In re Community Health Systems Inc., MDL 2595

Filing 144

MEMORANDUM OPINION ON MOTIONS TO DISMISS Signed by Chief Judge Karon O Bowdre on 9/12/16. (SAC )

FILED
2016 Sep-12 PM 02:25
U.S. DISTRICT COURT
N.D. OF ALABAMA

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ALABAMA
SOUTHERN DIVISION

IN RE: COMMUNITY HEALTH
SYSTEMS, INC.,
CUSTOMER SECURITY DATA
BREACH LITIGATION
(MDL 2595)

)
)
)
)
)
)
)

MASTER FILE NO.
15-CV-222-KOB

This document relates to all cases.

MEMORANDUM OPINION ON MOTIONS TO DISMISS
The Consolidated Amended Class Action Complaint (“Consolidated Amended Complaint”
doc. 53 as amended by doc. 130) in this Multi-District Litigation lists forty Named Plaintiffs
hailing from twenty-four different states. Plaintiffs seek to represent a class comprised of millions
of people whose personal information was affected by a data breach in 2014 involving the
computer network for Community Health Systems.
Two dispositive motions are pending before this court: (1) “Community Health Systems,
Inc. [CHSI]’s Motion to Dismiss for Lack of Personal Jurisdiction, Lack of Subject Matter
Jurisdiction, and Failure to State a Claim” (doc. 67); and (2) Community Health Systems
Professional Services Corporation [PSC]’s “Motion to Dismiss” (doc. 69). The court held two
extended hearings on these motions, one on February 10, 2016 and a second on April 15, 2016.
After the first hearing, the court entered its “Partial Order on Motions to Dismiss” (doc. 125) to
state, confirm, and clarify the oral rulings the court had made prior to the second hearing.
The instant Memorandum Opinion is meant to be a comprehensive compendium and
clarification of rulings on the two motions to dismiss, including not only those rulings already

1

stated in the Partial Order but also those addressed at the second hearing; the instant document also
includes a summary of the reasons for those rulings. The transcripts of the two hearings contain a
more extensive discussion of those reasons.
The court WILL GRANT IN PART and DENY IN PART both motions to dismiss, as more
specifically stated below and for the reasons explained on the record and summarized below.
I. Personal Jurisdiction over CHSI - Rule 12(b)(2)
Defendant CHSI challenges the court’s exercise of personal jurisdiction over it. The Due
Process Clause of the Fourteenth Amendment requires that a court have personal jurisdiction over
a defendant before it may render a judgment against it. See World-Wide Volkswagen v. Woodson,
444 U.S. 286, 291 (1980). To obtain personal jurisdiction over a nonresident defendant in a
diversity action, plaintiffs must show that jurisdiction exists under the laws of the forum state
where the case was filed and also that“sufficient minimum contacts [exist] between the forum state
and the defendant[ ] such that satisfy the Fourteenth Amendment Due Process Clause’s notions of
fair play and substantial justice.” Lockard v. Equifax, Inc., 163 F.3d 1259, 1265 (11th Cir. 1998).
Some of the claims in this case were originally filed in this court and in other federal courts
in Alabama, but many of the claims were transferred to this court from other fora to be
consolidated into this MDL. The undersigned, as the transferee judge in an MDL, possesses “‘all
the jurisdiction and powers over pretrial proceedings in the actions transferred to [her] that the
transferor judge would have had in the absence of transfer.’” See In re Agent Orange Prod. Liab.
Litig MDL No. 381, 818 F.2d 145, 163 (2d Cir. 1987) (quoting In re FMC Corp Patent Litig., 422
F. Supp. 1163, 1165 (J.P.M.D.L. 1976)).
The long-arm statutes of the transferor jurisdictions in this MDL vary; however, finding
2

sufficient minimum contacts provides a necessary step in any personal jurisdiction analysis, and
CHSI argued that Plaintiffs are unable to establish such minimum contacts in any transferor forum
except Tennessee. To determine whether the Plaintiffs had in fact done so, the court analyzed
whether Plaintiffs had established this court’s general and/or specific personal jurisdiction over
CHSI in each transferor forum and in Alabama.
A. Tennessee Claims
This court FINDS that it has personal jurisdiction over Defendant CHSI, a publicly-traded
Delaware holding company with its principal place of business in Tennessee, for the claims
asserted in the Consolidated Amended Complaint by the Plaintiffs who filed one of the three cases
transferred to and consolidated with this MDL from a district court sitting in Tennessee: Ellzey v.
Cmty. Health Sys., Inc., No. 2:15-CV-1640 (N.D. Ala.) [No: 3:15-CV-00832 (M.D. Tenn.)];
Murphy v. Cmty. Health Sys., Inc., No: 2:15-CV-281 (N.D. Ala.) [ No. 3:15-CV-00031 (M.D.
Tenn.)]; and McNutt v. Cmty. Health Sys., Inc., No. 2:16-CV-602 (N.D. Ala.) [ No. 3:16-CV-698
(M.D. Tenn.)].1
The parties had previously acknowledged in CHSI’s motion to dismiss, in briefs supporting
and opposing that motion, and at the hearings, that this court has general personal jurisdiction over
the claims against CHSI originally brought in Tennessee transferor courts because CHSI’s
principal place of business and office are in Tennessee. No dispute exists on this issue, and
CHSI’s motion to dismiss excluded claims that were filed in a Tennessee transferor court. The
1

The McNutt case, originally filed in the Middle District of Tennessee on March 31,
2016 and transferred to this MDL, will be designated as “McNutt II,” given that another case
bearing the name of McNutt v. Cmty. Health Sys., Inc., No. 4:15-CV-221 (N.D. Ala.) (“McNutt
I”) was originally filed in the Northern District of Alabama on February 5, 2015, and reassigned
to the undersigned to be part of this MDL.
3

McNutt II case was filed in Tennessee and transferred to this court after the court ruled that it had
personal jurisdiction over CHSI only for Plaintiffs’ claims that were originally filed in Tennessee;
at the time of the partial order regarding challenges to personal jurisdiction over CHSI, the MDL
encompassed only the Ellzey and Murphy cases. This court’s finding that it has personal
jurisdiction over the claims asserted against CHSI in cases originally filed in Tennessee courts
applies to and encompasses the claims in McNutt II.
The Plaintiffs agreed through counsel, after the recent filing of the McNutt II action in
Tennessee, that the Consolidated Amended Complaint (doc. 53) remains the operative Complaint
in this MDL; and that the rulings regarding the Consolidated Amended Complaint remain in effect
and apply to the McNutt II action, including the ruling that this court has personal jurisdiction over
CHSI for the claims—such as those in McNutt II—filed in Tennessee and transferred to this court.2
(Doc. 126).
B. Claims Brought in Other Jurisdictions
As to the claims against CHSI that were not originally brought in Tennessee, CHSI
challenged this court’s personal and subject matter jurisdiction over it via the declaration of Ben
Fordham. (Doc. 68-1). In response to that challenge, Plaintiffs argued that the establishment of
jurisdiction over CHSI in one transferor forum meant that this court has jurisdiction not only over
the Tennessee claims transferred to it but also over all claims consolidated in this MDL with those
Tennessee claims. However, the court FINDS that the establishment of personal jurisdiction over
CHSI in one transferor forum of this MDL—here, Tennessee—does not confer to this transferee

2

The Plaintiffs’ agreement that the court’s ruling regarding personal jurisdiction applies
to McNutt II does not mean that they agree with the ruling itself.
4

court personal jurisdiction over CHSI for all other claims asserted against CHSI by all other
Plaintiffs in the MDL’s Consolidated Amended Complaint where the other transferor jurisdictions
could not establish jurisdiction over CHSI. See In re Showa Denko K.K. L-Tryptophan Prods.
Liab. Litig.-II, 953 F.2d 162, 165 (4th Cir. 1992) (“The authority for consolidating cases on the
order of the judicial panel on multi-district litigation, however, is merely procedural and does not
expand the jurisdiction of the district court to which the cases are transferred.”); see also In re
Genetically Modified Rice Litig., 764 F.3d 864, 873-74 (8th Cir. 2014) (quoting with approval
above language from the Showa decision); In re Avandia Mktg., Sales Practices & Prod. Litig.,
617 F. App’x 136, 141 (3d Cir. 2015) (same). The court further FINDS that the filing in this MDL
of the Consolidated Amended Complaint, which supercedes other complaints for purposes of the
pretrial proceedings in this MDL, does not expand the court’s jurisdiction over CHSI.
Given this court’s rulings that neither the MDL consolidation process nor the filing of a
Consolidated Amended Complaint automatically expands this court’s personal jurisdiction over
CHSI beyond the Tennessee claims, the Plaintiffs attempted to establish jurisdiction over CHSI in
transferor jurisdictions other than Tennessee by pointing to CHSI’s affiliates and subsidiaries that
do business in other states. The Plaintiffs alleged in the Consolidated Amended Complaint that
“[t]hrough a network of affiliates, CHS[I] owns or leases 199 hospitals in 29 states . . . and
provides outpatient and physician services through a variety of facilities . . . .” (Doc. 53, at 23 ¶
54). The Plaintiffs argued in their briefs that CHSI is not legally distinct for purposes of personal
jurisdiction from PSC and/or the affiliated facilities referenced in the Consolidated Amended
Complaint that allegedly provided healthcare services to Plaintiffs.

5

However, CHSI presented evidence3 establishing that CHSI is a holding company with no
employees, a corporate entity separate and distinct from PSC and the referenced affiliated facilities.
Fordham’s declaration stated that CHSI is a parent company that does not directly own PSC or any
of those healthcare providers referenced in the Consolidated Amended Complaint whose acts in the
relevant states allegedly confer jurisdiction over CHSI in this MDL. The general rule, which all
relevant jurisdictions in this MDL follow,4 is that “[j]udicial jurisdiction over a subsidiary
3

Where, as here, a motion to dismiss presents a factual challenge to the court’s
jurisdiction, “‘the trial court is free to weigh the evidence and satisfy itself as to the existence of
its power to hear the case.’” Lawrence v. Dunbar, 919 F.2d 1525, 1529 (11th Cir. 1990)
(quoting Williamson v. Tucker, 645 F.2d 404, 412 (5th Cir.), cert. denied, 454 U.S. 396 (1981)).
4

The following cases are decisions in Alabama, where this transferee court sits and where
other cases in this MDL were filed, as well as in states in which other transferor courts sit:
Alabama (Alverson, Barr, Jones, McNutt I): Ex parte British Steel Corp., 426 So. 2d 409, 412
(Ala. 1982) (“[I]t is the rule that the parent’s use of the subsidiary in the forum does not
necessarily subject the parent to the jurisdiction [of the forum] . . . .” (internal quotation marks
and cites omitted)); Florida (Veciana): Gadea v. Star Cruises, Ltd., 949 So. 2d 1143, 1146 (Fla.
3d Dist. Ct.App. 2007) (quoting with approval the following language from Enic, PLC v. F.F.
South & Co., 870 So. 2d 888, 891-92 (5th Cir. 2004):“‘It is well settled in Florida that the mere
presence of a subsidiary in Florida, without more, does not subject a non-Florida corporate parent
to long-arm jurisdiction.’” ); Indiana (Watson): LinkAmerica Corp. v. Cox, 857 N.E. 2d 961, 964
(Ind. 2006) (“We also hold that the actions of a subsidiary corporation do not ordinarily establish
personal jurisdiction over its parent and find that principle controlling in this case.”); Mississippi
(Lawson): Hogrobrooks v. Progressive Direct, 858 So. 2d 913, 921 (Miss. Ct. App. 2003)
(addressing the parent-subsidiary relationship in the context of jurisdiction, and stating that the
corporate veil can only be pierced when the corporations do not recognize their separation; citing
with approval Gammill v. Lincoln Life & Annuity Distrib., Inc., 200 F. Supp. 2d 632, 635 (S.D.
Miss. 2001) (analyzing Mississippi’s long-arm statute and stating: “[t]he assertion that LNC is a
parent company of another defendant properly before this court is not a sufficient reason standing
alone for asserting in personam jurisdiction over a non-resident parent corporation.”); New
Mexico (Brito and Maes): Weisler v. Cmty. Health Sys., Inc., No. 12-CV-0079, 2012 WL
4498919, at *11 (D.N.M. Sept. 27, 2012) (finding that the plaintiff was unsuccessful in his
“attempts to use Defendant CHSI’s indirect ownership of its subsidiary the Hospital as a means
of establishing general jurisdiction over Defendant CHSI by contending that CHSI conducted
business in New Mexico through its subsidiary” and finding that no exceptions to the general rule
applied there, such as agency or alter-ego theories, based on the parent’s control of the
subsidiary); Ohio (Keen): Rucker v. Pers. Fin. Co., 90 N.E. 2d 428, 430-31 (Ohio. Ct. App.
6

corporation does not of itself give a state judicial jurisdiction over the parent corporation . . . even
though the parent owns all of the subsidiary’s stock.” Restatement (Second) of Conflicts § 52 cmt.
b (Am. Law Inst. 1971); see Cannon Mtg. Co. v. Cudahy Packing Co., 267 U.S. 333, 337 (1925)
(affirming dismissal of the action for lack of jurisdiction, finding that a Maine parent corporation
did not do business in North Carolina and rejecting the argument that its wholly owned subsidiary,
a separate and distinct Alabama corporate entity with an office in North Carolina, was the parent’s
agent for jurisdictional purposes). Therefore, the relationship of parent and subsidiary alone does
not confer personal jurisdiction upon this court over CHSI itself based on acts allegedly committed
by its subsidiaries.
Plaintiffs argued that personal jurisdiction should attach to CHSI based on the business
activities and actions of its subsidiaries because those subsidiaries function as agents of CHSI.
They based that argument in part upon allegations that CHSI chose to control the storing and

1948) (holding that the “fact that the stock of the subsidiary was held by the foreign corporation
and that the foreign corporation exercised control over the subsidiary through ownership of the
stock, the corporate identity being formally preserved, is not sufficient to subject such foreign
corporation to the jurisdiction of the state court”); Pennsylvania (Lutz, Roman & Smith):
Botwinick v. Credit Exch., Inc., 213 A. 2d 349, 354 (Pa. 1965) (finding “that the Pennsylvania
corporation, even though a subsidiary of the New York corporation, was not a mere
instrumentality of the latter,” and thus, that the Pennsylvania courts did not have jurisdiction over
the New York corporation based on the Pennsylvania subsidiary); Washington (Adams):
Williams v. Canadian Fishing Co., 509 P. 2d 64, 67 (Wash. Ct. App. 1973) (“We agree with
respondent that ownership of a subsidiary by a parent, with nothing more, is not sufficient to
constitute ‘doing business,’ for jurisdictional purposes . . . . Although in the case at bar the
parent and subsidiary corporations share a common director, there is no showing in the record
that the officers of the subsidiary do not act independently of the parent corporation or that the
subsidiary is otherwise a ‘mere instrumentality’ of the parent.”); and West Virginia (Glah):
Norfolk S. Ry. Co. v. Maynard, 437 S.E. 2d 277, 281 (W. Va. Sup. Ct. App. 1993) (“A parentsubsidiary relationship between corporations, one of which is ‘doing business’ in West Virginia,
does not without showing of additional factors subject the nonresident corporation to this state’s
jurisdiction.”).
7

protection of Plaintiffs’ confidential data in a collective fashion. However, Fordham’s declaration
specifically stated that CHSI “does not control or otherwise participate in any way in data
operations at the Facilities or [PSC], including collection, protection, storage or handling of
personal information obtained from patients who receive medical care at the Facilities,” and that
CHSI “has never possessed any personal information of any patients referenced in the Amended
Consolidated Class Action Complaint.” (Doc. 68-1, at 9, ¶ 30). Plaintiffs bear the burden of
rebutting that evidence from the declaration, and the court FINDS that they have failed to do so.
Plaintiffs also based their agency argument upon language on the www.chs.net website that
uses inclusive terms, such as “we,” “us,” “our” and “the Company”; the Plaintiffs read those terms
as acknowledging that CHSI and its subsidiaries function as one collective and integrated entity.
However, Fordham’s declaration also stated that PSC—not CHSI— owns and operates the
website. Plaintiffs bear the burden of rebutting that evidence from the declaration, but they have
failed to do so.
This court FINDS that Plaintiffs’ evidence of language in a website owned and operated by
PSC, a separate entity from CHSI, fails to support a finding that CHSI has purposefully availed
itself of the privilege of conducting activities with any forum state other than Tennessee. See Asahi
Metal Indus. Co. v. Sup. Ct. of Cal., Solano Cty., 480 U.S. 102, 112 (1987) (explaining that the
“substantial connection . . . between the defendant and the forum state necessary for a finding of
minimum contacts must come about by an action of the defendant purposefully directed toward the
forum State”) (emphasis in original). Alternatively, the court FINDS that the language on the
website owned and operated by PSC, including but not limited to the language in the section

