Searching over 5,500,000 cases.

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.

Khan v. Children's National Health System

United States District Court, D. Maryland

May 18, 2016

FARDOES KHAN, Plaintiff,


          THEODORE P. CHUANG United States District Judge

         Plaintiff Fardoes Kahn has filed a putative class action against Children's National Health System ("CNHS"), asserting various statutory and common law causes of action related to a data breach at a CNHS hospital. Pending is the Motion to Dismiss filed by CNHS. The Motion is fully briefed and ripe for disposition. No hearing is necessary to resolve the issues. See D. Md. Local R. 105.6. For the reasons set forth below, the Motion is GRANTED IN PART and DENIED IN PART.


         I. Data Breach

         Khan receives treatment at Children's Hospital in Washington, D.C., a hospital operated by CNHS. Khan provided CNHS with personally identifiable information such as her date of birth, Social Security number, address, and telephone number. CNHS also maintains records containing Khan's private health care information such as diagnoses, treatment records, and health insurance information.

         On or about July 26, 2014, hackers gained access to the email accounts of certain CNHS employees when those employees responded to "phishing" emails. The hackers' infiltration was not detected until December 26, 2014. During the five intervening months, the "email accounts had been potentially exposed in a way that may have allowed hackers to access information contained in those email accounts." Compl. ¶ 13. The email accounts contained certain patient information, such as names, addresses, dates of birth, Social Security numbers, and telephone numbers, as well as private health care information. On February 26, 2015, CNHS sent a letter to approximately 18, 000 patients, including Khan, notifying them that their personal data may have been contained in these email accounts.[1] CNHS stated that the data breach did not extend to its electronic medical records system or patient charts and professed to have "no evidence that the information in the emails has been misused or even accessed." Def.'s Mot. Dismiss Ex. A, Data Breach Letter.

         Khan alleges that her sensitive personal information was "compromised, viewed, and/or stolen" because CNHS did not take sufficient steps to protect it through encryption, passwords, or other measures. Compl. ¶¶ 20-21; 109. Upon learning of the breach, she placed passwords on her bank and credit card accounts. She remains concerned that her personal information will be misused, but she does not claim that she or anyone else affected by the data breach has learned of any misuse to date.

         II. Procedural History

         Khan filed suit in the Circuit Court for Montgomery County, Maryland on June 1, 2015, alleging violations of the Maryland Consumer Protection Act, Md. Code Ann., Com. Law §§13- 301 to 13-501 (2013), and the District of Columbia Consumer Protection Procedures Act, D.C. Code Ann., §§ 28-3901 to 28-3913 (2013), as well as negligence, breach of implied contract, and unjust enrichment. On July 21, 2015, CNHS removed the case to this Court under the Class Action Fairness Act, 28 U.S.C. § 1332(d) (2012). On September 8, 2015, CNHS filed a Motion to Dismiss. On October 16, 2015, Khan submitted an Opposition to the Motion. On November 16, 2015, CNHS filed a Reply. On December 29, 2015, Khan submitted a Motion for Leave to File a Surreply. Because the proposed surreply brief does not address "matters presented to the court for the first time in the opposing party's reply, " Khoury v. Meserve, 268 F.Supp.2d 600, 605 (D. Md. 2003), and because the issue discussed in the proposed surreply brief need not be addressed to resolve the Motion to Dismiss, the Motion for Leave to File a Surreply is denied. Khan and CNHS both submitted Notices of Supplemental Authority alerting the Court to recent decisions involving standing to sue for data breaches. The Court has reviewed and considered those cases.


         CNHS argues that the Complaint should be dismissed for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) because Khan lacks standing, or, in the alternative, for failure to state a claim under Rule 12(b)(6). Because the Court finds, for the reasons stated below, that Khan lacks standing and that the Court thus lacks subject matter jurisdiction, it does not address the merits of Khan's claims. See Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 94-95 (1998).

         I. Legal Standards

         A. Rule 12(b)(1)

         It is the plaintiffs burden to show that subject matter jurisdiction exists. Evans v.B.F. Perkins Co., Div. of Standex Int'l Corp., 166 F.3d 642, 647 (4th Cir. 1999). Federal Rule of Civil Procedure 12(b)(1) allows a defendant to move for dismissal based upon the belief that the plaintiff has failed to make that showing. When, as in this case, a defendant asserts that the plaintiff has failed to allege facts sufficient to establish subject matter jurisdiction, the allegations in the complaint are assumed to be true under the same standard as in a Rule 12(b)(6) motion, and "the motion must be ...

Buy This Entire Record For $7.95

Download the entire decision to receive the complete text, official citation,
docket number, dissents and concurrences, and footnotes for this case.

Learn more about what you receive with purchase of this case.