O 1

2 3 4 5 6 7

8 United States District Court 9 Central District of California

10

11 SALLIE HOLLY Case № 2:19-cv-07496-ODW (MRWx)

12 Plaintiffs,

ORDER GRANTING

13 v.

DEFENDANT’S MOTION TO

14 ALTA NEWPORT HOSPITAL, INC. DISMISS AND MOTION TO 15 DBA FOOTHILL REGIONAL STRIKE [21] MEDICAL CENTER, et al.,

16 Defendants. 17 18 I. INTRODUCTION 19 This matter comes before the Court on Defendant Alta Newport Hospital, Inc. 20 dba Foothill Regional Medical Center’s (“Hospital”) motion to dismiss Plaintiff Sallie 21 Holly’s Second Amended Complaint and motion to strike class allegations 22 (“Motion”). (Def.’s Second Mot. to Dismiss and Mot. to Strike (“Mot.”), ECF 23 No. 21.) For the reasons that follow, the Court GRANTS Hospital’s Motion to 24 Dismiss and GRANTS Hospital’s Motion to Strike.1 25 26 27

28 1 Having carefully considered the papers filed in connection with the Motion, the Court deemed the matter appropriate for decision without oral argument. Fed. R. Civ. P. 78; C.D. Cal. L.R. 7-15. 1 II. BACKGROUND 2 Plaintiff Sallie Holly received medical care at Hospital in March 2017 and, as 3 part of that process, she provided her medical and personal information to Hospital. 4 (Second Amended Complaint (“SAC”) ¶ 21, ECF No. 20.) In September 2017, Alta 5 Hospital Systems, LLC (“AHS”) sent Holly a letter informing her Hospital discovered 6 an inappropriate disclosure of Holly’s protected health information. (Id. ¶ 24.) AHS 7 explained that, on August 24, 2017, a new employee was training on a software 8 program, viewing medical records on a computer. (Id.) The employee took six 9 photographs of those medical records on her personal cellular telephone, some of 10 which were Holly’s medical records. (Id.) The employee then accidentally posted the 11 photographs on her public Facebook account. (Id.) The next day, a physician notified 12 Hospital’s management about the photographs being posted. (Id.) The information in 13 the posted medical records included Holly’s name, date of birth, account number, and 14 other diagnostic and treatment information. (Id.) After receiving the letter, both 15 Holly and her counsel contacted Hospital to seek remediation but received no 16 response. (Id. ¶¶ 25–32.) 17 On July 9, 2019, Holly filed a Complaint in the Superior Court of the State of 18 California for the County of Los Angeles, designated as Case Number 19STCV24211. 19 (Notice of Removal (“Removal”) 2, Ex. A (“Compl.”), ECF No. 1.) Hospital 20 removed the action on August 29, 2019. (Id. at 1.) On October 18, 2019, Holly filed 21 her First Amended Complaint (“FAC”). (FAC, ECF No. 12.) On November 1, 2019, 22 Hospital moved to dismiss Holly’s claims of negligent disclosure, negligent training, 23 breach of fiduciary obligation, and breach of contract, and also moved to strike 24 Holly’s class allegations against Hospital. (Defs.’ First Mot. to Dismiss & Mot. to 25 Strike, (“First Mot.”), ECF No. 13.) On April 10, 2020, the Court granted in part and 26 denied in part the first motion and granted leave to amend. (Order Granting in Part & 27 Den. in Part First Mot. (“Order First Mot.”), ECF No. 19.) On May 4, 2020, Holly 28 filed her SAC. Holly’s allegations in the SAC are essentially the same as the FAC, as 1 she copy-and-pasted a majority of the FAC. (Compare FAC, with SAC.) In both 2 complaints, Holly’s claims stem from allegations that a Hospital2 employee 3 inadvertently posted photographs of Holly’s personal medical information on the 4 employee’s public Facebook account. (SAC ¶¶ 21–24, 62–115.) 5 Based on these allegations, Holly asserts eight causes of action against 6 Hospital: (1) public disclosure of private facts (invasion of privacy); (2) negligent 7 disclosure; (3) negligent training; (4) breach of contract; (5) breach of fiduciary 8 obligation; (6) violation of California Civil Code section 56.10(a) (disclosure of 9 medical information by providers); (7) violation of 42 U.S.C. § 1320d-2 (wrongful 10 disclosure of individually identifiable health information); and (8) negligent infliction 11 of emotional distress. (Id. ¶¶ 62–115.) Holly brings her claims on behalf of a class of 12 similarly situated persons defined as: 13 All persons who have been patients of Defendants ALTA NEWPORT 14 HOSPITAL, INC., DBA FOOTHILL REGIONAL MEDICAL

