In re Horizon Healthcare Services, Inc. Data Breach Litigation

Courtney Diana, Mark Meisel, Karen Pekelney, and Mitchell Rindner (collectively, the members) (plaintiffs) were customers of Horizon Healthcare Services, Inc. (Horizon) (defendant). Horizon provided health-insurance products and services and collected potential customers’ and members’ personally identifiable information and protected health information. Horizon had a privacy policy and qualified as a consumer reporting agency within the meaning of the Fair Credit Reporting Act (FCRA). FCRA limited and regulated the dissemination of consumers’ covered information. In November 2018, two laptop computers containing unencrypted personal information about the members and over 800,000 other people were stolen from Horizon’s office. This data breach, allegedly caused by Horizon’s negligent conduct, resulted in the release of differing levels of information, ranging from a person’s name and address to another person’s social-security number and certain health information. The members sued Horizon, claiming violations of FCRA and other state law. Rindner alleged that the data breach resulted in a thief’s submission of a fraudulent tax return in Rindner’s name. Rindner was eventually able to resolve the situation by working with authorities but incurred out-of-pocket expenses. In federal court, Horizon moved to dismiss the complaint on the basis that the members had not sufficiently alleged an injury in fact for purposes of Article III standing. The court agreed and dismissed the complaint for lack of subject-matter jurisdiction. The members appealed.