24.  According to the United States Government Accountability Office (GAO), the  terms “identity theft” or “identity fraud” are broad terms encompassing various types of criminal  activities, such as credit card fraud, phone or utilities fraud, bank fraud and government fraud  (theft of government services).  Identity theft occurs when a person’s PII/PHI is used without  authorization to commit fraud or other crimes. See Federal Trade Commission, Fighting Back  against Identity Theft.2  According to the FTC:   Identity theft is serious. While some identity theft victims can resolve their  problems quickly, others spend hundreds of dollars and many days repairing  damage to their good name and credit record. Some consumers victimized by  identity theft may lose out on job opportunities, or be denied loans for education,  housing or cars because of negative information on their credit reports. In rare  cases, they may even be arrested for crimes they did not commit.    Id.   26.  Moreover, “[o]nce identity thieves have your personal information, they can drain  your bank account, run up charges on your credit cards, open new utility accounts, or get medical  treatment on your health insurance. An identity thief can file a tax refund in your name and get  your refund. In some extreme cases, a thief might even give your name to the police during an  arrest.”5   27.  Medical fraud (also known as medical identity theft) occurs when a person’s  personal information is used without authorization to obtain, or receive payment for, medical  treatment, services or goods.6  For example, as of 2010, more than 50 million people in the  United States did not have health insurance according to the U.S. census. This, in turn has led to  a surge in medical identity theft as a means of fraudulently obtaining medical care. “Victims of  medical identity theft [also] may find that their medical records are inaccurate, which can have a  serious impact on their ability to obtain proper medical care and insurance benefits.” Id.7    29.  A fraudster can easily research the email address of a data breach victim.  When a  fraudster has access to PII/PHI from a large group of similarly situated victims, it is much more  feasible to develop a believable phishing9 spoof email that appears realistic. The fraudsters can  then convince the group of victims to reveal  additional private financial account and payment  card information.     31.  "[H]ealth information is far more valuable than Social Security numbers" on the  cyber black market according to Dr. Deborah Peel, founder and chairwoman of Patient Privacy  Rights.12  An ABC News search uncovered one internet seller offering medical record database  dumps for $14 to $25 per person.  ABC News was then sent, unsolicited, 40 individuals’ private  health information, including their names, addresses and body mass index.  Another inquiry  yielded an offer of more than 100 records including everything from Social Security numbers to  whether someone suffered from anxiety, hypertension, and their HIV status.  Plaintiff’s and  Class Members’ PII/PHI could similarly be valued and traded on the cyber black market—and,  on information and belief, probably have been.  Medical records generally “hold an average  black market value of $50 per record.”13   33.  Identity thieves also use Social Security numbers to commit other types of fraud,  such as obtaining false identification cards, obtaining government benefits in the victim’s name,  committing crimes and/or filing fraudulent tax returns on the victim’s behalf to obtain fraudulent  tax refunds.  Identity thieves also obtain jobs using stolen Social Security numbers, rent houses  and apartments and/or obtain medical services in the victim’s name.  Identity thieves also have  been known to give a victim’s personal information to police during an arrest, resulting in the  issuance of an arrest warrant in the victim’s name and an unwarranted criminal record.  The  GAO states that victims of identity theft face “substantial costs and inconvenience repairing  damage to their credit records,” as well the damage to their “good name.”     34.   The unauthorized disclosure of a person’s Social Security number can be  particularly damaging since Social Security numbers cannot be easily replaced like a credit card  or debit card.  In order to obtain a new Social Security number, a person must show evidence that  someone is using the number fraudulently or is being disadvantaged by the misuse.14  Thus, a  person whose PII/PHI has been stolen cannot obtain a new Social Security number until the  damage has already been done.   36.  As a condition to providing health care services, St. Joseph requires its patients to  provide their detailed PII/PHI.  