8

“Legal Information,”5 fails to establish an agency relationship between CHSI and PSC, and
otherwise fails to establish CHSI’s minimum contacts with states represented in this MDL other
than Tennessee.
The Plaintiffs also relied on similar inclusive, collective language in Form 8-K6 and Form
10-K7 filings with the United States Securities and Exchange Commission (“SEC”). However, the

5

The Legal Information section specifies that CHSI “is a holding company and does not
engage in any business other than those activities associated with being a publicly traded (NYSE:
CYH) stock company, such as listing agreements with the New York Stock Exchange (‘NYSE’)
and registration and compliance with the U.S. Securities and Exchange Commission (‘SEC’)
. . . .[The NYSE and SEC] require that public companies maintain information on an internet
website that is accessible to shareholders [and] [i]ntegral to those requirements is that
information be presented in a consolidated fashion and include statements and operating results
for Community Health Systems, Inc. and its subsidiaries taken as a whole. Statements that
include the words ‘we,’ ‘us,’ ‘our,’ ‘the Company,’ and similar inclusive words are intended to
be summary information about the consolidation of Community Health Systems, Inc. and its
subsidiaries taken as a whole, and are not intended to bind or imply that the actions of one legal
entity should be attributed to the actions of another legal entity (such as Community Health
Systems, Inc.). In its registered filings with the SEC, Community Health Systems, Inc. is
required to adhere to the SEC’s principles of ‘plain English’ and avoid the use of defined terms,
jargon, and parenthetical exculpatory statements; for ease of reading, Community Health
Systems, Inc. and [PSC] adhere to those principles throughout this website. Each hospital
affiliated with Community Health Systems, Inc. and [PSC] is owned (or leased) and operated by
a separate and distinct legal entity. Each such legal entity is responsible for the healthcare
services delivered at its respective facility, employs its own management and other personnel,
and grants medical staff privileges and credentials to its own, separate medical staff.” (Doc. 68-2,
at 1).
6

Form 8-K is an SEC form that notifies investors of a current event and is filed by public
companies with the SEC.
7

Form 10-K is an annual report that the SEC requires companies to file and that gives a
comprehensive summary of a company’s financial performance. The Form 10-K upon which the
Plaintiffs rely contains the following language: “Throughout this Form 10-K, we refer to
Community Health Systems, Inc., or the Parent Company, and its consolidated subsidiaries in a
simplified manner and on a collective basis, using words like ‘we,’ ‘our,’ ‘us’ and the
‘Company.’ This drafting style is suggested by the Securities and Exchange Commission, or
SEC, and is not meant to indicate that the publicly-traded Parent Company or any particular
subsidiary of the Parent Company owns or operates any asset, business or property. The
9

Form 10-K and the www.chs.net website posting SEC filings, such as Forms 8-K and 10-K, clarify
the use of that inclusive, collective phrasing by explaining that such phrasing is meant to adhere to
the SEC’s principles of plain English for ease of reading, but is not meant to indicate that CHSI
operates the health providing facilities or to attribute to CHSI the acts of its subsidiaries. The court
FINDS that the language in these SEC filings fails to establish an agency relationship between
CHSI and PSC; that such language fails to establish an agency relationship between CHSI and the
facilities referenced in the Consolidated Amended Complaint; and that such language otherwise
fails to establish CHSI’s minimum contacts with jurisdictions in this MDL other than Tennessee.
Further, the Plaintiffs pointed to sealed insurance documents to support their claim of
agency. They alleged, without focusing on any particular policy provision and without additional
explanation, that “[i]f CHSI did not have any control of ‘data operations at the Facilities or [PSC,
LLC],’ these documents would not exist.” (Pls.’ Resp., doc. 80, at 26). The court must presume,
as CHSI has done, that the Plaintiffs were simply arguing that CHSI’s purchase of an insurance
policy that covers certain types of liability in certain amounts necessarily requires the court to
conclude that CHSI controlled PSC and the Facilities referenced in the Consolidated Amended
Complaint. The court finds no support for the Plaintiffs’ argument in the sealed documents and no
support in the law.
CHSI presented facts in Fordham’s declaration establishing that it is a separate corporate
entity from PSC and from the other facilities whose actions are challenged in the Consolidated

hospitals, operations and businesses described in this filing are owned and operated, and
management services provided, by distinct and indirect subsidiaries of Community Health
Systems, Inc.” (Fordham Decl., Doc. 68-1, at 15 ¶ 42 (quoting www.chs.net under Investor
Relations, SEC Filings, Form 10-K posted 2-25-2015, pp. 3-4)).
10

Amended Complaint; that PSC and such facilities are not agents of CHSI and that CHSI does not
otherwise control them; that CHSI does not control or participate in the collection, protection,
storage or handling of personal information from patients at the facilities referenced in the
Consolidated Amended Complaint; and that CHSI does not have the minimum contacts with
jurisdictions other than Tennessee necessary to satisfy due process guarantees of the United States
Constitution (Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). Plaintiffs bear the burden
of rebutting those facts and establishing jurisdiction over CHSI in each transferor court and
Alabama; however, Plaintiffs have failed to do so except for establishing jurisdiction over CHSI
for the claims filed against it in Tennessee.
Therefore, the court FINDS that the Plaintiffs have failed to establish that PSC and those
affiliated facilities are agents of CHSI for the purposes of establishing CHSI’s minimum contacts
with Alabama and with transferor jurisdictions. The court FINDS that the Plaintiffs have
established neither general personal jurisdiction nor specific personal jurisdiction over CHSI in
states other than Tennessee. Accordingly, the court further FINDS that CHSI’s motion to dismiss
for lack of personal jurisdiction is due to be GRANTED to the extent that it requests dismissal of
claims asserted in the Consolidated Amended Complaint against CHSI by Named Plaintiffs who
were not part of the Ellzey, Murphy or McNutt II cases that were transferred to this court. The
court WILL DISMISS WITHOUT PREJUDICE all such claims asserted against CHSI in the
Consolidated Amended Complaint pursuant to Rule 12(b)(2).
The dismissal without prejudice is a recognition that this court lacks personal jurisdiction
over Defendant CHSI for these Plaintiffs’ claims, but it is not an invitation to re-file claims in
Tennessee. The Plaintiffs have had ample opportunity to do so, as the McNutt II case
11

demonstrates.
To the extent that CHSI requests the dismissal of all claims against it in the underlying
cases that were not filed in Tennessee, the court WILL DENY WITHOUT PREJUDICE that
request at this time. The court addresses in this Memorandum Opinion and accompanying Order
only the claims in the Consolidated Amended Complaint and its Named Plaintiffs; while these
rulings affect the viability of underlying suits or certain claims in them, the parties have not yet
provided the court with the information required to address the effect of these rulings on all
underlying cases for all issues, and the court chooses not to address this issue in a piecemeal
fashion.
II. Subject Matter Jurisdiction - Rule 12(b)(1)
The court must address questions about its jurisdiction prior to making an adjudication on
the merits. Resnick v. AvMed, Inc., 693 F.3d 1317, 1323 (11th Cir. 2012). Therefore, the court
determined to first examine the Defendants’ challenge as to the Plaintiffs’ standing, “an aspect of
this case or controversy requirement.” See Cone Corp. v. Fla. Dep’t of Transp., 921 F.2d 1190,
1203 (11th Cir. 1991) (using quoted language). For matters of federal law, such as subject matter
jurisdiction, the MDL transferee court will apply the law of the circuit in which the transferee court
sits. In re Methyl Tertiary Butyl Ether (MTBE) Prods. Liab. Litig., 241 F.R.D. 435, 439 (S.D.N.Y.
2007) (stating “courts have held that the law of the transferee circuit controls pretrial issues such as
whether the court has subject matter . . . jurisdiction over the action . . . .”); In re Silica Prods.
Liab. Litig., 398 F. Supp. 2d 563, 644 n.128 (S.D. Tex. 2005) (same); see Murphy v. F.D.I.C., 208
F.3d 959, 965 (11th Cir. 2000) (finding that 11th Cir. law and not D.C. Cir. law should apply to the
federal law questions in a case transferred from D.C. Cir. to a court sitting in the 11th Cir., and
citing In re Temporomandibular Joint Implants Prods. Liab. Litig., 97 F.3d 1050, 1055 (8th Cir.
12

1996)).
A. Facial Attack on Article III Case or Controversy Standing
To establish standing in federal court, a plaintiff must plead sufficient facts to show the
following elements:
First, the plaintiff must have suffered an “injury in fact”—an invasion of a
legally protected interest which is (a) concrete and particularized, and (b)
actual or imminent, not conjectural or hypothetical[.] Second, there must be
a causal connection between the injury and the conduct complained of—the
injury has to be fairly traceable to the challenged action of the defendant,
and not the result of the independent action of some third party not before
the court. Third, it must be “likely,” as opposed to merely “speculative,”
that the injury will be redressed by a favorable decision.

Lujan v. Defenders of Wildlife, 504 U.S. 555, 560-61 (1992) (internal quotations and citations
omitted); see also Sprint Commc’ns Co., L.P. v. APCC Servs., Inc., 554 U.S. 269, 273 (2008)
(quoting Lujan with approval and listing the three elements of standing).
In its recent decision of Spokeo, Inc. v. Robins, __ U.S. __, 136 S. Ct. 1540 (2016), the
Supreme Court emphasized the injury-in-fact requirement of concreteness means that the injury
“must be ‘de facto’; that is, it must actually exist[,]”; and the requirement of particularization
means that the injury “must affect the plaintiff in a personal and individual way.” Id. at 1548.
Both are distinct from one another in a standing analysis. Both must be met. The party or parties
invoking federal jurisdiction bear the burden of establishing standing. See Susan B. Anthony List
v. Driehaus, __ U.S. ___, 134 S. Ct. 2334, 2342 (2014). Defendants challenge the existence of
the first two elements: injury-in-fact and causation.
As a preface to the analysis of the Defendants’ facial attack on standing, the court notes
that it had previously provisionally granted the Defendants’ motions to dismiss as to the nonstatutory claims asserted by Named Plaintiffs Kathy Ellzey and William Lutz, but had allowed
13

those Plaintiffs to re-plead to add additional facts. (Doc. 125, at 8). With this court’s
permission, the Plaintiffs supplemented the Consolidated Amended Complaint to replace two
paragraphs: paragraph 14 regarding Kathy Ellzey, to add additional information regarding
hacking Ms. Ellzey’s email account; and paragraph 44 regarding William Lutz, to add more
specific treatment dates for Mr. Lutz that occurred prior to the data breach in question. See Pls.’
Supp. to the Consol. Amend. Class Action Compl., doc. 130. The court FINDS in this
Memorandum Opinion that, considering the information in replacement paragraphs 14 and 44,
Kathy Ellzey and William Lutz have met the required standing elements. Thus, the court
changes the provisional granting of PSC’s motion as to their claims based on lack of standing to
a finding that Named Plaintiffs Ellzey and Lutz have pled sufficient facts to meet all three
elements of Article III case or controversy standing. The rulings in this Memorandum Opinion
address the motions to dismiss as encompassing Plaintiffs’ Supplement with the supplemental
allegations of Named Plaintiffs Ellzey and Lutz.
1. Injury-in-Fact Element of Standing
a. Overpayment
As to the first element of standing, injury-in-fact, the court FINDS that no injury-in-fact
exists for the purposes of Article III case or controversy standing based on the allegations of
“overpayment.” Plaintiffs base their general theory of “overpayment” on allegations that an
indeterminate portion of Plaintiffs’ payments to health providers “was made for the protection of
confidential patient data in Defendants’ allegedly secure computer network [and that the failure
of Defendants] to secure and protect Plaintiffs’ . . . confidential patient data” means that the
“Defendants’ retention of fees paid for that security and protection . . . represents an overpayment
for which Plaintiffs . . . should be compensated.” (Doc. 53, at 3 ¶ 10).
14

The Plaintiffs did not allege that they paid anything specific for the protection; that
patients who did not pay for services received a different level of protection from those who did
pay; that Plaintiffs paid a premium for data protection or otherwise bargained for the protection;8
or that Plaintiffs received any information about data protection other than a HIPAA Notice.
The Plaintiffs provided this court with no case law in which any federal court specifically
addressed and accepted “overpayment” as an injury-in-fact for standing purposes in an analogous
context,9 and this court is aware of none.
However, a number of courts have rejected an “overpayment” theory of damages as an
injury-in-fact for standing purposes. See Carlsen v. GameStop, Inc., 112 F. Supp. 3d 855, 861
(D. Minn. 2015) (finding that the plaintiffs had failed to establish Article III standing based on a
general theory of overpayment and stating: “Courts have generally found ‘overpayment’ theories
insufficient to establish injury, even in situations involving highly sensitive [personal
information].” (collecting cases)); In re Zappos.com, Inc., 108 F. Supp. 3d 949, 962 n. 5 (D.
Nev. 2015) (granting motion to dismiss for lack of standing based on “diminished value of the
services provided by Zappos” and stating that plaintiffs failed to “allege facts showing how the
price they paid for [Zappos’s] goods incorporated some particular sum that was understood by
both parties to be allocated towards the protection of customer data”); In re Science Applications

8

Although Plaintiffs state in their brief that they “bargained for and paid for protection of
their CPD when they sought healthcare” (doc. 73, at 24), ¶ 10 of the Consolidated Amended
Complaint, which they cite as support in their brief, does not state facts showing that they
bargained for protection of the confidential patient data. See doc. 53, at 3, ¶ 10.
9

The court notes that the case upon which Plaintiffs relied at the hearing, Weinberg v.
Advanced Data Processing, Inc., 147 F. Supp. 3d 1359 (S.D. Fla. 2015), did not address standing
at all, and certainly did not address whether an overpayment theory stated an injury-in-fact for
purposes of standing.
15

