Opinion
Case No. 17-CV-02817 LHK (PR)
07-26-2017
LOUEN SA, Plaintiff, v. CALIFORNIA CORRECTIONAL HEALTH SERVICES, Defendant.
ORDER OF DISMISSAL
Plaintiff, a California state prisoner proceeding pro se, filed a civil rights complaint under 42 U.S.C. § 1983. Plaintiff is granted leave to proceed in forma pauperis in a separate order. For the reasons stated below, the court dismisses the complaint for lack of standing.
DISCUSSION
A. Standard of review
A federal court must conduct a preliminary screening in any case in which a prisoner seeks redress from a governmental entity or officer or employee of a governmental entity. See 28 U.S.C. § 1915A(a). In its review, the court must identify any cognizable claims and dismiss any claims that are frivolous, malicious, fail to state a claim upon which relief may be granted or seek monetary relief from a defendant who is immune from such relief. See 28 U.S.C. § 1915A(b)(1), (2). Pro se pleadings must, however, be liberally construed. See Balistreri v. Pacifica Police Dep't., 901 F.2d 696, 699 (9th Cir. 1988).
To state a claim under 42 U.S.C. § 1983, a plaintiff must allege two essential elements: (1) that a right secured by the Constitution or laws of the United States was violated, and (2) that the alleged violation was committed by a person acting under the color of state law. See West v. Atkins, 487 U.S. 42, 48 (1988). B. Legal claims
Plaintiff alleges that defendant California Correctional Health Care Services ("CCHCS") violated the Health Insurance Portability and Accountability Act ("HIPAA"), 42 U.S.C. § 1320d, et seq., and the Confidentiality of Medical Information Act, Cal. Civil Code § 56, et seq. Specifically, plaintiff states that on May 16, 2016, CCHCS notified plaintiff that on February 25, 2016, an unencrypted laptop computer was stolen from an employee's personal vehicle. CCHCS notified plaintiff that it believed any release of sensitive information was limited to information regarding plaintiff's custody and care between 1996 and 2014. Plaintiff alleges that CCHCS failed to uphold its duty to fully encrypt and password protect its system against loss of data, and plaintiff requests monetary compensation for the privacy breach.
As an initial matter, plaintiff has failed to name a proper defendant. CCHCS is a state agency and therefore not a person under Section 1983. See Will v. Mich. Dept. of State Police, 491 U.S. 58, 71 (1989) ("[N]either a State nor its officials acting in their official capacities are 'persons' under § 1983."). Moreover, plaintiff's attempt to raise a claim pursuant to HIPAA, which requires the confidentiality of medical records, fails because "HIPAA itself does not provide for a private right of action." Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1082 (9th Cir. 2007) ("Under HIPAA, individuals do not have a right to court action."). Thus, plaintiff's HIPAA claim is not cognizable. However, the Ninth Circuit has held that the constitutional right to informational privacy extends to medical information. See Norman- Bloodsaw v. Lawrence Berkeley Lab., 135 F.3d 1260, 1269 (9th Cir. 1998) ("The constitutionally protected privacy interest in avoiding disclosure of personal matters clearly encompasses medical information and its confidentiality.").
Even assuming that plaintiff could substitute an appropriate individual as defendant and that plaintiff could properly bring a claim that his right to informational privacy was violated, the complaint must be dismissed because plaintiff's speculative allegations do not establish that plaintiff has standing.
Federal courts have the power and the duty to raise the issue of standing sua sponte and to dismiss the action if standing is wanting. See Bernhardt v. County of Los Angeles, 279 F.3d 862, 868 (9th Cir. 2002). To have Article III standing, a plaintiff must plead and prove that he has suffered sufficient injury to satisfy the "case or controversy" requirement of Article III of the United States Constitution. See Clapper v. Amnesty Int'l USA, 133 S. Ct. 1138, 1146 (2013) ("'One element of the case-or-controversy requirement' is that plaintiffs 'must establish that they have standing to sue.'") (quoting Raines v. Byrd, 521 U.S. 811, 818 (1997))). To satisfy Article III standing, a plaintiff must therefore allege: (1) injury-in-fact that is concrete and particularized, as well as actual or imminent; (2) that the injury is fairly traceable to the challenged action of the defendant; and (3) that the injury is redressable by a favorable ruling. Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 149 (2010) (citation omitted); Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992).
