Opinion
BCD-CIV-2023-00028
08-31-2023
SAYLOR DESJARDIN, Plaintiff, v. LESLIE WIRCHAK, et al., Defendants.
ORDER DENYING IN PART AND GRANTING IN PART THE MOTION TO DISMISS BROUGHT PURSUANT TO M.R. CIV. P. 12(b)(6) BY DEFENDANTS EASTERN MAINE MEDICAL CENTER, D/B/A NORTHERN LIGHT HEALTH, AND EASTERN MAINE MEDICAL CENTER, D/B/A NORTHERN LIGHT EASTERN MAINE MEDICAL CENTER
MICHAEL A. DUDDY, JUDGE BUSINESS & CONSUMER COURT
BACKGROUND
The question presented by this motion to dismiss is whether a hospital patient whose electronic medical record was repeatedly accessed, viewed, and misappropriated for illegitimate reasons by prying unauthorized hospital employees during the nine months of her pregnancy and beyond can state a claim against the hospital.
On May 9, 2023, Plaintiff Saylor DesJardin ("DesJardin") filed her Complaint in the abovecaptioned matter. DesJardin's Complaint asserts causes of action against Defendants Eastern Maine Healthcare Systems, doing business as Northern Light Health, and Eastern Maine Medical Center, doing business as Northern Light Eastern Maine Medical Center (together, the "Hospital Defendants"), as well as against certain individual defendants. As to the Hospital Defendants, DesJardin asserts claims for invasion of privacy (Count III), negligence (Count IV), negligent infliction of emotional distress (Count V), and breach of contract (Count VII).
Before the Court is Hospital Defendants' Motion to Dismiss (the "Motion") pursuant to Maine Rule of Civil Procedure 12(b)(6). By and through the Motion, Hospital Defendants attempt triage by seeking dismissal of all claims asserted against them for failure to state a claim. The Court heard oral argument on the Motion to Dismiss on August 30, 2023. After hearing argument and reviewing the motion papers and the Complaint's factual allegations, the Court DENIES IN PART and GRANTS IN PART Hospital Defendants' Motion to Dismiss.
FACTUAL ALLEGATIONS
The Court treats the following factual allegations as if they are admitted:
I. DesJardin's relationship with Connor Wirchak.
Des Jardin, a resident of Franklin in Hancock County, was in a contentious relationship with Connor Wirchak ("Connor"), who is a named individual defendant in this lawsuit, from approximately January 2020 through October 2021. Compl. ¶¶ 1, 18. Leslie Wirchak ("Leslie") is Connor's mother. Compl. ¶ 20. Leslie is also a named individual defendant in this lawsuit. At all times relevant to this matter, Leslie was a non-clinical, administrative employee and agent of Hospital Defendants. Compl. ¶¶ 2, 74. Later, but in a time frame relevant to this matter, Connor also became an employee and agent of Hospital Defendants. Compl. ¶ 90.
At one point in their relationship DesJardin and Connor were sitting in a parked car together. Connor produced a marriage license and asked DesJardin to sign it, which she did under duress and to placate Connor. Compl. ¶¶ 26-28. There was no marriage ceremony, no exchange of vows, and no witnesses. Compl. ¶ 29. The incomplete license was left with a clerk of courts. Compl. ¶ 31. DesJardin later confirmed through the clerk that a legal marriage had not occurred. Compl. ¶ 32. She did not hold herself out as being married. Compl. ¶ 32.
In the Fall of 2021, Connor began residing with his mother, Leslie. Compl. ¶ 36. In early October 2021, Des Jardin advised Connor that she was officially ending their relationship, which upset him. Compl. ¶ 37. Around this same time, DesJardin suspected that she was pregnant. Compl. ¶ 38. On October 10, 2021, a test confirming Des Jardin's pregnancy was performed at a medical facility unaffiliated with Hospital Defendants. Compl. ¶ 38.
On October 11, 2021, DesJardin informed Connor and Leslie that she was pregnant with Connor's child. Compl. ¶¶ 39-40. Connor accused DesJardin of lying about the pregnancy. Compl. ¶ 41. Des Jardin informed Connor that she planned to receive care at one of the Hospital Defendants' facilities, and she provided him with the date of her next appointment. Compl. ¶ 42. Connor declined to attend DesJardin's appointments. Compl. ¶ 43.
II. Des Jardin commences pre-natal care; unauthorized access of Des Jardin's health care information.
On October 19, 2021, DesJardin began receiving pre-natal care at facilities operated by Hospital Defendants. Compl. ¶ 44. She continued to receive care at those facilities throughout the duration of her pregnancy, the child's birth, and for her post-partum healthcare. Compl. ¶ 44. In the course of Des Jardin's care and treatment at Hospital Defendants' facilities, Hospital Defendants gathered, retained, and maintained DesJardin's "health care information" within the meaning of applicable Maine and federal law. Compl. ¶ 45. Hospital Defendants, through their Privacy Policy, notified DesJardin about the measures the law requires them to take to protect patients' health information. Compl. ¶ 220.
See 22 M.R.S. §1711-C(1)(E), Maine's statute governing "[confidentiality of health care information," and 42 U.S.C. § 1320d(4), defining "[h]ealth information" within the meaning of the federal Health Insurance Portability and Accountability Act, or "HIPAA."
