Sa v. California Correctional Health Care Services

Filing 7

ORDER OF DISMISSAL. Signed by Judge Lucy H. Koh on 7/26/17. (Attachments: # 1 Certificate/Proof of Service)(iymS, COURT STAFF) (Filed on 7/26/2017)

1
2
3
4
5
6
7
8

UNITED STATES DISTRICT COURT

9

NORTHERN DISTRICT OF CALIFORNIA

10
LOUEN SA,
United States District Court
Northern District of California

11

Case No. 17-CV-02817 LHK (PR)
Plaintiff,

12

ORDER OF DISMISSAL

v.

13
14

CALIFORNIA CORRECTIONAL
HEALTH SERVICES,

15

Defendant.

16

Plaintiff, a California state prisoner proceeding pro se, filed a civil rights complaint under

17

42 U.S.C. § 1983. Plaintiff is granted leave to proceed in forma pauperis in a separate order. For

18

the reasons stated below, the court dismisses the complaint for lack of standing.

19
20

DISCUSSION
A.

Standard of review

21

A federal court must conduct a preliminary screening in any case in which a prisoner seeks

22

redress from a governmental entity or officer or employee of a governmental entity. See 28 U.S.C.

23

§ 1915A(a). In its review, the court must identify any cognizable claims and dismiss any claims

24

that are frivolous, malicious, fail to state a claim upon which relief may be granted or seek

25

monetary relief from a defendant who is immune from such relief. See 28 U.S.C. § 1915A(b)(1),

26
27
28

Case No. 17-CV-02817 LHK (PR)
ORDER OF DISMISSAL

1

1

(2). Pro se pleadings must, however, be liberally construed. See Balistreri v. Pacifica Police

2

Dep’t., 901 F.2d 696, 699 (9th Cir. 1988).
To state a claim under 42 U.S.C. § 1983, a plaintiff must allege two essential elements: (1)

3
4

that a right secured by the Constitution or laws of the United States was violated, and (2) that the

5

alleged violation was committed by a person acting under the color of state law. See West v.

6

Atkins, 487 U.S. 42, 48 (1988).

7

B.

Legal claims

8

Plaintiff alleges that defendant California Correctional Health Care Services (“CCHCS”)

9

violated the Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 1320d,
et seq., and the Confidentiality of Medical Information Act, Cal. Civil Code § 56, et seq.

11
United States District Court
Northern District of California

10

Specifically, plaintiff states that on May 16, 2016, CCHCS notified plaintiff that on February 25,

12

2016, an unencrypted laptop computer was stolen from an employee’s personal vehicle. CCHCS

13

notified plaintiff that it believed any release of sensitive information was limited to information

14

regarding plaintiff’s custody and care between 1996 and 2014. Plaintiff alleges that CCHCS

15

failed to uphold its duty to fully encrypt and password protect its system against loss of data, and

16

plaintiff requests monetary compensation for the privacy breach.

17

As an initial matter, plaintiff has failed to name a proper defendant. CCHCS is a state

18

agency and therefore not a person under Section 1983. See Will v. Mich. Dept. of State Police, 491

19

U.S. 58, 71 (1989) (“[N]either a State nor its officials acting in their official capacities are

20

‘persons’ under § 1983.”). Moreover, plaintiff’s attempt to raise a claim pursuant to HIPAA,

21

which requires the confidentiality of medical records, fails because “HIPAA itself does not

22

provide for a private right of action.” Webb v. Smart Document Solutions, LLC, 499 F.3d 1078,

23

1082 (9th Cir. 2007) (“Under HIPAA, individuals do not have a right to court action.”). Thus,

24

plaintiff’s HIPAA claim is not cognizable. However, the Ninth Circuit has held that the

25

constitutional right to informational privacy extends to medical information. See Norman-

26
27
28

Case No. 17-CV-02817 LHK (PR)
ORDER OF DISMISSAL

2

1

Bloodsaw v. Lawrence Berkeley Lab., 135 F.3d 1260, 1269 (9th Cir. 1998) (“The constitutionally

2

protected privacy interest in avoiding disclosure of personal matters clearly encompasses medical

3

information and its confidentiality.”).

4

Even assuming that plaintiff could substitute an appropriate individual as defendant and

5

that plaintiff could properly bring a claim that his right to informational privacy was violated, the

6

complaint must be dismissed because plaintiff’s speculative allegations do not establish that

7

plaintiff has standing.

8

Federal courts have the power and the duty to raise the issue of standing sua sponte and to

9

dismiss the action if standing is wanting. See Bernhardt v. County of Los Angeles, 279 F.3d 862,
868 (9th Cir. 2002). To have Article III standing, a plaintiff must plead and prove that he has

11
United States District Court
Northern District of California

10

suffered sufficient injury to satisfy the “case or controversy” requirement of Article III of the

12

United States Constitution. See Clapper v. Amnesty Int’l USA, 133 S. Ct. 1138, 1146 (2013)

13

(“‘One element of the case-or-controversy requirement’ is that plaintiffs ‘must establish that they

14

have standing to sue.’”) (quoting Raines v. Byrd, 521 U.S. 811, 818 (1997))). To satisfy Article

15

III standing, a plaintiff must therefore allege: (1) injury-in-fact that is concrete and particularized,

16

as well as actual or imminent; (2) that the injury is fairly traceable to the challenged action of the

17

defendant; and (3) that the injury is redressable by a favorable ruling. Monsanto Co. v. Geertson

18

Seed Farms, 561 U.S. 139, 149 (2010) (citation omitted); Lujan v. Defenders of Wildlife, 504 U.S.

