Appeals panel: Threat of ID theft not enough to sustain class action vs. Advocate over stolen computers

A state appeals panel has determined Advocate Health, one of Illinois’ largest health care services providers, cannot be sued by a group of patients who believe their chances of falling prey to identity thieves increased significantly after computers containing their personal information was stolen from Advocate’s offices.

In an unpublished order delivered June 2 under Illinois Supreme Court Rule 23, a three-justice panel of the Illinois Second District Appellate Court upheld the rulings of lower court judges in Lake and Kane counties who had determined the prospective plaintiffs had not suffered significant enough actual injuries to sustain the litigation.

Justice Ann B. Jorgensen delivered the order, with Justices Joseph E. Birkett and Mary Seminara-Schostok concurring.

On July 15, 2013 in Park Ridge, burglars stole four password-protected computers from an Advocate Health and Hospitals Corporation office that contained information on about four million patients. The information included names, addresses, Social Security numbers, health insurance data, diagnoses and Medicare and Medicaid data. The computers have not been recovered.

About a month later, Advocate notified patients of the burglary, set up a call center to field questions about the matter and offered one year of free credit-monitoring services, identity theft resolution help and identity theft insurance.

On Sept. 25, 2013, 18 plaintiffs filed a class-action suit against Advocate in Lake County Circuit Court, followed by two plaintiffs one month later in Kane County. Both suits similarly alleged Advocate violated its obligations to “abide by best practices and industry standards concerning the security of personal information.” Further, plaintiffs charged the computers were unencrypted and not secure, and Advocate did not give timely notification of the security breach. Overall, plaintiffs contended Advocate  “facilitated and allowed the unlawful disclosure of patients’ private and confidential health information.”

Plaintiffs claimed they suffered anguish and pecuniary damages. The Lake County plaintiffs also alleged Advocate intentionally inflicted emotional distress. None of the plaintiffs said the information on the computers had been accessed or used by any unauthorized parties or that plaintiffs suffered identity theft or fraud.

Advocate filed motions to dismiss the suits, arguing plaintiffs lacked standing, because plaintiffs did not say they suffered an actual harm, but only speculated they might suffer harm. The claim that plaintiffs might face an increased risk of identity theft and fraud was conjecture, according to Advocate.

In May 2014, Judge Mitchell L. Hoffman threw out the Lake County suit and on July 10, Judge James R. Murphy did the same with the Kane County case, with both judges making similar observations about the shortcomings of the suits.

The judges said allegations of possible future injury were insufficient and – in the words of Hoffman – plaintiffs did not even assert facts that “would plausibly establish an ‘imminent’ or ‘certainly impending’ risk that they will be victimized.” Also, if harm came to the plaintiffs, it would be through the criminal actions of parties independent of Advocate. As far as the time and expense plaintiffs incurred to reduce the risks of identity theft, Hoffman ruled such costs were undertaken in response to a “speculative threat” and did not qualify as injury.

According to the judges, the suits collapsed, because the claims – including loss of privacy and emotional distress – were built on a missing foundation of actual injury.

The plaintiffs took the dismissals to Second District Appellate Court, where justices upheld the lower court decisions of Hoffman and Murphy, with everything again coming down to lack of a “distinct and palpable injury.”

Justices distinguished between an “increased risk or credible threat of impending harm,” as argued by plaintiffs, and “certainly impending harm,” as required by the most recent U.S. Supreme Court rulings on the question of standing.

Plaintiffs tried to persuade the Appellate Court that Advocate, by merely failing to maintain the privacy of plaintiffs’ personal information, compromised plaintiffs’ privacy and caused an actual injury. However, justices mopped up this argument by repeating that this alleged failure, in and of itself, did not constitute injury, because there was no alleged disclosure to a third party.

The plaintiffs’ attorney in the Lake County suit was Mark F. Slavin, of Chicago and in Kane County was Robert M. Foote, of Geneva. George J. Tzanetopoulos, of Chicago, defended Advocate in both counties.