Negron v. Ascension Health

UNITED STATES DISTRICT COURT

EASTERN DISTRICT OF MISSOURI

EASTERN DIVISION

ANGEL JOEL GUSMAN NEGRON, et al., )

)

Plaintiffs, )

) Case No. 4:24-CV-00669-JAR

vs. )

)

ASCENSION HEALTH, et al., )

)

Defendants. )

MEMORANDUM AND ORDER

This matter is before the Court on Defendant’s motion to dismiss Plaintiffs’ claims in this

putative class action arising from a healthcare system data breach. For the reasons set forth

below, the motion will be granted in part and denied in part.

BACKGROUND

Defendant Ascension Health and two affiliated companies1 (collectively, Ascension)

comprise a Missouri-based Catholic non-profit healthcare system of 140 hospitals serving 19

states. Plaintiffs were Ascension patients on May 8, 2024, when its technology network suffered

a ransomware attack wherein hackers copied electronic files containing patients’ protected health

information (PHI) and personally identifiable information (PII). The next day, Ascension posted

a notice to its website disclosing a cybersecurity event and describing its response, involving

investigation and remediation with expert third-party assistance.

1 The three related Defendants in this case are Ascension Health, its sister company Ascension

Health-IS Inc. d/b/a Ascension Technologies, and their parent company Ascension Health Alliance.

Ascension summarily contends that the Alliance and Technologies entities should be dismissed from the

complaint. But Plaintiffs plead all allegations as to all Defendants. Their respective roles in the events of

this case is a matter properly reserved for discovery. To the extent Ascension’s argument could be

construed as a motion to dismiss these defendants, it will be denied.

On May 14, 2024, Plaintiffs filed this putative class action asserting claims of negligence

(Count I), negligence per se (Count II), breach of implied covenant of good faith and fair dealing

(Count III), and unjust enrichment (Count IV) and seeking various forms of injunctive relief and

monetary damages. In October 2024, Plaintiffs filed an amended complaint asserting seven

claims on behalf of a nationwide class and 11 state law claims specific to seven state subclasses.

The proposed nationwide class consists of:

All United States residents whose Personal Information was compromised in the

Data Breach discovered by Ascension in May 2024, including all those

individuals who receive notice of the breach.

The seven proposed subclasses consist of residents of Arkansas, Florida, Illinois, Indiana,

Michigan, Oklahoma, and Wisconsin, respectively. Plaintiffs assert the following counts:

Nationwide Class

I. Negligence

II. Negligence per se

III. Breach of Express Contract

IV. Breach of Implied Contract

V. Unjust Enrichment (in the alternative to breach of implied contract)

VI. Invasion of Privacy

VII. Missouri Merchandising Practices Act, Mo. Rev. Stat. § 407.010

Sub-classes

VIII. Arkansas Deceptive Trade Practices Act, Ark. Code §§ 4-88-101

IX. Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. §§ 501.201

X. Illinois Personal Information Protection Act, 815 Il. Comp. Stat. § 530/1

XI. Illinois Consumer Fraud and Deceptive Business Practices Act, 815 Il. Comp. Stat.

§ 505

XII. Oklahoma Consumer Protection Act, Okla. Stat. tit. 15 § 751

XIII. Wisconsin Breach of Confidentiality of Health Records Act, Wis. Stat. § 146.81

XIV. Wisconsin Deceptive Trade Practices Act, Wis. Stat. § 100.18

XV. Wisconsin Notice of Unauthorized Acquisition of Personal Information Act, Wis.

Stat. § 134.98(2)

XVI. Michigan Identity Theft Protection Act, Mich. Comp. Laws § 445.72

XVII. Michigan Consumer Protection Act, Mich. Comp. Laws § 445.903

XVIII. Indiana Deceptive Consumer Sales Act, Ind. Code §§ 24-5-0.5-0.1

Common Facts

The central facts in the complaint common to all counts can be summarized as follows. In

connection with the provision of medical services, Ascension creates and stores patients’ medical

records containing PHI and PII. The Health Insurance Portability and Accountability Act

(HIPAA) requires regulated entities like Ascension to maintain appropriate administrative,

technical, and physical safeguards to protect the privacy of PHI and safeguard it from improper

disclosure. 45 C.F.R. § 164.530(c). Among HIPAA’s extensive standards and implementation

specifications, Plaintiffs invoke the following regulations (paraphrased) requiring providers to:

1. Ensure the confidentiality, integrity, and availability of electronic PHI; protect against

any reasonably anticipated threats or hazards to the security or integrity of such

information or impermissible use thereof; and ensure compliance by its workforce. 45

C.F.R. § 164.306.

2. Implement policies and procedures to prevent, detect, contain, and correct security

violations; conduct risk assessments; implement security measures to reduce risks and

vulnerabilities to a reasonable and appropriate level to comply with § 164.306; and

implement procedures to regularly review records of information system activity, such as

audit logs, access reports, and security incident tracking reports. 45 C.F.R.

§ 164.308(a)(1).

3. Implement security awareness and training programs for the workforce, including

security reminders and updates, protection from malicious software, log-in monitoring,

and password management. 45 C.F.R. § 164.308(a)(5).

4. Implement security incident procedures, including identifying, responding to, and

reporting suspected or known security incidents and mitigating the impact. 45 C.F.R.

§ 164.308(a)(6).

5. Implement technical policies and procedures for electronic information systems that

maintain electronic PHI to allow access only to those persons or software programs that

have been granted access rights. 45 C.F.R. § 164.312(a)(1).

Ascension’s HIPAA Notice of Privacy Practices states in pertinent part:

Our Commitment

We are committed to maintaining the privacy and confidentiality of your health

information. This Notice describes your rights concerning your health information

and how we may use and disclose (share) your information.

* * *

Our Responsibilities

• We are required by law to maintain the privacy and security of your health

information.

• We will notify you if a breach occurs that may have compromised the privacy

or security of your identifiable health information.

Additionally, Plaintiffs invoke as industry standards guidance contained in a Federal

Trade Commission (FTC) publication titled Protecting Personal Information: A Guide for

Business.2 The FTC uses its enforcement powers under the Federal Trade Commission Act

(FTCA), 15 U.S.C. § 45, to bring actions against businesses for unfair and deceptive data privacy

and security practices. The business guide advises companies to inventory, limit, protect, and/or

dispose of personal information, understand network vulnerabilities, and implement adequate

security policies. It advises entities to limit the retention of and access to sensitive data, encrypt

transmissions, update firewalls and malware programs, use authentication systems, require

complex passwords, train employees on IT security, use intrusion detection systems, monitor

network activity, and create data breach response plans.

Plaintiffs allege that, at the time of the data breach, Ascension maintained its computer

systems without encryption and other essential security measures, inconsistent with the foregoing

industry standards. As a result, cybercriminals were able to hack into Ascension servers and

2 Protecting Personal Information: A Guide for Business | Federal Trade Commission,

https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business (last

visited September 23, 2025) [https://perma.cc/YXF8-4Q9C].

access patient files, thereby exposing patients to identity fraud. Plaintiffs further plead that

Ascension was negligent in failing to maintain adequate security, protect patient information,

monitor its IT systems for intrusions, train its employees to avoid phishing, comply with FTC

cybersecurity guidelines and HIPAA, and adhere to industry standards. Consequently, Plaintiffs

face an imminent and ongoing risk of fraud and identity theft that was well-known and

foreseeable.

Named Plaintiffs

Thirteen named Plaintiffs allege the following common facts.3 Each Plaintiff was an

Ascension patient at the time of the breach. To obtain treatment, they were required to provide

PII/PHI, including name, date of birth, address, and social security number (SSN). Each Plaintiff

received a copy of Ascension’s Notice of Privacy Practices. As a result of the breach, they must

now take precautions to mitigate its impact by monitoring accounts for fraudulent activity and

checking credit reports. They must also manage spam calls, text messages, and emails. These

actions consume time and cause stress. Had they known of Ascension’s inadequate security, they

wouldn’t have provided their information. They suffered actual injuries in the form of invasion

of privacy, theft and lost value of PII/PHI, time lost mitigating the effects, the cost of lifetime

credit monitoring, the certain ongoing risk to their PII/PHI, lost benefit of bargain, nominal and

statutory damages, and emotional stress.

3 A fourteenth individual, Tiffany Farrand, is named as a Plaintiff for the Wisconsin subclass and

in corresponding Counts XIII-XV, but there is no mention of her in the Factual Allegations section of the

complaint. As such, Ms. Farrand’s claims will be dismissed. The Wisconsin subclass remains represented

by another named Plaintiff, Jill Radley.

Additionally, eleven of the thirteen named Plaintiffs allege the following individual

injuries from the breach.

1. Alma Croft of Alabama was notified by her credit monitoring service that her

PII/PHI was disseminated on the dark web. Doc. 52 ¶ 103.

2. Vikesha Exford of Alabama has incurred fraudulent charges on her bank account,

requiring her to lock the account and request a new debit card. She temporarily lost her car

insurance because her premium payment bounced while her account was locked, causing her to

incur $65 in fees. She also received notice from her credit monitoring service that her email

address and SSN were compromised. ¶ 130.

3. Courtney Brown of Florida has noted unrecognized items on her credit report

since the breach. Further, she was scheduled for surgery on the day of the breach, but the

procedure could not be performed. ¶¶ 156, 162.

4. Mattie Boyden of Illinois received notice that her PII/PHI were on the dark web,

and she has experienced an increase in spam calls, texts, and emails since the breach. ¶ 171.

5. Michael Cunningham of Kentucky received notice that his PII/PHI were on the

dark web. He has seen fraudulent activity on his accounts and an increase in spam calls, texts,

and emails since the breach. Further, he was forced to reschedule a medical procedure at a

different hospital. ¶¶ 185, 187.

6. Leah Willis of Michigan was scheduled for a surgery that was postponed due to

the breach, leaving her in pain in the interim. ¶ 200.

