TEXAS

SHERMAN DIVISION

RICHARD SMITH and SHAE LOFTICE, 

on behalf of themselves and all others 

similarly situated,

Plaintiffs,

v.

AMERICAN PAIN AND WELLNESS,

PLLC,

Defendant.

§

§

§

§

§

§

§

§

§

§

§

§

Civil Action No. 4:23-CV-295

Judge Mazzant

MEMORANDUM OPINION AND ORDER

Pending before the Court is Defendant’s Rule 12(b)(1) and (6) Motion to Dismiss

(Dkt. #8). Having considered the motion and the relevant pleadings, the Court finds that the 

motion should be GRANTED in part and DENIED in part.

BACKGROUND

Defendant American Pain and Wellness, PLLC (“American Pain”) is a healthcare provider

(Dkt. #4 at p. 3). As part of its operations, American Pain collects and maintains personal 

identifiable information (“PII”) and protected health information (“PHI”) (collectively, 

“PII/PHI”) about current and former patients seen at itsfacilities(Dkt. #4 at p. 3). American Pain 

is alleged to have “agreed it would safeguard the data in accordance with its internal policies, state 

law, and federal law” (Dkt. #4 at p. 3).

On November 10, 2022, cybercriminals are alleged to have breached American Pain’s 

systems and gained access to patient PII/PHI (the “Data Breach”) (Dkt. #4 at p. 4). However, 

“Defendant has been unable to determine precisely what information was stolen and when” (Dkt. 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 1 of 20 PageID #: 365
2

34 at p. 6). Plaintiff Richard Smith (“Smith”) and Plaintiff Shae Loftice (“Loftice”) (collectively, 

“Named Plaintiffs”) allege that their PII/PHI was accessed as a result of the Data Breach (Dkt. #4 

at p. 2). American Pain notified Named Plaintiffs of the Data Breach on March 24, 2023 (Dkt. #4 

at p. 5). In a letter notifying Named Plaintiffs of the Data Breach, American Pain encouraged 

Named Plaintiffs to “remain vigilant for incidents of fraud and identity theft by reviewing account 

statements and monitoring free credit reports;” “place a fraud alert and security freeze on one’s 

credit file;” “contact the Federal Trade Commission, their state Attorney General, and law 

enforcement to report attempted or actual identity theft and fraud;” “educate yourself regarding 

identity theft, fraud alerts, credit freezes, and the steps you can take to protect your personal 

information by contacting the consumer reporting bureaus, the Federal Trade Commission, or 

your state Attorney General” (Dkt. #4 at p. 5) (citing Data Breach Notifications, MAINE ATTY 

GEN.,.https://apps.web.maine.gov/online/aeviewer/ME/40/5f0af895-9bce-434f-86f0-

20256aa4d93c.shtml (last visited Mar. 31, 2023)).

Smith alleges that his “[] name; [] home address; [] date of birth; [] Social Security number;

[] medical history; [] health insurance information; [] treating physician; and [] diagnosis 

information” was compromised” (Dkt. #4 at p. 7). Smith further alleges that he has and will 

continue to spend time and effort monitoring his account to protect himself from identity theft 

(Dkt. #4 at pp. 7–8). As a result of the Data Breach, Smith alleges that he has suffered from 

“anxiety, sleep disruption, stress, fear, and frustration” (Dkt. #4 at p. 8). And Smith alleges he has 

suffered from the diminution in the value of his PII/PHI and an increased risk of identity theft 

(Dkt. #4 at p. 8)

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 2 of 20 PageID #: 366
3

Loftice alleges that her “[] name; [] home address; [] date of birth; [] medical history; [] 

health insurance information; [] treating physician; and [] diagnosis information” was 

compromised” (Dkt. #4 at p. 9). Loftice further alleges that she has spent at least 20 hours on the 

Data Breach and will continue to spend time and effort monitoring her account to protect himself 

from identity theft (Dkt. #4 at p. 9). As a result of the Data Breach, Loftice alleges that she has 

suffered from “anxiety, sleep disruption, stress, fear, and frustration” (Dkt. #4 at p. 10). And 

Loftice alleges she has suffered from the diminution in the value of her PII/PHI and an increased 

risk of identity theft (Dkt. #4 at p. 9)

Loftice further alleges that, “following the Data Breach, in March 2023, [she] was notified 

by Credit Wise, a credit and identity protection service, of a fraudulent attempt to open a credit 

line with JP Morgan Chase & Co.” (Dkt. #4 at p. 10). And she has “experienced an increase in 

spam texts and phone calls since the Data Breach” (Dkt. #4 at p. 10).

