Cohen v. Northeast Radiology, P.C.

Background

Bryan Cohen brought a proposed class action against Northeast Radiology, P.C. and Alliance Healthcare Services, Inc., alleging violations of state law arising from a data breach. Cohen alleged that, when he was a patient of Northeast Radiology in December 2016, he provided his name, address, Social Security number, and other treatment-related information. He alleged that unauthorized individuals accessed information on defendants’ servers between April 14, 2019, and January 7, 2020.

The opinion states that defendants reported that unauthorized individuals gained access to a picture archiving and communication system containing electronic protected health information. Defendants stated that information belonging to 29 patients was accessed and notified other patients whose information was stored on the system but whose information had not been confirmed as accessed.

Cohen alleged that a lender contacted him about a fraudulent loan application made in his name, that more than $10,000 in fraudulent charges were made to his bank account and were not reimbursed, and that his credit score fell from 730 to 466, contributing to the denial of an apartment rental. He also alleged that he spent time dealing with credit agencies and financial institutions, closing accounts, and monitoring his credit.

Motions and jurisdiction

Defendants moved to dismiss the first amended complaint under Federal Rule of Civil Procedure 12(b)(1) for lack of subject-matter jurisdiction and under Rule 12(b)(6) for failure to state a claim. Cohen also moved to appoint interim lead class counsel and sought an order under Rule 23(d) requiring corrective notice to proposed class members and restricting defendants’ future communications with them.

The court held that Cohen adequately alleged jurisdiction under the Class Action Fairness Act. That statute permits federal jurisdiction over certain class actions when, among other requirements, more than $5 million is in controversy and the proposed class has more than 100 members. The court concluded that Cohen’s allegations about his own losses, the more than 1.2 million patients whose information was stored on defendants’ servers, and the length of the alleged breach plausibly supported those requirements at the pleading stage.

The court also held that Cohen adequately alleged standing. It found that the alleged unreimbursed financial loss and time spent responding to the breach satisfied the injury requirement. The alleged fraudulent loan application and fraudulent bank charges also made the risk of future identity theft sufficiently plausible at this stage. The court further found that Cohen plausibly connected his alleged injuries to the data breach.

Claims under state law

The court allowed the negligence claim to proceed. Cohen plausibly alleged that defendants owed him a duty to protect his electronic protected health information, failed to take adequate protective measures, and caused his alleged fraudulent charges and other losses.

The court dismissed the negligence-per-se claim. It reasoned that neither the Health Insurance Portability and Accountability Act nor the Federal Trade Commission Act expressly creates a private right of action, and the parties and court had not identified a case in the Second Circuit recognizing a New York negligence-per-se claim based on those statutes.

The court dismissed the breach-of-contract claim because Cohen did not plausibly allege an agreement. The amended complaint did not describe or attach an express contract, and the court found that Cohen’s general assertion that he entered into a contract was insufficient.

The court allowed the implied-contract claim to proceed. It found that Cohen plausibly alleged conduct and a course of dealing suggesting an implied promise to protect patients’ electronic protected health information. The court also allowed the claim under New York General Business Law § 349 to proceed because Cohen plausibly alleged that defendants’ data-security representations and alleged failure to disclose inadequate security measures could mislead a reasonable consumer and cause injury.

Class-action motions

The court denied Cohen’s motion to appoint interim lead class counsel. It found no showing that the appointment was necessary, including no identified overlapping, duplicative, or competing lawsuit or competing counsel requiring appointment before class certification.

The court also denied Cohen’s Rule 23(d) motion. Cohen argued that statements in defendants’ March 10, 2020, letter to patients were misleading and that defendants should be required to send corrective notice and stop communicating with proposed class members without court permission. The court found that the letter, considered as a whole, did not mislead recipients and that the record did not show interference with the proper administration of the proposed class action. It also found that a broad prohibition on future communications would be overbroad.

Disposition

Judge Vincent L. Briccetti granted in part and denied in part the motion to dismiss the first amended complaint. The negligence, implied-contract, and Section 349 claims may proceed; the negligence-per-se and breach-of-contract claims were dismissed. The court denied the motion to appoint interim lead class counsel and denied the Rule 23(d) motion. Defendants were ordered to file an answer by February 11, 2021, and the court stated that it would schedule an initial conference by separate order.