13.  The United States Government Accountability Office noted in a June 2007 report  on Data Breaches (“GAO Report”) that identity thieves use identifying data such as SSNs to  open financial accounts, receive government benefits and incur charges and credit in a person’s  name.1 As the GAO Report states, this type of identity theft is the most harmful because it may  take some time for the victim to become aware of the theft and can adversely impact the victim’s  credit rating.    14.  In addition, the GAO Report states that victims of identity theft will face  “substantial costs and inconveniences repairing damage to their credit records” and their “good  name.”2   16.  With access to an individual’s Sensitive Information, criminals can do more than  just empty a victim’s bank account—they can also commit various types of fraud, including:  obtaining a driver’s license or official identification card in the victim’s name but with the thief’s  picture; using the victim’s name and SSN to obtain government benefits; or, filing a fraudulent  tax return using the victim’s information (like Plaintiff Weinberg experienced in this case). In  addition, identity thieves may obtain a job using the victim’s SSN, rent a house or receive  medical services in the victim’s name, and may even give the victim’s personal information to  police during an arrest resulting in an arrest warrant being issued in the victim’s name.5 Further,  loss of private and personal health information can expose the victim to loss of reputation, loss of  job employment, blackmail and other negative effects.   18.  A study by Experian found that the “average total cost” of medical identity theft is  “about $20,000” per incident, and that a majority of victims of medical identity theft were forced  to pay out-of-pocket costs for healthcare they did not receive in order to restore coverage.7  Almost half of medical identity theft victims lose their healthcare coverage as a result of the  incident, while nearly one-third saw their insurance premiums rise, and forty percent were never  able to resolve their identity theft at all.8 Indeed, data breaches and identity theft have a crippling  effect on individuals and detrimentally impact the entire economy as a whole.   19.  Further, medical databases are particularly high value targets for identity thieves.   According to a 2012 National Insurance report, “[a] stolen medical identity has a $50 street value  – whereas a stolen social security number, on the other hand, only sells for $1.”9 In fact, the  medical industry has experienced disproportionally higher instances of computer theft than any  other industry.     20.  Indeed, Intermedix’s Notice of Data Breach letter even recognizes the long- lasting harmful effects of its misconduct and recommends that Plaintiff and the Class remain  vigilant and continue to monitor their credit indefinitely.  The Data Breach.    22.  The employee sought out these patients’ Sensitive Information so that he or she  could disclose or sell that information to third parties who, in turn, used the information to file  fraudulent tax returns with the Internal Revenue Service (so that they could recover those  individuals’ tax refunds).   23.  Intermedix designed and implemented its policies and procedures regarding the  security of protected health information and Sensitive Information. These policies and  procedures failed to adhere to reasonable and best industry practices in safeguarding protected  health information and other Sensitive Information. For instance, Intermedix failed to supervise  employees with access to patients’ Sensitive Information, provide adequate protections and  safeguards limiting access to this information, or otherwise safeguard Plaintiff’s and the Class  members’ Sensitive Information.   24.  Further, Intermedix did not timely investigate or notify Plaintiff or the Class  members by written, telephone, electronic or authorized substitute notice until Intermedix posted  a Notice of Data Breach on its website in late 2014. The “notice” itself was problematic  inasmuch as Plaintiff and the Class did not have a direct relationship (business or otherwise) with  Intermedix and had no reason to visit Intermedix’s website (where they would still have to  search for the Notice of Data Breach). That’s because Intermedix was merely the payment and  billing processor used by Plaintiff’s and the Class’s medical service providers and thus, were  “behind the scenes.”   26.  Incredibly, and thanks to Intermedix’s wholly inadequate policies concerning the  handling and security of Plaintiff’s and the Class’s Sensitive Information (including the oversight  of those employees with access to such information), an employee—without authorization—was  able to systematically access potentially millions of patient records and put that data directly into  the hands of thieves.   