K.A. v. Children's Mercy Hospital

IN THE UNITED STATES DISTRICT COURT FOR THE

WESTERN DISTRICT OF MISSOURI

WESTERN DIVISION

K.A., BY AND THROUGH HER )

NEXT FRIEND B.W. INDIVIDUALLY )

AND ON BEHALF OF ALL OTHERS )

SIMILARLY SITUATED; )

) Case No. 4:18-00514-CV-RK

Plaintiff, )

)

v. )

)

CHILDREN’S MERCY HOSPITAL, )

)

Defendant. )

ORDER

Plaintiff K.A., a minor, by her next friend and mother, B.W., brings this putative class

action for damages against Defendant Children’s Mercy Hospital. Before the Court is a motion

for judgment on the pleadings filed by Defendant. (Doc. 15.) The motion is fully briefed.

(Docs. 16, 22, 23.) Supplemental briefing has been filed and oral argument held on the issue of

Article III standing. (Docs. 29, 30.) For the reasons below, the motion is GRANTED in part.

The Court concludes that Plaintiff’s Complaint fails to state a claim for breach of contract in

Count III. Plaintiff may file a motion for leave to amend the Complaint that complies with Local

Rule 15.1 within thirty days from the date of this Order. (Doc. 27.) If Plaintiff cannot cure the

deficiencies in Count III by an amended complaint, Counts III will be dismissed.

Background

Defendant is a health care provider that offers healthcare and medical treatment services.

As a health care provider, Defendant generates and stores medical records, including Plaintiff’s

medical records, which include sensitive information concerning patients’ treatment and

identification. Defendant posts a notice on its website regarding its privacy practices.1

1 The notice states:

Our Responsibilities

Children’s Mercy Hospital is required to:

• Keep your child’s health information private

• Provide you with a notice (this document) of the hospital’s legal duties and

privacy practices with respect to information it collects and maintains about your child

• Follow the terms of this notice

In March 2017, an employee of Defendant created an unauthorized website that contained

patients’ private treatment and identification information (the “Website”). Two months later,

Defendant sent Plaintiff a letter notifying her of the Website. Plaintiff then filed suit in Missouri

state court on behalf of a putative class asserting the following claims against Defendant: violation

of Missouri’s Merchandising Practices Act (“MMPA”) (Count I), breach of fiduciary duty (Count

II), breach of contract (Count III), negligent training, hiring, and supervision (Count IV), and

negligence (Count V). Defendant removed the case pursuant to this Court’s diversity jurisdiction

under the Class Action Fairness Act, 28 U.S.C. § 1332(d), answered the allegations and now

moves this Court for judgment on the pleadings under Federal Rule of Civil Procedure 12(c).

Discussion

The Court begins by addressing the issue of standing because standing is jurisdictional and

required to open the door to federal court. See Doe v. Chao, 540 U.S. 614, 624-25 (2004). Then,

the Court turns to instant motion in which Defendant challenges the factual and legal sufficiency

of Plaintiff’s state law claims. It is undisputed that Plaintiff’s claims are governed by Missouri

substantive law. See Shady Grove Orthopedic Assocs., P.A. v. Allstate Ins. Co., 559 U.S. 393, 417

(2010) (“[F]ederal courts sitting in diversity apply state substantive law and federal procedural

law.”) (citation and internal quotations omitted).

• Notify you if the hospital is unable to agree to a limit requested by you on

the use or disclosure of your child’s health information

• Try to meet reasonable requests you may have to communicate health

information by other means or at other locations

The hospital reserves the right to change its practices and to be sure the new

practices keep all health information safe. Should the hospital’s health information

practices change, it will post a revised notice on its web page

(www.childrensmercy.org <>), throughout its facilities, and will have copies available

for you to take with you. The hospital will apply any changes to all health information

regardless of when created or received.

The hospital will not use or disclose your child's health information without

your or your child’s permission, except as described in this notice or allowed by law

https://www.childrensmercy.org/HealthInformationPractices/

(Doc. 1-2 at 2-3) (emphasis in original).

