Summary
construing similarly worded Virginia statute to require "only an intent to communicate that which was disclosed" and noting that the statute "does not require the purpose of the communication to be the willful publication of the Social Security number itself"
Summary of this case from Curry v. Schletter Inc.Opinion
Case No. 10-30393-KRH, Adv. Proc. No. 10-03033.
July 21, 2010.
Mitchell Goldstein, Krumbein Consumer Legal Services, Inc., Richmond, VA, for Plaintiffs.
Brewster S. Rawls, Rawls McNelis, PC, Richmond, VA, for Defendants.
MEMORANDUM OPINION
Before the Court is a motion to dismiss filed by the defendant in this adversary proceeding. Hearing on the motion (the "Hearing") was held on May 12, 2010, at which time the Court took the matter under advisement. For the reasons set forth below, the Court will deny the motion in part and grant the motion in part.
Procedural Background
On January 22, 2010 (the "Petition Date"), debtors and plaintiffs Marcellus and Anet Maple (the "Plaintiffs") filed a voluntary petition for relief under Chapter 13 of Title 11 of the United States Code (the "Bankruptcy Code") in United States Bankruptcy Court for the Eastern District of Virginia. On February 18, 2010, Plaintiffs commenced this adversary proceeding by filing a complaint (the "Complaint") against one of their creditors, Colonial Orthopaedics, Inc. (the "Defendant"). On March 22, 2010, Defendant filed its Motion to Dismiss Pursuant to Federal Bankruptcy Rule 7012 (the "Motion to Dismiss") and an accompanying Memorandum in Support of Motion to Dismiss. Defendant seeks to have the Complaint dismissed pursuant to Rule 7012(b)(6) of the Federal Rules of Bankruptcy Procedure (the "Bankruptcy Rules") for failure to state a claim upon which relief can be granted.
Rule 7012(b)(6) of the Federal Rules of Bankruptcy incorporates by reference Rule 12(b)(6) of the Federal Rules of Civil Procedure (the "Civil Procedure Rules").
On April 4, 2010, Plaintiffs filed a Memorandum in Opposition to Defendant's Motion to Dismiss (the "Memorandum in Opposition"). On April 14, 2010, Defendant filed a reply to Plaintiffs' Memorandum in Opposition. At the Hearing, the Court granted Plaintiffs' oral motion to amend the Complaint and indicated that the Court would withhold ruling on the Motion to Dismiss until after an amended complaint was filed. Plaintiffs filed their amended complaint (the "Amended Complaint") on May 14, 2010.
Jurisdiction and Venue
The Court has subject matter jurisdiction under 28 U.S.C. § 1334 and the general order of reference from the United States District Court for the Eastern District of Virginia dated August 15, 1984. Plaintiffs allege that this is a core proceeding under 28 U.S.C. § 157(b)(2)(A), (B) and (O). Defendant denies that this is a core proceeding and does not consent to entry of final orders or judgment by this Court. To the extent that certain claims asserted by Plaintiffs may be noncore proceedings as described in 28 U.S.C. § 157(b)(2), such proceedings are "related to" the bankruptcy case and the Court may issue proposed findings of fact and conclusions of law pursuant to 28 U.S.C. § 157(c)(1). As Defendant has requested that the Court grant it the relief presented by its Motion to Dismiss, Defendant is deemed to have consented to entry of a dispositive order in that regard. See 28 U.S.C. § 157(c)(2). Venue is appropriate pursuant to 28 U.S.C. § 1409(a).
The Plaintiffs' Allegations
Plaintiffs allegedly incurred a debt owing to Defendant on June 16, 2009. Following the Petition Date, Defendant timely filed a proof of claim ("Proof of Claim") in Plaintiffs' bankruptcy case on February 3, 2010. In contravention of the provisions of Bankruptcy Rule 9037, the Proof of Claim contained such personal information as the Plaintiffs' home and work phone numbers, their dates of birth, their social security numbers, the name of their insurance carrier, and their insurance identification numbers. The Proof of Claim also disclosed certain confidential medical information concerning the Plaintiffs. In response to the Proof of Claim, Plaintiffs filed on February 11, 2010 a Motion to Restrict Public Access to Defendant's Proof of Claim ("Motion to Restrict"). The Court entered an order granting the Motion to Restrict on February 17, 2010.
Plaintiffs allege in their Amended Complaint that, while the personal information about them that was improperly disclosed in the Proof of Claim is no longer accessible by the general public through the court's CM/ECF or PACER systems, it is still available on the internet from other electronic systems that copied from PACER. Plaintiffs claim that they incurred attorney's fees and costs when they were required to file their Motion to Restrict. Plaintiffs also allege they have suffered "embarrassment and distress" (Am. Compl. ¶ 34) and "mental and emotional anguish and distress . . . caused by knowing th[eir] information has been made public by" Defendant (Am. Compl. ¶ 97).
CM/ECF is the Court's Case Management/Electronic Case Files system. Local Bankruptcy Rule 5005-2 mandates the electronic filing of all papers filed with the Court utilizing the CM/ECF system. Public Access to Court Electronic Records (PACER) is an electronic public access service managed by the Administrative Office of the United States Courts that provides access to public documents from all of the United States Federal Courts.
