RESTREPO

MEMORANDUM

RESTREPO, J.

Plaintiff, Citizens Bank of Pennsylvania ("Citizens"), is a retail bank based in Philadelphia. Defendant, Reimbursement Technologies, Inc. ("RTI"), is a nationwide physician billing and financial management company, and defendant, Leah Brown, is a former RTI employee. Plaintiff sued defendants for damages resulting from fraudulent withdrawals from bank accounts of plaintiff's customers perpetrated by a "third party fraud ring." Plaintiff alleges that defendants were liable for the resulting loss because the financial data used by the fraud ring originated from computers owned by defendant RTI. Plaintiff further alleges that the data was accessed on these computers by an employee of RTI who then sold the data to the third party fraud ring.

Pending before the Court is defendant RTI's Motion to Dismiss Plaintiff's Second Amended Complaint (ECF Document 30) pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure, plaintiff's response thereto (Document 33), and defendant's reply (Doc. 35). After the filing of defendant's reply in support of its motion to dismiss, plaintiff filed a Motion for Leave to File a Third Amended Complaint (Doc. 37), and defendant has filed its opposition thereto (Doc. 39). Defendant argues that plaintiff's motion for leave should be denied in that plaintiff has failed to remedy the ongoing deficiencies in its claims despite repeated attempts to do so, and because the proposed amendments would be futile.

1. BACKGROUND

Plaintiff alleges that at some point between January and September 2010, defendant RTI's employees including, Leah Brown, accessed financial information of patients who utilized the services of RTI's medical clients. See 2^nd Am. Compl. at 3. Among the patients whose information Brown accessed was a group of at least 134 individuals who also had bank accounts with plaintiff. Id. at 3. Over an extended period of time, Brown provided this financial information to an organized "third party fraud ring." Id. Using this information, members of the fraud ring went into numerous bank branches of plaintiff and fraudulently withdrew money from the accounts of at least 134 of plaintiff's customers. Id. Upon discovering the fraud, plaintiff reimbursed its customer's accounts for the amounts fraudulently withdrawn and offered additional services to those affected. Id. at 5. As a result of the fraudulent withdrawals, plaintiff claims losses totaling at least $390,506,84 "in connection with [plaintiff's] payment of funds in the [f]raudulent [t]ransactions." Id. ¶ 29.

2. STANDARD OF REVIEW

Defendant has moved to dismiss the Second Amended Complaint under Federal Rule of Civil Procedure 12(b)(6). Rule 12(b)(6) provides for the dismissal of a Complaint if the plaintiff "fail[s] to state a claim upon which relief can be granted[.]" When reviewing a motion to dismiss on the pleadings, courts "accept all factual allegations as true, construe the Complaint in the light most favorable to the plaintiff, and determine whether, under any reasonable reading of the Complaint, the plaintiff may be entitled to relief." Phillips v. Cnty. of Allegheny, 515, F.3d 224, 233 (3d Cir. 2008) (citation and quotations omitted).

In Bell Atlantic Corp. v. Twombly, 550 U.S. 544 (2007), the Supreme Court clarified the 12(b)(6) standard. The Court held that the factual allegations set forth in a Complaint "must be enough to raise a right to relief above the speculative level[.]" Id. at 555. In affirming that Twombly standards apply to all motions to dismiss, the Supreme Court has explained that principle. First, "the tenet that a court must accept as true all of the allegations contained in a Complaint is inapplicable to legal conclusions." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Second, "only a Complaint that states a plausible claim for relief survives a motion to dismiss." Id. at 679. Therefore, "a court considering a motion to dismiss can choose to begin by identifying pleadings that, because they are no more than conclusions, are not entitled to the assumption of truth." Id. Ultimately, "a Complaint must do more than allege the plaintiff's entitlement to relief. A Complaint has to 'show' such an entitlement with its facts." Fowler v. UPMC Shadyside, 578 F.3d 203, 211 (3d Cir. 2009).

3. DISCUSSION

(A) Count I: Negligence

Count I of the Second Amended Complaint alleges that defendant RTI was negligent in failing to prevent the confidential data from being stolen from its computer systems. See 2^nd Am. Compl. at 6. To establish a cause of action in negligence, plaintiff must demonstrate the following elements:

(1) defendant owed a duty of care to plaintiff;
(2) defendant breached that duty;
(3) the breach resulted in injury to the plaintiff; and
(4) plaintiff suffered an actual loss or damage.

