1

UNITED STATES DISTRICT COURT 

EASTERN DISTRICT OF TEXAS 

SHERMAN DIVISION 

RICHARD SMITH and SHAE LOFTICE on 

behalf of themselves and all others similarly 

situated, 

Plaintiff, 

v. 

AMERICAN PAIN AND WELLNESS, PLLC, 

Defendant. 

NO. 4:23-cv-00295 

AMENDED CLASS ACTION 

COMPLAINT 

 DEMAND FOR JURY TRIAL 

Richard Smith and Shae Loftice (collectively, “Plaintiffs”), through their attorneys, 

individually and on behalf of all others similarly situated, bring this Amended Class Action 

Complaint against Defendant American Pain and Wellness, PLLC (“Defendant”), and its present, 

former, or future direct and indirect parent companies, subsidiaries, affiliates, agents, and/or other 

related entities. Plaintiffs allege the following on information and belief—except as to their own 

actions, counsel’s investigations, and facts of public record. 

NATURE OF ACTION 

1. This class action arises from Defendant’s failure to protect highly sensitive data. 

2. Defendant is a healthcare provider specializing in back and spine pain. 

3. As such, Defendant stores a litany of highly sensitive personal identifiable 

information (“PII”) and protected health information (“PHI”)—together “PII/PHI”—about its 

current and former patients. But Defendant lost control over that data when cybercriminals 

infiltrated its insufficiently protected computer systems in a data breach (the “Data Breach”) 

4. It is unknown for precisely how long the cybercriminals had access to Defendant’s 

network before the breach was discovered. In other words, Defendant had no effective means to 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 1 of 34 PageID #: 39
2

prevent, detect, stop, or mitigate breaches of its systems—thereby allowing cybercriminals 

unrestricted access to patient PII/PHI. 

5. On information and belief, cybercriminals were able to breach Defendant’s systems 

because Defendant failed to adequately train its employees on cybersecurity and failed to maintain 

reasonable security safeguards or protocols to protect the Class’s PII/PHI. In short, Defendant’s 

failures placed the Class’s PII/PHI in a vulnerable position—rendering them easy targets for 

cybercriminals. 

6. Plaintiffs are Data Breach victims and received breach notices. They bring this class 

action on behalf of themselves, and all others harmed by Defendant’s misconduct. 

7. The exposure of one’s PII/PHI to cybercriminals is a bell that cannot be unrung. 

Before this data breach, patients’ private information was exactly that—private. Not anymore. 

Now, patients’ private information is forever exposed and unsecure. 

PARTIES 

8. Plaintiff, Richard Smith, is a natural person and citizen of Texas. He resides in 

Tarrant County, Texas, where he intends to remain. 

9. Plaintiff, Shae Loftice, a natural person and citizen of Texas. She resides in Grayson 

County, Texas, where she intends to remain. 

10. Defendant, American Pain and Wellness, PLLC, is a Texas professional limited 

liability company located in the Sherman Division of the Eastern District of Texas. The registered 

agent for service of process is attorney William Meier, III, a partner at Hallett & Perrin, P.C., 1445 

Ross Ave., Suite 2400, Dallas, Texas 75201. 

 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 2 of 34 PageID #: 40
3

JURISDICTION AND VENUE 

11. This Court has subject matter jurisdiction over this action under the Class Action 

Fairness Act, 28 U.S.C. § 1332(d)(2). The amount in controversy exceeds $5 million, exclusive of 

interest and costs. Upon information and belief, many members of the proposed class are from 

different states than Defendant. And there are over 100 putative Class members. 

12. This Court has personal jurisdiction over Defendant because it is headquartered in 

the Sherman Division of the Eastern District of Texas, regularly conducts business in Texas and 

has sufficient minimum contacts in Texas. 

13. Venue is proper in this Court because Defendant’s registered office and principal 

place of business is in this District, and because a substantial part of the events, acts, and omissions 

giving rise to Plaintiffs’ claims occurred in this District. 

BACKGROUND 

Defendant Collected and Stored the PII/PHI of Plaintiffs and the Class 

14. Defendant is a healthcare provider specializing in back and spine pain. It has 

multiple locations throughout Texas. 

15. In collecting and maintaining the PII/PHI, Defendant agreed it would safeguard the 

data in accordance with its internal policies, state law, and federal law. After all, Plaintiffs and 

Class members themselves took reasonable steps to secure their PII/PHI. 

16. As part of its business, Defendant receives and maintains the PII/PHI of thousands 

of current and former patients. In doing so, Defendant implicitly promises to safeguard their 

PII/PHI. 

17. Under state and federal law, businesses like Defendant have duties to protect 

patients’ PII/PHI and to notify them about breaches. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 3 of 34 PageID #: 41
4

18. Defendant recognizes these duties, declaring that: 

a. “We will not use or share your information with anyone except as described 

in [our] Privacy Policy;”1 and 

b. “The security of your Personal Information is important to us;”2

 

Defendant’s Data Breach 

19. On November 10, 2022, Defendant was hacked.3

 But Defendant did not realize that 

it was hacked until seventeen days later on November 27, 2022.4

 

20. Defendant admits that patient PII/PHI was compromised as “all files on [our] 

network, including all backups, were encrypted with malicious ransomware.”5

21. Because of Defendant’s Data Breach, at least the following types of PII/PHI were 

compromised: 

a. names; 

b. Social Security numbers; 

c. medical information; 

d. health insurance information; and 

e. “other” information (as vaguely reported by Defendant).6

 

22. In total, Defendant injured 7,457 persons—via the exposure of their PII/PHI—in 

the Data Breach. Upon information and belief, these 7,457 persons include current and former 

patients. 

1 Privacy Policy, AMERICAN PAIN & WELLNESS (June 30, 2015) https://www.painandwellness.com/privacy-policyamerican-pain-and-wellness-in-texas. 

2 Id. 3 Data Breach Notifications, MAINE ATTY GEN., https://apps.web.maine.gov/online/aeviewer/ME/40/5f0af895-9bce434f-86f0-20256aa4d93c.shtml (last visited Mar. 31, 2023). 

4 Id. 5 Id. 6 Data Security Breach Reports, ATTY GEN. TEXAS, 

https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage (last visited Mar. 31, 2023). 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 4 of 34 PageID #: 42
5

23. And yet, Defendant waited until March 24, 2023, before it began notifying the 

class—a full 117 days after Defendant discovered its Data Breach.7

 

24. Thus, Defendant kept the Class in the dark—thereby depriving the Class of the 

opportunity to try and mitigate their injuries in a timely manner. 