Named Plaintiffs bring this class action on behalf of themselves and all others allegedly 

harmed by American Pain’s conduct and the resulting Data Breach (Dkt. #4 at p. 2). Smith is a 

citizen of Texas, residing in Tarrant County, Texas (Dkt. #4 at p. 2). Loftice is a citizen of Texas, 

residing in Grayson County, Texas (Dkt. #4 at p. 2). American Pain is a professional limited liability 

company headquartered in and doing business in Texas (Dkt. #4 at pp. 2–3).

LEGAL STANDARD

I. 12(b)(1) Motion to Dismiss

Federal Rule of Civil Procedure 12(b)(1) authorizes dismissal of a case for lack of subject 

matter jurisdiction when the district court lacks statutory and constitutional power to adjudicate 

the case. Home Builders Ass’n of Miss., Inc. v. City of Madison, 143 F.3d 1006, 1010 (5th Cir. 1998). 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 3 of 20 PageID #: 367
4

If a Rule 12(b)(1) motion is filed in conjunction with other Rule 12 motions, the Court will consider 

the jurisdictional attack under Rule 12(b)(1) before addressing any attack on the legal merits. 

Ramming v. United States, 281 F.3d 158, 161 (5th Cir. 2001). 

In deciding the motion, the Court may consider “(1) the complaint alone; (2) the complaint 

supplemented by the undisputed facts evidenced in the record; or (3) the complaint supplemented 

by undisputed facts plus the [C]ourt’s resolution of disputed facts.” Lane v. Halliburton, 529 F.3d 

548, 557 (5th Cir. 2008) (quoting Barrera-Montenegro v. United States, 74 F.3d 657, 659 (5th Cir. 

1996)). The Court will accept as true all well-pleaded allegations set forth in the complaint and 

construe those allegations in the light most favorable to the plaintiff. Truman v. United States, 26 

F.3d 592, 594 (5th Cir. 1994). Once a defendant files a motion to dismiss under Rule 12(b)(1) and 

challenges jurisdiction, the party invoking jurisdiction has the burden to establish subject matter 

jurisdiction. See Menchaca v. Chrysler Credit Corp., 613 F.2d 507, 511 (5th Cir. 1980). The Court 

will grant a motion to dismiss for lack of subject matter jurisdiction only if it appears certain that 

the claimant cannot prove a plausible set of facts to support a claim that would entitle it to relief. 

Lane, 529 F.3d at 557. 

II. 12(b)(6) Motion to Dismiss

The Federal Rules of Civil Procedure require that each claim in a complaint include a 

“short and plain statement . . . showing that the pleader is entitled to relief.” FED. R. CIV. P.

8(a)(2). Each claim must include enough factual allegations “to raise a right to relief above the 

speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). 

A Rule 12(b)(6) motion allows a party to move for dismissal of an action when the complaint 

fails to state a claim upon which relief can be granted. FED. R.CIV. P. 12(b)(6). When considering 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 4 of 20 PageID #: 368
5

a motion to dismiss under Rule 12(b)(6), the Court must accept as true all well-pleaded facts in the 

plaintiff’s complaint and view those facts in the light most favorable to the plaintiff. Bowlby v. City 

of Aberdeen, 681 F.3d 215, 219 (5th Cir. 2012). The Court may consider “the complaint, any 

documents attached to the complaint, and any documents attached to the motion to dismiss that 

are central to the claim and referenced by the complaint.” Lone Star Fund V (U.S.), L.P. v. Barclays 

Bank PLC, 594 F.3d 383, 387 (5th Cir. 2010). The Court must then determine whether the 

complaint states a claim for relief that is plausible on its face. “A claim has facial plausibility when 

the plaintiff pleads factual content that allows the [C]ourt to draw the reasonable inference that the 

defendant is liable for the misconduct alleged.” Gonzalez v. Kay, 577 F.3d 600, 603 (5th Cir. 2009) 

(quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). “But where the well-pleaded facts do not 

permit the [C]ourt to infer more than the mere possibility of misconduct, the complaint has 

alleged—but it has not ‘show[n]’—‘that the pleader is entitled to relief.’” Iqbal, 556 U.S. at 679 

(quoting FED. R. CIV. P. 8(a)(2)). 

