LabMD, Inc. v. Federal Trade Commission
Filing
33
ORDER granting 13 Motion to Dismiss; denying as moot 2 Motion for Preliminary Injunction. Ordered by Judge William S. Duffey, Jr. on 5/12/14. (jdb)
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF GEORGIA
ATLANTA DIVISION
LabMD, Inc.
Plaintiff,
v.
1:14-cv-00810-WSD
FEDERAL TRADE COMISSION,
Defendant.
OPINION AND ORDER
This matter is before the Court on LabMD’s (“Plaintiff”) Motion for
Preliminary Injunction [2] and the Federal Trade Commission’s (“Defendant” or
“FTC”) Motion to Dismiss the Plaintiff’s Complaint [13]. A hearing on the
Motion for Preliminary Injunction was conducted on May 7, 2014.
I.
BACKGROUND
A.
Factual and Procedural History
Plaintiff is a small medical laboratory based in Atlanta, GA, that provided
doctors with cancer-detection services. In January, 2010, the Defendant
commenced an investigation into the Plaintiff’s data security practices regarding
Protected Health Information (“PHI”)1 based upon the claim that sensitive
information in the Plaintiff’s possession and control had been disclosed by means
of a peer-to-peer file sharing network available to the public. Three and a half
years later, the Defendant issued an Administrative Complaint against the Plaintiff
in which it alleged that there was “reason to believe” that Plaintiff may have
engaged in “unfair . . . acts or practices,” under 15 U.S.C. § 45(a)(1) of the Federal
Trade Commission Act (“Section 5”), because Plaintiff failed to provide
reasonably adequate security for patient information retained on its internal
network. The Administrative Complaint also alleged that Plaintiff had the capacity
to prevent the vulnerabilities in its data security infrastructure “at relatively low
cost using readily available security measures,” and that the ultimate consumers
allegedly harmed due to the Plaintiff’s lax data security were unable to protect
themselves because they “ha[d] no way of independently knowing” about the
alleged disclosures. Def.’s Mot. to Dismiss and Resp. to Pl.’s Mot. for Prelim. Inj.
at 7.
The Administrative Complaint cited two specific examples of alleged data
1
PHI refers to individually identifiable health information, including the
individual’s name, social security number, address, birth date, history of mental
and physical health condition, provision of health care, and payment history for the
provision of health care.
2
security failures at LabMD. First, that LabMD failed to discover that its billing
manager had installed a peer-to-peer file sharing application known as Limewire
on his or her work computer, and a file that contained personal information on
approximately 9,300 consumers was accessible to any individual, who used or had
access to Limewire’s software. Second, that the police department in Sacramento,
California arrested alleged identity thieves, and found, in their possession,
LabMD’s documents containing sensitive pertinent personal information on
individuals.2
On November 12, 2013, Plaintiff moved the Commission to dismiss the
Administrative Complaint on the grounds that the FTC had no statutory authority
to address the data security practices of private companies under Section 5, and
that the application of Section 5 to LabMD’s data security practices violated the
Due Process Clause of the United States Constitution. On January 16, 2014, the
Commission denied the Plaintiff’s Motion to Dismiss, concluding that Section 5
vests the FTC with authority to address a private company’s data security practices
“as unfair . . . acts or practices” if they are found to be so deficient that it “causes
2
At the May 7, 2014, Preliminary Injunction hearing, the FTC informed the Court
that it was unaware whether the alleged identity thieves arrested in Sacramento
received documents containing PHI as a consequence of LabMD’s data security
failures.
3
or is likely to cause substantial injury to consumers [that] is not reasonably
avoidable by consumers themselves and [the harm is] not outweighed by
countervailing benefits to consumers or competition.” 15 U.S.C. § 45(n). The
Commission also found that the Administrative Complaint sufficiently stated a
claim that the Plaintiff engaged in “unfair . . . acts or practices” because of its
alleged failure to maintain adequate data security, and stressed that the “ultimate
decision on LabMD’s liability will depend on the factual evidence to be adduced in
this administrative proceeding.” Pl.’s Ex. 3 at 18.
