Oral argument — Erica Tierney v. Advocate Health and Hospitals

Good morning ladies and gentlemen. Pleased to have Judge Springman sitting with us by designation today. The first case this morning is Tierney v. Advocate Health. Mr. Barno. Good morning your honors. May it please report. My name is Ben Barno and I'm here today on behalf of the appellant. Four million people, 20 years of personally identifiable information, protected health insurance stored on four laptop, four desktop computer through a back door, unencrypted, on a common law basis in my view I would respectfully suggest that that surely gets to a jury if not a summary judgment as to whether or not it's willful and want. But let's see what Advocate itself thinks about their conduct. One of its senior vice presidents, Kelly Jo Goldson, said at the time of the incident this type of data should always be maintained on our secure network. Of course it was not. Let's see what an expert in the area says. Mac McMillan, CEO of consulting firm Synergistics Tech, a consulting firm expert in the area commenting on the incident said, quote, I have to shake my head when I see four million patient records on desktops. It defies common sense and logic. How do you respond to the argument that Advocate does not receive monetary fees for assembling or evaluating patient data, but rather what Advocate does is it transmits information to insurance companies for payment for health care services? The first response, Your Honor, is I comment that that is selective of what the statutory language says, and it's something the defendants have to do because they can't deal with the actual wording. Here's what the statute says. Any person which for monetary fees, there you go, and I don't know if they get fees or not. It's not illogical that they do not get them, but we don't need that here. Dues, which they may get because there's membership, and we allege this is on a motion to dismiss, as we all know, or on a cooperative nonprofit basis, there you go. But I think we have to go back to the statute under which you sued here. Aren't there any state or federal statutes that protect private health care information that would be a better fit here? In my opinion, this is a pretty good fit as to whether or not there are individual state court provisions that do it. I don't know, frankly, any that do as good a job as FCRA, and I do agree with Your Honor when you say go back to the statutory language, and that's exactly what we've done. That's exactly what we've sued them under. But FCRA doesn't impose obligations upon a creditor who merely passes along information concerning particular debts to it. Only entities that are paid to assemble, evaluate, report consumer information are consumer reporting agencies under FCRA. An advocate transmits information for purposes of obtaining payment for health care services, you know, that its physicians have rendered. Advocate does many things, and we've alleged more than that. I think, respectfully, Your Honor, what that does is separate out certain things that the defendant could only land on. We've alleged that it reports to insurance companies. Insurance companies use the information probably on a qualitative, quantitative basis or statistical basis to bring about different rates, etc. So that may well be the case, but that is not the situation of advocate. Advocate draws a different picture through its counsel's papers than we have alleged, and as a motion to dismiss, I believe our allegations must be taken as true. In fact, our allegations came from information that advocate has on its own website. It does not have the lawyers have attempted to paint for it. Its activity is as we have pled it, and we have pled it in accordance with the statutory requirements. They also take a shot with regard to that it's not a consumer report. It most definitely is under the statutory language, and we have it cited in our papers. Any written, oral, or other communication of any information bearing on a consumer's personal characteristics or mode of living for credit or insurance to be used primarily for personal, family, or household purposes. Well, you see, let me quote from your brief. Quote, Plaintiffs admit that advocate does not receive monetary fees for assembling or evaluating patient data. Rather, by plaintiff's own admission, advocate transmits this information to insurance companies and government agencies for purposes of obtaining payment for health care services that its physicians have rendered, end quote. But they don't have to only get payment, Your Honor. They can do it on a not-for-profit basis, which they clearly do, and whether or not they collect dues is something that remains, I suppose, an open question. Payment is not the only element that goes into it. Let me respectfully suggest why that has to be the case. The goal here in creates a remedy for what the Congress probably sees as an important injury in existing in public that has no other address. Congress has the right to create a remedy for that. That's what they did here. To suggest that it's limited in the face of the very information that Congress is trying to protect and is so important to people, protected health information, gives a reading to the statute which is unreasonable. This statute was designed to do exactly what this case complains about and should not have occurred but for. If I might, Your Honor, there was a case in this district, Roe v. Unicare, which I had the fortune, honor, of being plaintiff's counsel in the case, and that case was similar. Unicare also was a gatherer of information and did things that we talked about, and there was a breach. That breach basically