Int’l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 30 (D.D.C. 2014) (rejecting
plaintiffs’ claims of standing based on an argument that they were cheated out of a portion of
their premiums for health and dental insurance when their data was not protected and a data
breach occurred: “To the extent that Plaintiffs claim that some indeterminate part of their
premiums went toward paying for security measures, such a claim is too flimsy to support
standing.”); see Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 968 (7th Cir. 2016)
(acknowledging in dicta the court’s skepticism regarding plaintiffs’ argument that the “cost of
[plaintiffs’] meal is an injury [-in-fact for standing purposes] because they would not have dined
at P.F. Chang’s had they known of its poor data security,” and noting that courts have adopted
such overpayment arguments only when “the product itself purchased was defective or dangerous
....”); see also Resnick v. AvMed, 693 F.3d 1317, 1323 & n.1 (11th Cir. 2012) (finding, after
plaintiffs alleged monetary damages from misuse of their identities and also alleged overpayment
based on defendant company’s failure to protect their confidential data from thieves,standing
based on allegations that the plaintiffs suffered monetary loss as a result of actual identity theft,
but not addressing whether overpayment represented an injury-in-fact for standing purposes);
Remijas v. Neiman Marcus Group, 794 F.3d 688, 696 (7th Cir. 2015) (stating that “we refrain
from deciding whether the overpayment for Neiman Marcus products . . . might suffice as
injuries under Article III” and acknowledging that “we are dubious” about whether the
overpayment theory alone would have sufficed to establish standing).
For all of these reasons, the court rejects the allegations of “overpayment” as sufficient to
establish an injury-in-fact for purposes of Article III case or controversy standing.
b. Loss of Intrinsic Value
As to the Plaintiffs’ argument that they suffered an injury-in-fact based on loss of intrinsic
16

value of their confidential personal information, the court FINDS that the facts alleged do not
support this theory of damages sufficient to establish Article III case or controversy standing.
The Consolidated Amended Complaint contains no facts showing that the Plaintiffs’ personal
information was rendered less intrinsically valuable to the Plaintiffs because of the data breach
and/or that Plaintiffs attempted to sell or use their personal information and were unable to use it
or were unable to sell it for the appropriate price because the data breach negatively impacted its
value.
The Plaintiffs cited three non-controlling cases, the first two of which were unpublished
and regarded dissemination of personal information by the defendant company, not through data
theft. The two unpublished cases were: a Ninth Circuit case, In re Facebook Privacy Litig., 572
F. App’x 494 (9th Cir. 2014), that did not specifically address standing; and Svenson v. Google,
Inc., No. 13-CV-4080, 2015 WL 1503429, at *2-3 (N.D. Cal. Apr. 1, 2015), which incorrectly
equated injury-in-fact for Article III standing purposes with damages sufficient to state a claim
under California law, and which relied on In re Facebook as recognizing “diminution of value of
personal information” as a plausible theory of damage for breach of contract under California
law. In the third opinion, Claridge v. RockYou, Inc., a data breach case, the court acknowledged
that it was addressing “a novel theory of damages for which supporting case law is scarce” and
“not yet settled.” 785 F. Supp. 2d 855, 861 (N.D. Cal 2011). Focusing on that uncertainty, the
court found the allegations sufficient for standing at the motion to dismiss stage; nevertheless,
the court promised that “[i]f it becomes apparent, through discovery, that no basis exists upon
which plaintiff could legally demonstrate tangible harm via the unauthorized disclosure of
personal information, the court will dismiss plaintiff’s claims for lack of standing at the
dispositive motion stage.”
17

This court finds more persuasive the reasoning in the following 2014 and 2015 published,
albeit non-controlling, decisions addressing similar theories in data breach cases and finding no
injury-in-fact for standing purposes. In In re Zappos, the court addressed plaintiffs’ theory of
standing that the data breach resulted in a devaluation of their personal information. It stated,
“[t]he court does not buy this argument” and noted that the plaintiffs alleged no facts “explaining
how their personal information became less valuable as a result of the breach or that they
attempted to sell their information and were rebuffed because of a lower price-point attributable
to the security breach.” 108 F. Supp. 3d at 954.
The court in Galaria v. Nationwide Mutual Insurance Company rejected a similar theory
of standing because plaintiffs “have failed to allege any facts explaining how their PII [personally
identifiable information] became less valuable to them (or lost all value) by the data breach,” and
because they did not allege that the data breach prevented them from selling their personal
information at the price they alleged it was worth. 998 F. Supp. 2d 646, 659-60 (S.D. Ohio
2014).
And the court in In re SAIC rejected as “unsuccessful” a theory based on “loss of value”
of personal information as injury-in-fact to establish standing: “Even if the [plaintiffs] did intend
to sell their own data—something no one alleges—it is unclear whether or how the data has been
devalued by the breach.” 45 F. Supp. 3d at 30.
This court joins those courts in rejecting the loss of intrinsic value theory to establish
standing.
c. Increased Risk of Harm
The Plaintiffs also argued that an injury-in-fact exists based on the increased risk of harm
after the data breach occurred. Some—but not all—Named Plaintiffs alleged accompanying
18

misuse of their data resulting from the data breach.
1. Risk of Harm Unaccompanied by Misuse
This court recognizes that a split exists in the Circuit Courts of Appeal regarding whether
an increased risk of harm after a data breach unaccompanied by misuse of the stolen data
constitutes an injury-in-fact. See, e.g., decisions in the Ninth and Seventh Circuit Courts of
Appeals holding that standing exists even when no misuse had yet occurred: Lewert, 2016 WL
1459226, at *2-4; Remijas, 794 F.3d at 692-93; Krottner v. Starbucks Corp., 628 F.3d 1139,
1142-43 (9th Cir. 2010); Pisciotta v. Old Nat’l Bancorp, 499 F.3d 629, 634 (7th Cir. 2007); but
see, e.g., a decision from the Third Circuit, Reilly v. Ceridian Corp., 664 F.3d 38, 42 (3d Cir.
2011) (affirming the district court’s dismissal for lack of standing based on an increased risk of
harm when unaccompanied by misuse, and criticizing Pisciotta and Krottner for using “skimpy
rationale”; for failing to discuss “constitutional standing requirements and how they apply to
generalized data theft situations”; and for using failed analogies between data breach cases, on
the one hand, and cases involving medical devices, toxic torts, or environmental injury, on the
other). The Eleventh Circuit has not chosen a side in this fray. See Resnick, 693 F.3d at 1323 n.
1 (“As Plaintiffs have alleged only actual—not speculative—identify theft, we need not address
the issue of whether speculative identity theft would be sufficient to confer standing.” (emphasis
added)).
Although the Supreme Court of the United States has not yet addressed this issue of
standing based on increased risk of harm in the data breach context, it has spoken fairly recently
to the issue in other contexts in the following decisions: Susan B. Anthony List v. Driehaus, ___
U.S. ___, 134 S. Ct. 2334 (2014) and Clapper v. Amnesty Intern., USA, ___ U.S. ___, 133 S. Ct.
1138 (2013). In Susan B. Anthony List, the Court reversed the dismissal of an action by
19

advocacy organizations challenging an Ohio statute criminalizing false statements about
candidates during political campaigns. In so ruling, the Court noted the history of past
enforcement and the allegations of an intent to engage in the same speech that was the subject of
a prior enforcement. Given that history and alleged intent, the Supreme Court found that the
organizations adequately alleged a substantial threat of both future administrative and criminal
enforcement to satisfy standing and also found that “an actual arrest, prosecution, or other
enforcement action is not a prerequisite to challenging the law.” 134 S. Ct. at 2342-46.
In Clapper, the Supreme Court found that no standing existed in a suit seeking a
declaration that a provision of the Foreign Intelligence Surveillance Act of 1978 (“FISA”)
allowing surveillance of certain individuals was unconstitutional because the respondents had
failed to demonstrate that the feared future injury was “certainly impending.” The Court
explained that the plaintiffs’ theory rested on speculation regarding the Government’s future
actions and “a highly attenuated chain of possibilities,” such as whether the Government would
decide to target the specific non-U.S. persons with whom respondents communicated; whether
the Government would invoke its surveillance authority under FISA rather than using another
method of surveillance; whether the judges who serve on the Foreign Intelligence Surveillance
Court would approve the surveillance; whether the Government would intercept successfully the
communications of respondents’ contacts; and whether the respondents would also be parties to
those intercepted communications. 133 S. Ct. at 1147-49. The Court rejected the Second
Circuit’s “objectively reasonable likelihood” standard, as beinginconsistent with the “certainly
impending” standard. Id. at 1147-48. In a footnote, the Court also referred to the “substantial
risk” standard: “to the extent that the ‘substantial risk’ standard is relevant and distinct from the
‘clearly impending’ requirement, respondents fall short of even that standard, in light of the
20

attenuated chain of inferences necessary to find harm here.” Id. at 1150 n.5.
In the instant case, this court FINDS that no injury-in-fact exists for the purposes of
Article III case or controversy standing under either the “certainly impending” standard or the
“substantial risk” of harm standard, based on the allegations that Plaintiffs have an “increased
risk” of becoming victims of identity theft crimes, fraud and abuse, and based on the specific
factual circumstances alleged here, where that risk is not accompanied by misuse of the stolen
data. This court does not find that an increased risk of harm unaccompanied by actual harm
cannot, under any circumstances, constitute an injury-in-fact.
However, for the Plaintiffs in the instant case who did not have allegations of misuse
accompanying their claims of an increased risk of harm, the facts pled here do not meet the
definition of injury-in-fact; the alleged injuries are “conjectural and hypothetical” and are not
“concrete,” nor are they “actual or imminent.” See Lujan, 504 U.S. at 560-61. Rather, the
alleged injuries here are based on a future threat “which relies on a highly attenuated chain of
possibilities.” See Clapper, 133 S. Ct. at 1148. Actual harm may occur only if the hacker is able
to decrypt and convert the information hacked to some understandable and usable form; if the
hacker intends to commit future criminal acts by misusing the information or selling it to another
who so intends; and if the hacker or those who may obtain the personal information are indeed
able to successfully make unauthorized use of it. This chain of possibilities, involving
“speculation about the decisions of independent actors,” would place the Plaintiffs’ standing
theory into the category that the Supreme Court declined to accept as injury-in-fact. See Clapper,
133 S. Ct. at 1150 (“We decline to abandon our usual reluctance to endorse standing theories that
rest on speculation about the decisions of independent actors.”).

21

2. Mitigation of Risk of Harm Unaccompanied by Misuse
The court further FINDS that no injury-in-fact exists for the purposes of Article III case or
controversy standing based on the allegations of time and money spent to investigate and/or
mitigate the increased risk of harm when that risk was not accompanied by misuse of the stolen
data. When, as here, increased risk of harm is not substantial and the hypothetical future harm is
not certainly impending, Plaintiffs cannot “manufacture standing merely by inflicting harm on
themselves based on their fears of hypothetical future harm that is not certainly impending.” See
Clapper, 133 S. Ct. at 1151 (using quoted language). The court notes that the Supreme Court in
Clapper rejected the Second Circuit’s previous standard of allowing mitigation costs to establish
standing when the fear was not “fanciful, paranoid, or otherwise unreasonable,” because that
standard “improperly water[ed] down the fundamental requirements of Article III.” The
Supreme Court explained that the key focus is not upon the reasonableness of the fears but upon
the imminence of the future harm and whether it is certainly impending or the risk of harm is
substantial. Id.
Having found that, in the instant case, the risk of harm unaccompanied by misuse does
not fit the two standards that the Supreme Court has accepted when the harm has not yet
occurred, this court must similarly find that the mitigation costs associated with that risk cannot
be an injury-in-fact and cannot be fairly traceable to the data breach.
d. Misuse and Mitigation of Risk Accompanied by Misuse
The court FINDS that injury-in-fact does exist for the purposes of Article III case or
controversy standing based on allegations that misuse of the stolen data has occurred. Only
where such misuse has already occurred can allegations regarding mitigation costs—such as time
and money spent to investigate and/or mitigate the misuse itself and the increased risk of future
22

harm—form part of the alleged injury-in-fact. See Clapper, 133 S. Ct. at 1151. Defendants did
not challenge the “injury-in-fact” element or the costs of mitigation of the risk for the Named
Plaintiffs who had already suffered misuse of their data after the breach; rather, the Defendants
only challenged costs of mitigation for those who had not yet suffered data misuse after the
breach. See doc. 70, at 4 (listing 26 Plaintiffs as alleging no injury, and omitting paragraphs
describing those Plaintiffs who alleged misuse) & 17 (challenging as an injury-in-fact mitigation
costs of Plaintiffs Bubel and Mendoza, who did not allege misuse, but not challenging such costs
for those who alleged misuse, such as Plaintiffs Matus and Brown).
Specifically, the court FINDS that the claims of the following fourteen Named Plaintiffs
alleged an injury-in-fact—which is both concrete and particularized as well as actual or
imminent, not conjectural or hypothetical—to support Article III case or controversy standing
based on misuse of stolen data subsequent to the data breach: 1. Kathy Ellzey (Ellzey case); 2.
Lynda Matus (Ellzey case); 3. Dallas Richard (Alverson/McNutt II cases); 4. Ashley Veciana
(Veciana/McNutt II cases); 5. Daniel Watson (Watson case); 6. Joel Lovelace (Alverson case); 7.
Melissa Cooper (Lawson/McNutt II cases); 8. Johannes Nhete (Alverson case); 9. Joan Crespin
(Maes/McNutt II cases); 10. John Sanchez (Ellzey case); 11. William Lutz (Lutz/McNutt II
cases); 12. Christopher Brown (Alverson case); 13. Tara June Moore (Ellzey case); and 14.
Cynthia Ann Martin Stonestreet, as Executor of the Estate of Mary Glah (Glah/McNutt II cases).
As the claims of these fourteen Named Plaintiffs meet the first element of standing, the court
will subsequently analyze whether they meet the other two elements of causation and
redressability.
e. Dismissals Based on Lack of Injury-in-Fact
The court FINDS that PSC’s motion to dismiss for lack of subject matter jurisdiction
23

based on lack of Article III case or controversy standing (doc. 69) is due to be GRANTED as to
the non-statutory claims of all other Named Plaintiffs not listed in the immediately preceding
paragraph, because they did not allege an injury-in-fact. Thus, those Named Plaintiffs have no
Article III case or controversy standing to sue for any of their claims, and the court does not have
subject matter jurisdiction over their non-statutory claims; the court WILL DISMISS WITHOUT
PREJUDICE the non-statutory claims of those Named Plaintiffs asserted against PSC. As to
their statutory claims, the Named Plaintiffs not listed in the immediately preceding paragraph
have no Article III standing to sue unless conferred by statute, and in a subsequent part of this
Memorandum Opinion, the court will address their standing to sue in federal court under the
FCRA claims and state statutory claims.
Although CHSI did not present a facial challenge to standing, the court FINDS that the
same standing requirement applies to claims asserted against CHSI. Accordingly, to the extent
the non-statutory claims dismissed against PSC were also asserted against CHSI by Named
Plaintiffs who were part of the Ellzey, Murphy or McNutt II cases, the court WILL sua sponte
DISMISS WITHOUT PREJUDICE those claims asserted against CHSI.
2. Causation/Fairly Traceable Element of Standing
Even when a plaintiff has sufficiently alleged an injury-in-fact, he must also plead
sufficient facts to show a causal connection between the injury and the challenged conduct of the
defendant; the injury must be fairly traceable to that conduct. See Lujan, 504 U.S. at 560-61
(listing elements of standing).
The Consolidated Amended Complaint alleges that the data breach involved “names,
addresses, birthdates, telephone numbers, Social Security numbers, employer names, and
guarantor names, as well as protected health information.” (Doc. 53, at 2). The Plaintiffs do not
24

allege that the data breach involved specific financial information, such as credit card or bank
account information.
The court FINDS that the “fairly traceable” element exists for purposes of Article III case
or controversy standing when at least one instance of misuse was pled that would have a logical
connection to the data stolen. Such misuse would be at least one of the following specific
allegations in the Consolidated Amended Complaint: opening without authorization of new
credit card account(s), new financial account(s), and/or new foreign exchange account(s) in the
Plaintiff’s identity; renting/attempting to rent an apartment using a Plaintiff’s identity without
authorization; using a Plaintiff’s identity without authorization to purchase a new cell phone
and/or open new cell phone account; hacking a Plaintiff’s existing phone and existing email
accounts; using a Plaintiff’s social security number and personal identifiers to file a federal tax
return or anything else without authorization.
Given these rulings, the court FINDS specifically that the allegations of the following
remaining Named Plaintiffs meet the “fairly traceable” element for purposes of Article III case or
controversy standing: 1. Kathy Ellzey (Ellzey case); 2. Lynda Matus (Ellzey case); 3. Dallas
Richard (Alverson/McNutt II cases); 4. Ashley Veciana (Veciana/McNutt II cases); 5. Melissa
Cooper (Lawson/McNutt II cases); 6. Johannes Nhete (Alverson case); 7. John Sanchez (Ellzey
case); 8. William Lutz (Lutz/McNutt II cases); 9. Christopher Brown (Alverson case); and 10.
Tara June Moore (Ellzey case). Because the court also FINDS that the allegations of these
Named Plaintiffs meet the last element of case or controversy standing, the redressability
element, the court WILL DENY PSC’s motion to dismiss to the extent that it challenges the
Article III case or controversy standing of these Plaintiffs and subject matter jurisdiction over the
claims of these ten Named Plaintiffs.
25

