Opinion
Case No.: 14–02379–5–SWH Adversary Proceeding No.: 16–00142–5–SWH
03-20-2017
IN RE: Wayne Edward BRANCH, Debtor Wayne Edward Branch, Plaintiff, v. Wakemed, fka Wake County Hospital System, Inc., Defendant.
Joseph Zachary Frost, Stubbs & Perdue, P.A., Raleigh, NC, for Plaintiff. Andrew H. Erteschik, Lisa P. Sumner, Poyner Spruill LLP, Raleigh, NC, Kristen Price Miller, Poyner & Spruill, Rocky Mount, NC, Matthew Nis Leerberg, Smith Moore Leatherwood LLP, Raleigh, NC, Robert R. Marcus, Smith Moore Leatherwood LLP, Charlotte, NC, for Defendant.
Joseph Zachary Frost, Stubbs & Perdue, P.A., Raleigh, NC, for Plaintiff.
Andrew H. Erteschik, Lisa P. Sumner, Poyner Spruill LLP, Raleigh, NC, Kristen Price Miller, Poyner & Spruill, Rocky Mount, NC, Matthew Nis Leerberg, Smith Moore Leatherwood LLP, Raleigh, NC, Robert R. Marcus, Smith Moore Leatherwood LLP, Charlotte, NC, for Defendant.
ORDER REGARDING MOTION TO DISMISS ADVERSARY PROCEEDING
Stephani W. Humrickhouse, United States Bankruptcy Judge
The matter before the court is the motion to dismiss this adversary proceeding pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure, made applicable to this adversary proceeding by Federal Rule of Bankruptcy Procedure 7012, filed by defendant WakeMed f/k/a Wake County Hospital System, Inc. ("WakeMed"), AP Dkt. 9. A hearing took place in Raleigh, North Carolina on January 25, 2017.
References to docket entries in this adversary proceeding are referred to herein as "AP Dkt. ––––." References to docket entries in the underlying bankruptcy case are referred to herein as "BR Dkt. ––––."
BACKGROUND
Wayne Edward Branch filed a voluntary petition for relief under chapter 7 of the Bankruptcy Code on April 25, 2014. WakeMed filed a proof of claim in the case in the amount of $4,910.00 on August 10, 2015. Claim No. 3–1. The proof of claim included an attachment that listed Mr. Branch's medical record number and patient numbers, as well as his dates of admission and discharge Id. On December 23, 2015, Mr. Branch through counsel filed an Ex–Parte Motion to Seal Proof of Claim No. 3, BR Dkt. 143. On December 29, 2015, an order granting the motion to seal was allowed, BR Dkt. 144.
The testimony at the hearings on the Sanctions Motion established that a different number is associated with each "encounter" or billing event, so each patient can have multiple "patient numbers." These numbers are distinct from the "medical record number."
Meanwhile, on December 4, 2015, a miscellaneous proceeding was commenced in which WakeMed filed an Ex Parte Global Motion to Establish a Procedure to Restrict Public Access to Certain Claims Pursuant to 11 U.S.C. § 107(c) and Federal Rule of Bankruptcy Procedure 9037. See Misc. Pro. No. 15–00004–5–SWH (the "Miscellaneous Proceeding"), Dkt. 1. After a hearing on December 7, 2015, an Order Establishing Procedure to Restrict Public Access was entered on December 11, 2015. Misc. Pro. Dkt. 5. Thereafter, a series of motions to seal and orders allowing those motions were filed, effectively restricting from public view all claims filed by WakeMed on or after December 1, 2007 (the effective date of Federal Rule of Bankruptcy Procedure 9037 ), and some earlier-filed claims. See generally Misc. Pro. Dkts. 6, 7, 8, 9, 12, 13, 14, 16, 20, 22, 24, 25, 27, 28.
Because many of the documents filed in the Miscellaneous Proceeding contained the names and case numbers of debtors whose personal information may have been disclosed, and because the claims could not as a practical matter be immediately restricted from public access upon the filing of those documents, the court restricted the entire Miscellaneous Proceeding from public view to protect those debtors' information during that delay.
The court may take judicial notice of filings in this court in considering a motion under Rule 12(b)(6), without converting the motion to one under Rule 56. Philips v. Pitt Cnty. Mem. Hosp., 572 F.3d 176, 180 (4th Cir. 2009) (in reviewing a Rule 12(b)(6) dismissal, courts may properly take judicial notice of matters of public record) (citing Hall v. Virginia, 385 F.3d 421, 424 (4th Cir. 2004) ).
On January 15, 2016, WakeMed filed a status report, Misc. Pro. Dkt. 19, indicating that it had moved to restrict access to 2,819 claims in closed cases, 788 claims filed before September 1, 2013 in open cases, and 602 claims filed after September 1, 2013 in open cases. According to the status report, on December 31, 2015, debtors whose protected health information may have been disclosed were sent notices required by the Healthcare Insurance Portability and Accountability Act ("HIPAA"), offering one year of third-party credit monitoring at no charge. Misc. Pro. Dkt. 19 at 3.