At all relevant times, DesJardin expected that the health care information she provided to Hospital Defendants would be kept confidential and that her information would only be accessed and utilized as necessary for the provision of healthcare to her. Compl. ¶ 49. At no time did DesJardin give either Connor or Leslie her authorization or permission to access or view any of her health care information maintained by Hospital Defendants, let alone any records related to her pregnancy. Compl. ¶ 46. Nor did she identify Connor to Hospital Defendants as her legal spouse or cohabitant. Compl. ¶ 47. She did not give Hospital Defendants her consent to disclose her health care information to Connor or Leslie. Compl. ¶ 48.
DesJardin's expectations proved to be misplaced. Connor advised Leslie and a John Doethat Des Jardin had a pre-natal appointment scheduled for October 19, 2021, at one of Hospital Defendants' facilities, and he directed Leslie or the John Doe to access the record for that appointment. Compl. ¶ 53. On or about October 12, 2021, one day after Des Jardin notified Connor and Leslie about her pregnancy and one week before she began receiving pre-natal care, Leslie or the John Doe began surveilling DesJardin's reproductive health. Compl. ¶ 50. Specifically, Leslie or the John Doe accessed DesJardin's health care information and protected health information ("PHI") contained within the electronic medical record ("EMR") maintained by Hospital Defendants. Compl. ¶ 50. Subsequently, on numerous occasions during Fall 2021, Leslie, or the John Doe Defendants acting at her direction, accessed DesJardin's EMR within Hospital Defendants' custody without any work-related reason for doing so and without DesJardin's knowledge or consent. Compl. ¶¶ 54, 57.
In addition to Connor and Leslie, the Complaint names John Does 1-5 as individual defendants (the "John Doe Defendants"). The John Doe Defendants are individuals who, at all relevant times, were associated with Leslie or Connor, employed by Hospital Defendants, had access to patient health care information maintained by Hospital Defendants, and who accessed, viewed, or distributed Desjardin's health care information without Desjardin's knowledge or consent and without a work-related reason for doing so. Compl. ¶ 6. Hospital Defendants know but have declined to supply the names of the John Doe Defendants.
"Protected health information" is defined by the rules implementing HIPAA. See HIPAA Privacy Rule, 45 C.F.R. § 160.103 (2023). Under HIPAA, covered entities and their business associates must observe heightened security standards to preserve the confidentiality of their patients' PHI. See 45 C.F.R. §§ 164.306-164.316.
a. John Doe 1 accessed DesJardin's protected health information.
On October 20, 2021, Defendant John Doe 1, a person associated with Leslie or Connor and employed by a Hospital Defendant, accessed the scheduling application utilized by Hospital Defendant Northern Light Health to search DesJardin's name and access her scheduled appointments. Compl. ¶ 58. John Doe 1 again searched DesJardin's name in Hospital Defendants' scheduling application on October 21 and November 15, 2021, and accessed her scheduled appointments. Compl. ¶ 58.
Apart from accessing Des Jardin's appointments through Hospital Defendants' scheduling application, on November 2, 2021, John Doe 1 accessed DesJardin's EMR and viewed documents or notes from a visit DesJardin made to Northern Light Women's Health. Compl. ¶ 59. John Doe 1 again entered DesJardin's EMR on November 3, 2021, the day following one of DesJardin's prenatal appointments, and viewed four documents or notes. Compl. ¶¶ 60-61.
John Doe 1 accessed DesJardin's EMR at the direction of Leslie or Connor, and he disclosed its contents to them. Compl. ¶¶ 62-63. John Doe 1 accessed DesJardin's EMR in the course of his employment by Hospital Defendants and by using credentials provided to him to access Hospital Defendants' electronic medical recordkeeping system. Compl. ¶ 64.
b. John Doe 2 accessed Des Jardin's protected health information.
Like John Doe 1, John Doe 2, a person associated with Leslie or Connor and employed by Hospital Defendants, accessed the scheduling application within DesJardin's EMR on three separate occasions: October 20, October 25, and November 2, 2021. Compl. ¶ 65. John Doe 2 viewed DesJardin's appointments scheduled with Hospital Defendants. Compl. ¶ 65. John Doe 2 viewed DesJardin's EMR at the direction of Leslie or Connor, and he disclosed its contents to them. Compl. ¶¶ 66-67. John Doe 2 accessed DesJardin's PHI while working in the course of his employment for Hospital Defendants and by using credentials provided to him to access Hospital Defendants' electronic medical recordkeeping system. Compl. ¶ 68.
There were other instances during Fall 2021 when DesJardin's health care information and PHI was accessed and viewed, but it is not clear by whom. For example, on November 12, 2021, either Leslie or a John Doe acting at her direction accessed a record from one of Des Jardin's visits to the emergency department at a Hospital Defendant's facility, which included DesJardin's clinical diagnoses. Compl. ¶ 55. On another occasion, either Leslie or a John Doe acting at her direction accessed DesJardin's demographic information and "problems list." Compl. ¶ 56.