(i) Common Law Duty

The Second Amended Complaint alleges that RTI had a duty to plaintiff and plaintiff's customers to do the following:

(a) to properly secure and to protect Citizens' customers' personal banking information and other information and not disclose such information improperly;
(b) to implement procedures and practices to prevent access and/or have in place appropriate data privacy and security safeguards to prevent disclosure to unauthorized third parties.

Simply alleging the existence of a legal duty in the Second Amended Complaint, however, is not enough to survive a motion to dismiss. Without sufficient factual and legal support, such allegations may be disregarded as conclusory statements of law. See R.W. v. Manzek, 888 A.2d 740, 746 (Pa. 2005) ("the existence of a duty is a question of law for the court to decide"); Fowler, 578 F.3d at 210 (holding that the court may disregard any unsupported legal conclusions in a Complaint). The Court must therefore determine whether the Second Amended Complaint alleges sufficient support for its assertion of defendant's legal duty.

Pennsylvania's Supreme Court has specified five factors that a trial court should consider in a negligence action when determining the existence of a common law duty of care:

(1) the relationship between the parties;
(2) the social utility of the actor's conduct;
(3) the nature of the risk imposed and foreseeability of the harm incurred;
(4) the consequences of imposing a duty upon the actor; and
(5) the overall public interest in the proposed solution.

Concerning the first factor, "duty is predicated on the relationship that exists between the parties at the relevant time." Manzek, 888 A.2d at 747. Here, the Second Amended Complaint alleges that at least 134 of Citizens' customers were also patients of RTI's clients. See 2^nd Am. Comp. ¶ 10. There is no suggestion in the Second Amended Complaint that the overlapping of the 134 customers was anything other than a coincidence. Id. The unintentional nature of this connection weakens the inference of a relationship. See, e.g., Althaus, 756 A.2d at 1169. Analysis of the first factor thus weighs against the existence of a duty.

In analyzing the second factor, the Court looks to the social utility of defendant's conduct. See Phillips, 841 A.2d at 1009. Here, the Second Amended Complaint states that Brown "had access to [plaintiff's] customers' confidential non-public personal and financial account information" and that this information "was accessed from via [sic] RTI's computers by Brown, among others." See 2^nd Am. Compl. ¶¶ 12-13. The nature of defendant's potentially negligent conduct is unclear, however, in light of the lack of factual allegations as to what safeguards were actually in place at the time of the alleged negligence. Therefore, it cannot properly be said that defendant's security precautions were inadequate, and this factor is neutral at best.

As for the third factor, "duty arises only when one engages in conduct which foreseeably creates an unreasonable risk of harm to others." Manzek, 888 A.2d at 747. While in hindsight one may be able to trace a line from defendant's actions to plaintiff's losses, this is not the applicable test. "The test is whether the harm to [plaintiff] was foreseeable in the first instance." Commerce Bank/Pennsylvania v. First Union Nat. Bank, 911 A.2d 133, 139 (Pa. Super. 2006). Defendants are generally not held liable for wrongful acts by intervening third parties. See Mahan v. Am-Gard, Inc., 841 A.2d 1052, 1061 (Pa. Super. 2003).

In this case, plaintiff's Second Amended Complaint fails to "show" with its facts, see Fowler, 578 F.3d at 211, that defendant's conduct could foreseeably create an unreasonable risk of harm to plaintiff due to intervening acts by third parties. The alleged facts do not suggest that defendant could have foreseen that:

(1) A rogue employee would steal information belonging to RTI's patients who were also customers of Citizens;
(2) This information would be sold to a third party "fraud ring";
(3) The fraud ring would target specific customers of plaintiff;
(4) Plaintiff's own employees would fail to detect and stop the fraud from occurring;
(5) Plaintiff would be obligated to repay all of its customers' money that had been fraudulently withdrawn.

