Opinion
354831
10-14-2021
KIM RAKYTA, and all others similarly situated, Plaintiff-Appellant, v. MUNSON HEALTHCARE, Defendant-Appellee.
UNPUBLISHED
Grand Traverse Circuit Court LC No. 2020-035343-NZ
Before: Redford, P.J., and K. F. Kelly and Letica, JJ.Per Curiam
In this class action lawsuit arising from a digital security breach, plaintiff appeals by right the trial court's order dismissing her claims against defendant under MCR 2.116(C)(8). On appeal, plaintiff argues that the trial court erred when it determined that she failed to allege damages that were cognizable under Michigan law. Plaintiff also argues that the trial court erred when it determined that defendant's collection of patient information was reasonable as a matter of law. We affirm.
I. BASIC FACTS
Beginning in July 2019 and continuing through October 2019, unknown attackers gained unauthorized access to 24 e-mail accounts assigned to some of defendant's employees by tricking them into sharing access to their account information. The attackers ultimately used the security breach to obtain access to information associated with approximately 75, 202 patients. The information included names, dates of birth, addresses, financial account numbers, social security numbers, insurance details, treatment information, diagnostic data, and other information commonly used to commit identity theft (confidential information).
Because the parties did not conduct discovery, we have used the allegations in plaintiff's complaint to provide the background facts.
Defendant first realized that its digital security may have been compromised in October 2019. Defendant hired a cybersecurity firm to investigate the attack and, in January 2020, the firm issued a report in which it confirmed that the unknown attackers had had access to the confidential information of defendant's patients. Defendant started notifying patients who were affected by the digital security breach in February 2020.
In May 2020, plaintiff sued defendant on her own behalf, and on behalf of all other persons similarly situated to her, for claims arising from defendant's alleged breach of its duty to protect the confidential information entrusted to it. Plaintiff alleged six separate claims in her complaint. Plaintiff alleged that defendant breached its duty to take reasonable steps to protect its patients' confidential information, which included failing to monitor its system, failing to timely detect the breach, and failing to timely notify its patients of the breach (Count I). Plaintiff further alleged that defendant's failure to protect its patients' confidential data amounted to an intrusion into the patients' seclusion and an invasion of their privacy (Count II). Plaintiff also alleged two contract claims: she alleged that defendant breached its explicit agreement to protect its patients' confidential data (Count III), and, in the alternative, that defendant breached an implied contract to protect its patients' confidential data (Count IV). For her fifth claim, plaintiff alleged that defendant's failure to protect its patients' confidential information breached several statutorily imposed duties, which amounted to negligence per se (Count V). Finally, plaintiff alleged that defendant's deficient handling of the confidential information and data breach amounted to a breach of the fiduciary duties that it owed to its patients (Count VI).
Defendant moved to dismiss plaintiff's claims under MCR 2.116(C)(8) because she failed to state any claims upon which relief could be granted. Defendant argued that plaintiff failed to allege that she or any potential class member suffered an actual injury. To the contrary, defendant maintained that plaintiff alleged only that she and the other potential class members might suffer some future injury, which was speculative. It further argued that, under Michigan law, a plaintiff cannot demonstrate that he or she suffered an injury by showing that he or she took prophylactic measures to ameliorate the risk of future harm. For these propositions of law, defendant relied on our Supreme Court's decision in Henry v. The Dow Chem Co, 473 Mich. 63; 701 N.W.2d 684 (2005), and this Court's decisions in Nyman v. Thomson Reuters Holdings, Inc, 329 Mich.App. 539; 942 N.W.2d 696 (2019), and Doe v. Henry Ford Health Sys, 308 Mich.App. 592; 865 N.W.2d 915 (2014). It also maintained that emotional damages are only cognizable when occasioned by an underlying actual injury. Defendant asserted that it was entitled to summary disposition of all plaintiff's claims because plaintiff failed to allege that she or any class members suffered any injuries that caused them damages beyond speculative damages premised on prophylactic measures.
