Darryl Scott v. Healthcare Management Solutions, LLC, et al.

Summary

The United States District Court for the Northern District of West Virginia granted in part and denied in part defendants’ motion to dismiss claims arising from a ransomware attack and alleged data breach affecting Medicare beneficiaries. The court denied dismissal for lack of Article III standing and allowed the negligence and negligence per se claims to proceed, finding that the plaintiff plausibly alleged concrete injuries, traceability, a special relationship, and breach. The court granted dismissal of the breach of implied contract claim and dismissed the breach of fiduciary duty claim based on the plaintiff’s agreement to voluntarily dismiss it.

Holdings

1. Scott plausibly established injury in fact, traceability, and redressability at the pleading stage; therefore, he had standing to pursue the action.
2. Scott plausibly alleged negligence and negligence per se because Defendants owed him a duty arising from a special relationship, and he adequately alleged breach and damages.
3. Scott failed to state a breach-of-implied-contract claim because he did not sufficiently allege privity or a direct relationship with Defendants.
4. Scott failed to state an invasion-of-privacy claim because he alleged negligent rather than intentional conduct and the compromised information did not constitute medical information.
5. Scott failed to state a claim under the California Customer Records Act because he was not Defendants' customer.
6. Scott plausibly stated claims under the unlawful and unfair prongs of the California Unfair Competition Law and adequately alleged statutory standing.
7. Scott failed to state a claim under the California Confidentiality of Medical Information Act because the data breach did not compromise medical information as defined by the statute.
8. Scott's declaratory-judgment claim could proceed at the pleading stage because he sought prospective relief concerning continuing data-security obligations and alleged that his information remained vulnerable.

Questions Presented

1. Whether Scott had Article III standing based on alleged identity theft, fraud, credit-score reduction, mitigation expenses, and related injuries.
2. Whether Scott plausibly stated a California negligence and negligence-per-se claim, including the existence of a duty, breach, and cognizable damages.
3. Whether Scott plausibly stated a breach-of-implied-contract claim despite lacking a direct relationship or privity with Defendants.
4. Whether Scott plausibly stated a California constitutional invasion-of-privacy claim when the alleged conduct was negligent and the compromised data did not include medical information.
5. Whether Scott qualified as a customer under the California Customer Records Act.
6. Whether Scott plausibly stated a California Unfair Competition Law claim under the unlawful and unfair prongs and had statutory standing.
7. Whether Scott plausibly stated a claim under the California Confidentiality of Medical Information Act when no claims or medical-treatment data was compromised.
8. Whether Scott's declaratory-judgment claim could proceed as prospective relief rather than being impermissibly duplicative.

Disposition

other