I. Standing

Although both parties assert that Plaintiff has standing, the Court is “under an independent

obligation to examine [its] own jurisdiction, and standing is perhaps the most important of the

jurisdictional doctrines.” Nolles v. State Comm. for the Reorganization of Sch. Dists, 524 F.3d

892, 897 (8th Cir. 2008); see Carlsen v. GameStop, Inc., 833 F.3d 903, 908 (8th Cir. 2016) (“[I]f

a plaintiff lacks standing to sue, the district court has no subject-matter jurisdiction.”). “Federal

courts are courts of limited jurisdiction, cabined by the authority granted to them by Article III of

the United States Constitution.” Nolles, 524 F.3d at 897. Article III limits federal courts’

jurisdiction to deciding cases and controversies. U.S. Const. art III, § 2. “One of the controlling

elements in the definition of a case or controversy under Article III is standing.” Id. at 897-98.

(citations and internal quotations omitted). “Constitutional standing requires a showing of: (1) an

injury in fact, which is an invasion of a legally protected interest that is concrete, particularized,

and either actual or imminent; (2) causation; and (3) redressability.” Curry v. Regents of the Univ.,

167 F.3d 420, 422 (8th Cir. 1999).

In this case, the issue implicated by the parties’ briefs is whether Plaintiff suffered an injury

in fact. “A plaintiff who has ‘produced facts indicating it was a party to a breached contract’ has

a judicially cognizable interest for standing purposes, regardless of the merits of the breach

alleged.” Carlsen, 833 F.3d at 909 (citation omitted). Here, in accordance with Eighth Circuit

case law, Plaintiff’s allegations are sufficient to confer Article III standing regarding her breach of

contract claim. Plaintiff alleged that Defendant’s notice constitutes an agreement with its patients.

Plaintiff alleged that Defendant breached its agreement with Plaintiff when it failed to implement

security measures to fulfill its agreement, which resulted in Plaintiff suffering the diminished value

of her bargain. Although the allegations contained in the Complaint are broad and conclusory,

facts establishing the legal conclusion of a valid, enforceable contract are not required to assert

standing in a breach-of-contract claim. Carlsen, 833 F.3d at 909. Further, the Court is bound by

the Eighth Circuit’s admonishment that “[i]t is crucial . . . not to conflate Article III’s requirement

of injury in fact with a plaintiff’s potential causes of action, for the concepts are not coextensive.”2

Id.; see Kuhns v. Scottrade, Inc., 868 F.3d 711, 715-716 (8th Cir. 2017) (analyzing standing for

breach of contract claims in data breach case) (Carlsen is controlling).

2 For this reason, despite addressing standing sua sponte, the Court disagrees with Plaintiff that

Defendant’s motion is essentially a challenge to standing. (Doc. 22 at 9-10.)

The Court further concludes that Plaintiff has standing to bring her other claims. As to the

claim brought under the MMPA, the statute “provides a private right of action to any person who

sustains ascertainable loss in connection with the purchase or lease of merchandise as a result of

certain practices declared unlawful.” Kuhns v. Scottrade, Inc., 868 F.3d 711, 719 (8th Cir. 2017)

(citing RSMo. § 407.025(1)). Here, Plaintiff alleges she overpaid for health care services from

Defendant due to the inadequate protection of her medical records, and she therefore has standing

to bring her claim under the MMPA. (Doc. 1-2 at ¶ 35.) See Carlsen, 833 F.3d at 910 (finding

standing to bring Minnesota consumer protection claim based on similar allegations).

Additionally, for each of her claims, Plaintiff alleges she was injured due to inadequate protection

of her medical records because she thereby lost the benefit of her bargain. See Kuhns, 868 F.3d at

716 (finding standing for breach of contract claims as well as statutory consumer protection claim

after determining that plaintiff had standing regarding his breach of contract claims).3 The Court

now turns to the instant motion for judgment on the pleadings.

II. Motion for Judgment on the Pleadings

A. Legal Standard

“After the pleadings are closed—but early enough not to delay trial—a party may move

for judgment on the pleadings.” Fed. R. Civ. P. 12(c). “A defense of failure to state a claim may

be raised in such a motion, see Fed. R. Civ. P. 12(h), and we employ the same standard that we

would have employed had the motion been brought under Rule 12(b)(6).” St. Paul Ramsey Cty.

Med. Ctr. v. Pennington Cty., 857 F.2d 1185, 1187 (8th Cir. 1988). To survive a motion to dismiss

under Rule 12(b)(6), a complaint must allege “enough facts to state a claim to relief that is plausible

on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is plausible if “the

plaintiff pleads factual content that allows the court to draw the reasonable inference that the

defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009).