CENTER; ALTA NEWPORT HOSPITAL, INC. AND DOES 1

15 THROUGH 50, whose personal data has been published without their 16 permission on the Internet during the Data Breach that occurred from at least March 1, 2017 to September 5, 2017 including all persons who were 17 sent the September 5, 2017 letter informing them of the Data Breach. 18 19 (Id. ¶ 54.) 20 Hospital now moves to dismiss Holly’s negligence-based and contract-based 21 claims (second, third, fourth, and eighth causes of action) for failure to state a claim. 22 Further, Hospital moves to strike the class allegations due to Holly failing to plausibly 23 allege the numerosity requirement under Rule 23(a). 24

25 2 As the Court noted in its previous Order, although Holly names two hospitals in the SAC—Alta Newport Hospital, Inc. dba Foothill Regional Medical Center and Alta Newport Hospital, Inc.— 26 she provides similar descriptions for each. (See SAC ¶¶ 1, 10, 14.) Additionally, Holly’s allegations imply the existence of only one hospital involved in the alleged incident. (See id. 27 ¶¶ 23–24). Further, Hospital’s Motion refers to only one hospital and Holly’s Opposition does not 28 argue that two hospitals are at issue. (See Mot. 9–10; Opp’n to Mot. (“Opp’n”), ECF No. 22.) As a result, the Court presumes the action involves only one hospital defendant. 1 III. LEGAL STANDARD 2 A. Motion to Dismiss 3 Dismissal under Rule 12(b)(6) “can be based on the lack of a cognizable legal 4 theory or the absence of sufficient facts alleged under a cognizable legal theory.” 5 Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990). “To survive a 6 motion to dismiss . . . under Rule 12(b)(6), a complaint generally must satisfy only the 7 minimal notice pleading requirements of Rule 8(a)(2)”—a short and plain statement of 8 the claim. Porter v. Jones, 319 F.3d 483, 494 (9th Cir. 2003); see also Fed. R. Civ. 9 P. 8(a)(2). The “[f]actual allegations must be enough to raise a right to relief above 10 the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). The 11 “complaint must contain sufficient factual matter, accepted as true, to state a claim to 12 relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) 13 (internal quotation marks omitted). “A pleading that offers ‘labels and conclusions’ or 14 ‘a formulaic recitation of the elements of a cause of action will not do.’” Id. (citing 15 Twombly, 550 U.S. at 555). 16 Whether a complaint satisfies the plausibility standard is “a context-specific 17 task that requires the reviewing court to draw on its judicial experience and common 18 sense.” Id. at 679. A court is generally limited to the pleadings and must construe 19 “[a]ll factual allegations set forth in the complaint . . . as true and . . . in the light most 20 favorable to [the plaintiff].” Lee v. City of Los Angeles, 250 F.3d 668, 688 21 (9th Cir. 2001). But a court need not blindly accept conclusory allegations, 22 unwarranted deductions of fact, and unreasonable inferences. Sprewell v. Golden 23 State Warriors, 266 F.3d 979, 988 (9th Cir. 2001). 24 Where a district court grants a motion to dismiss, it should generally provide 25 leave to amend unless “it is clear . . . the complaint could not be saved by any 26 amendment.