opened up a portal that allowed the public to see this medical information of about 207,000 people. Interestingly enough, the defense firm in that case, another quality defense firm, did not attack the applicability of FCRA to that, to me, almost identical situation here. It seems to me, oh I didn't mean to interrupt you. Go ahead, finish your thought. I'm waiting for Your Honor. You may not be happy about that. Well, I've had many unhappy moments in my life and sometimes I surprise by the happiness they result in. You see, it seems to me like the HIPAA or some other statute that mandates a level of protection for private health care information would have been a more appropriate statute. Now, of course, I understand there's no private right of action under HIPAA, but so what is an individual's recourse? An individual is charged with enforcement and can seek to do so civilly or criminally, but I'm just not certain that FCRA imposes the obligations that you argue it does. Well, I understand why the Court's not certain, and I suppose that's why I'm here today. There was another judge that wasn't certain either. I think he was wrong. Judge Hibbler, in his opinion, Roe versus Unicare, and the lawyers who then even raised the issue as to whether or not FCRA applied, I would say would be on my side of the table there. But let me respond a bit, if I could, and I would hope my comment would make the Court happy to the extent that it puts an illumination on the issue. The suggestion to go to HIPAA, quite frankly, but for a better phraseology, disregards what Congress has sought to put in place. Congress could have said, you know what, we've got this HIPAA over here. Let them go over there, eat worms and die, so you get hurt a little bit. But they didn't say that. They said there is an individual harm, and it may be hard to quantify, but we're not going to let anybody who has a little vacuous complaint get money. If it doesn't rise to the level of willful, well then they're going to have to go out to improve actual. But when it gets so bad, we're going to say, you know what, you've got to pay up. These people had to be hurt. It's their information, and between $100 and $1,000 it may be punitive. But Your Honor is correct. No private action under HIPAA, so why wouldn't Congress have a private action here? It seems, it's certainly difficult to tell a plaintiff's lawyer, and it's probably even more difficult to tell a victim that, you know what, you have another remedy over there, by complaining to the civil rights group or the government, because a big part of the law is providing for damages and compensation, and that's what FCRA does, and that's why FCRA is applicable here. Counsel, if I could ask, do you have any other case law that supports your position that the term furnishing under FCRA encompasses private information stolen through a security breach, other than the UNICARE case you just referenced? Well, I think disclosed has much to do with it also, and while, actually that's a great question. Other than disclosed, that would be about where I am with that, but it's a bad, it's a wrong path, Your Honor, and here's why. The obligation is to design systems that prevent the furnishing. The defense counsel got off that design business because they know their client didn't have a system that was worth a dime, worth less than a dime, had a negative value, so they switch. They get away from not having systems that are supposed to prevent that, which nobody can deny. They didn't violate that, but that's the language of E, design systems. They skip over and go right to furnish, but let me talk about furnish if I could. If I could ask you, what was the nature of the breach in your UNICARE case? In that case, somebody came in to work on the firewalls, if I recall, and they dropped the firewalls, so the medical information of 207,000 people was available on the internet, so if we went in there and put in, pick a US citizen, Paul Carlscott, they put his name in there, if he was part of that database, his medical information would pop up. Now, there was no evidence in that case, not even with Mr. Rowe, that anybody got into his information, but the idea that it was served up in that venue, which is, to me, very similar here. I can't say identical because identical is a tough word, but it's very, very close. In effect, this particular defendant, advocate, by his procedures, they might as well put up a catering service for thieves. It was so readily available. It's a step short of that, but not far. I mean, their own people condemned it. So it's the design of the system, of E's system to prevent the furnishing. They switched to furnishing. Under their theory, everything advocate did would be okay, as long as somebody didn't actually go out and use it. They don't even care if the crooks have it. They say, oh, well, what's that matter? Well, we all know the case law is against that. So, yeah, it's a great question, Your Honor, and I thank you for it, but it's not a matter of the furnishing. The statute says designing systems. Otherwise, the statute would have very little prophylactic effect. I mean, what they also want to go on to say, that their only obligation to design, because they know the argument's there, is to make sure they tell their people to give it to the right guys, the right companies, the right women, whatever. That's baloney. What that would mean if this statute went all the way through Congress, all the work, all the arguments, all the disagreements, all the push and shove that it takes to make a statute, to protect a microcosm of the injury that could occur. It's the thieves. Well, I have to say, when this first started, we