3 The Complaint’s allegations of heightened risk of identity theft are insufficient to confer standing

on Plaintiff. Despite Defendant’s characterization (Doc. 29 at 4), Plaintiff does not allege that her personal

information was stolen or actually disclosed to anyone. These allegations are not adequate to demonstrate

that plaintiff faces a “certainly impending” or “substantial risk” of identity theft as a result of the Website.

Alleruzzo, 870 F.3d at 769 (internal quotations omitted). Accordingly, the Court concludes that the

Complaint’s allegations of future injury are speculative, and do not support standing. See Clapper v.

Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (“Although imminence is concededly a somewhat elastic

concept, it cannot be stretched beyond its purpose, which is to ensure that the alleged injury is not too

speculative for Article III purposes--that the injury is certainly impending.”) (emphasis in original); id. at

410 (objectively reasonable likelihood of harm is insufficient).

The Court “accept[s] the well-pled allegations in the complaint as true and draw[s] all reasonable

inferences in the plaintiff’s favor.” Meiners v. Wells Fargo & Co., 898 F.3d 820, 821

(8th Cir. 2018). “[W]here the well-pleaded facts do not permit the court to infer more than the

mere possibility of misconduct, the complaint has alleged—but it has not ‘show[n]’—‘that the

pleader is entitled to relief.’” Iqbal, 556 U.S. at 679; Twombly, 550 U.S. at 570 (factual allegations

must “cross the line from conceivable to plausible”).

B. Breach of Contract Claim (Count III)

“A breach of contract action includes the following essential elements: (1) the existence

and terms of a contract; (2) that plaintiff performed or tendered performance pursuant to the

contract; (3) breach of the contract by the defendant; and (4) damages suffered by the plaintiff.”

Keveney v. Mo. Military Acad., 304 S.W.3d 98, 104 (Mo. banc. 2010). “The elements required to

form a valid contract in Missouri are ‘offer, acceptance, and bargained for consideration.’”

Whitworth v. McBride & Son Homes, Inc., 344 S.W.3d 730, 737 (Mo. App. 2011)

(quoting Johnson v. McDonnell Douglas Corp., 745 S.W.2d 661, 662 (Mo. banc 1988)).

Defendant argues that Plaintiff’s breach of contract claim fails because Plaintiff fails to

plausibly allege the existence of a contract. Plaintiff alleges, in conclusory fashion, that the online

notice of privacy practices posted on Defendant’s website constitutes a contract between her and

Defendant. Plaintiff pleads no facts to show that statements in the notice created a contractual

relationship. Plaintiff pleads no facts to show offer, acceptance, or consideration. Apart from the

notice, Plaintiff does not attach or plead the existence of a contract. Plaintiff fails to allege facts

from which the Court can reasonably infer the existence of a contract between Plaintiff and

Defendant. See Iqbal, 556 U.S. at 678 (plausibility standard asks for more than a sheer possibility

that a defendant has acted unlawfully). In responding to Defendant’s motion, Plaintiff asserts that

a contract was formed when Plaintiff submitted patient data to Defendant, but fails to provide

authority or discussion of the required contract elements to support this position.4 Accepting the

4 Plaintiff appears to be creating contractual terms from the privacy practices notice which

Defendant is required to provide under the privacy regulations of Health Insurance Portability and

Accountability Act of 1996 (“HIPAA”). Compare 45 C.F.R. §§ 164.520(b)(1)(ii)(E), 164.520(b)(1)(v)(A)-

(C), 164.522(b)(1)(i), with Doc. 1-2 at ¶ 10 (Children’s Mercy Hospital is required to . . . Provide you with

a notice (this document) of the hospital’s legal duties and privacy practices with respect to information it

collects and maintains about your child). HIPAA does not create a private right of action but allows patients

to file complaints alleging HIPAA violations with the federal government which could result in the

imposition of money penalties on the violating covered entity (e.g., health care provider), 54 CFR Part 160,

Subpart D. Although a patient can sue over an alleged HIPAA violation and obtain damages for violations

well-pled allegations as true and viewing them in Plaintiff’s favor, Plaintiff fails to plausibly allege

the existence of a contract between Plaintiff and Defendant.5

C. MMPA Claim (Count I)

“The MMPA provides a private right of action to any person who sustains ascertainable

loss in connection with the purchase or lease of merchandise as a result of certain practices declared

unlawful.” Kuhns v. Scottrade, Inc., 868 F.3d 711, 719 (8th Cir. 2017)

(citing RSMo. § 407.025(1)). “The MMPA requires plaintiffs to prove that they . . . suffered an

ascertainable loss of money or property as a result of an act declared unlawful under RSMo. §

407.020.” Binkley v. Am. Equity Mortg., Inc., 447 S.W.3d 194, 198 (Mo. banc. 2014).