Plaintiffs assert five counts in their Amended Complaint: (1) violation of their right to privacy and breach of contract, (2) violations of the Virginia Consumer Protection Act and the Virginia Personal Information Privacy Act, (3) contempt of court and violation of Bankruptcy Rule 9037, (4) violations of the Virginia Health Records Privacy Act and the Health Insurance Portability and Accountability Act, and (5) objections to the Proof of Claim and violations of Bankruptcy Rule 9011 and 18 U.S.C. § 152. Plaintiffs request injunctive relief, damages for mental and emotional anguish and distress, reimbursement of their attorney's fees, the cost of monthly credit monitoring for Plaintiffs' actuarial lives, statutory and punitive damages, sanctions against Defendant, and denial of the Proof of Claim.
CONCLUSIONS OF LAW Standard of Review
A pleading that states a claim for relief must contain a short and plain statement of the claim showing that the pleader is entitled to relief. Fed.R.Bankr.P. 7008(a)(2). A motion to dismiss under Rule 7012(b)(6) of the Bankruptcy Rules tests the legal sufficiency of the Complaint. See generally Bell Atl. Corp. v. Twombly, 550 U.S. 544 (2007). In ruling on Defendant's Motion to Dismiss, the Court must accept all well-pleaded factual allegations in the Amended Complaint as true and construe the Amended Complaint in a light most favorable to the Plaintiffs. "To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to `state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 129 S.ct 1937, 1949 (2009) (citing Twombly, 550 U.S. at 570). "`[D]etailed factual allegations'" are not required, but there must be "more than an unadorned, the-defendant-unlawfully-harmed-me accusation." Id. (quoting Twombly, 550 U.S. at 555). A court need not accept as true unwarranted inferences, unreasonable conclusions, or arguments. See Iqbal, 129 S.Ct. at 1949-51. A complaint must contain "more than labels and conclusions," Twombly, 550 U.S. at 555 (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)), and "[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Iqbal, 129 S.ct at 1949 (citing Twombly, 550 U.S. at 555). Dismissal is inappropriate when there exist well-pleaded factual allegations that plausibly give rise to an entitlement to relief. Iqbal, 129 S.ct at 1950; see also Giarratano v. Johnson, 521 F.3d 298, 302 (4th Cir. 2008) (holding that a complaint must "allege `enough facts to state a claim for relief that is plausible on its face'") (emphasis in original) (quoting Twombly, 550 U.S. at 570).
Plaintiffs' First Count: Violation of Right of Privacy and Breach of Contract
In their first count, Plaintiffs allege invasion of privacy, a violation of the privacy provisions of the Health Insurance Portability and Accountability Act of 1996, and breach of contract. While Plaintiffs appear to rely on their breach of contract contention as the basis for their first count in their Memorandum in Opposition, the Court will address all three claims as asserted in Count One of the Amended Complaint.
Invasion of Privacy
Under the common law there are four torts of invasion of privacy: "(1) unreasonable intrusion upon the plaintiff's seclusion . . . or into his private affairs; (2) public disclosure of true, embarrassing private facts about the plaintiff; (3) publicity which places the plaintiff in a false light in the public eye; and (4) misappropriation of plaintiff's name or likeness for commercial purposes." WJLA-TV v. Levin, 564 S.E.2d 383, 395 n. 5 (Va. 2002) (citing William L. Prosser, The Law of Torts § 117 (4th ed. 1971)). The Virginia General Assembly codified the fourth of these common law torts in 1977. See Va. Code § 8.01-40. When it did so, the Virginia General Assembly "implicitly excluded the remaining three as actionable torts in Virginia." WJLA-TV v. Levin, 564 S.E.2d at 395 (citing Falwell v. Penthouse, 521 F. Supp. 1204, 1206 (W.D. Va. 1981)). Plaintiffs do not assert a claim for the misappropriation of their name or likeness for commercial purposes, but rather assert a claim for the public disclosure of true embarrassing factual information about them. As any common law cause of action for such an invasion of privacy has been abrogated under Virginia law, Plaintiffs have failed to state a claim for invasion of privacy.
That section provides in pertinent part that "[a]ny person whose name, portrait, or picture is used without having first obtained the written consent of such person, . . . for advertising purposes or for the purposes of trade . . . may maintain a suit in equity against the person, firm, or corporation so using such person's name, portrait, or picture to prevent and restrain the use thereof; and may also sue and recover damages for any injuries sustained by reason of such use." Va. Code Ann. § 8.01-40.
Violation of Health Insurance Portability and Accountability Act
Congress enacted The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") in order to "improve portability and continuity of health insurance coverage in the group and individual markets." H.R. Rep. No. 104-496, at 1, 66-67, reprinted in 1996 U.S.C.C.A.N. 1865, 1865-66. Recognizing the need to protect patient privacy, HIPAA authorizes the Department of Health and Human Services to promulgate regulations that would protect the confidentiality of individuals' medical records. Webb v. Smart Document Solutions, 499 F.3d 1078, 1084 (9th Cir. 2007) (HIPAA "does not specify either how to protect privacy or to transmit health records efficiently and effectively. Instead it authorizes the Secretary of Health and Human Services to `adopt standards'" that will fulfill HIPAA's goals.). The regulations adopted by the Secretary of Health and Human Services are codified at 45 C.F.R. §§ 160 and 164 and are known collectively as the Privacy Rule. See generally Deborah F. Buckman, Validity, Construction, and Application of Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Regulations Promulgated Thereunder, 194 A.L.R. Fed. 133 (2004).
