Opinion
CASE NO. 14-02379-5-SWH CASE NO. 15-05318-5-SWH CASE NO. 15-01265-5-SWH
08-31-2016
IN RE: WAYNE EDWARD BRANCH CARLA LYNETTE BOSTICK JANIS MONROE CLARK DEBTORS
CHAPTER 7
CHAPTER 13
CHAPTER 13
ORDER REGARDING MOTIONS FOR SANCTIONS
The matters before the court are the motions for contempt and sanctions filed by the debtors against WakeMed or WakeMed Physician Practices (collectively "WakeMed"), specifically, Branch, Case No. 14-02379-5-SWH Dkt.146 (WakeMed) filed on January 7, 2016, Bostick, Case No. 15-5318-5-SWH Dkt. 12 (WakeMed Physician Practices) filed on November 17, 2015, and Clark, Case No. 15-01265-5-SWH Dkt. 23 (WakeMed) filed on November 24, 2015. Hearings were conducted on the motions in Raleigh, North Carolina on February 4, February 11, February 25, and March 10, 2016. Affidavits of Attorneys' Fees were submitted in each of the cases after the March 10, 2016 hearing date. At issue is whether WakeMed should be sanctioned for including in its proofs of claim personal information of the debtors that should have been redacted pursuant to Federal Rule of Bankruptcy Procedure 9037. The parties attempted to resolve the motion after the conclusion of the hearing, but advised the court on or about June 3, 2016, that an impasse had been reached. Accordingly, this matter is ripe for decision.
BACKGROUND
Wayne Edward Branch filed a voluntary petition for relief under chapter 7 of the Bankruptcy Code on April 25, 2014. WakeMed filed a proof of claim in the case in the amount of $4,910.00 on August 10, 2015. Branch Claim No. 3-1. The proof of claim included an attachment that listed Mr. Branch's medical record number and patient numbers. On December 23, 2015, Mr. Branch, through counsel, filed an Ex-Parte Motion to Seal Proof of Claim No. 3, Branch Dkt. 143. On December 29, 2015, an order granting the motion to seal was allowed, Branch Dkt. 144. On January 7, 2016, the instant motion for contempt and sanctions was filed on behalf of Mr. Branch. Branch Dkt. 146.
Some of the documents list these numbers as "patient numbers," others as "account ID" numbers. The testimony established that a different number is associated with each "encounter" or billing event, so each patient can have multiple patient numbers or account numbers. These numbers are distinct from the "medical record number."
Carla Lynette Bostick filed a voluntary petition for relief under chapter 13 of the Bankruptcy Code on October 1, 2015. WakeMed filed a proof of claim in the case on October 2, 2015 in the amount of $2,171.48. Bostick Claim No. 1-1. The proof of claim included an attachment that listed Ms. Bostick's social security number (listed as "Guarantor No.") and patient account numbers. WakeMed Physician Practices also filed a proof of claim in the case on October 2, 2015 in the amount of $246.00. Bostick Claim No. 2-1. That claim included an attachment listing Ms. Bostick's date of birth and an "account ID" for each billed entry. On November 2, 2015, Ms. Bostick, through counsel, filed an Ex-Parte Motion to Seal Proof of Claim No. 2, Bostick Dkt. 9, which was allowed by order dated November 3, 2016, Bostick Dkt. 10. That order provided that access would not be restricted until a redacted claim was filed, id., which was consistent with the court's procedure at the time. On November 17, 2015, the instant motion for contempt and sanctions was filed on behalf of Ms. Bostick. Bostick Dkt. 12. WakeMed Physician Practices amended its claim on February 3, 2016, reducing the claim amount to $0.00 and omitting any attachments. Bostick Claim No. 2-2. WakeMed also amended its claim on February 3, 2016, including an attachment listing only the last four digits of the patient account numbers and entirely omitting her date of birth and social security number. Bostick Claim No. 1-2.
Ms. Bostick did not file a motion to seal Claim No. 1; however, that claim is protected from public view as a result of WakeMed's motion to establish a procedure to restrict public access to certain claims filed on December 4, 2015 and subsequent motions to restrict access, as discussed in more detail herein.
Janis Monroe Clark filed a voluntary petition for relief under chapter 13 of the Bankruptcy Code on March 6, 2015. WakeMed filed a proof of claim in the case on March 10, 2015 in the amount of $553.00. Clark Claim No. 1-1. The proof of claim included an attachment that disclosed Ms. Clark's date of birth, full social security number, patient number, and medical record number. On November 11, 2015, Ms. Clark through counsel filed an Ex-Parte Motion to Seal Proof of Claim No. 1, Clark Dkt. 20, which was allowed by order dated November 12, 2015, Clark Dkt. 21. On November 24, 2016, the instant motion for contempt and sanctions was filed on behalf of Ms. Clark. Clark Dkt. 23. WakeMed amended its claim on December 7, 2015, omitting the attachment. Clark Claim No. 1-2.
Including Ms. Clark's case, counsel for Ms. Clark indicates that from November 11, 2015 through November 17, 2015, his firm filed 158 motions to restrict access or motions to seal claims filed by WakeMed in cases filed in this district. On December 4, 2015, after receiving a copy of one of the motions for sanctions, a local television station, WRAL, published a news story discussing WakeMed's disclosure of personal information in bankruptcy filings. On the same day, a miscellaneous proceeding was commenced in which WakeMed filed an Ex Parte Global Motion to Establish a Procedure to Restrict Public Access to Certain Claims Pursuant to 11 U.S.C. § 107(c) and Federal Rule of Bankruptcy Procedure 9037. See Misc. Pro. No. 15-00004-5-SWH (the "Miscellaneous Proceeding"), Dkt. 1. After a hearing on December 7, 2015, an Order Establishing Procedure to Restrict Public Access was entered on December 11, 2015. Misc. Pro. Dkt. 5. Thereafter, a series of motions to seal and orders allowing those motions were filed, effectively restricting from public view all claims filed by WakeMed on or after December 1, 2007 (the effective date of Federal Rule of Bankruptcy Procedure 9037), and some earlier-filed claims. See generally Misc. Pro. Dkts. 6, 7, 8, 9, 12, 13, 14, 16, 20, 22, 24, 25, 27, 28.
Because many of the documents filed in the Miscellaneous Proceeding contained the names and case numbers of debtors whose personal information may have been disclosed, and because the claims could not as a practical matter be immediately restricted from public access upon the filing of those documents, the court restricted the entire Miscellaneous Proceeding from public view to protect those debtors' information during that delay.
