Case No. 11 C 8088
Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 1 of 7 PageID #:2498
IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ILLINOIS
MEMORANDUM OPINION AND ORDER
MATTHEW F. KENNELLY, District Judge:
Brandon Worix, on behalf of himself and a putative class of similarly situated
persons, has sued MedAssets, Inc. for its alleged failure to implement adequate
safeguards to protect his personal information and to notify him properly when an
external hard drive containing that information was stolen. Worix asserts a negligence
claim and a claim under the Illinois Consumer Fraud and Deceptive Practices Act, 815
ILCS 505/2 (ICFA). Worix filed the case in state court, and MedAssets removed it to
federal court, citing the Class Action Fairness Act, 28 U.S.C. § 1332(d)(3), as well as
federal question jurisdiction under 28 U.S.C. § 1331 (at the time, Worix had asserted a
claim under a federal statute).
MedAssets has moved for summary judgment on both of Worix’s claims. For the
reasons stated below, the Court grants MedAssets’ motion.
MedAssets, Inc. provides financial services to health care providers. On June
Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 2 of 7 PageID #:2499
24, 2011, an unknown person stole an external hard drive from a MedAssets
employee’s car. At the time, MedAssets was providing financial services to Cook
County Health and Hospital Systems (CCHHS). Worix had been a patient at CCHHS.
MedAssets notified CCHHS of the theft on June 30, 2011. MedAssets conducted
an investigation of the theft and determined that the hard drive contained two reports
prepared for CCHHS: the “Month End Report” and the “Daily Medicaid Approvals
Report.” MedAssets determined that the only information pertaining to CCHHS’ patients
in these reports was the following: first and last name, client ID, account number,
referral date, admit date, not accepted date, patient type, and specific return reason.
MedAssets determined that the external hard drive did not contain patients’ social
security numbers, dates of birth, addresses, financial information, or medical diagnoses.
On August 19, 2011, CCHHS sent a notification letter about the theft to patients
whose information had been on the hard drive. The letter stated that the hard drive
contained “names, encounter numbers and administrative information” but not social
security numbers, addresses, and dates of birth. After receiving the letter, Worix called
the contact number listed in the letter with further inquiries about the theft. The
individual with whom he spoke confirmed that no addresses, birth dates, or social
security numbers were on the hard drive.
Worix contends that after receiving the notification letter, he suffered emotional
distress, which prevented him from meeting performance expectations at work and
ultimately led to his termination. He seeks to recover damages for emotional distress
and lost wages. Worix also contends that he is entitled to damages for time spent
researching MedAssets, credit monitoring, and identity theft protection services due to
Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 3 of 7 PageID #:2500
MedAssets’ data breach.
On a motion for summary judgment, the Court “view[s] the record in the light
most favorable to the non-moving party and draw[s] all reasonable inferences in that
party’s favor.” Trinity Homes LLC v. Ohio Cas. Ins. Co., 629 F.3d 653, 656 (7th Cir.
2010). Summary judgment is appropriate “if the movant shows that there is no genuine
issue as to any material fact and [that] the moving party is entitled to a judgment as a
matter of law.” Fed. R. Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 322-23
(1986). Summary judgment must be granted “[i]f no reasonable jury could find for the
party opposing the motion.” Hedberg v. Ind. Bell. Tel. Co., 47 F.3d 928, 931 (7th Cir.
To succeed on a claim under the ICFA, a plaintiff must establish that (1) the
defendant engaged in a deceptive act or practice, (2) the defendant intended for the
plaintiff to rely on the deception, (3) the deception occurred during a course of conduct
involving trade or commerce, (4) and the plaintiff sustained actual damages as a
proximate result of the defendant’s deception. Martis v. Pekin Mem’l Hosp. Inc., 395 Ill.
App. 3d 943, 949, 917 N.E.2d 598, 603 (2009). To be recoverable under the ICFA,
actual damages must arise from “purely economic injuries.” Thrasher-Lyon v. Illinois
Farmers Ins. Co., 861 F. Supp. 2d 898, 912-13 (N.D. Ill. 2012) (internal quotation marks
omitted) (citing Illinois cases); see also, Kim v. Carter’s Inc., 598 F.3d 362, 365 (7th Cir.
2010) (“The actual damage element of a private ICFA action requires that the plaintiff
suffer ‘actual pecuniary loss.’”) (citing Mulligan v. QVC, Inc., 382 Ill. App. 3d 620, 628,
Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 4 of 7 PageID #:2501
888 N.E.2d 1190, 1197 (2008)).
Worix contends that he suffered actual damages in various ways. First, Worix
argues that he suffered actual damages because he spent time investigating the data
breach. Specifically, he claims that he is entitled to recover his “opportunity costs” for
time spent “conducting research on the data breach, MedAssets’ business, and identity
theft protection alternatives” while on his lunch break or at home. Pl.’s Resp. Br. at 10.
