## Facts

- Providence Health System–Oregon stored electronic patient information for about 365,000 patients, including identifying and health-related data.
- A Providence employee took computer disks and backup tapes home and left them in a car.
- The disks and tapes were stolen from the employee’s car.
- Providence notified affected patients and recommended protective steps such as monitoring credit reports and placing fraud alerts.
- Plaintiffs did not allege the stolen information was accessed, viewed, or misused by the thief or anyone else.
- Plaintiffs alleged damages consisting of (1) costs for credit monitoring and other preventive measures and (2) increased risk of future identity theft with resulting anxiety and emotional distress.
- Plaintiffs brought a putative class action for negligence and for violations of the Oregon Unlawful Trade Practices Act (UTPA).
- The trial court dismissed for failure to allege legally cognizable injury; the Court of Appeals affirmed; the Oregon Supreme Court granted review.

## Issues

1. Whether allegations of increased risk of future identity theft and expenditures for preventive measures, without alleged misuse of stolen data, plead a legally cognizable injury sufficient for negligence.
2. Whether the same allegations plead an “ascertainable loss of money or property” sufficient to state a claim under the Oregon UTPA.

## Decision

- The Oregon Supreme Court affirmed dismissal of both claims.
- Plaintiffs failed to plead a present, non-speculative injury for negligence where there was no alleged viewing or use of the stolen information.
- Voluntary preventive expenditures (e.g., credit monitoring) made in response to a risk of future harm were not, by themselves, a compensable present injury on these allegations.
- Emotional distress based on fear of future identity theft was not recoverable absent a present, legally cognizable injury.
- Plaintiffs failed to plead an “ascertainable loss” under the UTPA because the alleged losses were tied to speculative future identity theft rather than a present loss caused by an unlawful trade practice.

## Legal Principles

- Oregon negligence requires “actual present harm”; exposure to a risk of future harm, without materialization, is insufficient.
- A plaintiff cannot convert a nonactionable risk of future loss into a negligence injury solely by incurring costs to guard against that risk.
- Emotional distress damages in negligence generally require a present, legally cognizable injury beyond distress arising from speculative future harm.
- Under the Oregon UTPA, an “ascertainable loss of money or property” must be a present loss caused by the challenged practice; speculative future losses and preventive costs in anticipation of possible misuse do not satisfy that element on these facts.

## Conclusion

Because plaintiffs alleged only theft of stored patient information, not its access or misuse, the Oregon Supreme Court held they pleaded no present injury for negligence and no ascertainable loss for UTPA purposes, and it affirmed dismissal of the putative class action.


Paul v. Providence Health Sys.-Or., 351 Or. 587, 273 P.3d 106 (Or. 2012)