25. And when Defendant did notify Plaintiffs and the Class of the Data Breach, 

Defendant acknowledged that their Data Breach created a present, continuing, and significant risk 

of suffering identity theft, warning the Plaintiffs and the Class to: 

a. “remain vigilant for incidents of fraud and identity theft by reviewing 

account statements and monitoring free credit reports;”8

b. “place a fraud alert and security freeze on one’s credit file;”9

c. “contact the Federal Trade Commission, their state Attorney General, and 

law enforcement to report attempted or actual identity theft and fraud;”10

and 

d. “educate yourself regarding identity theft, fraud alerts, credit freezes, and 

the steps you can take to protect your personal information by contacting 

the consumer reporting bureaus, the Federal Trade Commission, or your 

state Attorney General.”11

26. Defendant failed its duties when its inadequate security practices caused the Data 

Breach. In other words, Defendant’s negligence is evidenced by its failure to prevent the Data 

7 Data Breach Notifications, MAINE ATTY GEN., https://apps.web.maine.gov/online/aeviewer/ME/40/5f0af895-9bce434f-86f0-20256aa4d93c.shtml (last visited Mar. 31, 2023).

8 Id. 9 Id. 10 Id. 11 Id.

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 5 of 34 PageID #: 43
6

Breach and stop cybercriminals from accessing the PII/PHI. And thus, Defendant caused 

widespread injury and monetary damages. 

27. Since the breach, Defendant has been “working to implement additional safeguards 

and training to its employees.”12 But this is too little too late. Simply put, these measures—which 

Defendant now recognizes as necessary—should have been implemented before the Data Breach. 

28. On information and belief, Defendant failed to adequately train its employees on 

reasonable cybersecurity protocols or implement reasonable security measures. 

29. Further, the Notice of Data Breach shows that Defendant cannot—or will not—

determine the full scope of the Data Breach, as Defendant has been unable to determine precisely 

what information was stolen and when. 

30. Defendant has done nothing to remedy its Data Breach. Defendant has not offered 

its victims even simple credit monitoring services. Rather, Defendant blatantly disregards the 

injuries that it inflicted upon Plaintiffs and the Class. 

31. Because of Defendant’s Data Breach, the sensitive PII/PHI of Plaintiffs and Class 

members was placed into the hands of cybercriminals—inflicting numerous injuries and 

significant damages upon Plaintiffs and Class members. 

Plaintiff Smith’s Experiences and Injuries 

32. Plaintiff Richard Smith is a current patient of Defendant. He began receiving 

medical services from Defendant approximately fifteen years ago. 

33. Thus, Defendant obtained and maintained Plaintiff’s PII/PHI. 

34. As a result, Plaintiff Richard Smith was injured by Defendant’s Data Breach. 

12 Id. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 6 of 34 PageID #: 44
7

35. As a condition of receiving medical services, Plaintiff provided Defendant with his

PII/PHI. Defendant used that PII/PHI to facilitate its provision of services and its collection of 

payment. 

36. In providing his PII/PHI to Defendant, Plaintiff trusted that Defendant would use 

reasonable measures to protect it according to Defendant’s internal policies, as well as state and 

federal law. Defendant obtained and continues to maintain Plaintiff’s PII/PHI and has a continuing 

legal duty and obligation to protect that PII/PHI from unauthorized access and disclosure. 

37. Plaintiff reasonably understood that a portion of the funds paid to Defendant would 

be used to pay for adequate cybersecurity and protection of PII/PHI. 

38. Plaintiff received a Notice of Data Breach on March 28, 2023. 

39. Through its Data Breach, Defendant compromised Plaintiff’s: 

a. name; 

b. home address; 

c. date of birth; 

d. Social Security number; 

e. medical history; 

f. health insurance information; 

g. treating physician; and 

h. diagnosis information. 

40. Plaintiff has spent—and will continue to spend—significant time and effort 

monitoring his accounts to protect himself from identity theft. After all, Defendant directed 

Plaintiff to take those steps in its breach notice. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 7 of 34 PageID #: 45
8

41. Plaintiff fears for his personal financial security and worries about what information 

was exposed in the Data Breach. 

42. Because of Defendant’s Data Breach, Plaintiff has suffered—and will continue to 

suffer from—anxiety, sleep disruption, stress, fear, and frustration. Such injuries go far beyond 

allegations of mere worry or inconvenience. Rather, Plaintiff’s injuries are precisely the type of 

injuries that the law contemplates and addresses. 

43. Plaintiff suffered actual injury from the exposure and theft of his PII/PHI—which 

violates his rights to privacy. 

44. Plaintiff suffered actual injury in the form of damages to and diminution in the 

value of his PII/PHI. After all, PII/PHI is a form of intangible property—property that Defendant 

was required to adequately protect. 

45. Plaintiff suffered imminent and impending injury arising from the substantially 

increased risk of fraud, misuse, and identity theft—all because Defendant’s Data Breach placed 

Plaintiff’s PII/PHI right in the hands of criminals. 

46. Because of the Data Breach, Plaintiff anticipates spending considerable amounts of 

time and money to try and mitigate his injuries. 

47. Today, Plaintiff has a continuing interest in ensuring that his PII/PHI—which, upon 

information and belief, remains backed up in Defendant’s possession—is protected and 

safeguarded from additional breaches. 

Plaintiff Loftice’s Experiences and Injuries 

48. Plaintiff Shae Loftice is a current patient of Defendant. She began receiving 

medical services from Defendant a number of years ago. 

49. Thus, Defendant obtained and maintained Plaintiff’s PII/PHI. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 8 of 34 PageID #: 46
9

50. As a result, Plaintiff Loftice was injured by Defendant’s Data Breach. 

51. As a condition of receiving medical services, Plaintiff provided Defendant with her

PII/PHI. Defendant used that PII/PHI to facilitate its provision of services and its collection of 

payment. 

52. In providing her PII/PHI to Defendant, Plaintiff Loftice trusted that Defendant 

would use reasonable measures to protect it according to Defendant’s internal policies, as well as 

state and federal law. Defendant obtained and continues to maintain Plaintiff’s PII/PHI and has a 

continuing legal duty and obligation to protect that PII/PHI from unauthorized access and 

disclosure. 

53. Plaintiff reasonably understood that a portion of the funds paid to Defendant would 

be used to pay for adequate cybersecurity and protection of PII/PHI. 

54. Plaintiff received a Notice of Data Breach on March, 2023. 

55. Through its Data Breach, Defendant compromised Plaintiff’s: 

a. name; 

b. home address; 

c. date of birth; 

d. medical history; 

e. health insurance information; 

f. treating physician; and 

g. diagnosis information. 