On January 15, 2016, WakeMed filed a status report, Misc. Pro. Dkt. 19, indicating that it had moved to restrict access to 2,819 claims in closed cases, 788 claims filed before September 1, 2013 in open cases, and 602 claims filed after September 1, 2013 in open cases. In closed cases and for claims filed before September 1, 2013 in open cases, WakeMed sought to restrict access without regard to whether personal identifiers or protected health information was actually contained in the claims. Because any distributions had already occurred in the closed cases and because WakeMed did not believe there were any attachments in the claims filed before September 1, 2013 in open cases, WakeMed did not intend to re-file its claims in those cases. With respect to claims filed after September 1, 2013 in open cases, WakeMed sought to restrict access only if the claim actually contained information that might be protected under Rule 9037 or the Healthcare Insurance Portability and Accountability Act ("HIPAA"). WakeMed did intend to file redacted claims in those cases. According to the status report, debtors whose protected health information may have been disclosed were sent notices required by HIPAA, offering one year of third-party credit monitoring at no charge. The status report also reflected that WakeMed had taken similar steps with respect to claims filed in the United States Bankruptcy Courts for the Middle and Western Districts of North Carolina. In addition, the status report outlined steps taken by WakeMed to prevent further filings containing protected information, as well as notices and reports made or to be made to regulators on this issue. WakeMed's status report indicated that as of January 15, 2016, it had incurred filing fees of $107,550 for the motions to restrict public access, and $214,123.20 in fees and costs for its bankruptcy counsel. Additional motions to restrict access were filed after the date of the status report. Misc. Pro. Dkts. 22, 27.
The debtors in these cases, Mr. Branch, Ms. Bostick, and Ms. Clark, seek sanctions including actual damages, punitive damages, and attorneys' fees for WakeMed's failure to properly redact their personal information before filing the attachments to WakeMed's proofs of claim. The debtors contend that because the public has access to this information through the court's Public Access to Court Electronic Records ("PACER"), they are at risk of having their personal and medical information stolen.
APPLICABLE LAW AND PROCEDURE
The debtors did not specify in their motions under what statute or rule they seek relief. However, the contentions in the motions suggest that the debtors seek sanctions for violations of Federal Rule of Bankruptcy Procedure 9037, HIPAA, and, possibly, 11 U.S.C. § 107. The history of the relevant law and court procedures, of which the court may take judicial notice, may be helpful to provide some context.
While there were references at the hearing to other potential state law claims, none of those is before the court.
The E-Government Act of 2002, Pub. L. 107-347, 116 Stat. 2899, required courts to develop provisions for the public to have electronic access to court records, as well as to protect confidential and personal information. As a result, the Judicial Conference revised its policies in 2003 to require personal identifiers to be redacted from filings. Those policies went into effect on December 1, 2003. Prior to this time, full social security numbers were included on the petition, schedules and statements, and, often, on motions and orders entered in bankruptcy cases. The full names of dependents were listed in the schedules. The official forms were amended to comply with the Judicial Conference's policy as of December 1, 2003 (by, for example, asking for the last four digits of the debtor's social security number, rather than the full social security number, on the petition), but the Rule requiring filers to redact personal information was not effective until four years later.
The court's electronic records are available through PACER, a password protected system. In general, a user must register with PACER and log in to obtain access to the records. Additional access is available to the public through terminals at the court's clerk's office, where one can search court records without a PACER account during the court's business hours. The records are not, however, generally available to the public through, for example, an internet browser search.
Section 107(c) of the Bankruptcy Code was added effective October 17, 2005, and provides, in relevant part:
(c)(1) The bankruptcy court, for cause, may protect an individual, with respect to the following types of information to the extent the court finds that disclosure of such information would create undue risk of identity theft or other unlawful injury to the individual or the individual's property:
(A) Any means of identification (as defined in section 1028(d) of title 18) contained in a paper filed, or to be filed, in a case under this title.11 U.S.C. § 107(c) (2005). Accordingly, as of October 2005, a party could ask the court to restrict access to any document that contained personal identifiers.
(B) Other information contained in a paper described in subparagraph (A).
Federal Rule of Bankruptcy Procedure 9037, effective December 1, 2007, requires parties to redact certain information in filings with the court. It provides, in relevant part:
(a) Redacted Filings. Unless the court orders otherwise, in an electronic or paper filing made with the court that contains an individual's social-security number, taxpayer-identification number, or birth date, the name of an individual, other than the debtor, known to be and identified as a minor, or a financial-account number, a party or nonparty making the filing may include only:
(1) the last four digits of the social-security number and taxpayer-identification number;
(2) the year of the individual's birth;
(3) the minor's initials; and
(4) the last four digits of the financial-account number.
***
(d) Protective Orders. For cause, the court may by order in a case under the Code:
Fed. R. Bankr. P. 9037 (2007).(1) require redaction of additional information; or
(2) limit or prohibit a nonparty's remote electronic access to a document filed with the court.
On September 14, 2010, the Judicial Conference amended the policy on privacy and public access to electronic case files by restricting public access through PACER to all documents in bankruptcy cases that were filed before December 1, 2003, and had been closed for more than one year, with the following conditions:
• The docket sheet and docket information will remain available to the general public via PACER.
• Any party that has filed a notice of appearance in an individual case will have CM/ECF access to all filings in that case
• All documents in such cases will remain accessible at the clerks' offices, except those under seal.This restriction was accomplished through a nationwide upgrade to the federal courts' electronic filing program, CM/ECF. Accordingly, all documents (regardless of when filed) in cases filed in this court before December 1, 2003 that were closed on or before September 14, 2009 have been restricted from public view since 2010, but are accessible to any party who filed a notice of appearance in the case or to anyone who physically goes to the clerk's office to review the file.
• Access to documents in bankruptcy case appeals filed in the district courts, bankruptcy appellate panels or courts of appeals for bankruptcy cases filed in the bankruptcy court prior to December 1, 2003, will be similarly restricted.
In other words, even those cases where the full social security number appears on the petition itself remain accessible to anyone who goes to the clerk's office.
Meanwhile, this court's procedures for filing claims changed as well. Prior to February 2007, proofs of claim were submitted in paper form. Claims in chapter 7 and 11 cases were filed with the court, and, in cases filed as early as January 1, 1997, were scanned and docketed by the clerk into the electronic court file. Claims in chapter 12 and 13 cases were sent to the chapter 12 and 13 trustees, respectively, until February 3, 2007, when those claims were required to be filed with the court. As of February 3, 2007, electronic filing of claims became available, but was mandatory only for "registered Filing Users" (typically counsel). On December 1, 2008, electronic claims filing became mandatory for all creditors directly filing more than 10 claims in a 12-month period. E.D.N.C. LBR 3001-1. Paper claims continue to be scanned and docketed by the clerk.
Local Rule 5005-1, which directed the filing of chapter 12 and 13 claims with the trustee, was abrogated effective February 3, 2007, by order dated December 15, 2006. Claims filed with the trustees do not appear on the electronic docket unless also filed with the court.
In addition, until the motions to restrict access were filed in this case in November 2015, the court's procedure for restricting public access was to provide the offending party with 30 days to redact the information before the court would actually restrict access. Prior to filing their 158 motions to restrict access, Ms. Clark's counsel contacted the court and suggested that the procedure was a poor one, as there would be notice on the record that this information was available for 30 days, giving anyone of questionable moral character an opportunity to mine the information from the court's website during that period. As a result of Ms. Clark's counsel's prompting, the court adjusted its procedure to restrict access upon receipt of the motion, while also entering an order directing the filer to redact the offending document.