27.  The risk and other consequences associated with this outcome are clear. Even  Defendants—through their Notice of Data Breach regarding the data breach—advised those  affected to “remain vigilant and monitor your credit reports periodically,” and further advised  that those affected consider “enroll[ing] in a free credit monitoring service” or “placing a fraud  alert or security freeze on your credit report.”  Intermedix Violated HIPAA and Industry Standard Data Protection Protocols.   28.  HIPAA was enacted and became effective in 1996.   29.  Title II of HIPAA contains what are known as the Administrative Simplification  provisions. 42 U.S.C. §§ 1301, et seq. These provisions require, among other things, that the  Department of Health and Human Services (“HHS”) create rules to streamline the standards for  handling Sensitive Information, like the data unsecured by Intermedix. The HHS has  subsequently promulgated five rules under authority of the Administrative Simplification  provisions of HIPAA.   33.  In another example, NIST also discussed means for establishing “Workstation  Security” which included documenting “the different ways workstations are accessed by  employees and nonemployees,” as well as how to maintain proper “Access Control” by  determining, among other things, how users access and use information and how much  information they should be permitted to access at any given time.11   34.  These examples illustrate Intermedix’s failure to comply with even basic industry  standards. Even more striking is that one of the exact examples recommended by NIST (i.e.,  monitoring and limiting access to Sensitive Information, a free and commonly used technique),  would have prevented the unauthorized access of Sensitive Information at issue here.   35.  Unfortunately, the above-described security measures were not implemented,  which resulted in the unauthorized access to and use of Plaintiff’s and the Class’s Sensitive  Information.  Plaintiff Yehonatan Weinberg’s Experience.   36.  In 2012, Plaintiff Weinberg sought emergency medical treatment and was taken to  a hospital in an ambulance.   37.  In order to use the ambulance, Plaintiff Weinberg was required to provide the  ambulance service with his Sensitive Information.    39.  The records accessed and viewed by the Intermedix employee discussed above  included Plaintiff’s Sensitive Information.   40.  Plaintiff Weinberg’s Sensitive Information was thereafter disclosed to or sold to a  group of individuals who subsequently used that information to steal his identity and file a  fraudulent tax return using his name and Social Security number.    41.  After learning that his identity was stolen, Plaintiff Weinberg spent (and continues  to spend) a substantial amount of time and resources fixing the identity theft that he experienced.    42.  Prior to the Intermedix data breach, Plaintiff Weinberg’s identity had never been  stolen.   43.  Indeed, prior to learning about the Intermedix data breach, Plaintiff Weinberg  took (and continues to take) considerable precautions to protect his Sensitive Information.  Weinberg avoids transmitting his Sensitive Information over insecure sources. He stores  documents containing Sensitive Information in a safe and secure location and destroys any  documents that he receives in the mail that contain any of his Sensitive Information, or that  contain any information that could otherwise be used to steal his identity, such as credit card  offers.   45.  Thus, given that before the data breach Plaintiff Weinberg had never previously  suffered from identity theft and undertook considerable efforts to protect his Sensitive  Information, Weinberg has sufficiently shown that the data breach caused identity theft here.     46.  In short, but for Intermedix’s data breach, Weinberg’s identity would not have  been stolen—and, in turn, his Sensitive Information would not have been used to file a  fraudulent tax return purportedly on his behalf.  48.  Numerosity: The exact number of members of the Class is unknown to Plaintiff  at this time, but on information and belief, there are thousands of Class members throughout the  country, making joinder of each individual member impracticable. Ultimately, the members of  the Class will be easily identified through Defendants’ records.   50.  Typicality: Plaintiff’s claims are typical of the claims of the other members of the  Class. Plaintiff and the Class sustained damages as a result of Defendants’ uniform wrongful  conduct with Plaintiff and the Class.    51.  Adequate Representation: Plaintiff will fairly and adequately represent and  protect the interests of the Class, and has retained counsel competent and experienced in  complex litigation and class actions. Plaintiff has no interests antagonistic to those of the Class,  and Defendants have no defenses unique to Plaintiff.   