The claims alleged in the Administrative Complaint have been referred to an
administrative law judge (“ALJ”) in the underlying adjudicatory proceeding. On
May 20, 2014, the ALJ will conduct an evidentiary hearing to determine whether
the Plaintiff’s data security practices violated Section 5. After the ALJ issues an
initial decision, either party may appeal to the Commission for de novo review of
the ALJ’s factual findings and legal conclusions. 5 U.S.C. § 557(b). If the
Commission concludes that the Plaintiff engaged in “unfair . . . acts or practices,”
and enters a cease and desist order, the Plaintiff has a statutory right to “obtain a
review of such order in the court of appeals.” 15 U.S.C. § 45(c).
On November 14, 2013, the Plaintiff filed a complaint against the FTC in the
United States District Court for the District of Columbia, seeking to enjoin the
4
enforcement action on the grounds that (1) the FTC abused its statutory authority
by regulating LabMD’s data security practices, (2) the FTC’s application of
Section 5 to LabMD’s data security practices violated the Due Process Clause, and
(3) the FTC brought the enforcement action to retaliate against LabMd’s
President’s public criticism of the agency. On December 23, 2013, the Plaintiff
filed in the Eleventh Circuit a Motion to Stay the administrative proceedings,
arguing that a stay was necessary to prevent irreparable harm, including on the
grounds that the FTC’s application of Section 5 to LabMD’s data security practices
lacked statutory authority, and the FTC’s actions were ultra vires and
unconstitutional. On February 18, 2014, the Eleventh Circuit, sua sponte,
dismissed the Plaintiff’s petition for lack of jurisdiction.
The Eleventh Circuit concluded that its authority, under § 45(c), did not
extend beyond review of a final cease and desist order. The Eleventh Circuit,
however, “[did] not express or imply any opinion about whether a district court has
jurisdiction to hear [the plaintiff’s] claims or about the merits of those claims.”
On February 19, 2014, the Plaintiff voluntarily dismissed its complaint
pending before the United States District Court for the District of Columbia. A
month later, the Plaintiff filed a Verified Complaint (“Complaint”) for Declaratory
and Injunctive relief in this Court. The Complaint alleges that (1) the FTC action
5
is arbitrary and capricious under the Administrative Procedures Act (“APA”)
because the FTC does not have the statutory authority to regulate PHI under
Section 5; (2) the FTC action is an ultra vires act that exceeds its congressional and
constitutional authority; and (3) the FTC’s application of Section 5 to LabMD’s
data security practices violates the requirements of fair notice, and the right to a
fair hearing in a fair tribunal under the Due Process Clause of the United States
Constitution. The Complaint also alleges that the FTC violated LabMD’s First
Amendment right to free speech by filing the Administrative Complaint. On
March 20, 2014, Plaintiff filed a Motion for Preliminary Injunction to enjoin the
ongoing administrative proceeding before the ALJ, and to enjoin the FTC from
asserting any further data security actions against LabMD.
At the core, LabMD’s claims in this matter are identical to those filed in the
United States District Court for the District of Columbia and the Eleventh Circuit.
LabMD alleges that Section 5 does not authorize an action for alleged security
breaches involving PHI that is not provided to LabMD by patients but by
physicians ordering laboratory tests for their patients. It claims also that PHI is
regulated by the Health Insurance Portability and Accountability Act of 1996
(HIPPA) and the Health Information Technology for Economic and Clinical
Health Act (HITECH) of 2009, which discredits that the FTC has the authority to
6
regulate data security under Section 5. LabMD further alleges that the FTC has not
published any requirements for the protection of patient information, and thus
LabMD is not on notice of what protections the FTC now claims were required.
LabMD claims that the FTC brought its enforcement action against LabMD to
retaliate against its President’s public criticism of the FTC, which were published
through the press, social media, and in a book entitled The Devil Inside the
Beltway: The Shocking Expose of the US Government’s Surveillance and
Overreach into Cybersecurity, Medicine and Small Business.3
On April 7, 2014, the FTC replied to LabMD’s Motion for Preliminary
Injunction, and moved under Rule 12(b)(1) of the Federal Rules of Civil Procedure
to dismiss the Complaint for lack of jurisdiction and moved under Rule 12(b)(6) to
dismiss for failure to state a claim. On April 11, 2014, LabMD filed its Response
in Opposition to the FTC’s Motion to Dismiss. On April 16, 2014, the FTC replied
to LabMD’s Response to its Motion to Dismiss the Complaint.