In response to defendant's motion, plaintiff argued that she adequately pleaded damages. She noted that defendant's actions provided persons with "opportunities" to commit fraud, had "increased" the risk of actual harm to her and the potential class members, and placed her and the class members at "risk of injury." Plaintiff argued that a growing number of courts have held that the loss of value in "personally identifying information" was a legally cognizable form of "damages." She also noted that other courts have held that "imminent risk of future harm" amounted to a legally cognizable form of damages. Plaintiff distinguished the decisions in Henry, Nyman, and Doe by noting that she did not just rely on allegations of damages arising from prophylactic measures. Rather, she relied on the evidence that third parties had actually accessed her confidential information, which amounted to an imminent risk of future harm.
The trial court held a hearing on defendant's motion. Citing the decisions in Henry, Nyman, and Doe, the trial court agreed that plaintiff had not alleged damages for any of her claims that were cognizable under Michigan law. Accordingly, it granted defendant's motion and dismissed all plaintiff's claims. This appeal followed.
II. SUMMARY DISPOSITION: FAILURE TO PLEAD DAMAGES
On appeal, plaintiff argues that the trial court erred in several respects when it determined that she had not pleaded damages for her claims that were cognizable under Michigan law. She argues that Michigan law recognizes an imminent risk of future harm as a present injury capable of supporting a claim for damages. Plaintiff further argues that the allegation that someone actually viewed the confidential information devalued her information, which further constituted an actual injury causing damages. We disagree.
A. STANDARD OF REVIEW
This Court reviews de novo a trial court's decision to dismiss a claim under MCR 2.116(C)(8). See Glasker-Davis v. Auvenshine, 333 Mich.App. 222, 229;___ N.W.2d___ (2020). A defendant may move to dismiss a claim on the ground that the "opposing party has failed to state a claim on which relief can be granted." MCR 2.116(C)(8). A motion under MCR 2.116(C)(8) tests the "legal sufficiency of the complaint." Maiden v. Rozwood, 461 Mich. 109, 119; 597 N.W.2d 817 (1999). When reviewing the motion, this Court accepts all well pleaded factual allegations as true and construes the allegations in the light most favorable to the nonmovant. Id. A motion under MCR 2.116(C)(8) must be granted if no factual development could justify the claim for relief. Bailey v. Schaaf, 494 Mich. 595, 603; 835 N.W.2d 413 (2013). This Court also reviews de novo whether the trial court properly interpreted and applied Michigan's common law. Roberts v. Salmi, 308 Mich.App. 605, 612; 866 N.W.2d 460 (2014).
B. ANALYSIS
To establish a claim premised on negligence, plaintiff had to plead-and later be able to prove-that defendant, in relevant part, breached its duty of care and caused her to suffer damages. See Finazzo v. Fire Equip Co, 323 Mich.App. 620, 635; 918 N.W.2d 200 (2018). Although Michigan courts have not always carefully distinguished between the concepts of injury and damages, those concepts are distinct. See Henry, 473 Mich. at 75-76, 78. Economic losses can constitute damages, but not all economic losses will establish the element of damages; only damages that arise from an actual, present injury, are cognizable under Michigan law. Id. at 75-76 (stating that the plaintiff must demonstrate a present physical injury to person or property in addition to economic losses that result from that injury). Accordingly, in order to establish the damages element of a claim for negligence, a plaintiff must allege that he or she suffered damages from an actual, present injury. Id.
In her complaint, plaintiff alleged that defendant's failure to adequately protect its patients' confidential information resulted in losses that were "incurred to remedy or mitigate the effects of the attack." More specifically, she alleged that she and the potential class members were "exposed to a heightened and imminent risk of fraud and identity theft," which forced them to "closely monitor their financial accounts to guard against identity theft." Plaintiff stated as well that she "believ[ed] her Private Information" had been stolen and sold in the data breach. Although plaintiff did not allege that she or any other potential class member actually had been a victim of identity theft, let alone the victim of identity theft that could be directly traced to defendant's negligent conduct, she did allege that actual victims of identity theft face substantial costs associated with repairing the harms arising from identity theft. Plaintiff also alleged that there was a "strong probability that entire batches of stolen information have been dumped on the black market," which meant that she and the other potential class members were at increased risk. She nevertheless recognized that it might be years before potential bad actors might use the confidential information taken from defendant to steal her identity or the identities of the potential class members.
