DocketNumber: Case No. 3:17-cv-892-J-34PDB
Citation Numbers: 347 F. Supp. 3d 1047
Judges: Howard
Filed Date: 9/28/2018
Status: Precedential
Modified Date: 7/25/2022
THIS CAUSE is before the Court on the Motion to Dismiss (Doc. 41, StreamlineMD Motion), filed on November 17, 2017, by Defendants StreamlineMD LLC, Sean M. Mullen, and Harry C. Curley (collectively the "StreamlineMD Defendants"). There, the StreamlineMD Defendants assert that several claims alleged by the Plaintiff, St. Johns Vein Center, Inc., (SJVC), in its Second Amended Complaint, see Doc. 27, Second Amended Complaint for Damages and Injunctive Relief (SA Complaint), filed October 18, 2017, should be dismissed for failure to state a claim upon which relief can be granted. See StreamlineMD Motion at 3. Also before the Court is Defendant CVDJBA, LLC's Motion to Dismiss (Doc. 42, CVDJBA Motion), filed on November 17, 2017, in which CVDJBA seeks dismissal of Count IV of the SA Complaint for lack of personal jurisdiction as well as for failure to state a claim upon which relief can be granted. See CVDJBA Motion at 8. Plaintiff opposes both motions. See St. Johns Vein Center, Inc.'s Response and Memorandum in Opposition to Defendants' Motion to Dismiss (Doc. 46, SJVC Response to StreamlineMD), and St. Johns Vein Center, Inc.'s Response and Memorandum of Law in Opposition to CVDJBA's Motion to Dismiss (Doc. 47, SJVC Response to CVDJBA), both filed December 15, 2017. With leave of Court, CVDJBA, LLC filed a reply to SJVC's Response to CVDJBA. See Defendant CVDJBA, LLC's Reply Memorandum in Support of Dispositive Motion to *1052Dismiss (Doc. 51, CVDJBA's Reply), filed January 5, 2018. Accordingly, this matter is ripe for review.
I. STANDARD OF REVIEW
In ruling on a motion to dismiss, the Court must accept the factual allegations set forth in the complaint as true. See Ashcroft v. Iqbal,
Additionally, in considering a motion to dismiss for lack of personal jurisdiction under Rule 12(b)(2), Federal Rule of Civil Procedure (Rule(s) ), the "plaintiff seeking the exercise of personal jurisdiction over a nonresident defendant bears the initial burden of alleging in the complaint sufficient facts to make out a prima facie case of jurisdiction." See United Techs. Corp. v. Mazer,
*1053A plaintiff makes a prima facie showing by presenting evidence sufficient to withstand a motion for directed verdict on the issue of personal jurisdiction. Morris v. SSE, Inc.,
In accordance with this legal framework, the Court will summarize the facts alleged in the SJVC's SA Complaint, along with the relevant competing evidence put forth by CVDJBA as to the question of personal jurisdiction, all the while construing the alleged facts and evidence in favor of the non-moving plaintiff. Morris,
II. BACKGROUND
This controversy arises out of negotiations between the parties to this action to enter into a business venture that was never fully actualized. Plaintiff, SJVC, asserts that in the course of the parties' negotiations for the new business venture, Defendants, by virtue of a computer information management system, unlawfully gained access to SJVC's trade secrets, and ultimately used that protected information to exclude SJVC from the venture, and to compete against it.
SJVC is a Florida corporation with its principal place of business in Jacksonville, FL. SA Complaint at ¶ 1. Its business focuses on "diagnosing and treating vein conditions" and it is "one of only six Intersocietal Accreditation Commission-accredited vein centers in the State of Florida, and the only one in Northeast Florida for superficial venous evaluation and treatment." Id. at ¶ 10-11. In June of 2011, SJVC entered into a Service Agreement with StreamlineMD, an Ohio corporation that "offers cloud-based, clinical workflow and revenue cycle management technology and services tailored to meet the specific needs of" medical specialists like SJVC. Id. at ¶¶ 2, 12, 14.
*1054"provides physicians with a license to use its cloud-based integrated software platform to upload a physician's financial and performance data, which the physician can then use to generate reports and other documents on practice management, revenue cycle management, and billing in order to enhance his or her practice." Id. at ¶ 13.
Pursuant to the terms of the Service Agreement between SJVC and StreamlineMD, SJVC paid StreamlineMD a recurring fee for "a license to use Streamline MD's software and access StreamlineMD's database and information management systems." Id. at ¶ 14. SJVC used StreamlineMD's system for all aspects of its practice, except for patient billing. Id. at ¶ 16. Thus SJVC "used the software and services to generate reports containing significant confidential data and trade secret information belonging to [SJVC], including without limitation, the following: confidential patient information, procedures per month, finances (including reimbursement), insurance payment schedules, and patient demographics (collectively, the 'Protected Information.')." Id. The Service Agreement also granted StreamlineMD a license to "use only a few specific types of [SJVC's] data housed within StreamlineMD's software: aggregate, de-identified portions of [SJVC's] data for use only in the design, evaluation and operation of StreamlineMD's services, research, development and marketing ...." Id. at ¶ 17. However, as alleged by SJVC, nothing within the Service Agreement "afforded StreamlineMD, Mullen [as President of StreamlineMD], Curley [as CEO of StreamlineMD], or any other StreamlineMD employee authorization to access Plaintiff's Protected Information." Id. Nonetheless, SJVC asserts that "Mullen and Curley directly (or indirectly, through other StreamlineMD employees) accessed the Protected Information, reviewed it, and used it for their own personal benefit." Id. at ¶ 18.