Indeed, St. Joseph recognizes that maintaining the confidentiality  of its patients’ PII/PHI is critical:  Safeguarding patients' health information is not only a legal requirement but also  an important ethical obligation. As a health care provider, St. Joseph and its staff  are entrusted with clinical information regarding our patients. We recognize that  medical and billing records are highly confidential and must be treated with great  respect and care by all staff with access to this information. St. Joseph's policy  regarding confidentiality of protected health care information reflects our strong  commitment to protecting the confidentiality of our patients' medical records and  clinical information.15  (emphasis added).   37.  St. Joseph also makes certain representations, warranties and commitments to its  patients regarding the privacy of their PII/PHI in its Privacy Notice (Exhibit B).  The Privacy  Notice is posted in each St. Joseph facility (id. at 1) and on the St. Joseph website.16  The Privacy  Notice is also given to every St. Joseph patient—including Plaintiff and Class Members.  Indeed,  each St. Joseph patient must sign the Privacy Notice, acknowledging its existence and terms as a  condition to receiving health care services.  Id. at 3.  Plaintiff signed the Privacy Notice.    39.  St. Joseph further pledges:  We understand that all information about you and your health is personal. We are  committed to protecting this information. When you receive services at a St.  Joseph Facility/Entity, a medical record is created. This record describes the  services provided to you and is needed to provide you with quality care and to  comply with certain legal requirements. This Notice applies to records of your  care generated by St. Joseph, whether made by a St. Joseph employee or a  physician involved in your care.   Id. at 1 (emphasis added).    41.  “For any purpose other than the ones described above, your PHI may be used or  disclosed only when you provide your written authorization on an approved authorization form.”   Privacy Notice at 2 (emphasis added).  In other words, St. Joseph commits that “for any purpose  other than the ones described above,” a patient’s PII/PHI will not be disclosed without  authorization.  Id.  There are no exceptions.   42.  Regarding its patients’ rights pertaining to their PHI, St. Joseph further represents  and promises that “[i]n certain [undefined] instances, you have the right to be notified in the  event that we, or one of our Business Associates, discover an inappropriate use or disclosure of  your health information. Notice of any such use or disclosure will be made in accordance with  state and federal requirements.”  Privacy Notice at 3.   43.  St. Joseph further represents and promises its patients that they also “have the  right to request an ‘accounting of disclosures.’ This is a list of disclosures that we have made  about you.”  Id.      44.  Finally, regarding the PII/PHI entrusted to it, St. Joseph represents and promises  that it “safeguards customer information using various tools such as firewalls, passwords and  data encryption” and “continually strive[s] to improve these tools to meet or exceed industry  standards.”  Id.  Ironically, St. Joseph also promises to “limit access to [its patients’] information  to protect against its unauthorized use.”  Id.  St. Joseph’s data security efforts, however,  unfortunately failed across the board.  63.  Pursuant to Rule 23 of the Federal Rules of Civil Procedure, Plaintiff brings this  action as a class action on behalf of herself and the following Class of similarly situated  individuals:  All Texas residents who were sent a letter or other communication by St. Joseph  notifying them that their personally identifiable information and/or protected  health information was maintained on a St. Joseph Health System computer  system server that was breached by hackers between December 16, 2013 and  December 18, 2013, inclusive.    Excluded from the Class are (i) St. Joseph officers and directors, and (ii) the Court, Court  personnel, and members of their immediate families.   64.  The Class Members are so numerous that their joinder is impracticable.   According to information provided by St. Joseph, there are over 400,000 Class Members.  The  precise identities of the Class Members and their addresses are currently unknown to Plaintiff,  but can be easily derived from St. Joseph’s internal records that were used to send the Data  Breach notification letters to Plaintiff and Class Members in early February 2014.   66.  