In the latest sign that data breach class actions are here to stay—and, indeed, growing—the D.C. Circuit resuscitated claims against health insurer CareFirst BlueCross and Blue Shield, following a 2015 breach that compromised member names, dates of birth, email addresses, and subscriber identification numbers of approximately 1.1 million individuals. The
decision aligns the second most powerful federal appellate court in the nation with pre-
Spokeo decisions in
Neiman Marcus and
P.F. Chang and post-
Spokeo decisions in other circuits (Third,
Seventh, and Eleventh). In short, an increased risk of identity theft constitutes an imminent injury-in-fact, and the risk of future injury is substantial enough to support Article III standing.
The D.C. Circuit’s holding is an important development. First, the D.C. Circuit went beyond credit card numbers and social security numbers to
expand the scope of data types that create a risk to individuals (
i.e., names, birthdates, emails, and health insurance subscriber ID numbers). Second, the decision makes clear that organizations should carefully consider the interplay between encryption (plus other technical data protection measures) and “risk of harm” exceptions to notification, including exceptions that may be available under HIPAA and GLBA statutory regimes.
Data Breach and District Court Proceedings
In April 2015, CareFirst acknowledged that a security review uncovered evidence that hackers had stolen names, birthdates, email addresses, and health insurance subscriber identification numbers. Plaintiffs filed suit quickly in D.C., and then appealed the district court’s order dismissing the case for lack of standing because plaintiffs’ injury was too speculative.
Applying
Spokeo, the court explained that, “[a]n injury in fact must be concrete, particularized, and, most importantly for our purposes, ‘actual or imminent’ rather than speculative.” The D.C. Circuit considered two increased risks of identity theft based on the information that was exposed. First (and unsurprisingly), the court held that unauthorized access to Social Security and credit card numbers established an increased risk of identity theft sufficient for standing purposes.
[1] Second (and more importantly), the court found that the theft of names, birthdates, emails, and subscriber identification numbers alone—even without exposure of Social Security numbers or credit card information—presented a “substantial risk of identity fraud” in the form of “medical identity theft.” Citing the Seventh Circuit’s reasoning in
Neiman Marcus, the court explained: “Why else would hackers break into a . . . database and steal consumers’ private information? Presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities.”
Takeaways
The notion of medical identity theft is nothing new. Over the last several years, the increasing frequency of attacks in the health-care sector suggest that hackers have identified ways to monetize health-care information. As the D.C. Circuit explained, “a fraudster impersonates the victim and obtains medical services in her name,” which can “lead to inaccurate entries in victims’ medical records and can potentially cause victims to receive improper medical care, have their insurance depleted, become ineligible for health or life insurance, or become disqualified from some jobs.”
The decision has two important implications.
First, companies that experience a security incident will analyze whether they fall under the so-called “risk of harm” exemption to notification. These exemptions are available under many state breach notification laws and other regimes, including HIPAA and GLBA. The D.C. Circuit’s
decision will force organizations to think very carefully about referencing the data elements that were exposed, in concluding that the risk of consumer harm resulting from a breach is low or unlikely. In other words, historically, data breaches like CareFirst (
i.e., no Social Security numbers, no credit card numbers, no government identification credentials) might have been regarded as low-risk events that were unlikely to result in identity theft or class action litigation. The D.C. Circuit’s
decision dispels that misconception, and forces organizations to think about the data they maintain in a new light. All organizations, even the ones that do not collect or store Social Security numbers or credit card information, have data that may put individuals at risk of harm if exposed and all are thus at an increased risk of being a potential class action targets. It only depends only on how innovative hackers are in monetizing stolen data.
Second,
CareFirst is yet another warning to organizations that they can (and should) use data protection tools and techniques to manage legal risk. Whereas many organizations use encryption for Social Security numbers and credit card information, other data types are taking center stage for identity theft and fraud scams, including medical subscription ID numbers and date of birth, which are often key data elements that can be used to verify an individual’s identity, particularly for health-care providers. Broader use of encryption also allows organizations to take advantage of state data breach notification exemptions or “safe harbors,” such as North Dakota, which is the only state that requires notification to individuals if date of birth information is compromised in conjunction with first and last name. Of course, there are trade-offs and balances that apply to the deployment of encryption, the costs incurred to do so, and the impact on systems performance. Companies are well counseled to analyze these considerations together with the risk/litigation-mitigation benefits apparent in the wake of
CareFirst.
[1] Even though CareFirst’s data breach announcement specified that the “database accessed by attackers contained no member Social Security numbers, medical claims, employment, credit card, or financial information,” the plaintiffs’ alleged credit card information and Social Security numbers were part of the stolen information. The court resolved the dispute by holding that the plaintiffs had satisfactorily alleged theft of Social Security numbers and credit card information.