SJVC alleges that between mid-2015 and into 2016, Mullen and Curley, and James A. Heinz, President/CEO of CVDJBA, an Arizona company,
SJVC asserts that throughout its relationship with StreamlineMD, and during its discussions with Mullen, Curley, and Heinz regarding the new business venture, the StreamlineMD Defendants exercised unauthorized access to SJVC's Protected Information by virtue of the 2011 Service Agreement. Id. at ¶¶ 18, 22-23, 24, 31, 33. SJVC further alleges that Mullen and Curley shared this information with Heinz. Id. at ¶¶ 25, 32, 33, 40. According to SJVC, the StreamlineMD Defendants did so with the purpose of gaining information about SJVC's practice so that upon establishing the new consolidated medical practice, the Defendants would be better poised to compete with and isolate SJVC. Id. at ¶¶ 18, 22, 24, 30-31, 34, 38-39. Moreover, SJVC alleges that to the extent that it shared its Protected Information with the Defendants in order to further the new business venture, SJVC did so without knowing that the Defendants sought its information solely for the purpose of using that information to compete against SJVC, and never with the intent to include SJVC in the new consolidated medical practice. Id. at ¶¶ 22, 32, 39, 41.
SJVC subsequently initiated the instant action against StreamlineMD, Mullen, Curley, and CVDJBA. In its SA Complaint, SJVC asserts six claims. In Count I, it alleges that the StreamlineMD Defendants violated the Computer Fraud and Abuse Act,
III. ARGUMENTS OF THE PARTIES
In the StreamlineMD Motion, the StreamlineMD Defendants move to dismiss Counts I, II, III, IV, and V of SJVC's SA Complaint for failure to state claims for which relief can be granted. As to Counts I and II, the StreamlineMD Defendants assert that SJVC failed to sufficiently allege that it suffered statutory losses as defined and required by the CFAA. See StreamlineMD Motion at 4-9. In seeking to dismiss Count III, the StreamlineMD Defendants assert that because SJVC failed to allege that the Defendants had "storage of emails or electronic communications on their servers," or that they "accessed electronic communications without authorization,"
In response, SJVC argues that as to both Counts I and II, it has sufficiently alleged losses as required under the CFAA. See SJVC Response to StreamlineMD at 3-8. In terms of Count III, SJVC asserts that "[t]he entire StreamlineMD system was set up to allow the exchange and storage of various electronic communications,"
In the CVDJBA Motion, CVDJBA first asserts that SJVC's action against it should be dismissed for lack of personal jurisdiction. In this context, CVDJBA contends that all the contacts and interactions that its President and CEO, Heinz, had with St. George and SJVC, were on behalf of business entities distinct and entirely separate from CVDJBA. Hence, CVDJBA argues that SJVC's claims against it are misplaced because CVDJBA has had no contact with the state of Florida warranting its jurisdictional power over CVDJBA. CVDJBA Motion at 8, 10-28. Additionally, CVDJBA raises substantive challenges to the sufficiency of SJVC's trade secrets claim. First, CVDJBA asserts that SJVC's claim for damages or attorney's fees is misplaced.
In response to the CVDJBA Motion, SJVC contends that the Court does have personal jurisdiction over CVDJBA, and that contrary to CVDJBA's assertions, it did, through Heinz, have sufficient contacts with Florida to justify the exercise of personal jurisdiction over it. SJVC Response to CVDJBA at 2-14. SJVC also argues that in its SA Complaint it has sufficiently alleged that CVDJBA, through the actions of Heinz in conjunction with the StreamlineMD Defendants, stole its trade secrets.
In its Reply, CVDJBA argues that any misunderstanding or misconceptions SJVC held regarding the representative capacity in which Heinz met with SJVC are insufficient to establish personal jurisdiction over CVDJBA. Rather, as asserted by CVDJBA, all of the pertinent interactions and transactions that took place with respect to the instant controversy were between the SJVC and other business entities with which Heinz is associated.
IV. DISCUSSION
a. Counts I & II: CFAA claim against the StreamlineMD Defendants
In Counts I and II, SJVC asserts that the StreamlineMD Defendants violated
*1058Here SJVC asserts a right to pursue the civil claims in Counts I and II as a plaintiff who has suffered a "loss to 1 or more persons during any 1-year period ... aggregating at least $5,000 in value."