Plaintiff alleged that she and the other class members suffered damages, but she did not allege that those damages were from a present, actual injury. She alleged that she and the potential class members were placed in "imminent, immediate, and continuing increased risk of harm from fraud and identity theft." They were also, she alleged, "forced to expend time dealing with the effects of the Data Breach." More specifically, she alleged that they had the "risk of out-of-pocket fraud losses," had the "risk of being targeted" by fraud, and had to spend money on "protective measures," such as credit monitoring. Even though plaintiff alleged that she and the potential class members suffered present damages, she did not allege any damages that arose from an actual, present injury; instead, the allegations involved possible future injuries and the prophylactic measures that she and the potential class members might reasonably take to prevent or mitigate the potential future injuries. Allegations of this nature are inadequate to state a cause of action for negligence under the rule stated in Henry.
In Henry, 473 Mich. at 68, our Supreme Court clarified that a plaintiff's allegations of economic losses occasioned by a fear of future injury were not sufficient to establish an actual injury. In that case, the plaintiffs alleged that Dow Chemical had negligently released dioxin, which contaminated the Tittabawassee flood plain. Id. at 69. The plaintiffs were all persons who resided on the Tittabawassee flood plain and who were, as a result, potentially exposed to the dioxin that Dow Chemical had negligently released. Id. at 69-70. The plaintiffs denied that they had suffered physical injuries, but nevertheless asserted that they suffered damages in the form of medical monitoring expenses that they incurred in anticipation of possible future injury caused by their exposure to the dioxin in the environment where they lived. Id. at 73.
Our Supreme Court ruled that allegations of a potential future injury were not sufficient to establish a claim for negligence: "it is a present injury, not fear of an injury in the future, that gives rise to a cause of action under negligence theory." Id. Accordingly, "if the alleged damages cited by [the] plaintiffs were incurred in anticipation of possible future injury rather than in response to present injuries," the Court explained those pecuniary losses would not be "derived from an injury that is cognizable under Michigan tort law." Id. Examining the record, the Court determined that the plaintiffs in Henry had not pleaded a present injury:
Here, it is apparent that the only "injuries" alleged by the putative representatives of the medical monitoring class are "the losses they have and will suffer as they are forced to monitor closely their health and medical condition because of their exposure to Dow's Dioxin [sic] pollution." Thus, plaintiffs have arguably stated a present financial injury, i.e., damages. From this description,
however, it is apparent that plaintiffs do not claim that they suffer from present physical injuries to person or property. Rather, plaintiffs allege that they may develop dioxin-related illnesses in the future. At best, then, the only "injury" from which plaintiffs suffer at present is a fear of future illness. [Id. at 77-78 (alteration in original).]
Because the plaintiffs alleged only bare damages that were derivative of a possible, future injury rather than an actual present injury, the Court held that the plaintiffs failed to state a claim upon which relief could be granted. Id. at 78.
In Henry, the class members lived in a location that allegedly had been contaminated by Dow Chemical's negligent release of dioxin. For that reason, the class members risked being exposed to dioxin and further risked suffering from the class of harms that dioxin can cause. Accordingly, the class members might reasonably spend time and resources monitoring their health to mitigate any future harms. Nevertheless, our Supreme Court held that exposure to potential future harm and the payment of expenses associated with monitoring and mitigating the potential future harm were not sufficient to establish an actual, present injury. Id.
