10.  Defendant owns and operates Shorter University in Rome, Georgia.     11.  Plaintiff attended Shorter during the 2008-2009 school year and was a member  of the Shorter cheerleading team during that time.  In order to participate in cheerleading,  Plaintiff had to undergo a physical examination by a doctor associated with Shorter and also had  to provide medical records to Shorter.  In addition, following a tumbling accident, Plaintiff  underwent an examination by a physical therapist associated with Shorter, and also provided  records to Shorter for x-rays taken off campus.    12.  Defendant maintained records of student athletes, including Plaintiff, in hard  copy format stored on its campus.     13.  These records, including medical records and physical exam records, contained  PII and PHI such as names, social security numbers, birthdays, and basic medical information.     15.  On September 23, 2014, Defendant discovered that records of as many as 900  former and current Shorter students had been stolen from the unlocked room by an unauthorized  person.  Defendant apparently notified some people by sending a letter, although Plaintiff did not  receive any notification from Defendant.  She did not discover the breach until she reported her  stolen information to the Rome (Ga.) Police Department.     16.  Defendant knew or had reason to know that the theft included medical records  with PII and PHI but communicated to the public that it was uncertain if any personal  information was actually obtained.     17.  Plaintiff attempted to file her tax returns on January 28, 2015, and was notified  by her tax preparer that someone had already used her social security number and other PII to  file her tax returns and obtain her tax refund.     18.  According to news accounts, more than thirty (30) people whose records were  stolen from Shorter’s unlocked room have had similar fraudulent tax returns filed with their PII.     19.  According to the same news account, Shorter did not return several calls for  comment and has not explained why it communicated to the public and the Class that it was  uncertain PII was stolen when it knew that medical records containing PII and PHI had been  taken.     21.  As a result of the breach, Plaintiff has not been able to receive her tax refund and  has had to spend money on credit monitoring and protection services and will continue to pay a  monthly fee for credit monitoring and protection services.  In addition, Plaintiff’s husband, a  Lance Corporal and Electrical Engineer with the United States Marine Corps, is also not able to  file a tax return or receive a tax refund because Plaintiff and her husband file joint tax returns.   The inability to file a tax return and receive a refund has greatly affected Plaintiff and her  husband, as the money from their tax return was earmarked for assisting with their mortgage,  contributing to their daughter’s college fund, and paying down student loan payments -  loans  which were incurred while Plaintiff was a student at Shorter.    22.  This action may be brought and properly maintained as a class action pursuant to  the provisions of Rule 23 of the Federal Rules of Civil Procedure, et seq.  Plaintiff brings this  action on behalf of herself and a class of all others similarly situated.   23.  Plaintiff brings this class action on behalf of the following class:  All individuals whose PII and/or PHI was stolen from the files of Defendant in  September 2014.     24.  In accordance with Rule 23 of the Federal Rules of Civil Procedure, the Class is  so numerous that joinder of all members is impracticable.  While the exact number is not known  at this time, it is generally ascertainable by appropriate discovery, and it is believed the class  includes up to 900 members.   26.  Plaintiff’s claims are typical of the Class.  As with members of the Class,  Plaintiff’s PII and PHI was stolen because Defendant failed to properly safeguard her data under  lock and/or key.  Plaintiff’s interests coincide with, and are not antagonistic to, those of the other  class members.   27.  In accordance with Rule 23 of the Federal Rules of Civil Procedure, Plaintiff will  fairly and adequately represent and protect the interests of the Class.   28.  Plaintiff has retained counsel experienced in the prosecution of class  action  litigation and counsel will adequately represent  the interests of the Class.   30.  Plaintiff has or can acquire adequate financial resources to assure that the interests  of the Class will not be harmed; and   31.  Plaintiff is knowledgeable concerning the subject matter of this action and will  assist counsel to vigorously prosecute this litigation.   32.  In accordance with Rule 23 of the Federal Rules of Civil Procedure, et seq, the  class litigation is an appropriate method for fair and efficient adjudication of the claims involved.  Class action treatment is superior to all other available methods for the fair and efficient  adjudication of the controversy alleged herein; it will permit a large number of individual  citizens of the State of Georgia to prosecute their common claims in a single forum  simultaneously, efficiently, and without the unnecessary duplication of evidence, effort and  expense that numerous individual actions would require. Class action treatment will also permit  the adjudication of relatively small claims by certain class members, who could not individually  afford to litigate a complex claim against a large corporate defendant. Further, even for those  class members who could afford to litigate such a claim, it would still be economically  impractical, as the cost of litigation is almost certain to exceed any recovery they would obtain.   33.  Plaintiff is unaware of any difficulty likely to be encountered in the management  of this case that would preclude its maintenance as a class action.  35.  Defendant owed Plaintiff and the class a duty of reasonable care to protect their  PII and PHI in its custody and control, and/or assumed a duty to protect that data by collecting  and maintaining the PII and PHI in their offices.  