A Pennsylvania judge has dismissed a class action arising out of the breach of confidential employee information, adding to a growing body of state courts that have found that negligence claims alleging failure to provide reasonable data security for personal health and other information are not actionable.

Dittman v. UPMC arose out of a data breach of the University of Pittsburgh Medical Center's (UPMC) network, resulting in the theft of sensitive personal information for 62,000 employees, including birthdates, Social Security numbers, confidential tax information, addresses, salaries, and bank account information. Plaintiffs sought to recover damages associated with "imminent identity theft," including the cost of credit monitoring, asserting that UPMC had a common law duty to protect highly sensitive personal and financial information by designing, maintaining, and testing its security systems.

Allegheny County Court of Common Pleas Judge R. Stanton Wettick, Jr. rejected that argument, holding that Pennsylvania law did not recognize such a common law duty, which in the Court's view would need to be created by the state General Assembly. "The legislature is aware of and has considered the issues that plaintiffs want this court to consider. As of this date, the only legislation which the General Assembly has chosen to enact requires entities that suffer a breach of their security systems to provide notification," Judge Wettick wrote. "Furthermore, the legislature gives the Office of Attorney General exclusive authority to bring an action for violation of the notification requirement (i.e., no private actions are permitted)."

The Court also cited the economic loss doctrine, which precludes negligence claims for purely economic losses that do not involve bodily damage or property damage, as a basis for rejecting the plaintiffs' negligence claim.

Dittman is the latest in a line of cases rejecting class actions seeking economic damages arising out of data breaches. The balance of federal case law currently favors dismissal of such actions on the grounds that fear of identity theft is not a sufficient harm to trigger Article III standing. Most state courts examining the issue have found, like Judge Wettick, that there is no common law duty to provide adequate and reasonable data security.

The case, if anything, goes further than other state court decisions analyzing the wisdom of imposing a common law duty to protect sensitive personal information, noting the public policy implications if state courts were to permit such claims to go forward. In particular the Court expressed concern that a ruling in favor of the plaintiffs could result in hundreds of thousands of new lawsuits being filed in Pennsylvania. "Clearly, the judicial system is not equipped to handle this increased caseload of negligence actions," Judge Wettick said. "Courts will not adopt a proposed solution that will overwhelm Pennsylvania's judicial system" and would require defendant companies, victims themselves as the Court noted, to expend substantial resources to defend such claims.

Dittman also differs from other data breach class actions insofar as at least some of the plaintiffs alleged actual identify theft in the form of fraudulent income tax returns. Many courts that have rejected claims for damages arising out of data breaches have nonetheless permitted claims to go forward where the plaintiffs were able to demonstrate actual damages, rather than a speculative fear of identity theft.

Notwithstanding Dittman, the viability of future negligence claims stemming from the loss of sensitive personal information in connection with a data breach remains an open issue in many jurisdictions. The case does not address the viability of consumer fraud or breach of contract claims. Likewise, because the UPMC employment records disclosed in Dittman did not constitute "protected health information" under HIPAA, the Court sidestepped the question of whether HIPAA provides the standard of care for a common law negligence claim. While HIPAA does not provide a private cause of action for statutory violations, several state courts, including the Connecticut Supreme Court in Byrne v. Avery Center for Obstetrics and Gynecology, 2014 WK 5507439, Conn. Nov. 11, 2014, have rejected preemption arguments and allowed plaintiffs to use HIPAA to establish the standard of care in negligence claims.

Ballard Spahr's Privacy and Data Security Group assists clients in complying with regulatory privacy and data security requirements and responding to data breaches. In the event of a breach, members of the Group work with clients to quickly and effectively launch a comprehensive response under the protection of attorney-client privilege, assess the situation, and—if necessary—notify and respond to state, federal, and international regulators.

Attorneys in Ballard Spahr’s Health Care Group represent clients across the health care industry, including clinical laboratories, pharmacies, hospitals, long-term care facilities, insurance companies, and pharmaceutical manufacturers. Our attorneys counsel clients on regulatory, compliance, privacy and data security, transactional, financing, benefits and compensation, and labor and employment matters.

If you have questions about this alert, please contact Privacy and Data Security Practice Leader Philip N. Yannella at 215.864.8180 or yannellap@ballardspahr.com, Privacy and Data Security Practice Leader Daniel JT McKenna at 215.864.8321 or mckennad@ballardspahr.com, or John W. Devine at 215.864.8322 or devinej@ballardspahr.com.

Copyright © 2015 by Ballard Spahr LLP.
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.

Related Practices

Privacy and Data Security
Health Care