19

555, 560-61 (1992).

20

Although plaintiff has not attached a copy of the notification letter provided to him, a

21

number of lawsuits have been filed in federal district courts in California, making the same

22

allegations of a data breach that plaintiff makes in the instant case. The notification of the

23

potential breach was provided as an attachment in several of those actions and reads as follows:

24

We do not know if any sensitive information was contained in the laptop. To the extent
any sensitive information may have been contained in the laptop, we do not know if the
information included any of your information. If your information was included, the

25
26
27
28

Case No. 17-CV-02817 LHK (PR)
ORDER OF DISMISSAL

3

1
2

nature of the information may have included confidential medical, mental health, and
custodial information. To the extent any sensitive information may have been contained in
the laptop, we estimate that it would have been limited to information related to your
custody and care, if any, between 1996 and 2014.

3

Fletcher v. Cal. Corr. Health Care Servs., Case No. 16-cv-04187-YGR (PR), 2016 WL 5394125,

4

at *1 (N.D. Cal. Sept. 27, 2016); Seastrunk v. Cal. Corr. Health Servs., Case No. 2:16-cv-1424

5

AC P, 2016 WL 3549623, at *2 (E.D. Cal. June 30, 2016); Compton v. Cal. Corr. Health Care

6

Servs., Case No. 2:16-cv-1606 AC P, 2016 WL 3916320, at *2 (E.D. Cal. July 20, 2016);

7

Gonzalez v. Matolon, Case No. 2:16-cv-1281 MCE KJN P, 2016 WL 7178519, at *2 (E.D. Cal.

8

Dec. 9, 2016). The notification mirrors plaintiff’s allegations that his sensitive information was

9

only potentially subject to a breach because of the theft of the laptop, and demonstrates the

10

speculative nature of plaintiff’s claims.

United States District Court
Northern District of California

11

At most, plaintiff only alleges the possibility that his medical information was disclosed.

12

Without more, the alleged injury is entirely speculative. While potential future harm can in some

13

instances confer standing, plaintiff must face “a credible threat of harm” that is “both real and

14

immediate, not conjectural or hypothetical.” Krottner v. Starbucks Corp., 628 F.3d 1139, 1143

15

(9th Cir. 2010) (citations and internal quotation marks omitted). Plaintiff’s allegations are based

16

upon a notification which states that it is unknown whether any sensitive information is contained

17

in the laptop and that even if there is sensitive information in the laptop, the scope of the

18

information, including whether any of plaintiff’s information is contained therein, is unknown. In

19

other words, whether plaintiff’s sensitive information has even been compromised is unknown.

20

Plaintiff cannot state a federal claim for relief based upon the speculative breach of his sensitive

21

information, and the complaint must be dismissed.

22

Upon finding that a complaint should be dismissed for failure to state a claim, the district

23

court has discretion to dismiss with or without leave to amend. See Lopez v. Smith, 203 F.3d

24

1122, 1126-30 (9th Cir. 2000) (en banc). Leave to amend should be granted if it appears possible

25

that the defects in the complaint could be corrected, especially if a plaintiff is pro se. Id. at 1130-

26
27
28

Case No. 17-CV-02817 LHK (PR)
ORDER OF DISMISSAL

4

1

31; see also Cato v. United States, 70 F.3d 1103, 1106 (9th Cir. 1995) (“A pro se litigant must be

2

given leave to amend his or her complaint, and some notice of its deficiencies, unless it is

3

absolutely clear that the deficiencies of the complaint could not be cured by amendment.”).

4

However, if, after careful consideration, it is clear that a complaint cannot be cured by

5

amendment, the district court may dismiss without leave to amend. See id. at 1105-06. Here, as

6

set forth above, plaintiff lacks standing and thus amendment would be futile because the

7

notification on which his allegations are based establishes only speculative injury that is neither

8

real nor immediate. Because plaintiff lacks standing to pursue his federal claim, the court

9

DISMISSES the complaint in its entirety without prejudice and without leave to amend.
CONCLUSION

10

United States District Court
Northern District of California

11
12
13
14

The court DISMISSES plaintiff’s complaint without prejudice and without leave to amend.
The clerk shall terminate all pending motions and close the file.
IT IS SO ORDERED.
DATED:

7/26/17
LUCY H. KOH
UNITED STATES DISTRICT JUDGE

15
16
17
18
19
20
21
22
23
24
25
26
27
28

Case No. 17-CV-02817 LHK (PR)
ORDER OF DISMISSAL

5