56. Plaintiff has already spent at least 20 hours on the Data Breach and will continue to 

spend significant time and effort monitoring her accounts to protect herself from identity theft. 

After all, Defendant directed Plaintiff to take those steps in its breach notice. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 9 of 34 PageID #: 47
10

57. Plaintiff fears for her personal financial security and worries about what 

information was exposed in the Data Breach. 

58. Because of Defendant’s Data Breach, Plaintiff has suffered—and will continue to 

suffer from—anxiety, sleep disruption, stress, fear, and frustration. Such injuries go far beyond 

allegations of mere worry or inconvenience. Rather, Plaintiff’s injuries are precisely the type of 

injuries that the law contemplates and addresses. 

59. Plaintiff suffered actual injury from the exposure and theft of her PII/PHI—which 

violates her rights to privacy. 

60. Plaintiff suffered actual injury in the form of damages to and diminution in the 

value of her PII/PHI. After all, PII/PHI is a form of intangible property—property that Defendant 

was required to adequately protect. 

61. Plaintiff suffered imminent and impending injury arising from the substantially 

increased risk of fraud, misuse, and identity theft—all because Defendant’s Data Breach placed 

Plaintiff’s PII/PHI right in the hands of criminals. 

62. Because of the Data Breach, Plaintiff anticipates spending considerable amounts of 

time and money to try and mitigate her injuries. 

63. In fact, following the Data Breach, in March 2023, Plaintiff was notified by Credit 

Wise, a credit and identity protection service, of a fraudulent attempt to open a credit line with JP 

Morgan Case & Co., suggesting that her information has been placed in the hands of 

cybercriminals. 

64. Plaintiff also experienced an increase in spam texts and phone calls since the Data 

Breach, further suggesting that her information is in the hands of cybercriminals. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 10 of 34 PageID #: 48
11

65. Today, Plaintiff has a continuing interest in ensuring that her PII/PHI—which, upon 

information and belief, remains backed up in Defendant’s possession—is protected and 

safeguarded from additional breaches. 

Plaintiffs and the Proposed Class Face Significant Risk of Continued Identity Theft 

66. Because of Defendant’s failure to prevent the Data Breach, Plaintiffs and Class 

members suffered—and will continue to suffer—damages. These damages include, inter alia, 

monetary losses, lost time, anxiety, and emotional distress. Also, they suffered or are at an 

increased risk of suffering: 

a. loss of the opportunity to control how their PII/PHI is used; 

b. diminution in value of their PII/PHI; 

c. compromise and continuing publication of their PII/PHI; 

d. out-of-pocket costs from trying to prevent, detect, and recovery from 

identity theft and fraud; 

e. lost opportunity costs and wages from spending time trying to mitigate the 

fallout of the Data Breach by, inter alia, preventing, detecting, contesting, 

and recovering from identify theft and fraud; 

f. delay in receipt of tax refund monies; 

g. unauthorized use of their stolen PII/PHI; and 

h. continued risk to their PII/PHI—which remains in Defendant’s 

possession—and is thus as risk for futures breaches so long as Defendant 

fails to take appropriate measures to protect the PII/PHI. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 11 of 34 PageID #: 49
12

67. Stolen PII/PHI is one of the most valuable commodities on the criminal information 

black market. According to Experian, a credit-monitoring service, stolen PII/PHI can be worth up 

to $1,000.00 depending on the type of information obtained. 

68. The value of Plaintiffs’ and Class’s PII/PHI on the black market is considerable. 

Stolen PII/PHI trades on the black market for years. And criminals frequently post and sell stolen 

information openly and directly on the “dark web”—further exposing the information. 

69. It can take victims years to discover such identity theft and fraud. This gives 

criminals plenty of time to sell the PII/PHI far and wide. 

70. One way that criminals profit from stolen PII/PHI is by creating comprehensive 

dossiers on individuals called “Fullz” packages. These dossiers are both shockingly accurate and 

comprehensive. Criminals create them by cross-referencing and combining two sources of data—

first the stolen PII/PHI, and second, unregulated data found elsewhere on the internet (like phone 

numbers, emails, addresses, etc.). 

71. The development of “Fullz” packages means that the PII/PHI exposed in the Data 

Breach can easily be linked to data of Plaintiffs and the Class that is available on the internet. 

72. In other words, even if certain information such as emails, phone numbers, or credit 

card numbers may not be included in the PII/PHI stolen by the cyber-criminals in the Data Breach, 

criminals can easily create a Fullz package and sell it at a higher price to unscrupulous operators 

and criminals (such as illegal and scam telemarketers) over and over. That is exactly what is 

happening to Plaintiffs and Class members, and it is reasonable for any trier of fact, including this 

Court or a jury, to find that Plaintiffs’ and other Class members’ stolen PII/PHI is being misused, 

and that such misuse is fairly traceable to the Data Breach. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 12 of 34 PageID #: 50
13

73. Defendant disclosed the PII/PHI of Plaintiffs and Class members for criminals to 

use in the conduct of criminal activity. Specifically, Defendant opened up, disclosed, and exposed 

the PII/PHI of Plaintiffs and Class members to people engaged in disruptive and unlawful business 

practices and tactics, including online account hacking, unauthorized use of financial accounts, 

and fraudulent attempts to open unauthorized financial accounts (i.e., identity fraud), all using the 

stolen PII/PHI. 

74. Defendant’s failure to promptly and properly notify Plaintiffs and Class members 

of the Data Breach exacerbated Plaintiffs’ and Class members’ injury by depriving them of the 

earliest ability to take appropriate measures to protect their PII/PHI and take other necessary steps 

to mitigate the harm caused by the Data Breach. 

Defendant Knew—Or Should Have Known—of the Risk of a Data Breach 

75. Defendant’s data security obligations were particularly important given the 

substantial increase in cyberattacks and or data breaches in recent years. 

76. In 2021, a record 1,862 data breaches occurred, exposing approximately 

293,927,708 sensitive records—a 68% increase from 2020.13 Of the 1,862 recorded data breaches, 

330 of them, or 17.7% were in the medical or healthcare industry.14 Those 330 reported breaches 

exposed nearly 30 million sensitive records (28,045,658), compared to only 306 breaches that 

exposed nearly 10 million sensitive records (9,700,238) in 2020.15

77. Indeed, cyberattacks have become so notorious that the Federal Bureau of 

Investigation (“FBI”) and U.S. Secret Service issue warnings to potential targets, so they are aware 

of, and prepared for, a potential attack. As one report explained, “[e]ntities like smaller 

13 See 2021 Data Breach Annual Report, IDENTITY THEFT RESOURCE CENTER (Jan. 2022) 

https://notified.idtheftcenter.org/s/. 