FACTS ESTABLISHED AT HEARING
The claims filed in these three cases, and most - if not all - of the claims addressed in the remaining 157 motions to restrict access, were filed on behalf of WakeMed by Valeria Soles. Ms. Soles was employed by WakeMed in its patient financial services and collection department for over 33 years, having retired on December 18, 2015. Over the years, Ms. Soles was one of several people who filed bankruptcy claims, but it became solely her responsibility in September 2012. Ms. Soles was familiar with both electronic filing and filing of claims in paper form with the trustees, as opposed to the court.
The proof of claim form, Official Form 10, as effective December 1, 2008, includes instructions on page 2 that provide, in relevant part:
7. Documents:See, e.g., Ex. 8 at 2 (emphasis added). Below the instructions are definitions, including the following:
Attach to this proof of claim form redacted copies documenting the existence of the debt and any lien securing the debt. You may also attach a summary. . . .
Redacted
A document has been redacted when the person filing it has masked, edited out, or otherwise deleted, certain information. A creditor should redact and use only the last four digits of any social-security, individual's tax identification, or financial-
account number, all but the initials of a minor's name and only the year of any person's date of birth.Id.
The court's electronic filing system (CM/ECF) requires a series of steps to submit a claim. One of those steps is to check a box that indicates that a filer has read the redaction rules and has redacted the documents to be filed. Specifically, when one logs in to file in CM/ECF, the screen includes the following:
IMPORTANT NOTICE OF REDACTION RESPONSIBILITY: All filers must redact: Social Security or taxpayer-identification numbers; dates of birth; names of minor children; and financial account numbers, in compliance with Fed. R. Bankr. P. 9037. This requirement applies to all documents, including attachments.See, e.g., Ex. 8 at 3. A user may not move to the next step without checking the box.
[ ] I understand that, if I file, I must comply with the redaction rules. I have read this notice.
Ms. Soles testified that she received limited to no training with respect to filing bankruptcy claims. One of her colleagues showed her how to file electronically, telling her to "check the box" and then how to enter the claim information. When Ms. Soles first began filing electronic claims, she did not include attachments to the claims. Accordingly, at that time, there was nothing to redact. However, around September 2013, Ms. Soles began receiving objections to WakeMed's claims for lack of supporting documentation. She sought assistance from within WakeMed for how to save and upload documents from the billing system, and began attaching documents to the proofs of claim that showed the account information. Although many of these documents included personal information such as social security numbers and dates of birth, Ms. Soles did not read the redaction rules or make any effort to learn what was to be redacted, nor did she redact the attachments prior to filing. Ms. Soles further testified that while she had annual training regarding the requirements of HIPAA, she had no training with respect to filing bankruptcy proofs of claim. The HIPAA training did not cover bankruptcy claims filing. Ms. Soles also had no supervision with respect to filing claims, and testified that no one else in her department knew how to file bankruptcy claims. There was no audit system in place, and Ms. Soles had no direct contact with the legal department of WakeMed. Ms. Soles also testified that while she kept some copies of the claims she filed, she did not keep all of them nor did she appear to have any guidelines for when she did or did not keep copies.
WakeMed's failure to maintain copies of the filed proofs of claim inhibited the review process and delayed the correction of the unredacted claims, as WakeMed and its counsel had to review every claim that appeared on the electronic record to determine whether restriction and redaction were necessary.
With respect to HIPAA requirements, Ms. Soles testified that she understood that there was an exception to its disclosure requirements related to payment collection. Specifically, she understood that she could disclose social security numbers and other information to "authorized persons." It was her belief that the trustee, the debtor's attorney, and the court would be "authorized persons," and that filing a proof of claim was a collection activity that fell within the HIPAA exception. Ms. Soles was not aware that electronically filed claims were more broadly available than those she had filed with the trustee in the past. Ms. Soles did not know what PACER is, and did not have PACER access. She accessed information regarding bankruptcy filings through the court's telephonic information system (VCIS) if she had questions about a bankruptcy notice she received.
All mail from the bankruptcy court or regarding bankruptcy claims went to Ms. Soles. Ms. Soles also received the electronic filing notices from the bankruptcy court. When the first of the 160 motions to restrict access came to her attention, she turned them over to her supervisor, Liz Watson, who instructed her not to include attachments with claims filed with the bankruptcy court until she received further instructions from the legal department. Thereafter, Ms. Soles prepared some redacted attachments, but did not file them. She did not receive any further instructions before her retirement in December 2015.
Meanwhile, WakeMed hired Susan James, its new Vice President/Chief Legal Officer, on October 19, 2015, just a few weeks before the first motion to restrict access was filed. Ms. James testified that she had no bankruptcy experience or training, and had not appeared in federal court for at least 19 years (prior to electronic filing). Ms. James testified that she first became aware that unredacted claims were filed when she received a copy of one of the motions for sanctions on December 1, 2015. One of the motions to restrict access was brought to her attention the next day, December 2, 2015. Ms. James could not explain why the motions were not brought to her attention sooner, speculating only that because she was new, people in the mailroom did not know who she was. Regardless, she insisted that as soon as she was aware of the situation, she began to take action.
During a vigorous cross-examination, Ms. James conceded that because she is an officer, WakeMed had notice of the motions when she had notice, on December 1, 2015. She could not say whether WakeMed as an institution had notice any earlier, as WakeMed's focus to that point had been on identifying the claims that needed to be restricted. At that point, there had been no real effort to determine who had knowledge of the motions prior to December 1, 2015, or why it had taken a matter of weeks for the first motion to reach her desk.
Ms. James testified that she was not familiar with the rules requiring redaction of personal information in proofs of claim until she received the motion for sanctions. When she first received the motion on December 1, 2015, only every other page was provided. She began piecing together the allegations, and because an article about Duke University Healthcare's filing unredacted claims was attached to the motion, she reached out to a colleague at Duke to ask for a recommendation for counsel. Ms. James retained bankruptcy counsel on December 2, 2015 to review the motions and begin taking remedial action. Ms. James testified that she became aware that WRAL was preparing a story on the issue on December 3, 2015. On December 4, 2015, WakeMed filed its motion to establish a procedure to restrict access to all of the claims. At the same time, WakeMed retained HIPAA counsel to investigate whether the unredacted claims violated HIPAA and what actions needed to be taken with respect to any HIPAA disclosures.
Ms. James testified that the motion for sanctions caused her to open an investigation. She further testified that the sanctions motion was the first notice she received of the issue, and that she would also have opened an investigation had she received a call to the compliance line or to herself, or had she seen one of the motions to restrict access before she saw the motion for sanctions.
Ms. James testified that WakeMed discontinued filing proofs of claim during the investigation. She further explained her four-step approach to an investigation of any compliance issue, including the approach taken here:
(1) Determine whether there is a violation.