3
At the May 7, 2014 hearing, Mr. Daugherty testified that FTC employees
accessed his blog 75 times shortly after he criticized the FTC for bringing an
enforcement action against LabMD. Preliminary Injunction Hr’g Tr., May 7,
2014, at 23: 9-20. Counsel for the FTC did not know why FTC personnel
repeatedly accessed Mr. Daugherty’s blog shortly after the criticisms were
published, but surmised that a possible explanation for accessing the blog was that
FTC personnel wanted to ensure that Mr. Daugherty’s free speech rights were not
impeded. Id. at 24-28.
7
II.
DISCUSSION
A.
Legal Standard
1.
Motion to Dismiss
The law governing motions to dismiss pursuant to Rule 12(b)(6) is wellsettled. Dismissal of a complaint is appropriate “when, on the basis of a
dispositive issue of law, no construction of the factual allegations will support the
cause of action.” Marshall Cnty. Bd. of Educ. v. Marshall Cnty. Gas Dist.,
992 F.2d 1171, 1174 (11th Cir. 1993).
In considering a motion to dismiss, the Court accepts the plaintiff’s
allegations as true and considers the allegations in the complaint in the light most
favorable to the plaintiff. See Hishon v. King & Spalding, 467 U.S. 69, 73 (1984);
Watts v. Fla. Int’l Univ., 495 F.3d 1289, 1295 (11th Cir. 2007); see also Bryant v.
Avado Brands, Inc., 187 F.3d 1271, 1273 n.1 (11th Cir. 1999) (“At the motion to
dismiss stage, all well-pleaded facts are accepted as true, and the reasonable
inferences therefrom are construed in the light most favorable to the plaintiff.”).
The Court, however, is not required to accept a plaintiff’s legal conclusions. See
Sinaltrainal v. Coca-Cola Co., 578 F.3d 1252, 1260 (11th Cir. 2009) (citing
Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)), abrogated on other grounds by
Mohamad v. Palestinian Auth., 132 S. Ct. 1702 (2012). The Court also will not
8
“accept as true a legal conclusion couched as a factual allegation.” See Bell Atl.
Corp. v. Twombly, 550 U.S. 544, 555 (2007). Ultimately, the complaint is
required to contain “enough facts to state a claim to relief that is plausible on its
face.” Twombly, 550 U.S. at 570.4
To state a claim to relief that is plausible, the plaintiff must plead factual
content that “allows the Court to draw the reasonable inference that the defendant
is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. “Plausibility”
requires more than a “sheer possibility that a defendant has acted unlawfully,” and
a complaint that alleges facts that are “merely consistent with” liability “stops
short of the line between possibility and plausibility of ‘entitlement to relief.’” Id.
(citing Twombly, 550 U.S. at 557). “To survive a motion to dismiss, plaintiffs
must do more than merely state legal conclusions; they are required to allege some
specific factual bases for those conclusions or face dismissal of their claims.”
Jackson v. BellSouth Telecomms., 372 F.3d 1250, 1263 (11th Cir. 2004)
(“[C]onclusory allegations, unwarranted deductions of facts or legal conclusions
4
The Supreme Court explicitly rejected its earlier formulation for the Rule
12(b)(6) pleading standard: “‘[T]he accepted rule [is] that a complaint should not
be dismissed for failure to state a claim unless it appears beyond doubt that the
plaintiff can prove no set of facts in support of his claim which would entitle him
to relief.’” Twombly, 550 U.S. at 577 (quoting Conley v. Gibson, 355 U.S. 41,
45-46 (1957)). The Court decided that “this famous observation has earned its
retirement.” Id. at 563.
9
masquerading as facts will not prevent dismissal.”) (citations omitted).5
B.