III. DesJardin discovers that her medical record was accessed without her consent.
Hospital Defendants did not notify Des Jardin about any of the occasions during Fall 2021 when Leslie or the John Doe Defendants accessed DesJardin's EMR. Compl. ¶ 71. On November 16, 2021, Des Jardin received an anonymous message notifying her that Connor had accessed her medical record. Compl. ¶ 72. As of November 2021, DesJardin received healthcare only from facilities operated by a Hospital Defendant. Compl. ¶ 73. At that time, DesJardin was aware that Leslie was employed by a Hospital Defendant. Compl. ¶ 74.
After she received the anonymous message, DesJardin contacted Connor about it. Compl. ¶ 75. Connor explained that his mother, Leslie, was accessing DesJardin's medical record. Compl. ¶ 75. DesJardin confirmed that neither Leslie nor Connor had DesJardin's consent or authorization to access her medical record. Compl. ¶ 76. On or about November 16, 2021, DesJardin contacted Hospital Defendants to address the situation. Compl. ¶ 78.
DesJardin informed Hospital Defendants that she received information about Leslie's access of her medical record as an unauthorized third party. Compl. ¶ 79. DesJardin added that Leslie was the mother of her ex-boyfriend, Connor. Compl. ¶ 80. However, DesJardin was not yet aware of the breaches earned out by John Doe 1 and John Doe 2. Compl. ¶ 82. Hospital Defendants responded that they would investigate DesJardin's allegations. Compl. ¶ 81.
IV. Hospital Defendants' initial investigation of and response to DesJardin's allegations.
Hospital Defendants commenced their investigation into DesJardin's allegations during November or December 2021. Compl. ¶ 88. Hospital Defendants discussed DesJardin's allegations with Leslie, who erroneously identified herself to Hospital Defendants as Des Jardin's "mother-in-law." Compl. ¶ 89. Meanwhile, during December 2021 while Hospital Defendants' investigation was ongoing, DesJardin learned that Connor was hired by a Hospital Defendant. Compl. ¶ 90. Connor's employment by a Hospital Defendant exacerbated DesJardin's concerns about unauthorized access of her medical record. Compl. ¶ 91.
On or about January 10, 2022, DesJardin received a letter from Hospital Defendants regarding their investigation into her allegations. Compl. ¶ 92; Compl. Ex. A. The letter came during Des Jardin's second trimester, when she was established with one of the Hospital Defendant's facilities where she planned to give birth to her child. Compl. ¶ 101. That letter provided, in relevant part:
The letter attached to the Complaint as Exhibit A is actually dated January 10, 2021, but as pointed out during oral argument, the date on the letter displays the wrong year. The correct date is January 10, 2022.
As we discussed when we spoke, we take patient privacy very seriously and we are following up with you on the incident we discussed regarding an employee accessing your electronic medical record.
On November 16, 2021, you alerted us to a suspected questionable access into your medical record by your former mother-in-law, who is also an employee at [Eastern Maine Medical Center], Upon investigation, it was determined that an employee accessed your record on October 12[th], October 19[th], November 1st, and November 12[th], without a work-related reason for doing so. The employee appears to have accessed an [Emergency Department] Visit encounter that occurred on November 12, 2021, which included clinical diagnoses. The employee also appears to have accessed your demographics, and your problems list.
We regret this unfortunate incident. We are committed to protecting your privacy and go to considerable lengths to do so. When such an incident does occur, we wish to assure you that we take all reasonable steps to investigate the incident, reduce the risk of harm to you, and protect against any further inappropriate disclosures. In this instance, we are continuing to monitor for questionable and inappropriate
access in the electronic medical record, are providing privacy education to all employees, and provided re-education to staff in this specific department on what is appropriate and inappropriate access in the electronic medical record.Compl. Ex. A. The "employee" referenced in the letter was Leslie. Compl. ¶ 95. The letter failed to identify the breaches committed by the John Doe Defendants. Compl. ¶ 98.
Neither Hospital Defendant took any action against Leslie or any of the John Doe Defendants as a result of the investigation. Compl. ¶ 99. DesJardin and Connor tried to work out their issues during January 2022, but they were unsuccessful and that was the last time they communicated with one another directly. Compl. ¶ 100.
V. Occurrence of additional breaches of Des Jardin's electronic medical record during Spring 2022.
Whatever steps Hospital Defendants took, if any, to protect DesJardin's private healthcare information were ineffective. On or about March 14, 2022, John Doe 1 again accessed Hospital Defendants' scheduling application to search for Des Jardin's appointments. Compl. ¶ 105. John Doe 2 did the same on April 4, 2022, leading up to the birth of DesJardin's child. Compl. ¶ 107.
DesJardin was eventually admitted on an inpatient basis to a Hospital Defendant's facility sometime near the end of April 2022, and she gave birth there weeks later during May. Compl. ¶ 108. Neither Connor nor Leslie were present for the birth. Compl.¶ 109. Des Jardin did not identify Connor as her child's father on the birth certificate. Compl. ¶ 110.
John Doe 1 and John Doe 2, at the direction of Connor or Leslie, accessed DesJardin's EMR on multiple occasions between March 14 and June 20, 2022, and shared DesJardin's health care information and PHI with Connor and Leslie. Compl. ¶¶ 113-114. Notably, on May 25, 2022, John Doe 1 accessed DesJardin's EMR and viewed notes related to her inpatient stay in anticipation of the childbirth. Compl. ¶ 111. On June 20, 2022, John Doe 1 again accessed DesJardin's EMR and viewed notes from an encounter DesJardin had with a women's health practitioner two weeks after giving birth. Compl. ¶ 112.