(2) Define the scope.
(3) Correct the problem going forward.
(4) Look backwards. Ms. James testified that as of the hearing dates, WakeMed had been focused on determining the scope of the problem, restricting access to filed claims, redacting and filing amended claims, and creating new procedures for going forward. It had not yet started looking backwards to determine either the failures that contributed to the improper filings in the first place or the communications lapses that created the delay between the filing of the motions to restrict access and the issue being brought to the attention of Ms. James (or other corrective action being taken).
In the course of the investigation, Ms. James had spoken or emailed with Liz Watson and Dudley Harrington, both of whom work in the billing department, but she did not speak to Ms. Soles until January 2016. Ms. James testified that she relied upon WakeMed's counsel to determine the scope of the unredacted filings and to take the actions required with the bankruptcy court, and that she "authorized counsel to take all steps as quickly as humanly possible to comply" with the rules. She further testified that the scope of the investigation was limited to December 1, 2007 forward because that was the effective date of the rule requiring redaction, and that the September 1, 2013 date was used for some cases because that is the date Ms. Soles began including attachments to filed proofs of claim.
On December 31, 2015, WakeMed sent letters to 413 debtors whose social security number may have been disclosed, describing what happened, actions taken by WakeMed after discovery of the disclosure, a phone number for questions and how to obtain credit monitoring at no cost to the debtors. See, e.g., Ex. 6. Ms. James testified that these letters were required by HIPAA. Certain errors in the letter were illuminated on cross examination: for example, the letter indicated that only those registered to use PACER could access the information, but a person who goes to the clerk's office can access the information by logging onto the court's computer terminal. In addition, the letter indicated that a person would have to search a specific debtor's name, but a person could search "WakeMed" and find all of the claims filed by WakeMed. Ms. James testified that she was unaware of this potential access, but that she did not believe it was necessary to send a new letter.
As noted above, by January 15, 2016, WakeMed had moved in this district to restrict access to 2,819 claims in closed cases, 788 claims filed before September 1, 2013 in open cases, and 602 claims filed after September 1, 2013 in open cases, and had incurred filing fees of $107,550 for the motions to restrict public access and $214,123.20 in fees and costs for its bankruptcy counsel. At the same time, WakeMed took actions in the Middle and Western Districts to resolve issues with unredacted claims filed in those districts. In addition, Ms. James testified that WakeMed had taken other measures to prevent further violations in the future, as well as to resolve the issues with timely delivery of legal documents to her office, including:
• Instructing the mail room to notify her office when certified mail with a return address from an attorney is received;Ms. James also testified that she has talked to many other professionals in her industry, none of whom were familiar with Rule 9037. She commented that training on the bankruptcy requirements should be implemented throughout the healthcare industry.
• Hiring outside counsel to train employees on the requirements for filing proofs of claim;
• Hiring outside counsel to create a training and reference manual for the employees filing claims;
• Requesting outside counsel to provide annual updates regarding the law and any need to update the manual; and
• Requesting outside counsel to do a quality check of all WakeMed claims to ensure that all claims disclosing personal information had been restricted and/or redacted.
Upon questioning from the court, Ms. James agreed that there may be additional mailroom procedures that need to be implemented, including instruction for processing mail received from the court.
Ms. Clark's counsel, Travis Sasser, testified that he had reviewed the court's docket at the break during the hearing on February 25, 2016, and that several claims filed by WakeMed remained unrestricted on the docket containing unredacted social security numbers, dates of birth, and names of minors. See Ex. 11. WakeMed's counsel made a proffer, which was supported by Ms. James' testimony, that counsel had been instructed to continue with a quality check to make sure that every claim had been properly restricted and redacted, and that the check was ongoing.
All of the unredacted claims listed in Exhibit 11 were included, among others, in WakeMed's motion to restrict access filed in the Miscellaneous Proceeding on March 3, 2016, Misc. Pro. Dkt. 22, and were restricted pursuant to that motion.
In addition to the testimony of Ms. Soles, Ms. James, and Mr. Sasser, the court heard from one of the debtors in these cases. Ms. Clark testified that she was "very sensitive" about social security numbers and other private information being publicly available, and as a human resources professional she was "outraged" that WakeMed would file a document including her social security number. Ms. Clark's full social security number and date of birth were included in the claim filed by WakeMed, and although she did not actually know if a third party had obtained the information from the court's website, she "needed some protection." Ms. Clark testified that her debit card had been canceled more than one time because her accounts had been compromised, but she could not directly link the compromise of her accounts to the disclosures in the proof of claim. Ms. Clark was not interested in the credit monitoring offered by WakeMed in its December 31, 2015 letter, but instead wanted WakeMed to pay for her to obtain protection from LifeLock Identity Theft Protection at a cost of $300-400 per year for the rest of her life or until WakeMed could prove that her information was "really not on the internet anymore." Ms. Clark further testified that she had taken vacation days to appear in court, that she had incurred parking fees of $12 per day and attorney's fees to pursue the motion to restrict access and motion for sanctions, and that she suffered anxiety from the loss of privacy that had occurred from WakeMed's violation and the litigation surrounding the issue. Ms. Clark submitted a post-hearing declaration more specifically itemizing her requested damages, as discussed below.
DISCUSSION
As noted above, the debtors did not specify in their motions under what statute or rule they seek relief. However, the contentions in the motions suggest that the debtors seek sanctions for violations of Federal Rule of Bankruptcy Procedure 9037, HIPAA, and, possibly, 11 U.S.C. § 107. This court is not a HIPAA compliance tribunal, and the court questions whether it has jurisdiction to opine on or determine sanctions for violations of HIPAA. Accordingly, the court will limit its inquiry to whether the Bankruptcy Code or Rules have been violated and, if so, what remedy is available for those violations under the bankruptcy laws.
The case law overwhelmingly holds that there is no private right of action under HIPAA or § 107, and that the remedy under Rule 9037 is for the offending information to be restricted from public view. See Maple v. Colonial Orthopaedics, Inc. (In re Maple), 434 B.R. 363 (Bankr. E.D. Va. 2010); French v. Am. Gen. Fin. Servs. (In re French), 401 B.R. 295, 307 (Bankr. E.D. Tenn. 2009); Barnhart v. Union Bank, Inc. (In re Barnhart), No. 09-ap-00109, 2010 WL 724703, at *3-4 (Bankr. N.D. W. Va. Feb. 26, 2010); Carter v. Flagler Hospital, Inc. (In re Carter), 411 B.R. 730 (Bankr. M.D. Fla. 2009); Matthys v. Green Tree Servicing, LLC (In re Matthys), Adv. Pro. No. 09-16585-AJM-13, 2010 WL 2176086 (Bankr. S.D. Ind. May 26, 2010); Lenz v. Auto Acceptance (in re Lenz), 448 B.R. 832 (Bankr. D. Ore. 2011); Newton v. ACC of Enter. (In re Newton), A.P. No. 08-1106-DHW, 2009 WL 277437 (Bankr. M.D. Ala. Jan. 29, 2009).
