Checked with securities lawyer friend (albeit Canadian)...
Forget any civil suit until the SEC has won a judgement of fraud or some other iregularity against Medify and/or JB. That should come first. Unfortunately, a handful of private e-mails between JB and a few investors will likely not draw much (any)attention from the SEC.
SEC will typically limit their resources and attention to official company PRs, and filings such as quarterly reports and the like. If THESE official documents contain purposeful mistatements of fact and fraud... THEN you MIGHT get regulators involved. They like cases that are big... and obvious... and easiest to win.