Analysis
Under § 704 of the APA, “[a]gency action made reviewable by statute and
final agency action for which there is no other adequate remedy in a court are
subject to judicial review.” 5 U.S.C. § 704. “The requirement of a final agency
action has been considered jurisdictional. If the agency action is not final, the
court therefore cannot reach the merits of the dispute.” Nat’l Parks Conservation
Ass’n v. Norton, 324 F.3d 1229, 1236 (11th Cir. 2003) (internal citations and
quotation marks omitted). An agency action is considered final when two
requirements are met: (1) the action marks the “consummation of the agency’s
decisionmaking process”—it must not be of a tentative or interlocutory nature, and
(2) the action must be one by which “rights or obligations have been determined”
or from which “legal consequences will flow.” Bennett v. Spear, 520 U.S. 154,
177-78 (1994). A non-final agency action is one that “does not itself adversely
affect the complainant but only affects his rights adversely on the contingency of
5
Federal Rule of Civil Procedure 8(a)(2) requires the plaintiff to state “a short and
plain statement of the claim showing that the pleader is entitled to relief.” Fed. R.
Civ. P. 8(a)(2). In Twombly, the Supreme Court recognized the liberal minimal
standards imposed by Federal Rule 8(a)(2) but also acknowledged that “[f]actual
allegations must be enough to raise a right to relief above the speculative
level . . . .” Twombly, 550 U.S. at 555.
10
future administrative action.” Rochester Tel. Corp. v. United States, 307 U.S. 125,
130 (1939).
LabMD contends that the Commission’s interlocutory decision to deny its
Motion to Dismiss the Administrative Complaint is a final agency action because
the Commission has concluded that Section 5 allows the FTC to regulate PHI
retained by medical service providers, and, that the FTC is authorized to impose
obligations on those providers who maintain PHI even if it supplements the
requirements of other federal statutes. LabMD also argues that the FTC has treated
the Commission’s Order as a final agency action because the FTC submitted the
Order to the Eleventh Circuit and the District Court of New Jersey as supplemental
legal authority, requesting those courts to afford Chevron deference to the
Commission’s interpretation of Section 5.
While the Eleventh Circuit has not directly addressed the issue, those courts
that have universally hold that a direct attack on the agency’s statutory or
constitutional authority to conduct an investigation or commence an enforcement
action does not allow a plaintiff to evade administrative review or avoid
administrative procedures. Aluminum Co. of America v. United States, 790 F.2d
938, 942 (D.C. Cir. 1986) (observing that a claim attacking an agency’s assertion
of jurisdiction as beyond statutory authority does not make a difference to the
11
finality analysis because the purpose of finality is to prevent piecemeal
“consideration of rulings that may fade into insignificance by the time the initial
decisionmaker disassociates itself from the matter.”); see also VeldHoen v. United
States Coast Guard, T.A., 35 F.3d 222 (5th Cir. 1994); Dairymen, Inc. v. FTC, 684
F.2d 376, 378-79 (6th Cir. 1982).
The Commission’s denial of LabMD’s Motion to Dismiss the
Administrative Complaint on the grounds that the FTC does not have the statutory
authority to regulate data security practices under Section 5 is the type of Order
that “ha[s] long been considered nonfinal.” DRG Funding Corp. v. Secretary of
HUD, 76 F.3d 1212, 1215 (D.C. Cir. 1996). The Commission’s Order is the
equivalent of a district court’s decision to deny a motion to dismiss, “which—
unlike a final order ending the case—assures its continuation.” Id. LabMD’s
contention that the Commission’s interlocutory Order is a final agency action
because it concluded that the FTC has statutory authority to regulate PHI under
Section 5 has specifically been rejected by other courts.
In American Airlines Inc. v. Herman, for example, the plaintiff argued that it
would be “futile for it to pursue the administrative process because the DOL
already has finally and definitively rejected each of [the] challenges to its statutory
and regulatory authority.” 176 F.3d 283, 292 (5th Cir. 1999). The Fifth Circuit
12
rejected the plaintiff’s argument, and held that “the requirement that the reviewable
order be definitive in its impact on the rights of the parties is something more than
a requirement that the order be unambiguous in legal effect. It is a requirement
that the order have some substantial effect which cannot be altered by subsequent
administrative action.” Id. (internal quotation marks and citations omitted)
(emphasis in original). Because of the possibility that the plaintiff could prevail on
the merits in the administrative proceeding, the Fifth Circuit required the plaintiff
to submit to the administrative proceeding. Id.
