Facts

Albert Patterson received a letter from Medical Review Institute of America, LCC dated January 7, 2022, informing him that his personal health information and personally identifiable information and/or financial information was involved in a data breach where hackers infiltrated the company's information network and accessed highly sensitive data stored on the network. Patterson filed a complaint against Medical Review Institute of America, LLC alleging Negligence, Invasion of Privacy, Unfair Business Practices, Breach of Confidence, Breach of Implied Contract, Unjust Enrichment, and Confidentiality of Medical Information Act. On June 23, 2022, the court dismissed Patterson's initial complaint for lack of Article III standing and afforded Patterson leave to amend. On July 14, 2022, Patterson filed his first amended complaint.

PLAINTIFF'S CONTENTIONS: Plaintiff alleged that defendant acquired, collected, stored customers personal health information and personally identifiable information to facilitate clinical peer review of healthcare services and failed to take reasonable steps to protect this valuable sensitive information. Plaintiff contended that he suffered a cognizable injury in fact by verifying the legitimacy and impact of the data breach, exploring credit monitoring and identity theft insurance options, and seeking legal counsel regarding his options for remedying the effects of the data breach and that he suffered fear, apprehension, anxiety, and embarrassment as a result of the breach. Moreover, plaintiff argued that he was understandably alarmed by the letter he received from defendant and that he should be compensated for costs and burdens incurred as a reasonable reaction to the risk of harm.

DEFENDANT'S CONTENTIONS: Defendant alleged that plaintiff lacked Article III standing because he failed to establish cognizable injury in fact and that the District of Utah was a more convenient forum. Defendant also contended that none of the information about plaintiff that was potentially exposed in the data breach was sufficiently sensitive to create a credible risk of future fraud or identity theft.

Result

The court granted Medical Review Institute of America, LLC's motion to dismiss for lack of Article III standing.