Pub.L. No. 104-191, 110 Stat. 1936 (1996) (codified primarily in Titles 18, 26, and 42 of the United States Code).
Plaintiffs assert a claim for violation HIPAA's Privacy Rule in their Amended Complaint. Plaintiffs cite 45 C.F.R. § 164.520(a)-(b), which is the regulation adopted to address the requirements for notice to individuals of the use and disclosure of their protected health information. 45 C.F.R. § 164.520(a)-(b) (2010). "HIPAA has no express provision creating a private cause of action." Acara v. Banks, 470 F.3d 569, 571 (5th Cir. 2006) (citing Banks v. Dallas Hous. Auth., 271 F.3d 605, 608 (5th Cir. 2001)). Rather, HIPPA tasks the Secretary of Health and Human Services with the authority to enforce HIPAA. See 42 U.S.C. § 1320d-5 (2010). For Plaintiffs to be able to pursue this cause of action, the Court would have to find that a private right to enforce HIPAA is implied within the statute. Acara, 470 F.3d at 571. "`The judicial task is to interpret the statute Congress has passed to determine whether it displays an intent to create not just a private right but also a private remedy.'" Id. (quoting Banks, 271 F.3d at 608). The Supreme Court has presented four factors a court may use to determine whether a federal statute contains an implied private cause of action:
(1) whether the plaintiff is one of a class for whose special benefit the statute [sic] was enacted; (2) whether there is an indication of legislative intent to create or deny such a remedy; (3) whether such a remedy would be consistent with the underlying legislative purpose; and (4) whether the cause of action is one traditionally relegated to state law so that it would be inappropriate to infer a cause of action based solely on federal law.
Id. at 571 n. 1 (citing Cort v. Ash, 422 U.S. 66, 78 (1975)). "`Statutory intent [to create a private remedy] is determinative.'" Id. at 571 (quoting Banks, 271 F.3d at 608). "[W]ithout evidence of congressional intent, a private cause of action cannot be found." Id. at 571 n. 1 (citing Alexander v. Sandoval, 532 U.S. 275, 286 (2001)).
As HIPAA directly assigns the authority to enforce HIPAA to the Secretary of Health and Human Services, see 42 U.S.C. § 1320d-5 (2010), it does not appear that Congress intended to create a private remedy. The Court agrees with the majority of courts that have considered the issue that "HIPAA does not provide a private citizen a cause of action." Diment v. Cushing, No. 3:07cv00041, 2007 U.S. Dist. LEXIS 59746, at *6 (W.D. Va. Aug. 15, 2007); accord Sneed v. Pan American Hospital, No. 09-14697, 2010 U.S. App. LEXIS 5751, at *4 (11th Cir. Mar. 18, 2010) (per curiam) (unpublished opinion) (citing Acara, 470 F.3d at 571-72) ("We decline to hold that HIPAA creates a private cause of action."); Adams v. Eureka Fire Prot. Dist., 352 Fed. App'x 137, 139 (8th Cir. 2009) (per curiam) (unpublished opinion) ("HIPAA does not create a private right."); Webb, 499 F.3d at 1080 ("HIPAA provides for no private right of action."); Acara, 470 F.3d at 572 ("[T]here is no private cause of action under HIPAA."). As there is no private right of action under HIPAA, either express or implied, Plaintiffs have failed to state a claim for a violation of HIPAA.
Breach of Contract
A contract is a legally enforceable agreement. See 1 Corbin on Contracts § 1.3 (1963) ("[A] contract is a promise enforceable at law directly or indirectly."); see also Restatement (Second) of Contracts § 1 (1981). Under Virginia law, the "`elements of a breach of contract action are (1) a legally enforceable obligation of a defendant to a plaintiff; (2) the defendant's violation or breach of that obligation; and (3) injury or damage to the plaintiff caused by the breach of obligation.'" Sunrise Continuing Care, LLC v. Wright, 671 S.E.2d 132, 135 (Va. 2009) (quoting Filak v. George, 594 S.E.2d 610, 614 (Va. 2004)).
In their Amended Complaint, Plaintiffs fail to identify the legally enforceable agreement between the parties upon which Plaintiffs purport to rely. They assert only the conclusory allegation that there exists some unexplained legally enforceable contractual obligation between Plaintiffs and Defendant in the form of a HIPAA privacy policy. The contract between the parties is not otherwise disclosed or described.
Plaintiffs have failed to plead sufficient factual allegations that would render their breach of contract claim plausible on its face. The unadorned conclusory allegation set forth in the Amended Complaint is legally deficient. Plaintiffs have failed to meet the new heightened "plausible on its face" pleading standard now required by Ashcroft v. Iqbal, 129 S.ct 1937, 1950 (2009), and, therefore, fail to state a claim for relief for breach of contract.
As Plaintiffs have failed to adequately state a claim under any of the three theories advanced in Count One, Defendant's Motion to Dismiss Plaintiffs' first count will be granted.
Plaintiffs' Second Count: Violation of the Virginia Consumer Protection Act
The Virginia Personal Information Privacy Act (the "VPIPA") provides, among other things, that a person shall not "[i]ntentionally communicate another individual's social security number to the public." Va. Code Ann. § 59.1-443.2(A)(1) (2010). The Virginia General Assembly provided that this section of the VPIPA is enforceable through the provisions of the Virginia Consumer Protection Act (the "VCPA"). Va. Code Ann. § 59.1-444. The VCPA further provides that "[v]iolating any provision of [section] 59.1-443.2" is "hereby declared unlawful" when "committed by a supplier in connection with a consumer transaction." Va. Code Ann. § 59.1200(A)(43).
