Atwal, MD PC v. ECL Group LLC ( 2023 )

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF NEW YORK AMAR ATWAL MD, PC, Plaintiff, v. DECISION AND ORDER 22-CV-355S ECL GROUP, LLC, Defendant. I. Introduction In this removed breach of contract action, Plaintiff Dr. Amar Atwal (“Dr. Atwal” or “Plaintiff”) sues for injuries arising from his medical practice’s agreement with Defendant ECL Group, LLC (“ECL” or “Defendant”). Dr. Atwal contracted with ECL to retain his electronic medical records. In March 2021, ECL suffered an eight-day outage of its electronic medical record (or “EMR”) system, losing unbacked up records because of encryption in a ransomware attack. Presently before this Court is ECL’s Partial Motion to Dismiss (Docket No. 171), seeking dismissal only of Plaintiff’s Third (negligent misrepresentation), Fourth (negligence), Sixth (unjust enrichment), and Seventh (injunctive relief) Causes of Action. This Motion leaves uncontested Dr. Atwal’s claims alleged in the First (breach of contract), Second (declaratory judgment as to the parties’ obligation under the 1 In support of its Partial Motion, ECL submits Memorandum of Law, Docket No. 18, and its Reply Memorandum, Docket No. 22. ECL also filed a Motion for Extension of Time to File Answer, Docket No. 19; this Court concluded that the extension motion was moot, holding that any Answer is due 14 days after resolution of the Partial Motion, Docket No. 20. In response, Dr. Atwal submits his Memorandum of Law, Docket No. 21. agreement), and Fifth (deceptive business practices in violation of New York General Business Law § 349) Causes of Action. For the reasons stated below, ECL’s Partial Motion (id.) is granted in part, denied in part. ECL’s Motion is granted dismissing the negligence claims alleged in the Third and Fourth Causes of Action, the unjust enrichment claims from the termination of the Agreement in the Sixth Cause of Action, and the Seventh Cause of Action for injunctive relief, but denied dismissing the rest of the Sixth Cause of Action (alleging unjust enrichment from ECL’s invoices) and injunctive relief sought in the ad damnum clause (cf. Docket No. 8, Compl. a 16). With Plaintiff’s unchallenged First, Second, and Fifth Cause of Action, Dr. Atwal also alleged his Sixth Cause of Action alleging unjust enrichment and injunctive relief. ECL’s Answer to these surviving pleadings is due 14 days from entry of this Decision (see Docket No. 20). II. Background A. Proceedings to Partial Motion to Dismiss Plaintiff Dr. Atwal sued ECL in the New York State Supreme Court, Erie County, on or about April 11, 2022 (Docket No. 1, Notice of Removal ¶ 1, Ex. B-2 through B-4, A (state Docket Sheet)). On May 13, 2022, ECL removed this action to this Court under diversity jurisdiction (Docket No. 1). ECL moved to dismiss the state Complaint (Docket No. 4). Dr. Atwal then filed his Complaint in this Court (Docket No. 8). This Court denied that Motion to Dismiss as moot (Docket No. 9). B. Facts Alleged On or about April 24, 2018, Dr. Atwal and ECL entered into the Software and Service Agreement with an appended Service Level Agreement and a HIPAA Business Associate Agreement (or “BAA”; collectively “the Agreement”) (Docket No. 8, Compl. ¶ 5). ECL agreed to provide cloud based EMR system and billing services to Dr. Atwal (id. ¶ 6). Pursuant to the three-year agreement, ECL agreed to maintain the security of Dr. Atwal’s data using industry-standard data security protocols and agreed to promptly notify Dr. Atwal in the event of a data breach involving client data (id. ¶¶ 7, 9, 13). ECL agreed to retain Dr. Atwal’s data on a secure server and to maintain date recovery and data backup facilities in accordance with accepted industry practices (id. ¶ 10). ECL also was required to comply with HIPAA2 obligations (id. ¶ 12). Further, under the Agreement, ECL was to “use commercially reasonable efforts to make the Software available 99% of the time as measured on a monthly basis,” and reduce its monthly rates if availability fell below 95% in a month (id. ¶ 14). BAA also requires ECL to indemnify Dr. Atwal for losses proximately caused by violations of the BAA, HIPAA, gross negligence, or willful misconduct (id. ¶ 16). On or about March 20, 2021, Dr. Atwal experienced full interruption of ECL’s EMR system (id. ¶ 19). Dr. Atwal’s service and access to the EMR was restored on March 28, 2021 (id. ¶ 20). On April 1, 2021, ECL then reported that a ransomware attack had occurred but claimed that Dr. Atwal’s data was not encrypted (id. ¶ 21). Dr. Atwal, however, had certain records missing (such as Lasik consent forms, images of patients’ 2 Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Pub. L. 104–191, 110 Stat. 1936 (1996). ID cards and insurance cards) despite the resumption of services and access to other client data (id. ¶ 22). On April 21, 2021, Dr. Atwal provided notice to ECL of a material breach of the Agreement (id. ¶ 23). ECL repeatedly informed Dr. Atwal that his data was not encrypted and that any missing records was due to user error (id. ¶ 24). Dr. Atwal had to resort to staff reconstruction of the missing records, facing payment disputes, and reducing the number of client visits (id. ¶ 25). Over a month later, ECL admitted that Dr. Atwal’s data was encrypted by a ransomware attack restricting the doctor’s access to it (id. ¶ 26). ECL also said it did not maintain a complete backup of Dr. Atwal’s data or any backup was not fully accessible (id. ¶ 27). From March 2020, Dr. Atwal claims that ECL overcharged him based on the incorrect quantity of providers and other services not rendered to Dr. Atwal (id. ¶ 31). ECL accepted Dr. Atwal’s reduced, correct payments but then demanded additional funds based upon the inaccurate invoices (id. ¶¶ 34, 33). Dr. Atwal disputed the validity of subsequent invoices that overcharged his account (id. ¶¶ 36-41). On or about February 21, 2022, Dr. Atwal wrote to ECL notifying that the Agreement was not being renewed (id. ¶ 42). Dr. Atwal then requested that ECL cooperate in the transition to a new EMR provider, as required under the Agreement (id. ¶ 43). Dr. Atwal also asked for continued access following expiration (id. ¶ 44). ECL failed to respond to those requests (id. ¶¶ 45, 47). As a result, Dr. Atwal incurred what he terms “significant expense to export data” (id. ¶ 48). By letter dated April 22, 2022, Dr. Atwal confirmed that the Agreement was not renewed (id. ¶ 49). As of the date of the Complaint, ECL failed respond to the payment dispute, failed to remedy material breaches of the Agreement, and failed to respond to requests for the post-expiration access to the account (id. ¶ 50). C. Causes of Action Dr. Atwal’s Complaint (Docket No. 8) alleges seven causes of action. As previously noted, three causes of action (the First, Second and Fifth) are not the subject of ECL’s Partial Motion to Dismiss. The First Cause of Action alleges breach of the Software and Service Agreement. Dr. Atwal list several breaches by ECL in failing to secure Dr. Atwal’s confidential data, not notifying him of the data breach, failing to resolve errors, and not cooperating with the transition to the successor EMR provider (id. ¶ 54). The Second Cause of Action seeks declaratory judgment that Dr. Atwal satisfied all payment obligations to ECL (id. ¶ 61). He also seeks a declaration that ECL is obligated to defend and indemnify Dr. Atwal against claims or investigations from ECL’s failure to protect Atwal’s data (id. ¶ 64). The Fifth Cause of Action alleges deceptive business practices in ECL’s conduct under the Agreement by concealing the ransomware attack and claiming the issues were due to “user error,” in violation of New York General Business Law § 349 (id. ¶¶ 81-85). ECL now moves to dismiss the remaining Causes of Action. The Third Cause of Action alleges negligent misrepresentation of ECL’s ability to maintain, secure, and protect Atwal’s data. Dr. Atwal claims he relied upon ECL’s misrepresentation to enter into the Agreement. (Id. ¶¶ 66-71.) The Fourth Cause of Action claims ECL was negligent in securing Dr. Atwal’s medical records (id. ¶¶ 73-79). The Sixth Cause of Action claims ECL was unjustly enriched for monthly fees or premiums paid to it for data hosting and security services (id. ¶ 87). Dr. Atwal accuse ECL of not using these proceeds for the administrative costs for reasonable data privacy and security practices and procedures (id. ¶ 90). Dr. Atwal claims that he lacks an adequate remedy at law (id. ¶ 88). He concludes that he suffered damages “in an amount equal to the difference in value between the reasonable data privacy and security practices and procedures that Atwal paid for, and the inadequate data privacy and security practices and procedures that they received” (id. ¶ 91) and ECL should not benefit from this difference (id. ¶ 92). Finally, Plaintiff seeks injunctive relief in his Seventh Cause of Action (id. ¶¶ 95- 101). Plaintiff later concedes that an injunction is not a cause of action but a form of relief he claims (Docket No. 21, Pl. Memo. at 13). He argues that ECL’s Motion to Dismiss the Seventh Cause of Action is premature because he has not yet sought a preliminary injunction (id. at 13-14). D. Partial Motion to Dismiss (Docket No. 17) After the parties stipulated to extend ECL’s time to respond to the Complaint (Docket No. 15; see Docket No. 16, text Order of June 14, 2022), ECL filed its Partial Motion to