14 Id. 15 Id. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 13 of 34 PageID #: 51
14

municipalities and hospitals are attractive to ransomware criminals . . . because they often have 

lesser IT defenses and a high incentive to regain access to their data quickly.”16

78. In fact, according to the cybersecurity firm Mimecast, 90% of healthcare 

organizations experienced cyberattacks in the past year.17

79. Therefore, the increase in such attacks, and attendant risk of future attacks, was 

widely known to the public and to anyone in Defendant’s industry, including Defendant. 

Defendant Failed to Follow FTC Guidelines 

80. According to the Federal Trade Commission (“FTC”), the need for data security 

should be factored into all business decision-making. Thus, the FTC issued numerous guidelines 

identifying best data security practices that businesses—like Defendant—should use to protect 

against unlawful data exposure. 

81. In 2016, the FTC updated its publication, Protecting Personal Information: A 

Guide for Business. There, the FTC set guidelines for what data security principles and practices 

businesses must use.18 The FTC declared that, inter alia, businesses must: 

a. protect the personal customer information that they keep; 

b. properly dispose of personal information that is no longer needed; 

c. encrypt information stored on computer networks; 

d. understand their network’s vulnerabilities; and 

e. implement policies to correct security problems. 

16 Ben Kochman, FBI, Secret Service Warn of Targeted Ransomware, LAW360 (Nov. 18, 

2019), https://www.law360.com/articles/1220974/fbi-secret-service-warn-of-targeted-ransomware. 17 See Maria Henriquez, Iowa City Hospital Suffers Phishing Attack, SECURITY MAGAZINE (Nov. 23, 2020), 

https://www.securitymagazine.com/articles/93988-iowa-city-hospital-suffers-phishing-attack (last visited July 31, 

2022).

18 Protecting Personal Information: A Guide for Business, FEDERAL TRADE COMMISSION (Oct. 2016) 

https://www.ftc.gov/system/files/documents/plain-language/pdf-0136_proteting-personal-information.pdf. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 14 of 34 PageID #: 52
15

82. The guidelines also recommend that businesses watch for the transmission of large 

amounts of data out of the system—and then have a response plan ready for such a breach. 

83. Furthermore, the FTC explains that companies must: 

a. not maintain information longer than is needed to authorize a transaction; 

b. limit access to sensitive data; 

c. require complex passwords to be used on networks; 

d. use industry-tested methods for security; 

e. monitor for suspicious activity on the network; and 

f. verify that third-party service providers use reasonable security measures. 

84. The FTC brings enforcement actions against businesses for failing to protect 

customer data adequately and reasonably. Thus, the FTC treats the failure—to use reasonable and 

appropriate measures to protect against unauthorized access to confidential consumer data—as an 

unfair act or practice prohibited by Section 5 of the Federal Trade Commission Act (“FTCA”), 15 

U.S.C. § 45. Orders resulting from these actions further clarify the measures businesses must take 

to meet their data security obligations. 

85. In short, Defendant’s failure to use reasonable and appropriate measures to protect 

against unauthorized access to patients’ data constitutes an unfair act or practice prohibited by 

Section 5 of the FTCA, 15 U.S.C. § 45. 

Defendant Failed to Follow Industry Standards 

86. Several best practices have been identified that—at a minimum—should be 

implemented by businesses like Defendant. These industry standards include: educating all 

employees; strong passwords; multi-layer security, including firewalls, anti-virus, and antiCase 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 15 of 34 PageID #: 53
16

malware software; encryption (making data unreadable without a key); multi-factor authentication; 

backup data; and limiting which employees can access sensitive data. 

87. Other industry standard best practices include: installing appropriate malware 

detection software; monitoring and limiting the network ports; protecting web browsers and email 

management systems; setting up network systems such as firewalls, switches, and routers; 

monitoring and protection of physical security systems; protection against any possible 

communication system; and training staff regarding critical points. 

88. Defendant failed to meet the minimum standards of any of the following 

frameworks: the NIST Cybersecurity Framework Version 1.1 (including without limitation 

PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.AT-1, PR.DS-1, PR.DS-5, 

PR.PT-1, PR.PT-3, DE.CM-1, DE.CM-4, DE.CM-7, DE.CM-8, and RS.CO-2), and the Center for 

Internet Security’s Critical Security Controls (CIS CSC), which are all established standards in 

reasonable cybersecurity readiness. 

89. These frameworks are applicable and accepted industry standards. And by failing 

to comply with these accepted standards, Defendant opened the door to the criminals—thereby 

causing the Data Breach. 

Defendant Violated HIPAA 

90. HIPAA circumscribes security provisions and data privacy responsibilities 

designed to keep patients’ medical information safe. HIPAA compliance provisions, commonly 

known as the Administrative Simplification Rules, establish national standards for electronic 

transactions and code sets to maintain the privacy and security of protected health information.19

19 HIPAA lists 18 types of information that qualify as PHI according to guidance from the Department of Health and 

Human Services Office for Civil Rights, and includes, inter alia: names, addresses, any dates including dates of birth, 

Social Security numbers, and medical record numbers. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 16 of 34 PageID #: 54
17

91. HIPAA provides specific privacy rules that require comprehensive administrative, 

physical, and technical safeguards to ensure the confidentiality, integrity, and security of PII/PHI 

and PHI is properly maintained.20

92. The Data Breach itself resulted from a combination of inadequacies showing 

Defendant failed to comply with safeguards mandated by HIPAA. Defendant’s security failures 

include, but are not limited to: 

a. failing to ensure the confidentiality and integrity of electronic PHI that it 

creates, receives, maintains and transmits in violation of 45 C.F.R. § 

164.306(a)(1); 

b. failing to protect against any reasonably-anticipated threats or hazards to 

the security or integrity of electronic PHI in violation of 45 C.F.R. § 

164.306(a)(2); 

c. failing to protect against any reasonably anticipated uses or disclosures of 

electronic PHI that are not permitted under the privacy rules regarding 

individually identifiable health information in violation of 45 C.F.R. § 

164.306(a)(3); 

d. failing to ensure compliance with HIPAA security standards by Defendant’s 

workforce in violation of 45 C.F.R. § 164.306(a)(4); 

e. failing to implement technical policies and procedures for electronic 

information systems that maintain electronic PHI to allow access only to 

those persons or software programs that have been granted access rights in 

violation of 45 C.F.R. § 164.312(a)(1); 

20 See 45 C.F.R. § 164.306 (security standards and general rules); 45 C.F.R. § 164.308 (administrative safeguards); 45 

C.F.R. § 164.310 (physical safeguards); 45 C.F.R. § 164.312 (technical safeguards). 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 17 of 34 PageID #: 55
18

f. failing to implement policies and procedures to prevent, detect, contain and 

correct security violations in violation of 45 C.F.R. § 164.308(a)(1); 

g. failing to identify and respond to suspected or known security incidents and 

failing to mitigate, to the extent practicable, harmful effects of security 

incidents that are known to the covered entity in violation of 45 C.F.R. § 

164.308(a)(6)(ii); 

h. failing to effectively train all staff members on the policies and procedures 

with respect to PHI as necessary and appropriate for staff members to carry 

out their functions and to maintain security of PHI in violation of 45 C.F.R. 