However, many courts have held that § 105(a) gives the bankruptcy court the authority to sanction parties for contempt for violations of Rule 9037 under appropriate circumstances - specifically, "where it was shown that a creditor flaunted the law with knowledge of its proscriptions, failed to take remedial action once violations were discovered, or acted deliberately as opposed to mistakenly or inadvertently." Carter, 411 B.R. at 738 (quoting Newton, 2009 WL 277437, at *5); see also Ricker v. Athens Reg'l Med. Ctr. (In re Ricker), Adv. Pro. No. 12-1032, 2012 WL 2562760 (Bankr. E.D. Tenn. June 29, 2012); Maple, 434 B.R. at 374-75; Barnhart, 2010 WL 724703, at *3-4.
Rule 9037 requires redaction of "an individual's social-security number, taxpayer-identification number, or birth date, the name of an individual, other than the debtor, known to be and identified as a minor, [and] a financial-account number," specifying what portions of those identifiers may be included in a filing. Fed. R. Bankr. P. 9037(a). The remedy set forth in the Rule for a failure to comply is that the court may by order "limit or prohibit a nonparty's remote electronic access to a document filed with the court." Fed. R. Bankr. P. 9037(d). Even absent a remedy in Rule 9037, however, the court has inherent authority to sanction a party for contempt, and equitable powers to enforce a specific provision of the Bankruptcy Code under § 105(a). See In re Lunden, 524 B.R. 410, 417 (Bankr. D. Mass. 2010).
What Violates Rule 9037?
WakeMed submitted claims that included full social security numbers and dates of birth, which clearly is prohibited by Rule 9037. Those violations occurred in both Ms. Clark's case and Ms. Bostick's case, as well as in thousands of other cases. The evidence presented at the hearing, taken together with the motions to restrict access filed both by Ms. Clark's counsel and WakeMed itself in the Miscellaneous Proceeding, showed that WakeMed also filed claims after December 1, 2007 that included the full name of a minor (who should have been known by WakeMed to be a minor due to WakeMed's access to birthdates), which claims also violate Rule 9037 but were not filed in any of the three cases in which the motions for sanctions were filed.
Some of the debtors complained that WakeMed included their address on its claims. Rule 9037 does not prohibit the inclusion of the debtor's address; indeed, the debtor's address appears on the first page of the bankruptcy petition and is readily available to the public through numerous sources. Similarly, the inclusion of a telephone number does not violate Rule 9037.
A murkier questions is whether the "account IDs" or "patient numbers" included on the claims fail to comply with Rule 9037, which requires redaction of all but the last four digits of "a financial-account number." Rule 9037 does not define the term "financial-account number." The only case of which the court is aware that discusses what might be encompassed by this term is In re Brown, Case No. 11-30384, 2012 WL 2576473, at *4 (Bankr. W.D.N.C. July 3, 2012). There, the court considered whether customers' cable account numbers fell within the parameters of Rule 9037. Noting that nothing in the Rule limits its applicability to financial institutions, the court held that the account numbers were, indeed, "financial-account numbers." However, because there was a reasonable argument that these numbers were not required by Rule 9037 to be redacted, the court declined to award attorney's fees for listing the full numbers on the cable company's proofs of claim. The court did admonish the cable company to redact the numbers going forward.
In this case, Ms. Soles testified that the "account IDs" and "patient numbers" correspond to a particular billing entry, and that a new account number is generated for every visit. The debtors, who have the burden of proof, did not present any evidence that this is the type of information contemplated by the Rule or that a party with access to this number could do anything with it, such as access a patient's other records or private information. Instead, the only evidence is the testimony of Ms. James, who said that the sole use one could make of these numbers is to pay the debtor's bill - which would benefit, rather than harm, the debtor. These numbers may technically be a "financial account number," but they are of such limited use that they are more akin to an invoice number. These account IDs or patient numbers are probably not what was contemplated when Rule 9037 was created. As a result, the applicability of Rule 9037 to these numbers is gray. The court cannot award sanctions for disclosures that are not clearly prohibited by the statute or Rule. Accord, Brown, 2012 WL 2576473, at *4.
Ms. James testified that a new account number applies to each "encounter."
Although the court has now determined based on the evidence before it that the disclosure of these numbers did not violate Rule 9037, WakeMed began redacting all but the last four digits of these numbers prior to the hearings. To resolve any question about the applicability of Rule 9037 to these numbers, WakeMed should continue to redact all but the last four digits of the patient numbers and account IDs.
The debtors also complain about the inclusion of dates of admission and discharge, medical record numbers, and other medical information. Rule 9037 does not address the redaction or disclosure of any of these items. While it is possible that this information is protected under a non-bankruptcy law or regulation, there is no evidence that any of it puts the debtors at risk of identity theft or other damage as contemplated by § 107(c), and is otherwise not addressed in the Bankruptcy Code and Rules. As noted, this is not a HIPAA compliance court. Accordingly, the court declines to find that the disclosure of this information is sanctionable under § 105(a). See Law v. Siegel, 134 S. Ct. 1188, 1194-95 (2014) (equitable powers of the bankruptcy court must only be exercised within the confines of the Bankruptcy Code) (citations omitted).
Because the claim filed in Mr. Branch's case did not disclose any information that clearly must be redacted under Rule 9037, the court finds that WakeMed has not knowingly violated any provision of the Bankruptcy Code and Rules with respect to Mr. Branch. As noted above, however, WakeMed did violate Rule 9037 with respect to Ms. Clark and Ms. Bostick when it included unredacted social security numbers and dates of birth in claims filed in their cases. What Is a Sanctionable Violation of Rule 9037?
As noted above, courts overwhelmingly hold that sanctions are appropriate "where it is shown that a creditor flaunted the law with knowledge of its proscriptions, failed to take remedial action once violations were discovered, or acted deliberately as opposed to mistakenly or inadvertently." Maple, 434 B.R. at 374 (citations omitted). Ms. Soles, who filed the claims on behalf of WakeMed, may not have had actual knowledge of the redaction requirements, but she did "check the box" with every filing that indicated that she had read and complied with the rules regarding redaction. There is no evidence that anyone else at WakeMed had any understanding of what is required to file claims in bankruptcy cases. It is difficult to say that Ms. Soles (and by extension, WakeMed) "flaunted" the law, or acted deliberately. But the magnitude of the violation, and the fact that there was no supervision or training, indicates that WakeMed was more than negligent. An institution that participates in the bankruptcy process as frequently as WakeMed simply cannot ignore the requirements of the court; the Code and Rules are of equal importance to the requirements of HIPAA and other regulations that govern WakeMed's business practices, and the fact that no one was reviewing the rules that might apply is unforgivable.