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1034 (9th 27 Cir. 2008); see Fed. R. Civ. P. 15(a) (“The court should freely give leave when justice 28 so requires”). In determining whether to dismiss claims without leave to amend, the 1 court should also consider the following factors: (1) futility of the amendment; (2) bad 2 faith; (3) undue delay; (4) prejudice to the opposing party; and (5) whether the party 3 has previously amended. Doyel v. ATOS IT Sols. & Servs., Inc., No. SA CV 18-02181 4 DOC KES, 2020 WL2738240, at *2 (C.D. Cal. Mar. 3, 2020) (quoting W. Shoshone 5 Nat’l Council v. Molini, 951 F.2d 200, 204 (9th Cir. 1991). Thus, “[w]here the theory 6 presented in the amendment is lacking in legal foundation, or where previous attempts 7 have failed to cure a deficiency and it is clear that the proposed amendment does not 8 correct the defect, the court has discretion to deny the motion to amend.” Serpa v. 9 SBC Telecomm., Inc., 318 F. Supp. 2d 865, 872 (N.D. Cal. 2004) (citing Shermoen v. 10 United States, 982 F.2d 1312, 1319 (9th Cir. 1992)). 11 B. Motion to Strike 12 Under Rule 12(f), the court may strike “any insufficient defense or any 13 redundant, immaterial, impertinent or scandalous matter.” Fed. R. Civ. Proc. 12(f). 14 “[T]he function of a 12(f) motion to strike is to avoid the expenditure of time and 15 money that must arise from litigating spurious issues by dispensing with those issues 16 prior to trial.” Sidney-Vinstein v. A.H. Robins Co., 697 F.2d 880, 885 (9th Cir. 1983). 17 Rule 12(f) motions are generally disfavored “because of the limited importance of 18 pleading in federal practice, and because they are often used as a delaying tactic.” 19 Neilson v. Union Bank of Cal., N.A., 290 F. Supp. 2d 1101, 1152 (C.D. Cal. 2003); see 20 also Sapiro v. Encompass Ins., 221 F.R.D. 513, 518 (N.D. Cal. 2004) (“Courts have 21 long disfavored Rule 12(f) motions, granting them only when necessary to discourage 22 parties from making completely tendentious or spurious allegations.”). 23 “In ruling on a motion to strike under Rule 12(f), the court must view the 24 pleading in the light most favorable to the nonmoving party.” Cholakyan v. 25 Mercedes-Benz USA, LLC, 796 F. Supp. 2d 1220, 1245 (C.D. Cal. 2011). “[B]efore 26 granting such a motion, the court must be satisfied that there are no questions of fact, 27 that the claim or defense is insufficient as a matter of law, and that under no 28 1 circumstance could it succeed.” Id. (quoting Tristar Pictures, Inc. v. Del Taco, Inc., 2 No. CV 99-07655 DDP (Ex), 1999 WL 33260839, *1 (C.D. Cal. Aug. 31, 1999)). 3 IV. DISCUSSION 4 Hospital argues that Holly’s negligence and contract claims must be dismissed 5 because she has not alleged any non-speculative damages which are necessary to state 6 a claim. (Mot. 15–20.) Moreover, Hospital contends that the class allegations must 7 be struck because Holly has not plausibly alleged numerosity to satisfy Rule 23(a). 8 (Id. at 20–23.) The Court addresses the arguments below. 9 A. Motion to Dismiss 10 In its Motion, Hospital argues that Holly’s negligence and contract claims 11 against Hospital fail because Holly has not alleged any actual, non-speculative 12 damages, despite her two previous opportunities to amend. (Mot. 15–20.) Hospital 13 contends that, in the data breach context at issue here, speculative fear of identity theft 14 is not sufficient to establish an injury in fact and Holly fails to allege any facts to 15 support her assertions of damages. (Id.) 16 As the Court discussed in its previous Order, Holly’s breach of contract and 17 negligence claims must result in actual damages from the complained-of conduct. 18 (See Order 10–12); see also Aguilera v. Pirelli Armstrong Tire Corp., 223 F.3d 1010, 19 1015 (9th Cir. 2000) (“Under California law, a breach of contract claim requires a 20 showing of appreciable and actual damage.”); Ruiz v. Gap, Inc., 380 F. App’x 689, 21 691 (9th Cir. 2010) (“California also holds that ‘[n]ominal damages, to vindicate a 22 technical right, cannot be recovered in a negligence action, where no loss has 23 occurred.’”) (quoting Fields v. Napa Milling Co., 164 Cal. App. 2d 442, 448 (1958)). 