The VCPA defines a supplier as "a seller . . . who advertises, solicits or engages in consumer transactions." Va. Code Ann. § 59.1-198. Consumer transactions include the "sale . . . of goods or services to be used primarily for personal, family or household purposes." Id. Plaintiffs have alleged sufficient facts in their Amended Complaint for the Court to reasonably infer that Defendant sold medical services to Plaintiffs. Therefore, Defendant would be a supplier who engaged in a consumer transaction with Plaintiffs. See Humphrey v. Leewood Healthcare Ctr., 73 Va. Cir. 346, 347 (Fairfax Co. 2007) ("[N]ursing home care can be a `service' to be used for `family' purposes within the meaning of the VCPA."). Clearly, the VCPA and the VPIPA would then apply to Defendant.
Plaintiffs also allege that Defendant "[i]ntentionally communicate[d]" Plaintiffs' social security numbers. The phrase "intentionally communicate" utilized in Va. Code Ann. § 59.1-443.2(A)(1) is nowhere defined in the VPIPA. North Carolina's Identity Theft Protection Act ("NCITPA"), which is both structurally and linguistically similar to the VPIPA, also employs the phrase "intentionally communicate." In interpreting the NCITPA, the North Carolina Business Court held that a plaintiff must allege that a defendant business communicated a plaintiff's social security number to the public and the defendant acted with intent. Fisher v. Commc'n Workers of Am., 2008 NCBC 18, 55 (N.C. Super. Ct. 2008) (citing N.C. Gen. Stat. § 75-62(a)(1) (2007)). The NCITPA "does not require that the general public actually see the Social Security numbers," but only that the information was made "available to the general public." Id. at 59 (citing N.C. Gen. Stat. § 75-62(a)(1)). Additionally, the NCITPA "does not require that the communication of Social Security numbers be done for the purpose of providing them to the general public or facilitating identity theft" in order for a defendant to have violated the element of intentional communication. Id. at 60 (citing N.C. Gen. Stat. § 75-62(a)(1)).
North Carolina's Identity Theft Protection Act provides that a business may not "[i]ntentionally communicate or otherwise make available to the general public an individual's social security number," and to do so "is a violation of [General Statute of North Carolina section] 75-1.1," part of North Carolina's Unfair and Deceptive Trade Practices Act ("UDTPA"). N.C. Gen. Stat. §§ 75-62(a)(1), 75-62(d) (2010). North Carolina's UDTPA provides for a private right of action for violations of Chapter 75 of the General Statutes of North Carolina. See N.C. Gen. Stat. § 75-16.
"The North Carolina Business Court is a specialized forum of the North Carolina State Courts' trial division. Cases involving complex and significant issues of corporate and commercial law in [North Carolina] are assigned by the Chief Justice of the North Carolina Supreme Court to a special superior Court judge." North Carolina Business Court, http://www.ncbusinesscourt.net (last visited June 7, 2010).
Similarly, the VPIPA requires only an intent to communicate that which was disclosed in order to qualify a communication as "intentional." It does not require the purpose of the communication to be the willful publication of the Social security number itself. See Va. Code. Ann. § 59.1-443.2(A)(1) (2010). The overall structure of the intertwined VPIPA and VCPA supports this interpretation of the phrase. An "intentional communication" must be something less than a willful desire to publish sensitive information, because, when combined, the VPIPA and VCPA provide additional damages for the "willful" intentional communication of another's Social security number. See Va. Code. Ann. §§ 59.1-443.2(A)(1), 59.1-204(A).
Plaintiffs allege Defendant filed its Proof of Claim with Plaintiffs' Social security numbers attached in an exhibit. The Court can only conclude that, by filing the Proof of Claim, Defendant intended to communicate its contents to the Court, the trustee appointed in this case, and any other party in interest who might examine the Court's docket. The information contained in the Proof of Claim was made readily available to the general public at large when it was filed on the Court's publicly accessible filing system. Therefore, Plaintiffs have alleged sufficient specific facts that would support a claim that Defendant intentionally communicated Plaintiffs' Social security numbers to the public. While Plaintiffs have not plead facts that would support a claim that Defendants willfully intentionally communicated Plaintiffs' Social security numbers, facts establishing intentional communication are sufficient to survive a motion to dismiss.
Plaintiffs must allege that they have suffered some loss in order to assert a claim under the VCPA. The VCPA provides that "[a]ny person who suffers loss as the result of a violation of [the statute] shall be entitled to initiate an action to recover actual damages, or $500, whichever is greater." Va. Code § 59.1-204(A). "In this provision, the Virginia General Assembly invests in individuals `who suffer loss as a result of a violation' a right of recovery. Thus some loss as a result of the [VCPA] violation is required." Chisolm v. TransSouth Fin. Corp., 194 F.R.D. 538, 549 (E.D. Va. 2000); see also Polk v. Crown Auto, Inc., 228 F.3d 541, 543 (4th Cir. 2000) (per curiam) (citing § 59.1-204(A)) (One must "`suffer[] loss as the result of a violation' of the VCPA . . . to initiate an action for damages.").
