United States Court of Appeals For the First Circuit

No. 19-1429

ROBERT AMRHEIN, as Administrator of the Estate of STJEPAN TOT; RANDY STERN, as Executor of the Estate of ANNETTE MONACHELLI,

Plaintiffs, Appellants,

v.

eCLINICAL WORKS, LLC,

Defendant, Appellee.

APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS

[Hon. Richard G. Stearns, U.S. District Judge]

Before

Howard, Chief Judge, Thompson and Barron, Circuit Judges.

Patrick M. Groulx, with whom Isenberg Groulx, LLC, David M. Given, and Phillips, Erlewine, Given & Carlin LLP, were on brief, for appellants. James R. Carroll, with whom Jessica D. Miller, Geoffrey M. Wyatt, Jordan Schwartz, and Skadden, Arps, Slate, Meagher & Flom LLP, were on brief, for appellee.

March 27, 2020 THOMPSON, Circuit Judge. eClinicalWorks, LLC (ECW, for

short) sells software used by hundreds of thousands of hospitals,

doctors, and other healthcare providers to keep and access millions

of patients' medical records. Stjepan Tot and Annette Monachelli

were two of those patients. Before he died, Tot learned that his

health info stored in ECW's software contained several

inaccuracies. Sadly, Monachelli's family found out after she

departed. While she was alive, her primary care doctor had ordered

a magnetic resonance angiogram (MRA) for her, but the software

didn't show the order on the appropriate screen, so she never got

the test. So her brain aneurysm remained undiagnosed and

untreated, and she later died from it. In this lawsuit, Tot's and

Monachelli's estates (the plaintiffs) say ECW's system was riddled

with those and other glitches — showing healthcare providers false

and incomplete data about patients' medical problems and

treatments — and that ECW hid those bugs from government

regulators. If ECW had been up-front about the bugs, it would not

have obtained certification, and far fewer providers would have

bought it. At least, the estates allege as much in their amended

complaint. They bring a mix of state common-law claims and seek

to represent a class of millions of other patients whose healthcare

providers used ECW software to record and store their medical

records.

- 2 - The district judge, however, found that even taking the

plaintiffs' allegations as true, they lacked standing to bring

this case. So he granted ECW's motion to dismiss the case under

Federal Rule of Civil Procedure 12(b)(1). We review that decision

de novo. See Katz v. Pershing, LLC,

(1st Cir.

2012).

Standing

Article III of the Constitution confines "the judicial

power" of federal courts to "cases and controversies of the sort

traditionally amenable to, and resolved by, the judicial process,"

Steel Co. v. Citizens for a Better Env't,

(1998):

that is, "concrete, living contest[s] between adversaries," Fed.

Election Comm'n v. Akins,

(1998) (quoting Coleman

v. Miller,

(1939) (Frankfurter, J., dissenting)),

that a court can resolve with real-world relief (as opposed to "an

opinion advising what the law would be upon a hypothetical state

of facts"). MedImmune, Inc. v. Genentech, Inc.,

(2007). To show their dispute qualifies, the named plaintiffs

must establish standing, meaning they must plausibly allege

"(1) an injury in fact, (2) fairly traceable to the challenged

conduct of the defendant, and (3) likely to be redressed by a

favorable judicial decision." Spokeo, Inc. v. Robins,

(2016) (citing Lujan v. Defs. of Wildlife,

, 560–61 (1992)). "Where, as here, a case is at the pleading

- 3 - stage, the plaintiff[s] must 'clearly . . . allege facts

demonstrating' each element."

at 1547 (quoting Warth v.

Seldin,

(1975)).

The "first and foremost" of those elements — "injury in

fact" — is the "'invasion of a legally protected interest' that is

'concrete and particularized' and 'actual or imminent, not

conjectural or hypothetical.'"

at 1547–48 (first quoting Steel

Co.,

; then quoting Lujan,

).