In Iqbal, the Supreme Court established a two-step approach for assessing the sufficiency 

of a complaint in the context of a Rule 12(b)(6) motion. First, the Court should identify and 

disregard conclusory allegations, for they are “not entitled to the assumption of truth.” Iqbal, 556 

U.S. at 664. Second, the Court “consider[s] the factual allegations in [the complaint] to determine 

if they plausibly suggest an entitlement to relief.” Id. “This standard ‘simply calls for enough 

facts to raise a reasonable expectation that discovery will reveal evidence of the necessary claims 

or elements.’” Morgan v. Hubert, 335 F. App’x 466, 470 (5th Cir. 2009) (citation omitted). This 

evaluation will “be a context-specific task that requires the reviewing court to draw on its judicial 

experience and common sense.” Iqbal, 556 U.S. at 679.

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 5 of 20 PageID #: 369
6

Thus, “[t]o survive a motion to dismiss, a complaint must contain sufficient factual matter, 

accepted as true, to ‘state a claim to relief that is plausible on its face.”’ Id. at 678 (quoting 

Twombly, 550 U.S. at 570). 

ANALYSIS

I. American Pain’s 12(b)(1) Motion to Dismiss

American Pain argues that Named Plaintiff’s claims should be dismissed under Rule 

12(b)(1) for lack of subject matter jurisdiction because: 1) there is no diversity jurisdiction; 2) there 

is no federal question jurisdiction; and 3) Plaintiffs lack Article III standing (see Dkt. #8). The Court 

considers each argument in turn.

A. The Court has diversity jurisdiction over the parties under 28 U.S.C. 

§ 1332(d)(2).

American Pain first contends that the Court does not have subject matter jurisdiction over 

thissuit because there is no diversity between the parties. Because it is undisputed that the Named 

Plaintiffs are citizens of Texas and American Pain is located in Texas, American Pain argues that 

the requirements under 28 U.S.C. § 1332(d)(2) have not been met. Moreover, American Pain 

argues that the Named Plaintiffs did not adequately allege the amount in controversy under the 

Class Action Fairness Act (“CAFA”).

i. There is diversity between parties.

According to American Pain, the Court must only look to the named plaintiffs when 

analyzing whether diversity exists in a class action (Dkt. #8 at p. 5) (emphasis added). In response, 

Named Plaintiffs argue that, under CAFA, diversity can exist between any plaintiff class member 

and any defendant (Dkt. #12 at p. 8) (emphasis added). The Court agrees with Named Plaintiffs. 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 6 of 20 PageID #: 370
7

“CAFA does not replace the basic diversity requirements; it supplements them. That 

means that a class action case not arising under federal law can be lodged in federal court if it meets 

either the basic diversity requirements or CAFA’s requirements.” 2 W. Rubenstein, Newberg on 

Class Actions § 6:6 (5th ed.) (emphasis in original). Federal district courts have jurisdiction over 

cases in which the amount in controversy exceeds $75,000 and there is diversity of citizenship 

among the parties. 28 U.S.C. § 1332(a). Alternatively, “CAFA provides district courts with 

jurisdiction over ‘class action[s]’ in which the matter in controversy exceeds $5,000,000 and at 

least one class member is a citizen of a State different from the defendant.” Home Depot U.S.A., 

Inc. v. Jackson, 587 U.S. 435, (2019) (citing § 1332(d)(2)(A)). 

The Fifth Circuit has clarified that CAFA is referring to the citizenship of “any class 

member and any defendant.” In re Katrina Canal Litig. Breaches, 524 F.3d 700 (5th Cir. 2008). In 

other words, “CAFA, in expanding federal jurisdiction over certain class actions filed in state 

court, escaped the rule that citizenship of the named representative is controlling.” Id.; see also 

Hart v. FedEx Ground Package Sys. Inc., 457 F.3d 675, 676-77 (7th Cir. 2006) (“Because [the class 

representative] too is a citizen of Pennsylvania, in the absence of CAFA nothing would support 

federal subject-matter jurisdiction over these claims. That is because § 1332 requires ‘complete 

diversity,’ meaning that no plaintiff may be from the same state as any defendant, and in class 

actions only the citizenship of the named plaintiff counts.” (emphasis added)).

Even so, CAFA seeks to “draw a delicate balance between making a federal forum available 

to genuinely national litigation and allowing the state courts to retain cases when the controversy 

is strongly linked to that state.” Hollinger, 654 F.3d at 570 (citing Hart, 457 F.3d at 682).

“Therefore, [CAFA] provides a number of scenarios in which federal courts must abstain from 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 7 of 20 PageID #: 371
8

exercising jurisdiction.” Madison v. ADT, L.L.C., 11 F.4th 325, 327 (5th Cir. 2021) (citing Hollinger, 

654 F.3d at 570). One such scenario is the “home state” exception, “whereby the court must 

abstain if ‘two-thirds or more of the members of all proposed plaintiff classes in the aggregate, and 

the primary defendants, are citizens of the State in which the action was originally filed.’” Id.