On January 7, 2016, a motion for contempt and sanctions was filed on behalf of Mr. Branch. Branch Dkt. 146 (the "Sanctions Motion"). In the Sanctions Motion, Mr. Branch contended that by filing a proof of claim containing personal information that should have been redacted, WakeMed violated Rule 9037 of the Federal Rules of Bankruptcy Procedure, HIPAA, and possibly other obligations to the debtor. After hearing four days of testimony and argument on Mr. Branch's motion and similar motions filed by two other debtors, Mr. Branch's Sanctions Motion was denied in an order dated August 31, 2016, BR Dkt. 174 (the "Sanctions Order"). There, the court found that "the claim filed in Mr. Branch's case did not disclose any information that clearly must be redacted under Rule 9037," and thus "WakeMed has not knowingly violated any provision of the Bankruptcy Code and Rules with respect to Mr. Branch." BR Dkt. 174 at 20. The court specifically declined to consider whether WakeMed violated HIPAA or other non-bankruptcy laws. Id. at 17 ("This court is not a HIPAA compliance tribunal, and will limit its inquiry to whether the Bankruptcy Code or Rules have been violated and, if so, what remedy is available for those violations under the bankruptcy laws.").
On September 15, 2016, Mr. Branch filed the complaint in this adversary proceeding, seeking
compensatory and punitive damages, and attorneys' fees and expenses, arising from and in redress of Defendant's grossly negligent conduct including, inter alia , its repeated failure to comply with applicable standards, policies, regulations, and laws governing the dissemination, disclosure, and publication of sensitive, private, and protected account-related and health information relating to its patients, including Plaintiff.
AP Dkt. 1 at ¶ 1. Specifically, Mr. Branch contends that the attachment to the proof of claim included Mr. Branch's patient account number, medical record number, and admission and discharge dates, and that the inclusion of this information on a publicly-available document violated WakeMed's duty to protect certain health information under HIPAA and was grossly negligent. Mr. Branch further contends that he is, as a result, "exposed to an increased likelihood that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose." AP Dkt. 1 at ¶ 43. He maintains that he has suffered "significant damages," including the "costs, expenses and attorneys' fees associated with protecting and safeguarding his private ... information and the prosecution of this action." Id. at ¶ 46. The amount of attorneys' fees sought includes those previously submitted to the court in conjunction with the Sanctions Motion, which were denied in part because the court found there was no violation of Rule 9037 as to Mr. Branch.
The Complaint also includes allegations related to unredacted claims filed by WakeMed in other bankruptcy cases, apparently to bolster Mr. Branch's claim that he is entitled to receive punitive damages. The court imposed substantial sanctions against WakeMed in its Sanctions Order for those many violations, intending for that order to reprimand WakeMed sufficiently for its wrongdoing and to put an end to the matter. See BR Dkt. 174 at 30 ("This is not to say that WakeMed will continue to be subject to sanctions in the future for past transgressions; it appears to the court that compliance with this order and the actions taken to date are sufficient to remedy the past violations absent some evidence of direct, actual damages to a debtor resulting from the disclosure of his or her particular information.").
WakeMed seeks dismissal on two grounds: first, that Mr. Branch lacks standing to pursue the action because he has suffered no actual injury; and second, that Mr. Branch has failed to state a claim for negligence because WakeMed has breached no duty to Mr. Branch. AP Dkt. 9, 10. WakeMed also raised a concern with respect to the court's jurisdiction under Stern v. Marshall, 564 U.S. 462, 131 S.Ct. 2594, 180 L.Ed.2d 475 (2011), see AP Dkt. 17; however, because the district court retains de novo appellate jurisdiction over any legal conclusions this court might reach in its ruling on a motion to dismiss, any Stern concerns are alleviated.
DISCUSSION
I. STANDING UNDER RULE 12(b)(1)
WakeMed first contends that this court lacks subject-matter jurisdiction over this adversary proceeding because Mr. Branch lacks standing to pursue the claim. Specifically, WakeMed contends that the injury that Mr. Branch asserts—that he "has been, and continues to be, exposed to an increased likelihood that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose"—is insufficient to establish an "injury in fact" as required to confer standing upon him. WakeMed maintains that the risk of actual damages is speculative, that Mr. Branch cannot seek recovery for his alleged mitigation costs, and that he cannot recover attorney fees for either the prior action or the present one. Mr. Branch, on the other hand, disagrees that he has not been injured and that he cannot recover all of the damages he seeks, but contends that at a minimum he suffered damages in the nature of fees and costs incurred to restrict access to the proof of claim filed by WakeMed.
To have standing to bring a claim in federal court, a "plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , ––– U.S. ––––, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016) (citing Lujan v. Defenders of Wildlife , 504 U.S. 555, 560–61, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). An injury in fact requires both a "concrete" and "particularized" harm, which must be "actual or imminent, not conjectural or hypothetical." Spokeo , 136 S.Ct. at 1548 (citing Lujan , 504 U.S. at 560, 112 S.Ct. 2130 ).