Regarding the fourth factor, the consequences of imposing a duty on the actor must be considered. See Brisbine, 799 A.2d at 95. Establishing a duty in this case would potentially require medical data managers such as defendant to enhance data security procedures and safeguards - increasing the burdens placed on such companies. However, it is not clear that increasing security standards would have had any practical consequences on the outcome of this case. While the Second Amended Complaint alleges the existence of a duty on the part of defendant to maintain a certain level of data security safeguards, it provides a lack of allegations as to what safeguards were actually in place at the time of the alleged negligence or what safeguards should have been in place, for that matter. It cannot be inferred that the customer data was illicitly accessed by Brown due to lax security precautions, or legitimately accessed within the scope of Brown's employment authority (thus bypassing even the most rigorous of data security safeguards). Thus, the fourth factor weighs against the existence of a duty.

In considering the fifth factor, the Court analyzes the public's overall interest in imposing the alleged duty of care on defendant. See Phillips, 841 A.2d at 1010. In general, the public has an interest in holding medical information companies liable to their customers for any mishandling of the customers' confidential data. Here, however, plaintiff is not arguing that defendant be held liable to its own customers. Rather, plaintiff asserts that defendant should be held liable to third parties connected only derivatively to defendant through defendant's clients' patients' separate business relationships. Establishing such a duty in this case would expose defendant, and similar companies, to potentially limitless liability from plaintiffs who claim to have suffered a loss due to wrongdoing that is far removed from the initial causal event. Analysis of the fifth factor thus weighs against the existence of a duty in this case.

On balance, an analysis of the above factors weighs against the establishing of a duty of care on defendant in this case. Accordingly, plaintiff's allegations fail to sufficiently support the existence of a common law duty of care.

(ii) Statutory Duty

Plaintiff may also show negligence by demonstrating the violation of a statute or regulation that establishes a legal duty of care. Madison v. Bethanna, Inc., 2012 WL 1867459, *5 (E.D. Pa. May 23, 2012). Such a showing constitutes negligence per se. See id. Under Pennsylvania law, a successful claim of negligence per se consists of four elements:

(1) The purpose of the statute must be, at least in part, to protect the interest of the plaintiff individually, as opposed to the public interest;
(2) The statute or regulation must clearly apply to the conduct of the defendant;
(3) The defendant must violate the statute or regulation; and
(4) The violation of the statute must proximately cause the plaintiff's injuries.

Id.

Here, plaintiff's Second Amended Complaint asserts that defendant RTI had a statutory duty to plaintiff and its customers under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Pub. L. No. 104-191, 110 Stat. 1936 (1996). See 2^nd Am. Compl. ¶¶ 22, 36-37. The Second Amended Complaint appears to allege that, because RTI allegedly violated HIPAA's statutory duty by allowing its clients' patients' data to be used in defrauding accounts at plaintiff bank, defendant should thus be found negligent per se. Even assuming arguendo that plaintiff meets the first three elements of negligence per se, however, the claim fails in that plaintiff fails to relate defendant's alleged statutory violation to plaintiff's injuries as required by element four.

Regarding element four of the negligence per se test, plaintiff must show that defendant's alleged statutory violation was the proximate cause of plaintiff's injuries. Courts have generally been unwilling to find proximate causation where "an injury is indirect, remote, and many steps away from the alleged cause." See Allegheny Gen. Hosp. v. Philip Morris, Inc., 228 F.3d 429, 445 (3d Cir. 2000).

In this case, plaintiff fails to show that a violation of HIPAA (or any other statute, for that matter) could serve as the proximate cause of plaintiff's alleged harm. The alleged statutory violation - which occurred when defendant allegedly mishandled its clients' patients' private information - is causally separated from plaintiff's actual harm by multiple intervening acts of independent third parties. RTI's employee, Leah Brown, allegedly sold the data to a third party "fraud ring," whose fraudulent withdrawals from plaintiff were not caught by plaintiff's own employees until after the fact, see 2^nd Am. Compl. at 3. The Court cannot hold defendant responsible for the acts of the fraud ring or the tellers at plaintiff's bank branches. As such, plaintiff fails to meet its burden of showing negligence per se. In that plaintiff has failed to sufficiently allege a legal duty of care based either on common law or statute, a showing of negligence has not been made, and plaintiff's first Count is dismissed.