24 Holly alleges that she suffered “emotional harm and distress and has been 25 injured in her mind and body.” (SAC ¶ 49.) She also alleges that she “experienced 26 fear of identity theft, embarrassment, generalized anxiety . . . emotional pain and 27 upset” and was “injured in her health, strength and activity, sustaining injury to her 28 nervous system and person, all of which injuries have caused and continue to cause 1 [Holly] great mental, physical, emotional and nervous pain and suffering.” (Id. ¶¶ 50– 2 51.) Additionally, Holly asserts that she and other class members have suffered 3 damages, including increased risk of identity theft and identity fraud, improper 4 disclosure of personal information, value of time and expenses spent mitigating and 5 remediating the increased risk of identity theft and identity fraud, and the decreased 6 value of their personal information. (Id. ¶¶ 52–53, 81–84, 89–91, 97.) However, 7 these are the very same allegations the Court has already rejected as “conclusory and 8 vague” and “not sufficient to establish that Holly suffered actual damages to support 9 her breach of contract and negligence claims.” (Order 11.) Nevertheless, the Court 10 again discusses why each fails. 11 As with her FAC, Holly’s bare allegation of increased risk of identity theft in 12 the SAC is “too speculative to satisfy the pleading requirement” to show actual 13 damages. See Svenson v. Google Inc., 65 F. Supp. 3d 717, 725 (N.D. Cal. 2014); 14 Patton v. Experian Data Corp., No. SACV 15-1871 JVS (PLAx), 2016 WL 2626801, 15 at *4 (C.D. Cal. May 6, 2016) (finding that in a data breach case, “[T]he plaintiff must 16 show that there is a ‘credible,’ ‘real and immediate’ threat of identity theft to establish 17 an injury-in-fact” and actual damages (quoting Krottner v. Starbucks Corp., 628 F.3d 18 1139, 1140 (9th Cir. 2010)). Moreover, Holly provides only legal conclusions 19 concerning the future risk of identity theft, instead of factual support as the Court 20 previously directed. (See Order 11–12.) Thus, she again fails to sufficiently plead 21 damages concerning the future risk of identity theft. See Iqbal, 556 U.S. at 665–66 22 (finding that “[w]hile legal conclusions can provide the complaint’s framework, they 23 must be supported by factual allegations.”). 24 Next, “[a]lthough actual damages can include emotional distress, a plaintiff 25 must support her claim for pain and suffering with something more than [her] own 26 conclusory allegations, such as specific claims of genuine injury.” Sion v. SunRun, 27 Inc., No. 16-CV-05834-JST, 2017 WL 952953, at *2 (N.D. Cal. Mar. 13, 2017) 28 (internal quotation marks omitted). Here, Holly’s identical allegations concerning her 1 physical, mental, and emotional pain are once again “too sparse and conclusory to 2 support” her claims for damages. See id.; see also Burnell v. Marin Humane Soc’y, 3 No. 14-cv-05635-JSC, 2015 WL 6746818, at *19 (N.D. Cal. Nov. 5, 2015) 4 (dismissing intentional infliction of emotional distress claim where complaint lacked 5 “any facts pertaining to the nature and extent of [p]laintiffs’ emotional or mental 6 suffering”). Thus, Holly fails to establish actual damages regarding her negligent 7 infliction of emotional distress claim. 8 Similarly, Holly fails again to provide any supporting factual allegations for 9 how any credit monitoring was reasonable and necessary. See Ruiz, 380 F. App’x 10 at 691 (finding plaintiff’s negligence claim failed because plaintiff offered no 11 evidence on the amount of time and money spent on the credit monitoring despite 12 making a bare assertion to that effect). 13 Finally, as the Court previously explained in the prior Order, Holly’s claim 14 concerning the decreased value of personal data fails because it lacks supporting facts. 