In this regard, the StreamlineMD Defendants assert that SJVC's allegations regarding its losses are insufficient, and therefore, both Counts I and II must be dismissed. In particular, the StreamlineMD Defendants contend that in order to state a claim under the CFAA, a plaintiff must allege that it suffered losses as a result of an interruption of services, see
The Eleventh Circuit Court of Appeals addressed the interpretation of the definition of loss in
(1) reasonable costs incurred in connection with such activities as responding to a violation, assessing the damage done, and restoring the affected data, program system, or information to its condition prior to the violation; and (2) any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service. The statute is written in the disjunctive, making the first type of loss independent of an interruption of service.... "Loss" includes the direct costs of responding to the violation in the first portion of the definition, and consequential damages resulting from interruption of service in the second.
*1059TEC Serv, LLC v. Crabb, No. 11-62040-CIV-DIMITROULEAS/SNOW,
SJVC's SA Complaint is by no means a model of clarity, and contains many allegations that do not fall within the scope of the CFAA. Throughout the facts section of SJVC's SA Complaint, SJVC details its initial business relationship with StreamlineMD, and the terms of the Service Agreement between the two. SA Complaint at ¶¶ 14-17. In the facts section of the SA Complaint, SJVC also details interactions between SJVC and the Defendants in the course of the parties' attempt to enter into a new business venture, along with multiple actions SJVC took to facilitate its integration into the new company, many at the behest of the Defendants. Id. at ¶¶ 19-21, 26, 29, 32, 36, 39, 41. However, the only statement within the facts section that references any direct action SJVC took upon discerning that the Defendants had allegedly accessed SJVC's information in an unauthorized manner is that SJVC "complained and asked [Mullen and Curley] not to use its Protected Information to compete." Id. at ¶ 38. Otherwise, the facts section of the SA Complaint does not contain any specific allegations regarding the losses SJVC suffered as a result of the StreamlineMD Defendants' alleged unauthorized access of its information, or the actions SJVC took in response to that alleged unauthorized access.
However, within its specific allegations for Counts I and II, SJVC provides additional allegations. In relation to Count I, SJVC asserts that it has suffered damages and losses
in excess of $5,000 over a one-year period, among other reasons, because, the integrity of Plaintiff's computer system, its license to use StreamlineMD's software, and its property interest in its Protected Information therein were impaired by StreamlineMD, Curley and Mullen's unauthorized access to the Protected Information and use of it for their own personal gain.
Id. at ¶ 47. SJVC further asserts its
damages include money Plaintiff paid at the direction of [Mullen and Curley], lost time and effort and distraction from Plaintiff's practice, lost time and effort needed to take subsequent remedial measures to prevent a breach of access from occurring again, lost Protected Information, damages to Plaintiff's reputation, and the loss of future income to Plaintiff.
Id. at ¶ 48. Likewise, in relation to Count II, SJVC describes that its losses exceeded $5000 over a one year period because
Plaintiff's work through its primary doctor, Dr. St. George, was interrupted for weeks in trying to understand and work with [Mullen and Curley]; [Mullen and Curley] requested changes to Plaintiff's billing practices asking Plaintiff to move all of Plaintiff's billing to StreamlineMD, which Plaintiff did; and where, because of the complexity of the licensed software StreamlineMD provided, and the disruption to Plaintiff from the intended participation in [the new business venture], Plaintiff's revenues diminished; Plaintiff needed to obtain new experts and software licenses; and the day-to-day of Plaintiff's practice was and is disrupted and interfered with due to [Mullen and Curley's] unauthorized access to the Protected Information and use of it for their own personal gain.
*1060...
Plaintiff had to devote substantial resources to managing its financial data, including appointment scheduling, paying accountants, service identification, HIPPA protected records, and billing, and suffered impairment to its reputation and goodwill, lost revenues, and lost or delayed critical data as a result of StreamlineMD and [Mullen and Curley's] unauthorized access to Plaintiff's Protected Information. [Mullen and Curley] and CVDJBA insisted that Plaintiff transfer its billing practices to StreamlineMD, and thereafter, clearly having reviewed those client files in some form, proposed changes and clarifications. In doing so, Heinz of CVDJBA worked with StreamlineMD to obtain and manipulate the data from Plaintiff.
...
Plaintiff incurred substantial expenses both in its internal changes made because of these incursions and unauthorized access, and in other expenses in responding to the Defendants' unauthorized access and use and assessing the scope of intrusion and extent of damages to its computer systems (and Plaintiff's management practices contained therein) caused by the Defendants' actions.
Id. at ¶¶ 53-55.
First, it is important to note that nowhere within SJVC's allegations does it assert that it suffered an interruption of service as a result of the StreamlineMD Defendants' alleged intentional and unlawful access of SJVC's Protected Information on its computers. Therefore, SJVC's claimed losses must fall within the first category of losses described in
Upon review of SJVC's SA Complaint, the Court observes that many of SJVC's claimed losses have nothing to do with the costs it may have incurred in responding to the StreamlineMD Defendants' alleged offenses under the CFAA, or in conducting a damage assessment, or in restoring its data, programs, systems, and information to their condition prior to the offense.
weeks in trying to understand and work with [Mullen and Curley]; [Mullen and Curley] requested changes to Plaintiff's billing practices asking Plaintiff to move all of Plaintiff's billing to StreamlineMD, which Plaintiff did; and where, because of the complexity of the licensed software StreamlineMD provided, and the disruption to Plaintiff from the intended participation in [the new business venture] Plaintiff's revenues diminished.