7. Cheryl Hayes of Oklahoma received notice that her PII/PHI were on the dark

web, and she has seen an increase in spam calls, texts, and emails since the breach. She also

experienced delay and difficulty refilling prescriptions. ¶¶ 214, 220.

8. Christina McClellan has seen an increase in spam calls, texts, and emails since the

breach, personalized to her. ¶ 229.

9. Donald Pitchers of Indiana was unable to timely obtain insulin for his diabetes,

forcing him to ration his supply. He was also informed that his PII/PHI were on the dark web.

¶¶ 243-244.

10. George Gounaris of Indiana was notified that his PII or PHI was found on the

dark web. ¶ 257.

11. Jill Radley of Wisconsin incurred large withdrawals from her bank account and

related overdraft fees. She has also seen an increase in spam calls, texts, and emails since the

breach, personalized to her and related to her health issues. ¶ 271.

The breach occurred May 8, 2024. In December 2024, Ascension began notifying

consumers that the compromised files included patients’ names, birth dates, addresses, medical

records, payment information (e.g. credit card and bank account numbers), insurance

information, and government identification (e.g. social security, driver’s license, and passport

numbers). (Doc. 64 at 13 n.1).4 The notice offered mitigation in the form of 24 months of credit

monitoring, a $1 million insurance policy, and identity theft recovery services.

Ascension now moves to dismiss the complaint for lack of subject matter jurisdiction

under Rule 12(b)(1), Fed. R. Civ. P., arguing that Plaintiffs suffered no actual injury caused by

the attack and therefore lack standing to sue. Alternatively, Ascension seeks to dismiss the

complaint under Rule 12(b)(6) on various theories of unviability specific to each claim.

Plaintiffs contend that their alleged injuries attributable to the breach – e.g., financial fraud, lost

time, nuisance, intrusion, and ongoing vulnerability – establish standing and that their pleadings

are sufficient to state a claim for relief under each theory asserted.

JURISDICTION

Rule 12(b)(1)

Rule 12(b)(1) permits a party to move for dismissal for lack of subject matter jurisdiction.

The existence of subject matter jurisdiction is a question of law. Carlsen v. GameStop, Inc., 833

F.3d 903, 908 (8th Cir. 2016). When a motion to dismiss for lack of subject matter jurisdiction is

brought at the pleading stage, the Court reviews it as a facial attack on jurisdiction. In this

posture, the Court restricts itself to the face of the pleadings, accepting the allegations as true and

drawing all inferences in the plaintiffs’ favor. In re SuperValu, Inc., 870 F.3d 763, 768 (8th Cir.

4 Office of the Maine AG: Consumer Protection: Privacy, Identity Theft and Data Security

Breaches, https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-

a1252b4f8318/e55264f2-ff87-4b28-874d-653cfb735fe6.html (last visited September 23, 2025).

2017).

If a plaintiff has no standing, then the district court has no subject matter jurisdiction, and

the case must be dismissed pursuant to Rule 12(b)(1). ABF Freight Sys., Inc. v. Int'l Broth. of

Teamsters, 645 F.3d 954, 958 (8th Cir. 2011). “Standing to sue is a doctrine rooted in the

traditional understanding of a case or controversy.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338

(2016). A plaintiff must demonstrate “that she has suffered an injury fact that is fairly traceable

to the defendant's conduct and that is likely to be redressed by the relief she seeks.” In re

SuperValu, Inc., 870 F.3d at 768 (citing Spokeo). “To establish an injury in fact, a plaintiff must

show that her injury is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or

hypothetical.’” Id. When claiming future injuries, a plaintiff must demonstrate that the threatened

injury is “certainly impending” or that there is a “substantial risk” that the harm will occur. Id. at

769.

These requirements apply to putative class actions. Id. at 768. Plaintiffs must demonstrate

standing for each claim and for each form of relief they seek. Murthy v. Missouri, 603 U.S. 43,

61 (2024).

Nationwide Class Standing

Ascension contends that Plaintiffs have not sufficiently pleaded actual injury or causation

to establish standing. More specifically, it asserts that (1) Plaintiffs fail to connect bank and

credit irregularities, spam, or dark web notices to the breach such that these harms are “fairly

traceable” to it, (2) there are no claims of actual identity theft, and the risk of future theft is

speculative and also minimal given Ascension’s corrective measures, and (3) the personal

impacts of the breach identified in the complaint – the invasion of privacy, lost value of personal

information, lost benefit of bargain, time spent mitigating and monitoring accounts and credit

reports, and the resulting stress and anxiety – aren’t cognizable injuries to create standing.

In response, Plaintiffs contend that all of the foregoing are adequately pleaded and

cognizable injuries fairly traceable to Ascension for purposes of standing. In reply, Ascension

concedes that suspicious bank and credit activity constitutes identity theft but maintains that

Plaintiffs fail to connect those incidents to the breach.

Plaintiffs claim both present and future injuries. Some present injuries depend on the risk

of future injury. For instance, time and money spent on monitoring and mitigation are cognizable

only when the risk of future injury is substantial. In re SuperValue, 870 F.3d at 771. “In other

words, this allegation is not in itself an injury in fact unless there is also a substantial risk of

future injury in fact.” Pulliam v. W. Tech. Grp., LLC, 2024 WL 356777, at *8 (D. Neb. Jan. 19,

2024). Likewise, emotional stress from a fear of a future harm is cognizable only when tethered

to a substantial risk. Id. at *10. Plaintiffs “cannot manufacture standing merely by inflicting harm

on themselves based on their fears of hypothetical future harm that is not certainly impending.”

Murthy, 603 U.S. at 73. As such, the Court first examines the risk of future harm.

Future Injury

In SuperValu, hackers gained access to the plaintiffs’ bank card information only. The

Eighth Circuit held that the risk of future harm wasn’t substantial or imminent in that case

because bank card information alone isn’t enough to open unauthorized new accounts. 870 F.3d

at 770-71. The court specifically distinguished the scenario where stolen information includes

PII such as SSNs, birth dates, and driver’s license numbers, reasoning that the type of data

compromised can determine the potential harm. Id. at 770. In cases where precisely such highly

exploitable PII was compromised, and some plaintiffs experienced actual instances of identity

theft, other circuits have readily found a substantial risk of future injury for all plaintiffs. Webb v.

Injured Workers Pharmacy, LLC, 72 F.4th 365, 376 (1st Cir. 2023); In re Equifax Inc. Customer

Data Sec. Breach Litig., 999 F.3d 1247, 1263 (11th Cir. 2021). Consistent with that rationale,

this Court and others in the Eighth Circuit recognize a substantial risk of future injury when a

data breach involves SSNs and birth dates. See, e.g., Mackey v. Belden, Inc., 2021 WL 3363174,

at *5 (E.D. Mo. Aug. 3, 2021); Berry v. Crescent Cmty. Health Ctr., 2025 WL 1287909, at *5

(N.D. Iowa May 2, 2025); Perry v. Bay & Bay Transportation Servs., Inc., 650 F. Supp. 3d 743,

751 (D. Minn. 2023); Coffey v. OK Foods Inc., 2022 WL 738072, at *3 (W.D. Ark. Mar. 10,

2022); Weisenberger v. Ameritas Mut. Holding Co., 597 F. Supp. 3d 1351, 1359 (D. Neb. 2022);

In re Pawn Am. Consumer Data Breach Litig., 2022 WL 3159874, at *3-4 (D. Minn. Aug. 8,

2022). Some courts have found the risk of future injury too speculative in the absence of

pleadings alleging actual fraudulent activity. Duqum v. Scottrade, Inc., 2016 WL 3683001, at *4

(E.D. Mo. July 12, 2016); Pulliam, 2024 WL 356777, at *7; C.C. v. Med-Data Inc., 2022 WL

970862, at *7 (D. Kan. Mar. 31, 2022).

Here, considering the nature of PII compromised, combined with multiple concrete

incidents of suspicious bank and credit activity and dark web exposure after the breach, the Court

finds the risk of future injury sufficiently substantial to establish standing. Further, given this real

risk of future harm, Plaintiffs’ dependent claims regarding time and money spent on mitigation

and monitoring also confer standing. SuperValu, 870 F.3d at 774; Webb, 72 F.4th at 376-77; In

re Equifax, 999 F.3d at 1263; Mackey, 2021 WL 3363174, at *5; Berry, 2025 WL 1287909, at

*5. For the same reason, Plaintiffs have standing to pursue injunctive relief requiring Ascension

to secure their information and provide mitigation services going forward. Mackey, 2021 WL

3363174, at *12.

Present Injury

Plaintiffs’ present injuries vary in nature. Specific instances of fraudulent bank and credit

activity are actual and concrete injuries. See, e.g., SuperValu, 870 F.3d at 772 (fraudulent credit

card charge); Mackey, 2021 WL 3363174, at *4 (fraudulent tax return); Pawn, 2022 WL

3159874, at *4 (bank activity). Though Ascension contends that isolated incidents of suspicious

bank or dark web activity could be attributed to other causes, Plaintiffs plead that these events

occurred after and as a result of the breach and believe that their injuries are traceable to it. The

Court accepts the pleadings as true at this early stage and finds them sufficient to entitle

Plaintiffs to discovery on the issue. The Court also accepts at this stage that disruptions in

medical care are cognizable for purposes of standing. Ascension’s argument to the contrary is

unpersuasive.5

However, Plaintiffs’ alleged injuries in the form of spam calls, texts, and emails are not

fairly traceable to Ascension. Phone numbers and email addresses weren’t identified in the

pleadings or public notices as types of PII compromised in the breach. Even if they were – and

one would assume Ascension had them – such basic contact information can be obtained from

any number of sources. To the extent Plaintiffs claim lost time or nuisance as a result of spam,

the Court finds the connection to this data breach too speculative to establish standing entitling

Plaintiffs to any form of relief. See Berry, 2025 WL 1287909, at *5 (where the pleadings didn’t

link spam to the breach).