(B) Count II: Equitable Subrogation

Count II of the Second Amended Complaint alleges that plaintiff has an equitable subrogation claim against defendant. See 2^nd Am. Compl. ¶¶ 41-45. Equitable subrogation "places the subrogee in the precise position of the one to whose rights and disabilities he is subrogated." Pub. Serv. Mut. Ins. Co. v. Kidder-Friedman, 743 A.2d 485, 488 (Pa. Super. 1999). It is an equitable doctrine which may only be sought if plaintiff "appears before the court with clean hands," in that it played no part in the incurring of the original debt or harm. See Am. States Ins. Co. v. Maryland Cas. Co., 628 A.2d 880, 888 (Pa. Super 1993). This is because, in part, "great care should be taken by the court, that the subrogation will work no injustice to the rights of others." U.S. Steel Homes Credit Corp. v. S. Shore Dev. Corp., 419 A.2d 785, 790 (Pa. Super. 1980).

Here, plaintiff does not appear before the Court with "clean hands" since, in the very least, its bank tellers failed to prevent the fraudulent withdrawals which led to the loss to its own customers. It is these same withdrawals for which plaintiff seeks subrogation. Holding a third party liable through subrogation in this situation would hardly be equitable, as it would effectively allow plaintiff to shirk its own obligations to safeguard its customers from fraud. See Am. States Ins. Co., 626 A.2d at 888. Accordingly, plaintiff is not entitled to equitable remedies in this case, and Count II is dismissed.

(C) Count III: Fraud

Count III of the Second Amended Complaint alleges fraud by defendant RTI. The Federal Rules of Civil Procedure establish a heightened pleading requirement for fraud, requiring that such allegations "shall be stated with particularity." See Fed. R. Civ. P. 9(b).

Under Pennsylvania law, a prima facie case of fraud consists of the following elements:

(1) a false representation;
(2) made with knowledge of its falsity or recklessness as to whether it is true or false;
(3) which is intended to make the receiver act;
(4) justifiable reliance on the misrepresentation; and
(5) damages to the receiver as a proximate result of the reliance.

The Second Amended Complaint appears to allege the presence of both a "positive assertion" and an "intentional non-disclosure." In alleging false representation in the form of a "positive assertion," the Second Amended Complaint states that "RTI, through its agents, servants, workmen, and/or employees, fraudulently and intentionally misrepresented to Citizens that the withdrawals from the accounts of Citizens' customers were authorized," see 2^nd Am. Compl. ¶ 47. The misrepresentation alleged here appears to refer to the use of withdrawal slips and foreign cashed checks to withdraw money belonging to customers of plaintiff, id. at 3. While these facts may sufficiently allege the presence of a false representation for the purposes of element one, the Second Amended Complaint states explicitly that the representation was made by a "third party fraud ring" rather than RTI itself, id.

Other than conclusory allegations, plaintiff fails to allege any legal basis on which to hold defendant liable for the acts of third-party criminals. Because of this insufficiency in plaintiff's allegations of fraud, its false representation claim based on this alleged "positive assertion" fails to meet 9(b)'s heightened pleading requirement for false representation.

A fraud claim based on intentional non-disclosure "is actionable as fraud only where there is an independent duty to disclose the omitted information." Bucci, 591 F. Supp. 2d at 783. The duty to disclose information arises only in the context of a fiduciary or confidential relationship between the parties. See id. Such relationships may be shown to exist through the presence of an agreed upon "trust and confidence" between the parties. Id. A duty to disclose generally does not exist where "both the plaintiff and defendant were sophisticated business entities, entrusted with equal knowledge of the facts." Id. (quoting Duquesne Light Co. v. Westinghouse Elec. Corp., 66 F.3d 604, 612 (3d Cir. 1995)).