Plaintiffs allege that, as a result of Defendant's actions in filing the unredacted Proof of Claim in violation of the Bankruptcy Rules, Plaintiffs were required to file the Motion to Restrict in order to prevent their Social security numbers from being further disseminated. In filing the Motion to Restrict, Plaintiffs allege that they suffered a loss in the form of attorney's fees and costs that they otherwise would not have incurred. As such, Plaintiffs have plead sufficient facts to establish a loss. If the alleged loss is proven at trial, Plaintiffs would be entitled to recover the greater of their actual damages or $500. See Va. Code § 59.1-204(A).
As the Plaintiffs have alleged well-pleaded facts that plausibly give rise to an entitlement to relief for a violation of the VCPA, the Court will deny Defendant's Motion to Dismiss Count Two.
Plaintiffs' Third Count: Contempt of Court and Violation of Bankruptcy Rule 9037
Bankruptcy Rule 9037 requires redaction of sensitive personal information filed with the Court. Only the last four digits of a Social security number and an individual's year of birth may be published in court filings. Fed.R.Bankr.P. 9037. Plaintiffs allege in their Amended Complaint that Defendant published Plaintiffs' unredacted social security numbers and dates of birth in the Proof of Claim. Plaintiffs have sufficiently plead facts for the Court to reasonably infer that a violation of Bankruptcy Rule 9037 occurred.
Federal Rule of Bankruptcy Procedure 9037 entitled "Privacy Protection For Filings Made with the Court" provides:
(a) Redacted filings. Unless the court orders otherwise, in an electronic or paper filing made with the court that contains an individual's social-security number, taxpayer-identification number, or birth date, the name of an individual, other than the debtor, known to be and identified as a minor, or a financial-account number, a party or nonparty making the filing may include only:
(1) the last four digits of the social-security number and taxpayer-identification number;
(2) the year of the individual's birth;
(3) the minor's initials; and
(4) the last four digits of the financial-account number.
. . . .
(d) Protective orders. For cause, the court may by order in a case under the Code:
(1) require redaction of additional information; or
(2) limit or prohibit a nonparty's remote electronic access to a document filed with the court
Fed.R.Bankr.P. 9037(a), (d).
Plaintiffs next argue that the Court has the authority to sanction Defendant for the violation. Plaintiffs maintain that Defendant's failure to redact or withdraw the sensitive information published in Defendant's Proof of Claim was an act in contempt of court under 11 U.S.C. § 105. Section 105(a) of the Bankruptcy Code provides:
The court may issue any order, process, or judgment that is necessary or appropriate to carry out the provisions of this title. No provision of this title providing for the raising of an issue by a party in interest shall be construed to preclude the court from, sua sponte, taking any action or making any determination necessary or appropriate to enforce or implement court orders or rules, or to prevent an abuse of process.
11 U.S.C. § 105(a) (2010).
Bankruptcy Rule 9037 "does not . . . provide a private right of action . . . to . . . assess sanctions against the [d]efendant for attaching documentation to the [p]roof of [c]laim containing the [p]laintiff's full social security number and birth date." French v. Am. Gen. Fin. Servs. (In re French), 401 B.R. 295, 307 (Bankr. E.D. Tenn. 2009). However, "noncompliance with [Bankruptcy] Rule [9037] could potentially give rise to a contempt action" under 11 U.S.C. § 105(a). Id. at 315. As the Bankruptcy Court for the Northern District of West Virginia explained in its decision not to hold a creditor in contempt for violations of Bankruptcy Rule 9037:
The remedy for violations of Rule 9037 is either redaction or for the court to restrict access to un-redacted information. Nevertheless, courts have found that "[s]anctions would be appropriate where it is shown that a creditor flaunted the law with knowledge of its proscriptions, failed to take remedial action once violations were discovered, or acted deliberately as opposed to mistakenly or inadvertently."
Here the [d]ebtors have been granted a remedy under Rule 9037. In the [d]ebtors' Chapter 7 case, the court granted the [d]ebtors' motion to restrict access. . . . Thus, while the [d]ebtors' sensitive information was exposed to public access for a limited amount of time . . . any violation of Rule 9037 has been remedied.
While the [d]ebtors' complaint shows that the [b]ank violated the redaction requirements under Rule 9037, it does not show that they are entitled to recover damages for contempt. After the court granted the [d]ebtors relief, the [b]ank did not file another proof of claim. The complaint alleges no acts that rise to the level of a flagrant violation of Rule 9037 that would support a contempt award.
Barnhart v. Union Bank, Inc. ( In re Barnhart), No. 09-ap-00109, 2010 Bankr. LEXIS 471, at *8-10 (Bankr. N.D. W. Va. Feb. 26, 2010).
Plaintiffs have alleged facts nearly identical to those in Barnhart. Plaintiffs allege no facts that would indicate that Defendant flagrantly violated Bankruptcy Rule 9037. There is no allegation of facts indicating that publication of the proscribed information was willful or malicious. There is no allegation of repeat violations. Furthermore, Plaintiffs have already been provided a remedy when the Court granted their Motion to Restrict. Plaintiffs have, therefore, failed to state a claim for contempt of court.