The following allegations of the Complaint set forth Mr. Branch's asserted injury:
21. ... Plaintiff incurred attorneys' fees of $14,268.00, and expenses totaling $134.00 through March 17, 2016, in connection with the prosecution of the Sanctions Motion and compelling Defendant's compliance with its affirmative obligations, under the Bankruptcy Code, the Federal Rules of Bankruptcy Procedure, and other regulations and rules, from disclosing, publishing or otherwise disseminating certain protected health information to third parties and the general public....
43. As a result of Defendant's actions and grossly negligent, negligent, or willful handling and safeguarding of Plaintiff's personal, private, non-public information, he has been and continues to be, exposed to an increased likelihood that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose.
46. As a direct and proximate result of the foregoing actions of Defendants (sic), Plaintiffs (sic) have suffered significant damages including, but not limited to, the costs, expenses and attorneys' fees associated with protecting and safeguarding his private, non-public, personal, and protected information and the prosecution of this action.
50. By virtue of the foregoing, Plaintiff is entitled to an award of actual damages against Defendant, on account of their (sic) course of conduct, including but not limited to, the costs associated with future credit monitoring, reasonable attorneys' fees and expenses incurred by Plaintiff in connection with the prosecution of this matter and protecting his personal, private and protected information.
70. As a direct and proximate result of Defendant's gross negligence and negligence, Plaintiff has suffered significant financial harm and other such damages, which were reasonably foreseeable to Defendant and are anticipated to continue into the future.
71. Plaintiff, on account of the foregoing, are (sic) entitled to have and recover from Defendant actual damages in an amount to be determined at trial of this matter on account of their (sic) misconduct, malfeasance, negligence, and gross negligence.
AP Dkt. 1. The prayer for relief requests an order for, among other things, the following:
1. ... all the actual and compensatory damages suffered as a result of the actions and course of conduct of Defendant outlined above and those reasonable costs and expenses necessary in restricting and protecting further publication, disclosure, and dissemination of the protected personal identification information contained in the Proof of Claim and prosecution of this action against Defendant, which includes, but is not limited to, those reasonable attorneys' fees and costs incurred by Plaintiff in an aggregate amount exceeding TWENTY–FIVE THOUSAND DOLLARS ($25,000);
2. ... punitive damages ...
AP Dkt. 1 at 19.
In his Response and Memorandum of Law in Opposition to Motion to Dismiss ("Response"), Mr. Branch clarifies the damages he seeks in an effort to establish that they are actual and concrete: his information was in a proof of claim that was available to the public for at least 141 days, and
that but for the Plaintiff's efforts which culminated in the restriction of public access to said information, [and] the costs, expenses and attorneys' fees [that] were incurred by Plaintiff, his protected health information would still be exposed to the general public. Thus, the gravamen of Plaintiff's injury is not some speculation that his identity and protected information may have been compromised, it is the concrete and actual steps he was forced to take to correct the grossly negligent disclosure of his protected health information and prevent further disclosure, manipulation and dissemination, including the costs, expenses, and attorneys' fees that were incurred in connection with the remedial efforts that Plaintiff undertook in restricting access to the protected health information the preparation and filing of the Motion to Seal, and the expenses and costs related thereto.
AP Dkt. 23 at 2–3 (emphasis in original). (Of course, the statement that the information would still be on the public record but for Mr. Branch's motion to restrict access is an exaggeration, as WakeMed was taking steps to restrict access to all of its filed claims beginning in December 2015, before Mr. Branch's motion to restrict access was filed, in the Miscellaneous Proceeding.)
WakeMed asserts that Mr. Branch's allegations do not establish actual injury for purposes of standing for three reasons:
(1) The "increased likelihood" of harm is speculative or hypothetical;
(2) Mr. Branch cannot seek damages for his alleged mitigation costs, because:
(a) The court has already determined that Mr. Branch is not entitled to attorneys' fees incurred in pursuing the Sanctions Motion;
(b) North Carolina law does not allow plaintiffs to recover past litigation fees and costs as damages; and
(c) Mitigation costs for speculative future risk cannot create standing; and
(3) Attorneys' fees incurred in this action do not constitute actual damages, because there is no basis upon which to shift fees and because standing requires prior harm.
AP Dkts. 9, 10.
A. The Speculative or Hypothetical Nature of the Alleged Harm
Just last month, and after the hearing on this matter, the United States Court of Appeals for the Fourth Circuit considered whether "the harm from the increased risk of future identity theft and the cost of measures to protect against it" was sufficient to establish Article III standing where two data breaches at a Veterans Affairs medical center compromised the plaintiffs' personal information. Beck v. McDonald , 848 F.3d 262 (4th Cir. 2017). In Beck , two putative class actions were filed related to two separate data breaches: one involved a stolen laptop containing unencrypted personal information, while the other involved misplaced or stolen long-term storage boxes of pathology reports containing patients' identifying information. In both cases, the plaintiffs sought declaratory relief and monetary damages under the Privacy Act of 1974, 5 U.S.C. § 552a et seq. , the Administrative Procedures Act, and damages for common-law negligence. Specifically, the plaintiffs alleged that
"Defendants' failures" and "violations" of the Privacy Act "caused Plaintiffs ... embarrassment, inconvenience, unfairness, mental distress, and the threat of current and future substantial harm
from identity theft and other misuse of their Personal Information." J.A. 12. They further allege that the "threat of identity theft" required them to frequently monitor their "credit reports, bank statements, health insurance reports, and other similar information, purchas[e] credit watch services, and [shift] financial accounts." J.A. 12.