Conversely, the court WILL GRANT PSC’s motion to dismiss as to the non-statutory
claims of the following remaining Named Plaintiffs who did allege an injury-in-fact, but whose
injury-in-fact is not fairly traceable to the Defendants’ alleged wrongful conduct: 1. Daniel
Watson (Watson case–alleged unauthorized access to his checking account and attempted theft of
funds from his checking account, but the data breach did not include financial information such
as bank account numbers); 2. Joel Lovelace (Alverson case–alleged unauthorized charges had
been placed on his credit card account, but the data breach did not include financial information
such as credit card numbers); 3. Joan Crespin (Maes/McNutt II cases–alleged that unauthorized
charges had been placed on her credit card accounts); and 4. Cynthia Ann Martin Stonestreet, as
Executor of the Estate of Mary Glah (Glah/McNutt II cases–alleged that unauthorized charges
had been placed on Ms. Glah’s credit card accounts). As these four Named Plaintiffs have no
Article III case or controversy standing to sue, the court does not have subject matter jurisdiction
over any of their claims, unless a statute confers Article III statutory standing for those statutory
claims alone. Therefore, the court WILL DISMISS WITHOUT PREJUDICE the non-statutory
claims those four Named Plaintiffs asserted against PSC.
The court notes that only eight of those ten remaining Named Plaintiffs filed their claims
in Tennessee, and thus, only eight may pursue non-statutory claims against CHSI: 1. Kathy
Ellzey (Ellzey case); 2. Lynda Matus (Ellzey case); 3. Dallas Richard (McNutt II cases); 4.
Ashley Veciana (McNutt II cases); 5. Melissa Cooper (McNutt II case); 6. John Sanchez (Ellzey
case); 7. William Lutz (McNutt II cases); and 8. Tara June Moore (Ellzey case). Because Daniel
Watson, Joel Lovelace, Joan Crespin, and Mary Glah did not file their claims in Tennessee, the
court reiterates that no personal jurisdiction exists over CHSI for their claims; as discussed
earlier in this Memorandum Opinion, the court will dismiss such claims asserted against CHSI
26

for lack of personal jurisdiction, not lack of subject matter jurisdiction.
While the court will allow the ten Named Plaintiffs with standing to proceed to the next
step and will address the sufficiency of the pleadings, the court does so without prejudice to
revisiting the “fairly traceable” element and the standing determinations as to those ten Named
Plaintiffs if evidence or lack of evidence warrants. The court does so recognizing that evidence
disclosed during discovery may reflect that the misuse emanated from a cause other than the data
breach at issue here. However, these Named Plaintiffs have pled sufficient facts to establish
jurisdiction and standing, and can proceed to the next step of addressing the sufficiency of their
claims pursuant to a Rule 12(b)(6) challenge.
3. Redressable Element of Standing
The parties do not challenge this element of standing, and, as referenced earlier, the court
FINDS that this element exists for the remaining Named Plaintiffs’ non-statutory claims.
B. Factual Attack on “Fairly Traceable” Element of Article III Case or Controversy
Standing
In its motion to dismiss and supporting briefs, CHSI asserted a factual challenge to the
“fairly traceable” element, based on the declaration of Ben Fordham. The court FINDS that the
jurisdictional basis of this claim is intertwined with the merits of the federal and state claims.
Thus, the court further FINDS that, as to claims remaining after the court’s rulings on personal
jurisdiction and the facial challenge to standing, jurisdiction exists at this point; the court will
deal with this issue as a direct attack on the merits at a later stage, if appropriate. Accordingly,
the court WILL DENY CHSI’s motion to dismiss to the extent that it asserts a factual attack on
standing as to the remaining Plaintiffs.

27

C. Statutory Standing
In addition to the common law claims brought under state law, the Plaintiffs have
asserted a federal statutory claim under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681
et. seq., as well as claims under various state statutes. The court has determined previously in
this opinion that ten of the Named Plaintiffs have Article III case or controversy standing to sue;
therefore, they may proceed to argue the sufficiency of their claims, both statutory and nonstatutory, pursuant to a Rule 12(b)(6) challenge. The court will address the sufficiency of their
claims, including their statutory claims, pursuant to Rule 12(b)(6) later in this opinion. Eight of
those ten Plaintiffs may pursue claims against CHSI in this MDL. However, this court must
determine whether the Plaintiffs who have no Article III case or controversy standing and cannot
pursue state common law claims nevertheless have Article III standing to pursue their federal and
state statutory claims. Put another way, this court must determine whether those statutes
somehow confer standing in federal court where standing would not otherwise exist.
1. Standing under the FCRA
At the hearing on April 15, 2016, the court first addressed standing to sue based on the
FCRA. Given the court’s rulings as to case or controversy standing, which found only ten
Named Plaintiffs had such standing, the issue before the court at the hearing in April was
whether the provisions of the FCRA granted standing to sue under the FCRA to Named Plaintiffs
in addition to those ten by establishing statutory liability through a procedural violation of the
statute where no actual injury existed. Because the FCRA provides no liability for a negligent
breach without actual damages, the standing issue focused on willful breach, which provides for
liability to the consumer even when the consumer sustains no actual damages resulting from that
willful breach.
28

At the time the court held a hearing on the FCRA standing issue, the Supreme Court of
the United States had not yet issued its opinion in Spokeo, Inc. v. Robins, __ U.S. __, 136 S. Ct.
1540 (2016). That case involved alleged willful violations of the FCRA when Spokeo, Inc.
generated an incorrect personal profile of plaintiff Robins. One issue presented in Spokeo was
whether Robins could satisfy the injury-in-fact requirement of Article III standing by alleging a
bare procedural violation of the FCRA. The Supreme Court has now issued that opinion;
Spokeo was decided on May 16, 2016, and the opinion was revised as of May 24, 2016.
The Spokeo facts differ from those here: they did not involve a data breach, but rather,
involved the defendant operator of a website that intentionally disseminated information
regarding the plaintiff to a third party in response to that third party’s inquiry about the plaintiff.
Robins’s complaint was not that the website provided accurate information without his
permission, but that it gathered and provided inaccurate information in response to that third
party inquiry about him. The inaccurate information did not display Robins in a bad light; it
“described Robins as holding a graduate degree and as wealthy,” but “Robins, who [was]
unemployed, described the information as ‘caus[ing] actual harm to [his] employment
prospects.’” The Ninth Circuit characterized Robins’s allegations of injury as “sparse”; the
district court had boiled down those allegations as follows: “that he has been unsuccessful in
seeking employment, and that he is concerned that the inaccuracies in his report will affect his
ability to obtain credit, employment, insurance, and the like.” Spokeo, Inc. contended that
Robins did not have standing to sue under the FCRA, even for a willful violation, without
showing actual harm. Robins v. Spokeo, Inc., 742 F.3d 409, 410 & 413 (9th Cir. 2014), vacated
& remanded by Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).
The Ninth Circuit framed the issue as “whether violations of statutory rights created by
29

the FCRA are ‘concrete, de facto injuries’ that Congress can so elevate.” Because the statutory
cause of action did not require proof of actual damage, the Court of Appeals determined that
plaintiff Robins had suffered a violation of that statutory right without suffering actual damages.
Further, the Court of Appeals decided that the alleged violations of Robins’s statutory rights were
sufficient to satisfy Article III’s injury-in-fact requirement, because his allegations showed that
“‘Spokeo violated his statutory rights, not just the statutory rights of other people,’ and because
‘his personal interests in the handling of his credit information are individualized rather than
collective.’” Id. at 413. Spokeo, Inc. appealed.
In addressing the issue of Robins’s standing, the Supreme Court determined that “Article
III standing requires a concrete injury even in the context of a [federal] statutory violation.” 136
S. Ct. at 1549. The Court acknowledged that “because Congress is well positioned to identify
intangible harms that meet minimum Article III requirements, its judgment is also instructive and
important” in determining whether an intangible harm constitutes an injury-in-fact. Further
acknowledging that certain violations of a procedural requirement of the FCRA—e.g, the
dissemination of an incorrect zip code—may result in no harm, the Court explained that
“Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff
automatically satisfies the injury-in-fact requirement whenever a statute grants a person a
statutory right and purports to authorize that person to sue to vindicate that right.” Id. The
Supreme Court concluded that “Robins cannot satisfy the demands of Article III by alleging a
bare procedural violation.” Id. at 1550.
The Supreme Court emphasized that the injury-in-fact inquiry requires a plaintiff to show
that his harm is not only particularized but also concrete, but the Court of Appeals had not
specifically analyzed both; the Ninth Circuit had found that Robins’s injury was particularized as
30

it was a violation of his statutory rights, but the Court of Appeals had not specifically addressed
concreteness. Vacating the judgment and remanding the case for further proceedings, the
Supreme Court issued the following explanation and direction:
Because the Ninth Circuit failed to fully appreciate the distinction between
concreteness and particularization, its standing analysis was incomplete. It did not
address the question framed by our discussion, namely, whether the particular
procedural violations alleged in this case entail a degree of risk sufficient to meet
the concreteness requirement.
136 S. Ct. at 1550.
With that guidance in mind, the court addresses the standing issue in the context of
Plaintiffs’ claims under the FCRA: in Count VIII, they asserted a negligent violation; and in
Count VII, they asserted a willful violation.
a. Negligent Violation
In Count VIII, the Plaintiffs asserted a claim for negligent breach of the FCRA; Title 15
U.S.C. § 1681o establishes liability for negligent violation for “any actual damages sustained . . .
as a result of the failure.” The statute does not impose liability for a negligent breach as to those
who have not sustained actual damages.
This court has already determined, in its Article III case or controversy standing analysis,
that only the following ten Named Plaintiffs have alleged actual harm traceable to the data breach:
1. Kathy Ellzey (Ellzey/McNutt II cases); 2. Lynda Matus (Ellzey case); 3. Dallas Richard
(Alverson/McNutt II cases); 4. Ashley Veciana (Veciana/McNutt II cases); 5. Melissa Cooper
(Lawson/McNutt II case); 6. Johannes Nhete (Alverson case); 7. John Sanchez (Ellzey case); 8.
William Lutz (Lutz/McNutt II cases); 9. Christopher Brown (Alverson case); and 10. Tara June
Moore (Ellzey case). The court FINDS that the FCRA confers legal rights on these same ten
Named Plaintiffs to sue for negligent violation of the FCRA, and that they have alleged a
31

concrete, particularized, and personal injury as a result of the violation of their own individual
rights created by the FCRA, and not merely collective harm. Thus, the court FINDS that these
Plaintiffs have standing to assert the claim in Count VIII. Further, they have alleged harm that is
actual or imminent, not conjectural or hypothetical, and they have alleged a causal connection
between the injury and Defendant’s conduct.
The court WILL DENY PSC’s motion to dismiss pursuant to Rule 12(b)(1) as to the
FCRA negligence claims of those ten Named Plaintiffs. The court further FINDS that the FCRA
does not confer on the other Plaintiffs legal rights for a negligent violation in the absence of actual
injury; the court WILL DISMISS WITHOUT PREJUDICE the claim in Count VIII asserted
against PSC by all Named Plaintiffs except the ten listed above.
As to CHSI’s Rule 12(b)(1) motion to dismiss the claim in Count VIII, the court WILL
DENY the motion as to the claims of the Named Plaintiffs listed in the preceding paragraph who
filed their claims in Tennessee: 1. Kathy Ellzey (Ellzey case); 2. Lynda Matus (Ellzey case); 3.
Dallas Richard (McNutt II case); 4. Ashley Veciana (McNutt II case); 5. Melissa Cooper (McNutt
II case); 6. John Sanchez (Ellzey case); 7. William Lutz (McNutt II case); and 8. Tara June
Moore (Ellzey case). The court WILL GRANT CHSI’s Rule 12(b)(1) motion as to all claims in
Count VIII remaining against CHSI after the Rule 12(b)(2) ruling that were brought by Named
Plaintiffs other than the eight listed in this paragraph; the court WILL DISMISS such claims
WITHOUT PREJUDICE.
b. Willful Breach
The FCRA treats willful violations differently from negligent violations. In Count VII, the
Plaintiffs assert a claim for willful breach of the FCRA. Title 15 U.S.C. § 1681n provides for
liability to the consumer “in an amount equal to the sum of . . . any actual damages sustained by
32

the consumer as a result of the failure or damages of not less than $100 and not more than $1,000
. . . .” 15 U.S.C. § 1681n (emphasis added). Put another way, the FCRA provides for liability for
a willful breach even absent actual damages, and the question before this court is whether the
allegations of those Plaintiffs who alleged a willful FCRA violation without resulting actual
damage have Article III standing to present that FCRA claim.
In Spokeo, the Supreme Court answered one of the issues raised here by stating that Article
III standing does require a concrete injury in the context of a statutory violation; allegations of fact
that, if true, show a defendant willfully violated the FCRA do not alone meet the injury-in-fact
standing requirement. Therefore, this court cannot end the standing inquiry by automatically
accepting a bald allegation of a willful FCRA injury as injury-in-fact, but must determine whether
the injury meets the requirements of particularization and concreteness, as well as the requirement
that it be “actual or imminent, not conjectural or hypothetical.” See Spokeo, 136 S. Ct. at 1548
(quoting Lujan, 504 U.S. at 560). To satisfy the demands of Article III standing, then, a plaintiff
bringing claims under a federal statute such as the FCRA must allege facts showing that he
suffered concrete and particularized harm from the statute’s violation, and that the harm was
actual or imminent.
In the instant case, the particularization requirement is not a difficult one: a particularized
injury “‘must affect the plaintiff in a personal and individual way.’” Spokeo, 136 S. Ct. at 1548.
Plaintiffs have alleged that the Defendant violated each of their statutory rights by allowing
thieves to steal their data, and each of their interests in keeping their data private is individualized
rather than collective. The court FINDS that they have alleged a particularized injury.
As to the separate concreteness requirement, the Supreme Court elaborated as follows:
A “concrete” injury must be “de facto”; that is, it must actually exist. When we have
33

used the adjective “concrete,” we have meant to convey the usual meaning of the
term—“real,” and not abstract.” Concreteness, therefore, is quite different from
particularization. “Concrete” is not, however, necessarily synonymous with “tangible.”
Although tangible injuries are perhaps easier to recognize, we have confirmed in many of
our previous cases that intangible injuries can nevertheless be concrete.
Spokeo, 136 S. Ct. at 1548-49 (internal citations omitted). The Supreme Court also noted that
the risk of real harm can sometimes satisfy the requirement of concreteness, citing its Clapper
decision. Id. at 1549.
This court has previously found that the ten Named Plaintiffs who alleged facts showing
that the subsequent misuse of their personal data corresponded to the type of data stolen had
indeed alleged a loss that was “concrete” and “actual”; the court found that those Plaintiffs had
alleged a loss that was not conjectural or hypothetical. Accordingly, the court WILL DENY
PSC’s motion to dismiss pursuant to Rule 12(b)(1) as to the claims in the Consolidated Amended
Complaint for willful violation of the FRCA set out in Count VII asserted by the following
Named Plaintiffs: 1. Kathy Ellzey (Ellzey/McNutt II cases); 2. Lynda Matus (Ellzey case); 3.
Dallas Richard (Alverson/McNutt II cases); 4. Ashley Veciana (Veciana/McNutt II cases); 5.
Melissa Cooper (Lawson/McNutt II case); 6. Johannes Nhete (Alverson case); 7. John Sanchez
(Ellzey case); 8. William Lutz (Lutz/McNutt II cases); 9. Christopher Brown (Alverson case);
and 10. Tara June Moore (Ellzey case). This court has also found that “for the Plaintiffs in the
instant case who did not have allegations of misuse accompanying their claims of an increased
risk of harm . . . the alleged injuries are ‘conjectural and hypothetical’ and are not ‘concrete,’ nor
are they ‘actual and imminent.’” Accordingly, for all but the ten Plaintiffs listed in this
paragraph, injury-in-fact does not exist for their claim in Count VII for a willful violation of the
FCRA; the court WILL GRANT PSC’s motion to dismiss their claims in Count VII.
34

