Advocate Health Data Breach Class Action Sent to State Court

A U.S. district judge has tossed out the federal law violations alleged in an Advocate Health data breach class action lawsuit, ruling that the allegations of Fair Credit Reporting Act violations did not apply to a hospital system.

In the original Advocate Health lawsuit, several patients who were treated or tested at Advocate Health facilities in Illinois alleged that the company should have taken better care in securing their personal information prior to the July 15, 2013 theft of four desktop computers. They reportedly contained such information as names, addresses, dates of birth, Social Security numbers, treating physician and/or departments for each patient, their medical diagnosis, medical record numbers, medical services codes, and health insurance information.

However, the order granting the motion to dismiss notes that to have Article III standing to pursue a federal lawsuit, an injury-in-fact must be alleged. In the case of identity fraud from a data breach, plaintiffs and their class action lawyers must either demonstrate the likelihood of imminent harm or an actual injury. Instead, the judge wrote that several of the plaintiffs “alleged only a speculative fear of harm that someone could have bought and sold their personally identifiable information.”

U.S. District Judge Charles Ronald Norgle also agreed with Advocate Health that the company did not meet the definition of a credit reporting agency per the FCRA’s statutory language, which does include assembling “consumer credit information or other information on consumers.” However, the company does not do so for the benefit of third parties or participate in interstate commerce to do so.

He also cited case law stating that the Fair Credit Reporting Act “does not impose obligations upon a creditor who merely passes along information concerning particular debts owed to it.” Since the computers were stolen, Advocate did not actively participate in the data breach. Other cases have similarly found trouble incorporating the FCRA to establish standing in federal court and to pursue class action status.

The rest of the class action lawsuit will be remanded to state court in Illinois regarding claims of negligence and invasion of privacy by public disclosure of private facts.

The plaintiffs are represented by class action lawyers from Barnow and Associates PC, Coffman Law Firm, the Law Office of Aron D. Robinson and the Law Offices of Kevin Rogers.

The Advocate Health Data Breach Class Action Lawsuit is Tierney, et al., v. Advocate Health and Hospitals Corp., Case No. 13-cv-06237 in U.S. District Court for the Northern District of Illinois.