The debtors maintain that WakeMed failed to timely take remedial action, contending that it is "too big to care" and that the possibility of sanctions (or possibly the media attention) was required to entice WakeMed to take any action. The first motion to restrict access to a proof of claim was filed on November 2, 2015. From November 11 through November 18, 2015, 158 motions to restrict access were filed. On November 24, 2015, the first of the three motions for sanctions was filed. For some reason, none of these documents reached Ms. James until December 1, 2015, 29 days after the first motion to restrict access. The next day, Ms. James on behalf of WakeMed retained counsel to address the issue, and on December 5, 2015, the Motion to Establish a Procedure was filed. Based on the sheer volume and the limitations on the ability of the court staff to restrict access to more than 1,410 claims on any given day, it took several weeks for all of the claims to be restricted and/or redacted.
WakeMed apparently did not have procedures in place to have 159 motions to restrict access to its claims immediately brought to the attention of counsel. As a result of the failure in procedure, there was a delay of four weeks from the filing of the first motion (and 21 days from the filing of the first of the 158 motions) to the retention of outside counsel. This constitutes a "failure" to take timely remedial action. See In re Lunden, 524 B.R. 410 (Bankr. D. Mass. 2015) (contempt sanctions appropriate where counsel failed to take remedial measures when brought to his attention and defended actions with frivolous excuses).
The motion to restrict access in Mr. Branch's case was not filed until December 23, 2015.
The court agrees that once the motions were brought to the attention of Ms. James, WakeMed acted swiftly. However, the court cannot ignore the fact that the issue was not directed to her attention sooner, or that it was the motion for sanctions, not the motions to restrict access, that finally made its way to her desk.
The court does not find the actions of WakeMed to be intentional or malicious, but the failure to have proper procedures in place resulted in WakeMed's failure to take immediate action when the initial motions to restrict access were filed. This case is also distinguishable from others by the sheer volume of the problem, the length of time that it went unnoticed (also by debtors and their counsel, apparently), and the lack of oversight or training for an entity that files hundreds of bankruptcy claims each year. Accordingly, while the court does not view this case as meriting large punitive sanctions, it does find that some compensatory and punitive award as well as non-monetary relief is appropriate.
What Is an Appropriate Sanction?
Actual Damages
Ms. Clark is the only debtor who appeared and presented evidence to the court. She could not demonstrate that she had suffered any actual harm from the failure to redact her personal information, but she did testify that she took three days of vacation to attend the hearings, spent several hours consulting with her counsel about the issue and the hearings, and incurred mileage and parking expenses. Ms. Clark submitted a declaration after the hearing detailing those expenses as follows:
| 3 days of work to testify, 8 hours at $39.90/hour | $ 957.60 |
| Parking fees for 3 court appearances | $ 12.00 |
| Mileage: 36 miles at $0.54/mile | $ 19.44 |
| 3.5 hours consulting with counsel at $39.90/hour | $ 139.65 |
|---|---|
| $1,140.69 |
As described below, Ms. Clark and her counsel did the court and the public a service by bringing this matter to the attention of the court. The court will award Ms. Clark her actual expenses for pursuing this matter, as detailed above in the amount of $1,140.69. Ms. Clark also incurred attorneys' fees, which are addressed below.
Ms. Clark's testimony and declaration further noted that she has not quantified her "distress and anxiety over this situation," and she further believes that WakeMed should pay for LifeLock Ultimate Plus identity theft protection for ten years at a cost of $3,298.90. The identity theft protection request is addressed below. Under these facts, the court can find no basis in the law to compensate Ms. Clark for general "distress and anxiety." See Sloane v. Equifax Info. Servs., LLC, 510 F.3d 495, 503 (4th Cir. 2007) (explaining that to recover for emotional distress a party must "reasonably and sufficiently explain the circumstances of [the] injury and not resort to mere conclusory statements.") (citations omitted); Knussman v. Maryland, 272 F.3d 625, 640 (4th Cir. 2001) (factors properly considered in reviewing an award for emotional distress include the factual context in which the emotional distress arose; evidence corroborating the testimony of the plaintiff; the nexus between the conduct of the defendant and the emotional distress; the degree of such mental distress; mitigating circumstances, if any; physical injuries suffered due to the emotional distress; medical attention resulting from the emotional duress; psychiatric or psychological treatment; and the loss of income, if any) (citations omitted).
Credit Monitoring
Although there is no evidence that the information included on WakeMed's claims has been used for nefarious purposes, the debtors have requested that WakeMed be required to provide credit monitoring for those debtors whose personal information was disclosed. At the hearing, Ms. Clark suggested that it should be provided for the rest of her life, but her declaration requests protection for 10 years. Most courts have rejected credit monitoring as an appropriate remedy, as "potential identity theft" is too speculative. See, e.g., Barnhart, 2010 Bankr. LEXIS 471, 2010 WL 724703 (claim included social security number, date of birth, loan account number; risk that information could be used in the future too speculative to allege actual damages), Killian v. Green Tree Servicing, LLC, (In re Killian), Adv. Proc. No. 08-80250-HB, 2009 Bankr. LEXIS 2030, at *29 (Bankr. D.S.C. July 23, 2009) (dismissing claim for damages on the grounds that potential identity theft and costs of credit monitoring are speculative damages); Davis v. Eagle Legacy Credit Union (In re Davis), 430 B.R. 902 (Bankr. D. Colo. 2010) (social security number, date of birth, and driver's license number included in claim; "the harm Plaintiff asserts is not 'actual' or 'imminent,' for there is no evidence that Plaintiff's personal information has been accessed or misused by an unauthorized third party during the six days when it was viewable by the public on PACER, nor that it will be. In the absence of such evidence, Plaintiff's need for credit monitoring is conjectural or hypothetical. Thus, there is no injury in fact and Plaintiff lacks standing to bring any cause of action against Defendant."); but see In re Lunden, 524 B.R. 410 (Bankr. D. Mass. 2015) (awarding attorney's fees, punitive damages of $1,000, and credit monitoring for one year where social security number and date of birth not redacted).
Here, however, WakeMed has already agreed to pay for one year of credit monitoring for any debtor whose information was disclosed in violation of Rule 9037. Many of those debtors have already received letters from WakeMed outlining the steps they must take to obtain credit monitoring at no cost to the debtors; however, the court will require WakeMed to send a new letter to all of the debtors and any non-debtor minor whose social security number or full date of birth was included in a proof of claim filed on or after December 1, 2007, offering credit monitoring for one year at no cost to those individuals, with instructions for obtaining the same. The court will not dictate which credit monitoring service must be used. The new letter does not need to be HIPAA compliant, and should be limited to (1) the fact that the information was disclosed, (2) WakeMed will provide credit monitoring for one year at no cost, and (3) instructions for obtaining the credit monitoring.
