Michigan Patient Failed to Show Damages For Breach Claims Against Health System

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

Dec. 23 — A trial court should have granted summary judgment in favor of a Michigan health organization whose patient records were posted online because the plaintiff patient failed to demonstrate a present injury, the Michigan Court of Appeals ruled Dec. 18.

In a per curiam opinion, the appeals court reversed and remanded the lower court opinion in the class action.

The appeals court ruled that the identity theft protection services initiated by the named plaintiff in the class action against the Henry Ford Health System “are not cognizable damages in the absence of present injury.”

The conclusion that credit monitoring services can't be recovered as damages following a data breach where there is no evidence of identity theft is consistent with the authority of many other courts, the appeals court said, such as Reilly v. Ceridian Corp., 664 F.3d 38 (3d Cir. 2011).

Patient Records Posted Online

According to the court, defendant Perry Johnson and Associates Inc. provides transcription services for Henry Ford Health Systems, a Detroit-based network of hospitals. An error by Perry Johnson's subcontractor led to the availability of patient records on the Internet, the court said.

The information that was accessible online included patient names, medical record numbers and details of patients' visits with physicians, including a summaries of visits, the court said. In the case of the plaintiff, the information posted online included diagnoses of a sexually transmitted disease and alopecia, or baldness, according to the court.

The named plaintiff initiated a class action against the defendants on behalf of other patients who had doctor's visits at Henry Ford, alleging negligence, breach of contract and invasion of privacy.

A trial court denied motions for summary judgment by Henry Ford and Perry Johnson. The court also decertified a subgroup of the class, reducing its number from 320 to 159. The defendants appealed, and the plaintiff cross-appealed.

No ‘Present, Actual Injury.'

The appeals court reversed the grant of class certification and remanded for entry of summary judgment in favor of Henry Ford and Perry Johnson.

The only actual losses the plaintiff identified were those she incurred to protect against identity theft, the court said. But she failed to show that those credit monitoring service costs “relate to a present, actual injury,” the court said. There is no evidence that her information was viewed on the Internet or used for an improper purpose, it said.

“Absent some indication of present injury to her credit or identity, it is clear that these damages for credit monitoring were incurred in ‘anticipation of possible future injury,' ” the court said.

“Because plaintiff has failed to identify any other damages she wishes to pursue in relation to negligence or breach of contract, she has not shown a material question of fact remains and summary judgment should have been granted in regard to both of these claims,” the court said.

The trial court also should have granted summary judgment on the plaintiff's invasion of privacy claim because the facts don't suggest an intentional disclosure of private information, the appeals court said.

Judges Christopher M. Murray, Henry William Saad and Joel P. Hoekstra served on the panel.

Hertz Schram PC represented the named plaintiff. Kitch Drutchas Wagner Valitutti & Sherbrook PC represented Henry Ford. Pilchak & Cohen PC represented Perry Johnson.

Full text of the court's opinion is available at http://www.bloomberglaw.com/public/document/Doe_v_Henry_Ford_Health_Sys_No_317973_2014_BL_358961_Mich_Ct_App_.