IN THE CIRCUIT COURT OF THE STATE OF OREGON
IN AND FOR THE COUNTY OF MULTNOMAH RUSSELL GIBSON and WILLIAM WEILLER, DDS, individually and on behalf
Case No. 0601-01059 of all other similarly-situated individuals, PLAINTIFFS' THIRD AMENDED Plaintiffs,
COMPLAINT AND DEMAND FOR JURY TRIAL vs. PERSONAL INJURY PROVIDENCE HEALTH SYSTEMS•
CLASS ACTION OREGON, an Oregon non-profit corporation,
(Negligence/negligence per se)
Not subject to mandatory arbitration
This is a claim brought by plaintiffs Russell Gibson and William WeiIIer for themselves and for the class of similarly-situated current and former patients of Providence Health Systems for negligent loss and disclosure of protected health information and for violation of the Unlawful Trade Practices Act ORS 646.605 et seq. Plaintiffs claim that defendant was negligent in failing to safeguard protected health information when it allowed an employee to store in his or her car the patient care records of an estimated 365,000 patients. As defendant has admitted, the patient information was stolen. The information in question included social security numbers, addresses, phone numbers, and patient information. As a result of the theft, the affected patients have been put in jeopardy of identity theft, with potential consequences that include abuse and misuse of confidential patient information, personal data, financial records, and benefit rights. Defendant has informed plaintiffs and the class of the theft but has failed to take any or sufficient actions to protect patients from misuse of this information; rather, defendant has informed plaintiffs and the class that they must take steps to protect themselves. Plaintiffs and the class seek an injunction requiring defendant to set up a system at its expense to request fraud alerts under the Fair Credit Reporting Act, to notify the Social Security Administration, to fund the monitoring of patients' credit reports, and to fund the repairs of credit fraud that may occur in the future. In addition, for themselves and for the class, plaintiffs seek damages for past and future out-of-pocket losses and past and future non-economic losses for impairment of access to credit, inconvenience and emotional distress.PARTIES
Plaintiff Russell Gibson resides in Oregon. He is a former patient of the Providence Health System who received a letter from Providence disclosing that computerized patient records of 365,000 patients were stolen from an employee's car where they had been stored overnight.
Plaintiff, William Weiller, DDS, resides in Oregon. He is a former patient of the Providence Health System who received a letter from Providence disclosing that computerized patient records of 365,000 patients were stolen from an employee's car where they had been stored overnight.
Defendant Providence Health System-Oregon is a domestic non-profit corporation licensed to do business and doing business in Oregon.
All of the claims giving rise to this action accrued in Oregon. Defendant engages in
9 Plaintiffs make no federal claims in this case. Based on information and belief, the primary 10 defendant is an Oregon corporation, and more than two thirds of the class reside in Oregon. 11 Further, no individual plaintiffs or member of the proposed class's claim in this case is worth 12 more than $75,000. 13 ALLEGATION OF FACTS COMMON TO ALL CLAIMS 14 7.
On or about December 31, 2005, computer disks and tapes containing patient information 16 were stolen from a car where the data was stored overnight. The car belonged to defendant or to 17 defendant's agent or employee who was, at all material times, acting within the course and scope 18 of his or her agency or employment.
The theft of data exposed plaintiffs and members of the class to loss of privacy, to past and future out-of-pocket losses associated with monitoring credit reports and placing and maintaining fraud alerts, to credit injuries inherent in credit monitoring and placing and maintaining fraud alerts, and to repair costs of credit damage caused by the theft of data.CLASS ALLEGATIONS
The proposed class consists of current and former patients of Providence Health Systems whose patient information was stored on computer backup disks and tapes that were stolen from an employee or agent ofProvidence Health Systems and/or Providence Home Services. The proposed class excludes all officers and directors of defendant, Judge MarilYnn Litzenberger and her judicial staff, and any partner or employee ofthe law firm of Davis Wright Tremaine.
Based on information and belief, plaintiffs estimate that there are more than 365,000 members of the class. Members of the classes are so numerous that joinder ofall or most of them is impracticable.
There are questions of fact and law common to the class in that each class member has suffered an injury as a result of defendant's conduct. Common questions oflaw and fact predominate over any questions affecting only individual class members.Common questions include:
A. Whether defendant was negligent in handling patient information that was stored on computer backup disks and tapes; B. Whether defendant complied with the requirements of the Health Insurance Portability and Accountability Act and its implementing regulations; C. Whether defendant complied with ORS 192.518, the Protected Health Information Act; D. Whether defendant took appropriate steps to secure the stolen information, including encryption and securing the tapes and disks; E. Whether plaintiffs and members of the class are entitled to equitable relief to require defendant to fund the future costs associated with the monitoring of patient credit information for class members; F. Whether plaintiffs and class members are entitled to equitable relief to require defendant 7 to fund the future costs of credit repair for those class members who suffer financial loss 8 from identity theft; 9 G. Whether plaintiffs and members ofthe class will be entitled to damages for past and future out-of-pocket expenses, impairment of credit, inconvenience and emotional II distress caused by defendant's failure to secure the confidential information; 12 H. Whether defendant's sales of medical devices and medical services are subject to the 13 Unlawful Trade Practices Act, DRS 646.605; I. Whether defendant violated DRS 646.608(l)(e)by representing that it would secure, 15 protect and maintain privileged patient information when it did not; J. Whether the requirements of state and federal law that place conditions on the sales of 17 services create "representations" as defined by DRS 646.608(2) that are inherent in every 18 covered transaction; and 19 K. Whether the trial court's remedial authority set forth in DRS 646.636 includes the power 20 to order equitable relief in order to prevent or mitigate future harm? 21 14. 22 The claims of the named plaintiffs are typical of the claims of the class in that: 23 A. All claims involve identical conduct in that the.loss arose from a single incident that 24
occurred on our about December 31, 2005; 25 B. Defendant sent identical letters to plaintiffs and members of the class advising them of 26
the loss of data and advising them to take the same precautions to protect themselves;
The named plaintiffs seek equitable relief and damages for themselves and the class; 2 D. The injuries suffered by the named plaintiffs and the class members differ only in the 3
The named plaintiffs will fairly and adequately protect and represent the interests ofthe
A. Their claims are typical of the claims of the class members; B. They are represented by attorneys who are qualified and competent and who will 11 vigorously prosecute this litigation; and 12
