You're viewing Docket Item 155 from the case Worix v. MedAssets, Inc.. View the full docket and case details.

Download this document:







Case No. 11 C 8088

Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 1 of 7 PageID #:2498




MATTHEW F. KENNELLY, District Judge:

Brandon Worix, on behalf of himself and a putative class of similarly situated

persons, has sued MedAssets, Inc. for its alleged failure to implement adequate

safeguards to protect his personal information and to notify him properly when an

external hard drive containing that information was stolen. Worix asserts a negligence

claim and a claim under the Illinois Consumer Fraud and Deceptive Practices Act, 815

ILCS 505/2 (ICFA). Worix filed the case in state court, and MedAssets removed it to

federal court, citing the Class Action Fairness Act, 28 U.S.C. § 1332(d)(3), as well as

federal question jurisdiction under 28 U.S.C. § 1331 (at the time, Worix had asserted a

claim under a federal statute).

MedAssets has moved for summary judgment on both of Worix’s claims. For the

reasons stated below, the Court grants MedAssets’ motion.

MedAssets, Inc. provides financial services to health care providers. On June


Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 2 of 7 PageID #:2499

24, 2011, an unknown person stole an external hard drive from a MedAssets

employee’s car. At the time, MedAssets was providing financial services to Cook

County Health and Hospital Systems (CCHHS). Worix had been a patient at CCHHS.

MedAssets notified CCHHS of the theft on June 30, 2011. MedAssets conducted

an investigation of the theft and determined that the hard drive contained two reports

prepared for CCHHS: the “Month End Report” and the “Daily Medicaid Approvals

Report.” MedAssets determined that the only information pertaining to CCHHS’ patients

in these reports was the following: first and last name, client ID, account number,

referral date, admit date, not accepted date, patient type, and specific return reason.

MedAssets determined that the external hard drive did not contain patients’ social

security numbers, dates of birth, addresses, financial information, or medical diagnoses.

On August 19, 2011, CCHHS sent a notification letter about the theft to patients

whose information had been on the hard drive. The letter stated that the hard drive

contained “names, encounter numbers and administrative information” but not social

security numbers, addresses, and dates of birth. After receiving the letter, Worix called

the contact number listed in the letter with further inquiries about the theft. The

individual with whom he spoke confirmed that no addresses, birth dates, or social

security numbers were on the hard drive.

Worix contends that after receiving the notification letter, he suffered emotional

distress, which prevented him from meeting performance expectations at work and

ultimately led to his termination. He seeks to recover damages for emotional distress

and lost wages. Worix also contends that he is entitled to damages for time spent

researching MedAssets, credit monitoring, and identity theft protection services due to


Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 3 of 7 PageID #:2500

MedAssets’ data breach.


On a motion for summary judgment, the Court “view[s] the record in the light

most favorable to the non-moving party and draw[s] all reasonable inferences in that

party’s favor.” Trinity Homes LLC v. Ohio Cas. Ins. Co., 629 F.3d 653, 656 (7th Cir.

2010). Summary judgment is appropriate “if the movant shows that there is no genuine

issue as to any material fact and [that] the moving party is entitled to a judgment as a

matter of law.” Fed. R. Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 322-23

(1986). Summary judgment must be granted “[i]f no reasonable jury could find for the

party opposing the motion.” Hedberg v. Ind. Bell. Tel. Co., 47 F.3d 928, 931 (7th Cir.



ICFA claim

To succeed on a claim under the ICFA, a plaintiff must establish that (1) the

defendant engaged in a deceptive act or practice, (2) the defendant intended for the

plaintiff to rely on the deception, (3) the deception occurred during a course of conduct

involving trade or commerce, (4) and the plaintiff sustained actual damages as a

proximate result of the defendant’s deception. Martis v. Pekin Mem’l Hosp. Inc., 395 Ill.

App. 3d 943, 949, 917 N.E.2d 598, 603 (2009). To be recoverable under the ICFA,

actual damages must arise from “purely economic injuries.” Thrasher-Lyon v. Illinois

Farmers Ins. Co., 861 F. Supp. 2d 898, 912-13 (N.D. Ill. 2012) (internal quotation marks

omitted) (citing Illinois cases); see also, Kim v. Carter’s Inc., 598 F.3d 362, 365 (7th Cir.

2010) (“The actual damage element of a private ICFA action requires that the plaintiff

suffer ‘actual pecuniary loss.’”) (citing Mulligan v. QVC, Inc., 382 Ill. App. 3d 620, 628,


Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 4 of 7 PageID #:2501

888 N.E.2d 1190, 1197 (2008)).

Worix contends that he suffered actual damages in various ways. First, Worix

argues that he suffered actual damages because he spent time investigating the data

breach. Specifically, he claims that he is entitled to recover his “opportunity costs” for

time spent “conducting research on the data breach, MedAssets’ business, and identity

theft protection alternatives” while on his lunch break or at home. Pl.’s Resp. Br. at 10.