Having culled much of the chaff from SJVC's allegations of loss, there nonetheless remain a few strands of wheat. At least two of the remaining allegations of loss plausibly appear to fall within the definition of loss under
*1062
SJVC's allegations of loss are by no means robust. And without question, in further proceedings, SJVC bears the burden of substantiating these allegations with evidence.
*1063Ferring Pharm. Inc. v. Watson Pharm., Inc., No. 2:12-cv-05824,
Accordingly, drawing all reasonable inferences in SJVC's favor, as the Court must, the Court determines that at this stage of the proceedings, SJVC has sufficiently plead losses pursuant to
b. Count III: ECPA claim against Mullen and Curley
In Count III, SJVC asserts that Mullen and Curley violated Title II of the ECPA,
In advocating that the Court dismiss this claim, Mullen and Curley argue that SJVC has failed to sufficiently allege that the men accessed electronic communications belonging to SJVC, or that they did so through an electronic communications system. Particularly relevant here is whether the StreamlineMD information management system, which contained SJVC's Protected Information, and from which Mullen and Curley allegedly unlawfully accessed SJVC's Protected Information, constitutes an "electronic communications service" under the ECPA.
The ECPA defines an "electronic communication service" as "any service which provides to users thereof the ability to send or receive wire or electronic communications."
Courts that have examined the scope and application of the ECPA in the context of "electronic communications services" have done so primarily in factual settings related to unlawfully intercepted and obtained e-mails, telephone calls, and communications exchanged on internet websites, electronic bulletin boards, and dropbox systems.
As noted earlier, in its SA Complaint, SJVC describes the StreamlineMD information management system as a "cloud-based integrated software platform [to which a physician can] ... upload a physician's financial and performance data, which the physician can then use to generate reports and other documents on practice management, revenue cycle management, and billing in order to enhance his or her practice." Id. at ¶ 13. More specifically, SJVC alleges StreamlineMD granted it a license to "use StreamlineMD's software and access StreamlineMD's database and information management systems in exchange for a recurring fee." Id. at ¶ 14. Additionally, SJVC alleges that,
StreamlineMD's clinical electronic medical record software and services, along with related practice management software, helped and managed all aspects of *1065Plaintiff's practice, except patient billing. With the license afforded by the Service Agreement, Plaintiff used the software and services to generate reports containing significant confidential data and trade secret information belonging to Plaintiff, including, without limitation, the following: confidential patient information, procedures per month, finances (including reimbursement), insurance payment schedules, and patient demographics (collectively, the "Protected Information"). All aspects of Plaintiff's financial, patient/patient scheduling, medical record and referring physician data were contained within the software and system licensed to Plaintiff by StreamlineMD.
Id. at ¶ 16.
SJVC's allegations regarding the StreamlineMD information management system describe a service through which SJVC was able to gain access to its information which was stored in electronic databases managed and maintained by StreamlineMD. However, nothing within these allegations suggests a system through which SJVC transmitted or received electronic communications. Rather, all the allegations discuss SJVC's electronic access and use of information, rather than the transmission or receipt of information. Further, while SJVC suggests that aspects of the StreamlineMD information management system included "electronically billing patients, scheduling patient appointments, and patient online bill pay," SJVC Response to StreamlineMD at 6, SJVC does not allege how this aspect of the StreamlineMD information management system resulted in electronic communications. In sum, SJVC does not allege any facts suggesting that the StreamlineMD information management system is the equivalent or similar to "traditional electronic communication services." Nor has it identified any legal authority suggesting that an information management system like that of StreamlineMD constitutes an electronic communication service. Moreover, the authority cited by the Court above directs a contrary conclusion. As such, the Court is not persuaded that SJVC has sufficiently alleged the existence of an electronic communications service that could have been accessed by the named Defendants.
Finally, to the extent that SJVC alleges that Mullen and Curley "obtain[ed] access to electronic communications information while such communications were in electronic storage in that database," SA Complaint at ¶ 57, this allegation is purely conclusory and merely paraphrases the statutory language of
With regard to Count III of the SA Complaint, the Court determines that SJVC has failed to allege the requisite elements of a claim under the ECPA. Therefore the StreamlineMD Motion is due to be granted to the extent that Count III of the SA Complaint will be dismissed for failure to state a claim.
c. Counts IV and V: Theft and Misappropriation of Trade Secrets claims
In Counts IV and V, SJVC alleges theft and misappropriation of trade secrets *1066claims. Specifically, in Count IV, SJVC asserts that all of the Defendants (the StreamlineMD Defendants and CVDJBA) stole its trade secrets in violation of Florida Statutes section 812.081.
In response to Count IV, all of the Defendants assert that SJVC has failed to state a claim upon which relief can be granted because it has not sufficiently alleged the existence of a trade secret. See StreamlineMD Motion at 11-12; CVDJBA Motion at 31-32.