The Court finds no support in Illinois law for the proposition that time spent searching for
ways to remedy wrongdoing can constitute actual damages under the ICFA. Indeed,
under the ICFA, “a plaintiff does not suffer actual damage simply because of the
increased risk of future identity theft or because the plaintiff purchased credit monitoring
services.” In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 526 (N.D. Ill. 2011)
(citing Cooney v. Chi. Public Sch., 407 Ill. App. 3d 358, 365-66, 943 N.E.2d 23, 31
(2010)). If out of pocket expenses for credit monitoring services do not amount to actual
damages under the ICFA, an injured party’s personal time spent researching credit
monitoring or identity theft protection services could not possibly constitute actual
damages recoverable under the statute.
Second, Worix contends that he suffered actual damages in the form of lost
wages when he was fired from MedAssets. He argues that after receiving the
notification letter, he was “distracted at work,” “his lack of sleep was affecting his job
performance,” and he “unintentionally failed to follow proper lab procedures,” all of
which resulted in his termination. Pl.’s Resp. Br. at 10. At his deposition, however,
Worix admitted that he was fired because of his poor attendance, which was unrelated
to his receipt of the notification letter. Worix Dep. at 26-27. Worix’s employment
Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 5 of 7 PageID #:2502
records similarly reflect that he was terminated not for performance issues, but because
he had failed to adhere to his employer’s attendance policy. See Def.’s Ex. 16. Under
the circumstances, no reasonable jury could find that Worix’s receipt of the notification
letter proximately caused him to lose wages.
Finally, Worix argues that the emotional injuries he claims to have suffered as a
result of the data breach are sufficient on their own to constitute actual damages. It is
well-settled, however, that emotional damages alone do not constitute actual damages
under the ICFA. See Thrasher-Lyon, 861 F. Supp. 2d at 913 (explaining that Illinois law
requires proof that the plaintiff suffered “specific, actual damages” and that “an
allegation of only emotional damages precludes a claim under the ICFA”); Morris v.
Harvey Cycle & Camper, Inc., 392 Ill. App. 3d 399, 402-03, 911 N.E.2d 1049, 1053-54
(2009) (“The Consumer Fraud Act provides remedies for purely economic injuries.”).
Like the plaintiff in Thrasher-Lyon, Worix relies on a number of dated cases interpreting
the ICFA that are no longer controlling law. Thrasher-Lyon, 861 F. Supp. 2d at 913
(distinguishing cases that allowed ICFA claims to proceed based solely on emotional
distress on the ground that “they were decided prior to, and without the benefit of,
Morris.”). As the Court has discussed, no reasonable jury could find that Worix suffered
any economic damages that were proximately caused by the alleged violation of the
In sum, because no reasonable jury could find that Worix suffered any actual
damages recoverable under the ICFA, MedAssets is entitled to summary judgment on
Worix’s ICFA claim.
Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 6 of 7 PageID #:2503
The plaintiff in a negligence action must establish that the defendant owed him a
duty of care, the defendant breached that duty, and the plaintiff incurred injuries
proximately caused by that breach. Espinoza v. Elgin, Joliet & Eastern Ry. Co., 165 Ill.
2d 107, 114, 649 N.E.2d 1323, 1326 (1995). Proximate cause is composed of two
elements: cause in fact and legal cause. Knauerhaze v. Nelson, 361 Ill. App. 3d 538,
548-49, 836 N.E.2d 640, 651 (2005). Cause in fact concerns whether the defendant’s
conduct was a substantial factor in bringing about the injury, in other words whether the
injury would have occurred absent defendant’s conduct. Id. at 549. Legal cause
involves the foreseeability of the injury, specifically, “whether the injury is ‘of a type
which a reasonable man would see as a likely result of his conduct.’” Id. (citing Lee v.
Chi. Transit Auth., 152 Ill. 2d 432, 456, 605 N.E.2d 493, 503 (1992)). “Legal cause is
not established where the causal connection is contingent, speculative, or merely
possible.” Smith v. Joy Marvin, M.D., 377 Ill. App. 3d 562, 569, 880 N.E.2d 1023, 1031
In this case, no reasonable jury could conclude that MedAssets’ alleged breach
proximately caused Worix’s alleged injuries. During his deposition, Worix testified that
he had trouble sleeping in August 2011 because his ankle hurt, his “bones were sore,”
and he had a stressful job. Worix Dep. at 156-157. He also testified that in November
2011, he and his wife started fighting about money, specifically about a loan he took
out, which also created stress. Notably, Worix explained that his stress diminished and
his sleeping patterns returned to normal one week after he was fired. Given Worix’s
admissions, no reasonable jury could find that MedAssets’ alleged breach was a
Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 7 of 7 PageID #:2504
substantial factor in causing his sleeplessness or stress.
As for his other injuries, Worix has not shown that there is a genuine issue of fact
regarding their foreseeability. Worix testified that the depression he experienced
surrounding the notification letter led him to develop a fear of canoeing, entering tall
buildings, and driving on expressways. No reasonable jury could find it reasonably
foreseeable that the theft of a hard drive containing a person’s information of the type
at issue here would cause that person to experience these types of injuries.
For these reasons, MedAssets is therefore entitled to summary judgment on
Worix’s negligence claim.
For the reasons stated above, the Court grants defendant’s motion for summary
judgment [docket no. 124] and directs the Clerk to enter judgment in favor of defendant.
MATTHEW F. KENNELLY
United States District Judge
Date: July 15, 2013