Defendant raises two arguments for why Plaintiff’s MMPA claim fails: (1) because

Plaintiff fails to plausibly allege an ascertainable pecuniary loss, and (2) because Plaintiff fails

connect any such loss to an actionable misrepresentation or practice. Neither argument is

sufficiently supported.

First, to determine whether a plaintiff has suffered an ascertainable loss, Missouri courts

apply the benefit-of-the-bargain rule. Kelly v. Cape Cod Potato Chip Co., 81 F. Supp. 3d 754, 758

(W.D. Mo. 2015) (citing Sunset Pools v. Schaefer, 869 S.W.2d 883, 886 (Mo. App. 1994));

Plubell v. Merck & Co., 289 S.W.3d 707, 715 (Mo. App. 2009) (benefit-of-the-bargain rule

applicable in MMPA cases to meet the element of ascertainable loss). Under the benefit of the

bargain rule as applied to MMPA claims, a plaintiff can recover damages for “the difference

between the actual value of the property and what its value would have been if it had been as

represented.” Id.

Here, Plaintiff alleges that Defendant’s privacy practices posted on its website stated that

“[e]fforts to maintain the privacy and confidentiality of medical records are part of the healthcare

services[;]”and that as a result of Defendant’s unlawful practices, she suffered by paying more for

of state laws, the door to federal court is not available in lawsuits where the plaintiff does not have Article III

standing.

5 In addition to arguing insufficient existence of a contract, Defendant also argues that Plaintiff’s

breach of contract claim separately fails for lack of damages. Based on the authority and discussion

presented, Defendant does not persuasively support this argument. Defendant relies on Carlsen v.

Gamestop, Inc., 833 F.3d 903, 907 (8th Cir. 2016). Defendant’s reliance is misplaced because in Carlsen,

the Eighth Circuit affirmed the dismissal of a breach of contract claim based on a 12(b)(6) analysis not for

lack of damages, but because the express terms of the privacy policy, which was the purported contract, did

not encompass the information that was wrongfully disclosed. Id. at 911.

medical record privacy protections than she otherwise would have and by paying for medical

record privacy protections that she did not receive. (Doc. 1-2 at ¶¶ 35, 40.) Accepting the well-

pled allegations as true and viewing them in Plaintiff’s favor, as it must, the Court finds that

Plaintiff has plausibly alleged an ascertainable loss. See Kelly, 81 F. Supp. 3d at 759 (“Plaintiff

need only allege that the actual value of the product as purchased was less than the value of the

product as represented to state a claim for an ascertainable loss.”)

Defendant also argues that Plaintiff’s MMPA claim fails because Plaintiff has not

connected a pecuniary loss to any actionable practice. Based on the authority and discussion

presented, Defendant does not persuasively support this argument. Defendant relies on two district

court decisions: Amburgy v. Express Scripts, Inc., 671 F. Supp. 2d 1046 (E.D. Mo. 2009) (applying

Missouri law) (plaintiff’s MMPA claim fails to state a claim where he does not allege that his loss

was in relation to his purchase) and Cox v. Valley Hope Ass’n, 2016 U.S. Dist. LEXIS 119663

(W.D. Mo. Sep. 6, 2016) (determining that similar allegations of overpayment under an MMPA

claim did not confer standing). Defendant does not, however, discuss how Missouri courts have

construed the MMPA’s requirement that “an unlawful act [must be] committed ‘in connection

with’ the sale.” Conway v. Citimortgage, Inc., 438 S.W.3d 410, 414 (Mo. banc 2014) (citing

RSMo. § 407.020(1)); id. at 416 (concluding that the MMPA’s phrase “in connection with” does

not require a plaintiff to have a direct contractual relationship).

Therefore, Defendant’s motion to dismiss Count I is denied.

D. Common Law Tort Claims (Counts II, IV, and V)

“Any action for negligence requires the plaintiff to establish that . . . the plaintiff’s injury

was proximately caused by the defendant’s failure.” Jarrett v. Jones, 258 S.W.3d 442, 448

(Mo. banc 2008). Similarly, “[t]o prevail on a claim of breach of fiduciary duty, a plaintiff must

show . . . harm.” Brown v. Brown, 530 S.W.3d 35, 41 (Mo. App. 2017). Defendant argues that

Plaintiff’s tort claims fail because Plaintiff has not alleged a compensable injury under Missouri

law for two reasons.