Dismiss (Docket No. 17). Responses to this Partial Motion were due by July 8, 2022, and reply by July 18, 2022 (Docket No. 20). After timely briefing (Docket Nos. 21, 22), the Partial Motion was deemed submitted without oral argument. III. Discussion A. Applicable Standards 1. Motion to Dismiss, Rule 12(b)(6) Federal pleading standards are generally not stringent. Rule 8 requires a short plain statement of a claim, Fed. R. Civ. P. 8(a)(2). But that plain statement must “possess enough heft to show that the pleader is entitled to relief,” Bell Atlantic Corp. v. Twombly, 550 U.S. 554, 557, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007); see Ghadersohi v. Roswell Park Cancer Inst., No. 10CV143, 2011 WL 4572539, at *1 (W.D.N.Y. Sept. 30, 2011) (Skretny, C.J.). Under Rule 12(b)(6), the Court cannot dismiss a Complaint unless it appears “beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief.” Conley v. Gibson, 355 U.S. 41, 45-46, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957). As the Supreme Court held in Twombly, supra, 550 U.S. 554, a claim alleged in a Complaint must be dismissed if it does not plead “enough facts to state a claim to relief that is plausible on its face,” id. at 570 (rejecting longstanding precedent of Conley, supra, 355 U.S. at 45-46). To survive a Motion to Dismiss, the factual allegations in the Complaint “must be enough to raise a right to relief above the speculative level,” Twombly, supra, 550 U.S. at 555. As reaffirmed by the Court in Ashcroft v. Iqbal, 556 U.S. 662, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009), “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’ [Twombly, supra, 550 U.S.] at 570 . . . . A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged. Id., at 556 . . . . The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully. Ibid. Where a complaint pleads facts that are ‘merely consistent with’ a defendant’s liability, it ‘stops short of the line between possibility and plausibility of “entitlement to relief.”’ Id., at 557 . . . (brackets omitted).” Iqbal, supra, 556 U.S. at 678 (citations omitted). A Rule 12(b)(6) Motion is addressed to the face of the pleading. The pleading is deemed to include any document attached to it as an exhibit, Fed. R. Civ. P. 10(c), or any document incorporated in it by reference. Goldman v. Belden, 754 F.2d 1059 (2d Cir. 1985). This Court observes that the Agreement here was not attached as an exhibit. In considering such a motion, the Court must accept as true all the well pleaded facts alleged in the Complaint. Bloor v. Carro, Spanbock, Londin, Rodman & Fass, 754 F.2d 57 (2d Cir. 1985). However, conclusory allegations that merely state the general legal conclusions necessary to prevail on the merits and are unsupported by factual averments will not be accepted as true. New York State Teamsters Council Health and Hosp. Fund v. Centrus Pharmacy Solutions, 235 F. Supp. 2d 123 (N.D.N.Y. 2002). 2. Choice of Law The parties assert that New York substantive law is applicable here (e.g., Docket No. 18, Def. Memo. at 1, 3, 4; Docket No. 21, Pl. Memo. at 5). Plaintiff Dr. Atwal is a New York resident (see Docket No. 1, Notice of Removal ¶¶ 10, 13-14) while ECL is a limited liability company organized under the laws of the State of North Carolina (id. ¶ 15). No one has invoked North Carolina law, however. As a removed diversity action, substantive law is governed by state law, see Erie R.R. v. Tompkins, 304 U.S. 64, 58 S.Ct. 817, 82 L.Ed. 1188 (1983), including choice of law. A federal court sitting in diversity applies the choice of law rules of the forum state, Klaxon v. Stentor Elec. Mfg. Co., 313 U.S. 487, 61 S.Ct. 1020, 85 L.Ed. 1477 (1941), here New York. The first step under New York choice of law rules is to determine if an actual conflict exists between laws of the jurisdictions, Matter of Allstate Ins. Co. (Stolarz), 81 N.Y.2d 219, 223, 597 N.Y.S.2d 904, 905 (1993). Choice of law analysis is unnecessary where there is no relevant conflict between the laws, see Zervos v. Trump, 171 A.D.3d 110, 128, 94 N.Y.S.3d 75, 88 (1st Dep’t 2019) (absent a showing of discernable difference in laws, no choice of law analysis is necessary); Alitalia Linee Aeree Italiane, S.p.A. v. Airline Tariff Pub. Co., 580 F. Supp. 2d 285, 293 n.1 (S.D.N.Y. 2008). Neither party disputes the applicability of New York substantive law, see Atwal v. NortonLifeLock, Inc., No. 20CV449, 2022 WL 327471, at *4 (Feb. 3, 2022) (Skretny, J.), or cites law other than New York’s (or federal cases construing New York law) is applicable. Therefore, this Court applies New York law to Dr. Atwal’s substantive claims. Next, this Court examines the elements of the disputed causes of action. 