The lack of an actual, present injury prevents recovery by plaintiffs whose electronic patient records were stolen from the car of an employee of Providence Health System. So held the Oregon Supreme Court last month in Paul v. Providence Health System. The Court affirmed a 2010 decision by the Oregon Court of Appeals, which dismissed claims by individuals who were among thousands of patients whose records were stolen.
Plaintiffs asserted negligence and Unlawful Trade Practices Act claims against Providence. Plaintiffs did not allege that the records had been viewed or used by any third party, but only that defendant caused financial injury in the form of past and future credit monitoring, along with the possible future costs related to identity theft, and noneconomic damages in the form of emotional distress.
The Supreme Court relied on cases including Lowe v. Philip Morris USA, Inc., 344 Or 403 (2008), for the rule that the threat of future harm -- in the form of potential identity theft -- is not sufficient as an allegation of damages to support a negligence claim. That rule precludes as well recovery for the current cost of credit monitoring. Likewise, a risk of future identity theft will not support a claim for emotional distress, and the cost of credit monitoring is not the type of "ascertainable loss of money or property" subject to the UTPA.
See our coverage of the Court of Appeals opinion in Paul v. Providence Health System here.