VI. DesJardin again discovers that her medical record was accessed without her consent.
On or about July 7, 2022, DesJardin received a second anonymous message informing her that Connor was accessing her medical record. Compl. ¶ 119. DesJardin confronted Hospital Defendants about the reported breaches. Compl. ¶ 121. Hospital Defendants investigated DesJardin's new allegations, and on August 17, 2022, supplied DesJardin with a letter:
On July 7, 2022, you contacted [Eastern Maine Medical Center's] Patient Experience Department with questions relating to the employment status of the employee who had previously accessed your medical record without a work-related reason for doing so, along with other employment related questions. We spoke on July 22, 2022, and we discussed that we could not share specific employment information but that we could run an audit to assure that the employees you were concerned about, Leslie and Connor Wirchak, were not accessing your record or your son's record. On July 28, 2022, we relayed that our audit did not find any inappropriate access by these employees but that we wanted to continue to investigate your concerns.
On August 12, 2022, we discussed that upon further investigation it was determined that two employees accessed your record without a work-related reason for doing so. These employees were associated with Leslie Wirchak. The first employee accessed the scheduling application in the electronic medical record on October 20, 2021, October 25, 2021, November 2, 2021, and April 4, 2022, and appears to have searched for appointments under your name. The employee may have viewed any scheduled appointments within Northern Light Health that you had at the time.
The second employee also accessed the scheduling application on October 15, 2021, October 20, 2021, November 15, 2021, and March 14, 2022, and appears to have searched for appointments under your name. This employee may have also been able to view any scheduled appointments within Northern Light Health that you had at the time. In addition, on November 2, 2021, the employee accessed your record and viewed an encounter you had at Northern Light Women's Health in Ellsworth. The employee viewed two documents or notes. On November 3, 2021, the employee entered your record and viewed four documents and/or notes but it is unclear which encounter the documents that were accessed were tied to. On May 25, 2022, the employee accessed your record and viewed records relating to an inpatient hospital admission from April 26, 2022 to May 19, 2022 at Northern Light Maine Coast Hospital, and on June 20, 2022, the employee accessed an encounter you had at Northern Light Women's Health on May 31, 2022. There has not been any further access into your son's record by any of these employees.
We sincerely regret this unfortunate incident. We are committed to protecting your
privacy and we want to assure you that we take this very seriously. As we discussed when we last spoke on August 12, 2022, we referred this matter to [Eastern Maine Medical Center's] Human Resources Department for review and action in accordance with our policies for all employees involved. In addition, we are running weekly audit reports of your and your son's medical record to continue to monitor all access. We are also developing a re-education plan for all of our practices on what is appropriate and inappropriate access in the electronic medical record. We have also made [your doctor] aware of the situation as we discussed.
Lastly, as one of the employees viewed your demographic information, out of an abundance of caution you may want to place a fraud alert on your credit report.Compl. Ex. B. Hospital Defendants would not disclose the identities of John Doe 1 or John Doe 2. Compl. ¶ 128.
The knowledge that DesJardin's medical record was being accessed by Connor and Leslie to extract information about her pregnancy and newborn child caused DesJardin to undergo extreme emotional upset and anxiety. Compl. ¶¶ 129, 131-132. Moreover, she was embarrassed and disgusted by the breaches carried out by the John Doe Defendants, who are complete strangers to her. Compl. ¶ 130.
After receiving Hospital Defendants' letter of August 17, 2022, Des Jardin sought accountability and information from Hospital Defendants regarding the multiple breaches of her privacy and unauthorized access of her medical record. Compl. ¶¶ 133, 135. Hospital Defendants refused to provide Des Jardin with the information she requested, for example about the identities of the John Doe Defendants. Compl. ¶ 135. Hospital Defendants' refusal to identify the perpetrators of the breaches deepened DesJardin's emotional distress and anxiety; she does not know the identities of the John Doe Defendants, whether they continue to view her health care information and PHI without authorization or consent, and whether they continue to disclose that information to Connor or Leslie. Compl. ¶ 137. DesJardin suffered and continues to suffer compensatory and pecuniary damages. Compl. ¶¶ 191, 203, 228.
VII. Connor Wirchak files a Complaint for Divorce against DesJardin.
During early 2023, DesJardin, through her attorneys, attempted to resolve issues involving the breaches of her medical record with Connor and Leslie directly. Compl. ¶ 143. Neither Connor nor Leslie would engage in discussion regarding the breaches. Compl. ¶ 145. Weeks later, on or about April 4, 2023, Connor had DesJardin served with a Family Matter Summons and Preliminary Injunction, which was filed in Maine District Court in Bangor. Compl. ¶ 146. The filing included a Complaint for Divorce, even though DesJardin had never married Connor, and a request for a determination of parental rights and responsibilities. Compl. ¶¶ 147, 150. Connor used information wrongly obtained from DesJardin's medical record against her. Compl. ¶ 153. In DesJardin's view, the summons and complaint constituted a threat and attempt to deter her from pursuing legal action against Connor and Leslie as well as a means to hurt and upset her. Compl. ¶¶ 152, 156. The intended result was achieved; DesJardin underwent emotional distress, anxiety, embarrassment, and other damages as a result of the Wirchaks' actions. Compl. ¶¶ 158-159. The same resulted from DesJardin's interactions with Hospital Defendants, and Hospital Defendants' actions or omissions in relation to maintenance of the privacy of Des Jardin's medical record. Compl. ¶ 160. DesJardin cannot yet know the extent to which she has also been harmed by the John Doe Defendants, since Hospital Defendants refuse to release the identity of the John Does.