3. Negligent Misrepresentation under New York Law For Dr. Atwal’s Third Cause of Action, he pleads negligent misrepresentation under New York law by showing that Defendant had a duty, as a result of a special relationship, to give correct information; that Defendant made a false representation it knew or should have known was incorrect; that the information was known by Defendant to be desired by Plaintiff for a serious purpose; that Plaintiff intended to rely and act upon the representation; and that Plaintiff reasonably relied on it to his detriment, see Hydro Inv’rs, Inc. v. Trafalgar Power Inc., 227 F.3d 8, 20 (2d Cir. 2000) (citing New York law) (Docket No. 18, Def. Memo. at 3-4). To determine under New York law whether ECL has a special relationship to owe any duty to Dr. Atwal, the Second Circuit held that a fact finder consider three factors: “‘whether the person making the representation held or appeared to hold unique or special expertise; whether a special relationship of trust or confidence existed between the parties; and whether the speaker was aware of the use to which the information would be put and supplied it for that purpose.’ Suez Equity Investors, L.P. v. Toronto-Dominion Bank, 250 F.3d 87, 103 (2d Cir. 2001) (quotation marks and citation omitted),” Century Pac., Inc. v. Hilton Hotels Corp., No. 03 Civ. 8258 (SAS), 2004 WL 868211, at *8 (S.D.N.Y. Apr. 21, 2004). “A simple commercial relationship, such as that between a buyer and seller or franchisor and franchisee, does not constitute the kind of ‘special relationship’ necessary to support a negligent misrepresentation claim,” Century Pac., supra, 2004 WL 868211, at *8. Courts have found that a special relationship exists where “defendants sought to induce plaintiffs into a business transaction by making certain statements or providing specific information with the intent that plaintiffs rely on those statements,” id. (citations omitted). Determination of the existence of special relationship is “highly fact-specific and ‘generally not susceptible to resolution at the pleadings stage,’” id. (quoting Nasik Breeding & Research Farm Ltd. v. Merck & Co., 165 F. Supp. 2d 514, 536 (S.D.N.Y. 2001)). 4. Negligence under New York Law Under Dr. Atwal’s Fourth Cause of Action, he pleads negligence under New York law by alleging a duty owed by Defendant, breach of that duty, and suffering injury proximately resulting therefrom, e.g., Solomon by Solomon v. New York City, 66 N.Y.2d 1026, 1027, 499 N.Y.S.2d 392, 392 (1985) (Docket No. 18, Def. Memo. at 4-5). Further, under a well-established principle of New York law, “a simple breach of contract is not to be considered a tort unless a legal duty independent of the contract itself has been violated,” Clark-Fitzpatrick, Inc. v. Long Is. R.R., 70 N.Y.2d 382, 389, 521 N.Y.S.2d 653, 656 (1987) (citations omitted). This legal duty “must spring from circumstances extraneous to, and not constituting elements of, the contract, although it may be connected with and dependent upon the contract,” id. at 389, 521 N.Y.S.2d at 656-57 (citation omitted). 5. Unjust Enrichment The theory of unjust enrichment under New York law (as alleged in the Sixth Cause of Action here) is a quasi-contract imposed “by equity to prevent injustice, in the absence of an actual agreement between the parties concerned,” IDT Corp. v. Morgan Stanley Dean Witter & Co., 12 N.Y.3d 132, 142, 879 N.Y.S.2d 355, 361 (2009). This theory is not available to duplicate or replace a contract claim, Atwal v. NortonLifeLock, supra, 2022 WL 327471, at *11 (citations omitted). The existence of a valid and enforceable written contract ordinarily precludes recovery under an unjust enrichment theory, Clark- Fitzpatrick, supra, 70 N.Y.2d at 385, 389, 521 N.Y.S.2d at 656-57; IDT Corp., supra, 12 N.Y.3d at 142, 879 N.Y.S.2d at 361. A contract and unjust enrichment claim may be pled in the alternative until a contract is found, see Fed. R. Civ. P. 8(d)(2); Atwal v. NortonLifeLock, Inc., supra, 2022 WL 327471, at *11 (Docket No. 21, Pl. Memo. at 11). This alternative pleading is permitted “where the parties dispute the existence of contract or that the contract applies to the subject matter of the lawsuit,” id. (citations omitted). Unjust enrichment, however, is “not a catchall cause of action to be used when others fail,” Corsello v. Verizon N.Y., Inc., 18 N.Y.3d 777, 790, 944 N.Y.S.2d 732, 740 (2012). This claim is “available only in unusual situations when, though the defendant has not breached a contract or committed a recognized tort, circumstances create an equitable obligation running from the defendant to the plaintiff,” id. at 790, 944 N.Y.S.2d at 740; Atwal v. NortonLifeLock, Inc., supra, 2022 WL 327471, at *11. To state a claim under unjust enrichment, Plaintiff needs to allege that Defendant was enriched, at Plaintiff’s expense, and equity and good conscience do not permit Defendant to retain what is sought to be recovered, Mandarin Trading Ltd. v. Wilderstein, 16 N.Y.3d 173, 182, 919 N.Y.S.2d 465, 471 (2011). B. Parties’ Contentions ECL first argues that Dr. Atwal fails to state claims for negligent misrepresentation or negligence (in the Third and Fourth Causes of Action) because Dr. Atwal has not alleged an extra-contractual duty for tort liability and his losses were purely economic (Docket No. 18, Def. Memo. at 3-7), Clark-Fitzpatrick, supra, 70 N.Y.2d at 389, 521 N.Y.S.2d at 656-57. ECL contends that Dr. Atwal fails to allege distinct wrongful conduct not tethered to the Agreement (id. at 9). ECL next argues that, absent it owing a legal duty independent of a contract, the economic loss doctrine bars Dr. Atwal’s claims for negligent misrepresentation and negligence because Dr. Atwal has only alleged suffering economic loss and not injury to his person or property (id. at 7-8, citing, e.g., Ambac Assur. Corp. v. U.S. Bank Nat’l Ass’n, 328 F. Supp. 3d 141, 159 (S.D.N.Y. 2018); see also Docket No. 22, Def. Reply at 6-8). Next, ECL argues that Dr. Atwal fails to allege unjust enrichment in his Sixth Cause of Action because his allegations arose from the Agreement (a valid, written contract) and duplicating his breach of contract claims (Docket No. 18, Def. Memo. at 8-9). Dr. Atwal responds that he alleged claims in his Third, Fourth, and Sixth Causes of Action (see Docket No. 21, Pl. Memo. at 5-12). First, Dr. Atwal asserts that ECL had an independent duty beyond the Agreement to safeguard private, confidential information contained in the doctor’s medical and billing data (id. at 5-7). The mere existence of the Agreement does not extinguish ECL’s independent duty to act with reasonable care (id. at 7). ECL also owed a pre-contractual duty not to misrepresent its capabilities to obtain Dr. Atwal’s assent to the Agreement (id. at 7-9). Next, he denies the applicability of the economic loss doctrine for breached data security (id. at 10-11). Dr. Atwal asserts he makes a valid claim for unjust enrichment alternatively to his breach of contract claim (id. at 11-12). Here, Dr. Atwal believes that ECL was enriched when it collected monthly fees after he gave notice terminating the Agreement in April 2021 (id. at 12; see Docket No. 8, Compl. ¶¶ 7, 23, 38). Dr. Atwal later repeated requests for ECL’s cooperation in the transition to the new service provider but ECL failed to respond. This further enriched ECL during this transitional period. (Docket No. 21, Pl. Memo. at 12.) Finally, Dr. Atwal claims he pled entitlement to injunctive relief in the Seventh Cause of Action despite that not being a cause of action (id. at 13-14). He disclaims presently seeking preliminary relief thus making ECL’s Partial Motion to Dismiss premature (id. at 14). ECL replies that Dr. Atwal did not allege misrepresentations made prior to executing the Agreement to be actionable here (Docket No. 22, Def. Reply Memo. at 2), Century Pac., supra, 2004 WL 868211, at *8 (S.D.N.Y. Apr. 21, 2004). Further, Dr. Atwal has not alleged a special relationship with ECL (id.). ECL distinguish Dr. Atwal’s cited cases for negligence where those litigants either did not have a contract with the defendants or if they had a contractual relationship they did not center on protecting and securing data such as the Agreement here (id. at 4 & nn.2-3). This Court first addresses the injunctive relief sought in the Seventh Cause of Action. C. Dr. Atwal Alleges Injunctive Relief (Seventh Cause of Action) Both parties agree that injunctive relief is not a cause of action per se (Docket No. 21, Pl. Memo. at 13-14; see Docket No. 22, Def. Reply Memo. at 8; cf. Docket No. 18, Def. Memo. at 9-10 (arguing Dr. Atwal has not met high standard under Federal Rule of Civil Procedure 65 for injunctive relief)). Rather, it is a form of relief, compare Fed. R. Civ. P. 8(a)(2) (short statement of claim) with Fed. R. Civ. P. 8(a)(3) (demand for relief). Technically, the Seventh Cause of Action should be dismissed as a cause of action, Bristol Village, Inc. v. Louisiana-Pac. Corp., 916 F. Supp. 2d 357, 369 (W.D.N.Y. 2013) (Skretny, C.J.) (injunctions are remedies, not cause of action, duplicative of other substantive claims); Stewart v. Stewart, No. 18CV201, 2018 WL 11365079, at *21 (W.D.N.Y. Nov. 29, 2018) (Crawford, J.). Such a dismissal, however, does not deny or dismiss the remedy sought, see City of N.Y. v. A-1 Jewelry & Pawn, Inc., 247 F.R.D. 296, 353 (E.D.N.Y. 2007). Dr. Atwal does demand injunctive relief among his demands in