(citing Hollinger, 654 F.3d at 570; 28 U.S.C. § 1332(d)(4)(B)).

In its Motion, American Pain does not make any argument regarding exceptions to CAFA

(see Dkt. #8). However, at a teleconference hearing for a discovery dispute between the parties, 

counsel for American Pain raised additional arguments related to the home state exception. 

Because there is nothing in the record supporting those arguments, the Court declines to consider 

them at this time.

1

It is undisputed that American Pain is considered a citizen of Texas. And Named Plaintiffs 

have alleged that “many members of the proposed class are from different states than [American 

Pain]” (Dkt. #4 at p. 3). Accordingly, based on the current record, diversity of citizenship exists 

between the parties under CAFA.

ii. Named Plaintiffs sufficiently allege the amount in controversy.

In their Complaint, Named Plaintiffs allege that “the amount in controversy exceeds $5 

million, exclusive of interest and costs” (Dkt. #4 at p. 3). American Pain argues that Named 

Plaintiffs’ allegation is “unsupported” and “runs afoul of Iqbal’s pleading requirements” (Dkt. #8 

at p. 6). See Iqbal, 556 U.S. at 678.

Under CAFA, the aggregate amount in controversy for class or mass actions must exceed 

$5 million. Mississippi ex rel. Hood v. AU Optronics Corp., 571 U.S. 161, 166 (2014). The plaintiff’s 

1 The Court will consider additional arguments related to jurisdiction in the event that they are properly presented.

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 8 of 20 PageID #: 372
9

burden to demonstrate the amount in controversy is “[n]ormally . . . satisfied if the plaintiff claims 

a sum greater than the jurisdictional requirement.” White v. FCI USA, Inc., 319 F.3d 672, 674 (5th 

Cir. 2003) (citations omitted). “The required demonstration concerns what the plaintiff is 

claiming (and thus the amount in controversy between the parties), not whether the plaintiff is 

likely to win or be awarded everything he seeks.” Robertson v. Exxon Mobil Corp., 814 F.3d 236, 240

(5th Cir. 2015) (citations omitted). “A claim for damages made in apparent good faith controls the 

jurisdictional question . . . .” Jouett Investments Inc. v. Intuit Inc., No. 3:14–CV–1803–L, 2015 WL 

3770715, at *7 (N.D. Tex. June 15, 2015). And the Court can apply common sense when evaluating 

the amount in controversy claimed. Robertson, 814 F.3d at 240.

Given that Named Plaintiffs have brought this action on behalf of approximately 7,457 

persons who were allegedly harmed as a result of the Data Breach (see Dkt. #12 at p. 8), the Court 

finds that Named Plaintiffs have met their burden to demonstrate that the amount in controversy 

exceeds $5 million as required under CAFA.2

B. Plaintiffs have standing.

American Pain additionally argues that Named Plaintiffs have failed to allege injuries 

sufficient to confer Article III standing (Dkt. #8 at p. 8). In response, Named Plaintiffs argue that 

they have standing to sue based on the following alleged injuries: 1) American Pain disclosed 

Named Plaintiffs’ private information; 2) American Pain injured Named Plaintiff’s rights under 

contract; 3) Named Plaintiffs are now exposed to an increased risk for identity theft; 4) Plaintiff 

2 Because Named Plaintiffs are not claiming that federal question jurisdiction exists, (see Dkt. #4 at p. 3), and there 

is currently a basis for diversity jurisdiction (see supra), the Court declines to consider whether it has federal 

question jurisdiction at this time.

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 9 of 20 PageID #: 373
10

Loftice suffered fraud; 5) Named Plaintiffs have spent time and resources mitigating their chances 

of suffering harm; and 6) Named Plaintiffs fear for their financial security (Dkt. #12 at p. 7).

A federal court lacks jurisdiction over a claim if it does not allege an actual case or 

controversy. See Attala Cnty. v. Evans, 37 F.4th 1038, 1042 (5th Cir. 2022) (“It is axiomatic that a 

plaintiff seeking redress in federal court must meet the initial ‘requirement imposed by Article III 

of the Constitution by alleging an actual case or controversy.’” (citation omitted)). An actual case 

or controversy requires that a plaintiff have standing to sue. Id. To establish standing, the plaintiff 

must demonstrate that an injury is “[(1)] concrete, particularized, and actual or imminent; [(2)] 

fairly traceable to the challenged action; and [(3)] redressable by a favorable ruling.” Id. (quoting 

Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 149 (2010)). “At the pleading stage, general 

factual allegations of injury resulting from the defendant’s conduct may suffice, for on a motion to 

dismiss we ‘presum[e] that general allegations embrace those specific facts that are necessary to 

support the claim.’” Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992) (citation omitted). 