thought about debt collecting. We didn't think about breaches of computer security, because perhaps, back when the legislation was being considered, we didn't have a lot of breach of this nature. How do you answer, and I know you did in your reply brief, but with a single paragraph, the Fleet Mortgage Corporation case, which had to do with saying, where we said, this doesn't cover banks, the Fair Debt Collection Association. Well, thank you very much. To me, it's apples and oranges. That's a singular transaction that's not picking up, for instance, medical information. It's not transmitting it, and it's using it for its own purposes. Vastly different. But doesn't the bank transfer information to potential debt collectors and creditors, provide information to them? They may or may not, but what I know they don't do, at least they don't do it lawfully, is transmit protected medical information. What this company did here was they took a concept of protected medical information and turned it into unprotected medical information. I mean, the facts of Fleet, where one company is doing its own transaction. There's other cases, for instance, Macy's, the Macy's case, whichever one that was, and a couple like it, where a company is doing its own singular transactions. That's not what Fair Credit Reporting Act is dealing with. That is an entirely different situation. Unfortunately, through whatever, it's through a lot of artful arguing, and I don't mean that negatively. Lawyers are supposed to argue and it's supposed to be good, and I guess that includes art. The idea of the limitation is just destructive of the statute. This statute is broad, this statute is prophylactic, and this statute is designed to cover the very conduct that occurred here. For instance, Unicare, that was part of Wellpoint. Now Anthem, there was 200 and some thousand people here, another one was out of California, was 600 and some thousand. Now Anthem is out there. I guess they got advice that they don't have to have the system designed to protect it. 80 million people. You know what? When somebody stands up on appellate level and says, yes, this statute does cover it, I respectfully suggest that they'll be doing a different reading in this and there'll be greater protection. People won't leave desktop computers with 4 million items sitting there to damage people. Well, there may be remedies for this kind of conduct, but does it fall within Faraday Collection Practice Act, is the question. I would answer that absolutely, and here's why. Congress had to recognize that the proof of these damages, on an individual basis where you have states varying as to whether or not you can get emotional distress or not, and we can all talk about that, they wanted to solidify, quantify, identify, and make available damages to consumers, and that's what this act is about. That's why they have a willful category, and let me point out, they didn't make owners damages. It's as low as $100, maybe as high as $1,000, it's a provision for punitive. But yes, other avenues are available. First of all, respectfully try to get a class certified 50 states on a non-statutory provision. Try to get that these damages are recoverable unless you have severe emotional stress. So the reality is this is the remedy. This is it. So when Mr. McMillan said it defies common sense and logic, I would add and save a little bit of my time here, that it also defies the law. Thank you. Mr. Warren. Good morning, your honors. Daniel Warren on behalf of the appellee. The question before the court this morning is not whether there is a fair credit reporting act. And for them to make out a claim under the fair credit reporting act, they have to allege facts showing that the act applies here, which would require them to allege facts showing that the advocate is a consumer reporting agency and that it furnished consumer reports to users for improper purposes. With respect to the definition of consumer reporting agency, which is the threshold question here, there are two critical pieces that are missing from plaintiff's allegations. First, plaintiffs do not allege that advocate aggregated or assembled or evaluated consumer information either for a fee or even on a cooperative nonprofit basis because in either event, they would have to show or allege facts showing that advocate is in the regular business of providing that service. What about the fact that advocate uses the information it stores to give to third parties for the purpose of establishing the patient's eligibility for insurance coverage and in connection with the underwriting of insurance involving consumers? Would those be qualifying purposes under FCRA? One of them is, your honor, and one of them is not. What they have alleged and argued below is that advocate provides this information to insurance companies to determine eligibility for insurance under existing health care policies. That is not an enumerated purpose. It is not subject to FCRA as the Yang decision in the 11th Circuit expressly held. If it's provided for underwriting purposes, that would be an enumerated purpose under FCRA. It's not what they allege below. There are no facts in the complaint alleging that that was the purpose. It's all about existing health care policies. In other words, does the policy, is the policy covering this particular ailment or whatever? Correct. If it's an existing policy, it's not a FCRA matter. If it's underwriting, it might be. But only if it's otherwise a consumer report, which these are not for a variety of reasons, and only if advocate is a consumer reporting agency, which it clearly is not. Well, let me ask, are there any other entities that