§ 164.530(b) and 45 C.F.R. § 164.308(a)(5); and 

i. failing to design, implement, and enforce policies and procedures 

establishing physical and administrative safeguards to reasonably safeguard 

PHI, in compliance with 45 C.F.R. § 164.530(c). 

93. Simply put, the Data Breach resulted from a combination of insufficiencies that 

demonstrate Defendant failed to comply with safeguards mandated by HIPAA regulations. 

CLASS ACTION ALLEGATIONS 

94. Plaintiffs bring this class action under Fed. R. Civ. P. 23(a), 23(b)(2), and 23(b)(3), 

individually and on behalf of all members of the following class: 

All individuals residing in the United States whose PII/PHI was 

compromised in the Data Breach discovered by American Pain and 

Wellness, PLLC in November 2022. 

95. Excluded from the Class are Defendant, its agents, affiliates, parents, subsidiaries, 

any entity in which Defendant has a controlling interest, any Defendant officer or director, any 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 18 of 34 PageID #: 56
19

successor or assign, and any Judge who adjudicates this case, including their staff and immediate 

family. 

96. Plaintiffs reserve the right to amend the class definition. 

97. Certification of Plaintiffs’ claims for class-wide treatment is appropriate because 

Plaintiffs can prove the elements of their claims on class-wide bases using the same evidence as 

would be used to prove those elements in individual actions asserting the same claims. 

98. Ascertainability. All members of the proposed Class are readily ascertainable from 

information in Defendant’s custody and control. After all, Defendant already identified some 

individuals and sent them data breach notices. 

99. Numerosity. The Class members are so numerous that joinder of all Class members 

is impracticable. Upon information and belief, the proposed Class includes at least 7,457 members. 

100. Typicality. Plaintiffs’ claims are typical of Class members’ claims as each arises 

from the same Data Breach, the same alleged violations by Defendant, and the same unreasonable 

manner of notifying individuals about the Data Breach. 

101. Adequacy. Plaintiffs will fairly and adequately protect the proposed Class’s 

common interests. Their interests do not conflict with Class members’ interests. And Plaintiffs 

have retained counsel—including lead counsel—that is experienced in complex class action 

litigation and data privacy to prosecute this action on the Class’s behalf. 

102. Commonality and Predominance. Plaintiffs’ and the Class’s claims raise 

predominantly common fact and legal questions—which predominate over any questions affecting 

individual Class members—for which a class wide proceeding can answer for all Class members. 

In fact, a class wide proceeding is necessary to answer the following questions: 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 19 of 34 PageID #: 57
20

a. if Defendant had a duty to use reasonable care in safeguarding Plaintiffs’ 

and the Class’s PII/PHI; 

b. if Defendant failed to implement and maintain reasonable security 

procedures and practices appropriate to the nature and scope of the 

information compromised in the Data Breach; 

c. if Defendant were negligent in maintaining, protecting, and securing 

PII/PHI; 

d. if Defendant breached contract promises to safeguard Plaintiffs’ and the 

Class’s PII/PHI; 

e. if Defendant took reasonable measures to determine the extent of the Data 

Breach after discovering it; 

f. if Defendant’s Breach Notice was reasonable; 

g. if the Data Breach caused Plaintiffs and the Class injuries; 

h. what the proper damages measure is; and 

i. if Plaintiffs and the Class are entitled to damages, treble damages, and or 

injunctive relief. 

103. Superiority. A class action is superior to all other available means for the fair and 

efficient adjudication of this controversy. The damages or other financial detriment suffered by 

individual Class members are relatively small compared to the burden and expense that individual 

litigation against Defendant would require. Thus, it would be practically impossible for Class 

members, on an individual basis, to obtain effective redress for their injuries. Not only would 

individualized litigation increase the delay and expense to all parties and the courts, but 

individualized litigation would also create the danger of inconsistent or contradictory judgments 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 20 of 34 PageID #: 58
21

arising from the same set of facts. By contrast, the class action device provides the benefits of 

adjudication of these issues in a single proceeding, ensures economies of scale, provides 

comprehensive supervision by a single court, and presents no unusual management difficulties. 

FIRST CAUSE OF ACTION 

Negligence 

(On Behalf of Plaintiffs and the Class) 

104. Plaintiffs incorporate by reference all other paragraphs as if fully set forth herein. 

105. Plaintiffs and the Class entrusted their PII/PHI to Defendant on the premise and 

with the understanding that Defendant would safeguard their PII/PHI, use their PII/PHI for 

business purposes only, and/or not disclose their PII/PHI to unauthorized third parties. 

106. Defendant owed a duty of care to Plaintiffs and Class members because it was 

foreseeable that Defendant’s failure—to use adequate data security in accordance with industry 

standards for data security—would compromise their PII/PHI in a data breach. And here, that 

foreseeable danger came to pass. 

107. Defendant has full knowledge of the sensitivity of the PII/PHI and the types of harm 

that Plaintiffs and the Class could and would suffer if their PII/PHI was wrongfully disclosed. 

108. Defendant owed these duties to Plaintiffs and Class members because they are 

members of a well-defined, foreseeable, and probable class of individuals whom Defendant knew 

or should have known would suffer injury-in-fact from Defendant’s inadequate security practices. 

After all, Defendant actively sought and obtained Plaintiffs’ and Class members’ PII/PHI. 

109. Defendant owed—to Plaintiffs and Class members—at least the following duties 

to: 

a. exercise reasonable care in handling and using the PII/PHI in its care and 

custody; 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 21 of 34 PageID #: 59
22

b. implement industry-standard security procedures sufficient to reasonably 

protect the information from a data breach, theft, and unauthorized; 

c. promptly detect attempts at unauthorized access; 

d. notify Plaintiffs and Class members within a reasonable timeframe of any 

breach to the security of their PII/PHI. 