Although plaintiff has not attached a copy of the notification letter provided to him, a number of lawsuits have been filed in federal district courts in California, making the same allegations of a data breach that plaintiff makes in the instant case. The notification of the potential breach was provided as an attachment in several of those actions and reads as follows:
We do not know if any sensitive information was contained in the laptop. To the extent any sensitive information may have been contained in the laptop, we do not know if the information included any of your information. If your information was included, the
nature of the information may have included confidential medical, mental health, and custodial information. To the extent any sensitive information may have been contained in the laptop, we estimate that it would have been limited to information related to your custody and care, if any, between 1996 and 2014.Fletcher v. Cal. Corr. Health Care Servs., Case No. 16-cv-04187-YGR (PR), 2016 WL 5394125, at *1 (N.D. Cal. Sept. 27, 2016); Seastrunk v. Cal. Corr. Health Servs., Case No. 2:16-cv-1424 AC P, 2016 WL 3549623, at *2 (E.D. Cal. June 30, 2016); Compton v. Cal. Corr. Health Care Servs., Case No. 2:16-cv-1606 AC P, 2016 WL 3916320, at *2 (E.D. Cal. July 20, 2016); Gonzalez v. Matolon, Case No. 2:16-cv-1281 MCE KJN P, 2016 WL 7178519, at *2 (E.D. Cal. Dec. 9, 2016). The notification mirrors plaintiff's allegations that his sensitive information was only potentially subject to a breach because of the theft of the laptop, and demonstrates the speculative nature of plaintiff's claims.
At most, plaintiff only alleges the possibility that his medical information was disclosed. Without more, the alleged injury is entirely speculative. While potential future harm can in some instances confer standing, plaintiff must face "a credible threat of harm" that is "both real and immediate, not conjectural or hypothetical." Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir. 2010) (citations and internal quotation marks omitted). Plaintiff's allegations are based upon a notification which states that it is unknown whether any sensitive information is contained in the laptop and that even if there is sensitive information in the laptop, the scope of the information, including whether any of plaintiff's information is contained therein, is unknown. In other words, whether plaintiff's sensitive information has even been compromised is unknown. Plaintiff cannot state a federal claim for relief based upon the speculative breach of his sensitive information, and the complaint must be dismissed.
Upon finding that a complaint should be dismissed for failure to state a claim, the district court has discretion to dismiss with or without leave to amend. See Lopez v. Smith, 203 F.3d 1122, 1126-30 (9th Cir. 2000) (en banc). Leave to amend should be granted if it appears possible that the defects in the complaint could be corrected, especially if a plaintiff is pro se. Id. at 1130- 31; see also Cato v. United States, 70 F.3d 1103, 1106 (9th Cir. 1995) ("A pro se litigant must be given leave to amend his or her complaint, and some notice of its deficiencies, unless it is absolutely clear that the deficiencies of the complaint could not be cured by amendment."). However, if, after careful consideration, it is clear that a complaint cannot be cured by amendment, the district court may dismiss without leave to amend. See id. at 1105-06. Here, as set forth above, plaintiff lacks standing and thus amendment would be futile because the notification on which his allegations are based establishes only speculative injury that is neither real nor immediate. Because plaintiff lacks standing to pursue his federal claim, the court DISMISSES the complaint in its entirety without prejudice and without leave to amend.
CONCLUSION
The court DISMISSES plaintiff's complaint without prejudice and without leave to amend. The clerk shall terminate all pending motions and close the file.
IT IS SO ORDERED. DATED: 7/26/17
/s/_________
LUCY H. KOH
UNITED STATES DIS RICT JUDGE