Defendant's release of confidential information as a result of its failure to adequately protect its patients' confidential information is analogous to Dow Chemical's negligent release of dioxin. Plaintiff pleaded that, as a result of defendant's alleged negligence, third parties had the ability to see and copy confidential information that they might later use for illegal purposes. Further, if those third parties should use the information inappropriately, that use would cause harm to the person from whom the information was obtained. As a result, defendant's patients reasonably feared a future harm and might reasonably expend resources to mitigate the potential harm. And, although one might agree that the expenditures were reasonable, bare allegations of damages arising from the expenditure of resources to mitigate or prevent a future harm do not establish a present injury. As was the case in Henry, those "economic losses are wholly derivative of a possible, future injury rather than an actual, present injury." Id.
Moreover, contrary to plaintiff's claim on appeal, our Supreme Court did not carve out an exception to the common-law rule for injuries that were imminent. The Supreme Court plainly stated that a claim for negligence must be predicated on an injury that had actually occurred. An injury that is imminent is an injury that has not yet occurred. Consequently, plaintiff's allegations about damages from lost time and expenditures to prevent or mitigate the harms that would occur should third parties misuse the confidential information taken from defendant, along with her allegations that defendant's negligence created an imminent risk of harm, were inadequate to state a claim for negligence because those allegations did not involve a present, actual injury. Id.
Plaintiff's allegation that her confidential information lost value as a result of the exposure to third parties also does not save her negligence claims. The allegation is conclusory-she merely asserted that the exposure of the information caused a loss of value without explaining how it did so. Conclusory allegations will not suffice to state a cause of action. See ETT Ambulance Serv Corp v. Rockford Ambulance, Inc, 204 Mich.App. 392, 395; 516 N.W.2d 498 (1994) ("[T]he mere statement of a pleader's conclusions, unsupported by allegations of fact, will not suffice to state a cause of action."). In any event, the unauthorized viewing of confidential information does not by itself reduce the value of the information. As the trial court recognized, it is the use of the information in some harmful way that devalues the information or otherwise causes harm. Because plaintiff did not allege that anyone actually used her confidential information in a way that devalued it, her conclusory allegation that she and the potential class members suffered from a loss of value did not amount to an allegation that, if true, demonstrated that she suffered an actual, present injury causing damages. That allegation, as was the case with her allegations about monitoring expenses, involved damages wholly dependent on a potential future injury, which cannot support a claim for negligence. See Henry, 473 Mich. at 78.
Plaintiff similarly alleged that she and the potential class members suffered damages in the form of anxiety, embarrassment, and emotional distress as a result of defendant's failure to protect their confidential information. Our Supreme Court, however, rejected the argument that allegations of damages arising from emotional distress or anxiety about a potential future injury were sufficient to save a claim from summary disposition. The Court explained that Michigan law only recognized emotional distress as the basis for a negligence claim when the emotional distress involved present physical manifestations of the distress. Id. at 79. In this case, plaintiff did not allege that she or anyone else had suffered a physical manifestation of emotional distress; as such, that allegation was insufficient to establish a present injury.
Contrary to plaintiff's argument on appeal, she did not allege damages from an actual, present injury. Instead, she alleged that she and the other potential class members might suffer a future injury, and, for that reason, that they had expended time and resources to mitigate the potential for future injuries. But our Supreme Court's decision in Henry plainly established that such allegations are inadequate to state damages cognizable under Michigan law. Id. at 78.
Relying on this Court's decision in Doe, plaintiff argues that this Court has expressly recognized that an allegation that a third party had unauthorized access to confidential information constitutes an actual, present injury for purposes of the decision in Henry. In Doe, 308 Mich.App. at 594-595, the plaintiff and the other class members sued Henry Ford Health after it allegedly caused their confidential information to become available on the Internet. This Court noted that there was no evidence that anyone actually viewed the confidential information or misused it. Id. at 595. Although there was no evidence that anyone viewed or misused the information, the plaintiff asserted that she suffered damages in the form of credit-monitoring services. Id. at 599-600. This Court rejected that contention. Id. at 600.