“[S]tanding is not dispensed in gross; rather, plaintiffs must demonstrate standing for each claim 

that they press and for each form of relief that they seek (for example, injunctive relief and 

damages).” TransUnion LLC v. Ramirez, 594 U.S. 413, 431 (2021).

The proposed class representatives must have Article III standing. Flecha v. Medicredit, Inc., 

946 F.3d 762, 769 (5th Cir. 2020). “[I]f none of the named plaintiffs purporting to represent a class 

establishes the requisite of a case or controversy with the defendants, none may seek relief on behalf 

of himself or any other member of the class.” Green v. eBay Inc., No. CIV.A. 14-1688, 2015 WL 

2066531, at *3 (E.D. La. May 4, 2015) (citing O’Shea v. Littleton, 414 U.S. 488, 494 (1974)). “After 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 10 of 20 PageID #: 374
11

all, if the class representative lacks standing, then there is no Article III suit to begin with—class 

certification or otherwise.” Flecha, 946 F.3d at 769.

The Fifth Circuit has not addressed standing in the data breach context. 

i. Named Plaintiffs’ injury is concrete and imminent.

The Supreme Court recently addressed standing in a similar, but distinct context. See 

TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). The U. S. Treasury Department’s Office of 

Foreign Assets Control (“OFAC”) “maintains a list of ‘specially designated nationals’ who 

threaten America’s national security.” TransUnion, 594 U.S. at 419. These individuals are 

generally “terrorists, drug traffickers, or other serious criminals.” Id. In TransUnion, a class of 

8,185 plaintiffs filed suit after there were inaccurate OFAC alerts in their credit files. 1,853 of the 

class members (including the named plaintiff) had their credit reports containing inaccurate OFAC 

alerts disseminated to third parties during the period specified in the class definition. Id. at 421.

The internal credit files of the remaining 6,332 class members were not provided to third parties 

during the relevant time period. Id.

When evaluating whether the plaintiffs had Article III standing, the Supreme Court 

focused its analysis on whether the plaintiffs had suffered a “concrete harm.” Id. at 417. “Central 

to assessing concreteness is whether the asserted harm has a ‘close relationship’ to a harm 

traditionally recognized as providing a basis for a lawsuit . . . .” Id. (citing Spokeo, Inc. v. Robins, 578 

U.S. 330, 341 (2016)). The Supreme Court recognized that various intangible harms can be 

concrete. Id. at 425. “Those include, for example, reputational harms, disclosure of private 

information, and intrusion upon seclusion.” Id. at 425.

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 11 of 20 PageID #: 375
12

The Supreme Court had “no trouble concluding” that those 1,853 class members whose 

misleading credit reports were provided to third parties “suffered a harm with a ‘close 

relationship’ to the harm associated with the tort of defamation such that they had Article III 

standing.” Id. at 432.

However, the Supreme Court held that the remaining plaintiffs did not have standing 

because they did not suffer a concrete harm. In a suit for damages, the mere exposure to a risk of 

future harm alone is insufficient to constitute a concrete injury, unless that exposure caused an 

independent harm. Id. at 436. The risk of future harm on its own is not enough to support Article 

III standing. Id. Rather, a plaintiff must “demonstrate that the risk of future harm materialized,” 

or a plaintiff must “factually establish a sufficient risk of future harm to support Article III 

standing.” Id. at 437–38. Because the misleading OFAC alerts were never provided to third parties, 

nor was there a factually established risk that the credit reports would be provided to third-party 

businesses, the remaining plaintiffs did not have Article III standing. Id.

The Supreme Court went on to note that, had there been evidence that the plaintiffs

“suffered some other injury[,] such as emotional injury[,] from the mere risk that their credit 

reports would be provided to third-party businesses” the plaintiffs could have had Article III 

standing. Id. at 437.

Following TransUnion, several circuit courts have spoken on the issue of standing in the 

data breach context. See, e.g., Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365 (1st Cir. 2023);

Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022); Bohnak v. Marsh & McLennan Companies, 

Inc., 79 F.4th 276 (2d Cir. 2023).