In alleging fraudulent misrepresentation in the form of an intentional non-disclosure, the Second Amended Complaint states that "RTI had a duty to disclose the breach of the unauthorized disclosure of personal and financial identifying information of its [c]lients, including Citizens' customers. . . . RTI's breach of these duties constitutes a fraud." See 2^nd Am. Compl. ¶¶ 48, 52. However, the only relationship alleged in the Second Amended Complaint between plaintiff and defendant is that at least 134 of RTI's clients' patients were also plaintiff's customers. Id. at 3. This relationship appears to be coincidental and not the result of planning or agreement. In that it is coincidental, the relationship does not rise to the level of a "trust or confidence" between plaintiff and defendant corporations. Accordingly, plaintiff's fraudulent non-disclosure claim fails to satisfy the first element of a prima facie case of fraud through either a fraudulent assertion or a fraudulent non-disclosure under Rule 9(b), and Count III is dismissed in its entirety.

(D) Count IV: Unjust Enrichment

Count IV of the Second Amended Complaint alleges unjust enrichment on the part of defendant. Under Pennsylvania law, unjust enrichment is defined by the following elements:

(1) benefits conferred on defendant by plaintiff;
(2) appreciation of such benefits by defendant; and
(3) acceptance and retention of such benefits under such circumstances that it would be inequitable for defendant to retain the benefit without payment of value.

For the reasons set forth in the above discussion on equitable subrogation, plaintiff does not appear before the Court with "unclean hands." Accordingly, plaintiff is barred from seeking equitable remedies, and count IV is dismissed.

(E) Count V: Stored Communications Act Violation

Count V of the Second Amended Complaint alleges that defendants violated the federal Stored Communications Act ("SCA"), 18 U.S.C § 2701 et seq. The SCA, also known as Title II of the Electronic Communications Privacy Act ("ECPA"), "prohibits unauthorized access of an electronic communication while it is in 'electronic storage' in a 'facility through which an electronic communication service is provided.'" Integrated Waste Solutions, Inc. v. Goverdhanam, 2010 WL 4910176, *5-6 (E.D. Pa. 2010) (citing 18 U.S.C. § 2701(a)). The primary criminal provision of the SCA, 18 U.S.C, § 2701(a), states:

Except as provided in subsection (c) of this section whoever - -

(1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or
(2) intentionally exceeds an authorization to access that facility;

and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.

Except as provided in section 2703(e), any provider of electronic communication service, subscriber, or other person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind may, in a civil action, recover from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate.

(1) "any provider of electronic communication service";
(2) a "subscriber" of such a service; or
(3) any other person "aggrieved by any violation of this chapter."

This list is exclusive; no other category of individual may recover under the SCA, even if that party's allegation is otherwise sufficient. See Cornerstone Consultants, Inc. v. Production Input Solutions, LLC., 789 F. Supp. 2d 1029, 1049 (N.D. Iowa 2011). Plaintiff alleges no facts suggesting that it had any role in providing the services used by defendant to store its data. Nor does it allege any facts suggesting that it was a direct user of defendant's services. Finally, plaintiff is unable to allege that it was an "aggrieved person" for purposes of the statute. See, e.g., 18 U.S.C. § 2510(11) (defining "aggrieved person" under the statute as "a person who was a party to any intercepted . . . electronic communication or a person against whom the interception was directed"). Accordingly, since plaintiff is unable to allege that it satisfied any of these categories, plaintiff does not appear authorized to recover under the SCA.

Furthermore, "[t]he SCA prohibits access to only two forms of stored electronic communications: (1) 'communications temporarily stored by electronic communications services incident to their transmission' - for example, when 'an email service stores a message until the addressee downloads it,' In re Doubleclick, 154 F. Supp.2d 497, 512 (S.D. N.Y. 2001); and (2) data stored for purposes of 'backup protection' pending delivery to a recipient. 18 U.S.C. § 2510(17)." See Integrated Waste Solutions, 2010 WL 4910176, at *5-6. Here, plaintiff has not alleged access to a stored communication within the meaning of the Act. Rather, the facts alleged (as opposed to the alleged legal conclusions) in plaintiff's Second Amended Complaint appear to allege access to "data stored on [defendant's] computers." See, e.g., id. at *6.