MOTION TO DISMISS STANDARD
A motion to dismiss under Maine Rule of Civil Procedure 12(b)(6) "tests the legal sufficiency of the complaint and does not probe the merits of the underlying case." Carey v. Bd. cf Overseers af the Bar, 2018 ME 119, ¶ 19, 192 A.3d 589 (internal quotation marks omitted). In reviewing a motion to dismiss, courts must "consider the facts in the complaint as if they were admitted." Bonney v. Stephens Mem. Hosp., 2011 ME 46, ¶ 16, 17 A.3d 123 (citing Saunders v. Tisher, 2006 ME 94, ¶ 8, 902 A.2d 830). The complaint is viewed "in the light most favorable to the plaintiff to determine whether it sets forth elements of a cause of action or alleges facts that would entitle the plaintiff to relief pursuant to some legal theory." Id. (quotation marks omitted). Dismissal is warranted only "when it appears beyond a doubt that the plaintiff is not entitled to relief under any set of facts that he might prove in support of his claim." Id.
Generally, a court may consider only the pleadings on a motion to dismiss. Moody v. State Liquor &Lottery Comm 'n, 2004 ME 20, ¶¶ 8-9, 843 A.2d 43. However, official public documents, documents central to the plaintiffs complaint, and the documents referred to therein may also be considered in a ruling on a motion to dismiss without converting the motion into a motion for summary judgment when the documents' authenticity is not challenged. Id. ¶ 10. Here, DesJardin attached copies of the letters she received from the Hospital Defendants on January 10 and August 17, 2022. She also referred to a specific provision within Hospital Defendants' Privacy Policy. These materials are properly considered by the Court in deciding Hospital Defendants' Motion to Dismiss.
DISCUSSION
When a patient obtains hospital services and bares to her health care providers her most private and sensitive medical information, she does not expect her medical record to become an open book to be repeatedly read by unauthorized hospital employees-especially when they are a prying ex-boyfriend, his mother, and their allies. In this case, Hospital Defendants nevertheless try to frame the dispute as a typical one-time, impersonal cybersecurity incident, where the identity of the breaching party is unknown and unknowable; whether the breaching party used or viewed the individual consumer's data is unknown; and there are no actual injuries. See, e.g., In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 2010 ME 93,4 A.3d 492; Bathe v. Keybank N.A., No. BCD-CIV-2021-00043, 2021 WL 6125321 (Me. B.C.D. Nov. 23, 2021); Chabot v. Spectrum Healthcare Partners, PA., No. BCDWB-CV-2020-00018, 2021 WL 659565 (Me. B.C.D. Jan. 14, 2021). This case is readily distinguished from such cases by its alleged facts. Here, there are multiple breaches by employees of the facilities charged with protecting DesJardin's information. The Hospital Defendants know who the perpetrators are, and had an obligation to train, monitor, investigate, and remediate, especially after being twice told its employees were serially accessing a patient's medical records for improper purposes. There are multiple occasions when DesJardin's sensitive and private information was actually viewed without authorization by hospital employees with a personal connection to Des Jardin, and the information improperly obtained was actually used against her. There is nothing hypothetical, speculative, or conjectural about the breaches, disclosures, uses, and injuries. These alleged facts, viewed in the light most favorable to DesJardin, militate against dismissal of her tort claims, although her contract claim still falls short.
I. Invasion of Privacy (Count III).
In Maine, "it is an actionable tort to make an unauthorized intrusion upon a person's physical or mental solitude or seclusion." Nelson v. Me. Times, 373 A.2d 1221, 1223 (Me. 1977). In Nelson, the Law Court stated that a privacy claim of this type "should minimally allege a physical intrusion upon premises occupied privately by a plaintiff for purposes of seclusion." Id. (citation omitted). In reliance on Nelson, Hospital Defendants argue that DesJardin's invasion of privacy claim must be dismissed for failure to allege a "physical intrusion upon premises occupied privately by [her] for purposes of seclusion." See id. Nelson, however, involved a newspaper publishing a photograph obtained from a book that was being reviewed. Id. at 1222 n.l. Neither the original author nor the book publisher were being sued. Id. In other words, the newspaper's reproduction of the photograph was innocuous. The real problem with the plaintiff's claim was the failure to allege that the newspaper intruded upon the plaintiff's solitude or seclusion-physical or otherwise. See id. at 1223. The Complaint even lacked any averment that publication of the photograph was at all offensive to the plaintiff, id., which is not the case here.