The Court applied the rule stated in Henry and concluded that the costs of credit-monitoring services did not relate to a present, actual injury:
Analogously, in this case, plaintiff has not shown that the costs for the credit-monitoring services relate to a present, actual injury. She has in fact conceded that she has no evidence that her information was viewed by anyone on the Internet or used for an improper purpose such as identity theft. Absent some such indication of present injury to her credit or identity, it is clear that these damages for credit monitoring were incurred in anticipation of possible future injury. Because these economic losses are wholly derivative of a possible, future injury rather than an actual, present injury, the costs of these credit-monitoring services are not cognizable under Michigan's negligence law. [Id. at 600-601 (quotation marks, citations, and footnote omitted).]
Plaintiff suggests that, if the plaintiff in Doe had had evidence to establish either that someone viewed her information on the Internet or had used the information inappropriately, this Court would have held that the plaintiff established a present injury consistent with the rule stated in Henry. Plaintiff places too much weight on the word "or" in this Court's statement that the plaintiff in Doe had "conceded that she [had] no evidence that her information was viewed by anyone on the Internet or used for an improper purpose such as identity theft." Id. at 600-601 (emphasis added). This Court impliedly recognized that a person might suffer a present injury by the fact that an unauthorized third party viewed confidential information, but it did not hold that any evidence or allegation that an unauthorized third party viewed the confidential information invariably would establish a present injury to one's credit or identity. Indeed, this Court held that, in the absence of evidence "of present injury to her credit or identity, it is clear that these damages for credit monitoring were incurred in anticipation of possible future injury," which was not a cognizable form of damage. Id. at 601. This Court stated that its decision not only comported with Henry, but it also tracked with the decisions of numerous courts from foreign jurisdictions that had held that credit monitoring was not a cognizable form of damages when procured to combat an increased risk of identity theft when there had been no evidence of an actual identity theft. See id. at 601 n 6. Accordingly, it is evident that this Court in Doe applied Henry and held that the evidence, or, in the case of a motion under MCR 2.116(C)(8), the allegations in the complaint, must show a present injury.
This Court came to the same conclusion in Nyman. In that case, the plaintiffs alleged that Thomas Reuters had placed the first five digits of the plaintiffs' social security numbers on a website available to subscribers. See Nyman, 329 Mich.App. at 541-543. This Court recognized that the plaintiffs did not allege that anyone actually "accessed their information, resulting in some form of injury to [the] plaintiffs or actual cognizable damages." Id. at 553. Because the plaintiffs did not allege an actual, present injury that caused their damages, this Court concluded that the trial court properly dismissed the plaintiffs' negligence claims under MCR 2.116(C)(8). Id. at 554. Although this Court again noted that the plaintiffs did not allege that anyone viewed the confidential information, it did not hold that an allegation that someone had viewed the confidential information would by itself establish a present injury and damages arising from that injury. To the contrary, this Court reiterated that the plaintiffs had the burden to allege a present injury: "[P]laintiffs did not allege that anyone had accessed their information, resulting in some form of injury to plaintiffs or actual cognizable damages." Id. at 553. Thus, this Court again recognized that the plaintiffs had to demonstrate both that someone viewed the information and that the viewing resulted in "some form of injury to [the] plaintiffs or actual cognizable damages." Id.
In this case, plaintiff alleged that unauthorized persons had access to the confidential information, but she did not state allegations that-if true-showed that the unauthorized viewing caused a present injury. Rather, she framed her allegations as each involving the risk of future harm from identity theft and similar future harms, and alleged that she and the other potential class members had suffered damages in the form of lost time and expenditures to reduce the risk of future harm. Those allegations did not establish damages arising from a present injury, but instead all involved a potential future injury. As the trial court correctly concluded, allegations of damages involving future injuries are not cognizable under Michigan law. See Henry, 473 Mich. at 78; Doe, 308 Mich.App. at 600-601; Nyman, 329 Mich.App. at 553. Consequently, the trial court did not err when it dismissed plaintiff's negligence claims under MCR 2.116(C)(8).