However, before the Court can address whether SJVC sufficiently pled the existence of a trade secret, the Court must resolve CVDJBA's challenge to the existence of personal jurisdiction over it for purposes of Count IV of the SA Complaint. "As a general rule, courts should address issues relating to personal jurisdiction before reaching the merits of a plaintiff's claims." Republic of Panama v. BCCI Holdings (Luxembourg) S.A.,
In seeking to dismiss Count IV, CVDJBA asserts, in part, that the Court lacks personal jurisdiction over it. Generally, CVDJBA argues that SJVC mistook any communications and meetings it had with Heinz regarding the new business *1067venture as exercised on behalf of CVDJBA, a company for which Heinz serves as President and CEO, rather than on behalf of two other business entities for which Heinz was in fact acting. CVDJBA Motion at 8-9. Otherwise, CVDJBA asserts that it has no connections whatsoever with the state of Florida, has no business activities in the state, has not committed any tortious act in Florida, and thus cannot be haled into courts in Florida. CVDJBA Motion at 10-28. In response, SJVC counters that Heinz's presence and contacts with the state of Florida were on behalf of CVDJBA and were sufficient to warrant the Court's exercise of personal jurisdiction over the company. SJVC Response to CVDJBA at 1.
As referenced earlier in the Order, in ruling on a motion to dismiss for lack of personal jurisdiction, a district court has discretion to conduct an evidentiary hearing. See Delong Equip. Co. v. Wash. Mills Abrasive Co.,
In order to determine whether personal jurisdiction exists over CVDJBA, the Court must engage in a two-part inquiry. See Mut. Serv. Ins. Co. v. Frit Indus., Inc.,
Turning to the first prong of the analysis, Florida's long-arm statute - Florida Statutes section 48.193 - confers two types of jurisdiction. See NW Aircraft Capital Corp. v. Stewart,
Here, SJVC alleges
Defendants are subject to the personal jurisdiction of this Court pursuant to:
*1068...Fla. Stat. § 48.193 (1)(a), because Defendants have conducted, engaged in and carried out a business venture within the State of Florida; ...Fla. Stat. § 48.193 (1)(b), because Defendants have committed tortious acts within the State of Florida; and ...Fla. Stat. § 48.193 (2), because Defendants are engaged in substantial business activities within the State of Florida.
SA Complaint at ¶ 7.
The Court begins with SJVC's assertion that specific jurisdiction exists over CVDJBA because it committed a tortious act within the state. See FLA. STAT. ANN. § 48.193(1)(a)(2). As noted earlier, the Florida long-arm statute provides in pertinent part:
(1)(a) Any person, whether or not a citizen or resident of this state, who personally or through an agent does any of the acts enumerated in this subsection thereby submits himself or herself and, if he or she is a natural person, his or her personal representative to the jurisdiction of the courts of this state for any cause of action arising from the doing of any of the following acts:
...
2. Committing a tortious act within this state.
FLA. STAT. ANN. § 48.193(1)(a)(2). In order for the Court to address whether the allegations in SJVC's SA Complaint support jurisdiction in Florida on the basis that CVDJBA committed a tortious act here, the Court must first determine whether SJVC has pled a claim for theft of trade secrets against CVDJBA that is facially plausible. See PVC Windoors, Inc. v. Babbitbay Beach Constr., N.V.,
Florida law defines a trade secret as
the whole or any portion or phase of ... compilation of information which is for use, or is used, in the operation of a business and which provides the business an advantage, or an opportunity to obtain an advantage, over those who do not know or use it. The term includes any scientific, technical, or commercial information, including financial information, and includes any design, process, procedure, list of suppliers, list of customers, business code, or improvement thereof. Irrespective of novelty, invention, patentability, the state of the prior art, and the level of skill in the business, art, or field to which the subject matter pertains, a trade secret is considered to be:
1. Secret;
2. Of value;
3. For use or in use by the business; and
4. Of advantage to the business, or providing an opportunity to obtain an advantage, over those who do not know or use it
when the owner thereof takes measures to prevent it from becoming available to persons other than those selected by the owner to have access thereto for limited purposes.
FLA. STAT. ANN . § 812.081(1)(c). See also Del Monte Fresh Produce Co. v. Dole Food Co., Inc.,
few specific types of Plaintiff's data housed within StreamlineMD's software: aggregate, de-identified portions of Plaintiff's data for use only in the design, evaluation and operation of StreamlineMD's services, research, development and marketing; nothing more. Neither this limited license for limited use of certain data belonging to Plaintiff, nor any other provision in the Service Agreement or the Business Associate Agreement afforded StreamlineMD, Mullen, Curley, or any other StreamlineMD employee authorization to access Plaintiff's Protected Information.
SA Complaint at ¶ 17.
