In Dinerstein v. Google, LLC, No. 20-3134 (7th Cir. July 11, 2023), the Seventh Circuit is invited to decide whether a university hospital’s alleged disclosure of patient data to an on-line giant constituted a violation of state tort, contract or statutory law. But the panel bypasses this dispute and holds instead that the lead plaintiff in the class action failed to plausibly allege a tangible harm from the sale, thus there is no Article III standing and the case must be dismissed.
“Google and the University of Chicago together with its affiliated Medical Center . . . . aspired to develop [artificial intelligence] software capable of anticipating patients’ future healthcare needs. If successful, the software promised to reduce medical complications, eliminate unnecessary hospital stays, and, ultimately, improve patients’ healthcare outcomes . . . . As an initial step in the research effort, the University delivered several years of anonymized patient medical records to Google, thus supplying it with the information needed to ‘train’ the software’s algorithms.”
Plaintiff, twice a patient at the hospital, “sued Google and the University on behalf of himself and a class of other patients whose anonymized records were disclosed.” The claims included (in relevant part) a privacy tort and breach of contract based on a privacy notice he received from the hospital at the time of his treatment.
The district court, for the most part, ruled on the merits rather than standing and dismissed the complaint for failure to state a claim. “On the standing issue, the judge construed Dinerstein’s allegations about a lost benefit of the bargain as sufficient to support standing to sue on the contract (and contract-alternative) theories against both the University and Google . . . . She also reasoned that the allegations about an invasion of privacy—in the form of a wrongful disclosure of his private medical information—supported Dinerstein’s standing to sue for intrusion upon seclusion.”
On appeal, the Seventh Circuit affirms, but on standing rather than merits grounds, holding that plaintiff alleged no cognizable injury under any of his legal theories.
On the privacy claim, according to the Seventh Circuit, plaintiff framed the tort as “a breach of medical confidentiality, a novel cause of action that posits a common-law duty of medical providers to maintain patient confidentiality.” The panel holds that there is no common-law analogue to this claim, under the Article III standing principles announced in Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) and TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021). “Dinerstein has identified no case in which a court has permitted a plaintiff to bring a public-disclosure tort premised on the dissemination of anonymized information.”
The plaintiff also alleged the risk that Google could track back the medical data (using geolocation data from his cell phone) to discovery his identity. But “[b]ecause Dinerstein alleges no material harm arising from the alleged risk of future reidentification, that future risk cannot support standing to sue for damages.” Indeed, “the risk Dinerstein alleges is not sufficiently imminent” because Google was bound by a Data Use Agreement that explicitly barred use of the medical records for identifying the patients. “Absent from this case is a comparable indication—rooted in common sense or otherwise—that Google’s primary purpose in obtaining the medical records was to reidentify the University’s patients.”
Regarding the contract claim, the panel rejects an argument that plaintiff suffered a pecuniary harm because he supposedly paid the hospital fees predicated on the confidentiality of his medical data. “It is wholly implausible—and Dinerstein alleges nothing to the contrary—that the University charged a discrete ‘patient-confidentiality fee.’ Indeed, the fact that it reserved the right to share patient medical information for approved research purposes suggests exactly the opposite.” Furthermore, “Illinois law does not grant a patient a property interest in his medical records; they instead belong to the medical provider.”
Plaintiff also argued that the breach of contract alone was an injury that would at least entitle him to nominal damages. “He contends that common-law courts traditionally entertained claims for breach of contract regardless of whether the plaintiff alleged any harm beyond the breach itself. From this he infers that an allegation of a breach of contract is enough, without more, to support Article III standing.”
But the panel holds that “Dinerstein cannot rest on the University’s alleged breach of contract as a discrete de facto injury supporting his standing to sue in federal court. It is at most an injury in law, which we know from TransUnion -is not an injury in fact.’” It observes that “Spokeo and TransUnion put an end to federal courts hearing claims premised on nonexistent injuries—regardless of historical pedigree.”
The panel allows that there is “some tension also exists between our analysis here and that of a few of our sister circuits,” specifically noting that the Fifth Circuit explicitly approved the theory that breach of contract alone was a sufficient injury to support standing. “But the Fifth Circuit’s opinion . . .did not engage with the logic of Spokeo and TransUnion and rested in part on its own precedent. We therefore do not understand the Fifth Circuit’s decision to conflict with our own, nor are we inclined to adopt its approach.”
Paul Mollica's Federal Courts Blog 