Nelson, moreover, was decided in 1977, before the internet was invented and well before the advent of electronic medical recordkeeping. Since that time, consistent with the Restatement's comments, the Law Court has begun to deemphasize the physical requirements of the tort. In Lougee Conservancy, Inc. v. Citi Mortgage, the Law Court explained that "the physical occupancy necessary to maintain a claim for invasion of privacy can be established by virtue of private, personal possessions rather than physical presence because the owner maintains a personal privacy interest in the possessions even when not physically present." Lougee Conservancy, Inc. v. CitiMortgage, 2012 ME 103, ¶ 18, 48 A.3d 774 (citing Restatement (Second) of Torts § 652B cmt. b (Am. Law Inst. 1977)). Here, the alleged facts are somewhat analogous. The information contained in DesJardin's medical record is her "private, personal possession" in which she has "a personal privacy interest" that persists when she is not physically present. Just like a defendant who opens a private and personal piece of mail or who uses a key to physically open a locked filing cabinet, Hospital Defendants' employees used their log-in credentials to access DesJardin's EMR. See Restatement (Second) of Torts § 652B cmt. b ("investigation or examination into [a plaintiff's] private concerns, as by opening his private and personal mail ... [or] examining his private bank account" may constitute an invasion of privacy).
Trial courts in Maine are split on the need for a physical intrusion to support the claim. Compare 1 haver Coip. v. Reed, No. 2:10-cv-00423-JAW, 2011 WL 2682723, at *10 (D. Me. July 11, 2011) (denying motion to dismiss invasion of privacy claim based on the defendant's alleged misappropriation of the plaintiffs private emails), with Price v. DelPrete, No. cv-1458, 2014 WL 7920836, at *1-2 (Me. Super. Ct. Aug. 27, 2014) (granting motion to dismiss invasion of privacy claim because defendants did not physically enter plaintiffs home or office).
Hence, the nature of the intrusion at issue in this case is sufficient to withstand an early attempt at dismissal. This is not a case where it appears beyond a doubt that DesJardin is not entitled to relief under any set of facts that she might prove to support her invasion of privacy claim. As a result, Hospital Defendants' Motion to Dismiss DesJardin's Count III is denied.
II. Negligence (Count IV) and legally cognizable injuries.
Based largely on this Court's prior decisions dismissing cybersecurity cases, Hospital Defendants argue DesJardin's claim of negligence must be dismissed for failure to allege legally cognizable injury. Indeed, Hospital Defendants assert DesJardin's claims for invasion of privacy (Count III), negligent infliction of emotional distress (Count IV), and breach of contract (Count VII), are infected by the same fatal defect. Hospital Defendants assert that her claims of damages are too speculative to survive scrutiny, even at the motion to dismiss stage. Hospital Defendants' attack on DesJardin's damages claims are unavailing.
In an anonymous cybersecurity breach case, in which a plaintiff fears but has no evidence that her personal data was actually viewed and used, a claim for damages is necessarily speculative. See, e.g., Hannaford, 2010 ME 93, ¶¶ 6, 8, 4 A.3d 492; Bathe, 2021 WL 6125321, at *3; Chabot, 2021 WL 659565, at *4-5. Maine law does not recognize as legally cognizable damages that are speculative, see Snow v. Villacci, 2000 ME 127, ¶ 13, 754 A.2d 360, or based upon lost time and effort to prevent a speculative future harm, Hannaford, 2010 ME 93, ¶ 11, 4 A.3d 492. In the present case, however, DesJardin has alleged chapter and verse-actual dates and times-when malefactors employed by Hospital Defendants viewed and used her private health information against her. Based on the "quality of the evidence" alleged, see Snow, 2000 ME 127, ¶ 13, 754 A.2d 360, it cannot be said that there is no set of facts DesJardin might prove in support of her claim. DesJardin generally avers severe emotional distress, financial losses, economic harm,non-economic harm, actual damages, and compensatory damages. Compl. ¶¶ 191, 203, 204, 212, 228, 229. Under the facts of this case, that is sufficient for DesJardin to avoid being discharged by Hospital Defendants at this early stage of the litigation.
Among her various injuries, DesJardin claims as an injury her attorney's fees and expenses flowing from the pending divorce embroiling her in litigation with Connor. Contrary to Hospital Defendants' argument, the "tort of another" doctrine may but does not necessarily bar claiming these losses as damages for purposes of a motion to dismiss. See Charette v. Twombly, No. CIV.A. CV-99-289, 2000 WL 33675370, at *3 (Me. Super. Ct. Sept. 22, 2000) ("Where the wrongful act of a defendant has involved the plaintiff in litigation with others or has required him to incur expense to protect his interest, such costs and expenses including attorneys' fees are recoverable as damages") (citation omitted). This is a potential category of damages that can be explored in discovery.
Even DesJardin's claim of losses stemming from time and effort expended to protect her medical record and to prevent identity theft must be viewed in the context of this case. DesJardin's medical record was actually viewed and used by unauthorized, prying employees; the actions of Hospital Defendants did not prevent or stop the unauthorized behavior; and Hospital Defendants refuse to disclose the identities of the John Does who viewed DesJardin's data. Under the circumstances, time and effort may prove to be recoverable as a part of DesJardin's actual damages.
As a result, the Motion to Dismiss DesJardin's negligence claim contained in Count IV of the Complaint based on a failure to allege actual damages is denied. The Motion is also denied to the extent it seeks a dismissal of Counts III and V based on a failure to allege actual damages.