5 Ascension cites two out-of-circuit cases that are inapposite. Thomas v. Baker involved a pro se

plaintiff claiming injury from a delay in medical treatment attributable to the governor’s executive orders

issued in response to the acute stage of the COVID-19 pandemic. Thomas v. Baker, 2020 WL 6870994, at

*1 (D. Mass. Nov. 23, 2020). In Crumb v. Orthopedic Surgery, the court’s finding that the plaintiff

suffered no injury from delayed treatment was made at the summary judgment stage on a full record.

Crumb v. Orthopedic Surgery Med. Grp., 2010 WL 11509292, at *6 (C.D. Cal. Aug. 18, 2010).

Benefit of Bargain

Next, in connection with their contract and MMPA claims, Plaintiffs allege harm from

the lost benefit of their bargain with Ascension. With respect to this theory, the Court must be

careful not to conflate the injury requirement for standing with the substance of Plaintiffs’ cause

of action. “A party to a breached contract has a judicially cognizable interest for standing

purposes, regardless of the merits of the breach alleged.” Kuhns v. Scottrade, Inc., 868 F.3d 711,

716 (8th Cir. 2017) (citation omitted). Mindful of this distinction, the Court accepts Plaintiffs’

pleading that a contract existed and thus they have standing to claim this injury. See also Berry,

2025 WL 1287909, at *7; Harris v. Mercy Health Network, Inc., 2024 WL 5055556, at *8 (S.D.

Iowa June 26, 2024) (recognizing plaintiffs’ standing to assert contract claims based on a

hospital’s privacy policy but dismissing them on the merits); K.A. by & Through B.W. v.

Children's Mercy Hosp., 2019 WL 2144815, at *3-5 (W.D. Mo. May 16, 2019) (accepting

breach of contract and MMPA pleadings for purposes of standing but dismissing contract claim

on the merits).

Invasion of Privacy

Opinions diverge as to whether a data breach confers standing to claim an invasion of

privacy. The district courts in Berry and Pawn concluded without analysis that it does. See also

Medoff v. Minka Lighting, LLC, 2023 WL 4291973, at *3 (C.D. Cal. May 8, 2023) (analogizing

the claim to the common law tort of public disclosure of private facts). Conversely, a court in

this district found that a loss of privacy isn’t a concrete and particularized harm for purposes of

standing. Duqum, 2016 WL 3683001, at *8. Accord, C.C. v. Med-Data, 2022 WL 970862, at

*10 (acknowledging that every data breach involves a loss of privacy but finding that the loss

isn’t concrete, citing Duqum). Other courts have reached the same result for different reasons

touching on the merits. Pulliam, 2024 WL 356777, at *9 (referring to common law elements and

finding that the information wasn’t technically published, didn’t concern the plaintiffs’ private

life, and wasn’t highly offensive); In re Practicefirst Data Breach Litig., 2022 WL 354544, at *8

(W.D.N.Y. Feb. 2, 2022) (reasoning that the facts didn’t fit the common law elements and the

loss of privacy was too abstract).

This Court finds logic across the spectrum but again must distinguish standing from

substance. There is no dispute that Plaintiffs lost the security of highly sensitive personal

information as a result of this data breach. To the extent Plaintiffs plead emotional harm from

this violation, this is a long-recognized injury flowing from an invasion of privacy. Pawn, 2022

WL 3159874, at * 4 (collecting cases). As such, the Court finds that Plaintiffs at least have

standing to assert this claim. The Court reserves for the merits whether the present facts fit the

common law elements to state a claim.

Lost Value of PII

Here, too, opinions vary as to whether plaintiffs suffer a cognizable loss of value of their

PII as a result of a data breach. Some districts in this circuit have assumed without much

examination that it does. See, e.g., Perry, 650 F. Supp. 3d at 757; Hall v. Centerspace, LP, No.

22-CV-2028 (KMM/DJF), 2023 WL 3435100, at *8 (D. Minn. May 12, 2023); Rodriguez v.

Mena Hosp. Comm'n, 2023 WL 7198441, at *6 (W.D. Ark. Nov. 1, 2023). Conversely, in

Duqum, the court found no injury because the information had no market value. Duqum, 2016

WL 3683001, at *7. Accord, Taylor v. UKG, Inc., 693 F. Supp. 3d 87, 101 (D. Mass. 2023)

(reasoning that plaintiffs had not attempted to sell their data and received a lower price). In

Pulliam, the court acknowledged the practical value of personal information but found no

traditional analogue at common law and thus deemed the loss insufficiently concrete to confer

standing. Pulliam, 2024 WL 356777, at *8. In this Court’s view, the practical value is

significant.

Plaintiffs offer a useful analysis in In re Marriott Int'l, Inc., Customer Data Sec. Breach

Litig., 440 F. Supp. 3d 447 (D. Md. 2020). There, the data breach involved the theft of hotel

guests’ personal and payment information. Finding a cognizable injury in fact, the court

explained that the value of the information isn’t derived from its worth in an “imagined

marketplace” but rather in the economic benefit of being able to purchase goods and services

remotely and electronically.

[The Court should not] ignore what common sense compels it to acknowledge – the

value that personal identifying information has in our increasingly digital economy.

Many companies … collect personal information. Consumers, too, recognize the

value of their personal information and offer it in exchange for goods and services.

… Further, the value of personal identifying information is key to unlocking many

parts of the financial sector for consumers. Whether someone can obtain a mortgage,

credit card, business loan, tax return, or even apply for a job depends on the integrity

of their personal identifying information. Here Plaintiffs allege that they suffered

lower credit scores as a result of the data breach and that fraudulent accounts and

tax returns were filed in their names. Similarly, the businesses that request (or

require) consumers to share their personal identifying information as part of a

commercial transaction do so with the expectation that its integrity has not been

compromised.

Id. at 462 (cleaned up). The Court finds this rationale logical and persuasive. The fact that certain

intangible damages don’t lend themselves to precise market valuation doesn’t render the injury

any less real to the victim of a data breach. See also Gordon v. Zeroed-In Tech., LLC, 2025 WL

936415, at *7 (D. Md. Mar. 26, 2025) (reasoning that the breach impeded plaintiffs’ ability to

participate in the economy). The Court finds that the lost value of Plaintiffs’ information is a

concrete injury in fact for purposes of standing.

SUFFICIENCY OF THE COMPLAINT

Rule 12(b)(6)

To survive a motion to dismiss under Rule 12(b)(6), “a complaint must contain sufficient

factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft

v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 554, 570

(2007)). A claim is facially plausible “when the plaintiff pleads factual content that allows the

court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”

Iqbal, 556 U.S. at 678. When considering a Rule 12(b)(6) motion to dismiss, the court must

accept the allegations contained in the complaint as true, and all reasonable inferences from the

complaint must be drawn in favor of the nonmoving party. Ringhofer v. Mayo Clinic,

Ambulance, 102 F.4th 894, 901 (8th Cir. 2024). Courts are not bound to accept as true a legal

conclusion couched as a factual allegation, and factual allegations must be enough to raise a right

to relief above the speculative level. Torti v. Hoag, 868 F.3d 666, 671 (8th Cir. 2017). Legal

conclusions or formulaic recitations of the elements of a cause of action do not suffice.

DeCastro v. Hot Springs Neurology Clinic, P.A., 107 F.4th 813, 816 (8th Cir. 2024).

Review of the complaint on a motion to dismiss is a context-specific task that requires the

court to draw on its judicial experience and common sense. Norfolk & Dedham Mut. Fire Ins.

Co. v. Rogers Mfg. Corp., 122 F.4th 312, 315 (8th Cir. 2024) (citing Iqbal, 556 U.S. at 679). A

“well-pleaded complaint may proceed even if it strikes a savvy judge that actual proof of those

facts is improbable, and that a recovery is very remote and unlikely.” Id.

Negligence (Count I)

Plaintiffs plead that, by virtue of a special patient-provider relationship, Ascension had a

duty to employ reasonable measures, consistent with industry standards, to secure and protect

Plaintiffs’ PII/PHI from this foreseeable data breach. More specifically, Plaintiffs cite industry

standards contained in the HIPAA regulations and FTC guidelines, as described in the

introduction.

In support of its motion to dismiss this count, Ascension argues that Plaintiffs’ negligence

claim is precluded by the economic loss doctrine, which bars the recovery of purely pecuniary

losses in tort where the injury results from a breach of contract. Mackey, 2021 WL 3363174, at

*7. Ascension simultaneously disputes the existence of any contract. As discussed further below,

the Court agrees that the pleadings fail to establish an express or implied contract. Even

acknowledging conflicting caselaw recognizing implied contracts in the data breach context,

Plaintiffs’ negligence claim would still survive here because the economic loss doctrine doesn’t

apply when there’s a special relationship between the parties. Id. at *8; Emerson Elec. Co. v.

Marsh & McLennan Companies, 362 S.W.3d 7, 12 n.4 (Mo. 2012).

In Mackey, this Court accepted that an employment relationship was sufficiently special

to give rise to an employer’s duty to protect employees’ PII from a data breach. Mackey, 2021

WL 3363174, at *8. Given the highly sensitive nature of PHI shared in the health care context,

the patient-provider relationship is even more sacred and is clearly recognized as special under

Missouri law. J.J. by & through C.W. v. Poplar Bluff Reg'l Med. Ctr., L.L.C., 675 S.W.3d 259,

266 (Mo. App. E.D. 2023) (stating that a doctor’s fiduciary duty of confidentiality to patients

extends to all employees in a health care setting). Accord, Pollack v. Cruz, 296 So. 3d 453, 460

(Fla. Dist. Ct. App. 2020) (recognizing a special relationship between hospitals and patients).

