.  COUNT IV - NEGLIGENCE…………………………….……………………………………21  COUNT IV - CONSPIRACY……………..…………..………...………….…………….….…22  27.  Mrs. Polanco first moved to the Vineland area in November 2011 so that  she and her husband could provide a better life for themselves and minor their daughter,  who is now six (6) years old.    28.  Since moving to the Vineland area, the Polancos’ daughter  has suffered  from a series of medical events, including upper respiratory infections, bronchitis, fevers  and episodes where her throat swells making it difficult for her to breath.   29.  Mrs. Polanco has taken her daughter to both the SJH Regional Medical  Center and the Elmer Hospital owned by SJH at least five (5) times since 2011.     30.  During each of her visits to SJH hospitals, the Polancos’ daughter has  been treated in the emergency room given the sudden on-set of her symptoms.     31.  Given the suddenness of her illnesses and her readily apparent distress in  breathing, it has been Mrs. Polanco’s goal to get her daughter to the closest hospital to  seek treatment for her daughter as quickly as possible.   32.   During those visits to the SJH hospitals, the Polancos’ daughters’  treatment has included antibiotics administered intravenously.       34.  During her visits to SJH, Mrs. Polanco was also provided with a copy of  SJH’s privacy policy indicating that SJH would take appropriate measures to safe-guard  her and her daughter’s PCI.  The representation of SJH that it would safeguard the  privacy of her PCI was one of the reasons why she opted to visit the SJH hospitals.   35.  As stated in a December 31, 2012 letter from Omnicell, on the night of  November 14, 2012, “an Omnicell electronic device issued to an Omnicell employee was  stolen from his locked car.”  See Exhibit “A”.     36.  Based upon media reports, the electronic device stolen from the Omnicell  employee’s car was a laptop computer and the PCI data on the laptop was not encrypted.     37.  The failure to encrypt the PCI constitutes as violation of the Health  Insurance Portability and Accountability Act of 1996, as discussed below.   39.  Although the December 31, 2012 Notice Letter provided certain  information about the theft of the PCI of Plaintiff and the Class, it failed to advise  Plaintiff and the Class about the material information concerning the loss of their PCI,  such as how and why an Omnicell employee came to have in his possession, outside a  medical facility, an Omnicell laptop computer containing PCI of Plaintiff and the Class;  how and why the PCI was unencrypted, in violation of the Health Insurance Portability  and Accountability Act of 1996; and what concrete steps were being taken by all  Defendants to secure existing PCI to ensure that the PCI of Plaintiff and the Class was  not compromised in the future.   40.  The delay between the November 14, 2012 theft and the December 31,  2012 Letter by Omnicell was unreasonable and was not mandated by law enforcement.   41.  According to media reports, tens of thousands of patients were affected by  the Omnicell data breach including 8,500 patients from SJH; 4,000 from UMHS; and  56,000 from Sentara.   43.  The reasonable actions of Mrs. Polanco to seek treatment for her daughter  at the Memorial Hospital of Salem County has resulted in increased costs for Mrs.  Polanco to seek treatment for her daughter.  It is believed and therefore averred that  additional Class members have incurred, and continue to incur, additional expenses by  seeking care at alternative hospitals following the data breach described in the December  31, 2012 Notice Letter.   44.  Pursuant to the Health Insurance Portability and Accountability Act of  1996 (“HIPAA”), the U.S. Department of Health and Human Services (“HHS”) issued  the Standards for Privacy of Individually Identifiable Health Information (“the Privacy  Rule”).  The Privacy Rule was effective December 28, 2000.   45.  The Privacy Rule was implemented to protect all individually identifiable  health information which is defined by the Privacy Rule as Protected Health Information  59.  Plaintiff brings this action pursuant to Rule 23 of the Federal Rules of  Civil Procedure, on behalf of herself, and on behalf of all individuals who had their PCI  stolen from the electronic device issued to the Omnicell employee on the evening of  November 14, 2012.    60.  Plaintiff also seeks certification of a Class pursuant to Fed. R. Civ. P.  23(b)(2) as Plaintiff seeks declaratory and injunctive relief.    61.  The Class consists of numerous individuals and entities throughout the  United States, making individual joinder impractical, in satisfaction of Rule 23(a)(1).   62.  The disposition of the claims of the Class members in a single class action  will provide substantial benefits to all parties and to the Court.   63.  The claims of the representative Plaintiff are typical of the claims of the  Class, as required by Rule 23(a)(3), in that the representative Plaintiff had her PCI stolen  on the evening of November 14, 2012 and has thereafter suffered damage as a proximate  result.     64.  The factual and legal bases of each of the Defendants’ misconduct are  common to the Class Members and represent a common thread of fraud and other  misconduct resulting in injury to Plaintiff and the members of the Class.    66.  Plaintiff will fairly and adequately represent and protect the interests of  the Class, as required by Rule 23(a)(4).  Plaintiff has retained counsel with substantial  experience in prosecuting nationwide consumer class actions.  Plaintiff and their counsel  are committed to vigorously prosecuting this action on behalf of the Class, and have the  financial resources to do so.  Neither Plaintiff nor her counsel has any interest adverse to  those of the Class.   67.  