Upon consideration of the SA Complaint, the Court determines that SJVC's allegations lay the beginnings of a foundation for an allegation of protected trade secrets, but go no further. SJVC has alleged that its Protected Information includes confidential patient information, which can fall within the definition of a trade secret. See e.g. AR2, LLC v. Rudnick, No. 14-80809-CIV,
*1070Audiology Distrib., LLC v. Simmons, No. 8:12-cv-02427-JDW-AEP,
Significantly, SJVC's SA Complaint is devoid of any allegations that SJVC took "measures to prevent [its Protected Information] from becoming available to persons other than those selected by the owner to have access thereto for limited purposes." See FLA. STAT. ANN . § 812.081(1)(c). At most, SJVC alleges that neither the limited license it gave StreamlineMD for use of certain data "nor any other provision in the Service Agreement or the Business Associate Agreement afforded StreamlineMD, Mullen, Curley, or any other StreamlineMD employee authorization to access Plaintiff's Protected Information." SA Complaint at ¶ 17. Likewise, it asserts that "[n]othing in the MOU granted the Defendants access to any of the Protected Information or allowed the Defendants to use the Protected Information." Id. at ¶ 28. The Court is not convinced that the language in the Service Agreement or the MOU supports an inference that SJVC took "measures to prevent [its Protected Information] from becoming available ...." FLA. STAT. ANN. § 812.081(1)(c).
While SJVC suggests that it did not authorize the StreamlineMD Defendants to access its Protected Information, SJVC fails to allege what steps it took to prohibit access or to protect against inadvertent disclosure of its Protected Information stored on StreamlineMD's software. Moreover, in focusing solely on whether the language of the Service Agreement or the MOU allowed the StreamlineMD Defendants to access SJVC's Protected Information, SJVC fails to address the critical question of what efforts it undertook to maintain the secrecy of its Protected Information. In this context, the Court further notes that SJVC willingly shared much of the data it designated as "Protected Information" in an effort to further the new consolidated medical practice, as well as in accordance with the MOU. Nowhere does SJVC allege that in the course of sharing this information with the Defendants, it placed additional restrictions or limits on how the Defendants could use or access that information. Nor does SJVC indicate any restrictions it may have placed on the Defendants' access to that information, should the business venture between the parties fail to be actualized, as was in fact the case here. Additionally, SJVC sets forth no facts regarding how it sought to protect its information in terms of its own employee's access to the same, or in regard to other organizations with which SJVC might have business interactions. Without such allegations, a claim asserting the existence of a trade secret cannot succeed. See e.g., Advice Interactive Group, LLC v. Web.com Group, Inc., No. 3:17-cv-801-J-39MCR,
In light of this conclusion, SJVC's assertion of specific personal jurisdiction over CVDJBA quickly dissembles. This is so because without plausibly alleging the existence of a trade secret, SJVC cannot allege that CVDJBA committed a theft of a trade secret. See FLA. STAT. ANN . § 812.081 ( [a]ny person who, with intent to deprive or withhold from the owner thereof the control of a trade secret, or with an intent to appropriate a trade secret to his or her own use or to the use of another... commits a felony of the third degree ....) (emphasis added). SJVC's inability to assert a claim of theft of trade secrets forecloses its argument that CVDJBA has committed a tortious act within this state. See
SJVC is equally unable to mount a successful argument that the court can exercise general jurisdiction over CVDJBA pursuant to Florida Statutes section 48.193(2). "The reach of [ section 48.193(2) ] extends to the limits o[f] personal jurisdiction imposed by the Due Process Clause of the Fourteenth Amendment." Carmouche,
In this regard, the Court is guided by the Supreme Court's decisions in Goodyear Dunlop Tires Operations, S.A. v. Brown,
[a] court may assert general jurisdiction over foreign (sister-state or foreign-country) corporations, without offending due process when their affiliations with the State are so 'continuous and systematic' as to render them essentially at home in the forum State ... And a corporation's operations in a forum other than its formal place of incorporation or principal place of business will be so substantial and of such a nature as to render the corporation at home in that State only in "exceptional" cases.
SJVC has failed to make a prima facie showing that CVDJBA's presence in *1073Florida includes activities that are so "continuous and systematic so as to render it essentially at home" in the state. See Wolf,
in September 2015, Heinz, President/CEO of CVDJBA, visited Plaintiff in Jacksonville and discussed the financial benefits of Plaintiff joining Heinz and CVDJBA in a new corporate structure.
Subsequently, in 2015 and 2016, Plaintiff, through Dr. St. George, met with Mullen and Heinz, who convinced Dr. St. George he should pursue this merger. Despite Dr. St. George's skepticism, Mullen and Heinz continued to argue what they represented to be the benefits of the transfer, without adequately disclosing to Dr. St. George the risk to his practice should the merger not be completed.
Id. at ¶ 20-21. Additionally, SJVC alleges that "Heinz repeatedly traveled to Florida, and met in the Middle District ... to discuss [the new venture] in glowing terms." Id. at ¶ 36. None of these allegations are sufficient to establish that CVDJBA's presence in Florida rises to the level of being so substantial as to warrant the Court's exercise of general jurisdiction over it.
SJVC also contends that CVDJBA could be haled into Florida courts pursuant to Florida Statutes section 48.193(1)(a)(1) (specific personal jurisdiction exists where defendant operated, conducted, engaged or carried on a business within the state). However, personal jurisdiction is established only if a plaintiff shows both that the exercise of jurisdiction is appropriate under the state's long-arm statute, and that the exercise of that jurisdiction comports with notions of Due Process. See Mut. Serv. Ins. Co.,
The StreamlineMD Defendants also moved to dismiss Count IV, as well as Count V, arguing that SJVC failed to allege facts sufficient to support a claim that its Protected Information constitutes a trade secret. As to these claims the Court's determination above - that SJVC has failed to plausibly allege the existence of a trade secret - is dispositive. Because SJVC has failed to allege facts sufficient to support a plausible claim that its Protected Information constitutes a trade secret, SJVC cannot state a claim for either theft or misappropriation of trade secrets. As such, the Streamline Motion is due to be granted to the extent that the Counts IV and V are due to be dismissed for failure to state a claim.
