Sarah Beck, et al v. North Broward Hospital District, et al.

D ISTRICT C OURT OF A PPEAL O F T HE STATE OF F LORIDA
FOURTH DISTRICT
SARAH BECK, TIMOTHY HALE, ANDREA HUNTER, ROSELENE
JOSEPH, JAMES KIC, LORI LESLIE, and SANDY R. LEVY, individually
and on behalf of all others similarly situated,
Appellants,
v.
NORTH BROWARD HOSPITAL DISTRICT d/b/a BROWARD HEALTH,
Appellee.
No. 4D2024-1814
[January 14, 2026]
Appeal from the Circuit Court for the Seventeenth Judicial Circuit,
Broward County; Jack B. Tuter, Jr., Judge; L.T. Case Nos. CACE22-
000803; CACE22-000857; CACE22-006111.
Dorothy 	P. 	Antullis, 	Stuart 	A. 	Davidson, 	and 	Facundo 	Scialpi 	of
Robbins Geller Rudman & Dowd LLP, Boca Raton, and Norman E. Siegel,
J. Austin Moore, and Kasey Youngentob of Stueve Siegel Hanson LLP,
Kansas City, MO, for appellants.
Peter R. Goldman, Danna Khawam, Nina Welch of Nelson Mullins Riley
& Scarborough LLP, Fort Lauderdale, and Beverly A. Pohl of Nelson
Mullins Riley & Scarborough LLP, Boca Raton, for appellee.
GROSS, J.
We affirm the circuit court’s order that the defendant below had not
waived its entitlement to sovereign immunity.
By 	an 	amended 	class 	action 	complaint, 	the 	plaintiffs 	sued 	North
Broward Hospital District (“Broward Health”) for claims arising out of an
October 2021 data breach incident. 	The plaintiffs were former patients of
Broward Health. 	Broward Health is a public, not-for-profit health care
system organized under the laws of Florida. 	It operates four major
hospitals and more than 30 locations and offices.
The complaint alleged two counts, negligence and breach of contract,

2
arising 	from 	the 	exposure 	of 	the 	patients’ 	private 	information1 	to
unauthorized third parties.
The plaintiffs pleaded the existence of an express contract with Broward
Health cobbled together from a Patient’s Bill of Rights and Responsibilities,
a Notice of Privacy Practices for Protected Health Information, bylaws of
the medical staff, and a code of conduct.
For the negligence count, the plaintiffs alleged that Broward Health
failed to exercise due care in collecting, storing, and using the plaintiffs’
private information. 	The plaintiffs specified that the following harm was
caused by such negligence:
1. loss of control over their private information, which has
marketable value;
2. diminished personal and economic value of their private
information;
3. diminished transactional or barter value of their private
information;
4. loss of inherent privacy value assigned to keeping their
private information confidential;
5. actual identity theft;
6. out-of-pocket expenses associated with protecting their
property interests; and
7. future costs in terms of time, effort, and money that will be
expended to prevent, detect, contest, and repair the impact
of the private information compromised as a result.
Broward Health moved to dismiss the operative complaint.
Regarding 	the 	negligence 	claim, 	Broward 	Health 	argued 	that 	the
complaint should be dismissed with prejudice because the plaintiffs’ claim
was barred by sovereign immunity, as the limited statutory waiver of
sovereign immunity does not extend to the plaintiffs’ damages, which did
not arise out of “injury or loss of property, personal injury, or death” as
1 This private information included personal identification, insurance, medical,
and other information.