In the first case, the defendants moved to dismiss the complaint for lack of subject-matter jurisdiction or, in the alternative, for failure to state a claim. The district court dismissed the common-law negligence claim, but did not dismiss the remaining claims. On summary judgment, however, the defendants renewed their motion to dismiss for lack of subject-matter jurisdiction, which was allowed for lack of standing because the plaintiffs' fear of harm from future identity theft was " ‘contingent on a chain of attenuated hypothetical events and actions by third parties independent of the defendants.’ " Id. at 268. In the second case, the district court dismissed the complaint for lack of subject-matter jurisdiction because the plaintiff " ‘ha[d] not alleged that there ha[d] been any actual or attempted misuse of her personal information,’ thus rendering her allegation that her information ‘will eventually be misused as a result of the disappearance of the boxes ... speculative.’ " Id. at 269.
Reviewing the matters de novo , the Fourth Circuit affirmed the dismissals. After first considering the tenets established with respect to "threatened injury" in Clapper v. Amnesty International USA , 568 U.S. 398, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013), the Beck court determined that the theft of the laptop and boxes containing the personal information, without any allegation that the plaintiffs' personal information had been accessed or misused or that the plaintiffs had suffered identity theft, was insufficient to confer standing for purposes of Article III:
Indeed, for the Plaintiffs to suffer the harm of identity theft that they fear, we must engage with the same "attenuated chain of possibilities" rejected by the Court in Clapper , 133 S.Ct. at 1147–48. In both cases, we must assume that the thief targeted the stolen items for the personal information they contained. And in both cases, the thieves must then select, from thousands of others, the personal information of the named plaintiffs and attempt successfully to use that information to steal their identities. This "attenuated chain" cannot confer standing.
848 F.3d at 275. The court also rejected the plaintiffs' contention that because the defendants offered free credit monitoring to the plaintiffs, the defendants conceded that the theft constituted a reasonable risk of harm to the plaintiffs. Id.
The Beck court then turned to whether the plaintiffs suffered an injury in fact because they incurred "the cost of measures to guard against identity theft, including the costs of credit monitoring services." Id. at 276. Because the harm the plaintiffs sought to mitigate was speculative, the court found that mitigation costs were also insufficient to confer standing:
As was the case in Clapper , the Plaintiffs here seek "to bring this action based on costs they incurred in response to a speculative threat," i.e. their fear of future identity theft based on the breaches at Dorn VAMC. [133 S.Ct.] at 1151. But this allegation is merely "a repackaged version of [Plaintiffs'] first failed theory of standing." Id. Simply put, these self-imposed harms cannot confer standing. See, e.g., Remijas [v. Neiman Marcus Grp., LLC] , 794 F.3d [688] at 694 [ (7th Cir. 2015) ] ("Mitigation
expenses do not qualify as actual injuries where the harm is not imminent."); Reilly [v. Ceridian Corp.] , 664 F.3d [38] at 46 [ (3d Cir. 2011) ] ("[P]rophylactically spen[ding] money to ease fears of [speculative] future third-party criminality ... is not sufficient to confer standing.").
This court also noted the speculative nature of potential identity theft as an appropriate basis for damages in its Sanctions Order.
Most courts have rejected credit monitoring as an appropriate remedy, as "potential identity theft" is too speculative. See, e.g., [In re] Barnhart , 2010 Bankr. LEXIS 471, 2010 WL 724703 (claim included social security number, date of birth, loan account number; risk that information could be used in the future too speculative to allege actual damages), Ki llian v. Green Tree Servicing, LLC, (In re Killian), Adv. Proc. No. 08–80250–HB [2009 WL 2927950, at *8–9], 2009 Bankr. LEXIS 2030, at *29 (Bankr. D.S.C. July 23, 2009) (dismissing claim for damages on the grounds that potential identity theft and costs of credit monitoring are speculative damages); Davis v. Eagle Legacy Credit Union (In re Davis) , 430 B.R. 902 (Bankr. D. Colo. 2010) (social security number, date of birth, and driver's license number included in claim; "the harm Plaintiff asserts is not ‘actual’ or ‘imminent,’ for there is no evidence that Plaintiff's personal information has been accessed or misused by an unauthorized third party during the six days when it was viewable by the public on PACER, nor that it will be. In the absence of such evidence, Plaintiff's need for credit monitoring is conjectural or hypothetical. Thus, there is no injury in fact and Plaintiff lacks standing to bring any cause of action against Defendant.").