For the foregoing reasons, the StreamlineMD Defendants' Motion to Dismiss Counts I and II is denied as SJVC has sufficiently pled loss as defined by the CFAA. However, the StreamlineMD Motion is due to be granted to the extent that Counts III, IV and V are all due to be dismissed for failure to state a claim upon which relief can be granted. Further, the CVDJBA Motion is due to be granted, and the claim against it in Count IV is dismissed for lack of personal jurisdiction over CVDJBA.
Accordingly, it is hereby ORDERED :
1) Defendants' Motion to Dismiss the Second Amended Complaint (Doc. 41), filed on the behalf of StreamlineMD, LLC, Sean M. Mullen, and Harry G. Curley is GRANTED in part and DENIED in part .
a. The Motion is GRANTED , to the extent that Counts III, IV and V of the Second Amended Complaint are dismissed.
b. The Motion is DENIED as to Counts I and II of the Second Amended Complaint.
2) Defendants StreamlineMD, LLC, Sean M. Mullen, and Harry G. Curley are directed to respond to the Second Amended Complaint in accordance with the Federal Rules of Civil Procedure.
3) Defendant CVDJBA, LLC's Motion to Dismiss for Lack of Personal Jurisdiction and Memorandum of Legal Authority (Doc. 42) is GRANTED , and the Clerk of the Court is directed to terminate this Defendant from the Court docket.
DONE AND ORDERED in Jacksonville, Florida this 28th day of September, 2018.
In support of CVDJBA's argument that Count IV should be dismissed for lack of personal jurisdiction, CVDJBA included with its Motion a Declaration by James A. Heinz, president and CEO of CVDJBA. See Doc. 42-1 (Heinz Declaration). The Heinz Declaration is accompanied by a variety of supporting exhibits. See
Any facts recited here are drawn from SJVC's SA Complaint along with CVDJBA's and SJVC's associated declarations and evidence in regard to the question of personal jurisdiction. However, these facts may well differ from those that ultimately can be proved.
The parties have filed, under seal, an unredacted copy of the Service Agreement. See Doc. 54 (Service Agreement), filed April 13, 2018. Given that the document has been filed under seal with the Court, the Court will not directly quote from it. However, to the extent that the parties rely on or refer to the Service Agreement's terms and conditions, the Court will note when it agrees or disagrees with how the parties construe the Service Agreement and its effect. Likewise, when necessary, the Court will generically describe the Service Agreement's content.
CVDJBA "is not a medical practice and treats no patients. CVDJBA, LLC renders medical practice management services to several medical practices located in Arizona, New Mexico, and Texas." Heinz Declaration at ¶ 7.
The parties have filed, under seal, an unredacted copy of the Memorandum of Understanding. See Doc. 55 (MOU), filed April 13, 2018. As with the Service Agreement, because the document has been filed under seal, the Court will not directly quote from it. However, to the extent that the parties rely on or refer to the MOU's terms and conditions, the Court will note when it agrees or disagrees with how the parties construe the MOU and its effect. Likewise, when necessary, the Court will generically describe the MOU's content.
SJVC signed the MOU on September 4, 2015, while a representative from Healthcare Consolidated Solutions, the entity created to facilitate the establishment of the new medical practice, signed the MOU on October 15, 2015. MOU at 4.
As necessary throughout the Order, the Court will address additional facts drawn from SJVC's SA Complaint, as well as from CDVJBA's and SJVC's affidavits, declarations, and other evidence.
For Counts I - V, SJVC seeks "damages, injunctive relief as requested, costs of this action, reasonable attorneys' fees and such other relief as this court deems appropriate." Id. at 13, 15, 16,18, 20.
None of the Defendants address Count VI in their respective Motions to Dismiss. Therefore, the Court will not discuss it further.
The Court exercises federal question subject matter jurisdiction over SJVC's Counts I - III, pursuant to
Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage. No action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware.
The Court notes that "[a]lthough an unpublished opinion is not binding ..., it is persuasive authority." United States v. Futrell,
SJVC also includes within its litany of losses the claim that it "needed to obtain new experts and software licenses." SA Complaint at ¶ 53. In light of SJVC's allegation that StreamlineMD eventually terminated its Service Agreement with SJVC, id. at ¶ 38, the Court construes this claimed loss as related to the dissolution of the original Service Agreement between SJVC and StreamlineMD, and not a loss associated with StreamlineMD's alleged unauthorized access to SJVC's Protected Information.