the Complaint (Docket No. 8, Compl., at 16) so dismissal of the Seventh Cause of Action would not preclude injunctive relief. Imposition or denial of injunctive relief only arises upon Dr. Atwal moving for injunctive relief. Since Dr. Atwal has not sought preliminary injunction (Docket No. 21, Pl. Memo. at 14), this Court agrees that denying injunctive relief is premature, Chachkes v. David, No. 20-cv-2879 (LJL), 2021 WL 101130, at *14 (S.D.N.Y. Jan. 12, 2021). Thus, this Court grants in part ECL’s Partial Motion (Docket No. 18) dismissing the Seventh Cause of Action but not denying injunctive relief yet to be sought by Dr. Atwal. This Court next considers Dr. Atwal’s negligence claims. D. Dr. Atwal, However, Has Not Alleged Negligence and Negligent Misrepresentation (Fourth and Third Causes of Action) To state negligent conduct, Dr. Atwal must allege a legal duty extraneous to the Agreement he also claims ECL breached. Dr. Atwal, however, has not done so. Instead, he restates “albeit in slightly different language,” Clark-Fitzpatrick, supra, 70 N.Y.2d at 390, 521 N.Y.S.2d at 657, ECL’s unmet contractual obligations during and following the data breach. Here, the Agreement provided data protection and retention services. Where ECL allegedly failed to perform or deficiently performed these services (ordinarily instances of negligence in another context) breached the Agreement. Dr. Atwal has not alleged that ECL had an independent duty aside from the Agreement. Even the duty alleged to secure medical data consistent with HIPAA requirements (Docket No. 8, Compl. ¶ 12) was incorporated in the Agreement. Also incorporated in the BAA within this Agreement is the duty that ECL indemnify and hold Dr. Atwal harmless for losses from gross negligence (id. ¶ 16). The cases cited by Dr. Atwal for data breaches as negligence or creating an independent duty beyond the Agreement (see Docket No. 21, Pl. Memo. at 5, 11) are distinguishable, as asserted by ECL (Docket No. 22, Def. Reply Memo. at 4 nn.2, 3). None of the litigants in those cases were contractors offering data protection, e.g., Wallace v. Health Quest Sys., Inc., No. 20 CV 545, 2021 WL 1109727, at *9, 1 (S.D.N.Y. Mar. 23, 2021) (customers or patients of defendant’s healthcare facilities) (cf. Docket No. 21, Pl. Memo. at 5, 11), or did not involve a contract with the plaintiffs, e.g., Toretto v. Donnelley Fin. Servs., 583 F. Supp. 3d 570, 595 (S.D.N.Y. 2022) (plaintiff alleged third- party beneficiaries to financial services agreements) (cf. Docket No. 21, Pl. Memo. at 5, 11). Dr. Atwal cites Hoffmann v. Major Model Management, Inc., No. 20-CV-6941, 2022 WL 992795, at *1, 4 (S.D.N.Y. Mar. 31, 2022) (id. at 5, 11), where the court held that contract fashion model Stephanie Hoffmann abandoned her breach of contract claim. Further, the defendant argued Hoffmann had not identified contractual provisions that were breached. The agreement there also was silent on defendant’s alleged duty to safeguard Hoffmann’s personally identifiable information. Id. at *4. The court concluded that Hoffmann was not seeking enforcement of the bargain, so her claims were only for negligence, id. Thus, there were not dual contract and negligence allegations. Dr. Atwal also cites two cases where applicants submitted personal information to obtain financial services where defendants pledged to protect that information, Jones v. Commerce Bancorp, Inc., No. 06 Civ. 835 (HB), 206 WL 1409492, at *2 (S.D.N.Y. May 26, 2006) (opening checking account) (Docket No. 21, Pl. Memo. at 5, 11); Daly v. Metropolitan Life Ins. Co., 4 Misc. 3d 887, 893, 782 N.Y.S.3d 530, 535 (Sup. Ct. N.Y. Cnty. 2004) (obtaining life insurance coverage) (id. at 5). In Daly, the court addressed what was termed “the emergence of identity theft as one of this country’s growing concern,” a new area of law in 2004, “namely the duties and responsibilities incidental to the safeguarding of confidential personal information,” Daly, supra, 4 Misc. 3d at 888, 782 N.Y.S.2d at 532. There, Sara Daly sued alleging negligence, id., at 890, 891, 782 N.Y.S.2d at 533, 534, and not breach of contract. This duty is derived from implied covenant of trust and confidence, id. at 892, 782 N.Y.S.2d at 535 (quoting Doe v. Community Health Plan—Kaiser Corp., 268 A.D.2d, 183, 187, 709 N.Y.S.2d 215, 217-18 (3d Dep’t 2000)). Metropolitan Life acknowledged this duty by issuing a privacy notice (as was later done by Commerce Bancorp in Jones) stating that it took good care of customer’s private information, id. at 893, 782 N.Y.S.2d at 535-36. Thus, there were not both contractual and tort duties alleged. Meanwhile, in Jones, Keisha Jones sued pro se, Jones, supra, 2006 WL 1409492, at *1. Among various