The Court finds no support in Illinois law for the proposition that time spent searching for

ways to remedy wrongdoing can constitute actual damages under the ICFA. Indeed,

under the ICFA, “a plaintiff does not suffer actual damage simply because of the

increased risk of future identity theft or because the plaintiff purchased credit monitoring

services.” In re Michaels Stores Pin Pad Litig., 830 F. Supp. 2d 518, 526 (N.D. Ill. 2011)

(citing Cooney v. Chi. Public Sch., 407 Ill. App. 3d 358, 365-66, 943 N.E.2d 23, 31

(2010)). If out of pocket expenses for credit monitoring services do not amount to actual

damages under the ICFA, an injured party’s personal time spent researching credit

monitoring or identity theft protection services could not possibly constitute actual

damages recoverable under the statute.

Second, Worix contends that he suffered actual damages in the form of lost

wages when he was fired from MedAssets. He argues that after receiving the

notification letter, he was “distracted at work,” “his lack of sleep was affecting his job

performance,” and he “unintentionally failed to follow proper lab procedures,” all of

which resulted in his termination. Pl.’s Resp. Br. at 10. At his deposition, however,

Worix admitted that he was fired because of his poor attendance, which was unrelated

to his receipt of the notification letter. Worix Dep. at 26-27. Worix’s employment


Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 5 of 7 PageID #:2502

records similarly reflect that he was terminated not for performance issues, but because

he had failed to adhere to his employer’s attendance policy. See Def.’s Ex. 16. Under

the circumstances, no reasonable jury could find that Worix’s receipt of the notification

letter proximately caused him to lose wages.

Finally, Worix argues that the emotional injuries he claims to have suffered as a

result of the data breach are sufficient on their own to constitute actual damages. It is

well-settled, however, that emotional damages alone do not constitute actual damages

under the ICFA. See Thrasher-Lyon, 861 F. Supp. 2d at 913 (explaining that Illinois law

requires proof that the plaintiff suffered “specific, actual damages” and that “an

allegation of only emotional damages precludes a claim under the ICFA”); Morris v.

Harvey Cycle & Camper, Inc., 392 Ill. App. 3d 399, 402-03, 911 N.E.2d 1049, 1053-54

(2009) (“The Consumer Fraud Act provides remedies for purely economic injuries.”).

Like the plaintiff in Thrasher-Lyon, Worix relies on a number of dated cases interpreting

the ICFA that are no longer controlling law. Thrasher-Lyon, 861 F. Supp. 2d at 913

(distinguishing cases that allowed ICFA claims to proceed based solely on emotional

distress on the ground that “they were decided prior to, and without the benefit of,

Morris.”). As the Court has discussed, no reasonable jury could find that Worix suffered

any economic damages that were proximately caused by the alleged violation of the


In sum, because no reasonable jury could find that Worix suffered any actual

damages recoverable under the ICFA, MedAssets is entitled to summary judgment on

Worix’s ICFA claim.


Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 6 of 7 PageID #:2503


Negligence claim

The plaintiff in a negligence action must establish that the defendant owed him a

duty of care, the defendant breached that duty, and the plaintiff incurred injuries

proximately caused by that breach. Espinoza v. Elgin, Joliet & Eastern Ry. Co., 165 Ill.

2d 107, 114, 649 N.E.2d 1323, 1326 (1995). Proximate cause is composed of two

elements: cause in fact and legal cause. Knauerhaze v. Nelson, 361 Ill. App. 3d 538,

548-49, 836 N.E.2d 640, 651 (2005). Cause in fact concerns whether the defendant’s

conduct was a substantial factor in bringing about the injury, in other words whether the

injury would have occurred absent defendant’s conduct. Id. at 549. Legal cause

involves the foreseeability of the injury, specifically, “whether the injury is ‘of a type

which a reasonable man would see as a likely result of his conduct.’” Id. (citing Lee v.

Chi. Transit Auth., 152 Ill. 2d 432, 456, 605 N.E.2d 493, 503 (1992)). “Legal cause is

not established where the causal connection is contingent, speculative, or merely

possible.” Smith v. Joy Marvin, M.D., 377 Ill. App. 3d 562, 569, 880 N.E.2d 1023, 1031


In this case, no reasonable jury could conclude that MedAssets’ alleged breach

proximately caused Worix’s alleged injuries. During his deposition, Worix testified that

he had trouble sleeping in August 2011 because his ankle hurt, his “bones were sore,”

and he had a stressful job. Worix Dep. at 156-157. He also testified that in November

2011, he and his wife started fighting about money, specifically about a loan he took

out, which also created stress. Notably, Worix explained that his stress diminished and

his sleeping patterns returned to normal one week after he was fired. Given Worix’s

admissions, no reasonable jury could find that MedAssets’ alleged breach was a


Case: 1:11-cv-08088 Document #: 155 Filed: 07/15/13 Page 7 of 7 PageID #:2504

substantial factor in causing his sleeplessness or stress.

As for his other injuries, Worix has not shown that there is a genuine issue of fact

regarding their foreseeability. Worix testified that the depression he experienced

surrounding the notification letter led him to develop a fear of canoeing, entering tall

buildings, and driving on expressways. No reasonable jury could find it reasonably

foreseeable that the theft of a hard drive containing a person’s information of the type

at issue here would cause that person to experience these types of injuries.

For these reasons, MedAssets is therefore entitled to summary judgment on

Worix’s negligence claim.


For the reasons stated above, the Court grants defendant’s motion for summary

judgment [docket no. 124] and directs the Clerk to enter judgment in favor of defendant.

United States District Judge

Date: July 15, 2013