Placing these last two allegations in the context of SJVC's other claims of loss against the StreamlineMD Defendants, and given that the overwhelming emphasis of SJVC's claimed losses focuses on its failed business venture with the StreamlineMD Defendants, there is certainly ground to construe these allegations as more aligned with the failed business venture than with StreamlineMD's alleged unauthorized access to SJVC's Protected Information. Nonetheless, construing the allegations in SJVC's favor, the Court reads them as relating to the StreamlineMD Defendants' alleged unlawful access to SJVC's information.
However, SJVC's allegations that it "suffered impairment to its reputation and goodwill, [and] lost revenues, as a result of [the StreamlineMD Defendants'] unauthorized access to Plaintiff's Protected Information" id. at ¶ 54, appears to fall within the second category of losses outlined in18 U.S.C. § 1030 (e)(11), which requires the plaintiff to assert an interruption of services. SJVC has not done so here, and therefore the Court will not consider these loss allegations any further.
In this regard, the Court notes that SJVC may ultimately struggle to prove its allegations of loss. Given the Court's rejection of many of the losses alleged by SJVC in relation to Counts I and II, SJVC will have to prove that its alleged losses associated with the remedial measures it took in response to the StreamlineMD Defendants' alleged unauthorized access of SJVC's information exceeded $5,000.
The ECPA, like the CFAA, "is primarily a criminal statute with a civil component aimed at creating a private right of action against computer hackers and electronic trespassers." IPC Sys., Inc. v. Garrigan, No. 1:11-cv-3910-AT,
An "electronic communication system" also includes within its definition the ability to send or receive "wire communications." "Wire communications," which include the "aural transfer" of information,
Dropbox "is a cloud storage product that allows a user to create an account to save and store digital content ... and to share that content by providing others with the e-mail address and password used to log into the account." TLS Mgmt. v. Rodriguez-Toledo,
Florida Statutes section 812.081 provides that
[a]ny person who, with intent to deprive or withhold from the owner thereof the control of a trade secret, or with an intent to appropriate a trade secret to his or her own use or to the use of another, steals or embezzles an article representing a trade secret or without authority makes or causes to be made a copy of an article representing a trade secret commits a felony of the third degree ....
Fla. Stat. Ann . § 812.081.
Under the Florida Uniform Trade Secrets Act, misappropriation means
(a) Acquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or
(b) Disclosure or use of a trade secret of another without express or implied consent by a person who:
1. Used improper means to acquire knowledge of the trade secret; or
2. At the time of disclosure or use, knew or had reason to know that her or his knowledge of the trade secret was:
a. Derived from or through a person who had utilized improper means to acquire it;
b. Acquired under circumstances giving rise to a duty to maintain its secrecy or limit its use; or
c. Derived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use ....
Fla. Stat. Ann . § 688.002.
CVDJBA also asserts that Count IV should be dismissed against it because SJVC failed to allege the requisite intent for trade secret theft, CVDJBA Motion at 29-30, SJVC insufficiently plead that CVDJBA stole or embezzled from the Plaintiff, id. at 30, and that SJVC failed to plead that any violation occurred in Florida. Id. at 32.
As relevant here, Florida Statute section 48.193(1)(a) guides that
[a] person, whether or not a citizen or resident of this state, who personally or through an agent does any of the acts enumerated in this subsection thereby submits himself or herself and, if he or she is a natural person, his or her personal representative to the jurisdiction of the courts of this state for any cause of action arising from any of the following acts:
1. Operating, conducting, engaging in, or carrying on a business or business venture in this state or having an office or agency in this state.
2. Committing a tortious act within this state.
....
Fla. Stat. Ann . § 48.193(1)(a). Conversely, section 48.193(1)(b) details
[n]otwithstanding any other provision of this subsection, an order issued, or a penalty or fine imposed, by an agency of another state is not enforceable against any person or entity incorporated or having its principal place of business in this state if the other state does not provide a mandatory right of review of the agency decision in a state court of competent jurisdiction.
Id. at § 48.193(1)(b).
Given the specific language of SJVC's pleadings, and the arguments it lays out in its Response to CVDJBA, the Court presumes that in alleging jurisdiction per section 48.193(1)(b), but stating that "Defendants have committed tortious acts within the State of Florida," SA Complaint at ¶ 7, SJVC intended to assert personal jurisdiction over CVDJBA pursuant to 48.193(1)(a)(2), rather than 48.193(1)(b). There is nothing within SJVC's pleadings, aside from its reference to section 48.193(1)(b), to suggest that it intended to assert jurisdiction under that section.
The Court's conclusion on this question is bolstered by evidence proffered by CVDJBA in the Heinz Declaration. There Heinz admits that he traveled to Florida and had several interactions with St. George and SJVC on behalf of business entities other than, and entirely separate from, CVDJBA. Heinz Declaration at ¶¶ 73-81. He further declares that CVDJBA has absolutely no presence, nor any interaction with anyone or any business within the state of Florida. Id. at ¶¶ 4-36.
Moreover, even before the Daimler Court clarified the limited set of circumstances that would subject a business entity to general jurisdiction, courts had found allegations similar to those of SJVC to be insufficient to establish general jurisdiction over a defendant. See e.g., Turi v. Stacey, No. 5:13-cv-248-Oc-22PRL,