Plaintiffs rely, additionally, on 11 U.S.C. § 107(c), which provides that the Court, "for cause, may protect an individual, with respect to [a person's social security number or date of birth] to the extent the court finds that disclosure of such information would create undue risk of identity theft or other unlawful injury to the individual or the individual's property." Again the Court finds the analysis in French v. American General Financial Services persuasive. 401 B.R. at 304-06. "Because [section] 107(c) does not expressly provide a private right of action, in order for the [p]laintiff to proceed . . . the court must find an implied right of action." Id. at 304. "[L]egislative history evidences that Congress did not intend for [section] 107(c) to create a private right of action or to be a remedial statute in any way," but rather "that the sole purpose of [section] 107(c) was to establish public access to court documentation with very limited exceptions and not to create a private right of action for the [p]laintiff to seek damages for the filing of private personal information." Id. at 306. Thus, the Plaintiffs have failed to state a claim upon which relief can be granted for a violation of 11 U.S.C. § 107(c).
As Plaintiffs have failed to state claims under either 11 U.S.C. §§ 105 or 107(c), the Court will grant Defendant's Motion to Dismiss Count Three.
Plaintiffs' Fourth Count: Violation of the Virginia Health Records Privacy Act and the Health Insurance Portability and Accountability Act
In their fourth count, Plaintiffs allege: (i) violations of the Virginia Health Records Privacy Act (the "VHRPA") codified in section 32.1-127.1:03 of the Code of Virginia, (ii) violations of HIPAA, and (iii) negligence for breach of the statutory duties of care created by the VHRPA and HIPAA as well as by the Virginia Supreme Court's decision in Fairfax Hospital v. Curtis, 492 S.E.2d 642 (Va. 1997). The Court will address each of these claims.
The VHRPA "recognize[s] an individual's right of privacy in the content of his health records." Va. Code Ann. § 32.1-127.1:03 (2010). "[N]o health care entity . . . may disclose an individual's health records" without permission from the patient or other legal authorization. Id. Redisclosure of health records "beyond the purpose for which such disclosure was made" can only occur by "first obtaining the individual's specific authorization." § 32.1-127.1:03(A)(3). Similarly, HIPAA authorizes the Secretary of Health and Human Services to draft standards that will promulgate HIPAA's goal of protecting patients' privacy in their health records. Webb v. Smart Document Solutions, 499 F.3d 1078, 1084 (9th Cir. 2007). As the Court discussed in connection with Count One, there is no private cause of action, express or implied, under HIPAA. The Court need not find whether the Virginia General Assembly intended to create an express or implied private right of action under the VHRPA. The statute provides ample evidence of legislative intent to preserve, advance, and maintain the duty of care that was recognized by the Virginia Supreme Court in Fairfax Hospital v. Curtis, 492 S.E.2d 642 (Va. 1997).
According to the Virginia Supreme Court, "a health care provider owes a duty to the patient not to disclose information gained from the patient during the course of treatment without the patient's authorization, and . . . violation of this duty gives rise to an action in tort." Curtis, 492 S.E.2d at 644; see also Evans v. Diamond Healthcare Corp., 73 Va. Cir. 502, 502-03 (Richmond City 2007) (citing Curtis, 492 S.E.2d at 644) ("[T]he plaintiff still has a remedy under common law for improper disclosure of confidential medical information."); S.R. v. Inova Healthcare Servs., 49 Va. Cir. 119, 121-22 (Fairfax Co. 1999) (citing Curtis, 492 S.E.2d at 644) (interpreting Curtis as establishing a common law "tort for wrongful disclosure of confidential information gained during the course of treatment" rather than creating a statutory right of action under § 8.01-399 which is "`merely a rule of evidence'"). In a case factually similar to the case at bar, the Circuit Court of the City of Richmond held that in order to survive a demurrer, the "[p]laintiff must allege how and to what extent each of the parties failed to follow [the] procedure" outlined in [section] 32.1-127.1:03 for the subpoena of medical records. Smith v. Kryzanowski, 69 Va. Cir. 185, 186 (Richmond City 2005).
Smith v. Kryzanowski involves the notice requirement established under the VHRPA when medical records are requested in judicial proceedings. 69 Va. Cir. 185 (Richmond City 2005).
Plaintiffs plead that Defendants owed to them a duty not to improperly disclose their confidential medical information. Plaintiffs allege that their confidential medical information was published by Defendant in Defendant's Proof of Claim. Plaintiffs do not specifically allege that they never gave authorization for the disclosure, but they allege sufficient facts regarding their efforts to remove such information from the publicly accessible filing system for the Court to infer that their authorization had not been given. Plaintiffs plead sufficient facts to allege causation of emotional injury resulting from Defendant's alleged breach of duty. Plaintiffs have alleged facts plausible on their face necessary to establish duty, breach, and causation in their negligence claim.
Plaintiffs allege damages for mental and emotional anguish and distress. "As a general rule, in tort cases, absent accompanying physical harm or wanton and willful conduct, emotional distress damages are not recoverable." Curtis, 492 S.E.2d at 644 (citing Carstensen v. Chrisland Corp., 442 S.E.2d 660, 668 (Va. 1994); Sea-Land Serv., Inc. v. O'Neal, 297 S.E.2d 647, 653 (Va. 1982); Womack v. Eldridge, 210 S.E.2d 145, 147 (Va. 1974)). Plaintiffs have not alleged that Defendants engaged in any wanton or willful conduct. However, "there are exceptions to this general rule: `We have approved the recovery of damages for humiliation, embarrassment, and similar harm to feelings, although unaccompanied by actual physical injury, where a cause of action existed independently of such harm.'" Id. at 644 (quoting Sea-Land Serv., 297 S.E.2d at 653) (emphasis in original). Where a hospital disclosed a patient's medical records to third parties absent the patient's or a court's permission, the Virginia Supreme Court found:
[T]he plaintiff's cause of action falls within the exception to the general rule because her cause of action is independent of the humiliation, embarrassment, and harm to feelings that she suffered. Without question, a patient, whose intimate personal medical information is wrongfully disseminated to third parties, will experience some degree of humiliation, embarrassment, and hurt. Under these circumstances, we perceive no logical reason to refuse recovery of emotional distress damages.