advocate is sending patient information to other than the insurance companies and governmental agencies? That's all that's alleged in the complaint, Your Honor. That's what they are relying on. It is that activity that they are relying on here to try to bring advocate within the scope of the application. So, what statute should they have come in under? What should they have done here? Well, they have asserted common law claims, Your Honor, which obviously the court doesn't have jurisdiction over unless the FCRA claim makes sense. There are 13 or 14 other class actions that have been consolidated in various courts around the state. There are all sorts of other claims that are being asserted. One problem with many of those claims is that the plaintiffs have not asserted any injury to themselves, and therefore, they either lack standing or fail to allege damages. But in terms of what they should do, Your Honor mentioned HIPAA and whether they have a remedy there. I'm certainly not conceding or acknowledging that the client, that advocate did anything in violation of any of those statutes. In fact, FCRA, the Fair Credit Reporting Act, expressly acknowledges in its wisdom that uses or disclosures of protected information by covered entities such as advocate that are permitted by HIPAA are expressly not part of the FCRA statute. They are not covered by FCRA. So when advocate submits information to insurance companies, which like any other health care entity, it must do in order to facilitate reimbursement for the services it is in the business of providing, those being health care services. HIPAA says, you are allowed to disclose that information for purposes related to your health, treatment, or payment operations. So that's expressly an overarching exclusion from the FCRA statute that their allegations clearly support here. Because what they are alleging, again, is that by virtue of providing this information to insurance companies, they think advocate has become a consumer reporting agency under FCRA, when in fact, just the opposite is true. So the fact that the company left private health insurance on millions of patients on four unsecured hard drives is not something we should be concerning ourselves with? Well, I think the question, Your Honor, is whether it's a FCRA issue, and it simply is not. This is a square peg trying to be forced into a round hole. And why do you think that happened? Because, I'm sorry? And why do you think that is the case? Why are they here on FCRA? Because the reason that they... Let's see how open you are. Okay, and I'm sorry, the question is, why do I think that this is a square peg in a round hole? No, why do you think they did that, if it's a square hole in a round? Why do I think the plaintiffs did that? Why did they assert this claim? I would say it's the willfulness penalty that they are interested in, the $100 or $1,000 per person times 4 million people in their alleged class, for an act that doesn't apply here. Because consumer reporting agencies are in the business of aggregating, not just their own experiences with their own patients, which is what counsel has alleged is the case here. In fact, I think I heard him say that he acknowledges that when a company is involved in its own singular activities with its own customer base, or in this case, its own patient base, that's not a FCRA matter. But that is, in fact, what he's alleged here. If you look at paragraph 59 of his amended complaint, he is saying that every single member of his 4 million person proposed class either is or was an Advocate patient. And all that he's alleging that Advocate is doing is furnishing information about its own patients to insurance companies. So the court asked counsel about the Fleet Mortgage case. In Fleet Mortgage, this court's held. Excuse me. That when a creditor merely passes along information concerning particular debts owed to it, it is not a purveyor of consumer reports. It is not a consumer reporting agency, and the information it's reporting are not consumer reports. Suppose Advocate's actions have been more blatant, and it had furnished private health care information to people to whom it should not have. What would have been Ms. Tierney's remedy in such a case? I would think there would be common law remedies for deliberate improper disclosures to people who aren't authorized to receive it. Again, that's not what's before this court. What's before this court is a question of statutory application. They are bringing this claim under 1681EA, which requires reasonable procedures to be put in place by consumer reporting agencies, which we're not, to prevent or limit furnishing to people who shouldn't have it. And if you look at the whole statute, I don't see the design systems language that counsel referred to. That's not in there. But what is in there is language requiring the CRA, the Consumer Reporting Agency, to require end users to identify themselves and to certify what their purpose is. And it requires the agency to make an effort to identify the people to whom it is deliberately, purposefully furnishing information. And Judge Springman, you asked about the furnishing in the Roe versus Unicare, I think it was. That was information that the defendant put out on the internet. There is no case that holds that being the victim of a burglary or being the victim of a data intrusion can be construed as the defendant furnishing the information to the thief. In other words, information that has been stolen has not been furnished. Exactly. And there are three cases that we are aware of that have directly addressed that issue. In the context of data breaches, and they all have held, furnishing cannot