BR Dkt. 174 at 24.
In his brief and at the hearing on this matter, Mr. Branch attempted to distinguish Clapper and other cases relied upon by WakeMed with respect to whether Mr. Branch asserted an injury in fact. However, the Beck court's subsequent reliance on Clapper on facts analogous to these, as well as its specific conclusions related to the speculative risk of identity theft and mitigation costs and its distinction of those cases in which allegations "sufficed to push the threatened injury of future identity theft beyond the speculative to the sufficiently imminent," Beck , 848 F.3d at 274, render Mr. Branch's argument unpersuasive.
The Beck court noted that the cases relied upon by the plaintiffs, which are also cited by Mr. Branch, "demonstrate why the Plaintiffs' theory is too speculative to constitute an injury-in-fact," as those cases included common allegations that the personal information of the plaintiffs had actually been stolen, and at least one named plaintiff in two of the cases "alleged misuse or access of that personal information by the thief." Beck, 848 F.3d at 274 (discussing Galaria v. Nationwide Mut. Ins. Co., 663 Fed.Appx. 384 (6th Cir. 2016) ; Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688 (7th Cir. 2015) ; Pisciotta v. Old Nat'l Bancorp, 499 F.3d 629 (7th Cir. 2007) ; and Krottner v. Starbucks Corp., 628 F.3d 1139 (9th Cir. 2010).
Mr. Branch's Complaint does not allege that anyone actually accessed the proof of claim filed in his case before it was restricted from public view, nor that the information contained on the proof of claim has been used in any way. In addition, the Complaint does not contain any facts that explain what risk Mr. Branch faces as a result of the disclosure of the particular types of data contained on the proof of claim filed by WakeMed in his case. The proof of claim did not contain Mr. Branch's social security number or date of birth, nor did it include any account numbers linked to a credit card or other account at a financial institution. The court is thus left to speculate what harm could come to Mr. Branch should a third party access the information that was included on the proof of claim: his medical record number, various account numbers related to the invoices for specific encounters at WakeMed, and the dates of admission and discharge. As the court noted in finding that these disclosures did not violate Rule 9037, there is nothing here that subjects Mr. Branch to identity theft, and the court is left hypothesizing as to what Mr. Branch feels he must protect himself against.
And, as WakeMed has noted, Mr. Branch included his dates of admission in his Complaint, which is not in any way restricted from public access. See AP Dkt. 1 at 4, ¶ 16.
Based on the reasoning set forth by the Fourth Circuit in Beck , the court finds that the injury asserted by Mr. Branch of "increased likelihood of that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose," including the damages "associated with protecting and safeguarding his private, non-public, personal, and protected information," and the "costs associated with future credit monitoring, ... and protecting his personal, private and protected information," is too speculative to support standing under Article III.
B. Alleged Mitigation Costs
WakeMed contends that Mr. Branch's alleged mitigation costs, which include attorneys' fees and costs related to the Motion to Restrict Access and the Sanctions Motion, are also insufficient to confer standing on Mr. Branch for three reasons: (a) the court has already determined that Mr. Branch is not entitled to attorneys' fees incurred in pursuing the Sanctions Motion, and Mr. Branch is barred by issue preclusion from re-litigating the issue; (b) North Carolina law does not allow plaintiffs to recover past litigation fees and costs as damages; and (c) mitigation costs for speculative future risks cannot create standing. The court will consider each of these arguments in turn.
1. Issue Preclusion
WakeMed contends that this court has already determined that Mr. Branch is not entitled to recover his attorneys' fees and costs incurred in connection with the Sanctions Motion, and thus he is barred by collateral estoppel from seeking recovery of those fees (or asserting them as an element of his damages) in this adversary proceeding. At first blush, that argument is compelling. The court heard evidence for days, including evidence about whether HIPAA allowed the disclosure of certain information in connection with collection on an account.
However, collateral estoppel requires four elements to be met to limit re-litigation of an issue:
(1) the issue sought to be precluded was the same as that involved in the prior action;
(2) the issue was actually litigated;
(3) it was determined by a valid and final judgment; and
(4) the determination was essential to the prior judgment.
Combs v. Richardson , 838 F.2d 112, 115 (4th Cir. 1988) (citations omitted). In the Sanctions Order, the court limited its review to "whether the Bankruptcy Code or Rules have been violated and, if so, what remedy is available for those violations under the bankruptcy laws." BR Dkt. 174 at 17. Finding that there was no violation of the Bankruptcy Code or Rules, the court found no basis to award attorneys' fees to Mr. Branch. The court specifically declined to consider whether Mr. Branch might have a claim to attorneys' fees under any other legal theory. Accordingly, while some of the issues of collateral estoppel may be satisfied, the question of whether Mr. Branch might be entitled to fees and costs on a basis other than for violation of Rule 9037 was not actually determined by this court. Accordingly, collateral estoppel or issue preclusion does not bar Mr. Branch from seeking attorneys' fees in this matter; however, there are other bases upon which his claims will be dismissed.