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 12 of 20 PageID #: 376
13

In Bohnak, the Second Circuit had “no trouble concluding” that exposure of private PII to 

unauthorized third parties is “sufficiently concrete” to support a claim for damages. Bohnak, 79 

F.4th at 285. To be sure, the Second Circuit held that the plaintiff’s exposure “bears some 

relationship to a well-established common-law analog: public disclosure of private facts.” Id. 

(citing Restatement (Second) Torts § 652D (“One who gives publicity to a matter concerning the 

private life of another is subject to liability to the other for invasion of ... privacy, if the matter 

publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of 

legitimate concern to the public.”)).

In Bohnak, the Second Circuit further underscored that the Supreme Court in TransUnion 

specifically recognized that “disclosure of private information” was an intangible harm 

“traditionally recognized as providing a basis for lawsuits in American courts.” Id. at 286 (citing 

TransUnion, 594 U.S. at 417). Thus, an injury arising from such a disclosure is concrete for 

purposes of Article III standing. Id. Moreover, the Second Circuit held that the plaintiff’s 

allegations established a concrete injury for a second reason—she suffered concrete harms “as a 

result of the risk of future harm occasioned by the exposure of her PII.” Id. Specifically, she alleged 

that she incurred “out-of-pocket expenses associated with the prevention, detection, and recovery 

from identity theft” and “lost time” and other “opportunity costs” associated with attempting to 

mitigate the consequences of the data breach. Id. Thus, the Second Circuit held that “[t]hese 

separate and concrete harms foreseeably arising from the exposure of [the plaintiff’s] PII to a 

malign outside actor, giving rise to a material risk of future harm, independently support standing.” 

Id.

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 13 of 20 PageID #: 377
14

In support, in Bohnak, the Second Circuit cited to similar holdings from the First and Third 

Circuits. Id. at 286–87. In Webb, the plaintiffs brought suit against a pharmacy after their PII was 

allegedly exposed in a data breach. 72 F.4th at 369. One of the plaintiffs alleged actual misuse of 

her PII. Id. Another plaintiff alleged that, based on the allegations of actual misuse, there is a 

material risk of future misuse. Id. at 375. The First Circuit held that both plaintiffs plausibly alleged 

a concrete harm “based on an imminent and substantial risk of future harm as well as a present and 

concrete harm resulting from the exposure to this risk.” Id. at 369.

The Third Circuit in Clemens similarly concluded:

Following TransUnion’s guidance, we hold that in the data breach context, where 

the asserted theory of injury is a substantial risk of identity theft or fraud, a plaintiff 

suing for damages can satisfy concreteness as long as [the plaintiff] alleges that the 

exposure to that substantial risk caused additional, currently felt concrete harms. 

For example, if the plaintiff’s knowledge of the substantial risk of identity theft 

causes [the plaintiff] to presently experience emotional distress or spend money on 

mitigation measures like credit monitoring services, the plaintiff has alleged a 

concrete injury.

Clemens, 48 F.4th at 155-56.

The Court finds these holdings in Bohnak, Webb, and Clemens persuasive. Here, Named 

Plaintiffs assert six causes of action, each of which encompass at least one of the harms that satisfies 

Article III standing. Named Plaintiffs allege that their PII/PHI was exposed to a third party. This 

exposure bears some relationship to a well-established common-law analog: public disclosure of 

private facts. And the Supreme Court in TransUnion found that the disclosure of private 

information was an intangible harm traditionally recognized as providing a basis for suit. 

TransUnion, 594 U.S. at 425. Accordingly, Named Plaintiffs sufficiently allege a concrete injury 

for standing purposes under Article III.

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 14 of 20 PageID #: 378
15

Further, Named Plaintiffs allege that they spent time and money mitigating their risks of 

identity theft. In Bohnak, the Second Circuit held that the plaintiff alleged concrete harms when 

she alleged that she incurred “out of pocket expenses associated with the prevention, detection, 

and recover from identity theft” and “lost time” as well as “opportunity costs” associated with 

mitigating the data breach’s impact. Bohnak, 79 F.4th 286. In this case, American Pain encouraged 

Named Plaintiffsto take precautions due to the Data Breach (Dkt. #4 at p. 5), and Named Plaintiffs 

allege they expended time and money to protect themselves against identity theft. Named Plaintiffs 

could have expended their time and money on other things; however, the Data Breach forced them 

to take precautions they otherwise would not have taken. See Webb, 72 F.4th at 377 (“[T]ime spent 

responding to a data breach can constitute a concrete injury sufficient to confer standing, at least 

when that time would otherwise have been put to profitable use.”) As such, Named Plaintiffs 

sufficiently allege a concrete injury for standing purposes under Article III. 