be stretched to include that kind of action. Furnishing is a volitional, purposeful act by the entity providing the information. Even when there's no level of diligence in protecting information? It would not be a FCRA matter. It would not be a FCRA matter. What were the specific, how did the burglary occur? What happened? It was a break-in by two individuals into the locked offices of an administrative building that Advocate has. There was really no indication that the thieves were the kind of sophisticated people who hack into networks, for example. So it was just merely a theft of the computers themselves? Yeah, computer towers were taken, among some other items as well, including, I believe, a floor cleaning machine. And that was the circumstance. And it happened in July of 2013, and here we are nearly two years later, and two of these six individuals say they have experienced some misuse of their identity in the interim. Plaintiffs themselves allege that nine million American individuals a year are the victims of actual identity theft. So the numbers don't necessarily paint a picture, as they have in other cases, like the Haniford case, which I believe has been cited in the briefs, where there were hundreds or thousands of instances of identity theft in the wake of a network payment card network intrusion. Here, that's not the case. But that's only relevant here if they first get past the hurdle of establishing that Advocate is in the business regularly for a fee, or otherwise of providing a service of aggregating consumer information, not just their own patients, but aggregating consumer information, assembling it, evaluating it, and then providing it for that fee to a third party who's going to use it for certain enumerated purposes. None of that has happened here. There are no other questions. I thank the Court for its attention. Thank you, Counsel. Thank you. How much time? You have two minutes. Thank you, Your Honor. I'll speak quickly then. First of all, Judge Roldner, you read language from their brief that said that plaintiffs admitted. We did not admit that. They cited paragraph 50 in our complaint. I just read it. Paragraph 50 does not say that we admitted that they don't receive payment. They were wrong in their brief, and it wasn't our language. What they have to skip, and they do skip, is the idea that this is a not-for-profit. They can't talk about it because they're hoisted on it. It is. They're done on that issue. They want to talk about other things, but it doesn't escapate them from not-for-profit. They said the material wasn't aggregated. It absolutely was aggregated. There's information of 4 million people on these desktops that's aggregated. They keep talking about non-medical information. FCRA clearly provides for the protection of medical information. They avoid it throughout their briefs. They breached it. They had it. They turned protected medical information into unprotected medical information. He said that the desktops were kept locked and secured. No, they weren't. That room was open. It was the back door that the crooks came in by using a screwdriver and pulled by their own counsel. So when he says locked in that room, no, they weren't. Well, on that point, where the issue was raised that what the plaintiff or what the petitioner is seeking is really an opportunity to prove willfulness, and you had indicated that is an issue that should go to the jury, what is the evidence then that you would intend to present on showing willfulness? Willfulness would be experts in the area saying this violates common sense and reason. Their own person saying, hey, we should never put it on that. We had a secured system. We could have put it on and we didn't from the mouths of their own company. Respectfully, I'd take that to a jury all day long if the judge wouldn't give me a summary. There is no way they have to be embarrassed to have maintained that type of information in that category. Was there a policy that you found during the course of discovery that Advocate had with regard to securing that office where these laptops and towers were stored? Your Honor, I don't believe we've had discovery yet, but I would say this. If they have a policy that authorizes that kind of conduct, they ought to fire everybody that even read it, let alone inked it. But I don't have discovery yet. If they have a secured system, I have to believe somewhere along the line, somebody, more than one person, violated whatever they did. Again, they avoid the clear language that applies to them. Talk about parts they think doesn't. Respectfully, if these consumers are going to try to get any kind of recovery, this is it. One quick more point, and I apologize. Counsel referenced hundreds of thousands of claims in Hanford. I was in Hanford. There were claims, but there weren't hundreds of thousands. Neither here nor there, different kind of case. But I would also tell you there was an allusion to the idea where you go off into the state courts there and go get your remedy. Well, he knows. He's defending them, or his firm is. Every one was dismissed other than with regard to an individual claiming they had an actual data breach. There were 13 put together, I think, in the state court, dismissed, a motion to dismiss. There was one in King County, dismissed. It may be on appeal. There was one in Lake County that was dismissed, and a motion for reconsideration was denied. So the idea that there's any allusion put to this panel that, oh, all these remedies are waiting for the people in the state court, it's hogwash. Thank you. Thank you, counsel. Thanks to both counsel. The case will be taken under advisement. We move to the second.