The court also noted that Mr. Branch would not be responsible for any attorneys' fees in connection with the Sanctions Motion because his attorneys were working on a contingency basis. BR Dkt. 174 at 28. Whether fees not actually incurred could be a basis for damages seems illogical, but is fortunately not an issue that must be determined by this court.
--------
2. Past Costs as Damages
Mr. Branch contends that he is entitled to recover his fees and expenses incurred in connection with the Motion to Restrict Access and the Sanctions Motion because he would not have incurred those costs but for WakeMed's negligence, and that they are necessary to "make him whole." WakeMed contends that North Carolina law does not support recovery of those fees and costs, and thus they cannot be considered an "injury in fact." In support of this argument, WakeMed relies on Robinson v. Hope , 216 N.C. App. 573, 719 S.E.2d 66 (2011), which held that attorneys' fees from a prior action cannot serve as damages in a later action unless there is independent statutory authority for an award of those fees. There, the court rejected the same argument advanced by Mr. Branch: but for the defendant's actions, the fees would not have been incurred, and the award would make the plaintiff whole. 216 N.C. App. at 578, 719 S.E.2d at 69. Indeed, the Robinson court acknowledged that it had, in the past, allowed fees and costs associated with litigation to remedy an attorneys' malpractice in Gram v. Davis , 128 N.C. App. 484, 495 S.E.2d 384 (1998), but specifically declined to extend the Gram holding beyond attorney malpractice actions. Robinson , 216 N.C. App. at 578, 719 S.E.2d at 69.
Mr. Branch failed to address why Robinson is distinguishable or inapplicable, and given the North Carolina Court of Appeals' explicit reiteration of North Carolina's longstanding rule disallowing attorney's fees in civil cases absent a statute or contractual agreement, the court finds no relevant distinction or basis upon which to depart from its holding. Accordingly, the court finds that recovery of past fees and costs cannot support standing in this case.
3. Mitigation Costs for Speculative Future Risk
WakeMed contends that none of the expenses, costs, and fees sought are recoverable because they were mitigation costs related to a speculative future risk. As noted above, the Beck court specifically addressed whether mitigation costs related to the risk of identity theft were sufficient to confer standing, and held that they are not. 848 F.3d at 276. Because the harm the plaintiffs sought to mitigate was not imminent, the court found that mitigation costs were "self-imposed" and insufficient to confer standing. Id. The same is true here. The fees and costs for which Mr. Branch seeks to recover are those he asserts were necessary to "protect[ ] and safeguard[ ] his private, non-public, personal, and protected information" from "an increased likelihood that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose." AP Dkt. 1 at 43, 46.
For the reasons outlined above and as dictated by the holding in Beck , the court finds that Mr. Branch's asserted mitigation costs—the cost of identity theft protection, and the costs and attorneys' fees associated with the Motion to Restrict Access and the Sanctions Motion—were incurred with respect to a speculative future risk of (unspecified) harm from the disclosure of information that there is no allegation was ever discovered by a third party, and thus cannot support an injury in fact.
C. Attorneys' Fees Incurred in this Action
WakeMed also contends that the attorneys' fees incurred in this action do not constitute actual damages, because there is no basis upon which to shift fees and because standing requires prior harm. Mr. Branch's response brief does not directly address this argument, but the Complaint does seem to ask for "all the actual and compensatory damages suffered as a result of the course of conduct of Defendant ... and prosecution of this action against Defendant, which includes, but is not limited to, those reasonable attorneys' fees and costs incurred by Plaintiff ...." AP Dkt. 1 at 19, ¶ 1 (emphasis added). The court is unaware of any basis for awarding fees to the plaintiff in a negligence action, and Mr. Branch has provided no authority for the same. See also Eakes v. Eakes , 194 N.C.App. 303, 312, 669 S.E.2d 891, 897 (2008) ("It is settled law in North Carolina that ordinarily attorneys fees are not recoverable as an item of damages or of costs, absent express statutory authority for fixing and awarding them.") (citations and internal quotation marks omitted).
Further, WakeMed cites to persuasive authority that fees for this action cannot create an injury for purposes of standing. See Steel Co. v. Citizens for a Better Env't , 523 U.S. 83, 107, 118 S.Ct. 1003, 140 L.Ed.2d 210 (1998) (plaintiff "cannot achieve standing to litigate a substantive issue by bringing suit for the cost of bringing suit."); see also Davis v. Eagle Legacy Credit Union (In re Davis) , 430 B.R. 902, 907 (Bankr. D. Colo 2010) (rejecting claim for attorneys' fees for filing adversary proceeding to recover damages for filing a proof of claim containing personal information). Absent any authority that would support recovery of Mr. Branch's fees for this action, the court agrees that the costs and expenses of this litigation do not constitute an injury in fact sufficient to confer standing.