Questions of law and fact common to all Class Members predominate over any  questions affecting only individual Class Members including, inter alia:   (i)  Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI willfully or negligently violated FCRA;  (ii)  Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI violated the Texas Medical Practice Act;  (iii)  Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI violated the Texas Hospital Licensing Law;  (iv)  Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI constitutes negligence and/or gross negligence;  (v)  Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI constitutes negligence per se;  (vi)  Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI constitutes breach of contract;  (vii)  Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI constitutes breach of implied contract;  (viii) Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI violated the Texas Deceptive Trade Practices-Consumer  Protection Act;  (ix)  Whether St. Joseph’s failure to safeguard and protect Plaintiff’s and Class  Members’ PII/PHI invokes the equitable doctrines of money had and  received/assumpsit;  (x)  Whether Plaintiff and Class Members sustained harm and damages as a direct  and/or proximate result of St. Joseph’s failure to safeguard and protect their  PII/PHI and, if so, the amount of such damages;   (xi)  Whether Plaintiff and Class Members are entitled to exemplary damages as a  direct and/or proximate result of St. Joseph’s failure to safeguard and protect their  PII/PHI and, if so, the amount of such damages; and  (xii)  Whether Plaintiff and Class Members are entitled to injunctive relief as a direct  and/or proximate result of St. Joseph’s failure to safeguard and protect their  72.  The preceding factual statements and allegations are incorporated by reference    73.  In enacting FCRA, Congress made several findings, including that consumer  reporting agencies have assumed a vital role in assembling and evaluating consumer credit  information and other consumer information—such as PII/PHI (15 U.S.C. § 1681(a)(3))—and  “[t]here is a need to insure that consumer reporting agencies exercise their grave responsibilities  with fairness, impartiality, and a respect for the consumer's right to privacy.” 15 U.S.C. §  1681(a)(4) (emphasis added).   74.  Under 15 U.S.C. § 1681a(f), a “consumer reporting agency” includes any person  which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages, in whole  or in part, in the practice of assembling or evaluating consumer credit information or other  information on consumers for the purpose of furnishing “consumer reports” to third parties, and  which uses any means or facility of interstate commerce for the purpose of preparing or  furnishing consumer reports.   76.  “Consumer credit information” (PII) includes, inter alia, a person’s name,  identification number (e.g., Social Security number), marital status, physical address and contact  information, educational background, employment, professional or business history, financial  accounts and financial account history (i.e., details of the management of the accounts), credit  report inquiries (i.e., whenever consumer credit information is requested from a credit reporting  agency), judgments, administration orders, defaults, and other notices.   77.  Under 15 U.S.C. § 1681a(i), “medical information” (PHI) is information or data,  whether oral or recorded, in any form or medium, created by or derived from a health care  provider or the consumer, that relates to the (i) past, present, or future physical, mental, or  behavioral health or condition of an individual, (ii) provision of health care to an individual, and  (iii) payment for the provision of health care to an individual.   78.  FCRA limits the dissemination of consumer credit information (PII) to certain  well-defined circumstances and no other.  15 U.S.C. § 1681b(a).  FCRA also specifically  protects medical information (PHI).  See, e.g., 15 U.S.C. §§ 1681a(d)(3) (“Restriction on sharing  of medical information”); 1681b(g) (“protection of medical information”); 1681c(a)(6)  (“Information excluded from consumer reports”).   84.  The preceding factual statements and allegations are incorporated by reference.    85.  In the alternative, by its above-described wrongful actions, inaction and/or  omissions, St. Joseph negligently and/or in a grossly negligent manner violated FCRA; to wit, St.  Joseph negligently and/or in a grossly negligent manner violated 15 U.S.C. § 1681(b), 15 U.S.C.  § 1681a(d)(3), 15 U.S.C. § 1681b(a);(g), and/or 15 U.S.C. § 1681c(a)(6) (and the related  applicable regulations) by failing to identify, implement, maintain and monitor the proper data  security measures, policies, procedures, protocols, and software and hardware systems to  safeguard and protect Plaintiff’s and Class Members’ PII/PHI which, in turn, directly and/or  proximately caused the Data Breach which, in turn, directly and/or proximately resulted in the  theft of Plaintiff’s and Class Members’ unencrypted PII/PHI and its wrongful dissemination into  the public domain for no permissible purpose under FCRA.  