3
provided by section 768.28(1), Florida Statutes (2021).
Regarding the breach of contract claim, Broward Health argued that
under Pan-Am Tobacco Corp. v. Department of Corrections, 471 So. 2d 4, 6
(Fla. 1984), the waiver of sovereign immunity applied only to express,
written contracts, not to the pamphlet-style informational notices at issue
in this case.
The 	trial 	court 	granted 	Broward 	Health’s 	motion 	to 	dismiss 	with
prejudice. The court held that the plaintiffs “[did not] seek relief based on
an ‘injury or loss of property, personal injury or death.’ Instead, they seek
economic damages which are barred.” 	Thus, the court explained: “The
statute in question does not provide a remedy for ‘economic’ damages.
Such a remedy would have to come from the Florida Legislature.” 	The
court later entered a final order of dismissal.
Discussion
“In Florida, sovereign immunity is the rule, rather than the exception[.]”
Pan-Am Tobacco, 471 So. 2d at 5. 	“Article X, section 13 of the Florida
Constitution provides ‘absolute sovereign immunity for the state and its
agencies 	absent 	waiver 	by 	legislative 	enactment 	or 	constitutional
amendment.’” 	Orlando v. Broward Cnty., Fla., 920 So. 2d 54, 57 (Fla. 4th
DCA 2005) (quoting Cir. Ct. of Twelfth Jud. Cir. v. Dep’t of Nat. Res., 339
So. 2d 1113, 1114 (Fla. 1976)).
The legislative waiver of sovereign immunity in section 768.28, Florida
Statutes provides:
In accordance with s. 13, Art. X of the State Constitution, the
state, for itself and for its agencies or subdivisions, hereby
waives sovereign immunity for liability for torts, but only to
the extent specified in this act. 	Actions at law against the
state or any of its agencies or subdivisions to recover damages
in tort for money damages against the state or its agencies or
subdivisions for injury or loss of property, personal injury, or
death caused by the negligent or wrongful act or omission of
any employee of the agency or subdivision[,] . . . if a private
person, would be liable to the claimant, in accordance with
the general laws of this state, may be prosecuted subject to
the limitations specified in this act.
§ 768.28(1), Fla. Stat. (2021).

4
While the legislature explicitly waived sovereign immunity in tort in
section 768.28, “[t]here is no analogous waiver in contract.” 	Pan-Am
Tobacco, 471 So. 2d at 5. 	“Nonetheless, the legislature has, by general
law, explicitly empowered various state agencies to enter into contracts.”
Id. 	“Additionally, it has authorized certain goals and activities which can
only be achieved if state agencies have the power to contract for necessary
goods and services.” 	Id.
To determine whether sovereign immunity bars the plaintiffs from
bringing a breach of contract claim against Broward Health, the key
questions are (1) “whether the Legislature has waived immunity [and (2)]
whether an express, written contract exists between [the parties].” 	Heine
v. Fla. Atl. Univ. Bd. of Trs., 360 So. 3d 412, 418 (Fla. 4th DCA 2023). For
sovereign immunity purposes, an express contract includes those “implied
covenants and conditions that do not contradict, supplant, or override
express contract provisions[.]” Rojas v. Univ. of Fla. Bd. of Trs., 419 So. 3d
593, 606 (Fla. 2025). 	If the answer to either question is affirmative,
Broward Health “cannot invoke sovereign immunity to bar” the plaintiffs’
breach of contract claim. Heine, 360 So. 3d at 418 (citing Pan-Am Tobacco,
471 So. 2d at 5).
The legislature has not explicitly waived sovereign immunity regarding
the privacy issues implicated by the Health Insurance Portability and
Accountability Act of 1996 (“HIPAA”) or the Florida Patient’s Bill of Rights
and Responsibilities. 	Neither statute creates a cause of action against a
governmental entity. 	No private cause of action exists under HIPAA. 	See
Acara v. Banks, 470 F.3d 569, 570, 572 (5th Cir. 2006) (affirming motion
to dismiss plaintiff’s suit against doctor for violating HIPAA by disclosing
her medical information without consent and holding that “there is no
private cause of action under HIPAA”). 	Similarly, section 381.026(3)
provides that the Florida Patient’s Bill of Rights “shall not be used for any
purpose in any civil or administrative action and neither expands nor
limits any rights or remedies provided under any other law.” § 381.026(3),
Fla. Stat. (2021); see also Murthy v. N. Sinha Corp., 644 So. 2d 983, 986
(Fla. 1994) (“declin[ing] to infer any civil liability” in construction industry
regulatory and penal statutes “as there is no evidence in the language or
the legislative history . . . of a legislative intent” to create “a private right
of action”).
Furthermore, the documents relied upon by the plaintiffs did not create
an “express written contract” as required by Rojas and Pan-Am Tobacco.
Broward Health provided patients with notice required by federal and
state statutes. 	Section 381.026, Florida Statutes, requires a health care

