Appellate Court Decertifies Henry Ford Privacy Class Action

A Michigan appellate court has rejected certification of a class action lawsuit against Henry Ford Health System and a transcription service, saying that the alleged privacy violations after the medical records of 159 patients were accidentally posted online due to negligence isn’t enough to support the privacy allegations.

The three-judge panel said in its Dec. 18 decision that summary judgement should have been granted by the trial judge to Henry Ford and Perry Johnson & Associates Inc., the transcription service company, and that the privacy lawsuit is being sent back to the trial judge for that purpose. They also reversed the class certification of the lawsuit by the lower court.

The appellate court explained that in Michigan a privacy invasion is based on intention, but in this case the medical records were exposed due to an accidental error by Perry Johnson’s subcontractor.

“Because the undisputed facts in this case indicate nothing more than a negligent disclosure of private information, no material question of fact remains and summary disposition should have been granted regarding plaintiff’s invasion of privacy claim,” the panel wrote.

The class included 159 patients who had visited Henry Ford doctors from June 3, 2008 to July 18, 2008.

The class action lawsuit was filed after there was “an error by Perry Johnson’s subcontractor, Vingspan, that led to the availability of patient records on the Internet.”

As a result of the error, the medical records were searchable via Google. The information available included the patient’s name, medical record number, the date of the doctor visit, location of doctor visit, the doctor’s name and the doctor’s summary of the patient’s visit.

In the case of the lead plaintiff, this information included a diagnosis of the sexually transmitted disease, “cervical dysplasia secondary to HPV (Human Pappillomavirus)” as well as alopecia (baldness).

However, “after Henry Ford learned of the problem, all information was removed from access on the internet, the affected patients were notified, and steps were taken to more adequately protect patient information.”

In addition, the Michigan state appellate court explains that “there is no indication in the lower court record that the information in question was viewed by a third party on the internet or that it was used inappropriately.”

For the purpose of offsetting any damage or injury to patients, Henry Ford had created a “‘hotline’ following the incident, and received no report, through the hotline or otherwise, that patient information had been viewed online or used for identity theft purposes.”

The lead plaintiff admitted during her deposition that she wasn’t aware of anyone seeing or using the medical information during the course of the accidental breach. However, she did claim damages suffered in the form of money spent on identify theft services, totalling $275.

The three judge panel rejected that those costs amount to an injury.

“Plaintiff has not shown that the costs for the credit monitoring services related to a present, actual injury,” the panel explained.

“Absent some indication of present injury to her credit or identity, it is clear that these damages for credit monitoring were incurred in ‘anticipation of possible future injury,” the judges concluded, adding that hypothetical injuries are not recognized by Michigan law.

The anonymous plaintiff charged Henry Ford and Perry Johnson with negligence, invasion of privacy and breach of contract.

The plaintiffs are represented by Hertz Schram PC.

Henry Ford Health System is represented by Kitch Drutchas Wagner Valitutti & Sherbrook.

Perry Johnson is represented by Straub Seamn & Allen PC.

The Henry Ford Health System Privacy Invasion Class Action Lawsuit is Jane Doe v. Henry Ford Health System, et al., Case Nos. 31793 and 31795, in the Court of Appeals for the State of Michigan.