Attorneys' Fees
Many courts have found no basis to award attorney fees for violations of Rule 9037. See, e.g., Carter, 411 B.R. 730, Davis, 430 B.R. 902, Brown, 2012 WL 2576473; see also In re Gjestvang, 405 B.R. 316 (Bankr. E.D. Ark. 2009) (no basis to award attorney's fees to restrict public access to a claim under § 107(c); Rule 9037 was not in effect when claim filed). At least one court awarded $300 in attorney's fees, but noted that it was only doing so because the case was one of first impression, and fees may not be awarded in the future on similar motions. Carter v. Checkmate, Cash Advance Ctrs., LLC (In re Carter), Adv. Pro. No. 09-00132-TOM, 2009 WL 3425828, at *4 (Bankr. N.D. Ala. Oct. 23, 2009). The Lunden court awarded attorney's fees where the court found that counsel failed to take remedial measures when the violation was brought to his attention, and then defended his actions with "ex post facto excuses bordering on the frivolous." 524 B.R. at 418.
This court has previously recognized its general authority under § 105(a) to compensate debtors for attorneys' fees incurred in bringing matters of "problematic and recurring practice(s)" of creditors to the attention of the court. In re Campbell, No. 12-06400-8-SWH, 2013 WL 2443377, at *1 (Bankr. E.D.N.C. June 5, 2013). In that case, the debtor demonstrated that the City of Raleigh regularly filed claims as "secured," when, in fact, those claims were unsecured, and the City either (a) corrected them only upon receiving an objection or (b) failed to respond to objections and allowed the misclassification to be corrected by debtor's counsel and the court. The debtor demonstrated that the practice was not "a rare clerical error," but was a common practice that shifted the obligation to debtor's counsel "to determine a claim's secured status, to initiate corrective measures, and to ensure that the claims are corrected." Campbell, 2013 WL 2443377, at *2. The court found that there was a problem with the City's protocol for claim classification that resulted in increased payouts to which it was not entitled and impeded the fair and efficient functioning of the court. Id. at *4. The Campbell court noted that the City had not taken the opportunity to revise its procedures when the issue was first brought to its attention, applauded the new effort to focus on its internal claims-handling process, and credited debtor's counsel's "diligent effort" to bring the matter to light with the City's agreement to correct its "insufficient staff training, lack of attention, general laziness, and . . . troubling indifference to the consequences that these factors imposed on others." Id. at *4.
Here, debtors' counsel likewise acted diligently in "doing the necessary homework to illustrate the scope of the problem to the court." Campbell, 2013 WL 2443377, at *5. Accordingly, "pursuant to the court's inherent powers to issue orders as necessary to ensure the efficient functioning of the court, a compensatory award of fees to counsel is warranted." Id.
The court also notes that the staff in the court's clerk's office spent countless hours processing both the 160 motions filed by debtors' counsel and the more than 4,000 requests to restrict access filed by WakeMed. Unfortunately, there is no way for the court to order a sanction that would compensate the court's staff for its dedicated service on this project.
Ms. Clark's counsel, the Sasser Law Firm, did a service to the court and the public by bringing the issue to the court's attention and having it - including the court's procedure - remedied. In doing so, the firm filed 158 motions to restrict access after contacting the court to change the procedure so as not to put these debtors' information at greater risk through the process of protecting it. The court finds it appropriate to award fees to the Sasser Law Firm for its efforts. The firm submitted a fee affidavit separating its fees and expenses into two categories: the first is for time spent on Ms. Clark's case specifically, and the second is for time spent researching, preparing, and filing its other 157 motions to restrict access.
The Sasser Law Firm's fee affidavit with respect to Ms. Clark's case showed $117.46 in costs, including filing fees, PACER fees, parking, and mailing costs, and $20,616.50 in attorney and staff time, for a total of $20,733.96. Hourly rates charged were $320 for Mr. Sasser, $295 for Mr. Walker, and $80 for staff. The court finds the rates and the amounts charged to be reasonable. Accordingly, the court will require WakeMed to reimburse the Sasser Law Firm the amount of $20,733.96 for its work on the Clark case.
The Sasser Law Firm also submitted detail relating to the review and filing of its other 157 motions to restrict access, which included staff time reviewing claims for personal information, attorney time for preparing the motions, and attorney time for fielding questions from clients about the issue. That affidavit showed filing fees, PACER fees, postage and copy costs totaling $4,355.74. Attorney and staff fees, at the hourly rates listed above, totaled $12,136. The court finds these amounts to be reasonable, and the court will require WakeMed to reimburse the Sasser Law Firm the amount of $16,491.74 for its work on the other cases.
Mr. Branch and Ms. Bostick were both represented by the firm of Stubbs & Perdue. The claim filed in Mr. Branch's cases did not clearly violate Rule 9037, and the court will not award any fees related to his case. See, e.g., Brown, 2012 WL 2576473, at *4 (denying request for attorney's fees where - prior to court's ruling - cable account numbers were not obviously "financial account numbers" disclosed in violation of Rule 9037). Further, the court notes that the time entries attached to the fee affidavit in Mr. Branch's case indicate that the matter was undertaken on a contingency arrangement, so Mr. Branch will not be responsible for any fees incurred by his counsel in this matter. With respect to Ms. Bostick, the court notes that her counsel did not move to restrict access to Claim No. 1 even though it contained her social security number; counsel moved to restrict access only to Claim No. 2. However, Stubbs & Perdue's efforts did help bring the matter to the court's attention and assist in getting it resolved, and the court will award fees to the firm in the Bostick case.
The fee detail in Ms. Bostick's case begins after the motion to restrict access had been filed and after the motion for sanctions had been drafted, leaving the court without information about whether her file was similarly established on a contingency basis. There is nothing on the docket in either case to inform the court as to the fee agreements with the debtors.
Claim No. 2 has been restricted through WakeMed's motions filed in the Miscellaneous Proceeding.
Stubbs & Perdue submitted two post-hearing fee affidavits, one in Ms. Bostick's case and one in Mr. Branch's case. The Bostick Affidavit seeks reimbursement of fees in the amount of $15,650 and costs in the amount of $982.46, while the Branch Affidavit seeks reimbursement of fees in the amount of $12,652.25 and costs in the amount of $127.75. For most of the time spent preparing for and attending the hearings, the firm appropriately split its fees and costs between the two cases. Other entries are easily identified as related to one case or the other. In some instances the fees are charged in only one case without sufficient explanation as to why they were not split. Regardless, the court realizes that had Stubbs & Perdue filed its motion for sanctions only in the Bostick case, it would have incurred more fees on behalf of Ms. Bostick than the (split) fee affidavit reflects. Accordingly, while the court will not double the fees sought in the Bostick case, it will award a fee enhancement to reflect the reduction that occurred as a result of the fee allocation.