5
provider 	to 	“adopt 	and 	make 	available 	to 	the 	patient, 	in 	writing, 	a
statement of the rights and responsibilities of patients[.]” 	§ 381.026(6),
Fla. Stat. (2021). 	Both the Patient’s Bill of Rights and the Privacy Notice
used by Broward Health are informational documents designed to promote
the understanding and well-being of patients, to give patients “a general
understanding of the procedures to be performed on them and to provide
information 	pertaining 	to 	their 	health 	care 	so 	that 	they 	may 	make
decisions in an informed manner after considering the information relating
to their condition, the available treatment alternatives, and substantial
risks and hazards inherent in the treatments.” 	§ 381.026(3), Fla. Stat.
(2021).
Such informational notices disseminated to patients do not give rise to
express written contractual obligations binding the health care provider
and the patient. 	See Brush v. Mia. Beach Healthcare Grp. Ltd., 238 F.
Supp. 3d 1359, 1367 (S.D. Fla. 2017) (holding that provisions in the
defendant healthcare group’s Notice of Privacy Practices, Patient Rights
and Responsibilities, and Patient Visitation Rights “are not contractual in
nature. 	Instead, these provisions inform patients of their rights” under
HIPAA and “the duties imposed upon the Defendants by these statutory
provisions.”).
The plaintiffs argue that the Florida Supreme Court’s recent Rojas
decision compels reversal of the trial court’s order dismissing their breach
of contract claim. 	We distinguish Rojas because that case involved a
specific, written financial liability agreement.
Rojas determined that the financial liability agreement was an express
contract between the students and the university and that provision of on-
campus services and facilities are “permissible implied obligations that do
not have . . . a directly antagonistic relationship with the text of a contract.”
419 So. 3d at 604.
The Court determined the plain language of the financial liability
agreement at issue in Rojas shows that it was intended to be a binding
agreement 	between 	the 	university 	and 	the 	enrolled 	students. 	That
agreement stated:
I agree to pay all UF debts and charges pursuant to UF
policies. 	I understand that the university is advancing value
to me in the form of educational services and that my right to
register is expressly conditioned upon my agreement to pay
the costs of tuition, fees, and other charges and any additional
costs when those charges become due . . . . 	This agreement

6
shall be construed in accordance with Florida law and any
lawsuit 	to 	collect 	unpaid 	fees 	may 	be 	brought 	in 	the
appropriate 	court 	sitting 	in 	Alachua 	County, 	Florida,
regardless of my domicile at the time of bringing such suit.
Univ. of Fla. Bd. of Trs. v. Rojas, 351 So. 3d 1167, 1171 n.4 (Fla. 1st DCA
2022).
Language similar to the binding contract in Rojas is absent from the
informational privacy materials upon which the plaintiffs rely in this case.
Because there was no “express written contract” that would bring this case
within the waiver of sovereign immunity authorized in Rojas and Pan-Am
Tobacco, the trial court did not err in dismissing plaintiffs’ breach of
contract claim with prejudice.
As to the negligence count, this court has strictly construed section
768.28(1) to require a waiver of sovereign immunity to be clear and
unambiguous. 	See Dep’t of Fin. Servs. v. Barnett, 262 So. 3d 750, 752,
754 	(Fla. 	4th 	DCA 	2018) 	(“[B]ecause 	waiver 	is 	an 	abrogation 	of 	the
sovereignty of the state, courts have strictly construed any statute waiving
immunity to protect the public purse.”).
This case is controlled by our decision in City of Pembroke Pines v.
Corrections Corp. of America, Inc., 274 So. 3d 1105 (Fla. 4th DCA 2019)
(“Pembroke Pines II”).
The factual background of Pembroke Pines II was set forth in Corrections
Corporation of America, Inc. v. City of Pembroke Pines, 230 So. 3d 477 (Fla.
4th DCA 2017) (“Pembroke Pines I”). Pembroke Pines II, 274 So. 3d at 1107.
Pembroke Pines I involved a dispute between the City of Pembroke Pines
and Corrections Corporation of America, Inc. (“CCA”). Id. The City sought
declaratory judgment regarding whether the City had a duty to provide
sewer and water services to an area outside of its boundary, where CCA
and the Town of Southwest Ranches entered into a contract regarding the
development of a correctional facility. 	Id. at 1108.
The trial court ruled that the City had no such duty, even though the
City and Southwest Ranches had entered into agreements that the City
would not interfere with the development or operation of the CCA’s jail
facility and agreed that the City had sufficient capacity to provide water
and sewer service to the future CCA facility site. 	Id. at 1108–09. 	While
the appeal of that trial court order was pending, Southwest Ranches
received notification that a detention center would not be built on the CCA
site. 	Id. at 1109.