As to CHSI’s Rule 12(b)(1) motion to dismiss the claim in Count VII, the court WILL
DENY the motion as to the claims of the eight Named Plaintiffs listed in the preceding paragraph
who filed their claims in Tennessee: 1. Kathy Ellzey (Ellzey case); 2. Lynda Matus (Ellzey
case); 3. Dallas Richard (McNutt II case); 4. Ashley Veciana (McNutt II case); 5. Melissa
Cooper (McNutt II case); 6. John Sanchez (Ellzey case); 7. William Lutz (McNutt II case); and
8. Tara June Moore (Ellzey case). The court WILL GRANT CHSI’s Rule 12(b)(1) motion as to
all claims in Count VII remaining against CHSI after the Rule 12(b)(2) ruling that were brought
by Named Plaintiffs other than the eight listed in this paragraph; the court WILL DISMISS such
claims WITHOUT PREJUDICE.
The court recognizes that these Rule 12(b)(1) rulings on the claims in Count VII differ
from its rulings at the April hearing, which occurred before the Supreme Court’s guidance in
Spokeo.10
2. State Statutory Claims
In their brief addressing standing under the state statutory claims, the Plaintiffs stated:
“Assuming the Court’s continued application of its previous ruling that Plaintiffs who have not
alleged ‘misuse of the stolen data,’ id. at 5, have not suffered Article III injury-in-fact for
purposes of their common-law claims, Plaintiffs agree that there is no independent statutory basis
for jurisdiction over the state statutory claims of any Named Plaintiff whose state common-law
claims were dismissed on standing grounds.” (Doc. 129, at 4). Perhaps Plaintiffs recognized
that, on this issue, the Supreme Court has spoken: “[T]he fact that a State thinks a private party
10

At the April hearing, the court ruled that 15 U.S.C. § 1681n confers Article III standing
for all of the Plaintiffs as to the willful violation of the FCRA, relying on Palm Beach Golf
Center v. John G. Sarris, DDS, PA, 781 F.3d 1245 (11th Cir. 2015).
35

should have standing to seek relief for a generalized grievance cannot override our settled law to
the contrary . . . . States cannot alter that [limited] role simply by issuing to private parties who
otherwise lack standing a ticket to the federal courthouse.” Hollingsworth v. Perry, __ U.S. ____,
133 S. Ct. 2652, 2667 (2013); see also Ross v. AXA Equitable Life Ins. Co., 115 F. Supp. 3d 424,
434 (S.D.N.Y. 2015) [“And the Court is not aware of (and Plaintiffs do not cite) any authority
suggesting that a state legislature can confer Article III standing upon a plaintiff who suffers no
concrete harm merely by authorizing a private right of action based on a bare violation of a state
statute.”] (emphasis in original).
Accordingly, the court FINDS that the state statutes under which Plaintiffs bring claims
do not provide a separate basis for Article III standing. The court further FINDS that only the
following ten Named Plaintiffs who have Article III case or controversy standing may also
pursue any state statutory claims, and that the only potentially relevant states11 as to the state
statutory claims are listed below next to each name: 1. Kathy Ellzey (Ellzey case: Alabama); 2.
Lynda Matus (Ellzey case: Alabama); 3. Dallas Richard (Alverson/McNutt II cases: Alabama); 4.
Ashley Veciana (Veciana/McNutt II cases: Florida); 5. Melissa Cooper (Lawson/McNutt II cases:
Mississippi); 6. Johannes Nhete (Alverson case: potentially relevant states are Nebraska, his state
of residence; Virginia, the state of treatment; and Ohio, the state of one alleged injury); 7. John
Sanchez (Ellzey case: New Mexico); 8. William Lutz (Lutz/McNutt II cases: Pennsylvania); 9.
11

To the extent that the Consolidated Amended Complaint contains any ambiguity about
the states where the Plaintiffs received treatment, the briefing confirms the parties’ agreement
that Dallas Richard, Melissa Cooper, and Tara June Moore received treatment from CHSaffiliated facilities during the relevant period in their own states of residence, which are Alabama
for Mr. Richard, Mississippi for Ms. Cooper, and Tennessee for Ms. Moore; and that Christopher
Brown claimed to have received treatment during the relevant period from such facilities both in
his home state of Tennessee as well as in Texas. See Doc. 103, at 13 n.1.
36

Christopher Brown (Alverson case: the potentially relevant states are Tennessee, the state of his
residence and where he received some treatment; and Texas, where he also received treatment);
and 10. Tara June Moore (Ellzey case: Tennessee).
The court notes that two of the Named Plaintiffs with standing, Johannes Nhete and
Christopher Brown, implicate more than one state whose statutory laws may apply, because they
received treatment and/or injury in a state different than their state of residence. The parties did
not address choice of law for state statutes in their briefs. As to Plaintiffs Nhete and Brown, the
court does not make a determination at this time as to which of the states’ statutes listed above
apply or whether those Plaintiffs may bring statutory claims based on multiple states’ statutes,
but instead considers all possibilities in examining the state law claims.
In Count IX (asserting a violation of state consumer laws for unfair or deceptive trade
practices) and Count X (asserting a violation of state data breach notification statutes), the
Plaintiffs do not list or specifically refer to any state statutes of Alabama or Mississippi. The
Consolidated Amended Complaint as supplemented does not contain any facts indicating that
Named Plaintiffs Ellzey, Matus, Richard, and Cooper have any meaningful connection with
states other than Alabama or Mississippi that would provide them standing to sue under those
state statutes listed in the pleading; thus, the facts fail to establish a concrete, particularized, and
personal injury to these Plaintiffs as a result of the alleged violation of statutes of other states.
See Palm Beach, 781 F.3d at 1251. Therefore, the court FINDS that Named Plaintiffs Ellzey,
Matus, Richard, and Cooper have no standing to assert claims based on violations of statutes in
states with which they have alleged no connection. The court WILL DISMISS the state statutory
claims of Named Plaintiffs Ellzey, Matus, Richard, and Cooper.
37

To the extent that the Plaintiffs attempted or intended to assert claims in Counts IX and X
that Defendants violated any statutes under Alabama and Mississippi statutes, the court FINDS
that they have failed to do so. To the extent that the Plaintiffs attempted or intended to assert any
non-statutory common law claims in Counts IX and X, or to assert any state statutory claims not
listed in ¶ 214 of Count IX or in ¶ 226 of Count X, the court FINDS that they have failed to do
so.
Thus, the court FINDS that the only possible state statutes under which remaining claims
arise are the following asserted in Counts IX and X:
Count IX
•
(¶ 214c) the Florida Deceptive and Unfair Trade Practices Act, Fla. Stat.
Ann. § 501.204(1), et seq.;
•
(¶ 214h) the Revised Statutes of Nebraska, Neb. Rev. Stat. § 87.302, et
seq.;
•
(¶ 214 j) the New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-122(D)(5)(7) and (14) and 57-12-3, et seq.;
•
(¶ 214k) the Ohio Consumer Sales Practices Act, Ohio Rev. Code Ann. §§
1345.02(A) and (B)(1) and (2), et seq.;
•
(¶ 214 n) the Pennsylvania Unfair Trade Practices and Consumer Protection
Law, 73 P.S. §§ 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.;
•
(¶ 214o) the Texas Deceptive Trade Practices Consumer Protection Act,
V.T.C.A., Bus. & C. § 17.46(a), (b)(5) and (7).
Count X
•
(¶ 226h) Tenn. Code Ann. § 47-18-2107(b), et seq.;
•
(¶ 226i) Va. Code Ann. § 18.2-186.6(B), et seq.
In light of this court’s rulings above on standing for the state statutory claims and the
relevant remaining statutes, the court FINDS that it has subject matter jurisdiction over the
following state statutory claims asserted against PSC:
1. The claim in Count IX asserted by Ashley Veciana (Veciana/McNutt II
cases) alleging a violation of the Florida Deceptive and Unfair Trade
Practices Act, Fla. Stat. Ann. § 501.204(1), et seq;
38

2. The claims asserted by Johannes Nhete (Alverson case) in Count IX alleging
violations of the Revised Statutes of Nebraska, Neb. Rev. Stat. § 87.302, et
seq. and the Ohio Consumer Sales Practices Act, Ohio Rev. Code Ann. §§
1345.02(A) and (B)(1) and (2), et seq.; and in Count X alleging violations
of Va. Code Ann. § 18.2-186.6(B), et seq.;
3. The claim asserted by John Sanchez (Ellzey case) in Count IX alleging a
violation of the New Mexico Unfair Practices Act, N.M. Stat. Ann. § § 5712-2(D)(5)(7) and (14) and 57-12-3, et seq.;
4. The claim asserted by William Lutz (Lutz/McNutt II cases) in Count IX
alleging a violation of the Pennsylvania Unfair Trade Practices and
Consumer Protection Law, 73 P.S. § § 201-2(4)(v)(vii) and (xxi), and 2013, et seq.;
5. The claims asserted by Christopher Brown (Alverson case) in Count IX
alleging a violation of the Texas Deceptive Trade Practices Consumer
Protection Act, V.T.C.A., Bus. & C. § 17.46(a), (b)(5) and (7); and in
Count X alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et
seq.; and
6. The claim asserted by Tara June Moore (Ellzey case) in Count X alleging a
violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.
The court WILL DENY PSC’s Rule 12(b)(1) motion to dismiss as to those six claims listed
above in this paragraph and asserted against PSC. As to all other state statutory claims asserted
against PSC, the court WILL GRANT PSC’s Rule 12(b)(1) motion; the court WILL DISMISS
such claims WITHOUT PREJUDICE.
Further, the court FINDS that it has subject matter jurisdiction over the following state
statutory claims asserted against CHSI:
1. The claim in Count IX asserted by Ashley Veciana (McNutt II case) alleging a
violation of the Florida Deceptive and Unfair Trade Practices Act, Fla. Stat. Ann.
§ 501.204(1), et. seq;
2. The claim asserted by John Sanchez (Ellzey case) in Count IX alleging a violation
of the New Mexico Unfair Practices Act, N.M. Stat. Ann. § § 57-12-2(D)(5)(7)
and (14) and 57-12-3, et seq.;
3. The claim asserted by William Lutz (McNutt II case) in Count IX alleging a
violation of Pennsylvania Unfair Trade Practices and Consumer Protection Law,
73 P.S. § § 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.; and
4. The claim asserted by Tara June Moore (Ellzey case) in Count X alleging a
violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.
39

The court WILL DENY CHSI’s Rule 12(b)(1) motion to dismiss as to the four claims listed
above in this paragraph and asserted against CHSI. As to all other state statutory claims asserted
against CHSI that remain after the court’s Rule 12(b)(2) rulings, the court WILL GRANT
CHSI’s Rule 12(b)(1) motion; the court WILL DISMISS such claims WITHOUT PREJUDICE.
The court notes, as before, that the dismissal of the claims without prejudice pursuant to
Rule 12(b)(1) is not an invitation to re-plead, but is simply a recognition that this dismissal is
based on lack of subject matter jurisdiction.
III. Rule 12(b)(6) Motion
At the hearing on April 15, 2016, the court next addressed the motions to dismiss the
remaining claims pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure. As the
Supreme Court has explained, “[t]o survive a motion to dismiss, a complaint must contain
sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’”
Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting and explaining its decision in Bell Atlantic
Corp. v. Twombly, 550 U.S. 544, 570 (2007)). To be plausible on its face, the claim must
contain enough facts to “allow[ ] the court to draw the reasonable inference that the defendant is
liable for the misconduct alleged.” Iqbal, 556 U.S. at 678.
The Supreme Court has identified “two working principles” for the district court to use in
applying the facial plausibility standard for motions to dismiss. The first principle is that the
court must assume the veracity of well-pleaded factual allegations; however, the court does not
have to accept legal conclusions as true even when “couched as [] factual allegation[s]” or
“threadbare recitals of the elements of a cause of action, supported by mere conclusory
statements.” Iqbal, 556 U.S. at 678-79. The second principle is that “only a complaint that states
40

a plausible claim for relief survives a motion to dismiss.” Id.
Thus, under prong one, the court determines which factual allegations are well-pleaded
and assumes their veracity, and then proceeds, under prong two, to determine the claim’s
plausibility given the well-pleaded facts. That task is “context-specific” and, to survive the
motion, the allegations must permit the court based on its “judicial experience and common
sense . . . to infer more than the mere possibility of misconduct.” Iqbal, 556 U.S. at 679. If the
court determines that well-pleaded facts, accepted as true, do not state a claim that is plausible,
the court must dismiss the claim.
In a motion brought pursuant to Rule 12(b)(6), the movant bears the burden of showing
that the complaint should be dismissed for failure to state a claim upon which relief may be
granted. E.g., Beck v. Deloitte & Touche, 144 F.3d 732, 734-35 (11th Cir. 1998) (placing the
burden on defendant to prove that a complaint should be dismissed); Cont’l Motors, Inc. v.
Jewell Aircraft, Inc., 882 F. Supp. 2d 1296, 1302 n. 26 (S.D. Ala. 2012) (stating that the Rule
12(b)(6) movant bears the burden). “Rule 12(b)(6) is a low threshold for a plaintiff to overcome.
[A district court] cannot . . . dismiss a claim merely because recovery on the merits at trial
appears doubtful or dubious.” Cont’l Motors, 882 F. Supp. 2d at 1302 (citing Speaker v. U.S.
Dep’t of Health & Human Servs. Ctrs. for Disease Control & Prevention, 623 F.3d 1371, 1380
(11th Cir. 2010) (stating that “a well-pleaded complaint may proceed even if it strikes a savvy
judge that actual proof of these facts is improbable, and that a recovery is very remote and
unlikely”) (citation omitted)).
A. Federal Claims under the FCRA: Counts VII (Willful) and VIII (Negligent)
In Counts VII and VIII, the Plaintiffs asserted that Defendants’ disclosure of their
41