C. Their interests are not antagonistic to or in conflict with the interests of the class 13 members. 14 16.
A. Prosecution of separate actions against the defendant creates a risk of inconsistent or 18 varying adjudications, with incompatible standards of conduct for defendant; 19 B. Plaintiffs seek equitable relief with respect to the class as a whole; 20 C. Common questions of law and fact predominate over factors affecting only individual 21 members; 22 D. Individual class members have little interest in controlling the litigation due to the high 23
cost of each individual action, the relatively modest amount of damages suffered by any 24
individual plaintiff, and because plaintiffs and their attorneys will vigorously pursue the 25 claims; 26
E. As far as plaintiffs know, no other class action that purports to address this issue has been
F. This forum is desirable as defendant does business here;
G. A class action will be an efficient method of adjudicating the claims of the class members
H. In the aggregate, class members have claims for relief that are significant in scope relative
Count 1: Negligence Per Se
ORS 192.518(1) provides that Oregonians have the right to have their protected health
Defendant was negligent in failing to comply with the standards set forth ORS 192.518 et seq. and 45 CFR Parts 160 and 164.
Defendant's negligence caused or contributed to plaintiffs' and class members' injuries. Plaintiffs and class members suffered financial injury in the form of past and future costs to monitor credit reports, recurring future costs to notify and re-notify credit bureaus of fraud alerts, costs of notification to the Social Security Administration, the Immigration and Naturalization Agency, the Internal Revenue Service, State and Local law enforcement agencies and possible future costs of repair of identity theft.
Plaintiffs and class members lack an adequate remedy at law in that the monitoring needs are on-going to minimize future harm. Further, monetary damages will not fully and adequately compensate plaintiffs and class members for future harm and on-going monitoring costs.
Plaintiffs and the class are entitled to an injunction that requires defendant to pay for on•going monitoring of credit reports, notify Social Security of the data loss, fund recurring credit bureau fraud alerts and pay for the future cost of possible loss and damage due to identity theft.
Plaintiffs and class members have suffered economic damages in the form ofpast out-of•pocket expenses for credit monitoring services, credit injury, postage, long distance and time loss from employment to address these issues. Plaintiffs and class members will continue to suffer these damages in the future, all to their economic damage in an amount to be proved at trial. In addition, plaintiffs and class members have suffered non-economic damages in the past and will' do so in the future in the form of impairment of access to credit inherent in placing and
Plaintiffs are entitled to recover and recoup fees and costs from any recovery under the common fund theory.Count 2: Common Law Negligence
Plaintiffs incorporate ~~1-18; 22-25.
Defendant was negligent in failing to safeguard the data, in failing to encrypt it, in allowing its agent or employee to store such data in his or her car, and in failing to put in place policies that would protect such data from theft and disclosure.
As a result of defendant's negligence, plaintiffs and class members suffered the previously-described injuries.SECOND CLAIM FOR RELIEF-UNLAWFUL TRADE PRACTICES ACT
Plaintiffs incorporate ~~1-17; 22-24.
In pertinent part, the Unlawful Trade Practices Act ("UTPA") prohibits representations that "goods or services have *** characteristics" that they do not have. ORS 646.608(1)(e). The UTPA further prohibits representations that "goods or services are of a particular standard, quality or grade···." ORS 646.608(1)(g).
10 Defendant violated the UTPA in one or more of the following ways that caused injury to 11 plaintiffs and members of the class: 12 A. In representing that all information gathered to sell its services or goods would be 13 safeguarded and kept confidential when it knew that it lacked adequate means to 14 safeguard such information; and
WHEREFORE, plaintiffs and the class seek relief against defendant as follows:
26 a. An order certifying this matter as a class action; T' 'Te 10-PLAINTIFFS' THIRD AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
PAUL & SuGERMAN, PC
520 SW Sixth Avenue, Suite920 -Portland, Oregon 97204
b. The appointment of the undersigned as counsel of record for the class;
DATED this 22nd day of September, 2006
David F. Suge man, SB No. 86298 David Paul, 0 No. 6 PAUL & SUGE N, PC 520 S.W. Sixth Ave., Ste. 920 Portland, Oregon 97204 Phone: (503) 224-6602 Fax: (503) 224-2764 E-Mail: [email protected]
[email protected] Michael L. Williams, OSB No. 78426 Brian S. Campf, OSB No. 92248 Williams Love O'Leary Craine & Powers 9755 SW Barnes Rd., Suite 450 Portland, OR 97225 Phone: (503) 295-2924 Fax: (503) 295-3720 Email: [email protected]
[email protected] r--e 12 _ PLAINTIFFS' THIRD AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL
CERTIFICATE OF SERVICE
I hereby certify that I served the foregoing PLAINTIFFS' THIRD AMENDED COMPLAINT AND DEMAND FOR JURY TRIAL on the following persons on this same day:
~y hand delivering o by facsimile transmission o by electronic mail
o by enclosing a copy in an envelope, properly addressed and with first-class postage, and placing in the mail in Portland, Oregon
Page 1 -CERTIFICATE OF SERVICE
PAUL & SUGERMAN, PC 520 SW Sixth Avenue, Suite 920 -Portland, Oregon 97204