A Colorado federal judge recently granted a motion to dismiss a putative class action against two healthcare software companies arising from a 2022 data breach in which a threat actor allegedly accessed personally identifiable information (“PII”) and protected health information (“PHI”) in “over 250,000 patient records.”  See Henderson v. Reventics, LLC, 2024 WL 5241386 (D. Colo. Sept. 30, 2024).

The court concluded that the plaintiffs lacked Article III standing because each of their alleged harms either did not constitute an injury in fact or was not traceable to the data breach (let alone the defendants’ conduct).  The court noted that the case involved “the mere loss of data” “without allegations that the data has been misused,” and as a result any harm was hypothetical or self-imposed.  The court also rejected plaintiffs’ theories that the breach led to “increased spam” or specific incidents of fraud, noting that plaintiffs’ allegations were too speculative to establish causation.

With this opinion, the District of Colorado joined other district courts in the Tenth Circuit in concluding that “a plaintiff does not suffer an injury in fact where their PHI/PII is accessed through a data breach but no direct harm results.”  While the Circuit has yet to opine on the topic, it may soon have that opportunity as the plaintiffs have filed a notice of appeal.