110. Thus, Defendant owed a duty to timely and accurately disclose to Plaintiffs and 

Class members the scope, nature, and occurrence of the Data Breach. After all, this duty is required 

and necessary for Plaintiffs and Class members to take appropriate measures to protect their 

PII/PHI, to be vigilant in the face of an increased risk of harm, and to take other necessary steps to 

mitigate the harm caused by the Data Breach. 

111. Defendant also had a duty to exercise appropriate clearinghouse practices to remove 

PII/PHI it was no longer required to retain under applicable regulations. 

112. Defendant knew or reasonably should have known that the failure to exercise due 

care in the collecting, storing, and using of the PII/PHI of Plaintiffs and the Class involved an 

unreasonable risk of harm to Plaintiffs and the Class, even if the harm occurred through the 

criminal acts of a third party. 

113. Defendant’s duty to use reasonable security measures arose because of the special 

relationship that existed between Defendant and Plaintiffs and the Class. That special relationship 

arose because Plaintiffs and the Class entrusted Defendant with their confidential PII/PHI, a 

necessary part of obtaining services from Defendant. 

114. The risk that unauthorized persons would attempt to gain access to the PII/PHI and 

misuse it was foreseeable. Given that Defendant holds vast amounts of PII/PHI, it was inevitable 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 22 of 34 PageID #: 60
23

that unauthorized individuals would attempt to access Defendant’s databases containing the 

PII/PHI —whether by malware or otherwise. 

115. PII/PHI is highly valuable, and Defendant knew, or should have known, the risk in 

obtaining, using, handling, emailing, and storing the PII/PHI of Plaintiffs and Class members and 

the importance of exercising reasonable care in handling it. 

116. Defendant improperly and inadequately safeguarded the PII/PHI of Plaintiffs and 

the Class in deviation of standard industry rules, regulations, and practices at the time of the Data 

Breach. 

117. Defendant breached these duties as evidenced by the Data Breach. 

118. Defendant acted with wanton and reckless disregard for the security and 

confidentiality of Plaintiffs’ and Class members’ PII/PHI by: 

a. disclosing and providing access to this information to third parties and 

b. failing to properly supervise both the way the PII/PHI was stored, used, and 

exchanged, and those in its employ who were responsible for making that 

happen. 

119. Defendant breached its duties by failing to exercise reasonable care in supervising 

its agents, contractors, vendors, and suppliers, and in handling and securing the personal 

information and PII/PHI of Plaintiffs and Class members which actually and proximately caused 

the Data Breach and Plaintiffs’ and Class members’ injury. 

120. Defendant further breached its duties by failing to provide reasonably timely notice 

of the Data Breach to Plaintiffs and Class members, which actually and proximately caused and 

exacerbated the harm from the Data Breach and Plaintiffs’ and Class members’ injuries-in-fact. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 23 of 34 PageID #: 61
24

121. Defendant has admitted that the PII/PHI of Plaintiffs and the Class was wrongfully 

lost and disclosed to unauthorized third persons because of the Data Breach. 

122. As a direct and traceable result of Defendant’s negligence and/or negligent 

supervision, Plaintiffs and Class members have suffered or will suffer damages, including 

monetary damages, increased risk of future harm, embarrassment, humiliation, frustration, and 

emotional distress. 

123. Defendant’s breach of its common-law duties to exercise reasonable care and its 

failures and negligence actually and proximately caused Plaintiffs and Class members actual, 

tangible, injury-in-fact and damages, including, without limitation, the theft of their PII/PHI by 

criminals, improper disclosure of their PII/PHI, lost benefit of their bargain, lost value of their 

PII/PHI, and lost time and money incurred to mitigate and remediate the effects of the Data Breach 

that resulted from and were caused by Defendant’s negligence, which injury-in-fact and damages 

are ongoing, imminent, immediate, and which they continue to face. 

SECOND CAUSE OF ACTION 

Negligence per se

(On Behalf of Plaintiffs and the Class) 

124. Plaintiffs incorporate by reference all other paragraphs as if fully set forth herein. 

125. Under the FTC Act, 15 U.S.C. § 45, Defendant had a duty to use fair and adequate 

computer systems and data security practices to safeguard Plaintiffs’ and Class members’ PII/PHI. 

126. Section 5 of the FTC Act prohibits “unfair . . . practices in or affecting commerce,” 

including, as interpreted and enforced by the FTC, the unfair act or practice by businesses, such as 

Defendant, of failing to use reasonable measures to protect the PII/PHI entrusted to it. The FTC 

publications and orders promulgated pursuant to the FTC Act also form part of the basis of 

Defendant’s duty to protect Plaintiffs’ and the Class members’ sensitive PII/PHI. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 24 of 34 PageID #: 62
25

127. Defendant breached its respective duties to Plaintiffs and Class members under the 

FTC Act by failing to provide fair, reasonable, or adequate computer systems and data security 

practices to safeguard PII/PHI. 

128. Defendant violated its duty under Section 5 of the FTC Act by failing to use 

reasonable measures to protect PII/PHI and not complying with applicable industry standards as 

described in detail herein. Defendant’s conduct was particularly unreasonable given the nature and 

amount of PII/PHI Defendant had collected and stored and the foreseeable consequences of a data 

breach, including, specifically, the immense damages that would result to individuals in the event 

of a breach, which ultimately came to pass. 

129. The harm that has occurred is the type of harm the FTC Act is intended to guard 

against. Indeed, the FTC has pursued numerous enforcement actions against businesses that, 

because of their failure to employ reasonable data security measures and avoid unfair and deceptive 

practices, caused the same harm as that suffered by Plaintiffs and members of the Class. 

130. But for Defendant’s wrongful and negligent breach of its duties owed, Plaintiffs 

and Class members would not have been injured. 

131. The injury and harm suffered by Plaintiffs and Class members was the reasonably 

foreseeable result of Defendant’s breach of their duties. Defendant knew or should have known 

that Defendant was failing to meet its duties and that its breach would cause Plaintiffs and members 

of the Class to suffer the foreseeable harms associated with the exposure of their PII/PHI. 

132. Similarly, under HIPAA, Defendant had a duty to follow HIPAA standards for 

privacy and security practices—as to protect Plaintiffs’ and Class members’ PHI. 

133. Defendant violated its duty under HIPAA by failing to use reasonable measures to 

protect its PHI and by not complying with applicable regulations detailed supra. Here too, 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 25 of 34 PageID #: 63
26

Defendant’s conduct was particularly unreasonable given the nature and amount of PHI that 

Defendant collected and stored and the foreseeable consequences of a data breach, including, 

specifically, the immense damages that would result to individuals in the event of a breach, which 

ultimately came to pass. 