Named Plaintiffs also allege they suffer from emotional distress because of the Data Breach.

Relying on TransUnion, the Third Circuit in Clemens recognized that “if the plaintiff’s knowledge 

of the substantial risk of identity theft causes [the plaintiff] to presently experience emotion 

distress...the plaintiff has alleged a sufficiently concrete injury.” Clemens, 48 F.4th at 156. Here, 

Named Plaintiffs allege the exposure of their PII/PHI caused them emotional distress—namely 

anxiety, sleep disruption, stress, fear, and frustration (Dkt. #4 at pp. 8-10). Accordingly, Named 

Plaintiffs sufficiently allege a concrete injury for standing purposes.

Thus, Named Plaintiffs’ sufficiently allege concrete and particularized injuriesfor standing 

purposes under Article III. 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 15 of 20 PageID #: 379
16

For Article III standing, an injury in fact must also be “actual or imminent, not conjectural 

or hypothetical.” Stringer v. Whitley, 942 F.3d 715, 721 (5th Cir. 2019). “For a threatened future 

injury to satisfy the imminence requirement, there must be at least a ‘substantial risk’ that the 

injury will occur.” Id. Here, American Pain advised Named Plaintiffs to, among other things,

“remain vigilant for incidents of fraud and identity theft,” to place fraud alerts and credit freezes 

on their reports, as well as report suspicious activity to the appropriate law enforcement agencies 

(See Dkt. #4 at p. 5). The suggested precautions are telling. American Pain realized Named 

Plaintiffs faced an actual or imminent harm from the Data Breach since third parties may use the 

PII/PHI for nefarious purposes. Notably, Loftice alleges that following the Data Breach she was 

notified “of a fraudulent attempt to open a credit line with JP Morgan Chase & Co.” (Dkt. #4 at 

p. 10). Thus, the Court is satisfied that there is a substantial risk that the Named Plaintiffs will 

suffer identity theft as a result of the Data Breach.

In conclusion, Named Plaintiffs sufficiently allege concrete and particularized injuries that 

are imminent or actual. 

ii. Named Plaintiffs’ injury is traceable to the Data Breach

and their injury is redressable.

American Pain focuses solely on the argument that Named Plaintiffs have not alleged a 

concrete and particularized injury to satisfy Article III standing (Dkt. #8 at p. 7). Therefore, the 

Court will just briefly address the additional requirements for standing—traceability and 

redressability.

A plaintiff’s alleged injury must be “fairly traceable to the defendant’s allegedly unlawful 

conduct.” Hein v. Freedom From Religion Found., Inc., 551 U.S. 587, 598 (2007). And “Article III 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 16 of 20 PageID #: 380
17

standing requires identification of a remedy that will redress the individual plaintiffs’ injuries.”

California v. Texas, 593 U.S. 659, 660 (2021).

Here, Named Plaintiff’s alleges that American Pain’s actions led to the disclosure of their 

private information. Thus, the Court is satisfied that Named Plaintiff’s injury is fairly traceable to 

American Pain’s alleged conduct at this stage. And Named Plaintiffs have alleged that monetary 

relief would compensate them, which renders their injury redressable. 

II. American Pain’s 12(b)(6) Motion to Dismiss

American Pain argues that Named Plaintiff’s claims should be dismissed under Federal 

Rule of Civil Procedure 12(b)(6) for failure to state a claim (Dkt. #8 at p. 11). Having considered 

the motion and the relevant pleadings, the Court finds that Named Plaintiffs have stated plausible 

claims for purposes of defeating a Rule 12(b)(6) motion for the following claims: 1) negligence; 2) 

breach of contract; 3) breach of fiduciary duty; 4) intrusion upon seclusion; and 5) unjust 

enrichment. However, Named Plaintiffs do not state a plausible claim for negligence per se. 

Named Plaintiffs allege a claim for negligence per se, arguing that American Pain “violated 

[the Health Insurance Portability and Accountability Act (“HIPAA”)] by failing to comply with 

mandated safeguards and Section 5 of the [Federal Trade Commission Act (“FTC Act”)] by 

failing to provide fair, reasonable or adequate computer systems and data security practices to 

safeguard PII/PHI” (Dkt. #12 at p. 21). American Pain moves to dismiss Named Plaintiff’s claim 

for negligence per se under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim 

(Dkt. #8 at p. 13). In support, American Pain argues that there is no private right of action under 

the FTC Act or HIPAA, so “it would be inconsistent with the legislative intent to impose private 

civil liability for a violation thereof” (Dkt. #8 at p. 13).

