A group of fertility centers can’t completely avoid consumer fraud claims from an Illinois woman who accused them of being slow to act after a data breach exposed personal information of current and former patients.
The woman, identified only as Jane Doe, sued Fertility Centers of Illinois and US Fertility. She said she had a consultation at an FCI office in Hinsdale in October 2011. US Fertility provides platforms and information technology services to FCI. Both companies had a data breach in 2020, exposing names, Social Security numbers and birth dates.
According to Doe, the companies contacted her several months after learning of the breach in September 2020 and offered a year of free access to credit monitoring and identity restoration services. Her lawsuit alleged the companies didn’t properly protect or promptly dispose patient data and failed to give a timely notification of the breach. The complaint includes claims of breach of express and implied contract and fiduciary duty, unjust enrichment, invasion of privacy and violation of the Illinois Consumer Fraud and Deceptive Trade Practices Act.
The companies moved to dismiss Doe’s complaint for lack of standing and failure to state a claim. U.S. District Judge Gary Feinerman ruled on those motions in an opinion issued March 31.
Feinerman said the challenge to Doe’s standing falls short. The companies said she failed to allege an actual injury from the breach or a risk of future harm, but Feinerman said Doe’s claims include “out-of-pocket costs associated with the prevention, detection, recovery and remediation (of) identity theft and fraud.” That the companies offered a year of services, he said, “confirms the reasonableness” patients would have some out-of-pocket mitigation expenses.
He further wrote Doe’s express contract claim against FCI is viable because she alleges signing paperwork under which the company said it would guard and promptly dispose of her data. She also said FCI had a privacy policy that promised to give timely notification of a breach. Feinerman explained he can ascertain what the parties agreed to at the time of her consultation, which is sufficient to defeat the motion to dismiss.
The judge also rejected FCI’s argument, at least so far as to win a dismissal, that it couldn’t have breached a contract because US Fertility suffered the data breach. However, he said Doe’s express contract claim against US Fertility isn’t viable because she didn’t allege knowledge of that company at the time of her FCI consultation.
On the same grounds, Doe’s implied contract claim is viable against FCI, but not against US Fertility. Her unjust enrichment claims, offered as an alternative, also survive against FCI but not against US Fertility for the same reasoning, Feinerman said.
FCI never treated Doe beyond the initial consultation, and so it said she can’t establish its fiduciary duty. Feinerman said that consultation, at the pleading stage, is enough to keep him from affirming the lack of a physician-patient relationship. He rejected her argument USF can be held liable on a partnership or alter ego theory, as Doe never claimed such a relationship with that company.
Feinerman dismissed Doe’s invasion of privacy claims for lacking an allegation of a public disclosure of patient data, but he allowed her consumer fraud allegation to survive because the parties reply brief didn’t contest her request for punitive damages, “thereby forfeiting the point,” he wrote.
Doe has until April 22 to file a second amended complaint.
Doe and the plaintiffs' class are represented by attorneys Patrick J. Solberg and Ross M. Good, of the firm of Anderson+Wanca, of Rolling Meadows.
The fertility centers are represented by attorneys Claudia D. McCarron and Paulyne Gardner, of Mullin Couglin, of Devon, Pennsylvania.