confidential patient data constituted a willful or negligent violation of the Fair Credit Reporting
Act. The FCRA requires every “consumer reporting agency” to “maintain reasonable
procedures” to ensure that the agency does not “furnish[ ] . . . consumer reports” to unauthorized
third parties or for impermissible purposes. 15 U.S.C. § 1681e(a).
To state a claim that the requirement of maintaining reasonable procedures applies to
Defendants, the Consolidated Amended Complaint must properly plead that Defendants are
consumer reporting agencies. Defendants argued that they are not consumer reporting agencies
within the FCRA’s definition of that term, that they do not furnish consumer reports within the
FCRA’s definition of that term, and that the Plaintiffs have not properly pleaded these elements.
Thus, the resolution of this issue hinges on whether the Defendants fall within the FCRA’s
definition of “consumer reporting agency” and whether Defendants’ reports fall within the
FCRA’s definition of “consumer reports.”
The definition of “consumer reporting agency” states in relevant part:
any person which, for monetary fees, dues, or on a cooperative nonprofit
basis, regularly engages in whole or in part in the practice of assembling or
evaluating consumer credit information or other information on consumers
for the purpose of furnishing consumer reports to third parties . . . .
15 U.S.C § 1681a(f).
The definition of “consumer reports” in the FCRA is, in relevant part, as
follows:
(d) Consumer report.
(1) In general.
The term “consumer report” means any written, oral, or other
communication of any information by a consumer reporting agency bearing on
a consumer’s credit worthiness, credit standing, credit capacity, character,
general reputation, personal characteristics, or mode of living which is used or
42

expected to be used or collected in whole or in part for the purpose of serving
as a factor in establishing the consumer’s eligibility for —
(A) credit or insurance to be used primarily for personal, family, or household
purposes;
(B) employment purposes; or
(C) any other purpose authorized under section 1681b of this title.
(2) Exclusions.
Except as provided in paragraph (3), the term “consumer report” does
not include—
(A) subject to section 1681s-3 of this title, any —
(i) report containing information solely as to transactions or
experiences between the consumer and the person making the report;
15 U.S.C. § 1681a.
Therefore, to be subject to the FCRA, the Defendants must be credit reporting agencies –
they must regularly engage in assembling or evaluating consumer information for the purpose of
furnishing consumer reports to third parties; they must receive payment for providing the
report(s); and the report(s) cannot contain information solely as to the transactions between the
Defendants and the consumers who are the subject of the report(s).
This court FINDS that ¶ 194 in the Consolidated Amended Complaint is merely a
formulaic recitation of the elements under the FCRA and does not constitute well-pleaded facts.
See Simpson v. Sanderson Farms, 744 F.3d 702, 708 (11th Cir. 2014) (quoting Iqbal, 556 U.S. at
678 (“‘Threadbare recitals of the elements of a cause of action, supported by mere conclusory
statements, do not suffice.’”)). Ignoring the conclusory language and formulaic recitations in ¶
194 of the Consolidated Amended Complaint and elsewhere, and considering only the wellpleaded facts, the court FINDS that neither Defendant is a consumer reporting agency as defined
by the FCRA: the well-pleaded facts reflect that the fees collected were for healthcare services,
not for assembling or evaluating information on consumers; and further, the well-pleaded facts

43

reflect that the information Defendants provided to third parties was not a credit report as defined
and subject to exclusion (A)(i). Accordingly, the court FINDS that the Plaintiffs fail to state
plausible FCRA claims against Defendants.
Therefore, the court WILL GRANT the Rule 12(b)(6) motions as to ALL Plaintiffs’
FCRA claims in Counts VII and VIII that remained against both PSC and CHSI after the court’s
Rule 12(b)(1) and (2) rulings. The court WILL DISMISS Count VII and Count VIII from the
Consolidated Amended Complaint as to all remaining Plaintiffs. This ruling operates as an
alternative finding as to FCRA claims over which the court previously found it had no subject
matter jurisdiction; to the extent that the court has jurisdiction over those claims, they are subject
to dismissal pursuant to Rule 12(b)(6) for failure to state a plausible claim.
B. State Common Law Claims
Contrary to the lawyers’ arguments in the briefs, choice of laws issues matter in this
MDL. Because the Plaintiffs have invoked diversity jurisdiction pursuant to 28 U.S.C. §
1332(d)(2) and are asserting state law claims, the court must apply the common law from various
states and from multiple transferor jurisdictions. The due process rights of the individual
Plaintiffs are at stake. The court must determine which states’ laws are in play based on the
choice of law rules of the transferor courts so it may identify which law governs and whether the
various state laws conflict. See Phillips Petroleum Co. v. Shutts, 472 U.S. 797, 821-23 (1985)
(explaining that the parties in a nationwide class action have a due process right to have the
applicable state law govern their disputes: the “constitutional limitations on choice of law . . .
[are] not altered by the fact that it may be more difficult or burdensome to comply . . . because of
the large number of transactions which the [trial court] proposes to adjudicate and which have
44

little connection with the forum.”).
To determine which state common law applies to which Plaintiff’s claims, the court must
first consider the choice-of-law rules each transferor court would use. “In federal multidistrict
proceedings, the transferee court applies the substantive law of the transferor courts.” In re
Silicone Gel Breast Implants Prods. Liab. Litig., 887 F. Supp. 1455, 1457 (N.D. Ala. 1995);
Multi-District Litig. Manual, Fourth § 9:18 (2014) (In the section entitled
“Choice of law in the transferee court,” the manual states: “The Panel has recognized that the
transferee court will be obligated to apply the law the transferor forum would apply,” and the
manual proceeds to focus on the In re Korean Air Lines case.). The parties provided the court
with very little guidance as to this complex issue.
1. Count I (Breach of Contract); Count II (Breach of Implied Contract) and
Count III (Unjust Enrichment)
Without much assistance from the parties, the court used choice of law rules of the
transferor jurisdictions of Florida, Mississippi, Pennsylvania, and Tennessee, as well as Alabama
where this court sits, for the remaining non-statutory claims12 to determine which states’ laws
were relevant. As a result, the court examined the common law regarding unjust enrichment and

12

Alabama was the jurisdiction where the claims of Christopher Brown (Alverson case),
Dallas Richard (Alverson case), and Johannes Nhete (Alverson case) were first filed; Florida was
the jurisdiction where the claims of Ashley Veciana were first filed and transferred (Veciana
case); Mississippi was the jurisdiction where the claims of Melissa Cooper were first filed and
transferred (Lawson case); Pennsylvania was the jurisdiction where the claims of William Lutz
were first filed and transferred; and Tennessee was the transferor jurisdiction for the claims of
Kathy Ellzey, Lynda Matus, John Sanchez and Tara June Moore in the Ellzey case with Richard,
Veciana, Cooper and Lutz listed as Named Plaintiffs in the later-filed McNutt II case. The court
has previously determined in this Memorandum Opinion that it does not have jurisdiction over
the non-statutory claims asserted in cases from the other transferor jurisdictions (New Mexico,
Ohio, Washington and West Virginia).
45

breach of contract—express and implied—from the states of Alabama, Florida, Mississippi, New
Mexico, Pennsylvania, Tennessee, Texas, and Virginia.
The court FINDS that the remaining Named Plaintiffs’ allegations meet the bare
minimum standards for asserting these claims in those states. See, e.g., Resnick v. AvMed, Inc.,
693 F.3d 1317 (11th Cir. 2012) (applying Florida law and reversing the trial court’s dismissal for
failure to state a claim on breach of contract, breach of implied contract and unjust enrichment,
among others); Givens v. Mullikin, 75 S.W. 3d 383, 407-08 (Tenn. 2002) (recognizing that, under
Tennessee law, an implied covenant of confidentiality of medical records can arise from the
original contract of patient treatment); see generally Kennedy v. Boles Invs., Inc., 53 So. 3d 60,
74 (Ala. 2010) (“The law generally allows for the recovery of all damages, including incidental
and consequential, caused by the breach of contract or the commission of a tort.” (internal
quotation and citation omitted)); Aetna Cas. & Sur. Co. v. Doleac Elec. Co., Inc., 471 So. 2d 325,
330 (Miss. 1985) (stating that a plaintiff in a breach of contract action “is entitled to recover any
damages directly attributable to the defendant’s breach.”).
In the breach of contract claims, the Plaintiffs alleged that Defendants breached their
contractual promises to comply with the requirements of HIPAA and to act reasonably to protect
Plaintiffs’ confidential patient data, and that their breach resulted in harm to the Plaintiffs. As to
those claims, the court acknowledges the Defendants’ argument that the Plaintiffs have not
adequately alleged the element of causation for these breach of contract and other claims: the
mere fact that misuse occurred after the data breach, standing alone, does not establish a
sufficient nexus between the breach and misuse. See, e.g., Resnick, 693 F.3d at 1326-27
(“Generally, to prove that a data breach caused identity theft, the pleadings must include
46

allegations of a nexus between the two instances beyond allegations of time and sequence . . . .
Had Plaintiffs alleged fewer facts [about the substantial precautions they took to protect against
data theft], we doubt whether the Complaint could have survived a motion to dismiss.”).
The court further acknowledges that all Named Plaintiffs, except Ms. Ellzey and Mr.
Lutz, who re-pleaded after briefing, failed to allege a lack of history of misuse of their data
and/or to state that they took precautions prior to the data breach to protect themselves from
identity theft. Such allegations would render more likely a nexus between the misuse and the
data breach in question.
The court agrees that the alleged facts supporting causation are indeed thin. However, the
claims of the remaining Named Plaintiffs recite allegations about misuse occurring subsequent to
the breach that would be consistent with the type of data stolen. The court FINDS that, while
this decision on the sufficiency of the pleading of causation in Counts I and II is a very close one,
the remaining Named Plaintiffs have sufficiently alleged a nexus between the data theft and the
identity theft, and they have stated plausible claims in Counts I and II under the laws of Alabama,
Florida, Mississippi, New Mexico, Pennsylvania, Tennessee, Texas, and Virginia.13 The court
13

See Resnick, 693 F.3d at 1326-27 (applying Fla. law on the elements of a breach of
contract claim); Brooks v. Franklin Primary Health Ctr., Inc., 53 So. 3d 932, 935-36 (Ala. Ct.
Civ. App. 2010) (listing elements of a breach of contract claim, including “resulting damages”);
Favre Prop. Mgmt., LLC v. Cinque Bambini, 863 So. 2d 1037, 1044 (Miss. Ct. App. 2004)
(listing elements of a breach of contract claim); Shaeffer v. Kelton, 619 P. 2d 1226, 1230-31
(N.M. 1980) (discussing requirements of a breach of contract action under the law of New
Mexico, including “damages naturally flowing from the breach”); CoreStates Bank v. Cutillo,
723 A.2d 1053, 1058 (Pa. Super. 1999) (listing elements for breach of contract that must be in a
pleading); Ingram v. Cendant Mobility Fin. Corp., 215 S.W. 3d 367, 374 (Tenn. Ct. App. 2006)
(discussing the essential elements of a breach of contract claim); Velvet Snout, LLC v. Sharp, 441
S.W. 3d 448, 451 (Tex. Ct. App. 2014) (listing elements of a breach of contract claims); Squire
v. Va. Housing Dev. Auth., 758 S.E. 2d 55, 60 (Va. 2014) (listing elements of a breach of
contract action). For breach of implied contract, see: Ellis v. City of Birmingham, 576 So. 2d
47

WILL DENY the motions to dismiss pursuant to Rule 12(b)(6) regarding the remaining Named
Plaintiffs’ claims asserted in Counts I and II.
As an alternative ruling to the dismissals based on the lack of the “fairly traceable”
element on standing, discussed above, the court FINDS that, to the extent that Named Plaintiffs
Daniel Watson, Joel Lovelace, Joan Crespin, and Cynthia Ann Martin Stonestreet, as Executor of
the Estate of Mary Glah, may have met the “fairly traceable” element of standing, they have not
sufficiently alleged a nexus between the data theft and the identity theft because the type of
misuse occurring subsequent to the breach is inconsistent with the type of data stolen; their
claims fail to state a claim under their respective state’s law for breach of contract. Therefore,
the motion to dismiss pursuant to Rule 12(b)(6) is due to be GRANTED regarding the claims in
Counts I and II of the Consolidated Amended Complaint on that alternative ground as to Named
Plaintiffs Watson, Lovelace, Crespin, and Stonestreet.

156, 157 (Ala. 1991) (“A contract implied in fact requires the same elements as an express
contract, and differs only in the method of expressing mutual assent.”); Baron v. Osman, 39 So.
3d 449, 451 (Fla. Dist. Ct. App. 2010) (stating that “[t]he only distinction between an express
and implied-in-fact contract is the manner in which the parties’ assent is manifested or proven”);
Franklin v. Franklin ex. rel. Phillips, 858 So. 2d 110, 120 (Miss. 2003); Orion Tech. Res., LLC v.
Los Alamos Nat’l Sec., LLC, 287 P. 3d 967, 971 (N.M. Ct. App. 2012) (interior quotations
omitted) (“The distinction between an express and implied contract involves no difference in
legal effect, but lies merely in the mode of manifesting assent.”); Elias v. Elias, 237 A. 2d 215,
217 (Pa. 1968); River Park Hosp., Inc. v. Blue Cross Blue Shield of Tenn., Inc., 173 S.W. 3d 43,
57 (Tenn. Ct. App. 2002) (explaining the difference in contracts implied in fact, which result
from a meeting of the minds of the parties, and contracts implied in law, which do not have the
assent of the parties bound, and are “discussed in terms of unjust enrichment, quasi contract and
justice”); Mann Frankfort Stein & Lipp Advisors, Inc. v. Fielding, 289 S.W. 3d 844, 850 (Tex.
2009) (explaining that the difference between express and implied contracts is the mode of
expressing assent); Nossen v. Hoy, 750 F. Supp. 740, 744 (E.D. Va. 1990) (applying the laws of
Virginia. and Washington and explaining the distinction between implied-in-fact contracts and
quasi-contracts).
48

In the unjust enrichment claim, which is an alternative claims to the breach of contract
claims, the Plaintiffs alleged that the Defendants received payment from Plaintiffs that
encompassed services for protecting Plaintiffs’ confidential patient data, and that Defendants’
retention of the benefits of those payments was unjust in light of their failure to protect the data
and of the subsequent data breach. As to the unjust enrichment claim, the court acknowledges
PSC’s dispute of fact that Plaintiffs paid local clinics but not Defendants, as Plaintiffs alleged, so
Defendants could not have been unjustly enriched. However, that argument is for another stage
of this litigation. PSC also cited cases from jurisdictions that are not controlling on this court
and would not be controlling on the transferor courts, and this court chooses not to follow them
to the extent that they are contrary to this ruling. The court FINDS that the unjust enrichment
claim asserted in Count III states a plausible claim under the laws of Alabama, Florida,
Mississippi, New Mexico, Pennsylvania, Tennessee, Texas, and Virginia.14 The court WILL
DENY the motions to dismiss regarding the unjust enrichment claim of the remaining Named
Plaintiffs, asserted in Count III of the Consolidated Amended Complaint.
2. Count VI (Bailment)
In Count VI, the Plaintiffs allege that they delivered their confidential patient data to the
14

