Patterson v. Medical Review Institute of America, LLC

Background

Albert Patterson alleged that Medical Review Institute of America, LLC (MRIoA) acquired, collected, and stored customers’ personal health information and personally identifiable information to facilitate clinical peer review of health-care services. He alleged that MRIoA sent him a January 7, 2022 letter stating that his information had been involved in a data breach in which hackers infiltrated MRIoA’s systems.

Patterson’s First Amended Complaint asserted seven claims: negligence; violation of California’s Confidentiality of Medical Information Act; invasion of privacy; breach of confidence; breach of implied contract; unfair business practices under California law; and unjust enrichment. Several claims were brought for a proposed nationwide class, while the medical-information and unfair-business-practices claims were brought for a proposed California subclass.

MRIoA moved to dismiss under Federal Rule of Civil Procedure 12(b)(1), which permits dismissal for lack of subject-matter jurisdiction, and Rule 12(b)(6), which concerns failure to state a legally sufficient claim. MRIoA alternatively sought transfer to the District of Utah under 28 U.S.C. § 1404(a). In an earlier order, the court dismissed Patterson’s original complaint for lack of Article III standing but allowed him to amend. Patterson then filed the First Amended Complaint.

Standing analysis

Article III standing requires a plaintiff to show an injury in fact that is concrete, particularized, and actual or imminent; a connection between the injury and the defendant’s conduct; and a likelihood that a favorable decision would remedy the injury. A plaintiff who lacks standing also cannot seek relief for a class.

MRIoA challenged Patterson’s standing on both the face of the complaint and the supporting facts. Patterson relied on time spent verifying the breach, investigating credit monitoring and identity-theft insurance, monitoring his accounts, and seeking legal advice. He also alleged fear, apprehension, anxiety, and embarrassment.

The court concluded that Patterson had not shown a cognizable injury in fact. The court noted that Patterson did not dispute that the information potentially exposed in the breach was not sufficiently sensitive to create a credible risk of future fraud or identity theft. The information consisted of a single one-page document containing the date, the title “Advisory,” a reference to “Patterson, Albert” as insured and patient, a policy number, a 60-minute review time, and a total amount to be billed of $327.00.

The court held that lost time and anxiety, without a credible risk of future fraud or identity theft, did not establish Article III standing. It also rejected Patterson’s argument that his mitigation efforts were reasonable, explaining that a plaintiff cannot create standing by spending money or time responding to a risk of future harm that is not certainly impending.

Disposition

The court granted MRIoA’s motion to dismiss and dismissed Patterson’s First Amended Complaint without further leave to amend. Because the court resolved the case for lack of standing, it did not reach MRIoA’s alternative arguments that Patterson failed to state a claim or that the District of Utah was a more convenient forum. The court also vacated the scheduled hearing.

Classification

This is a procedural order because the court dismissed the complaint for lack of Article III standing without reaching the sufficiency of Patterson’s underlying claims.