7
“With no detention center to build, CCA sold the CCA site to Southwest
Ranches” and “filed [a] second amended counterclaim against the City.”
Id. 	CCA 	alleged 	four 	counts 	relevant 	to 	that 	appeal: 	“Count 	I 	for
declaratory judgment; Count II for promissory estoppel; 	Count V for
tortious interference with contract; and Count VI [for] tortious interference
with advantageous business relationship.” Id. at 1110. For the tort claims
in Counts V and VI, CCA claimed “damages, including lost profits and
costs.” 	Id.
The 	trial 	court 	denied 	the 	City’s 	motion 	to 	dismiss 	based 	upon
sovereign immunity. 	Id. 	This court reversed, holding that the City was
entitled to sovereign immunity. 	Id. at 1111. 	We observed that “section
768.28’s limited waiver of sovereign immunity does not apply to CCA’s
state law tort claims which are not based on ‘injury or loss of property,
personal injury, or death caused by the negligent or wrongful act or
omission of any employee of the agency or subdivision while acting within
the scope of the employee’s office or employment . . . .’” Id. at 1112 (quoting
§ 768.28(1), Fla. Stat.). 	Significantly, we explained that “[t]he waiver of
sovereign immunity has not been extended to include the claim upon
which 	CCA 	relies 	here 	– 	economic 	damages 	framed 	in 	counts 	for
declaratory relief, promissory estoppel, tortious interference with contract,
and tortious interference with advantageous business relationship.” Id. at
1113; see also City of Fort Lauderdale v. Tropical Paradise Resorts, LLC,
372 So. 3d 663, 667 (Fla. 4th DCA 2023) (holding that City was entitled to
sovereign immunity for claims seeking “economic damages for defense of
litigation” and not for “injury or loss of property, personal injury, or death”
under section 768.28(1)).
Consistent with Pembroke Pines II, we hold that the damages the
plaintiffs claim from the use of their personal and health information
involve economic damages falling outside of the section 768.28(1) limited
waiver of sovereign immunity, because there was no actual damage to
tangible property. 	The damage to privacy rights here is akin to the
damages in Pembroke Pines II arising from interference with a contractual
or business relationship.
Affirmed.
SHEPHERD, J., concurs.
FORST , J., concurs specially with opinion.
F ORST , J., concurring specially.

8
I concur with the affirmance of the trial court’s dismissal of appellants’
complaint on the basis of appellee’s assertion of sovereign immunity. 	My
only disagreement with the majority opinion is its holding that “[t]his case
is controlled by our decision in City of Pembroke Pines v. Corrections Corp.
of America, Inc., 274 So. 3d 1105 (Fla. 4th DCA 2019) (“Pembroke Pines
II”).” Due to the differences in the “injury or loss of property” claims in the
two 	cases, 	I 	find 	Pembroke 	Pines 	II 	to 	be 	“instructive” 	rather 	than
“controlling.” 	I otherwise agree with the majority opinion’s analysis and
holding.
* 	* 	*
Not final until disposition of timely-filed motion for rehearing.