"Concrete" injuries embrace not only tangible harms — like a picked

pocket or a broken leg, Gustavsen v. Alcon Labs., Inc.,

(1st Cir. 2018) ("[A]ctual economic loss . . . is the

prototypical concrete harm.") — but also intangible ones, like the

suppression of free speech or religious exercise, Spokeo,

, or "[t]he invasion of a common-law right (including

a right conferred by contract)" actionable without wallet injury,

Katz,

; see also Servicios Azucareros de Venezuela,

C.A. v. John Deere Thibodeaux, Inc.,

(5th Cir.

2012) ("Injuries to rights recognized at common-law — property,

contracts, and torts — have always been sufficient for standing

purposes."). Since "[s]tanding to sue is a doctrine rooted in the

traditional understanding of a case or controversy," an intangible

stake is more likely to confer standing if it "has a close

relationship to a harm that has traditionally been regarded as

- 4 - providing a basis for a lawsuit in English or American courts."

Spokeo,

.

In addition, legislatures "can raise to the status of

legally cognizable injuries certain harms that might otherwise

have been insufficient at common law." Katz,

(citing Lujan,

). As our judicial higher-ups have

put it, "Congress has the power to define injuries and articulate

chains of causation that will give rise to a case or controversy

where none existed before," Spokeo,

(quoting

Lujan,

(Kennedy, J., concurring)), a power it can

exercise through statutes that "identify the injury it seeks to

vindicate and relate the injury to the class of persons entitled

to bring suit." Lujan,

(Kennedy, J., concurring).

There are limits; even Congress can't spin a "bare

procedural violation, divorced from any concrete harm" into an

"injury-in-fact." Spokeo,

. Still, the common

law "has long permitted recovery by certain tort victims" — e.g.,

for libel or slander per se — "even if their harms" (e.g., to

reputation) "may be difficult to prove or measure."

.

So too, the violation of a statutory right (even a procedural one)

designed to protect someone against a "risk of real harm" can give

her standing without more proof the feared harm came (or will come)

to pass. Id.; see Robins v. Spokeo, Inc.,

(9th Cir. 2017) (on remand) ("Spokeo II 'instruct[s] that an

- 5 - alleged procedural violation [of a statute] can by itself manifest

concrete injury where Congress conferred the procedural right to

protect a plaintiff's concrete interests and where the procedural

violation presents "a risk of real harm" to that concrete

interest.'" (quoting Strubel v. Comenity Bank,

(2d Cir. 2016); citing Dreher v. Experian Info. Sols., Inc.,

(4th Cir. 2017) and Lyshe v. Levy,

(6th Cir. 2017)).

"That a suit may be a class action . . . adds nothing"

to all this; "even named plaintiffs who represent a class 'must

allege and show'" a past or threatened injury to them, and not

just to "other, unidentified members of the class to which they

belong" and which they purport to represent. Spokeo,

n.6 (quoting Simon v. Eastern Ky. Welfare Rights Org.,

, 40 n.20 (1976)).

Our Take

The estates contend they do have a real stake in this

fight that gives them standing — but not because of Tot or

Monachelli's death.1 Instead, they claim to have shared two

1 We say this because the estates' opening brief does not identify Tot or Monachelli's health problems, or their deaths, as the injuries-in-fact on which their claims are based. In their response, ECW points this out, noting that Monachelli's estate brought and settled a separate wrongful death lawsuit against her healthcare provider. And other than citing Monachelli's death to support their argument (unveiled in their reply) that the "compromised" medical records were "an invasion of Plaintiffs'

- 6 - concrete injuries with the putative class: first, the risk their

doctors will misdiagnose them or botch their medical treatment

based on the faulty records, and second, the future out-of-pocket

costs necessary to find and fix the errors. The problem is that

to create standing, a threatened injury must be "imminent" or

"actual" when the plaintiffs filed their complaint. See Friends

of the Earth, Inc. v. Laidlaw Envtl. Servs. (TOC), Inc.,

(2000); Lujan,

n.4. By then, however,

Tot and Monachelli had both passed away; they faced no risk of

future misdiagnosis or botched medical treatment. And their

estates can't drum up standing by claiming they'll need to pay

money to correct errors no longer relevant to their care. See

Clapper v. Amnesty Int'l USA,

(2013) (holding

that plaintiffs could not "manufacture standing by incurring

costs" to avoid "non-imminent harm"); Katz,

("When

an individual alleges that her injury is having to take or forbear

protected interest under federal law in having accurate and reliable electronic healthcare records," the estates do not develop a physical-injury-based argument. To do so (aside from having to raise the issue in their opening brief), the plaintiffs would have had to explain why the allegations in the Amended Complaint show that Monachelli's death was "fairly traceable" to the defects in ECW's software, Spokeo,