Id. The independent cause of action is the common law tort of wrongful disclosure of health information, and thus, no physical injury is necessary in order to recover for emotional distress damages in the instant case.
Plaintiffs allege "mental and emotional anguish and distress" resulting from the knowledge that their sensitive information was made public. (Pls.' Am. Compl. ¶ 97.) Plaintiffs additionally allege "embarrassment and distress" as a result of Defendant's actions. (Pls.' Am. Compl. ¶ 34.) Plaintiffs adequately plead facts sufficient to sustain the damages element of their negligence claim for the wrongful disclosure of health information.
As Plaintiffs have alleged well-pleaded facts that plausibly support all of the elements to assert a claim under the Virginia common law tort of wrongful disclosure of health information, the Court will deny Defendant's Motion to Dismiss Count Four.
Plaintiffs' Fifth Count: Objection to Proof of Claim, Violation of Bankruptcy Rule 9011, and Violation of 18 U.S.C. § 152
Plaintiffs allege in the fifth count of their Amended Complaint that because the Defendant violated Bankruptcy Rule 9037 and 11 U.S.C. § 107(c), the Proof of Claim should be denied and the Defendant should be sanctioned. Plaintiffs also object to the Proof of Claim pursuant to 11 U.S.C. § 502. Finally, Plaintiffs allege that Defendant filed a false declaration in violation of Bankruptcy Rule 9011 and 18 U.S.C. § 152 when Defendant filed its Proof of Claim, as there exists a discrepancy between the amount that the Plaintiffs allege the claim should total and the amount stated in the filed Proof of Claim.
The Court turns first to the objection to the Proof of Claim based on violations of 11 U.S.C. § 107(c) and Bankruptcy Rule 9037. As noted in the Court's discussion of Count Three, § 107(c) of the Bankruptcy Code creates neither an express nor an implied private cause of action. French, 401 B.R. at 304-306. Similarly, Bankruptcy "Rule 9037 does not . . . provide a private right of action for . . . the Plaintiff[s] to cancel the debt owed to the Defendant and/or assess sanctions against the Defendant for attaching documentation to the Proof of Claim containing the Plaintiff[s'] full social security number[s] and birth date[s]." Id. at 307.
Once Plaintiffs object to the Proof of Claim, "the court must, after notice and a hearing, determine the amount of the claim . . . and allow the claim unless it falls into one of the . . . enumerated exceptions" in 11 U.S.C. § 502(b). Id. at 307-08. The "statutory exceptions" in 11 U.S.C. § 502(b) "provide `the sole bases for a party to object to a claim,'" and "`a procedural violation, such as that alleged here [the failure to redact . . . information from an attachment to a proof of claim], therefore, cannot serve as an independent ground for the disallowance of a creditor's proof of claim.'" French, 401 B.R. at 309 (internal citations omitted).
Plaintiffs do not have a private right of action under 11 U.S.C. § 107(c). While Plaintiffs do have access to a remedy under Bankruptcy Rule 9037, that remedy is limited to the relief already granted in the form of the Motion to Restrict. Plaintiffs fail to state a valid objection to the Proof of Claim based on 11 U.S.C. § 107(c) or Bankruptcy Rule 9037. The Court will grant Defendant's Motion to Dismiss on those elements of Plaintiffs' objection to the Proof of Claim.
Plaintiffs' "inability to state a cause of action under either [section] 107(c) or [Bankruptcy] Rule 9037 does not . . . resolve [Plaintiffs'] objection to the Proof of Claim." French, 401 B.R. at 307. Plaintiffs object to the amount of the claim asserted by Defendant in the Proof of Claim pursuant to 11 U.S.C. § 502(b). Traditionally, Plaintiffs would raise their objection to the Proof of Claim in their Chapter 13 case as a contested matter governed by Bankruptcy Rule 9014. In re IBIS Corp., 272 B.R. 883, 893 (Bankr. E.D. Va. 2001) ("Objections to proofs of claim are contested matters governed by Fed.R.Bankr.P. 9014."); In re Fleming, 2008 WL 4736269 at *1 (Bankr. E.D. Va. Oct. 15 2008) ("The hearing on the claim objection is treated as a contested matter, and Fed.R.Bankr.P. 9014 applies."). Raising such an objection in an adversary proceeding is not fatal to the objection, particularly in light of the additional procedural protections afforded a creditor in an adversary proceeding. Furthermore, Bankruptcy Rule 3007(b) permits an objection to be included in an adversary proceeding when combined with a demand for relief of a kind specified in Bankruptcy Rule 7001. The Court will allow the objection to the amount of the Proof of Claim to proceed as an adversary proceeding. The Court will deny Defendant's Motion to Dismiss as to Plaintiffs' objection to the amount of the Proof of Claim.
Bankruptcy Rule 7001 lays out the different types of adversary proceedings.
