Mar. 4, 2022 – In a 7-page opinion, the Hon. Roger M. Young, South Carolina Circuit Judge, denied, in part, Defendant Roper St. Francis Healthcare’s motion to dismiss the case. The case arises from a cyberattack on Roper that took place between October 14, 2020, and October 29, 2020. Plaintiffs were notified of the breach on or about January 6, 2021. In their complaint, the Plaintiffs seek damages and injunctive relief based on claims sounding in wrongful intrusion/invasion of privacy, breach of express contract, breach of implied contract, breach of S.C. Code 39-1-90, unjust enrichment, negligence per se, breach of fiduciary duty, breach of confidentiality. The Court denied the motion to dismiss as to the negligence claim, the breach of express contract claim, and the breach of fiduciary duty claim.
The Court first denied Defendant’s motion to dismiss the negligence claim, noting that the Supreme Court of Georgia recently held there is a common-law negligence claim when a health care provider who has a duty to safeguard sensitive personal data fails to protect the data against criminal third party’s theft of data and the plaintiff suffers an imminent loss or substantial risk of identity theft which is the proximate result of the data breach.
With respect to the breach of express contract count, the Court held that the facts as alleged in the complaint state a claim for breach of express contract upon which relief may be granted. The Court held that Defendant’s “Notice of Privacy Policies” can be construed as a valid contract between Defendant and Plaintiff patients due to the requirement that patients agree to these terms and policies in order to receive medical care from Defendant. The Court, therefore, denied Roper’s motion to dismiss the breach of contract claims.
With respect to the claim for breach of fiduciary duty, the Court denied the motion to dismiss finding that there is a factual and legal dispute as to whether “confidence” extends to the Plaintiff giving their personal data to the hospital system
In sum, the Court dismissed the Plaintiffs’ causes of action under wrongful intrusion/invasion of privacy, breach of implied contract, breach of S.C. Code 39-1-90, unjust enrichment, and negligence per se, breach of fiduciary duty, breach of confidentiality, and breach of confidence and denied the motion dismiss with respect negligence, breach of contract and breach of fiduciary duty. The case will now proceed to discovery.
The case is Prevost, et al. v. Roper St. Francis Healthcare, No. 2021-CP-10-01754 (S.C. Ct. Comm. Pleas). The plaintiffs are represented by Mason Lietz & Klinger, LLP.