, "highlighting the relevant facts and analyzing on-point authority"; but they don't. Rodríguez v. Municipality of San Juan,

(1st Cir. 2011) (stressing that "an argument not seriously developed in the opening brief" is forfeited (quoting Tejada-Batista v. Morales,

, 103 (1st Cir. 2005))).

- 7 - from some action, that choice must be premised on a reasonably

impending threat.").2

Unflapped, the estates get creative; they urge that Tot

and Monachelli's inability to rely on their medical records

maintained on ECW's software during their lifetimes was itself a

concrete "informational injury." In support, they cite a line of

Supreme Court cases recognizing that a "plaintiff suffers an

'injury in fact' when [he or she] fails to obtain information which

must be publicly disclosed pursuant to a statute." Akins,

(citing Public Citizen v. Dep't of Justice,

(1989), and Havens Realty Corp. v. Coleman,

,

373–374 (1982) as examples). In addition, they point out, several

of our sister circuits have held that statutes gave consumers

standing to sue violators for "failing to protect [their]

confidential information," Appellant's Br. at 21 — for example,

by letting their personal info slip into hackers' hands, In re

2At oral argument, the estates suggested that "the imminent harm [they] allege is that the errors in the medical records" will harm the estates (rather than the deceased person) because the faulty records are "impairing their ability to, for example, prosecute their wrongful death suits." But they concede that their amended complaint does not "explicitly state" this injury. To plead an injury-in-fact based on that harm, that's exactly what they had to do. See Spokeo,

(requiring the pleadings to "'clearly allege facts demonstrating' each element" of standing (cleaned up)). Instead, the pleading doesn't say a word about malpractice lawsuits or how the software defects could still harm the estates.

- 8 - Horizon Healthcare Servs. Inc. Data Breach Litig.,

(3d Cir. 2017), or exposing confidential information (there,

credit card numbers) to other prying eyes, Muransky v. Godiva

Chocolatier, Inc.,

(11th Cir. 2019), reh'g en

banc granted, opinion vacated,

(11th Cir. 2019).

Similarly, in Robins, the defendant spread false "material facts

about [the plaintiff's] life," which (like the unauthorized

disclosure of private information) "present[ed] a sincere risk of

harm" to the real-world interests that Congress chose to protect

(like the victim's job prospects). Robins, 867 F.3d at 1114–18.

These courts held that in such cases, the affected consumers could

sue without proof that a more specific injury (like identify theft

or the loss of a job opportunity) occurred or was imminent.

Yet, all of these decisions relied on Congress's power

to identify "previously inadequate" intangible injuries and

protect them with "procedural right[s]" whose infraction

"constitute[s] injury in fact" without proof of "any additional

harm beyond the one Congress has identified." Spokeo,

(putting Akins and Public Citizen in this bucket); see

also Muransky,

(accepting "Congress's elevation

of the risk [at issue] to the status of a concrete harm . . . under

the principles laid down in Spokeo"); In re Horizon,

(concluding that in the Fair Credit Reporting Act, "Congress

properly defined an injury that 'give[s] rise to a case or

- 9 - controversy where none existed before'": the "unauthorized

dissemination of [the plaintiffs'] own private information"

(quoting Spokeo,

)); Robins, 867 F.3d at 1113–

18 (holding that the FCRA made "the dissemination of [material]

false information in consumer reports" an injury in fact). In

contrast, the estates do not claim that any statute gave them a

right to have ECW maintain accurate information about them and to

sue if it failed to do so. To the contrary, they admit that

"[n]one of [their] claims involves a new statutory right" or

implicates "Congress's power to create new rights" or "claims for

relief." So their claimed injury does not "exist . . . by virtue

of [any] 'statute[ ] creating legal rights, the invasion of which

creates standing.'" Warth,

(quoting Linda R.S. v.