This duty includes following the standards and  procedures under the HIPAA Security Standard and other federal and state statutes for the  safeguarding of medical records, PII and PHI.     36.  Defendant violated its duty of reasonable care by failing to store sensitive and  private records containing PII and PHI in a safe manner that would protect this information from  anyone who wanted to see it, use it, or take it.     37.  Defendant also failed to comply with HIPAA data security standards, statutes  and/or regulations prohibiting the storage of unprotected sensitive personal information.     38.  As a direct and proximate result of Defendant’s negligence, Plaintiff and the Class  have been damaged by the theft and fraudulent use of their PII and PHI, including, but not  limited to, the loss of their PII and PHI, fraudulent activity associated with the use of their  compromised PII and PHI, and the loss of money and costs incurred as a result of the identity  theft and/or the increased risk of identity theft, all of which have ascertainable value to be proven  at trial.      40.  Plaintiff and the Class, by participating in athletics and providing Defendant with  their medical records and/or physical examinations, entered into an implied contract with  Defendant whereby Defendant became obligated to reasonably safeguard Plaintiff and the  Class’s sensitive, non-public information.    41.  Plaintiff and the Class members would not have entrusted their medical records,  PII and PHI to Defendant in the absence of such an implied contract.     42.  Plaintiff and the Class members fully performed their obligations under the  implied contract with Defendant.    43.  Defendant breached the implied contract with Plaintiff and the Class by failing to  take reasonable measures to safeguard their financial data and by failing to provide timely and  accurate notice to them that their PII was compromised as a result of the theft.     44.  As a direct and proximate result of Defendant’s breach of the implied contracts  between it and Plaintiff and the Class members, Plaintiff and the Class members suffered and  will continue to suffer damages, including, but not limited to, the loss of their PII and PHI,  fraudulent activity associated with the use of their compromised PII and PHI, and the loss of  money and costs incurred as a result of the identity theft and/or the increased risk of identity  theft, all of which have ascertainable value to be proven at trial.    46.  Plaintiff and Class Members, as student athletes undergoing physicals and/or  providing medical records to Defendant and competing on Defendant’s behalf, have a special  relationship with Defendant. Defendant owes a fiduciary duty to Plaintiff and Class Members to  keep their PHI and PII private and confidential and to protect it from misuse by others.    47.  Defendant breached the fiduciary duty it owed to Plaintiff and Class Members by  failing to adequately safeguard their PHI and PII against unauthorized disclosure and misuse.    48.  Defendant further breached the fiduciary duties it owed to Plaintiff and Class  Members by failing to timely and adequately notify them of the breach of their PHI and PII and  misleading them about the nature of the breach and the information stolen.     49.  Defendant’s failure to adequately safeguard Plaintiff’s and Class Members’ PHI  and PII has resulted in losses and damages to Plaintiff and members of the Class.  50.  Plaintiff repeats, realleges, and incorporates by reference paragraphs 1-33 as if  fully set forth herein.   51.  Defendant has engaged in a common fraud and/or misrepresentation.     52.  Defendant knew of the theft on or about September 23, 2014, and knew that the  theft included at least two files full of medical records and physical examination records that  contained names, birthdays, Social Security numbers, and other identifying information.     54.  Instead, on September 25, 2014, Shorter sent a letter to former student-athletes  warning them to keep a close eye on their credit and financial records, but indicating that it was  “uncertain if any personal information was actually obtained during the unauthorized access.”     55.  According to a news article in the Rome Tribune on September 29, 2014,  Defendant informed the public that the records were kept in a locked room and that the door was  broken.  However, a police investigation later found that the door had not actually been locked.    56.  Finally, Plaintiff overpaid tuition in the expectation that a portion would be spent  to adequately protect her PII and PHI by Defendant, Defendant wrongfully collected and kept  this money, and Defendant did not provide adequate service to protect Plaintiff and the Class’ PII  and PHI.   57.  These misrepresentations, omissions and failures to notify Plaintiff and members  of the Class that their medical records had been stolen and as a result their PII and PHI had been  stolen were material misrepresentations and omissions.     58.  Plaintiff and the Class are presumed to have justifiably relied on Defendant’s  omissions and failures to disclose in not taking steps to safeguard their financial information,  change their Social Security numbers or communicate to the IRS that their financial information  had been stolen and therefore prevent the fraudulent tax returns filed by a third party.     59.  As a direct and proximate result of Defendant’s common scheme of fraud,  Plaintiff and Class were damaged, and are entitled to disgorgement  BREACH OF FIDUCIARY DUTY  Plaintiff, individually and on behalf of all others similarly situated, and for this Count,  alleges the following:     BREACH OF IMPLIED CONTRACT  Plaintiff, individually and on behalf of all others similarly situated, and for this Count,  alleges the following:    COMMON LAW FRAUD AND MISREPRESENTATION  Plaintiff, individually and on behalf of all others similarly situated, for this Count, alleges  the following:   NEGLIGENCE  Plaintiff, individually and on behalf of all others similarly situated, for this Count, alleges  the following:  