Disputing this characterization, Ascension argues that the patient-provider fiduciary

relationship and resulting duty of confidentiality applies only to individual doctors, not to

institutions. In support, Ascension cites Cahill v. Mem'l Heart Inst., LLC, 2024 WL 4311648, at

*14 (E.D. Tenn. Sept. 26, 2024), where the court reasoned that the plaintiffs merely purchased

medical services from the defendant hospital in a commercial transaction. This Court does not

share that logic. In the context of a systemwide data breach, it makes no sense to recognize the

fiduciary duty of a patient’s doctor but not of the entity maintaining the treatment records. In the

Court’s view, the level of trust inherent in the patient-provider relationship and corresponding

duty of confidentiality codified by HIPAA necessarily extends to regulated providers and

warrants fiduciary treatment.6

As such, the Court concludes that the economic loss doctrine wouldn’t bar Plaintiffs’

negligence claim even if their contract claims were viable. Ascension’s motion to dismiss will be

denied as to Count I.

Negligence Per Se (Count II)

“Negligence per se ‘is a form of ordinary negligence that results from violation of a

statute’ and ‘arises where the legislature pronounces in a statute what the conduct of a reasonable

person must be.’” Aubuchon v. Tate Trucking, LLC, 2024 WL 4285880, at *2 (E.D. Mo. Sept.

25, 2024) (quoting Lowdermilk v. Vescovo Bldg. & Realty Co., Inc., 91 S.W.3d 617, 628 (Mo.

App. E.D. 2002)). It is “in effect a presumption that one who has violated a safety statute has

violated his legal duty to use due care.” J.J.'s Bar & Grill, Inc. v. Time Warner Cable Midwest,

6 The other cases cited in Ascension’s brief didn’t involve HIPAA and thus don’t change the

Court’s conclusion. See Community Bank of Trenton v. Schnuck Markets, Inc., 887 F.3d 803, 818 (7th

Cir. 2018) (where plaintiff was a bank and defendant was a grocery chain); Sherman v. Sea Ray Boats,

Inc., 649 N.W.2d 783 (2002) (involving the sale of a boat); U.S. Bank, N.A. v. Integrity Land Title Corp.,

929 N.E.2d 742, 744 (Ind. 2010) (where a bank sued a title company).

LLC, 539 S.W.3d 849, 868 (Mo. App. W.D. 2017). “To establish a claim of negligence per se,

the plaintiff must plead and prove the following four elements: (1) the defendant violated a

statute; (2) the injured plaintiff was a member of the class of persons intended to be protected by

the statute; (3) the injury complained of was of the kind the statute was designed to prevent; and

(4) the violation of the statute was the proximate cause of the injury.” Martinez v. Kilroy Was

Here LLC, 551 S.W.3d 491, 496 (Mo. App. E.D. 2018). “When a case based on negligence per

se is submitted to the jury, the standard of care is omitted because the statutory violation itself

constitutes a breach of the standard of care.” Dibrill v. Normandy Assocs., Inc., 383 S.W.3d 77,

84 (Mo. App. E.D. 2012).

Plaintiffs assert a claim of negligence per se based on Ascension’s violation of HIPAA

and the FTCA. Specifically, HIPAA requires a covered entity to “have in place appropriate

administrative, technical, and physical safeguards to protect the privacy of [PHI].” 45 C.F.R.

§ 164.530(c)(1). As further summarized in the introduction, the regulations impose numerous

standards and implementation specifications relating to particular security considerations and

requiring appropriate institutional procedures and practices. See, e.g., 45 C.F.R. § 164.306,

§ 164.308, § 164.312. The FTCA prohibits unfair and deceptive trade practices, 15 U.S.C. § 45,

and the FTC’s resource Protecting Personal Information: A Guide for Business recommends

precautions and practices for the retention, protection, and disposal of information. (Doc. 52 at

20-21).

In support of its motion to dismiss this count, Ascension contends that negligence per se

lies only where a statute creates a private cause of action, and neither HIPAA nor the FTCA

creates one. As the Court understands it, Ascension posits that a plaintiff must have a statutory

claim in order to also have a negligence claim. This is incorrect. “The test to determine whether a

violation of a statute may constitute negligence per se depends on legislative intent.” J.J.'s Bar &

Grill, Inc. v. Time Warner Cable Midwest, LLC, 539 S.W.3d 849, 869 (Mo. App. W.D. 2017).

“There is a difference between whether a statute creates a private cause of action permitting an

individual to initiate a lawsuit … based on a violation of the statute, and whether a statute

establishes a standard of care supporting recovery on a theory of negligence per se because a

violation of the statute relieves the jury of the obligation to find negligence.” Id. at 866 n.13.

Indeed, it would make no sense for a common law claim of negligence per se to lie only where a

statutory claim already exists. A statutory “cause of action” isn’t a prima facie element for

negligence per se. Rather, the inquiry is simply whether the legislature (or regulatory body)

intended for the statute to establish the standard of care. Id. The “initial question is whether the

legislation or regulation is to be given any effect in a civil suit.” Id. at 869 (quoting the

Restatement (Second) of Torts § 286 comment d.).

On this question, the Missouri Court of Appeals has recognized that HIPAA creates a

statutory duty of confidentiality that, when violated, gives rise to a common law claim of

negligence per se under Missouri law. J.J., 675 S.W.3d at 266. Upon review of the HIPAA

regulations cited by Plaintiffs, which impose numerous mandatory standards and implementation

specifications across a range of information security considerations, this Court agrees that the

statute and corresponding regulations were intended to establish a legal duty and standard of care

for the protection of patients’ personal information.

By contrast, the Eighth Circuit has concluded that the FTCA does not create a legal duty

enforceable through a state negligence action. In re SuperValu, Inc., 925 F.3d 955, 964 (8th Cir.

2019) (applying Illinois common law). Indeed, neither the statutory language of the FTCA nor

the FTC publication, Protecting Personal Information: A Guide for Business, which Plaintiffs

cite as the source of industry “guidelines,” can be interpreted to legislate a standard of care for

data security. The FTCA simply prohibits unfair and deceptive trade practices, and the guide

merely recommends security best practices for the inventory, retention, protection, and disposal

of information as well as crisis management planning.

Accordingly, the Court finds that Plaintiffs have stated a viable claim for negligence per

se based on alleged violations of HIPAA and applicable regulations but not based on the FTCA

or the FTC Guide for Business. Ascension’s motion to dismiss will be granted in part and denied

in part on this Count II.7

Breach of Express Contract (Count III)

In Count III, Plaintiffs plead that they had an express contract with Ascension in the form

of its Notice of Privacy Practices, which advises patients of their rights and Ascension’s

obligations under HIPAA and explains the parameters of Ascension’s use of patient PII/PHI.

They assert that the contract was formed when they obtained services and provided their PII/PHI

subject to the Notice. Plaintiffs plead that the Notice constitutes a written agreement, which

Ascension breached by failing to protect Plaintiffs’ PHI/PII. In support of its motion to dismiss

this count, Ascension argues that the complaint lacks facts demonstrating the elements of mutual

assent and consideration required to form a contract.

To determine whether an agreement is formed, courts look for the essential elements of a

contract: offer, acceptance, consideration, and whether there was a meeting of the minds and

mutual assent to the essential terms of the agreement. Woodson v. Bank of Am., N.A., 602 S.W.3d

316, 323 (Mo. App. E.D. 2020). “Mutuality of agreement is determined by looking at both the

7 The parties don’t ask the Court to conduct a choice-of-law analysis at this time but seem to agree

that the states of Arkansas, Kentucky, and Michigan do not recognize a cause of action for negligence per

se based on federal statutory standards of care, though such standards are relevant to a finding of ordinary

negligence.

intentions of the parties as expressed or manifested in their words or actions and the

circumstances surrounding the parties’ relationship.” Id. (cleaned up).

In Kuhns, the Eighth Circuit rejected the notion that a portion of payment for brokerage

services was for data security pursuant to a privacy policy. 868 F.3d at 718. In the HIPAA

context, the Western District of Missouri dismissed the theory that a privacy policy constitutes a

contract because the statutory obligation to comply with HIPAA requires no consideration. K.A.

by & through B.W. v. Children's Mercy Hosp., No. 18-00675-CV-W-ODS, 2019 WL 13207485,

at *6 (W.D. Mo. May 17, 2019). Accord, Harris, 2024 WL 5055556, at *10; In re Mednax

Servs., Inc., Customer Data Sec. Breach Litig., 603 F. Supp. 3d 1183, 1221 (S.D. Fla. 2022);

Brush v. Miami Beach Healthcare Grp. Ltd., 238 F. Supp. 3d 1359, 1367 (S.D. Fla. 2017).8

The Court agrees with this reasoning. Plaintiffs’ bare allegation that the Notice

constitutes an agreement is conclusory. The Notice is merely a notice, informing patients of their

rights under HIPAA and the duties HIPAA imposes on providers. Mednax, 603 F. Supp. 3d at

1221-22. Plaintiffs do not and could not plead that they understood the Notice to create a

contract for data security funded by their payment for medical services. Any provider’s

itemization of charges dispels that belief. See SuperValu II, 925 F.3d at 966 (rejecting the

concept of PII as a benefit conferred in exchange for data protection). But even accepting this

illogical premise, assent must still be mutual to form a contract, and the complaint doesn’t and

couldn’t allege a contractual undertaking or assent by Ascension when its privacy obligations are

statutory and cannot be purchased or bargained for. K.A., 2019 WL 13207485, at *6; Mednax,

8 Conversely, in Weisenberger v. Ameritas Mut. Holding Co., 597 F. Supp. 3d 1351, 1359 (D. Neb.

2022), the court found sufficient consideration by characterizing the agreement as “If you give us your

PII, we will keep it secure pursuant to our duty under HIPAA.” This Court does not share that view.

603 F. Supp. 3d at 1222. Count III fails to state a claim and will be dismissed.

Breach of Implied Contract (Count IV)

Absent an express contract, Plaintiffs plead that the parties had an implied contract

pursuant to which Ascension agreed to safeguard their PII/PHI in accordance with industry

standards. They assert that Ascension violated an implied covenant of good faith and fair dealing

by failing to maintain adequate data security.

