Barry Rosen, BridgeTower Media Newswires
The United States Supreme Court barred federal courthouse doors to a wide swath of lawsuits complaining about intangible or ephemeral injuries in its May 2016 decision in Spokeo v. Robins. The ruling is already reverberating through health care litigation, as federal courts have since used the reasoning of Spokeo to reject privacy-related lawsuits brought by patients against health care providers.
More specifically the Supreme Court, in Spokeo, ruled that a person must suffer concrete harm to sue in federal court. A bare violation of a statutory right namely, a bare procedural or technical violation of federal law cannot serve as a substitute for the concrete injury required by Article III of the Constitution, which establishes the federal courts. Therefore, without such a concrete injury, a federal court simply does not have the jurisdiction to resolve the matter.
The facts of Spokeo
Spokeo is a "people search" website that aggregates publicly available information without independently verifying the information. Thomas Robins alleged that a search of his name on Spokeo returned inaccurate, albeit not derogatory, information, and he filed a class-action complaint against Spokeo for willful violations of the Financial Credit Reporting Act (FCRA). The FCRA requires consumer reporting agencies to maintain the maximum possible accuracy of its consumer reports.
Court opinion
The Supreme Court ruled that to establish standing to sue under Article III of the Constitution, a person must suffer an "injury in fact." To do so, the harm suffered must be both "particularized," meaning it affects the person in an individual way, and "concrete," meaning the injury is de facto, or actually exists.
The court further held that an intangible harm can be concrete, such as the deprivation of free speech. According to the Supreme Court, when determining whether an intangible harm is concrete, courts should look to whether the intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts. And courts should look to Congress, because Congress is well positioned to determine when an intangible harm meets minimum Article III requirements.
However, Article III standing requires a concrete injury even in the context of a statutory violation, meaning, the bare procedural violation that Robins alleged, in the absence of any concrete harm, did not satisfy the injury in fact requirement of Article III.
Impact on health care
Khan v. Children's Nat'l Health Sys. is a class action, filed in federal court in Maryland. The case involved an allegation that Children's Hospital in Washington, D.C., did not take sufficient steps to protect patient information following a breach of employee email accounts. Hackers gained access to the email accounts, which contained certain patient information, on or about July 26, 2014. However, Children's did not learn of the breach until Dec. 26, 2014, which meant that the information was potentially exposed for five months.
According to the court, Khan's most promising argument for injury in fact was that the breach placed her at increased risk of identity theft. However, because Khan could not show either actual misuse of personal data or intent to misuse the data, the court, relying on Spokeo, recently determined that Khan did not connect the alleged statutory and common law violations to a concrete harm. Therefore, Khan did not sufficiently allege an injury in fact as required to establish Article III standing.
In another class action complaint, Smith v. Facebook, which was filed in federal court in California last March, Facebook users alleged that health care providers violated health privacy laws when they allowed Facebook to access data collected from inquiries made by visitors to the providers' websites.
On June 30, the health care providers and Facebook filed a joint motion to dismiss, arguing that post-Spokeo, the Facebook users had failed to show a concrete harm. According to the health care providers, an allegation that the information that can be gleaned from such inquiries is valuable to advertisers is not a concrete harm sufficient to satisfy Article III's injury in fact requirement. Until the Facebook users can show that someone was willing to pay for their personal information, or that their personal information has lost marketability or value, their alleged harm is merely speculative.
While this area of the law is obviously still evolving, so far, it appears to be adhering to the maxim "no harm, no foul."
-----
Barry F. Rosen is the Chairman & CEO of the law firm of Gordon Feinblatt LLC, heads the Firm's Health Care Practice Group, and can be reached at 410-576-4224 or brosen@gfrlaw.com. Leslie M. Cumber is an associate in Gordon Feinblatt's Health Care Practice Group and can be reached at 410-576-4248 or lcumber@gfrlaw.com.
Published: Tue, Mar 07, 2017