Finally, "[s]ection 2701 does not proscribe unauthorized use or disclosure of information obtained from authorized access to a facility." Ideal Aerosmith, Inc. v. Acutronic USA, Inc., 2007 WL 4394447, *7 (E.D. Pa. 2007) (quoting In re Am. Airlines, Inc., Privacy Litig., 370 F. Supp.2d 552, 559 (N.D. Tex. 2005)) (citing cases); see also Intern'l Ass'n of Machinists and Aerospace Workers v. Werner-Masuda, 390 F. Supp.2d 479, 499 (D. Md. 2005) (Title II does "not prohibit the unauthorized disclosure or use of information, but rather unauthorized access. Nor [does its] terms proscribe authorized access for unauthorized or illegitimate purposes."). Therefore, to the extent that plaintiff alleges, "at most, that defendants exceeded their authorized access to proprietary information in ordinary storage on [RTI's] computers," see Integrated Waste Solutions, 2010 WL 4910176, at *7, such allegations fail to make a proper claim of a violation of the SCA. See id. For each of the independent reasons identified above, the Second Amended Complaint does not provide a sufficient basis for allowing plaintiff to sue for a violation of the SCA, and Count V is dismissed.

(F) Plaintiff's Motion for Leave to File a Third Amended Complaint

Following the filing of plaintiff's operative Second Amended Complaint, plaintiff states that

federal and local authorities notified Citizens of an additional breach, which interview provided new evidence related to an additional data breach by another RTI employee . . . Based on this new information, Citizens seeks to amend its Second Amended Complaint to include the newly discovered breach, and to add a claim for subrogation under 13 Pa. C.S.A. § 4407.

With regard to plaintiff's Proposed Count VI, see Pl.'s Proposed 3rd Am. Compl. ¶¶ 73-79, which was not included in the operative Second Amended Complaint, that amendment would be futile. Plaintiff's proposed Count VI is styled "Subrogation Pursuant to 13 Pa. C.S.A. § 4407." Section 4407 provides:

If a payor bank has paid an item . . . under circumstances giving a basis for objection by the drawer or maker, to prevent unjust enrichment and only to the extent necessary to prevent loss to the bank by reason of its payment on the item, the bank is subrogated to the rights:

(1) of any holder in due course on the item against the drawer or maker;
(2) of the payee or any other holder of the item against the drawer or maker either on the item or under the transaction out of which the item arose: and
(3) of the drawer or maker against the payee or any other holder of the item with respect to the transaction out of which the item arose.

Proposed Count VI alleges that "Citizens' mitigation efforts reduced the losses, potential and/or actual, of Citizens' customers, which in turn significantly reduced the potential liability exposure for RTI for claims based on identity theft and losses of finances" and that "[t]his conferred significant monetary benefits upon RTI and unjustly enriched RTI, as RTI has failed and/or refused to compensate Citizens for its mitigation efforts." See Pl.'s Proposed 3^rd Am. Comp. ¶ 77. Plaintiff further asserts that "[t]he affected customers have a valid claim against RTI" and that "Citizens is subordinated to the claims of its affected customers against RTI because of RTI's negligent and/or wrongful conduct under 13 Pa. C.S.A. § 4407." Id. ¶¶ 78-79.

Section 4407 provides that under certain circumstances, a bank "is subrogated to the rights of" the drawer or maker "against the payee or any other holder of the item." See 13 Pa. C.S.A. § 4407 (emph. added). Even assuming arguendo that plaintiff has sufficiently alleged that RTI was unjustly enriched and that plaintiff's customers had a viable cause of action against RTI for the fraudulent transactions, plaintiff cannot allege that RTI was "the payee or any other holder of" any of the items in question, see id. Rather, an organized fraud ring (not RTI) allegedly withdrew money from plaintiff's customers' accounts. Neither RTI nor anyone acting on its behalf is alleged to have been a payee or holder of any of the fraudulent items at issue. Accordingly, granting plaintiff leave to file the proposed Third Amended Complaint would be futile, and plaintiff's request in that regard is denied.

4. CONCLUSION

The Second Amended Complaint fails to plead sufficient factual and legal matter to meet the pleading standards set forth under the Federal Rules of Civil Procedure. Defendant's 12(b)(6) Motion to Dismiss the Second Amended Complaint is therefore granted. Furthermore, because amending the Second Amended Complaint would be futile and there has been repeated failure to cure by amendments previously allowed, plaintiff's Motion for Leave to File a Third Amended Complaint is denied.

An appropriate Order follows.