Richard D.,

, 617 n.3 (1973)).3

Instead, they tell us "[t]he case and controversy

requirement is met here by the simple fact that Plaintiffs have

made traditional common law claims arising from the compromised

medical records of both Mr. Tot and Mrs. Monchelli." But

constitutional standing requirements apply "with equal force in

3 In their reply, the plaintiffs cite various federal statutes arguably designed to help ensure certain health records are accurate and reliable, and they claim to have a "protected interest under federal law in having accurate and reliable electronic healthcare records." But these undeveloped suggestions are too little and come too late. See United States v. Tosi,

(1st Cir. 2018)("[A]rguments available at the outset but raised for the first time in a reply brief need not be considered.").

- 10 - every case" brought in federal court and to "each and every claim

[a plaintiff] asserts" — even common-law claims. Katz, 672 F.3d

at 71–72; see Kerin v. Titeflex Corp.,

, 983–85

(1st Cir. 2014) (affirming dismissal of common-law product

liability claims for lack of standing).4 And the plaintiffs

identify no common-law claim that gives them the kind of

informational right the Supreme Court, or other courts (so far as

we're aware), have held can ground an injury in fact.

It's true, "the actual or threatened injury required

under Article III can be satisfied solely by virtue of an invasion

of a recognized state-law right," at least when the courts have

"long . . . permitted" folks in the plaintiffs' shoes to bring the

"type of suit at issue." Scanlan v. Eisenberg,

(7th Cir. 2012) (quoting Sprint Commc'ns Co., L.P. v. APCC Servs.,

Inc.,

(2008)); accord Katz,

. But

generally, a tort claim based on a breach of fiduciary duty (the

only claim the estates discuss in their briefs) requires the

4 Plaintiffs point out that in Spokeo, Justice Thomas opined that "the concrete-harm requirement does not apply as rigorously when a private plaintiff seeks to vindicate his own private rights." 136 U.S. at 1552 (Thomas, J., concurring). But even by Justice Thomas's reckoning, a plaintiff courting that relaxed treatment must identify a statute or common-law rule that "arguably establish[es] a private cause of action to vindicate the violation of a privately held right" without proving actual damages. Id. at 1551–53. And as we'll explain, these plaintiffs identify no law that gives them the "private right" (to the maintenance of accurate medical records, full stop) they allege ECW invaded.

- 11 - plaintiff to show some "harm resulting from [the] breach of duty."

Restatement (Second) of Torts § 874 (1979); Palmetto Partners,

L.P. v. AJW Qualified Partners, LLC,

, 264–65

(2011); Cooper v. Cooper,

(2001); see also UBS Fin.

Servs., Inc. v. Aliberti,

, 405 (2019). As we've

noted, though, the estates don't rely on any financial, physical,

or emotional harm to Tot or Monachelli as their injury-in-fact.

And they make no argument, and cite no cases, suggesting that any

of their common-law claims make the past "injury" they do claim

(the keeping of inaccurate medical records about them) actionable

without proof of such real-life harm. See Rodríguez,

(deeming unargued issues waived).5

And so, based on the arguments properly presented, we're

left with a moot risk of misdiagnosis or mistreatment that no

statute or common-law claim makes suable. Without further injury,

the plaintiffs lacked standing to bring this case.

Affirmed.

5 In their briefs, the estates do cite cases suggesting that disclosing confidential information to an unauthorized third party might be harm enough to support a tort claim under the laws of Vermont and New York (the states where Tot and Monachelli lived), see Muransky,

; Lawson v. Halpern-Reiss, 2019 Vt 38, ¶ 12 (2019); MacDonald v. Clinger,

(N.Y. App. Div. 1982), but that's not the injury they claim; they don't allege ECW divulged their private information to third parties unauthorized to view it. See Kamal v. J. Crew Grp., Inc.,

, 118 n.9 (3d Cir. 2019) (noting that "the sources cited in Muransky recognize that [the tort of] breach of confidence requires unauthorized disclosure to a third party").

- 12 -