Mid-Atlantic Health Law TOPICS

A version of this article was printed in The Daily Record on February 27, 2017.

In the May 2016 case of Spokeo v. Robins, the United States Supreme Court barred federal courthouse doors to a wide swath of lawsuits complaining about intangible or ephemeral injuries. The ruling is already reverberating through health care litigation, as federal courts have since used the reasoning of Spokeo to reject privacy-related lawsuits brought by patients against health care providers.

More specifically the Supreme Court, in Spokeo, ruled that a person must suffer concrete harm to sue in federal court. A bare violation of a statutory right, namely, a bare procedural or technical violation of federal law, cannot serve as a substitute for the concrete injury required by Article III of the United States Constitution, which is the part of the Constitution that establishes the federal courts. Therefore, without such a concrete injury, a federal court simply does not have the jurisdiction to resolve the matter.

A. The Facts of Spokeo

Spokeo is a "people search" website that aggregates publicly available information without independently verifying the information. Thomas Robins alleged that a search of his name on Spokeo returned inaccurate, albeit not derogatory, information, and he filed a class-action complaint against Spokeo for willful violations of the Financial Credit Reporting Act (FCRA). The FCRA requires consumer reporting agencies to maintain the maximum possible accuracy of its consumer reports.

B.  The Supreme Court's Opinion

The Supreme Court ruled that to establish standing to sue under Article III of the Constitution, a person must suffer an "injury in fact."  To do so, the harm suffered must be both "particularized," meaning it affects the person in an individual way, and "concrete," meaning the injury is de facto, it actually exists.

The Court further held that an intangible harm can be concrete, such as the deprivation of free speech. According to the Court, when determining whether an intangible harm is concrete, courts should look to whether the intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts. And, courts should look to Congress, because Congress is well positioned to determine when an intangible harm meets minimum Article III requirements.

However, Article III standing requires a concrete injury even in the context of a statutory violation, meaning, the bare procedural violation that Robins alleged, in the absence of any concrete harm, did not satisfy the injury in fact requirement of Article III.

C.  The Impact of Spokeo on Health Care

Khan v. Children's Nat'l Health Sys. is a class action, filed in federal court in Maryland. The case involved an allegation that Children?s Hospital in D.C. did not take sufficient steps to protect patient information following a breach of employee email accounts. Hackers gained access to the email accounts, which contained certain patient information, on or about July 26, 2014. However, Children's did not learn of the breach until December 26, 2014, which meant that the information was potentially exposed for five months.

According to the court, Khan's most promising argument for injury in fact was that the breach placed her at increased risk of identity theft. However, because Khan could not show either actual misuse of personal data or intent to misuse the data, the court, relying on Spokeo, recently determined that Khan did not connect the alleged statutory and common law violations to a concrete harm. Therefore, Khan did not sufficiently allege an injury in fact as required to establish Article III standing.

In another class action complaint, Smith v. Facebook, which was filed in a federal court in the Northern District of California on March 15, 2016, Facebook users alleged that health care providers violated health privacy laws when they allowed Facebook to access data collected from inquiries made by visitors to the providers' websites.

On June 30, 2016, the health care providers and Facebook filed a joint motion to dismiss, arguing that post-Spokeo, the Facebook users had failed to show a concrete harm. According to the health care providers, an allegation that the information that can be gleaned from such inquiries is valuable to advertisers is not a concrete harm sufficient to satisfy Article III's injury in fact requirement. Until the Facebook users can show that someone was willing to pay for their personal information, or that their personal information has lost market-ability or value, their alleged harm is merely speculative.

While this area of the law is obviously still evolving, so far, it appears to be adhering to the maxim "no harm, no foul."

Barry Rosen
(410) 576-4224 • brosen@gfrlaw.com