Moore

INTRODUCTION

Appellants April Kay Moore, Kimberly Joy, and Yvette McKinley are patients at medical facilities operated by respondent Centrelake Medical Group. In reliance on Centrelake’s allegedly false representations that it employed reasonable safeguards for patients’ personal identifying information (PII), appellants entered into contracts with Centrelake. Their contracts allegedly incorporated a privacy policy, in which Centrelake promised to maintain adequate data security practices to protect appellants’ PII from unauthorized access by third parties. In early 2019, Centrelake suffered a data breach, in which appellants’ PII was allegedly stolen by hackers and disseminated into the public domain. In April 2019, Centrelake issued a notice of the data breach, acknowledging that patient records and data might have been taken, and encouraging patients to protect themselves from identity theft or fraud, including by monitoring their credit and financial accounts. Appellants spent time on such monitoring, and appellant McKinley purchased credit and identity monitoring services.

2 In June 2019, appellants brought this action against Centrelake on behalf of themselves and a…