The plaintiff, Rebecca Petta, filed a class-action complaint in the circuit court of Champaign County against the defendant, Christie Business Holdings Company, P.C., doing business as Christie Clinic (“Christie”). The complaint alleged that Christie negligently failed to prevent its patients’ private personal data, including Social Security numbers and health insurance information, from being “exposed” to an unknown third party who gained unauthorized access to one of Christie’s business e-mail accounts. Christie filed a combined motion to dismiss the complaint pursuant to section 2-619.1 of the Code of Civil Procedure (Code) (735 ILCS 5/2-619.1 (West 2022)), which the trial court granted.
The Illinois Supreme Court affirmed the dismissal in its opinion filed on January 24, 2025, stating: “At issue in this appeal is whether the appellate court properly affirmed the trial court’s dismissal of Petta’s complaint on the ground that Petta lacked standing … In Illinois, standing “requires only some injury in fact to a legally cognizable interest. [Citation.] More precisely, the claimed injury, whether ‘actual or threatened’ [citation], must be: (1) ‘distinct and palpable’ [citation]; (2) ‘fairly traceable’ to the defendant’s actions [citation]; and (3) substantially likely to be prevented or redressed by the grant of the requested relief [citations].””
“The principal factual basis of Petta’s complaint is the letter that she received from Christie notifying her of the “data incident.” This letter states only that Petta’s private personal data, including her Social Security number and health insurance information, may have been exposed to a third party. It does not state that this data was actually acquired by a third party. Nor does anything in the letter suggest that it is likely the third party did, in fact, take the data. To the contrary, according to the letter, Christie’s investigation revealed that the unauthorized third party was attempting to intercept a financial transaction, not steal patients’ private personal information. Viewing the letter in the light most favorable to Petta, the primary factual allegation of the complaint is that Petta and the other members of the putative class faced only an increased risk that their private personal data was accessed by an unauthorized third party. In a complaint seeking monetary damages, such an allegation of an increased risk of harm is insufficient to confer standing.”
“As alleged in Petta’s complaint, the wrongful act committed by Christie was the failure to adequately prevent Petta’s private personal data from being disclosed to an unauthorized third party. Critically, however, Petta’s complaint does not allege that any of her private, personally identifiable information, such as her Social Security number, was used in the loan application. Instead, Petta alleges only that her publicly available phone number and city were used in an application that was made “in someone else’s name.” The allegation regarding the loan application is therefore not, in fact, an instance of someone stealing Petta’s identity or an indication that an unauthorized third party had acquired Petta’s private, personally identifiable information. Further, as the appellate court observed, the unsuccessful loan application cannot be said to be “fairly traceable” to any of Christie’s alleged misconduct given that the information used in the loan application (Petta’s phone number and city) could be found in a publicly available phone directory. Thus, as the appellate court determined, Petta’s allegation regarding the loan application is “ ‘purely speculative’ because there is no apparent connection between the purported fraudulent loan attempt and the data breach at issue. Anyone could have committed the fraud using the same readily available public information.” 2023 IL App (5th) 220742. Accordingly, the appellate court correctly concluded that Petta lacked standing and that her complaint should be dismissed on that basis.”
Source Petta v. Christie Business Holding Co., P.C., 2025 IL 130337.
If you or a loved one may have been harmed by a medical information data breach in Illinois or in another U.S. state, you should promptly find an Illinois lawyer, or a lawyer in your state, who may investigate your medical records data breach claim for you and represent you or your loved one in a medical records data breach case, if appropriate.
Click here to visit our website or call us toll-free in the United States at 800-295-3959 to find attorneys in your state who may assist you.
Turn to us when you don’t know where to turn.