See, e.g., Resnick, 693 F.3d at 1328-29 (reversing the district court’s dismissal on the
unjust enrichment claim); see generally Avis Rent a Car Inc. v. Heilman, 876 So. 2d 1111, 1123
(Ala. 2003); Fla. Power Corp. v. Winter Park, 887 So. 2d 1237, 1241 n. 4 (Fla. 2004); Willis v.
Rehab Sols., PLLC, 82 So. 3d 583, 588 (Miss. 2012); City of Rio Rancho v. Amrep Southwest,
Inc., 260 P. 3d 414, 428-29 (N.M. 2011) (listing elements of an unjust enrichment claim);
Limbach Co., LLC v. City of Philadelphia, 905 A. 2d 567, 575 (Pa. Comm. Ct. 2006) (listing
elements); Am & Foreign Ins. Co v. Jerry’s Sport Ctr., Inc., 2 A. 3d 526, 545 (Pa. 2010);
Freeman Indus., LLC v. Eastman Chem. Co., 172 S.W.3d 512, 525 (Tenn. 2005); Pepi Corp. v.
Galliford, 254 S.W. 3d 457, 465 (Texas Ct. App. 2007) (addressing a claim for quantum meruit
“[f]ounded on unjust enrichment”); Rosetta Stone Ltd. v. Google Inc., 676 F.3d 144, 165 (4th
Cir. 2012) (applying Virginia law).
49

Defendants as a bailment arrangement to receive healthcare with the understanding that
Defendants would adequately safeguard it, and that the Defendants breached their obligations
under the bailment arrangement when they failed to adequately protect the data from data theft.
Recognizing that bailment can sound in contract or tort, depending upon the choice of law of the
forum, the court examined the state law on bailment in Alabama, Florida, Mississippi, Nebraska,
New Mexico, Ohio, Pennsylvania, Tennessee, Texas, and Virginia. The court FINDS that,
under the law of all applicable states, the Plaintiffs have failed to allege facts that meet the
definition of bailment and the elements of a bailment claim. The laws of the states at issue all
generally include the concept of placing property into the exclusive possession of the bailee with
the return of that property anticipated after the special purpose of the bailment is accomplished.15
15

See Garrett v. Nelson & Affiliates, 794 F. Supp. 2d 1253, 1261 (M.D. Ala. 2011)
(applying Alabama law and stating that bailment contemplates that the property be returned or
reclaimed after the special purpose of the bailment is accomplished, and if it is not returned, an
accounting is required); Monroe Systs. for Bus., Inc. v. Intertrans. Corp., 650 So. 2d 72, 75-76
(Fla. 1994) (defining bailment to include redelivery after the bailment purpose has been
fulfilled); Hamm v. F.B. Walker & Sons, Inc., 198 So. 2d 817, 818 (Miss. 1967) (discussing
bailment in terms of delivery of personal property to bailee contemplating its eventual return to
the bailor); Gerdes v. Klindt, 253 Neb. 260, 570 N.W. 2d 336, 342-43 (1997) (defining bailment
as requiring redelivery after the bailment purpose has been fulfilled); Fernandez v. Ford Motor
Co., 879 P.2d 101, 107 (N.M. 1994) (refusing to find a bailment where the pleadings indicated
that although a construction company had physical possession of the tractor-trailer, the owner of
the tractor-trailer retained some control over it, so no exclusive control and no bailment existed);
Tomas v. Nationwide Mut. Ins. Co., 607 N.E. 2d 944, 946 (Ohio 1992) (definition of bailment
requires that the property be returned or reclaimed by the bailor after the special purpose for the
bailment is accomplished, or, if the property is not returned, an accounting will occur); Lear Inc.
v. Eddy, 749 A. 2d 971, 973 (Pa. 2000) (same); Jackson v. Metro. Gov’t. of Nashville &
Davidson Cnty., 483 S.W. 2d 92, 94-95 (Tenn. 1972) (same); Hoye v Like, 958 S.W. 2d 234,
237-38 (Tex. 1997) (“[T]he creation of a bailment requires that possession and control over an
object pass from the bailor to the bailee . . . .”); Anchor Cas. Co v. Robertson Transport Co., 389
S.W. 2d 135, 138 (Tex. 1965) (damage for bailment occurs when chattel is not returned or is
returned damaged because of the negligence of the bailee); K-B Corp v. Gallagher, 237 S.E. 2d
183, 185 (Va. 1977) (focusing on the bailee’s having sole custody and control of physical
property).
50

The allegations of the Consolidated Amended Complaint do not so plead.
Accordingly, as to the remaining Named Plaintiffs over whose bailment claims this court
has jurisdiction, the court WILL GRANT the motion to dismiss, WILL DISMISS such claims,
and WILL DISMISS Count VI from the Consolidated Amended Complaint. As an alternative
ruling covering those Plaintiffs over whose non-statutory claims the court found it had no
jurisdiction, the court FINDS that they have failed to state a claim upon which relief can be
granted, and that their bailment claim is due to be dismissed pursuant to Rule 12(b)(6).
3. Tort Claims: Count IV (Negligence), Count V (Negligence Per Se),
& Count XI (Wantonness)
In addressing these tort claims based on choice of law directives of the transferor
jurisdictions and Alabama, the court examined the state law for such claims in Alabama, Florida,
Mississippi, Nebraska, New Mexico, Ohio, Pennsylvania, Tennessee, Texas, and Virginia.
a. Negligence
In Count IV, the Plaintiffs alleged that Defendants breached the duty to use reasonable
care in safeguarding the Plaintiffs’ confidential patient data, and that they were damaged when
the data breach occurred and some Plaintiffs’ data was misused. Defendants challenged whether
the Plaintiffs adequately alleged proximate cause, arguing that the facts alleged did not
sufficiently support the claim that any alleged negligence on Defendnats’ part proximately caused
the misuse of Plaintiffs’ data. As the court acknowledged previously in this Memorandum
Opinion, the facts supporting causation are indeed thin. The Plaintiffs cannot rest merely upon
time and sequence that the alleged fact of misuse occurred after the data breach. See, e.g.,
Resnick, 693 F.3d at 1326-27 (In addressing allegations that the defendant’s negligent failure to

51

secure plaintiff’s data proximately caused the identity theft, the court explained: “Generally, to
prove that a data breach caused identity theft, the pleadings must include allegations of a nexus
between the two instances beyond allegations of time and sequence.”).
In the instant case, however, the claims of the remaining Named Plaintiffs allege misuse
occurring subsequent to the breach that would be consistent with the type of data stolen. The
court FINDS that, while this decision as to the sufficiency of proximate cause allegations is a
very close one, the remaining Named Plaintiffs have met the pleading standards, albeit barely;
the court WILL DENY the motions to dismiss as to their negligence claims under the laws of
Alabama, Florida, Mississippi, Nebraska, Ohio, Pennsylvania, Tennessee, Texas, and Virginia.16
As an alternative ruling to the dismissals based on the lack of the “fairly traceable”
element on standing, the court FINDS that, to the extent that Named Plaintiffs Daniel Watson,
Joel Lovelace, Joan Crespin, and Cynthia Ann Martin Stonestreet, as Executor of the Estate of
Mary Glah, may have met the “fairly traceable” element of standing, they have not sufficiently
alleged proximate cause (an element of their cause of action), because the type of misuse
occurring subsequent to the negligence is inconsistent with the type of data stolen. Therefore, the
motion to dismiss pursuant to Rule 12(b)(6) is due to be GRANTED regarding the negligence
claim in Count IV of the Consolidated Amended Complaint on that alternative ground as to
Named Plaintiffs Watson, Lovelace, Crespin, and Stonestreet.
16

Resnick, 693 F.3d at 1326-27 (applying Florida law); Martin v. Arnold, 643 So. 2d 564,
567 (Ala. 1994); Gulledge v. Shaw, 880 So. 2d 288, 292-93 (Miss. 2004); Willet v. Cnty. of
Lancaster, 713 N.W.2d 483, 487 (Neb. 2006); Dawson v. Wilheit, 105 N.M. 734, 736 (N.M. Ct.
App. 1987); Whiting v. Ohio Dep’t of Mental Health, 750 N.E. 2d 644, 647 (Ohio Ct. App.
2001); Lux v. Gerald E. Ort Trucking, Inc., 887 A. 2d 1281, 1286 (Pa. Super. Ct. 2005);
Kilpatrick v. Bryant, 868 S.W.2d 594, 598 (Tenn. 1993); Works v. Arlington Mem’l Hosp., 782
S.W.2d 309, 314 (Tex. Ct. App. 1989); McGuire v. Hodges, 639 S.E. 2d 284, 288 (Va. 2007).
52

b. Negligence Per Se
In Count V, the Plaintiffs allege that Defendants were negligent per se, asserting that the
standard of care that the Defendants breached is based on the requirement to protect data that was
set out in two statutes: HIPAA and § 5 of the Federal Trade Commission Act. Neither statute
provides litigants with a private right of action. See, e.g., Bans Pasta, LLC v. Mirko Franchising
LLC, 2014 WL 637762, at *12 (W.D. Va. Feb. 12, 2014) (“[N]either the FTC Act nor the FTC
Franchise Rule give[ ] rise to a private right of action.”); Sheldon v. Kettering Health Network,
40 N.E. 3d 661, 674 (Ohio Ct. App. Aug. 14, 2015) (stating that “HIPAA universally has been
held not to authorize a private right of action”). Although the briefs did not discuss this claim in
the FTC Act context, the Plaintiffs confirmed at the April hearing that they are traveling under
not only HIPAA but also the FTC Act as defining Defendants’ per se duties, and argued that the
Defendants’ alleged violation of both statutes supports their negligence per se claim.
The elements of the cause of action of negligence per se vary from state to state, but the
elements generally include: “(1) that the statute the defendant is charged with violating was
enacted to protect a class of persons to which the plaintiff belonged; (2) that the plaintiff’s injury
was the kind of injury contemplated by the statute; (3) that the defendant violated the statute; and
(4) that the defendant’s violation of the statute proximately caused the plaintiff’s injury.” Cook’s
Pest Control, Inc. v. Rebar, 28 So. 3d 716, 726 (Ala. 2009).17
17

See Resnick, 693 F.3d at 1325 (applying Florida law); Dooley v. Byrd, 64 So. 3d 951,
960 (Miss. 2011) (listing similar elements); Archibeque v. Homrich, 543 P. 2d 820, 825
(N.M. 1975) (setting out a similar test of negligence per se); Doe v. Liberator, 478 F. Supp. 2d
742, 763 (M.D. Pa. 2007) (applying Pa. law); Whaley v. Perkins, 197 S.W. 3d 665, 672 (Tenn.
2006) (discussing the doctrine of negligence per se under Tennessee law and stating that, while
not every violation of a statute creates a private negligence cause of action, the court considers
two “threshold questions” in every negligence per se case: “whether the plaintiff belongs to the
53

A conflict exists among the states regarding whether a plaintiff may pursue a negligence
per se claim based on an alleged violation of a federal statute that does not provide a private right
of action. PSC’s briefs do not address this issue, and CHSI’s initial brief mentioned the issue but
did not provide the court with a state-by-state analysis for all relevant states.18
Some of the relevant states allow a negligence per se action to proceed even where it is
based on statutes that provide no private right of action. See, e.g., Allen v. Delchamps, Inc., 624
So. 2d 1065, 1067-68 (Ala. 1993) (rejecting the argument that summary judgment was due to be
granted on the negligence per se claim because the FDCA provides no private right of action for
damages: “However, the plaintiffs in this case are not suing directly under the F.D.C.A or its
accompanying regulations. Rather, they are relying on the regulations to establish a duty or
standard of care.”); Harden v. Danek Med., Inc., 985 S.W. 2d 449, 452 (Tenn. 1998) (assuming

class of persons the statute was designed to protect and whether the plaintiff’s injury is the type
that the statute was designed to prevent”); Collett v. Cordovana, 772 S.E. 2d 584, 588 (Va. 2015)
(listing elements). See also Webster v. Shaw, ___ N.E. 3d ___, 2016 WL 1403822, at *3 (Ohio
Ct. App. Apr. 11, 2016) (internal quotations and cites omitted) (“The concept of negligence per
se allows the plaintiffs to prove the first two prongs of the negligence test, duty and breach of
duty, by merely showing that the defendant committed or omitted a specific act prohibited or
required by statute....But the plaintiff in a negligence per se action still has to prove proximate
cause and damages.”).
18

CHSI’s initial brief in support of its motion to dismiss did cite three cases for the
proposition that HIPAA and the FTC do not provide a private right of action: Sheldon v.
Kettering Health Network, 40 N.E. 3d 661 (Ohio Ct. App. 2015) (HIPAA); Clark v. Nashville
Gen. Hosp.,Case No. 3:14-1048, 2014 WL 2560505 (M.D. Tenn.) (Memo. Op. entered June 6,
2014 addressing a claim for violation of HIPAA, not a claim for negligence per se based on
HIPAA) & 2014 WL 3722881 (Order dismissing HIPAA claims, entered July 24, 2014); and
Haun v. Don Mealy Imports, Inc., 285 F. Supp. 2d 1297, 1306 (M.D. Fla. 2003) (addressing a
claim for a violation of the FTC Act, not a claim for negligence per se based on that Act). But
that proposition is different from finding that a statute such as HIPAA that does not create a
private right of action cannot form the basis of a duty or standard of care for a negligence per se
claim. Of those cases, only Sheldon addressed a negligence per se claim, as discussed
subsequently in the body of this opinion.
54

violations of FDCA statute that did not provide for a private right of action could be the basis of
negligence per se action but finding that summary judgment was appropriate because the
violation was not the proximate cause of plaintiff’s injuries).
In contrast, the laws of Florida prohibit plaintiffs from pursuing negligence per se claims
based on statutes that provide no private right of action. At the April 2015 hearing, the parties
and the court discussed the decision of Weinberg v. Advanced Data Processing, Inc., 147 F.
Supp. 3d 1359 (S.D. Fla. Nov. 17, 2015. In that case, the Florida district court refused to allow a
negligence per se action based on HIPAA to proceed: “Florida courts have refused to recognize a
private right of action for negligence per se based on an alleged violation of a federal statute that
does not provide for a private right of action.” Id. at 1365-66 (citing Jupiter Inlet Corp. v.
Brocard, 546 So. 2d 1, 2-3 (Fla. 4th Dist. Ct. App. 1998) (addressing OSHA)).
Applying choice of law rules, the court FINDS that Florida law applies to the negligence
per se claim of Plaintiff Veciana, and further FINDS that the Defendants’ motion to dismiss is
due to be GRANTED as to Plaintiff Veciana’s negligence per se claim.
The only other relevant case to which Defendants have pointed this court regarding
whether a plaintiff can bring a negligence per se case using a standard of care based on a federal
statute with no private right of action is Sheldon v. Kettering Health Network, 40 N.E. 3d 661
(Ohio Ct. App. 2015). In Sheldon, the Ohio Court of Appeals specifically found that “that
federal regulations . . . cannot be used as a basis for negligence per se under Ohio law” and also
that “utilization of HIPAA as an ordinary negligence ‘standard of care’ is tantamount to
authorizing a prohibited private right of action for violation of HIPAA itself . . . .” 40 N.E.3d at
673. The court notes that such a holding may prevent the only remaining Plaintiff with a tie to
55