“There is no difference in legal effect between an express contract and one implied in

fact. The distinction lies merely in the manner of manifesting mutual assent.” Nickel v. Stephens

College, 480 S.W.3d 390, 397 n.6 (Mo. App. W.D. 2015) (internal citation omitted). To

determine whether an implied contract exists, courts consider the parties’ acts, conduct, and

statements as a whole; whether there was a meeting of the minds on essential elements; the

parties’ intent to enter into a contract upon defined terms; and whether one of the parties has

relied in good faith on the alleged contract. Id.

Plaintiffs plead that the parties’ mutual understanding on the essential terms of their

agreement is evidenced by their course of conduct and Ascension’s statements in the Notice.

Specifically, Plaintiffs provided their PII/PHI in order to receive services; Ascension accepted

the information and promised to protect it; Plaintiffs paid Ascension for health care services; and

Plaintiffs expected Ascension to use part of its earnings for data security.

In support of its motion to dismiss this count, Ascension argues that the complaint cannot

establish mutual assent and consideration. The Court agrees for the same reasons stated above

with respect to express contracts. Ascension’s obligation to protect Plaintiffs’ information is

entirely statutory, not transactional. The cases cited by Plaintiffs don’t involve HIPAA and are

factually distinguishable in that important regard. Mackey, 2021 WL 3363174 at *8 (involving

PII retained by the plaintiff’s employer); Hall v. Centerspace, LP, No. 22-CV-2028

(KMM/DJF), 2023 WL 3435100, at *5 (D. Minn. May 12, 2023) (same); Baldwin v. Nat’l W.

Life Ins. Co., 2021 WL 4206736, at *7 (W.D. Mo. Sept. 15, 2021) (PII provided to purchase life

insurance); Mohsen v. Veridian Credit Union, 733 F. Supp. 3d 754, 768 (N.D. Iowa 2024) (PII

deemed exchanged for banking services beneficial to the bank); Hiscox Ins. Co. Inc. v. Warden

Grier, LLP, 474 F. Supp. 3d 1004, 1010 (W.D. Mo. 2020) (PII provided to law firm).9

Again, the complaint cannot be understood to demonstrate Ascension’s contractual assent

or acceptance of any form of consideration for data security. K.A., 2019 WL 13207485, at *6;

Mednax, 603 F. Supp. 3d at 1222. Absent an implied contract, there is also no implied covenant

of good faith and fair dealing. Count IV fails to state a claim and will be dismissed.

Unjust Enrichment (Count V)

In the alternative to their implied contract claim, Plaintiffs assert a claim for unjust

enrichment, which “requires a showing that (1) the plaintiff conferred a benefit on the defendant;

(2) the defendant appreciated the benefit; and (3) the defendant accepted and retained the benefit

under inequitable and/or unjust circumstances.” Hargis v. JLB Corp., 357 S.W.3d 574, 586 (Mo.

2011) (cleaned up). Plaintiffs plead that they conferred benefits on Ascension in the form of

payment for services and PII/PHI in connection therewith, and Ascension retained those benefits

inequitably by failing to secure Plaintiffs’ information. Plaintiffs submit that, by neglecting to

invest in adequate security, Ascension unjustly profited at their expense.

In support of its motion to dismiss on this count, Ascension argues that Plaintiffs paid for

health care services, not data security, and PII/PHI is not a benefit to the provider. Plaintiffs

9 In Hiscox, the law firm arguably had an ethical duty to protect confidential information in

a manner not subject to contractual consideration. 474 F. Supp. 3d at 1010. The Court

nonetheless finds this case less persuasive than those specifically involving violations of HIPAA.

counter that providing their PII/PHI was a condition of receiving care and thus not severable

from the benefit of payment.

Though there is some variation in existing caselaw, the majority appears to reject

Plaintiffs’ theory. Most notably, in SuperValu II, the Eighth Circuit reasoned that the defendant

didn’t receive a benefit in exchange for data security because no portion of payment was

attributable to that service. SuperValu II, 925 F.3d 966. Several district courts in this circuit have

applied this reasoning in a HIPAA context. See. e.g., Berry, 2025 WL 1287909, at *10; Harris,

2024 WL 5055556, at *12; Rodriguez v. Mena Hosp. Comm'n, 2023 WL 7198441, at *11 (W.D.

Ark. Nov. 1, 2023) (also rejecting the “would not have shopped” theory).

The cases cited by Plaintiffs are distinguishable and unpersuasive. In In re Group Health

Plan Litig., 709 F. Supp. 3d 707, 715 (D. Minn. 2023), the defendant health care company

exploited patients’ PII/PHI by tracking their website activity and providing that data to

Facebook, thus clearly deriving a commercial benefit. In Mohsen, the court accepted without

analysis that a bank benefited from its customers’ PII.10 733 F. Supp. 3d at 768. Consistent with

SuperValu II, Berry, Harris, and Rodriguez, the Court will grant Ascension’s motion to dismiss

as to Count V.

10 This Court questions whether patients’ PII/PHI confers a separate benefit on providers in a

contractual sense. As a practical matter, most PHI is generated by the provider. And to the extent patients

supply PII/PHI, it benefits patients by facilitating care and creates additional burdens for the provider,

whose only benefit in the transaction is the payment for health care services. This is materially different

from a scenario where, for example, a consumer provides PII to a commercial vendor in exchange for a

discount or goods and services, enabling the vendor to then use that PII for marketing purposes. See In re

Mednax, 603 F. Supp. 3d at 1221 (contrasting consumer transactions and health care services).

Invasion of Privacy (Count VI)

Missouri law recognizes four variations on a claim for invasion of privacy. Plaintiffs

invoke two.11 Tortious “intrusion on seclusion” has three elements: (1) an intentional intrusion

(2) on the private affairs of another (3) by unreasonable means and highly offensive to a

reasonable person. Sofka v. Thal, 662 S.W.2d 502, 510 (Mo. banc 1983) (citing the Restatement

(Second) of Torts § 652B). Publication isn’t an element on this theory. Id. It merely requires a

subject matter that the plaintiff is entitled to keep private and the defendant’s acquisition of such

information through unreasonable means. Ryno v. Hillman, 641 S.W.3d 385, 393 (Mo. App. S.D.

2022). Alternatively, “public disclosure of private facts” involves (1) the defendant’s publication

to a large number of persons (2) absent a grant to the defendant of any waiver or privilege (3) the

disclosure of private matters in which the public has no legitimate concern (4) in a way as to

bring shame or humiliation to an individual of ordinary sensibilities. Y.G., 795 S.W.2d at 498-99

(where a hospital disclosed a patient’s IVF treatment to the media); J.J., 675 S.W.3d at 262 n.3

(where a hospital employee disclosed a minor’s medical information to his schoolmate).

While Plaintiffs have surely suffered an appropriation of their private information, these

legal theories don’t fit the present facts. First, Ascension didn’t commit the intrusion or

publication; hackers did. By imputing the conduct to Ascension due to its inadequate security,

Plaintiffs essentially reprise their negligence claim. But this attempt to convert omission into

action doesn’t comport with the facts or relevant elements. The intrusion was perpetrated by a

cybercriminal, not Ascension. Second, the Court is not persuaded that a criminal cyberattack

equates to “publication” in the common law sense. Put simply, the actual actor and proper

11 The two theories not applicable here are (1) appropriation of a plaintiff’s name or likeness and (2)

publicity placing the plaintiff in a false light. Y.G. v. Jewish Hosp. of St. Louis, 795 S.W.2d 488, 498 (Mo.

App. E.D. 1990) (citing the Restatement (Second) of Torts § 652C and E).

defendant for this count is not a party. Plaintiffs’ claim is properly framed as negligence.

Ascension’s motion to dismiss will be granted as to Count VI.

State Statutory Claims

Plaintiffs assert twelve separate counts under the consumer protection statutes of

Missouri, Arkansas, Florida, Illinois, Oklahoma, Wisconsin, Michigan, and Indiana.

Missouri Merchandising Practices Act (Count VII)

As relevant here, the MMPA prohibits misrepresentations and the concealment or

omission of material facts “in connection with” the sale of services and creates a civil action for

any buyer who suffers an ascertainable loss “as a result of” the use of an unlawful practice. Mo.

Rev. Stat. § 407.010(4), § 407.020, § 407.025. An “unfair practice” is defined to include

unethical practices that present a risk of or cause substantial injury to consumers. 15 C.S.R. § 60-

8.020.

Plaintiffs plead that Ascension violated the MMPA by misrepresenting that it would

protect PII/PHI in compliance with HIPAA and concealing the fact that its data security was

inadequate. Plaintiffs further plead that Ascension’s failure to meet industry standards constitutes

an unethical and unfair practice that presents a risk to consumers. In support of its motion to

dismiss this count, Ascension contends that Plaintiffs’ allegations fail to satisfy the heightened

pleading standards of Rule 9(b), Fed. R. Civ. P., because Plaintiffs don’t specifically identify any

actionable misrepresentation or omission, and they don’t claim to have relied on the Notice.

“The Eastern and Western Districts of Missouri have consistently held that Rule 9(b)

applies to MMPA cases.” Brunts v. Hornell Brewing Co., 2023 WL 3568650, at *9 (E.D. Mo.

May 19, 2023). “When Rule 9(b) applies, the complaint must allege such matters as the time,

place, and contents of the false representations, as well as the identity of the person making the

misrepresentation and what was obtained or given up thereby.” Collins v. Metro. Life Ins. Co.,

117 F.4th 1010, 1017 (8th Cir. 2024). In other words, the party must identify the “who, what,

where, when, and how.” BJC Health Sys. v. Columbia Cas. Co., 478 F.3d 908, 917 (8th Cir.

