Slashdot Mirror
Federal Court: Theft of Medical Records Not an 'Imminent Danger' To Victim
chicksdaddy writes: A federal court in Texas ruled last week that a massive data breach at a hospital in that state didn't put patients at imminent risk of identity theft, even when presented with evidence that suggested stolen patient information was being used in attempted fraud and identity theft schemes. According to a post over at Digital Guardian's blog Beverly Peters was one more than 400,000 patients of St. Joseph Hospital whose information was stolen by hackers in an attack that took place between December 16 and 18, 2013.
Peters alleged that her personal information had been exposed in the breach and then disseminated in the public domain, where it was being "misused by unauthorized and unknown third parties." Specifically: Peters reported that, subsequent to the breach at St. Josephs, her Discover credit card was used to make a fraudulent purchase and that hackers had tried to infiltrate her Amazon.com account — posing as her son. Also: telemarketers were using the stolen information. Peters claimed that, after the breach, she was besieged with calls and solicitations for medical products and services companies, with telemarketers asking to speak to her and with specific family members, whose contact information was part of the record stolen from St. Joseph's.
As a result, Peters argued that she faced an "imminent injury" due to "increased risk" of future identity theft and fraud because of the breach at St. Joseph, and wished to sue the hospital for violations of the Fair Credit Reporting Act (FCRA). But the court found otherwise, ruling that Peters lacked standing to bring the case in federal court under Article III of the Constitution. That was because she hadn't been able to prove any direct damages from the attempted identity theft that occurred in the past (Discover reversed the fraudulent charge), while the threat she faced in the future was not "imminent."
As this article notes, the ruling turns on a high profile case involving government surveillance and the now-infamous FISA courts dating back to the Carter administration: Clapper v. Amnesty International USA. In that case, the U.S. Supreme Court ruled against the human rights group and a collection of lawyers and reporters in a challenge to part of the Foreign Intelligence Surveillance Act (FISA). The plaintiffs said they feared that their sources, colleagues and clients would be targets of U.S. government surveillance, and the threat would force them to take expensive security measures to keep their communications private. The High Court ruled otherwise, saying the threat of government surveillance was hypothetical, but not "certainly impending."
In his 15 page ruling (PDF), U.S. District Judge Kenneth Hoyt said the same logic applied to Peters' suit as well. "Under Clapper, Peters must at least plausibly establish a "certainly impending" or "substantial" risk that she will be victimized," Hoyt wrote. "The allegation that risk has been increased does not transform that assertion into a cognizable injury.
Peters alleged that her personal information had been exposed in the breach and then disseminated in the public domain, where it was being "misused by unauthorized and unknown third parties." Specifically: Peters reported that, subsequent to the breach at St. Josephs, her Discover credit card was used to make a fraudulent purchase and that hackers had tried to infiltrate her Amazon.com account — posing as her son. Also: telemarketers were using the stolen information. Peters claimed that, after the breach, she was besieged with calls and solicitations for medical products and services companies, with telemarketers asking to speak to her and with specific family members, whose contact information was part of the record stolen from St. Joseph's.
As a result, Peters argued that she faced an "imminent injury" due to "increased risk" of future identity theft and fraud because of the breach at St. Joseph, and wished to sue the hospital for violations of the Fair Credit Reporting Act (FCRA). But the court found otherwise, ruling that Peters lacked standing to bring the case in federal court under Article III of the Constitution. That was because she hadn't been able to prove any direct damages from the attempted identity theft that occurred in the past (Discover reversed the fraudulent charge), while the threat she faced in the future was not "imminent."
As this article notes, the ruling turns on a high profile case involving government surveillance and the now-infamous FISA courts dating back to the Carter administration: Clapper v. Amnesty International USA. In that case, the U.S. Supreme Court ruled against the human rights group and a collection of lawyers and reporters in a challenge to part of the Foreign Intelligence Surveillance Act (FISA). The plaintiffs said they feared that their sources, colleagues and clients would be targets of U.S. government surveillance, and the threat would force them to take expensive security measures to keep their communications private. The High Court ruled otherwise, saying the threat of government surveillance was hypothetical, but not "certainly impending."