The trial court also did not err when it dismissed plaintiff's other claims on the same basis. To establish a tort claim under Michigan law, the plaintiff must demonstrate a present injury, even if he or she does not have to establish a physical injury. See Henry, 473 Mich. at 78-79 (noting that claims for libel and malpractice both require proof of a present injury and economic loss occasioned by the present injury). See also Highfield Beach at Lake Mich. v. Sanderson, 331 Mich.App. 636, 666; 954 N.W.2d 231 (2020) (stating that a plaintiff must prove damages as an element of breach of fiduciary duty). Additionally, the plaintiff must be able to demonstrate the damages with reasonable certainty; a plaintiff cannot establish the element of damages by alleging damages that are remote, contingent, or speculative. See Health Call of Detroit v. Atrium Home & Health Care Servs, Inc, 268 Mich.App. 83, 96; 706 N.W.2d 843 (2005). The same is true for claims premised on a breach of contract. See Doe, 308 Mich.App. at 602.
Plaintiff did not allege that she suffered cognizable damages as a result of a breach of fiduciary duty, breach of contract, breach of implied contract, invasion of privacy, or intrusion upon seclusion. Plaintiff alleged that unknown third parties saw her confidential information, which she alleged amounted to a breach of fiduciary duty, breach of express or implied contract, and an invasion of privacy or intrusion upon her seclusion, but she did not allege that the unknown third parties did anything with that information that injured her. This Court will not presume damages. See Nyman, 329 Mich.App. at 554; Doe, 308 Mich.App. at 603. The only actual damages-as opposed to conclusory allegations of damages-that plaintiff alleged were damages involving prophylactic measures to mitigate the losses from potential future harms, which are not cognizable under Michigan law. See Henry, 473 Mich. at 78. Similarly, plaintiff's allegations that she and the other potential class members might suffer future injuries are too speculative to establish the damage elements of her claims. See Doe, 308 Mich.App. at 602. Because plaintiff did not allege damages that were recoverable under Michigan law, the trial court did not err when it dismissed all her claims under MCR 2.116(C)(8).
Plaintiff additionally argues that this Court should adopt a rule that an imminent risk of harm constitutes a present injury for purposes of Michigan law, notwithstanding the decision in Henry. She cites numerous foreign authorities for that proposition, including federal lower court decisions and decisions from the United States Supreme Court. This Court is not bound to follow federal decisions interpreting Michigan law. See Van Buren Twp v. Garter Belt Inc, 258 Mich.App. 594, 604; 673 N.W.2d 111 (2003). This Court, however, must follow the decision in Henry. See Duncan v. Michigan, 300 Mich.App. 176, 193; 832 N.W.2d 761 (2013). And the Supreme Court clearly stated in Henry that a plaintiff must plead that he or she suffered a present injury-not a potential future injury or even an imminent future injury. See Henry, 473 Mich. at 78. Plaintiff failed to allege a present injury that gave rise to cognizable damages. Consequently, the trial court properly dismissed all her claims on that basis.
III. INTRUSION UPON SECLUSION
Plaintiff also argues that the trial court erred as a matter of law when it held that merely collecting data was not an intrusion upon seclusion. The trial court did briefly discuss whether defendant's collection of confidential information was offensive, but it did not dismiss plaintiff's claim on the ground that it was not offensive as a matter of law. The trial court stated that it was dismissing the invasion of privacy and intrusion upon seclusion claim because plaintiff failed to allege damages that were cognizable under Michigan law. Therefore, plaintiff has not identified an error for this Court to review. In any event, as already discussed, the trial court did not err when it dismissed that claim on that basis.
"There are three necessary elements to establish a prima facie case of intrusion upon seclusion: (1) the existence of a secret and private subject matter; (2) a right possessed by the plaintiff to keep that subject matter private; and (3) the obtaining of information about that subject matter through some method objectionable to a reasonable man." Lewis v. LeGrow, 258 Mich.App. 175, 193; 670 N.W.2d 675 (2003) (quotation marks and citation omitted).
Affirmed. As the prevailing party, defendant may tax its costs. MCR 7.219(A).