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 17 of 20 PageID #: 381
18

“Negligence per se is a common-law doctrine in which a duty is imposed based on a 

standard of conduct created by a penal statute rather than on the reasonably prudent person test 

used in pure negligence claims.” Smith v. Merritt, 940 S.W.2d 602, 607 (Tex. 1997). “Under Texas 

law, when a legislative body declines to provide for an individual private right of action in a statute 

and instead provides a comprehensive regulatory scheme with limited private remedies, that 

statute will not be an appropriate basisfor a negligence per se claim.” Armstrong v. Sw. Airlines Co., 

No. 3:20-CV-3610-BT, 2021 WL 4391247, at *3 (N.D. Tex. Sept. 24, 2021) (citing Smith, 940 

S.W.2d at 607–08; Reeder v. Daniel, 61 S.W.3d 359, 362–63 (Tex. 2001)). When “determine[ing] 

whether a given statute may be the basis for a negligence per se claim, Texas courts must ‘consider 

whether recognizing such an accompanying civil action would be inconsistent with legislative 

intent.’” Id. (quoting Reeder, 61 S.W.3d at 362). “Texas courts ‘will not disturb the Legislature’s 

regulatory scheme by judicially recognizing a cause of action’ not contemplated in the statute.” Id.

(quoting Reeder, 61 S.W.3d at 364). 

The FTC Act does not create a private cause of action. Thomas v. Culpepper, No. 4:18-CV814-ALM-CAN, 2019 WL 6037992 (E.D. Tex. July 29, 2019), report and recommendation adopted, 

No. 4:18-CV-814, 2019 WL 4564837 (E.D. Tex. Sept. 20, 2019) (citing Fulton v. Hecht, 580 F.2d 

1243, 1248 n.2 (5th Cir. 1978)). Likewise, “there is no private cause of action under HIPAA.”

Acara v. Banks, 470 F.3d 569, 572 (5th Cir. 2006). Other Texas state courts and federal courts 

applying Texas law have declined to recognize negligence per se claims based upon statutes that 

do not create a private right of action. See, e.g., Smith, 940 S.W.2d at 607 (holding that violating 

section 106.06 of the Texas Alcohol Beverage Code “does not create a negligence per se cause of 

action” because “[t]o hold otherwise would ignore the intent and policies of the Legislature.”); 

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 18 of 20 PageID #: 382
19

Baker v. Smith & Nephew Richards, Inc., No. 95-58737, 1999 WL 811334, at *18 (152nd Dist. Ct., 

Harris County, Tex. June 7, 1999), aff’d sub nom. McMahon v. Smith & Nephew Richards, Inc., No. 

14-99-00616-CV, 2000 WL 991697 (Tex. App.—Houston [14th Dist.] July 20, 2000, no pet.) 

(mem. op., not designated for publication) (holding where there is “Congressional prohibition of 

private rights of action” under a statute, allowing negligence per se claims based upon that statute 

would be “both legally improper and ill-advised”); Armstrong, 2021 WL 4391247, at *4 (holding 

the Air Carrier Access Act that “precludes a private right of action ... is not a proper basis for a 

negligence per se claim under Texas law”); Walters v. Blue Cross & Blue Shield of Texas, Inc., No. 

3:21-CV-981-L, 2022 WL 902735, at *6 (N.D. Tex. Mar. 28, 2022) (holding that HIPAA is not a 

proper basis for a negligence per se claim under Texas law because the statute does not contain a 

private right of action). Given these prior rulings, the Court finds that neither the FTC Act nor 

HIPAA is an appropriate basis for a negligence per se claim. Named Plaintiffs’ negligence per se 

claims should be dismissed.

CONCLUSION

For the foregoing reason, Defendant’s Rule 12(b)(1) and (6) Motion to Dismiss (Dkt. #8)

is hereby GRANTED in part and DENIED in part.

Specifically, it is ORDERED that Plaintiffs Richard Smith’s and Shae Loftice’s claims for 

negligence per se are DISMISSED with prejudice. 

It is further ORDERED that Defendant American Pain and Wellness, PLLC’s Rule 

12(b)(1) and (6) Motion to Dismiss is DENIED in all other respects.

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 19 of 20 PageID #: 383
20

IT IS SO ORDERED.

Case 4:23-cv-00295-ALM Document 32 Filed 09/03/24 Page 20 of 20 PageID #: 384