claims, Jones alleged that Commerce Bancorp breached the contract and was negligent in allowing her personal data to be released to allow her funds to be withdrawn from her Commerce Bancorp bank account, id. On Commerce Bancorp’s Motion to Dismiss, the United States District Court for the Southern District of New York gave liberal construction to Jones’ pro se Complaint, concluding that she alleged negligence, id. at *2-3, and a breach of contract claim, id. at *4. The court held that she alleged that Commerce Bancorp was negligent in failing to prevent the theft of personal identifying information, id. at *2-3. The independent duty thus alleged here is to prevent the disclosure of personal information, see id. at *2 (citing Daly, supra, 4 Misc. 3d at 893, 782 N.Y.S.2d at 535). As for her contract claim, Jones claimed a pamphlet entitled “Booklet with Deposit Rules, Regulations, Disclosures and Privacy Notice” issued by Commerce Bancorp was a contract that the bank breached. Commerce Bancorp did not challenge the existence of a “contract” from its privacy policy statement, id. at *4 (quotation marks in original). Again liberally construing her pro se contract claim while not questioning whether that pamphlet was in fact a contract, the court found that Jones alleged a contract claim, id. Commerce Bancorp argued that it refunded Jones’ losses thus did not allege a claim, id. Thus, the court concluded that Jones alleged these two causes of action without the court declaring distinct tort and contract duties or discussing the requirement that the negligence claim have an independent duty from the contract. There also was no indication that Commerce Bancorp’s booklet was incorporated into a contract with Jones. Therefore, Jones and Daly are distinguishable because they either do not present (or definitively present) breach of a contract to secure private personal information with allegations of negligence and violation of an independent duty owed by the contractor to the litigants. Jones may not involve a contract at all (with the court accepting the pro se plaintiff’s uncontested allegation of the existence of the contract) while Daly only alleged negligence. Dr. Atwal’s claims are like those in Alitalia Linee Aeree Italiane, S.p.A. v. Airline Tariff Pub. Co., 580 F. Supp. 2d 285 (S.D.N.Y. 2008), involving a data bank participation agreement for airlines. Plaintiff airline Alitalia entered a Data Bank Participation Agreement with defendant Airline Traffic Publishing Company (“ATPCO”), 580 F. Supp. 2d at 286-87. ATPCO’s contract contained a limitation of liability clause where ATPCO did not warrant the accuracy of data, id. at 287. Alitalia sued ATPCO when ATPCO imputed errors in ticket pricing, id. at 288, seeking revenue losses from ATPCO’s mistakes, id. at 289. Alitalia claimed this mistake was a breach of contract but denied the applicability of the limitation of liability clause, id. Furthermore, Alitalia alleged that ATPCO owed a fiduciary duty independent of the data bank contract and breached that duty, id. The airline also claimed gross negligence given ATPCO’s repeated data entry mistakes with Alitalia and other airlines, id. On the negligence claim, the district court rejected Alitalia’s claim because it did not allege a duty distinct from or in addition to its contract claim, id. at 293. In the absence of a contract, ATPCO had no duty to enter data (or to do so accurately) to make it liable for negligent entry, id. “the standard of care governing the entry of data is solely a function of a private bargain between sophisticated parties” where they could assess the value of the date, consequences of error, and pricing “to meet the contractual standard,” id. The court concluded there “that plaintiff’s claims are premised solely upon a contractual duty,” apply that content’s limitation of liability provision, id. The court then held that the coding errors were not gross negligence under a more exacting standard for sophisticated contractual parties, id. at 294. Here, ECL’s duty and the manner it furnished data services arises solely from the Agreement with Dr. Atwal. Dr. Atwal has not shown an independent or additional duty aside from the Agreement for ECL’s tort liability. Thus this Court grants ECL’s Partial Motion (Docket No. 17) to dismiss the Fourth Cause of Action alleging negligence without a duty independent from compliance with the Agreement. Dr. Atwal’s negligent misrepresentation claims (see Docket No. 8, Compl. ¶¶ 9-11) also revolve around the terms of the Agreement that he argues elsewhere were breached. He does not allege that these representations were made by ECL to induce him to enter into the Agreement which would make these statements