Plaintiff and members of the Class have all suffered, and will continue to  suffer, harm and damages as a result of the Defendants’ unlawful and wrongful conduct.   69.  The class treatment of common questions of law and fact is also superior  to multiple individual actions or piecemeal litigation in that it conserves the resources of  the Court and the litigants, and promotes consistency and efficiency of adjudication.   70.    The Defendants have acted and failed to act on grounds generally  applicable to Plaintiff and the Class and require that the Court impose uniform relief to  ensure compatible standards of conduct toward the Class, thereby making appropriate  equitable relief to the Class as a whole within the meaning of Rules 23(b)(1) and (b)(2).    71.  Plaintiff hereby incorporates by reference the preceding paragraphs as if  fully set forth here and further alleges as follows.   72.  Upon information and belief, Defendants first knew, or should have  known, that the PCI of the Plaintiff and the Class had been stolen on the night of  November 14, 2012.     73.  Defendant Omnicell waited a full forty-seven (47) days to issue letter to  Plaintiff (and presumably other members of the Class) about the theft.   74.  Defendant SJH has never notified Plaintiff or members of the Class of the  theft.   76.  By the acts and omissions set forth herein, Defendants have violated  security breach notification laws of New Jersey, Virginia, Michigan and the other states  where members of the Class reside.    77.  The New Jersey law, N.J. Stat. 56:8-163, specifically provides that:   Any business that conducts business in New Jersey … shall  disclose any breach of security of those computerized records  following discovery or notification of the breach to any customer  who is a resident of New Jersey whose personal information was,  or is reasonably believed to have been, accessed by an  unauthorized person.  The disclosure to a customer shall be made  in the most expedient time possible and without unreasonable  delay, consistent with the legitimate needs of law enforcement, as  provided in subsection c. of this section, or any measures necessary  to determine the scope of the breach and restore the reasonable  integrity of the data system. …  *  *  *  Any business … required under this section to disclose a breach of  security of a customer’s personal information shall, in advance of  the disclosure to the customer, report the breach of security and  any information pertaining to the breach to the Division of State  Police in the Department of Law and Public Safety for  investigation or handling, which may include dissemination or  referral to other appropriate law enforcement entities.  The notification required by this section shall be delayed if a law  enforcement agency determines that the notification will impede a  criminal or civil investigation and that agency has made a request  that the notification be delayed. The notification required by this  section shall be made after the law enforcement agency determines  that its disclosure will not compromise the investigation and  notifies that business or public entity.  8.2 miles from Mrs. Polanco’s home and Elmer Hospital is 13.3 miles from her home.     88.  Plaintiff hereby incorporates by reference the preceding paragraphs as if  fully set forth here and further alleges as follows.   90.  New Jersey, Virginia and Michigan have enacted laws to protect  consumers against unfair, deceptive or fraudulent business practices, unfair competition  and false advertising and unconscionable business practices.     91.  New Jersey, Virginia and Michigan allow consumers a private right of  action under such laws.    92.  By the misrepresentations and non-disclosure of material facts alleged  above, the Defendants deceived and continue to deceive consumers, such as Plaintiff and  the Class.  This conduct constitutes unconscionable, unlawful, unfair, deceptive and/or  fraudulent business practices within the meaning of the New Jersey Consumer Fraud Act,  56:8-1, et seq ., The Virginia Consumer Protection Act, VA Code Ann. § 59.1-196 et  seq., and the Michigan Consumer Protection Act, M.C.L.A. 445.901 et seq.   93.  As a direct and proximate result of the Defendants= unfair and deceptive  trade practices, Plaintiff and the Class have and will continue to suffer damages in an  amount to be determined at trial.   WHEREFORE, Plaintiff respectfully seeks the relief set forth below.  94.  Plaintiff hereby incorporates by reference the preceding paragraphs as if  fully set forth here and further alleges as follows.   96.  Defendants have made false and fraudulent statements and material  misrepresentations and omissions to Plaintiff and the Class relating to the receipt, storage,  maintenance and privacy of their PCI, as well as the time, place and manner of the  unauthorized access to their PCI.  Defendants’ statements were misleading, at best, and  materially false and fraudulent, at worst.     97.  Defendants intended that Plaintiff and the Class would rely on their  statements, representations and omissions to their detriment.  In particular, the  Defendants made misrepresentations about the security of the PCI they sought and  received from Plaintiff and the Class.  Then, after the breach, they failed to timely notify  Plaintiff and the Class of the breach, as required by law.  Plaintiff and the Class have  relied on Defendant’s misrepresentations to their detriment.       98.  In addition, the Defendants concealed and suppressed and/or omitted  material facts as to their knowledge of the unauthorized access PCI.     BREACH OF STATE SECURITY NOTIFICATION LAWS   CLASS ACTION ALLEGATIONS………………………………………………….………..12  COUNT I - BREACH OF STATE SECURITY NOTIFICATION LAWS……..…....…..…15  COUNT II - VIOLATIONS OF THE NEW JERSEY, VIRGINIA AND MICHIGAN   FRAUD   VIOLATIONS OF THE NEW JERSEY,   VIRGINIA AND MICHIGAN CONSUMER FRAUD LAWS  