52.  Policies Generally Applicable to the Class: This class action is appropriate for  certification because Defendants have acted or refused to act on grounds generally applicable to  the Class, thereby requiring the Court’s imposition of uniform relief to ensure compatible  standards of conduct toward the members of the Class, and making final injunctive relief  appropriate with respect to the Class as a whole. Defendants’ policies challenged herein apply  and affect members of the Class uniformly and Plaintiff’s challenge of these policies hinges on  Defendants’ conduct with respect to the Class as a whole, not on facts or law applicable only to  Plaintiff or any other Class member.   54.  Plaintiff incorporates the foregoing allegations as if fully set forth herein.   55.  Intermedix requested and came into possession of the Plaintiff’s and the Class’s  Sensitive Information, and had a duty to exercise reasonable care in safeguarding and protecting  such information from being accessed. Intermedix’s duty arose from the legal and industry  standards discussed above.   56.  Intermedix had a duty to employ procedures to detect and prevent the improper  access and misuse of the Plaintiff’s and the Class’s Sensitive Information. The breach of  security, unauthorized access, and resulting injury to Plaintiff and the Class were reasonably  foreseeable, particularly in light of Intermedix’s inadequate data security protocols and the other  major data breaches impacting companies in the United States that fail to implement proper data  security measures.   57.  Intermedix, through its actions and/or omissions, unlawfully breached its duty to  Plaintiff and the Class by failing to implement industry-standard protocols and exercising  reasonable care in protecting and safeguarding Plaintiff’s and the Class members’ Sensitive  Information within Intermedix’s control.   59.  But for Intermedix’s breach of its duties, Plaintiff’s and the Class’s Sensitive  Information would not have been compromised. Plaintiff’s and the Class’s Sensitive Information  was stolen and accessed as the proximate result of Intermedix failing to exercise reasonable care  in safeguarding such information by adopting, implementing, and maintaining appropriate  security measures.   60.  As a result of Intermedix’s conduct, Plaintiff and the Class suffered and will  continue to suffer actual damages including, but not limited to, expenses and/or time spent on  credit monitoring and identity theft insurance; time spent scrutinizing bank statements, credit  card statements, and credit reports; expenses and/or time spent initiating fraud alerts; decreased  credit scores and ratings; and increased risk of future harm (such as fraudulent charges,  fraudulently filed tax returns, and greater susceptibility to identity theft—along with all of the  time and expenses associated with dealing with that). Further, Plaintiff and the Class have  suffered and will continue to suffer other forms of injury and/or harm including, but not limited  to, anxiety, emotional distress, loss of privacy, and other economic and non-economic losses.   61.  Additionally, Plaintiff and the Identity Theft Subclass have suffered actual  damages including suffering from identity theft.   62.  Plaintiff incorporates the foregoing allegations as if fully set forth herein.   66.  Additionally, Plaintiff and the Identity Theft Subclass have suffered actual  damages including suffering from instances of identity theft.  67.  Plaintiff incorporates the foregoing allegations as if fully set forth herein,  excluding paragraphs 54–66.   68.  Plaintiff and members of the Class conferred a monetary benefit on Intermedix.  Intermedix received and retained money belonging to Plaintiff and the Class in the form of  service or processing fees charged to their medical service providers for Intermedix’s billing and  payment processing services.    69.  Intermedix appreciates or has knowledge of such benefit.   70.  The service or processing fees that Plaintiff and the Class (directly or indirectly)  paid to Intermedix are used by Intermedix, in part, to pay for the administrative costs of data  management and security. Intermedix even claims to have invested millions of dollars in its  information security safeguards to protect patient related data.   72.  Accordingly, Intermedix has received money from Plaintiff and the Class through  the unlawful practices alleged herein, which in equity and good conscience should be returned.  Breach of Fiduciary Duty   (On Behalf of Plaintiff and the Class)   It is Well Established That Security Breaches Lead to Instances of Identity Theft, Like Those  Experienced in This Case.   Negligence  (On Behalf of Plaintiff and the Class)   Restitution/Unjust Enrichment   (On Behalf of Plaintiff and the Class)  