actionable as negligent misrepresentation. Thus, this Court grants ECL’s Partial Motion (Docket No. 17) to dismiss the Third (negligent misrepresentation) Cause of Action. With this disposition, this Court need not address whether Dr. Atwal’s claims also are barred by the economic loss doctrine. E. Unjust Enrichment (Sixth Cause of Action) Dr. Atwal alleges two sources for unjust enrichment by ECL. One was the invoices ECL submitted that exceeded what the doctor believed he owed under the Agreement. The second was ECL’s continued billing after Dr. Atwal gave notice of the termination of the Agreement. ECL argues that the invoice dispute is a duplicate of Dr. Atwal’s breach of contract claim (see Docket No. 18, Def. Memo. at 9). Dr. Atwal counters that ECL has not acknowledged that the Agreement controls (Docket No. 21, Pl. Memo. at 12). This Court concludes that alleged overbilling in ECL’s invoices is distinct from the breaches of contract alleged in the First Cause of Action. Equitably, ECL should not overcharge for services rendered. The breach of contract, however, alleged in the Complaint (see Docket No. 8, Compl. ¶ 54) focuses upon ECL’s performance of the substance of the Agreement. Neither party cites to the Agreement’s fee provisions and no one attached a copy of the Agreement as an exhibit to the Complaint. From these pleadings, it is unclear that a valid, written contract governs the fee structure to determine if the breach of contract claims include this overcharging, see IDT Corp., supra, 12 N.Y.3d at 142, 879 N.Y.S.2d at 361 (cf. Docket No. 18, Def. Memo. at 8-9). At this pleadings stage, Dr. Atwal has alleged a quasi-contract claim to recover the overage of the difference between the correct fee and the amount billed. This can be pled in the alternative until a contract is found or (as applicable here) provisions in the Agreement for billing and payment for ECL’s services are produced. As for the termination of the Agreement, while Dr. Atwal followed its terms, ECL does not argue that this claim falls under the breach of the Agreement. But Dr. Atwal alleges as an example of a breach of contract the failure of ECL to assist in the transition from ECL to a new provider (see Docket No. 8, Compl. ¶ 54(k)). Unlike invoices and billing, this claim is addressed in an enforceable, written contract. Unjust enrichment claims for whatever ECL earned following Dr. Atwal’s termination duplicates his breach of contract claim. Thus, this Court grants so much of ECL’s Partial Motion (Docket No. 17) to dismiss this portion of Dr. Atwal’s claims arising out of termination. ECL’s Partial Motion (id.) thus is granted in part, denied in part. With this treatment of the Sixth Cause of Action, Dr. Atwal’s allegations there are sufficiently distinct to not require repleading to eliminate the unjust enrichment following termination of the Agreement. IV. Conclusion Upon consideration of the causes of action subject to this Partial Motion to Dismiss, first, injunctive relief is not a cause of action but may be alleged as relief sought. Dr. Atwal has not alleged a duty independent from ECL’s contractual duty to state his negligence claims. Further, his unjust enrichment claim arising from the termination of the Agreement repeats what is alleged in Dr. Atwal’s breach of contract claims. Therefore, this Court grants Defendant ECL’s Partial Motion to Dismiss Dr. Atwal’s Third, Fourth, and Seventh Causes of Action and so much of his Sixth Cause of Action alleging unjust enrichment following termination of the Agreement (the last being duplicative of his pending breach of contract claims). This case thus proceeds on Dr. Atwal’s First and Second Causes of Action alleging breach of contract and declaratory judgment, the remainder of his Sixth Cause of Action (Dr. Atwal’s invoice overbilling dispute), and the injunctive relief sought in his ad damnum clause (since Dr. Atwal has yet to seek a preliminary injunction). Defendant ECL Group shall answer these claims within 14 days of entry of this Decision. V. Orders IT HEREBY IS ORDERED, that the Partial Motion to Dismiss (Docket No. 17) of Defendant ECL Group, LLC, is GRANTED IN PART (dismissing the Third, Fourth, Seventh, and so much of the Sixth Causes of Action as described above) and DENIED IN PART (denying dismissal of the remainder of the Sixth Cause of Action and injunctive relief). FURTHER, that ECL Group, LLC, shall answer these remaining allegations (as well as the First, Second, and Fifth Causes of Action not subject to Defendant’s Partial Motion) in the Complaint within 14 days of entry of this Decision. SO ORDERED. Dated: July 31, 2022 Buffalo, New York s/William M. Skretny WILLIAM M. SKRETNY United States District Judge