The Court concludes that it does not have jurisdiction over this action
because even if it determines that the Commission’s position on the FTC’s
authority to regulate PHI under Section 5 was definitive, the mere assertion of
jurisdiction does not impose or fix an obligation on LabMD from which “legal
consequences may flow.” Bennett, 520 U.S. at 177-78. The Commission’s denial
of LabMD’s Motion to Dismiss the Administrative Complaint is not a final agency
action, and the FTC’s decision to submit the Commission’s Order to other courts
as “supplemental authority” is a litigation tactic that does not render final a
Commission Order that is not. The possibility that LabMD may prevail on the
merits if the ALJ, or the Commission, concludes that it did not violate Section 5
will moot its judicial challenge and render it unnecessary for the Court to intervene
13
in an ongoing administrative proceeding.6 American Airlines Inc., 176 F.3d at
292. See also FTC v. Standard Oil Co. of California, 449 U.S. 232, 242 (1980)
(observing that “judicial intervention into the agency process denies the agency an
opportunity to correct its own mistakes and to apply its expertise,” and that
“intervention also leads to piecemeal review which at the least is inefficient and
upon completion of the agency process might prove to have been unnecessary.”)
(citations omitted).
LabMD alleges that the burdens imposed by the FTC investigation and the
requirement to submit to an administrative proceeding crippled its day to day
business because it had to effectively shut down its operations, lay off more than
two dozen employees, and cannot procure medical malpractice and property
insurance to remain a going concern. Even if the Court accepts these allegations as
true, the expense and burdens associated with complying with an agency’s
information requests and submitting to an administrative proceeding do not qualify
as legally recognized harms, and do not provide a basis upon which to grant
6
The Court believes that the likelihood of a favorable jurisdictional or merits
outcome for LabMD is slight, but that belief cannot govern the legal issues
addressed in this Order. As the Court noted at the May 7, 2014 hearing, the
authority of the FTC to enlarge its regulatory activity in the data security area
presents an interesting and likely important jurisdictional issue that needs to be
resolved promptly.
14
LabMD relief. Standard Oil Co. of California, 449 U.S. at 244 (“litigation
expense, even substantial and unrecoupable cost, does not constitute irreparable
injury” because “the expense and annoyance of litigation is part of the social
burden of living under government.”) (internal citations and quotation marks
omitted); see also Imperial Carpet Mills, Inc. v. Consumer Prod. Safety Comm’n,
634 F.2d 871, 874 (5th Cir. Unit B Jan. 1981)7 (holding that “the burden of
defending against the Complaint; the expense of complying with the Commission’s
anticipated final order; the resulting bad publicity; and the potential for a
dangerous loss of credit” do not justify intervention into administrative agency
action).8
7
In Bonner v. City of Prichard, the Eleventh Circuit adopted as binding precedent
decisions of the Fifth Circuit handed down prior to October 1, 1981. 661 F.2d
1206, 1209-10 (11th Cir. 1981).
8
LabMD’s claim that the FTC investigation had a crippling effect on its business is
questionable in light of Mr. Daugherty’s testimony at the Preliminary Injunction
hearing. In 2010, the FTC began its investigation into LabMD’s data security
practices. Four years later, in January, 2014, LabMD decided to no longer provide
cancer detection services, which is the essence of its business operations.
