The Southern District of Florida Issues Ruling Further Limiting Claims in Data Breach MDL
The Southern District of Florida issued its second motion to dismiss ruling in the multidistrict litigation (“MDL”), In re Mednax Services, MDL No. 2994, further limiting Plaintiffs’ claims but allowing the case to proceed to discovery. This ruling is a mixed bag for the Defendants but consistent with rulings in prior cases (where the half of disputes tend to make it past initial practice, in some form, even if the claims at issue are winnowed). Read on to learn more about this litigation and the legal theories advanced by Plaintiffs.
As we previously covered, the Mednax Defendants are healthcare providers whose patient information—encompassing nearly 1.3 million patients—was accessed by a third party. The Mednax Plaintiffs sued on behalf of themselves and their minor children, claiming that this data event exposed them to various harms. Specifically, they asserted that Defendants failed to properly secure said personal health information. Further, they alleged that Defendants’ response to the healthcare data breach resulted in additional harm to Plaintiffs and their minor children. The first amended complaint contained twenty-two state-law claims (for breach of implied covenant, violations of state and consumer laws, breach of implied contract, negligence, negligence per se, invasions of privacy, breach of fiduciary duty, and negligent training and supervision) on behalf of thirteen potential classes and subclasses of Plaintiffs.
The Mednax Defendants moved to dismiss the first amended complaint, which the Court granted in part. The Court dismissed without prejudice and with leave to amend six claims: violation of the Maryland Personal Information Protection Act (“MPIPA”); violation of the Florida Deceptive and Unfair Trade Practices Act (“FDUTPA”); violation of the Missouri Merchandising Practices Act (“MMPA”); violation of the Texas Deceptive Trade Practices-Consumer Protection Act (“TDTPCPA”); violation of the Virginia Consumer Protection Act (“VCPA”); and negligence. The Court further dismissed with prejudice nine claims: breach of the covenant of good faith and fair dealing, violation of the California Unfair Competition Law; violation of the California Consumer Legal Remedies Act; violation of the Oklahoma Consumer Protection Act; violation of the South Carolina Unfair Trade Practices Act; breach of implied contract; invasion of privacy by public disclosure of private facts; breach of the fiduciary duty of confidentiality; and negligent training and supervision. The remaining seven claims survived dismissal.
The Plaintiffs then filed a second amended complaint attempting to cure the pleading deficiencies identified in the Court’s first ruling. The Mednax Defendants, in turn, filed a second motion to dismiss, seeking to dismiss four of the Plaintiffs’ eleven remaining counts—three of which the Court had previously dismissed without prejudice (the FDUTPA, MMPA, and VCPA claims). As to the fourth claim under the New York General Business Law (“NYGBL”), the Court had declined to dismiss it, but permitted the Mednax Defendants’ additional briefing on this claim after finding their new arguments “sufficiently meritorious.”
In ruling on the Mednax Defendants’ second motion to dismiss, the Court once again granted in part and denied in part the motion. The Court found that the Plaintiffs are entitled to seek declaratory and injunctive relief under the FDUTPA, regardless of whether they seek monetary damages because the FDUTPA does not limit the remedies that a plaintiff can seek. As to the re-pleaded MMPA and VCPA claims, however, the Court found that dismissal with prejudice was warranted because the Plaintiffs had not remedied the central defects of their original claims. Despite additional allegations in the second amended complaint, the Plaintiffs still did not allege that any Plaintiff received healthcare services from physicians affiliated with the Mednax Defendants’, such that they adequately pleaded a MMPA claim. Moreover, the Plaintiffs had not sufficiently alleged that the Mednax Defendants had actual knowledge they withheld from the Plaintiffs regarding the breach such that the Plaintiffs stated a VCPA claim. Lastly, despite the Plaintiffs’ NYGBL previously surviving dismissal, the Court reconsidered its earlier ruling and dismissed this claim, finding that the Plaintiffs had not pleaded a sufficient nexus to New York in order to state an NYGBL claim.
Accordingly, only eight claims will proceed to discovery in this MDL, less than half of those pleaded.