In his 15 page ruling (PDF), U.S. District Judge Kenneth Hoyt said the same logic applied to Peters' suit as well. "Under Clapper, Peters must at least plausibly establish a "certainly impending" or "substantial" risk that she will be victimized," Hoyt wrote. "The allegation that risk has been increased does not transform that assertion into a cognizable injury.
I wonder if Judge Kenneth Hoyt would be cool with hackers openly posting all of his personal info online. After all, it's not a cognizable injury or anything.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
What a clueless moron that judge is. No wonder in a state that teaches intelligent design and where half the people are functionally illiterate and marry their cousins.
This guy is an embarrassment and a liberal ass.
Yeah...Regan nominated him. This what you get for trying to be "inclusive".
Maybe this is saying that you can't sue for something that hasn't happened yet - and, indirectly, that the law requiring protection of confidentiality (and penalizing failure) has no teeth, and that the limits against abusive overreach of law are allowing an end-run around the general intent.
Let's say you had a workman at your house, and they left the garage door unlocked when they were finished. If you come home and everything is fine, then there is no cause for legal action. If you come home and your house has been robbed, then first it's the robber's criminal act, and then maybe there's a civil action by your insurance company to get money from the workman's insurance company.
The hospital is seen as the *victim* of a theft, just as if a doctor's or psychiatrist's office were broken into for drugs and some records were stolen, rather than a *culprit* for "failing to maintain HIPAA confidentiality". YOU have to go after each person who does something illicit with the information; each marketer, each fraud instance, each problem, is individual. And since each of them is small individually, it's YOUR burden to chase them as a civil matter rather than a criminal matter that would get you some help from society (through the police agencies).
Do you have any concept of what the case is about here?
Standing requires you to have:
1) actual injury (or imminent injury);
2) The injury must be caused by the defendants' actions or negligence;
3) The injury must be redressable - e.g., it must be likely that court action will remedy the situation and make the plaintiff "whole" again;
What is alleged by the plaintiff in this case is that "I'm at heightened risk of identity theft because of this, therefore St. Joseph's is in violation of the law and should be punished for the leak." Except every injury she claims is theoretical - not imminent, and there is no way of telling from ONLY her claims whether or not these claimed injuries were caused by the St. Joseph's leak. My medical records have never been breached, but somebody's stolen my credit card number before... so there are, clearly, other ways for a credit card number to be stolen. My medical records have never been breached, but I've received spam mail that appears to be from my own email address - so again, clearly there's other ways for this to happen. My medical records have never been breached, but I've received numerous and frequent calls from telemarketers - again, if all they have is her claim, then the preponderance of the evidence doesn't show that St Joseph's is the CAUSE of her woes.
What's more, the only *actual injury* she's sustained has been fixed already - Discover declined the charge & issued her a new account.
What's left is big scary sounding ghost stories that "someday some hacker might use my stuff to do scary stuff, and the only way that could have happened is through St. Joseph's negligence."
So... yeah, she doesn't have standing to file a class action suit. In making this judgement, the government *is* following the law. Of course, if you'd like to revise the rules for Standing, then I'll go file a federal case against you because I'm afraid that something I've said here might make you punch me in the mouth someday. Because you know, punching someone in the mouth is against the law, and you MIGHT do it to me someday, so it never hurts to get you thrown in jail ahead of time - right?
Let's say the Feds set up an illegal surveillance program (what? never happen!).
They illegally spy on people but you don't know who. They may have spied on you, but you can't prove it.
So YOU can't file a lawsuit against the feds because YOU haven't been spied on.
Do you see how ridiculous "Standing" is in this situation?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Although it is alleged that St. Joseph's failures "proximately caused" these injuries, the allegation is conclusory and fails to account for the sufficient break in causation caused by opportunistic third parties. The injuries, to the extent that they meet the first prong, are "the result of the independent action of a third party" and therefore not cognizable under Article III.
1) Company leaks your data
2) Third parties abuse your data
3) You don't have standing to sue company, because you've been harmed by third parties.
Who else would have standing to sue expect for the people whose data is being protected? This is basically saying nobody has standing and the law is null and void. This judge should rule the Snowden trial, if there ever is one. He'd dismiss all charges because the US government would lack standing, they haven't been harmed by Snowden's actions only the actions of independent third parties acting on his information. That's a clear break in causation, don't you agree?
Live today, because you never know what tomorrow brings