Preliminary Injunction Hr’g Tr., at 6: 20-25. LabMD continued to operate as a
going concern throughout the FTC investigation until the end of 2013. In 2013,
LabMD retained 25 to 30 employees on its payroll, and it continued to generate a
profit margin of approximately 25% until 2013 when the company experienced a
loss of half a million dollars. Id. at 11: 1-25. The company “never had problems
getting insurance prior to 2013.” Id. at 12: 6-8. The evidence presented at the
Preliminary Injunction hearing demonstrates that an insurer’s decision to deny tail
risk coverage to LabMD on account of the FTC investigation and administrative
15
LabMD’s view that the Court can address and review its constitutional
claims based on the Due Process Clause and the First Amendment regardless of
whether there is a final agency action under the APA is contrary to established
precedent. In Ticor Tile Ins. Co. v. FTC, the plaintiff mounted a facial challenge
to the constitutionality of Section 5, arguing that the FTC had definitively
concluded that the provision was constitutional, and that the FTC’s position
constituted final agency action reviewable in a federal court before the
consummation of the administrative proceeding. 814 F.2d 731, 738-743, 746-749
(D.C. Cir. 1987). The D.C. Circuit affirmed the dismissal of plaintiff’s complaint
because there was no final agency action, the plaintiff did not exhaust its remedies
in the administrative proceeding, and the case was not ripe for review. Id. at 732;
Id. at 748 (Williams, J.) (explaining that even if unconstitutional actions are
accepted as “heavier” than “those of statutory illegality, the constitutional
dimension of appellants’ burden entails a concern that militates powerfully against
proceeding was not made until January 13, 2014, which is a week after LabMD
had decided to discontinue its cancer detection services. See Pl.’s Ex. 15, attached
to Pl.’s Ex. List. At the Preliminary Injunction hearing, Mr. Daugherty, conceded
that the implementation of the Affordable Care Act, and its resulting effect on cost
containment and market consolidation negatively impacted LabMD’s operations,
and “creat[ed] huge anxiety, destruction, consolidation in our customer base.” Id.
at 52: 9-21. Mr. Daugherty also conceded that LabMD’s future “depend[ed] on
Obamacare, and other than that I don’t know.” Id. at 54: 1-4.
16
immediate review: the fundamental rule of judicial restraint, forbidding resolution
of constitutional questions before it is necessary to decide them.”) (internal
citations and quotation marks omitted).
In the absence of final agency action, LabMD’s alleged constitutional
injuries are not currently ripe for review. North Carolina State Bd. of Dental
Examiners v. FTC, 768 F. Supp. 2d 818, 824 (E.D.N.C 2011) (holding that in the
absence of a final cease and desist order from the Commission, plaintiff has failed
to show that its constitutional rights have been or are being violated); see also E. I.
Dupont de Nemours and Co. v. FTC, 488 F. Supp. 747, 754 (D. Del. 1980)
(rejecting the plaintiff’s claim that the FTC violated its First Amendment rights by
filing a complaint because the FTC did not direct the plaintiff to stop engaging in
speech, and there was no indication that significant costs or sanctions on the use of
protected expression would be imposed on the plaintiff to stifle its free speech as
the “only ‘threat’ that is involved in the administrative proceedings is the threat
that a cease and desist order will be issued [and] . . . no other sanctions or penalties
can be imposed . . . as the result of those proceedings.”).
Finally, LabMD asserts that even if the Commission’s Order regarding its
jurisdiction does not constitute final agency action, the Leedom exception applies,
allowing the Court to review LabMD’s constitutional and ultra vires claims.
17
Under the Leedom exception, federal courts typically lack jurisdiction to enjoin an
ongoing administrative proceeding, Ewing v. Mytinger & Casselberry, Inc., 339
U.S. 594, 598 (1950), unless the agency commits an “egregious error” that plainly
violates an unambiguous and mandatory provision of a federal statute, and the
aggrieved party has no adequate or meaningful opportunity to vindicate its rights.
Leedom v. Kyne, 358 U.S. 184 (1958); American Airlines Inc., 176 F.3d at 29394. The Court concludes that the Leedom exception does not apply here because
the FTC’s application of Section 5 to the data security practices of private
companies is not contrary to an unambiguous and mandatory provision of a federal
statute. In American Airlines Inc., the Fifth Circuit specifically held that the
Leedom exception does not apply to a “dispute over whether an agency charged
with a statute’s implementation has interpreted it correctly.” 176 F.3d at 293. That
is the crux of the Plaintiff’s Complaint in this matter, but it is insufficient to invoke
the exception under Leedom. LabMD can obtain meaningful and adequate review
of its jurisdictional challenge in the Court of Appeals, if that is necessary.
III.
CONCLUSION
Accordingly, for the foregoing reasons,
IT IS HEREBY ORDERED that the Defendant’s Motion to Dismiss the
Complaint for lack of jurisdiction is GRANTED [13].
18
IT IS FURTHER ORDERED that the Plaintiff’s Motion for Preliminary
Injunction is DENIED AS MOOT [2].
SO ORDERED this 12th day of May 2014.
19
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?