15 See Razuki v. Caliber Home Loans, Inc., No. CV 17-1718-LAB (WVGx), 2018 WL 16 6018361, at *1 (S.D. Cal. Nov. 5, 2018) (finding plaintiff’s damages allegations 17 insufficient to support a negligence claim where plaintiff claimed diminished value of 18 his personal data but “fail[ed] to allege enough facts to establish how his personal 19 information is less valuable as a result of the breach”). Therefore, Holly’s conclusory 20 allegations concerning any mitigation or remediation efforts and decreased value of 21 person data fail. 22 Other than the above vague and insufficient allegations, Holly offers only legal 23 conclusions from various data theft cases to support her claims of damages, stating 24 that she has suffered harm similar to the plaintiffs in those cited cases. (See, e.g., SAC 25 ¶ 50 (claiming that Plaintiff experienced “fear of identity theft, embarrassment, 26 generalized anxiety and stress about future identity theft, emotion pain and upset as 27 provided under Krottner v. Starbucks Corp., 628 F.3d 1139 [9th Cir. 2010]”); see also 28 id. ¶ 8 (“Plaintiff HOLLY alleges that similar to the reasoning in Stephen Adkins v. 1 Facebook [Case Number 18-05982-WHA, N.D., Ca.] . . . she has alleged an injury in 2 fact and has standing to sue in this matter, even where there is no evidence that the 3 information has been misused.”)). Holly must allege more than legal conclusions and 4 vague statements to establish actual damages to support her breach of contract and 5 negligence claims. However, Holly fails to sufficiently allege that her own facts 6 pertaining to damages are similar to the cited cases, and therefore, the conclusory 7 allegations of similarity are insufficient. See Burns v. HSBC Bank, 8 No. EDCV 12-1748-JGB (OPx), 2013 WL 12136377 at *5 (C.D. Cal. Aug. 26, 2013) 9 (“[V]ague and conclusory allegations regarding damages are insufficient to survive a 10 motion to dismiss.”). 11 The Court granted Holly leave to amend her FAC to cure its many deficiencies, 12 but Holly has simply realleged verbatim the majority of the FAC. Accordingly, the 13 Court again finds Holly’s conclusory and vague allegations insufficient to establish 14 that she suffered actual damages as a result of the data breach. Further, the SAC is a 15 copy-and-paste of the FAC, demonstrating Holly’s inability or unwillingness to cure 16 the deficient allegations. See Carrico v. City & Cnty. of San Francisco, 656 F.3d 17 1002, 1008 (9th Cir. 2011) (finding plaintiffs’ failure to propose “any specific 18 allegations that might rectify” the deficiencies in the complaint as a demonstration of 19 their “inability” or “unwillingness” to make the necessary amendments); see also 20 Eminence Capital, LLC v. Aspeon, Inc., 316 F.3d 1048, 1051–52 (9th Cir. 2003) 21 (finding that district courts should consider “repeated failure to cure deficiencies by 22 amendments previously allowed” in denying leave to amend). Therefore, Hospital’s 23 Motion to Dismiss Holly’s breach of contract and negligence claims is GRANTED 24 without leave to amend. 25 B. Motion to Strike 26 In its previous Order, the Court granted Hospital’s first Motion to Strike 27 because Holly failed to allege facts sufficient to support numerosity in her class 28 allegations. (See Order 13.) Now, Hospital moves again to strike Holly’s class 1 allegations, arguing that Holly again fails to allege any facts supporting the 2 numerosity requirement for a class action. (Mot. 21–22.) Hospital argues that Holly’s 3 allegations of the “Data Breach” only involving “a single employee who took six 4 photographs with her cellular phone,” cannot support numerosity. (Id. at 21 5 (emphasis omitted) (citing SAC ¶ 24).) Holly contends that she has sufficiently 6 alleged numerosity of the class because it is plausible that the photographs contained 7 “far more than a single person or few persons [sic] records” and Hospital has not put 8 forth any evidence that “only a de minimis number of records were posted.” 