III. Negligent Infliction of Emotional Distress ("NIED") (Count V).
Hospital Defendants primarily argue DesJardin's NIED claim should be dismissed because Hospital Defendants were under no duty to avoid negligently causing her emotional distress. The elements of a claim for NIED are that (1) the defendant owed a duty to the plaintiff; (2) the defendant breached that duty; (3) the plaintiff was harmed; and (4) the defendant's breach caused the plaintiff's harm. Curtis v. Porter, 2001 ME 158, ¶ 18, 784A.2d 18. Regarding the first element, determination of duty in the context of a NIED claim "is not generated by traditional concepts of foreseeability ... there is no [] general duty to avoid negligently causing emotional harm to others." Id. The Law Court recognizes such a duty, however, when "a special relationship exists between the actor and the person emotionally harmed." Id. ¶ 19.
The Law Court also recognizes a duty to avoid negligently causing emotional harm to others in "bystander liability actions." Id. However, this case only involves a duty emerging from the parties' purported special relationship.
In Maine, included among the small handful of relationships that qualify as "special relationships" is that between parties involved in a fiduciary relationship in which there exists a "great disparity of position and influence" among them. Dragomir v. Spring Harbor Hosp., 2009 ME 51, ¶¶ 18-19, 970 A.2d 310. Determination of whether a fiduciary relationship amounts to a special relationship giving rise to a duty to avoid negligently causing another emotional harm must be made on a case-by-case basis. See id. ¶ 19 (discussing Restatement (Second) of Torts § 315(b) (Am. Law Inst. 1965)). Courts may find that parties are involved in a fiduciary relationship when there is proof of (1) the actual placement of trust and confidence in fact by one party in the other, and (2) a great disparity of position and influence between the parties. Oceanic Inn, Inc. v. Sloane's Cove, LLC, 2016 ME 34, ¶ 18, 133 A.3d 1021. "To establish the element of disparity of position and influence, the plaintiff must demonstrate diminished emotional or physical capacity or the letting down of all guards and bars." Id. (citation and internal marks omitted).
Here, to avoid dismissal of her NIED claim, DesJardin must plead facts sufficient to (1) demonstrate the existence of a fiduciary relationship with Hospital Defendants, and to (2) establish that relationship as a "special relationship" giving rise to a duty to avoid negligently causing emotional harm to others.
a. The Complaint alleges facts to demonstrate the existence of a fiduciary relationship between DesJardin and Hospital Defendants that qualifies as a special relationship.
Hospital Defendants argue the Complaint fails to plead facts underlying the alleged fiduciary relationship with sufficient particularity to survive the Motion to Dismiss. See Bryan R. v. Watchtower Bible and Tract Soc. of New York, Inc., 1999 ME 144, ¶¶ 20-21, 738 A.2d 839. To the contrary, the pleadings state facts that, when accepted as true, illustrate (1) DesJardin's actual placement of trust and confidence in Hospital Defendants to protect her EMR from unauthorized access, and (2) a significant disparity between DesJardin and Hospital Defendants in their ability to protect her EMR from unauthorized access such that she relied fully on Hospital Defendants to do so.
After DesJardin first reported unauthorized access of her medical record to Hospital Defendants, Hospital Defendants undertook an investigation to address the issue. Compl. ¶¶ 88-89, 92. Hospital Defendants sent Des Jardin the January 10, 2022, letter sharing the results of their investigation. Compl. ¶ 92. The letter stated, in part, that "[Hospital Defendants] wish to assure [Des Jardin] that we take all reasonable steps to investigate the incident, reduce the risk of harm to [her], and protect against any further inappropriate disclosures." Compl. Ex. A. The letter, sent to Des Jardin during the second trimester of her pregnancy when she was already established with her provider at the Hospital Defendant's facility, Compl. ¶ 101, goes on to describe steps Hospital Defendants were taking to protect against further disclosure. This sequence of events was repeated in the context of Hospital Defendants' letter to DesJardin of August 17, 2022. Compl. ¶¶ 119, 121; Compl. Ex. B.
Based on Hospital Defendants' representations and DesJardin's circumstances, DesJardin relied on Hospital Defendants to investigate the breaches and prevent their recurrence. Compl. ¶ 102. Des Jardin continued as a patient of Hospital Defendants and gave birth to her son at a facility operated by a Hospital Defendant. Compl. ¶ 108. She received post-partum care at another such facility. Compl. ¶ 44. These facts, as pled, are sufficient to demonstrate DesJardin's actual placement of trust and confidence in Hospital Defendants to protect her EMR, health care information and PHI from unauthorized access. Likewise, these facts demonstrate a disparity in position and influence between DesJardin and Hospital Defendants. Hospital Defendants were the trusted custodians of DesJardin's medical record and its contents. DesJardin relied on Hospital Defendants to identify unauthorized breaches of her record's security, and to prevent future breaches.
The same facts support qualification of DesJardin's fiduciary relationship with Hospital Defendants as a "special relationship." Hospital Defendants frame their relationship with DesJardin as a typical one between a company and a consumer concerning routine management and protection of confidential, personal information. It may be that in the quotidian course of business, a company does not enter into a fiduciary or special relationship with its customers in the routine management and protection of the customers' personal information. This is not that situation. Hospital Defendants were twice put on notice that egregious breaches of DesJardin's sensitive information were occurring, and twice assured DesJardin that they would investigate and take steps to protect her health care information. These facts distinguish this relationship, at least for motion to dismiss purposes, from the commonplace relationship Hospital Defendants depict between companies and consumers.