Section 502(b) of the Bankruptcy Code provides:
[I]f such objection to a claim is made, the court, after notice and a hearing, shall determine the amount of such claim . . . as of the date of the filing of the petition, and shall allow such claim in such amount, except to the extent that —
(1) such claim in unenforceable against the debtor and property of the debtor, under any agreement or applicable law for a reason other than because such claim is contingent or unmatured.
11 U.S.C. § 502(b)(1).
Plaintiffs also assert in their fifth count that Defendant filed a false declaration in violation of Bankruptcy Rule 9011 and 18 U.S.C. § 152. Given that title 18 is the criminal and penal code of the United States, Plaintiffs lack standing to bring an action under 18 U.S.C. § 152 and this Court is not the proper court in which such a proceeding should be brought. The Court, therefore, will address only Plaintiffs' assertions under Bankruptcy Rule 9011. The relevant parts of Bankruptcy Rule 9011 provide:
Section 152 of title 18 of the United States Code provides in relevant part that:
A person who —
. . .
(2) knowingly and fraudulently makes a false oath or account in or in relation to any case under title 11;
(3) knowingly and fraudulently makes a false declaration, certificate, verification, or statement under penalty of perjury as permitted under section 1746 of title 28, in or in relation to any case under title 11;
(4) knowingly and fraudulently presents any false claim for proof against the estate of a debtor, or uses any such claim in any case under title 11, in a personal capacity or as or through an agent, proxy, or attorney;
. . .
shall be fined under this title, imprisoned not more than 5 years, or both.
18 U.S.C. § 152 (2010).
(b) Representations to the court. By presenting to the court (whether by signing, filing, submitting, or later advocating) a petition, pleading, written motion, or other paper, an attorney or unrepresented party is certifying that to the best of the person's knowledge, information, and belief, formed after an inquiry reasonable under the circumstances, —
. . .
(3) the allegations and other factual contentions have evidentiary support or, if specifically so identified, are likely to have evidentiary support after a reasonable opportunity for further investigation or discovery;
. . .
(c) Sanctions. If, after notice and a reasonable opportunity to respond, the court determines that subdivision (b) has been violated, the court may, subject to the conditions stated below, impose an appropriate sanction upon the attorneys, law firms, or parties that have violated subdivision (b) or are responsible for the violation.
(1) How initiated.
(A) By motion. A motion for sanctions under this rule shall be made separately from other motions or requests and shall describe the specific conduct alleged to violate subdivision (b). It shall be served as provided in Rule 7004. The motion for sanctions may not be filed with or presented to the court unless, within 21 days after service of the motion (or such other period as the court may prescribe), the challenged paper, claim, defense, contention, allegation, or denial is not withdrawn or appropriately corrected, except that this limitation shall not apply if the conduct alleged is the filing of a petition in violation of subdivision (b). If warranted, the court may award to the party prevailing on the motion the reasonable expenses and attorney's fees incurred in presenting or opposing the motion. Absent exceptional circumstances, a law firm shall be held jointly responsible for violations committed by its partners, associates, and employees.
(B) On court's initiative. On its own initiative, the court may enter an order describing the specific conduct that appears to violate subdivision (b) and directing an attorney, law firm, or party to show cause why it has not violated subdivision (b) with respect thereto.
Plaintiffs' conclusory allegation that Defendant's "supporting documentation clearly shows a potential claim for at most $289," (Pls.' Am. Compl. ¶ 94) rather than the $600.19 asserted in the Proof of Claim, is not sufficient to support a Bankruptcy Rule 9011 violation. Determining the sufficiency of the evidence attached to the Proof of Claim is a task for the Court. Plaintiffs have failed to allege specific facts that would indicate the lack of any evidentiary support for Defendant's Proof of Claim.
Furthermore, Plaintiffs have failed to follow the proper procedure set forth in Bankruptcy Rule 9011(b) for initiating sanctions against Defendant. "In order to seek sanctions pursuant to [Bankruptcy] Rule 9011, a two-step process must be followed. The motion must first be served on the opposing party. Then, after the twenty-one day `safe harbor' has passed, the party seeking sanctions may file the motion with the court." In re Varona, 388 B.R. 705, 711 n. 5 (Bankr. E.D. Va. 2008) (citing Brickwood Contractors, Inc. v. Datanet Eng'g, Inc., 369 F.3d 385, 389 (4th Cir. 2004); In re Sammon, 253 B.R. 672, 678 (Bankr. D.S.C. 2000)). Thus, Plaintiffs have failed to state a claim based on a violation of Bankruptcy Rule 9011 for which relief can be granted, and the Court will grant Defendant's Motion to Dismiss and will dismiss the Bankruptcy Rule 9011 claim.
Plaintiffs have alleged sufficient factual matter in Count Five of their Amended Complaint to adequately state a claim upon which relief may be granted only with regard to their objection to the amount asserted in Defendant's Proof of Claim. The objection to the amount of the Proof of Claim will survive, but the Court will dismiss all remaining claims asserted under Count Five of the Amended Complaint.
CONCLUSION
For the foregoing reasons, the Court will grant Defendant's Motion to Dismiss with respect to Counts One, Three, and all but that portion of Count Five pertaining to Plaintiffs' objection to the amount of the Proof of Claim. The Court will deny Defendant's Motion to Dismiss with respect to Counts Two, Four, and Plaintiffs' objection to the amount of the Proof of Claim presented in Count Five.
A separate order shall issue.