St. Joseph’s above-described  negligent and/or grossly negligent FCRA violations also prevented it from being in a position to  timely and immediately notify Plaintiff and Class Members about the Data Breach which, in  turn, inflicted additional harm and damages on them.    87.   Plaintiff and Class Members, therefore, are entitled to compensation for their  actual damages including, inter alia, the (i) improper disclosure of their PII/PHI, (ii) lost benefit  of their bargains, (iii) deprivation of the value of their PII/PHI, for which there is a well- established national and international market, (iv) diminished value of the medical services they  paid St. Joseph to provide, (v) value of their lost time and out-of-pocket expenses incurred to  mitigate the identity theft, identity fraud and/or medical fraud pressed upon them (and/or to be  pressed upon them) by the Data Breach (including, inter alia, the value of their lost time and out- of-pocket expenses that St. Joseph advised and encouraged them to incur to place “freezes” and  “alerts” with the credit reporting agencies, close or modify financial accounts, and closely review  and monitoring their credit reports and accounts for unauthorized activity), (vi) emotional  distress from the theft and compromise of their PII/PHI, the identity theft, identity fraud and/or  medical fraud experienced to date and to be experienced in the future, and (vii) the credible  threat of real and impending future harm and damages from identity theft, identity fraud and/or  medical fraud, as evidenced by the identity theft, identity fraud and/or medical fraud Plaintiff has  already experienced, and (viii) attorneys’ fees, litigation expenses and costs, pursuant to 15  U.S.C. §1681o(a).  88.  The previous factual statements and allegations are incorporated by reference.   90.  Under TEX. OCC. CODE § 159.002(c), a person, including a hospital, that receives  information from a confidential communication or record as described above and acts on the  patient's behalf, may not disclose such information except to the extent that disclosure is  consistent with the authorized purposes for which the information was first obtained.   91.  St. Joseph’s above-described wrongful actions, inaction and/or omissions that  caused the Data Breach, caused the unauthorized disclosure of Plaintiff’s and Class Members’  PII/PHI, and caused Plaintiff and Class Members to suffer the resulting harm and damages  collectively constitute the unauthorized release of confidential and privileged communications in  violation of the Texas Medical Practice Act.  Plaintiff and Class Members, therefore, are entitled  to injunctive relief and/or to recover their damages under TEX. OCC. CODE § 159.009.   92.  The previous factual statements and allegations are incorporated by reference.   93.  Under TEX. HEALTH & SAFETY CODE § 241.151(2), “health care information” is  any information, including payment information, recorded in any form or medium that identifies  a patient and relates to the history, diagnosis, treatment, or prognosis of a patient.    95.  Under TEX. HEALTH & SAFETY CODE § 241.155, a hospital shall adopt and  implement reasonable safeguards for the security of all health care information it maintains.   96.  St. Joseph’s above-described wrongful actions, inaction and/or omissions that  caused the Data Breach, caused the unauthorized disclosure of Plaintiff’s and Class Members’  PII/PHI, and caused Plaintiff and Class Members to suffer the resulting harm and damages  collectively constitute (i) the unauthorized disclosure of Plaintiff’s and Class Members’ health  care information to unauthorized parties, and (ii) St. Joseph’s failure to adopt and implement  reasonable safeguards for the security of Plaintiff’s and Class Members’ PHI entrusted to it— both of which are violations of the Texas Hospital Licensing Law.  Plaintiff and Class Members,  therefore, are entitled to injunctive relief and/or to recover their damages under TEX. HEALTH &  97.  The previous factual statements and allegations are incorporated by reference.   I.  Data breaches lead to identity theft, identity fraud and/or medical fraud, and the  resulting significant harm and economic damages.   NEGLIGENCE/GROSS NEGLIGENCE   NEGLIGENT VIOLATION OF THE FAIR CREDIT REPORTING ACT  (15 U.S.C. § 1681, et seq.)    VIOLATION OF THE TEXAS HOSPITAL LICENSING LAW  (TEX. HEALTH & SAFETY CODE § 241.001, et seq.)    VIOLATION OF THE TEXAS MEDICAL PRACTICE ACT  (TEX. OCC. CODE § 159.001, et seq.)    WILLFUL VIOLATION OF THE FAIR CREDIT REPORTING ACT  (15 U.S.C. § 1681, et seq.)   