II. DISMISSAL FOR FAILURE TO STATE A CLAIM UPON WHICH RELIEF MAY BE GRANTED
A. The Standard for Dismissal Pursuant to Rule 12(b)(6).
Rule 8(a)(2) of the Federal Rules of Civil Procedure provides that "[a] pleading that states a claim for relief must contain ... a short and plain statement of the claim showing that the pleader is entitled to relief." If a complaint fails to meet this threshold obligation, the action should be dismissed under Rule 12(b)(6) for "failure to state a claim upon which relief can be granted." Fed. R. Civ. P. 12(b)(6). For purposes of Rule 12(b)(6), all allegations of fact contained in a complaint must be accepted as true. E.I. du Pont de Nemours & Co. v. Kolon Indus., Inc., 637 F.3d 435, 440 (4th Cir. 2011).
In Bell Atlantic Corp. v. Twombly , the Supreme Court of the United States held that a complaint must include "enough facts to state a claim to relief that is plausible on its face." 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). The Court elaborated in Ashcroft v. Iqbal that "the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions," and that "only a complaint that states a plausible claim for relief survives a motion to dismiss." 556 U.S. 662, 129 S.Ct. 1937, 1949, 173 L.Ed.2d 868 (2009) ; see also Adcock v. Freightliner, LLC , 550 F.3d 369, 374 (4th Cir. 2008) (mere legal conclusions do not warrant automatic assumption of truth by the court). The allegations must be more than a "formulaic recitation of the elements" of a claim. Iqbal, 129 S.Ct. at 1951.
A claim has facial plausibility when the plaintiff pleads enough "factual content to allow the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Clatterbuck v. City of Charlottesville, 708 F.3d 549, 554 (4th Cir. 2013). "The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully." Iqbal, 129 S.Ct. at 1949. Thus, dismissal under Rule 12(b)(6) is proper when, from the face of the complaint, it is clear that the plaintiff's claims are not supported by law, that one or more facts necessary to assert a valid claim have not been pled, or that facts exist that necessarily defeat the plaintiff's claims.
B. Negligence
To state a claim for negligence under North Carolina law, a plaintiff must allege facts to support the following elements: (1) legal duty; (2) breach of that duty; (3) actual and proximate causation; and (4) injury. Mabrey v. Smith , 144 N.C.App. 119, 122, 548 S.E.2d 183, 186, disc. rev. denied , 354 N.C. 219, 554 S.E.2d 340 (2001). Here, Mr. Branch's Complaint generally alleges that WakeMed breached its duty to him as derived from three sources: HIPAA, Rule 9037 of the Federal Rules of Bankruptcy Procedure, and the WakeMed Joint Notice of Privacy Practices. AP Dkt. 1 at ¶ 67. He alleges that he has suffered "significant financial harm" as a result of WakeMed's negligence, AP Dkt. 1 at ¶ 70, presumably tied back to the expenses, costs, and fees related to protecting and safeguarding his private information as outlined above.
1. Duty and Breach of Duty
WakeMed challenges the proffered bases for its duty to Mr. Branch, as well as the allegations that it breached any duty, as a matter of law. In other words, even taking the allegations of the Complaint as true (as the court must, in considering a motion to dismiss pursuant to Rule 12(b)(6) ), Mr. Branch is not entitled to recover as a matter of law.
Two of the proffered bases for breach of duty may be disposed of with relative ease. First, this court has already determined that WakeMed did not violate Rule 9037 of the Federal Rules of Bankruptcy Procedure in Mr. Branch's case. Specifically, the court found as follows:
A murkier questions is whether the "account IDs" or "patient numbers" included on the claims fail to comply with Rule 9037, which requires redaction of all but the last four digits of "a financial-account number." Ms. Soles testified that these numbers correspond to a particular billing entry, and that a new account number is generated for every visit. Based on the testimony, the only use one could make of these numbers is to pay the debtor's bill—which would benefit, rather than harm, the debtor. These numbers may technically be a "financial account number," but they are of such limited use that they are more akin to an invoice number. These account IDs or patient numbers are probably not what was contemplated when Rule 9037
was created. As a result, the applicability of Rule 9037 to these numbers is gray, and their disclosure should not result in an award of attorney's fees. Accord, In re Brown , Case No. 11-30384, 2012 WL 2576473 at *4 (Bankr. W.D.N.C. July 3, 2012) (declining to award sanctions or attorney's fees for disclosure of full cable account number where the court could not conclude that the violation was willful, malicious, or flagrant, particularly given the creditor's (ultimately unsuccessful) argument that Rule 9037 did not apply to those account numbers).
BR Dkt. 174 at 17–18. Further,
The debtors also complain about the inclusion of dates of admission and discharge, medical record numbers, and other medical information. Rule 9037 does not address the redaction or disclosure of any of these items. While it is possible that this information is protected under a non-bankruptcy law or regulation, there is no evidence that any of it puts the debtors at risk of identity theft or other damage as contemplated by § 107(c), and is otherwise not addressed in the Bankruptcy Code and Rules.... Accordingly, the court declines to find that the disclosure of this information is sanctionable under § 105(a).