2007). Rule 9 is to be interpreted “in harmony with the principles of notice pleading.” Schaller

Tel. Co. v. Golden Sky Sys., Inc., 298 F.3d 736, 746 (8th Cir. 2002). A complaint subject to Rule

9 need not provide anything more than notice of the claim; it simply requires a higher degree of

notice enabling the defendant to respond to potentially damaging allegations. Id. “The level of

particularity required depends on the nature of a case.” E-Shops Corp. v. U.S. Bank Nat’l Ass’n,

678 F.3d 659, 663 (8th Cir. 2012).

Ascension’s HIPAA Notice itself, incorporated by reference into the complaint, states

that Ascension is “committed to maintaining the privacy and confidentiality of your health

information” and “required by law” to do so. (Doc. 73-1). Plaintiffs characterize this as a

misrepresentation that Ascension would protect the privacy and confidentiality of Plaintiffs’

PII/PHI by maintaining adequate security. Ascension argues that Plaintiffs fail to explain how

these statements are false, citing Feins v. Goldwater Bank NA, 2022 WL 17552440, at *8 (D.

Ariz. Dec. 9, 2022). There, the privacy policy represented that the defendant bank would protect

personal information from unauthorized access and use security measures that comply with

federal law. The court found those statements insufficient, reasoning that the data breach itself

was not enough to show that the statements were false. However, in Fero v. Excellus Health

Plan, Inc., 236 F. Supp. 3d 735, 776 (W.D.N.Y. 2017), the court found substantially similar

representations by a HIPAA-regulated entity sufficient because they would lead a reasonable

consumer to believe that the defendant was providing adequate data security. Similarly, the

MMPA provides relief when the representation in question would cause a reasonable person to

enter into the transaction. § 407.025. Given the language of Ascension’s Notice within the

broader context of patient-provider confidentiality and HIPAA, a consumer could reasonably

understand and rely on the Notice to mean that Ascension protects PII/PHI. The Court accepts

the sufficiency of Plaintiffs’ pleadings at this early stage.

From here, Plaintiffs centrally allege that, in the course of their treatment (the “when”

and “where”), Ascension represented to them in the Notice that it would keep their PII/PHI

private; they relied on Ascension to do so; Ascension concealed the fact that its security was

inadequate; and they wouldn’t have provided their PII/PHI had they known of Ascension’s

inadequate security. As a whole, the 120-page complaint lays out sufficient facts to enable

Ascension to respond to the allegations. Ascension cannot claim ignorance of the dates and

locations of each plaintiff’s treatment. Such granular details in Ascension’s possession are

unnecessary to place it on notice of Plaintiffs’ class claims. Given the nature of this case, the

Court finds the pleadings sufficiently specific to provide Ascension notice of the claim. Schaller,

298 F.3d at 746. To the extent Ascension reprises this theory on Plaintiffs’ other state statutory

claims, the Court reaches the same conclusion.

However, Plaintiffs’ MMPA still fails for a different reason. The Eighth Circuit’s

decision in Kuhns is directly on point and fatal to this count. There, according to the complaint,

the defendant brokerage company represented in privacy statements that it would protect clients’

information, but the company failed to maintain adequate cybersecurity measures and suffered a

cyberattack. 868 F.3d at 717. Noting that the MMPA requires an unlawful act and pecuniary loss

“in relation to” a sale and purchase of a service, the Eighth Circuit concluded that the plaintiffs’

MMPA claim wasn’t viable because the plaintiff purchased brokerage services, not data security.

Id. at 719. Thus, the alleged misrepresentation and corresponding loss didn’t “relate to” the

purchase of information privacy.

The Missouri Supreme Court appears to share the Eighth Circuit’s reasoning that services

not contemplated as part of the transaction are not included “in connection with” it for purposes

of MMPA liability. See Jackson v. Barton, 548 S.W.3d 263, 271 (Mo. 2018) (holding that debt

collection services were included “in connection with” the sale because they involved recovering

payment to complete the sale), and Watson v. Wells Fargo Home Mortg., Inc., 438 S.W.3d 404,

408 (Mo. 2014) (holding that loan modification negotiations weren’t included “in connection

with” the sale of the loan because they weren’t a service that the lender agreed to sell and the

borrower agreed to buy). More recently, a Missouri appellate court suggested in dicta that a

healthcare provider’s breach of confidentiality could indeed give rise to liability under the

MMPA. J.J., 675 S.W.3d at 266. However, absent clear precedent to that effect, this Court must

follow Kuhns as further informed by Jackson and Watson. Consequently, Ascension’s motion

will be granted as to Count VII.

Arkansas Deceptive Trade Practices Act (Count VIII)

Plaintiff Linda Dunn, on behalf of the Arkansas subclass, asserts a claim under the

Arkansas Deceptive Trade Practices Act (ADTPA), Ark. Code. Ann. §§ 4-88-101, et seq. Much

like the MMPA, ADTPA prohibits the use of deception or the concealment or omission of

material fact with the intent that others rely on it. § 4-88-108. Plaintiffs allege that Ascension

engaged in unconscionable practices, in violation of § 4-88-107(10), by misrepresenting that it

would protect PII/PHI, concealing the inadequacy of its systems, and failing to maintain

adequate security as required by the Arkansas Personal Information Protection Act, § 4-110-104.

In support of its motion to dismiss on this count, Ascension first argues that ADTPA

prohibits class actions except when the claim involves a violation of the state constitution. § 4-

88-113(f)(1)(B). In response, Plaintiffs cite Mounce v. CHSPSC, LLC, where the district court

allowed an ADTPA class action to proceed notwithstanding the statutory prohibition, reasoning

that Rule 23 is procedural and supersedes any conflicting state procedural law. 2017 WL

4392048, at *7 (W.D. Ark. Sept. 29, 2017) (citing Shady Grove Orthopedic Assocs., P.A. v.

Allstate Ins. Co., 559 U.S. 393, 409-10 (2010)). See also Whitley v. Baptist Health, 2020 WL

4575991, at *1 (E.D. Ark. Aug. 7, 2020) (noting that Rule 23 trumps ADTPA’s class action

prohibition). Upon review of these cases, the Court agrees that § 4-88-113(f)(1)(B) cannot

preclude Plaintiff Dunn’s putative class claim in federal court.

Ascension also invokes its global theory that Plaintiff Dunn fails to satisfy the heightened

pleading standards of Rule 9(b). See e.g., Jarrett v. Panasonic Corp. of N. Am., 8 F. Supp. 3d

1074, 1085 (E.D. Ark. 2013) (applying Rule 9(b) to an ADTPA claim). Ascension specifically

argues that Plaintiffs have not sufficiently pleaded their reliance on an actionable

misrepresentation or omission that caused injury. (Doc. 60 at 40-42). But the complaint expressly

alleges these elements on this count. (See Doc. 52 at 91-93). As stated above with respect to

Plaintiffs’ MMPA claim, given the particular nature of this case, the totality of the pleadings, and

the further details in Ascension’s possession, the Court finds the pleadings sufficiently specific to

place Ascension on fair notice of Plaintiffs’ claims in accordance with Rule 9(b).

Ascension’s motion to dismiss will be denied as to Count VIII.

Florida Deceptive and Unfair Trade Practices Act (Count IX)

Plaintiff Courtney Brown, on behalf of the Florida subclass, asserts a claim under the

Florida Deceptive and Unfair Trade Practices Act (FDUTPA), which simply states that

unconscionable, unfair, or deceptive trade practices are unlawful. Fla. Stat. §§ 501.204. In

construing the statute, “due consideration and great weight” is given to interpretations of the

FTCA, 15 U.S.C. § 45. Plaintiff Brown pleads that Ascension violated the FDUTPA by

misrepresenting that it would protect her PII/PHI and concealing its inadequate security. She

further pleads that Ascension violated its legal duty under a separate statute, § 501.171, to take

reasonable measures to protect electronic data containing personal information. Plaintiff Brown

had a surgical procedure canceled as a result of the breach, and her credit report was impacted.

In support of its motion to dismiss this count, Ascension again raises its global theory of

insufficient pleadings with respect to reliance on an actionable representation or omission. Rule

9(b) doesn’t apply to FDUTPA claims. Harris v. Nordyne, LLC, 2014 WL 12516076, at *5 (S.D.

Fla. Nov. 14, 2014). And in any case, the Court finds the pleadings sufficient.

Ascension also argues that FDUTPA applies only to conduct that occurs in Florida,

which can’t be the case here because Plaintiffs plead for purposes of venue that Ascension is

based in Missouri and maintained patients’ PII/PHI in Missouri. Indeed, Florida federal courts

confirm that FDUPTA claims “must arise out of conduct that occurred within the state of

Florida.” Lingard v. Holiday Inn Club Vacations, Inc., 2023 WL 4661963, at *11 (M.D. Fla. July

20, 2023). But Plaintiffs’ venue pleadings don’t negate the facts giving rise to their FDUTPA

claim. Venue is a separate inquiry and is proper in the district where the defendant resides or

where a substantial part of events occurred. 28 U.S.C. § 1391(b). The complaint is readily

understood to allege that the Florida resident Plaintiffs were treated at Ascension facilities in

Florida. Necessarily, then, these Plaintiffs received Ascension’s HIPAA Notice and provided

their PII/PHI at the Florida facilities where they were treated, and Ascension maintained their

information on computer systems within the state. In today’s digital age, the Court rejects the

notion that the presence of that information on Ascension’s servers in Missouri would foreclose

the Florida Plaintiffs’ home state claims.12

Ascension’s motion to dismiss will be denied as to this Count IX.

Illinois Statutory Claims (Counts X & XI)

Plaintiffs Angel Negron and Mattie Boyden, on behalf of the Illinois subclass, assert

claims under the Illinois Personal Information Protection Act (IPIPA), 815 Ill. Comp. Stat. § 530

(Count X), and the Illinois Consumer Fraud and Deceptive Business Practices Act (ICFA), 815

Ill. Comp. Stat. § 505 (Count XI).

On Count X, IPIPA requires any data collector to provide expedient notice of a data

breach. § 530/10. Plaintiffs allege that Ascension failed to provide timely and accurate notice of

this breach. In support of its motion to dismiss, Ascension contends that IPIPA doesn’t create a

private right of action. “The only way to pursue a claim under PIPA is by satisfying ICFA’s

requirements because PIPA does not create a separate cause of action.” SuperValu II, 925 F.3d at

964. However, where a plaintiff successfully pleads an ICFA claim, the IPIPA claim also

survives. In re Fortra File Transfer Software Data Sec. Breach Litig., 749 F. Supp. 3d 1240,

1272 n.14 (S.D. Fla. 2024).