The Court acknowledges the narrow set of relationships to which the Law Court has ascribed "special relationship" status. However, at this stage the Court merely appraises the adequacy of DesJardin's Complaint. See Oceanic Inn, Inc., 2016 ME 34, ¶ 23, 133 A.3d 1021. The facts pled therein, taken as true, demonstrate that the parties' relationship is characterized by DesJardin's dependence on Hospital Defendants to protect her EMR from known and ongoing breaches, and Hospital Defendants' affirmative representations to her on more than one occasion that they would do so. This is not a case where it is beyond doubt there is no set of facts that DesJardin might be able to prove to support her claim. Hospital Defendants' Motion to Dismiss Des Jardin's NIED claim contained in Count V of the Complaint based is denied.
b. DesJardin alleges objectively severe emotional harm.
Hospital Defendants also assert DesJardin has alleged insufficient psychic injury.
Regarding the degree of the severity of DesJardin's emotional harm, the fact that her emotional harm was or is "[s]o intense that no reasonable person could be expected to endure it," Lyman v. Huber, 2010 ME 139, ¶ 21, 10 A.3d 707, is adequately pled within the Complaint. DesJardin alleges that she "experienced significant emotional distress, anxiety, embarrassment, and humiliation." Compl. ¶ 160. She suffered and continues to suffer "extreme mental anguish, emotional distress" and "embarrassment and humiliation." Compl. ¶¶ 191, 204, 228. Read in the context of the Complaint as a whole, DesJardin, a young-woman and resident of a mid-coast community, relied on Hospital Defendants to provide services vital for her health as a pregnant woman. Hospital Defendants allowed a hostile, prying, ex-boyfriend, his mother, and their allies for nine months or more to repeatedly read her most sensitive healthcare information. Affording DesJardin all inferences reasonably drawn from her allegations, under these circumstances a reasonable person could undergo emotional upset "so extreme and outrageous that proof of bodily harm is not needed" to substantiate the claimed distress resulting from known, repeated, and ongoing breaches of one's confidential health care information. See Lyman, 2010 ME 139, ¶ 21, 10 A.3d 707. Indeed, the facts as alleged are conceivably among a pregnant patient's worst nightmares. For these additional reasons Hospital Defendants' attempt to dismiss the NIED claim is denied.
IV. Breach of Contract (Count VII).
DesJardin alleges that when she began receiving health services through Hospital Defendants during October 2021 she provided Hospital Defendants with her health care information in exchange for those services, thereby entering into an implied contract with Hospital Defendants wherein they agreed to protect DesJardin's confidential information. Compl. ¶¶ 218-229. Hospital Defendants argue, in part, that DesJardin's breach of contract claim must be dismissed because the Complaint does not recite allegations sufficient to show valid consideration. The Court agrees, and consequently Plaintiff's breach of contract claim is dismissed.
Hospital Defendants made additional arguments in support of dismissal of Plaintiffs breach of contract claim. Because the Court dismisses Plaintiff s breach of contract claim for failure to plead adequate consideration, the Court does not address these arguments.
For a party's performance to constitute valid consideration, there must first be a bargained-for promise in exchange for which the consideration is given. Panasonic Commc 'ns &Sys. Co. v. Dep't cf Admin., 1997 ME 43, ¶ 12, 691 A.2d 190. One party's agreement to perform a pre-existing contractual obligation is not valid consideration for a new promise by the other party. Id. ¶ 11 (citation omitted). Likewise, a unilateral promise by one party cannot constitute consideration if it was not bargained-for or otherwise motivated by the other party's request. Whitten v. Greeley Shaw, 520 A.2d 1307, 1310 (Me. 1987).
According to Des Jardin, a provision contained in Hospital Defendant's Privacy Policy induced her to provide her confidential health care information to Hospital Defendants. Compl. ¶ 220. That provision describes Hospital Defendants' duties regarding its patients' health information, and what the law requires them to do to keep that information private and secure. Compl. ¶ 220. In other words, it describes a pre-existing legal obligation imposed upon Hospital Defendants. See Panasonic Commc'ns &Sys. Co., 1997 ME 43, ¶ 12, 691 A.2d 190. Because the only thing promised to DesJardin was what the law requires, the provision at issue cannot be construed as valid consideration for her purported implied contract. Consequently, the Motion to Dismiss DesJardin's breach of contract claim contained in Count VII of the Complaint based on a failure to plead consideration is granted.
CONCLUSION
For the foregoing reasons, with respect to Plaintiff Saylor DesJardin's claims for invasion of privacy (Count III), negligence (Count IV), and negligent infliction of emotional distress (Count V), Defendants' Eastern Maine Healthcare Systems, doing business as Northern Light Health, and Eastern Maine Medical Center, doing business as Northern Light Eastern Maine Medical Center, Motion to Dismiss is DENIED. The Motion to Dismiss is GRANTED concerning Plaintiff's breach of contract claim (Count VII).
So ordered.
The Clerk is instructed to enter this Order on the docket for this case by incorporating it by reference. M.R. Civ. P. 79(a).