Because the claim filed in Mr. Branch's case did not disclose any information that clearly must be redacted under Rule 9037, the court finds that WakeMed has not knowingly violated any provision of the Bankruptcy Code and Rules with respect to Mr. Branch.
BR Dkt. 174 at 20.
Accordingly, the court finds as a matter of law that WakeMed did not violate any duty that might be established by Rule 9037 with respect to Mr. Branch, and that a violation of Rule 9037 cannot form the basis of his negligence claim.
Mr. Branch also asserts that the Joint Notice of Privacy Practices published on WakeMed's website obligated WakeMed to protect health information, AP Dkt. 1. at ¶ 40, that the Privacy Practices established a duty to Mr. Branch to protect that information, id. at ¶ 59, and that the disclosure of Mr. Branch's information on the proof of claim breached that duty. As noted by WakeMed, however, there are no factual allegations that would establish that this document creates any obligations on the part of WakeMed, nor can a breach of contract typically give rise to a negligence action. Kaleel Builders, Inc. v. Ashby , 161 N.C.App. 34, 43, 587 S.E.2d 470, 476 (2003). The court agrees, and, further, Mr. Branch offered no argument with respect to WakeMed's challenge to his reliance on the Privacy Practices and arguably has waived the same.
Mr. Branch's primary basis for contending WakeMed had and breached a duty to him is the limitation on disclosure of private information contained in HIPAA. WakeMed maintains that it did not violate HIPAA as a matter of law, because an entity covered by HIPAA may disclose personal health information for "treatment, payment, or health care operations." 45 C.F.R. § 164.506(a) ; 45 C.F.R. § 164.502(a)(ii). "Payment" includes "collection activities." 45 C.F.R. § 164.501. In making a permissible disclosure, the entity must "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request." 45 C.F.R. § 164.502(b).
WakeMed disclosed the following on the proof of claim filed in Mr. Branch's bankruptcy case: his name, medical record number, patient account numbers, and dates of admission and discharge. Mr. Branch maintains that this is not the minimum necessary information, and relies upon the fact that WakeMed now files its claims showing only the last four digits of the patient account number. However, subsequent remedial measures are inadmissible to establish liability for negligence, see Fed. R. Evid. 407, and, in any event, the court does not find the new filing procedure to be determinative of the question of WakeMed's reasonable efforts to limit the information disclosed.
Instead, the court finds as a matter of law that the information disclosed was reasonably limited. This is in keeping with other courts, who have found the disclosure of significantly more private information—including the actual medical services received—not to support a claim against a medical provider. See OhioHealth Corp. v. Ryan , No. 10AP-937, 2012 WL 68733, at *1 (Ohio Ct. App. Jan 10, 2012) (dismissing counterclaim for damages where exhibit attached to complaint to collect unpaid medical bills disclosed private information).
Accordingly, the court finds that the facts alleged by Mr. Branch do not support the essential elements of a claim for negligence—duty and breach of duty—as a matter of law, and the motion to dismiss pursuant to Rule 12(b)(6) will be allowed on that basis.
2. Damages
A plaintiff is also required to set forth sufficient factual allegations in his complaint to establish that he suffered damages as a proximate result of the defendant's conduct. Here, there is no specific allegation that anyone obtained the information while it was publicly available or used that information in any way to harm Mr. Branch, nor is there any allegation of what nefarious use one could make of the information that was disclosed. Instead, there are only conclusory allegations that Mr. Branch is subjected to "an increased likelihood that his information will be manipulated, transferred, stolen, or otherwise utilized for an improper purpose." The court does not have to accept conclusions contained in the complaint as true.
With respect to damages, Mr. Branch alleges that he has suffered "significant financial harm," but the only factual allegations to support any financial impact on Mr. Branch are the attorneys' fees he alleges that he incurred in conjunction with the Motion to Restrict Access and the Sanctions Motion. The court has some concerns about Mr. Branch's apparent effort to recover as actual damages fees that (1) were incurred in conjunction with a Sanctions Motion for which the court found he was not entitled to recover and (2) were not actually paid by Mr. Branch because the representation was undertaken on a contingency basis. Further, as explained at length above, costs and expenses incurred in anticipation of a speculative future injury are insufficient to confer standing, and by extension are not recoverable damages.
Mr. Branch also seems to allege that he has been damaged in the amount of the fees and costs in bringing this action; however, a discussed above, the court is not aware of any theory under which Mr. Branch would be entitled to recover fees against a defendant in a negligence action.
Accordingly, the court finds that Mr. Branch has failed to plead with the required specificity any facts that establish the essential element of damages, and the motion to dismiss pursuant to Rule 12(b)(6) will be allowed on that basis.
CONCLUSION
Based on the foregoing, WakeMed's motion to dismiss the Complaint pursuant to Rules 12(b)(1) and 12(b)(6) of the Federal Rules of Civil Procedure, made applicable in this adversary proceeding by Rule 7012 of the Federal Rules of Bankruptcy Procedure, is ALLOWED.