Ascension also argues that Plaintiffs have not plausibly pleaded that it failed to timely

notify them of the breach insofar as the complaint itself describes Ascension’s immediate

response. But what constitutes reasonable and timely notice under the circumstances is a fact

12 This Court does not find persuasive the rationale of Bellwether Cmty. Credit Union v. Chipotle

Mexican Grill, Inc., 353 F. Supp. 3d 1070 (D. Colo. 2018), where the court construed venue pleadings to

foreclose FDUTPA claims for Florida victims of a Colorado company’s data breach because “claims can

only substantially occur in one place.” Id. at 1093. Venue is an entirely separate inquiry, and litigants

routinely plead alternate theories on any number of issues. This Court has no trouble accepting that venue

is proper in Missouri, where Ascension is domiciled and perhaps certain systemwide decisions were

made, and that Florida subclass claims arose in Florida, where Florida Ascension patients received

HIPAA Notices, provided their PII/PHI, and suffered losses from the breach.

question beyond the Court’s examination of the pleadings at this stage.13 Plaintiffs can maintain

their IPIPA claim if their ICFA claim is viable, which it is.

On Count XI, ICFA prohibits unfair or deceptive practices, including misrepresentation

or the concealment or omission of material fact with the intent that others rely on it. § 505/2.

Plaintiffs plead that Ascension violated ICFA by misrepresenting that it would protect their

PII/PHI, failing to maintain adequate security, and concealing its failure. Plaintiff Boyden further

pleads that her information was exposed on the dark web. Conduct is deceptive if it is likely to

deceive a reasonable consumer and unfair if it is unethical and causes substantial injury.

Mashallah, Inc. v. W. Bend Mut. Ins. Co., 20 F.4th 311, 322 (7th Cir. 2021).

Again, Ascension argues that Plaintiffs fail to specifically plead reliance on an actionable

representation or omission and resulting injury. Federal courts apply Rule 9(b) pleading

standards to ICFA claims. Spivey v. Evig LLC, 2025 WL 1638453, at *2 (N.D. Ill. June 9, 2025).

But, as previously stated, the Court finds the pleadings sufficient overall.

Ascension also argues that, like the FDUTPA, the ICFA provides a right of action only

when the conduct occurs in Illinois, so Plaintiffs’ venue pleadings defeat the claim. This theory

remains unavailing. “There is no single formula or bright-line test for determining whether a

transaction occurs within this state.” Jett v. Warrantech Corp., 436 F. Supp. 3d 1170, 1180 (S.D.

Ill. 2020). Circumstances will vary in every case, but courts consider “the residency of the

plaintiff, the location of harm, communications between parties (where sent and where received),

and where a company policy is carried out.” Id. The Illinois subclass Plaintiffs were treated at

Ascension facilities in Illinois where they received Ascension’s HIPAA Notice, provided their

PII/PHI, and suffered loss from the data breach. The Court finds the pleadings sufficient to state

13 The Court likewise rejects this argument challenging similar claims asserted by the Wisconsin

and Michigan subclasses (Counts XV and XVI, respectively).

a claim under the ICFA.

Ascension’s motion to dismiss will be denied as to Counts X and XI.

Oklahoma Consumer Protection Act (Count XII)

Plaintiff Cheryl Hayes, on behalf of the Oklahoma subclass, asserts a similar state

statutory claim under the Oklahoma Consumer Protection Act (OCPA), Okla. Stat. tit. 15 § 751,

et seq.14 Notably, however, OCPA contains an exemption for “actions or transactions” regulated

under laws administered by any regulatory body acting under statutory authority. § 754.2. In

support of its motion to dismiss on this count, Ascension centrally argues that this exemption

precludes Plaintiff Hayes’s OCPA claim because Ascension’s privacy practices are regulated by

HIPAA.

In response, Plaintiffs cite Robinson v. Sunshine Homes, Inc., where the court declined to

apply the exemption because the state regulatory framework mainly governed licensing and

didn’t create a private right of action. 291 P.3d 628, 635 (Okla. Civ. App. 2010). Plaintiffs thus

argue that this exemption doesn’t apply here because HIPAA provides no monetary redress.

More recently, however, in a case for money damages, the Oklahoma Supreme Court has

clearly instructed that “the focus on whether a § 754 exemption applies is determined by whether

the action or transaction is regulated and not specifically on whether such regulations also

14 Specifically, Plaintiffs invoke OCPA provisions prohibiting false representations “as to the

characteristics, ingredients, uses, benefits, alterations, or quantities of the subject of a consumer

transaction or a false representation as to the sponsorship, approval, status, affiliation or connection of a

person therewith” and representations “that the subject of a consumer transaction is of a particular

standard, style or model, if it is of another.” § 753(5) and (8). Though not briefed by either party, it is

unclear to the Court how Ascension’s HIPAA notice can be construed to contain representations

regarding the “subject of the consumer transaction,” which is health care, not data privacy. These

provisions of OCPA don’t seem to apply here. However, other provisions of OCPA prohibit deceptive or

unfair trade practices in the form of misrepresentations or omissions that could be expected to deceive or

mislead a person and cause injury. §§ 752.13 and 14, § 753.21. While Plaintiffs don’t expressly invoke

these subsections, the complaint sufficiently pleads such practices.

provide a private right of action.” U.S. Bank Nat'l Ass'n v. Hill, 540 P.3d 1, 11 (Okla. 2023).

Consistent with this view, multiple federal courts have concluded that the OCPA exemption

applies regardless of whether a private right of action exists. Mednax, a data breach case

involving HIPAA violations, is squarely on point. There, the court reasoned that the “actions” in

question were those taken by Mednax in the course of safeguarding or failing to safeguard the

plaintiffs’ PHI – “actions that fall squarely within the scope of HIPAA.” Mednax, 603 F. Supp.

3d at 1217. See also Gray v. Acadia Healthcare Co., Inc., 2020 WL 5996418, at *11 (E.D. Okla.

Oct. 9, 2020) (involving misconduct at a hospital regulated by the Oklahoma department of

health); Sweeny v. Toyota Motor Sales, U.S.A., Inc., 2023 WL 2628697, at *14 (C.D. Cal. Feb. 9,

2023) (reasoning that the Oklahoma motor vehicle commission’s administrative code prohibited

false or misleading advertising).

Guided by these cases, the Court will grant Ascension’s motion to dismiss on Count XII.

Wisconsin Statutory Claims (Counts XIII-XV)

Plaintiff Jill Radley, on behalf of the Wisconsin subclass, asserts state statutory claims for

breach of confidentiality of patient health care records pursuant to Wis. Stat. § 146.81, et seq.

(Count XIII), violation of the Wisconsin Deceptive Trade Practices Act (WDTPA), Wis. Stat.

§ 100.18, et seq. (Count XIV), and failure to provide adequate notice of the unauthorized

acquisition of personal information, in violation of Wis. Stat. § 134.98(2), et seq. (Count XV).

On Count XIII, §§ 146.82 and 83 provide standards similar to HIPAA for the

confidentiality and limited release of patient health care records. Section 146.84(1) creates a

private right of action for the knowing and willful or negligent release of records in violation of

those standards, though no liability attaches when the custodian acts in good faith. In support of

its motion to dismiss this count, Ascension argues that the statute doesn’t apply to the present

facts because Ascension didn’t release or disclose Plaintiffs’ information at all; it was stolen by

cybercriminals. While this is a logical reading of the statute’s active verbs, two district courts in

Wisconsin have rejected this argument in other data breach cases. Dusterhoft v. OneTouchPoint

Corp., 2024 WL 4263762, at *16 (E.D. Wis. Sept. 23, 2024); Fox v. Iowa Health Sys., 399 F.

Supp. 3d 780, 796 (W.D. Wis. 2019). The Court declines to depart from these Wisconsin

decisions and will deny Ascension’s motion on Count XIII.

On Count XIV, claims arising under the WDTPA have three elements: “(1) the defendant

made a representation to the public with the intent to induce an obligation, (2) the representation

was untrue, deceptive or misleading, and (3) the representation materially induced (caused) a

pecuniary loss to the plaintiff.” Giasson v. MRA - Mgmt. Ass'n, Inc., 2025 WL 1025173, at *18

(E.D. Wis. Apr. 7, 2025). Notably, the WDTPA applies only to affirmative assertions; an

omission is insufficient. Id. In support of its motion to dismiss this count, Ascension again

contends that Plaintiffs have failed to satisfy Rule 9(b) pleading standards or plausibly allege

reliance on an actionable misrepresentation causing injury, and that Ascension’s alleged

concealment of its inadequate data security doesn’t give rise to a WDTPA claim.

Wisconsin courts are split as to whether Rule 9(b) standards apply to WDTPA claims.

See Id. at *18 n.13; Green v. Olympus Grp., Inc., 2025 WL 1201995, at *3 (E.D. Wis. Apr. 25,

2025). And reasonable reliance is not an element but may be considered by the fact finder. Blitz

v. Monsanto Co., 317 F. Supp. 3d 1042, 1054 (W.D. Wis. 2018). In any case, Plaintiff Radley

pleads that she “reasonably expected that her PII and PHI would remain safe” and that, had she

been informed of Ascension’s insufficient security, she would not have provided her

information. As for injury, her bank account was compromised, resulting in large withdrawals

and unreimbursed overdraft fees. (Doc. 52 at 60). This is sufficient even applying Rule 9(b).

The closer call here is whether Plaintiffs have identified a representation that was

“untrue, deceptive, or misleading” for purposes of the WDTPA. Plaintiffs don’t address this

count at all in their responsive brief but confirm that their theory of the case – the specific “what”

of their complaint – is that Ascension omitted and concealed the fact that its data security

practices were inadequate. (Doc. 64 at 38-39). Unlike in other states, this alleged omission

doesn’t give rise to a WDTPA claim. Giasson, 2025 WL 1025173, at *18. Rather, the WDTPA

requires an active misrepresentation. In Giasson, the defendant’s privacy policy represented that

it used “reasonable and appropriate” and “industry-standard” security measures to protect PII.