First, Defendant argues that Plaintiff’s damages theory of heightened future risk of identity

theft fails as a matter of law. This argument is now moot because the argument is merits-based,

however, the Court has determined that the Complaint’s allegations of heightened risk of identity

theft are insufficient to confer standing on Plaintiff. See supra note 3. Therefore, Plaintiff cannot

pursue this relief.

Second, Defendant argues that Plaintiff’s damages theory of lost benefit of the bargain is

barred by Missouri’s economic loss doctrine. “The economic loss doctrine prohibits a party from

seeking to recover in tort for economic losses that are contractual in nature.” Graham Constr.

Servs. v. Hammer & Steel Inc., 755 F.3d 611, 616 (8th Cir. 2014) (citation and internal quotations

omitted). However, Defendant’s economic loss doctrine argument is inapplicable because as

determined above in section II.B, Plaintiff has not plausibly pled a breach of contract claim. The

Court notes that were the economic loss doctrine to apply, Defendant does not address the

exception to the economic loss doctrine relied on by Plaintiff. See Web Innovations & Tech. Servs.

v. Bridges to Dig. Excellence, Inc., 69 F. Supp. 3d 928, 932 (E.D. Mo. 2014) (citing Bruce Martin

Constr., Inc. v. CTB, Inc., No. 1:10CV205 SNLJ, 2012 WL 718624, at *3 (E.D. Mo. Mar. 6, 2012))

(exception to the economic loss doctrine where tort claims either involve a fiduciary relationship

or rendering of professional services).

Moreover, regarding Plaintiff’s tort claims, Plaintiff has also pleaded that she has suffered

other damages including embarrassment, humiliation, and loss of enjoyment of life. Defendant

does not address or challenge these alleged damages. Therefore, Defendant’s motion to dismiss

Plaintiff’s tort claims in Counts II, IV, and V is denied.6

6 The Court is allowing the common law tort claims to go forward. In doing so, the Court recognizes

that although proof of monetary damages may not be required for a breach of fiduciary duty claim,

see Fierstein v. Depaul Health Ctr., 24 S.W.3d 220, 224 (Mo. App. 2000), Plaintiff has not persuasively

argued her position that she can claim presumed damages. For instance, Plaintiff cites Munden v. Harris,

134 S.W. 1076, 1077-1078 (Mo. App. 1911) and Y.G., et al. v. Jewish Hospital of St. Louis, 795 S.W.2d

488, 500 (Mo. App. 1990), which involve the tort of invasion of privacy, which is a separate from

negligence, Hyde v. City of Columbia, 637 S.W.2d 251, 267 (Mo. App. 1982). Plaintiff also cites cases that

recognize the existence and elements of a cause of action for a physician or healthcare provider’s wrongful

disclosures of medical information. Brandt v. Med. Def. Assocs., 856 S.W.2d 667, 674 (Mo. 1993) (“a

physician has a fiduciary duty of confidentiality not to disclose any medical information received in

connection with the treatment of the patient”); Fierstein v. Depaul Health Ctr., 24 S.W.3d 220, 224

(Mo. App. 2000) (breach of fiduciary duty claim against healthcare provider where plaintiff’s medical

records were disclosed to a third party without plaintiff’s authorization). First, Plaintiff does not allege that

her personal information was stolen or actually disclosed to anyone. Assuming arguendo that Plaintiff had

plead an actual disclosure, none of the cases support that wrongful disclosure of medical information, in

and of itself, gives rise to a cognizable theory of damages under Missouri law. In fact, the Court of Appeals

in Fierstein upheld a verdict director which required proof that “as a direct result of such disclosure,

[p]laintiff suffered damage.” 24 S.W.3d at 226.

Conclusion

Defendant’s motion for judgment on the pleadings is therefore GRANTED in part.

(Doc. 15.) The Court concludes that Plaintiff’s Complaint fails to state a claim for breach of

contract in Count III. Plaintiff may file a motion for leave to amend the Complaint that complies

with Local Rule 15.1 within thirty days from the date of this Order. (Doc. 27.) If Plaintiff cannot

cure the deficiencies in Count III by an amended complaint, Count III will be dismissed.

IT IS SO ORDERED.

s/ Roseann A. Ketchmark

ROSEANN A. KETCHMARK, JUDGE

UNITED STATES DISTRICT COURT

DATED: May 16, 2019