134. Defendant’s various violations and its failure to comply with applicable laws and 

regulations constitutes negligence per se. 

135. As a direct and proximate result of Defendant’s negligence per se, Plaintiffs and 

Class members have suffered and will continue to suffer numerous injuries (as detailed supra). 

THIRD CAUSE OF ACTION 

Breach of Implied Contract 

(On Behalf of Plaintiffs and the Class) 

136. Plaintiffs incorporate by reference all other paragraphs as if fully set forth herein. 

137. Plaintiffs and Class members were required to provide their PII/PHI to Defendant 

as a condition of receiving medical services provided by Defendant. Plaintiffs and Class members 

provided their PII/PHI to Defendant or its third-party agents in exchange for Defendant’s medical 

services. 

138. Plaintiffs and Class members reasonably understood that a portion of the funds they 

paid Defendant would be used to pay for adequate cybersecurity measures. 

139. Plaintiffs and Class members reasonably understood that Defendant would use 

adequate cybersecurity measures to protect the PII/PHI that they were required to provide based 

on Defendant’s duties under state and federal law and its internal policies. 

140. Plaintiffs and the Class members accepted Defendant’s offers by disclosing their 

PII/PHI to Defendant or its third-party agents in exchange for medical services. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 26 of 34 PageID #: 64
27

141. In turn, and through internal policies, Defendant agreed to protect and not disclose 

the PII/PHI to unauthorized persons. 

142. In its Privacy Policy, Defendant represented that they had a legal duty to protect 

Plaintiffs’ and Class Member’s PII/PHI. 

143. Implicit in the parties’ agreement was that Defendant would provide Plaintiffs and 

Class members with prompt and adequate notice of all unauthorized access and/or theft of their 

PII/PHI. 

144. After all, Plaintiffs and Class members would not have entrusted their PII/PHI to 

Defendant or its third-party agents in the absence of such an agreement with Defendant. 

145. Plaintiffs and the Class fully performed their obligations under the implied 

contracts with Defendant. 

146. The covenant of good faith and fair dealing is an element of every contract. Thus, 

parties must act with honesty in fact in the conduct or transactions concerned. Good faith and fair 

dealing, in connection with executing contracts and discharging performance and other duties 

according to their terms, means preserving the spirit—and not merely the letter—of the bargain. 

In short, the parties to a contract are mutually obligated to comply with the substance of their 

contract in addition to its form. 

147. Subterfuge and evasion violate the duty of good faith in performance even when an 

actor believes their conduct to be justified. Bad faith may be overt or consist of inaction. And fair 

dealing may require more than honesty. 

148. Defendant materially breached the contracts it entered with Plaintiffs and Class 

members by: 

a. failing to safeguard their information; 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 27 of 34 PageID #: 65
28

b. failing to notify them promptly of the intrusion into its computer systems 

that compromised such information. 

c. failing to comply with industry standards; 

d. failing to comply with the legal obligations necessarily incorporated into 

the agreements; and 

e. failing to ensure the confidentiality and integrity of the electronic PII/PHI 

that Defendant created, received, maintained, and transmitted. 

149. In these and other ways, Defendant violated its duty of good faith and fair dealing. 

150. Defendant’s material breaches were the direct and proximate cause of Plaintiffs and 

Class members’ injuries (as detailed supra). 

151. Plaintiffs and Class members performed as required under the relevant agreements, 

or such performance was waived by Defendant’s conduct. 

FOURTH CAUSE OF ACTION 

Breach of Fiduciary Duty 

(On Behalf of Plaintiffs and the Class) 

152. Plaintiffs incorporate by reference all other paragraphs as if fully set forth herein. 

153. Given the relationship between Defendant and Plaintiffs and Class members, where 

Defendant became guardian of Plaintiffs’ and Class members' PII/PHI, Defendant became a 

fiduciary by its undertaking and guardianship of the PII/PHI, to act primarily for Plaintiffs and 

Class members, (1) for the safeguarding of Plaintiffs’ and Class members' PII/PHI; (2) to timely 

notify Plaintiffs and Class members of a Data Breach and disclosure; and (3) to maintain complete 

and accurate records of what information (and where) Defendant did and does store. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 28 of 34 PageID #: 66
29

154. Defendant has a fiduciary duty to act for the benefit of Plaintiffs and Class members 

upon matters within the scope of Defendant’s relationship with them—especially to secure their 

PII/PHI. 

155. Because of the highly sensitive nature of the PII/PHI, Plaintiffs and Class members 

would not have entrusted Defendant, or anyone in Defendant’s position, to retain their PII/PHI had 

they known the reality of Defendant’s inadequate data security practices. 

156. Defendant breached its fiduciary duties to Plaintiffs and Class members by failing 

to sufficiently encrypt or otherwise protect Plaintiffs’ and Class members' PII/PHI. 

157. Defendant also breached its fiduciary duties to Plaintiffs and Class members by 

failing to diligently discover, investigate, and give notice of the Data Breach in a reasonable and 

practicable period. 

158. As a direct and proximate result of Defendant's breach of its fiduciary duties, 

Plaintiffs and Class members have suffered and will continue to suffer numerous injuries (as 

detailed supra). 

FIFTH CAUSE OF ACTION 

Intrusion upon Seclusion/Invasion of Privacy 

(On Behalf of Plaintiffs and the Class) 

159. Plaintiffs incorporate by reference all other paragraphs as if fully set forth herein. 

160. The State of Texas recognizes the tort of Intrusion upon Seclusion, and adopts the 

formulation of that tort found in the Restatement (Second) of Torts, which states: 

One who intentionally intrudes, physically or otherwise, upon the 

solitude or seclusion of another or his private affairs or 

concerns, is subject to liability to the other for invasion of his 

privacy, if the intrusion would be highly offensive to a 

reasonable person. 

Restatement (Second) of Torts§ 652B (1977). 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 29 of 34 PageID #: 67
30

161. Plaintiffs and the Class had a legitimate expectation of privacy regarding their 

highly sensitive and confidential PII/PHI and were accordingly entitled to the protection of this 

information against disclosure to unauthorized third parties. 

162. Defendant owed a duty to its current and former patients, including Plaintiffs and 

the Class, to keep this information confidential. 

163. The unauthorized acquisition (i.e., theft) by a third party of Plaintiffs’ and Class 

members’ PII/PHI is highly offensive to a reasonable person. 

