This monthly column is written by Ellie F. Chapman of Morgan, Lewis & Bockius LLP in San Francisco. It is designed to provide RPP readers with a sampling of the types of patient privacy cases that courts are now hearing. It is not intended to be a comprehensive monthly survey of all patient privacy court actions. Contact Ellie at ellie.chapman@morganlewis.com.
◆ New York District Judge Reverses Prior Decision: Risk of Future Identity Theft Sufficient to Convey Standing in Data Breach Case. In Fero et. al. v. Excellus Health Plan Inc. et al., on January 19, 2018, a New York district judge reinstated claims brought by plaintiffs who claimed that their data had been exposed but not misused, reversing the court’s earlier decision that these plaintiffs had not alleged an injury sufficient to establish Article III standing. In September 2015, Rochester-based Excellus Health Plan Inc. (Excellus) announced that its computer network had been hacked, exposing the personally identifiable information (PII) of approximately 10 million policyholders. Several lawsuits were subsequently filed against Excellus, and Excellus moved to dismiss. In February 2017, Judge Elizabeth A. Wolford granted in part the motion to dismiss, finding that four of the plaintiffs, who did not allege any post-breach misuse of their PII, lacked standing for failure to allege an injury-in-fact. In March 2017, the plaintiffs moved for reconsideration of the dismissal. They argued that such reconsideration was necessary for two reasons. First, since Judge Wolford’s prior order, the Second Circuit had decided Whalen v. Michaels Stores Inc., which cited favorably to Sixth and Seventh Circuit precedent holding that an increased risk of identity theft post-breach was sufficient to show Article III standing. Second, new evidence demonstrated that the plaintiffs’ data had been exfiltrated from the health insurer and made available for sale on the dark web. Judge Wolford agreed with the plaintiffs, reversing her previous dismissal: “Until the Supreme Court weighs in, in [the Second] Circuit at least, harm based on the theft of personally identifying information, such as a Social Security number or date of birth, as alleged [by the Excellus plaintiffs], is sufficient to establish standing.” She also found persuasive the plaintiffs’ evidence that their stolen information was available on the dark web. Such information bolstered the plaintiffs’ claims that their PII had been compromised, and that the hackers had nefarious intentions.
