Christian & Small is pleased to announce that Partners Richard E. Smith, Jonathan W. Macklem, and J. Paul Zimmerman recently received a summary judgment dismissal in a data breach case.
The case involves the firm’s representation of a hospital that was subject to a data breach when a third party broke into a locked office building on the hospital campus. The Plaintiff alleged causes of action including negligence per se under HIPAA, breach of contract, and invasion of privacy claims. In November 2018, the Circuit Court of Jefferson County granted summary judgment dismissing all claims against the hospital client.
There were two significant findings by the trial judge that are applicable to data breach cases in Alabama. First: the judge determined that there is no special relationship between a hospital and its patients in terms of protecting a patient’s personal identification information. The Court determined that while a special relationship exists between a hospital and its patients in the provision of medical care, that special relationship did not extend to protecting someone’s identification information. In the absence of a special relationship, the Court dismissed the claims based on Alabama’s general rule that companies are not liable for the criminal conduct of third parties.
Secondly, the Court’s decision was significant because it dismissed the claims based on the plaintiff’s failure to have expert testimony as to the Standard of Care under HIPAA for a health care provider to protect a patient’s information. The only evidence regarding the Standard of Care as provided under HIPAA was provided through the defendant’s expert, who testified that the hospital complied with applicable federal regulations. The Court held that the plaintiff was required to present expert testimony about what the HIPAA regulations required, as well as expert testimony as to how the defendant violated or breached those applicable federal standards.