For example, the fee detail attached to the Branch Affidavit ends with a time entry on March 9, 2016, which included review and preparation for final arguments in this matter, and does not have an entry for the actual final argument on March 10, 2016. The fee detail attached to the Bostick Affidavit included 4.5 hours on March 10, 2016 to prepare for and attend court, travel to court, and paralegal time related to the hearing at a total charge of $1,346.75. Similarly, the cost detail in Ms. Bostick's case includes Westlaw legal research charges totaling $492.88 incurred on February 10 and 25, 2016, while Mr. Bostick's detail shows Westlaw charges of $42.38 incurred on February 4, 2016. There is no information how the Westlaw charges were established, nor is it clear why these charges were not divided between the two cases. Similarly, PACER charges of over $50 were incurred, presumably researching WakeMed claims in other cases for purposes of the hearing, that were not evenly divided between Mr. Branch and Ms. Bostick. The hearing transcript fee of $390.55 was also charged only to Ms. Bostick.
The court finds that the fees and costs in the Bostick fee detail are reasonable, and, with a fee enhancement as explained above, the court will award Stubbs & Perdue a total of $22,632.46 in the Bostick case.
Punitive Damages
The court finds that limited punitive damages are appropriate in this case. While there is no evidence that the disclosure of personal information was malicious or intentional, the scope of the Rule 9037 violations is extreme and resulted from an utter failure of WakeMed to educate itself regarding the requirements of the Bankruptcy Code and Rules, a lack of training and education of the WakeMed staff, and a failure of procedures to bring these matters to the attention of counsel and take immediate corrective actions. In establishing its award of punitive damages, the court has considered the significant cost in filing and attorneys' fees incurred by WakeMed to remedy the violations as punitive in nature. The court has further determined that allocation between the debtors - who provided a significant public service by bringing and prosecuting the motions - and the court is appropriate.
Accordingly, the court finds that a punitive sanction in the amount of $70,000 is appropriate in this case. WakeMed will be directed to pay the amount of $50,000 to the court, and $10,000 each to Ms. Clark and Ms. Bostick for their roles as "stalking horses" in bringing this matter to the attention of the court and forcing corrective action by WakeMed. This is not to say that WakeMed will continue to be subject to sanctions in the future for past transgressions; it appears to the court that compliance with this order and the actions taken to date are sufficient to remedy the past violations absent some evidence of direct, actual damages to a debtor resulting from the disclosure of his or her particular information.
Non-Monetary Sanctions
In addition to requiring WakeMed to pay actual damages and attorneys' fees as directed above, the court will require WakeMed to take certain actions to ensure that it complies with the court's rules going forward. The status report filed in the miscellaneous proceeding indicates that as of January 15, 2016, in addition to filing its motions to restrict access to its claims, WakeMed had taken the following steps:
• Multiple Board meetings and briefings
• Strategic Leadership Team and Operations Leadership Team briefings
• Review of its procedures for filing bankruptcy claims
• Development of new procedures for filing bankruptcy claims and training thereon
• Engaged counsel to conduct in-person training related to HIPAA disclosures and Rule 9037 requirements to all personnel involved in filing proofs of claim.
• Respond[ed] to calls from debtors who received bankruptcy or HIPPA notices
• Publish[ed] public notice on its website
• Ma[de] appropriate reports to North Carolina Attorney General's Office
• Prepare[d] report to United States Department of Health and Human Services/ Office for Civil Rights to be included in annual reporting which will occur in 45 days.Misc. Pro. Dkt. 19 at 7. In addition, Ms. James testified that as of the hearing dates, additional actions had been taken, including:
• Instructing the mail room to notify her office when certified mail with a return address from an attorney is received;
• Hiring outside counsel to train employees on the requirements for filing proofs of claim;
• Hiring outside counsel to create a training and reference manual for employees filing claims;
• Requesting outside counsel to provide annual updates regarding the law and any need to update the manual; and
• Requesting outside counsel to do a quality check of all WakeMed claims to ensure that all claims disclosing personal information had been restricted and/or redacted.
These are all positive steps toward ensuring that continuing violations do not occur. WakeMed is directed to demonstrate its continued compliance with these steps by submitting, for the five years following the date of this order, quarterly reports to the Bankruptcy Administrator detailing the training conducted with respect to claims filing, the number of claims filed during that quarter, a certification that those claims were properly redacted, and an outline of office procedures in place with respect to claims filing during that quarter. Further, the court directs WakeMed to maintain electronic copies of all claims submitted on its behalf, and, to the extent required by EDNC LBR 5005-4(7)(a), to maintain paper copies with the original "wet-ink" signature of filed claims. WakeMed is further directed to review and update its procedures for handling incoming mail and electronic notices received from the court or counsel.
CONCLUSION
Based on the foregoing, the motions are ALLOWED IN PART AND DENIED IN PART. Mr. Branch's motion for sanctions is DENIED, as WakeMed did not violate Rule 9037 in in his case. Ms. Bostick's motion for sanctions and Ms. Clark's motion for sanctions are ALLOWED as set forth below.
Accordingly, it is ORDERED:
WakeMed is directed to send a letter to all of the debtors and any non-debtor minor whose social security number or full date of birth was included in a proof of claim filed on or after December 1, 2007, offering credit monitoring for one year at no cost to those individuals, with instructions for obtaining the same.
WakeMed is directed to submit, for the five years following the date of this order, quarterly reports to the Bankruptcy Administrator detailing the training conducted with respect to claims filing, the number of claims filed during that quarter, a certification that those claims were properly redacted, and an outline of office procedures in place with respect to claims filing during that quarter.
WakeMed is directed to maintain electronic copies of all claims submitted on its behalf, and, to the extent required by EDNC LBR 5005-4(7)(a), to maintain paper copies with the original "wet-ink" signature of filed claims.
WakeMed is further directed to review and update its procedures for handling incoming mail and electronic notices received from the court or counsel.
WakeMed is directed to pay the sum of $11,140.69 to Janis Monroe Clark, in care of her counsel, within ten days of the date of this order at the following address: Sasser Law Firm, 2000 Regency Parkway, Suite 230, Cary, North Carolina 27518.
WakeMed is directed to pay the sum of $10,000.00 to Carla Lynette Bostick, in care of her counsel, within ten days of the date of this order at the following address: Stubbs & Perdue, PA, 9208 Falls of Neuse Road, Suite 201, Raleigh, North Carolina 27615.
WakeMed is directed to pay the sum of $37,225.70 to the Sasser Law Firm within ten days of the date of this order at the following address: Sasser Law Firm, 2000 Regency Parkway, Suite 230, Cary, North Carolina 27518.
WakeMed is further directed to pay the sum of $22,632.46 to Stubbs & Perdue, PA within ten days of the date of this order at the following address: Stubbs & Perdue, PA, 9208 Falls of Neuse Road, Suite 201, Raleigh, North Carolina 27615.
WakeMed is further directed to pay the sum of $50,000 to the Clerk of Court, United States Bankruptcy Court for the Eastern District of North Carolina, within ten days of the date of this order at the following address: 300 Fayetteville Street, Fourth Floor, Raleigh, North Carolina 27602 (by hand or overnight delivery) or PO Box 791, Raleigh, North Carolina 27602 (by mail).
SO ORDERED.
SIGNED this 31 day of August,2016.
/s/ _________
Stephani W. Humrickhouse
United States Bankruptcy Judge