Ohio, Johannes Nhete, from pursuing a claim for negligence per se pursuant to Ohio law with a
standard of care based on a violation of HIPAA and/or the FTC Act. However, Mr. Nhete lives
in Nebraska and was treated in Virginia, so under choice of law rules, his claim may be governed
by the law of those states. The Defendants have cited the court to no law in Nebraska or Virginia
prohibiting a claim for negligence per se using a standard of care based on a statute that does not
provide a private right of action. Accordingly, the court will not dismiss Plaintiff Nhete’s
negligence per se claims.
The court acknowledges PSC’s argument that many states do not recognize negligence
per se as a claim independent from negligence. The first of the two cases PSC cited from
relevant jurisdictions—Ward v. Cnty. of Cuyahoga, 721 F. Supp. 2d 677, 694 (N.D. Ohio
2010)—is inapposite. The second—Rains v. Bend of the River, 124 S.W. 3d 580, 589-591
(Tenn. Ct. App. 2003)—does recognize a claim for negligence with the standard of care set out
by statute as long as other elements of the negligence cause of action are present, such as
causation and “whether the plaintiff belongs to the class of persons the statute was designed to
protect and whether the plaintiff’s injury is of the type that the statute was designed to prevent.”
See also Scheele v. Rains, 874 N.W. 2d 867, 872-73 (Neb. 2016) (“This court has concluded on
various occasions that the violation of a regulation or statute is not negligence per se, but may be
evidence of negligence to be considered with all the other evidence in the case.”); Zavala v.
Trujillo, 883 S.W. 2d 242, 246 (Tex. Ct. App. - El Paso 1994) (emphasis in original, footnote
omitted) (stating that “negligence per se is not a cause of action separate and independent from a
common law negligence cause of action [but is] merely one method of proving, through proof of
an unexcused violation of a penal statute designed to protect the class of persons to which the
56

injured party belongs, the breach of duty required in any negligence cause of action . . . .”).
The court FINDS no reason to dismiss the claim on this theory of negligence, whether it
be denominated negligence per se in some states or negligence based on a standard of care set by
statute in others.
As the Defendants bear the burden on these motions, the court FINDS that, except for the
negligence per se claims of Named Plaintiff Veciana under Florida law, Defendants have failed
to meet their burden to establish that the negligence per se claims of the other remaining Named
Plaintiffs are due to be dismissed. The court WILL GRANT the motions to dismiss as to Named
Plaintiff Veciana’s claim of negligence per se, but WILL DENY the motions to dismiss as to the
negligence per se claims of the other remaining Named Plaintiffs over whom this court has
jurisdiction.
As an alternative ruling to the dismissals based on the lack of the “fairly traceable”
element on standing, the court FINDS that, to the extent that Named Plaintiffs Daniel Watson,
Joel Lovelace, Joan Crespin, and Cynthia Ann Martin Stonestreet, as Executor of the Estate of
Mary Glah, may have met the “fairly traceable” element of standing, they have not sufficiently
alleged proximate cause, an element of their cause of action, because the type of misuse
occurring subsequent to the conduct forming the basis of the negligence per se claim is
inconsistent with the type of data stolen. Therefore, the motion to dismiss pursuant to Rule
12(b)(6) is due to be GRANTED regarding the negligence per se claim in Count V of the
Consolidated Amended Complaint on that alternative ground as to Named Plaintiffs Watson,
Lovelace, Crespin, and Stonestreet.

57

c. Wantonness
In Count XI, the Plaintiffs allege that the Defendants’ failure to protect their confidential
data was wanton, and that their wanton conduct injured the Plaintiffs. PSC argued rather
cursorily that “many states” do not recognize the claim of wantonness, but PSC makes no
attempt to provide case law from each of the relevant states. It did provide case law from two of
the ten potentially relevant states, but the gist of the argument appears to be that wantonness is a
level of intent as opposed to a cause of action separate from negligence. One of those cases from
a relevant jurisdiction, Ward v. Cnty. of Cuyahoga, is an opinion from the Northern District of
Ohio that cites as support for its view of Ohio law one reversed case and an unreported one. 721
F. Supp. 2d 677, 694 (N.D. Ohio 2010).
One of the cases PSC cited for Tennessee law, Littlefield v. Rock-Tenn S. Container,
LLC, actually is an unpublished Alabama district court decision applying Tennessee law, with a
footnote acknowledging that “neither party addressed the wantonness claim separately in their
briefs” and citing a reversed case and an incorrectly cited case to support its view of wantonness
under Tennessee law. No. 2:12-CV-578, 2014 WL 3653911, *3 & n.3 (M.D. Ala. July 23, 2014).
Another case PSC cited as support is a decision of a district court in Tennessee that was reversed
on other grounds and that granted summary judgment on the wantonness claim because it “is
typically a negligence inquiry, and Plaintiffs are no longer pursuing a negligence claim.” Payne
v. Novartis Pharm. Corp., 967 F. Supp. 2d 1223, 1228 n.3 (E.D. Tenn. 2013), rev’d 767 F.3d 526
(6th Cir. 2014). CHSI also cited the Payne case in a footnote as its only support for the
perfunctory argument that wantonness is not a cause of action under Tennessee law. (Doc. 68, at
32 n.17).
58

This court must reiterate that Defendants, as movants, bear the burden on these motions
to dismiss to show the insufficiency of the Plaintiffs’ pleadings as a matter of law, and such
cursory arguments—that do not cover the case law of the relevant jurisdictions and that are based
in part upon decisions that are not controlling and that are less than confidence inspiring—do not
meet that burden. As to the remaining Plaintiffs over whose claims for wantonness this court has
jurisdiction, the court FINDS that the motions to dismiss the wantonness claims in Count XI are
due to be DENIED.
As an alternative ruling to the dismissals based on the lack of the “fairly traceable”
element on standing, the court FINDS that, to the extent that Named Plaintiffs Daniel Watson,
Joel Lovelace, Joan Crespin, and Cynthia Ann Martin Stonestreet, as Executor of the Estate of
Mary Glah, may have met the “fairly traceable” element of standing, they have not sufficiently
alleged proximate cause, an element of their cause of action, because the type of misuse
occurring subsequent to the conduct forming the basis of the wantonness claim is inconsistent
with the type of data stolen. Therefore, the motion to dismiss pursuant to Rule 12(b)(6) is due to
be GRANTED regarding the wantonness claim in Count XI of the Consolidated Amended
Complaint on that alternative ground as to Named Plaintiffs Watson, Lovelace, Crespin, and
Stonestreet.
4. State Statutory Claims in Counts IX and X
In Counts IX and X, Plaintiffs assert that Defendants violated certain state statutes: they
allege in Count IX that Defendants violated state statutes prohibiting unfair or deceptive trade
practices; and they allege in Count X that Defendants violated state data breach notification
statutes. The court had previously determined that, given the rulings on jurisdiction, the only
59

remaining state statutory claims are as follows:
1. The claim in Count IX asserted by Ashley Veciana (Veciana/McNutt II cases)
against PSC and CHSI, alleging a violation of the Florida Deceptive and Unfair
Trade Practices Act, Fla. Stat. Ann. § 501.204(1), et seq;
2. The claims asserted by Johannes Nhete (Alverson case) against PSC in Count IX
alleging violations of the Revised Statutes of Nebraska, Neb. Rev. Stat. §
87.302, et seq. and the Ohio Consumer Sales Practices Act, Ohio Rev. Code
Ann. §§ 1345.02(A) and (B)(1) and (2), et seq.; and in Count X alleging
violations of Va. Code Ann. §§ 18.2-186.6(B), et seq.;
3. The claim asserted by John Sanchez (Ellzey case) against PSC and CHSI in
Count IX alleging a violation of the New Mexico Unfair Practices Act, N.M.
Stat. Ann. §§ 57-12-2(D)(5)(7) and (14) and 57-12-3, et seq.;
4. The claim asserted by William Lutz (Lutz/McNutt II cases) against PSC and
CHSI in Count IX alleging a violation of Pennsylvania Unfair Trade Practices
and Consumer Protection Law, 73 P.S. §§ 201-2(4)(v)(vii) and (xxi), and 201-3,
et seq.;
5. The claims asserted by Christopher Brown (Alverson case) against PSC in Count
IX alleging a violation of the Texas Deceptive Trade Practices Consumer
Protection Act, V.T.C.A., Bus. & C. § 17.46(a), (b)(5) and (7); and in Count X
alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.; and
6. The claim asserted by Tara June Moore (Ellzey case) against PSC and CHSI in
Count X alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et seq.
Thus, the only state statutory claims over which this court possibly has jurisdiction are
brought under statutes from Florida, Nebraska, New Mexico, Ohio, Pennsylvania, Tennessee,
Texas, and Virginia.19 In briefing, PSC noted that “some of these statutes include no private right
of action” and raised other potential problems, such as the lack of reliance. (Doc. 70, at 38-39).
However, Defendants failed to provide the court with meaningful information to address each of
the statutes, such as the relevant texts of the statutes and relevant case law addressing whether a

19

The list of these statutes is on page 38 of this Memorandum Opinion.
60

private right of action exists for each statute, and the requirements of a successful suit under each
of these statutes. Defendants bear the burden on these motions.
The court FINDS that Defendants have failed to meet their burden to establish the
insufficiency of the remaining state statutory claims listed above as stated in the Consolidated
Amended Complaint. Thus, as to those specific claims of the remaining Named Plaintiffs’s
claims over which this court has jurisdiction, the motions to dismiss are due to be DENIED.
V. Remaining Claims after Rulings on Rule 12(b)(1), 12(b)(2), and 12(b)(6) Motions
After the rulings on the Rule 12(b)(1), 12(b)(2), and 12(b)(6) motions, no federal
statutory claims remain, and the remaining state law claims are listed below. The court
recognizes that these Named Plaintiff purport to represent a class. The court has not yet
addressed class certification, and these rulings do not foreclose potential class claims brought by
the remaining Named Plaintiffs on behalf of those similarly situated.
A. Remaining Claims against CHSI
1. Non-Statutory Claims
The following non-statutory claims remain against CHSI:
a. Count I (Breach of Contract): the claims of Named Plaintiffs Kathy Ellzey,
Lynda Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John Sanchez,
William Lutz, and Tara June Moore;
b. Count II (Breach of Implied Contract): the claims of Named Plaintiffs Kathy
Ellzey, Lynda Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John
Sanchez, William Lutz, and Tara June Moore;
c. Count III (Unjust Enrichment): the claims of Named Plaintiffs Kathy Ellzey,
Lynda Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John
Sanchez, William Lutz, and Tara June Moore;
d. Count IV (Negligence): the claims of Named Plaintiffs Kathy Ellzey, Lynda
61

Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John Sanchez,
William Lutz, and Tara June Moore;
e. Count V (Negligence per se): the claims of Named Plaintiffs Kathy Ellzey,
Lynda Matus, Dallas Richard, Melissa Cooper, John Sanchez, William Lutz,
and Tara June Moore;
f. Count XI (Wantonness): the claims of Named Plaintiffs Kathy Ellzey, Lynda
Matus, Dallas Richard, Ashley Veciana, Melissa Cooper, John Sanchez,
William Lutz, and Tara June Moore.

2. State Statutory Claims
The following state statutory claims asserted against CHSI in Count IX of the
Consolidated Amended Complaint remain:
1. The claim in Count IX asserted by Named Plaintiff Ashley Veciana (McNutt II
case), alleging a violation of the Florida Deceptive and Unfair Trade Practices
Act, Fla. Stat. Ann. § 501.204(1), et seq;
2. The claim asserted by Named Plaintiff John Sanchez (Ellzey case), alleging a
violation of the New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-122(D)(5)(7) and (14) and 57-12-3, et seq.; and
3. The claim asserted by Named Plaintiff William Lutz (McNutt II case), alleging a
violation of the Pennsylvania Unfair Trade Practices and Consumer Protection
Law, 73 P.S. §§ 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.
The following state statutory claim asserted against CHSI in Count X of the
Consolidated Amended Complaint remains: the claim asserted by Named Plaintiff Tara June
Moore (Ellzey case) in Count X, alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et
seq.

62

B. Remaining Claims against PSC
1. Non-Statutory Claims
The following non-statutory claims remain against PSC:
a. Count I (Breach of Contract): the claims of Named Plaintiffs Kathy Ellzey;
Lynda Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes
Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara June
Moore;
b. Count II (Breach of Implied Contract): the claims of Named Plaintiffs Kathy
Ellzey; Lynda Matus; Dallas Richard; Ashley Veciana; Melissa Cooper;
Johannes Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara
June Moore;
c. Count III (Unjust Enrichment): the claims of Named Plaintiffs Kathy Ellzey;
Lynda Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes
Nhete; John Sanchez; William Lutz; Christopher Brown; and Tara June
Moore;
d. Count IV (Negligence): the claims of Named Plaintiffs Kathy Ellzey; Lynda
Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes Nhete;
John Sanchez; William Lutz; Christopher Brown; and Tara June Moore;
e. Count V (Negligence per se): the claims of Named Plaintiffs Kathy Ellzey;
Lynda Matus; Dallas Richard; Melissa Cooper; Johannes Nhete; John
Sanchez; William Lutz; Christopher Brown; and Tara June Moore;
f. Count XI (Wantonness): the claims of Named Plaintiffs Kathy Ellzey; Lynda
Matus; Dallas Richard; Ashley Veciana; Melissa Cooper; Johannes Nhete;
John Sanchez; William Lutz; Christopher Brown; and Tara June Moore.
2. State Statutory Claims
The following state statutory claims asserted against PSC in Count IX of the
Consolidated Amended Complaint remain:
a. The claim in Count IX asserted by Named Plaintiff Ashley Veciana
(Veciana/McNutt II cases), alleging a violation of the Florida Deceptive and
Unfair Trade Practices Act, Fla. Stat. Ann. § 501.204(1), et seq;

63

b. The claims asserted by Named Plaintiff Johannes Nhete (Alverson case),
alleging violations of the Revised Statutes of Nebraska, Neb. Rev. Stat. §
87.302, et seq. and the Ohio Consumer Sales Practices Act, Ohio Rev. Code
Ann. §§ 1345.02(A) and (B)(1) and (2), et seq.;
c. The claim asserted by Named Plaintiff John Sanchez (Ellzey case), alleging a
violation of the New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-122(D)(5)(7) and (14) and 57-12-3, et seq.;
d. The claim asserted by Named Plaintiff William Lutz (Lutz/McNutt II cases),
alleging a violation of the Pennsylvania Unfair Trade Practices and Consumer
Protection Law, 73 P.S. §§ 201-2(4)(v)(vii) and (xxi), and 201-3, et seq.;
e. The claims asserted by Named Plaintiff Christopher Brown (Alverson case),
alleging a violation of the Texas Deceptive Trade Practices Consumer
Protection Act, V.T.C.A., Bus. & C. §§ 17.46(a), (b)(5) and (7).
The following state statutory claims asserted against PSC in Count X of the
Consolidated Amended Complaint remain:
a. The claim asserted by Named Plaintiff Johannes Nhete (Alverson case) in
Count X, alleging violations of Va. Code Ann. § 18.2-186.6(B), et seq.;
b. The claim asserted by Named Plaintiff Christopher Brown (Alverson case)
in Count X, alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et
seq.; and
c. The claim asserted by Named Plaintiff Tara June Moore (Ellzey case) in
Count X, alleging a violation of the Tenn. Code Ann. § 47-18-2107(b), et
seq.
The court will enter a separate Order consistent with this Memorandum Opinion.

Dated this 12th day of September, 2016

____________________________________
KARON OWEN BOWDRE
CHIEF UNITED STATES DISTRICT JUDGE

64