9 (Opp’n 15.) 10 A class action may proceed only if “the class is so numerous that joinder of all 11 members is impracticable.” Fed. R. Civ. P. 23(a)(1). “Where the exact size of the 12 class is unknown but general knowledge and common sense indicate that it is large, 13 the numerosity requirement is satisfied.” Orantes-Hernandez v. Smith, 541 F. Supp. 14 351, 370 (C.D. Cal. 1982). Although the numerosity requirement is not tied to any 15 numerical threshold, “[t]he Supreme Court has held fifteen is too small.” Harik v. 16 Cal. Teachers Ass’n, 326 F.3d 1042, 1051 (9th Cir. 2003) (citing Gen. Tel. Co. v. 17 EEOC, 446 U.S. 318, 330 (1980)). “In general, courts find the numerosity 18 requirement satisfied when a class includes at least 40 members.” Rannis v. Recchia, 19 380 F. App’x 646, 650–51 (9th Cir. 2010). As noted in the prior Order, “[c]ourts are 20 hesitant to strike class allegations before the parties have had an opportunity to go 21 through the class certification process.” Portillo v. ICON Health & Fitness, Inc., 22 No. CV 19-01428-ODW (PJWx), 2019 WL 6840759, at *6 (C.D. Cal. Dec. 16, 2019). 23 However, as explained by one court, “class certification discovery is not a 24 substitute to the pleading requirements of Rule 8 and Twombly. Class allegations 25 must [be] supported by sufficient factual allegations demonstrating that the class 26 device is appropriate and discovery on class certification is warranted.” Jue v. Costco 27 Wholesale Corp., No. C-10-00033-WHA, 2010 WL 889284, at *1 (N.D. Cal. Mar. 11, 28 2010). Furthermore, “[a] plaintiff is required to state a viable claim at the outset, not 1 allege deficient claims and then seek discovery to cure the deficiencies.” APL Co. 2 Pte. v. UK Aerosols Ltd., Inc., 452 F. Supp. 2d 939, 945 (N.D. Cal. 2006). 3 Here, Holly fails to allege any facts in the SAC to support numerosity and 4 instead relies on only the possibility of discovery to substantiate her allegations. (See 5 SAC ¶ 56; Opp’n 14–15.) As she did in opposition to Hospital’s previous motion to 6 strike, Holly again implies that the six photographs may have contained the medical 7 records of other individuals. (See Opp’n 15–16.) Yet this implicit suggestion, 8 without more, does not meritoriously establish numerosity on its own, as the Court 9 previously explained. Moreover, Holly only copies her claims of numerosity from the 10 FAC and restates allegations from previous paragraphs in the SAC. (See SAC ¶¶ 34, 11 56.) The arguments in Holly’s Opposition are again absent from the SAC. (See 12 Opp’n 15; SAC ¶ 56.) Holly’s failure to amend and allege facts in support of 13 numerosity shows that the class allegations are unsupportable. The Court is unwilling 14 to put both parties through costly discovery to permit Holly further attempts to 15 establish an implausible fact. Accordingly, Hospital’s Motion to Strike is 16 GRANTED without leave to amend. 17 /// 18 /// 19 /// 20 /// 21 /// 22 /// 23 /// 24 /// 25 /// 26 /// 27 /// 28 /// 1 V. CONCLUSION 2 For the reasons discussed above, Hospital’s Motion to Dismiss Holly’s 3 || negligence-based and contract-based claims (causes of action two, three, four, and 4|| eight) against Hospital is GRANTED without leave to amend and Hospital’s Motion 5 || to Strike Holly’s class allegations is GRANTED without leave to amend. 6 7 IT IS SO ORDERED. 8 9 October 21, 2020 □□ 10 NB. Yi Ki 2 OTIS DY WRIGHT, II 3 UNITED STATES DISTRICT JUDGE

14 15 16 17 18 19 20 21 22 23 24 25 26 27 28