The court found this sufficient to constitute an alleged misrepresentation. Id., at 19. In

Dusterhoft, the defendant’s website stated that it “maintain[ed] commercially reasonable security

measures” to protect private information from unauthorized access. 2024 WL 4263762, at *16.

Here, Ascension’s HIPAA Notice merely states that Ascension is “committed to maintaining the

privacy and confidentiality of your health information” and “required by law” to do so. (Doc. 52

at 10; Doc. 73-1). In other contexts, such a general statement would not be actionable. Bakery

Bling v. Matrix Packaging Mach., LLC, 685 F. Supp. 3d 718, 752 (E.D. Wis. 2023) (involving

commercial representations). The Court notes that the briefing on this issue is minimal. Out of

caution, and given the expectations inherent in HIPAA, the Court will accept Plaintiffs’

pleadings of active misrepresentation at this early stage. See Dusterhoft, 2024 WL 4263762, at

*16 (reasoning that whether statements are misleading is a fact question).

On Count XV, § 134.98 requires companies doing business in the state to notify

customers within 45 days after any data breach. It states, “Failure to comply with this section is

not negligence or a breach of any duty, but may be evidence of negligence or a breach of a legal

duty.” § 134.98(4). In its motion to dismiss this count, Ascension argues that the statute doesn’t

create a separate right of action. Ascension cites Fox, where the Western District of Wisconsin

dismissed a similar claim because “the legislature has not provided any indication that § 134.98

creates a separate right of action.” 399 F. Supp. 3d at 800. Although Plaintiffs cite contrary

conclusions from other districts,15 this Court elects to follow the Wisconsin district court’s

interpretation of Wisconsin state law, which aligns with Wisconsin Supreme Court instruction

that “courts may not find a statutory right in legislative silence alone.” Crown Castle USA, Inc. v.

Orion Const. Grp., LLC, 811 N.W.2d 332, 342 (Wis. 2012). Consistent with Fox, the Court will

dismiss this count as an independent claim, but Plaintiffs may invoke the statute as relevant to

their negligence claims.

Ascension’s motion to dismiss will be denied as to Counts XIII and XIV and granted as

to Count XV.

Michigan Statutory Claims (Counts XVI-XVII)

Plaintiff Leah Willis, on behalf of the Michigan subclass, asserts claims under the

Michigan Identity Theft Protection Act (MITPA), Mich. Comp. Laws § 445.61, et seq. (Count

XVI) and the Michigan Consumer Protection Act (MCPA), Mich Comp. Laws § 445.901, et seq.

(Count XVII).

Regarding Count XVI, MITPA § 445.72 requires businesses to give consumers notice of

data security breaches “without unreasonable delay.” § 445.72(4). In support of its motion to

dismiss this count, Ascension submits that MITPA doesn’t provide an independent right of

15 See In re Equifax, Inc., Customer Data Sec. Breach Litig., 362 F. Supp. 3d 1295, 1341 (N.D. Ga.

2019) (reasoning that the statute is silent on enforcement); In re Target Corp. Data Sec. Breach Litig., 66

F. Supp. 3d 1154, 1170 (D. Minn. 2014) (same).

action. Plaintiffs dispute this interpretation but alternatively reserve the right to invoke MITPA

through the MCPA.

MITPA creates a misdemeanor for fraudulent notices and empowers the attorney general

or a prosecuting attorney to bring civil enforcement actions to recover fines for any violation of

the statute. § 445.72(12) and (13). It also clarifies that state enforcement mechanisms “do not

affect the availability of any civil remedy for a violation of state or federal law.” § 445.72(15).

Some courts have interpreted this to mean that consumers may enforce MITPA § 445.72 through

the MCPA. In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., 613 F. Supp. 3d

1284, 1306-7 (S.D. Cal. 2020); In re Equifax, Inc., Customer Data Sec. Breach Litig., 362 F.

Supp. 3d 1295, 1339 (N.D. Ga. 2019); In re Target Corp. Data Sec. Breach Litig., 66 F. Supp.

3d 1154, 1169 (D. Minn. 2014).

However, shortly after the instant motion was fully briefed, the Eastern District of

Michigan concluded that a MITPA notice violation (§ 445.72(4)) cannot proceed as an MCPA

claim. The MCPA expressly creates a right of action for a different section of MITPA (i.e.,

§ 445.71 prohibiting the denial of credit to a victim of identity theft) but not for the data breach

notice section at issue here (§ 445.72). Angus v. Flagstar Bank, FSB, 2025 WL 937760, at *7

(E.D. Mich. Mar. 27, 2025) (citing MCPA § 445.903(1)(jj)). Following the rule of statutory

construction expressio unius est exclusio alterius – the expression of one thing is the exclusion of

another – the court reasoned, “By listing a violation of [§ 445.71] and omitting a violation of

[§ 445.72], the Michigan Legislature made clear that a violation of [§ 445.72] is not actionable

under the MCPA.” Id.

Faced with a conflict between older cases outside the Seventh Circuit and a recent

Michigan case interpreting Michigan state law, this Court will follow the thoughtful rationale of

the Michigan district court. Target cursorily inferred a MITPA notice cause of action through

the MCPA without examining § 445.903(1)(jj), and Equifax and Solara simply followed Target.

Only Angus provides a meaningful analysis, which this Court finds persuasive. The Michigan

legislature clearly knew how to provide relief for a MITPA violation through the MCPA but

chose not to do so for the notice provisions. Thus, the Court agrees that MITPA § 445.72 doesn’t

create a private right of action and also concludes, following Angus, that “the MCPA does not

authorize a plaintiff to bring a claim based upon a violation of [§ 445.72].” Id.

On Count XVII, the MCPA prohibits unlawful trade practices including representations

of fact “material to the transaction such that a person reasonably believes the … state of affairs to

be other than it actually is” and “failing to reveal facts that are material to the transaction in light

of representations of fact made in a positive manner.” § 445.903(bb) and (cc). Plaintiffs plead

that Ascension misrepresented that it would protect PII/PHI and concealed the fact that its data

systems were not secure.

In support of its motion to dismiss this count, Ascension asserts its global arguments that

the complaint falls short of Rule 9(b) standards and fails to plead reliance and resulting injury.

As previously stated, the Court finds the complaint sufficient in these respects. Plaintiff Willis

pleads that she received Ascension’s HIPAA Notice and reasonably expected that her PII and

PHI would be safe. Had she known of Ascension’s inadequate data security, she wouldn’t have

provided it. Additionally, her surgery was postponed as a result of the breach, leaving her in pain

until it could be rescheduled. The Court finds these pleadings sufficient to state an MCPA claim.

Ascension’s motion to dismiss will be granted as to Count XVI and denied as to Count

XVII.

Indiana Deceptive Consumer Sales Act (Count XVIII)

Finally, Plaintiffs Donald Pitchers and George Gounaris, on behalf of the Indiana

subclass, assert a claim under the Indiana Deceptive Consumer Sales Act (IDCSA), Ind. Code

§§ 24-5-0.5-3. The IDCSA prohibits unfair or deceptive acts, omissions, or practices in

connection with a consumer transaction, including implicit and explicit misrepresentations that

occur before, during, or after the transaction.Reger v. Arizona RV Centers, LLC, 515 F. Supp. 3d

915, 938 (N.D. Ind. 2021). In support of its motion to dismiss this count, Ascension again asserts

its global theories that Plaintiffs have not sufficiently pleaded their reliance on an actionable

misrepresentation or omission that caused injury. (Doc. 60 at 40-42).

Indiana courts apply Rule 9(b) pleading standards to IDCSA claims. Williams v. Thor

Motor Coach, Inc., 2024 WL 4524292, at *2 (N.D. Ind. Oct. 17, 2024). Even so, the Court finds

the pleadings sufficient to state an IDCSA claim. Plaintiffs plead that, in the course of treatment

(the “when and where”), Ascension misrepresented through its HIPAA notice (the “how”) that it

would maintain adequate security and comply with privacy laws while knowing that its practices

were inadequate, deliberately misleading patients to transact for their health care services (the

“what”). (Doc. 52 at 114-15). They plead reliance by alleging that they received Ascension’s

Notice and reasonably expected their PII/PHI to remain safe (Id. at 54, 56), and had they known

of Ascension’s insufficient security, they wouldn’t have provided their information (Id. at 55,

57). As for injury, they plead that, a result of the data breach, their information appeared on the

dark web, and Pitchers was unable to obtain his medication on time. (Id. at 54-55).

These allegations satisfy Rule 9(b) standards for an IDCSA claim. See e.g., Moore v. Soc.

Coaching-Credit Repair, LLC, 2024 WL 1929431, at *3 (N.D. Ind. May 1, 2024) (finding

IDCSA pleadings sufficient). The Court will deny Ascension’s motion on this Count XVIII.

CONCLUSION

Accordingly,

IT IS HEREBY ORDERED that Defendants’ motion to dismiss (Doc. 59) is

GRANTED with respect to Counts II, IV, V, VI, VII, XII, XV, and XVI and DENIED with

respect to Counts I, VII, [X, X, XI, XIII, XIV, XVII, and XVIII.

IT IS FURTHER ORDERED that, as to Count II, the motion is GRANTED as to the

FTCA and DENIED as to HIPAA.

IT IS FURTHER ORDERED that, as to the claims of Plaintiff Tiffany Farrand, the

motion is GRANTED in its entirety and without prejudice.

IT IS FINALLY ORDERED that Defendants’ motion to dismiss Ascension Health

Alliance and Ascension Technologies is DENIED at this time.

An order requiring the parties to submit a joint proposed scheduling plan will issue

separately.

Dated this 23rd day of September 2025.

UNITED STATES DISTRICT JUDGE

42