164. The intrusion was into a place or thing which was private and entitled to be private. 

Plaintiffs and the Class disclosed their sensitive and confidential information to Defendant, but did 

so privately, with the intention that their information would be kept confidential and protected 

from unauthorized disclosure. Plaintiffs and the Class were reasonable in their belief that such 

information would be kept private and would not be disclosed without their authorization. 

165. The Data Breach constitutes an intentional interference with Plaintiffs’ and the 

Class’s interest in solitude or seclusion, either as to their person or as to their private affairs or 

concerns, of a kind that would be highly offensive to a reasonable person. 

166. Defendant acted with a knowing state of mind when it permitted the Data Breach 

because it knew its information security practices were inadequate. 

167. Defendant acted with a knowing state of mind when it failed to notify Plaintiffs and 

the Class in a timely fashion about the Data Breach, thereby materially impairing their mitigation 

efforts. 

168. Acting with knowledge, Defendant had notice and knew that its inadequate 

cybersecurity practices would cause injury to Plaintiffs and the Class. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 30 of 34 PageID #: 68
31

169. As a proximate result of Defendant’s acts and omissions, the private and sensitive 

PII/PHI of Plaintiffs and the Class were stolen by a third party and is now available for disclosure 

and redisclosure without authorization, causing Plaintiffs and the Class to suffer damages (as 

detailed supra). 

170. Unless and until enjoined and restrained by order of this Court, Defendant’s 

wrongful conduct will continue to cause great and irreparable injury to Plaintiffs and the Class 

since their PII/PHI are still maintained by Defendant with their inadequate cybersecurity system 

and policies. 

171. Plaintiffs and the Class have no adequate remedy at law for the injuries relating to 

Defendant’s continued possession of their sensitive and confidential records. A judgment for 

monetary damages will not end Defendant’s inability to safeguard the PII/PHI of Plaintiffs and the 

Class. 

172. In addition to injunctive relief, Plaintiffs, on behalf of themselves and the other 

Class members, also seeks compensatory damages for Defendant’s invasion of privacy, which 

includes the value of the privacy interest invaded by Defendant, the costs of future monitoring of 

their credit history for identity theft and fraud, plus prejudgment interest and costs. 

SIXTH CAUSE OF ACTION 

Unjust Enrichment 

(On Behalf of Plaintiffs and the Class) 

173. Plaintiffs incorporate by reference all other paragraphs as if fully set forth herein. 

174. This claim is pleaded in the alternative to the breach of implied contract claim. 

175. Plaintiffs and Class members conferred a benefit upon Defendant. After all, 

Defendant benefitted from using their PII/PHI to facilitate its provision of services and its 

collection of payment. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 31 of 34 PageID #: 69
32

176. Defendant appreciated or had knowledge of the benefits it received from Plaintiffs 

and Class members. And Defendant benefited from receiving Plaintiffs’ and Class members’ 

PII/PHI, as this was used to facilitate its provision of services and its collection of payment. 

177. Plaintiffs and Class members reasonably understood that Defendant would use 

adequate cybersecurity measures to protect the PII/PHI that they were required to provide based 

on Defendant’s duties under state and federal law and its internal policies. 

178. Defendant enriched itself by saving the costs they reasonably should have expended 

on data security measures to secure Plaintiffs’ and Class members’ PII/PHI. 

179. Instead of providing a reasonable level of security, or retention policies, that would 

have prevented the Data Breach, Defendant instead calculated to avoid its data security obligations 

at the expense of Plaintiffs and Class members by utilizing cheaper, ineffective security measures. 

Plaintiffs and Class members, on the other hand, suffered as a direct and proximate result of 

Defendant’s failure to provide the requisite security. 

180. Under principles of equity and good conscience, Defendant should not be permitted 

to retain the full value of Plaintiffs’ and Class members’ payment because Defendant failed to 

adequately protect their PII/PHI. 

181. Plaintiffs and Class members have no adequate remedy at law. 

182. Defendant should be compelled to disgorge into a common fund—for the benefit 

of Plaintiffs and Class members—all unlawful or inequitable proceeds that it received because of 

its misconduct. 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 32 of 34 PageID #: 70
33

PRAYER FOR RELIEF 

Plaintiffs and Class members respectfully request judgment against Defendant and that the 

Court enter an order: 

A. Certifying this case as a class action on behalf of Plaintiffs and the proposed Class, 

appointing Plaintiffs as class representatives, and appointing their counsel to 

represent the Class; 

B. Awarding declaratory and other equitable relief as necessary to protect the interests 

of Plaintiffs and the Class; 

C. Awarding injunctive relief as necessary to protect the interests of Plaintiffs and the 

Class; 

D. Awarding Plaintiffs and the Class damages including applicable compensatory, 

exemplary, punitive damages, and statutory damages, as allowed by law; 

E. Awarding restitution and damages to Plaintiffs and the Class in an amount to be 

determined at trial; 

F. Awarding attorneys’ fees and costs, as allowed by law; 

G. Awarding prejudgment and post-judgment interest, as provided by law; 

H. Granting Plaintiffs and the Class leave to amend this complaint to conform to the 

evidence produced at trial; and 

I. Granting other relief that this Court finds appropriate. 

 

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 33 of 34 PageID #: 71
34

DEMAND FOR JURY TRIAL 

Plaintiffs demand a jury trial for all claims so triable. 

Date: April 24, 2023 Respectfully submitted, 

/s/ Joe Kendall 

JOE KENDALL

Texas Bar No. 11260700 

KENDALL LAW GROUP, PLLC 

3811 Turtle Creek Blvd., Suite 1450 

Dallas, Texas 75219 

214-744-3000 / 214-744-3015 (Facsimile) 

jkendall@kendalllawgroup.com

 TURKE & STRAUSS LLP 

 Samuel J. Strauss (pro hac vice to be filed) 

 Raina Borrelli (pro hac vice to be filed) 

 613 Williamson Street, Suite 201 

 Madison, Wisconsin 53703 

 Telephone: (608) 237-1775 

 Facsimile: (608) 509-4423 

 sam@turkestrauss.com 

 raina@turkestrauss.com 

 Attorneys for Plaintiffs and Proposed Class

CERTIFICATE OF SERVICE

 I hereby certify that a copy of the foregoing document was served on all counsel of record 

on April 24, 2023 via CM/ECF, in accordance with the Federal Rules of Civil Procedure. 

 /s/ Joe Kendall 

 JOE KENDALL

Case 4:23-cv-00295-ALM Document 4 Filed 04/24/23 Page 34 of 34 PageID #: 72