Charlie v. Rehoboth McKinley Christian Health Care Services

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW MEXICO

ALICIA CHARLIE, LEONA GARCIA LACY, DARRELL TSOSIE, and E.H., a minor, by and through his guardian, GARY HICKS on behalf of themselves and a class of similarly situated individuals,

Plaintiffs,

v. Civ. No. 21-652 SCY/KK

REHOBOTH MCKINLEY CHRISTIAN HEALTH CARE SERVICES,

Defendant.

ORDER SETTING HEARING This matter comes before the Court on Plaintiffs’ Unopposed Motion For Preliminary Approval Of Class Action Settlement And Memorandum Of Law In Support Thereof. Doc. 39. In this motion, Plaintiffs state that the parties have reached a settlement of this putative class action case. Plaintiffs request that the Court preliminarily approve the settlement; conditionally certify the settlement class; appoint Alicia Charlie, Leona Garcia Lacey, Darrell Tsosie, and E.H., by and through his guardian, Gary Hicks as class representatives; appoint attorneys David K. Lietz and Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman, PLLC (“Milberg”) as class counsel; approve and direct notice be sent to the class; appoint Kroll Settlement Administration LLC as Claims Administrator; approve the claim and exclusion forms; and set a hearing date and schedule for final approval of the settlement and consideration of class counsel’s motion for award of fees, costs, expenses, and service awards. Doc. 39 at 9- 10.1 “Preliminary approval of a class action settlement, in contrast to final approval, is at most a determination that there is probable cause to submit the proposal to class members and hold a full-scale hearing as to its fairness. A proposed settlement of a class action should therefore be preliminarily approved where it appears to be the product of serious, informed, non-collusive

negotiations, has no obvious deficiencies, and does not improperly grant preferential treatment to class representatives. The standards for preliminary approval of a class settlement are not as stringent as those applied for final approval.” Ross v. Convergent Outsourcing, Inc., 323 F.R.D. 656, 659 (D. Colo. 2018) (cleaned up). The Court sets a hearing on the motion for preliminary settlement approval at which it will address the factors it must consider under Rule 23(a), (b)(3), and (e). “[W]here settlement precedes class certification (e.g., approval for settlement and certification are sought simultaneously, as is the case here) district courts must be even more scrupulous than usual when examining the fairness of the proposed settlement.” In re Sprint Corp. ERISA Litig., 443 F. Supp.

2d 1249, 1255 (D. Kan. 2006) (collecting authorities); see also Johnson v. NPAS Sols., LLC, 975 F.3d 1244, 1253 (11th Cir. 2020) (“the district court must assume the role of fiduciary for the class plaintiffs and ensure that the class is afforded the opportunity to represent its own best interests”). The Court specifically advises the parties that it will address the following topics at the hearing:

1 The native pagination in Doc. 39 differs from the pagination in the CM ECF header. The Court’s citations are to the page numbers in the CM ECF header at the top of the page, not the native pagination at the bottom. A. Notice Under Federal Rule of Civil Procedure 23(c)(2)(B), “the Court must direct to class members the best notice that is practicable under the circumstances, including individual notice to all members who can be identified through reasonable effort.” To ensure that it complies with this obligation, the Court will address the following topics.

1) Whether the class is adequately defined. Specifically, under the proposed settlement, the class is defined as “All persons to whom on or about May 19, 2021 Rehoboth McKinley Christian Health Care Services sent Notice of a Data Breach that was discovered on February 16, 2021, which involved an unauthorized person gaining access to certain systems containing PII/PHI.” Doc. 39 at 5-6. In limiting the class to those persons RMCHCS sent notices on or about May 19, 2021, the Court presumes that data breach victims not included in the May 19 notice are excluded from the class, will not receive notice of the lawsuit, will have no opportunity to opt-out of the lawsuit, and so the class action will not affect their ability to file a lawsuit. If this is not the intent of the parties, they shall provide the Court a revised definition of the class no later than Friday, November 18. If this is the intent of the parties, they should be

prepared to address whether the scope of the class is adequate under Rule 23 and what measures were taken to ensure that list of persons sent notice on May 19 included all persons whose personal information was compromised in the data breach. 2) Whether additional methods of reaching class members should be used. Given the nature of this class as a predominately rural one, the Court will address such topics as whether notice should be posted in the hospital facilities or other areas such as community centers. The Court will address whether the class is composed of a significant portion of Navajo speakers. The Court will address the procedure related to opt-outs, to include whether opt-out should proceed via less arduous means. The Court will also address other methods for class members to file a claim in addition to downloading a form online, which requires internet access. 3) The Court will also confirm with counsel that the claims deadline and all claim adjudications will take place and be finalized prior to the final approval hearing, and discuss an appropriate date for that hearing. B. Damages

In their complaint, Plaintiffs alleged that they “have been placed at an imminent, immediate and continuing increased risk of harm from fraud and identity theft.” Compl. ¶ 117 (emphasis added). They allege that they “face substantial risk of out-of-pocket fraud losses” in the future. Id. ¶ 119 (emphasis added). “Plaintiffs anticipate spending considerable time and money” to mitigate the harms caused by the data breach. Id. ¶ 115 (emphasis added). Plaintiffs “face substantial risk of being targeted for future phishing, data intrusion, and other illegal schemes.” Id. ¶ 120 (emphasis added). Plaintiffs “may also incur out-of-pocket costs for protective measures.” Id. ¶ 121 (emphasis added). The Court found these allegations to be speculative and therefore not compensable damages. Doc. 32 at 15. The parties’ settlement agreement appears to concur, because it proposes no monetary

compensation without a demonstration that a class member suffered out-of-pocket losses or actual identity theft. The gap between this narrow definition of damages and the class definition as a whole may leave the vast majority of class members with no compensation other than credit monitoring services and/or injunctive relief. Advisory committee guidelines recommend that district courts should scrutinize such proposed settlements. Fed. R. Civ. P. 23(h), 2003 advisory committee note (“Settlements involving nonmonetary provisions for class members . . . deserve careful scrutiny to ensure that these provisions have actual value to the class.”). Accordingly, the Court will address what value the credit monitoring services and/or injunctive relief provides to the class, whether that relief likely will comprise the majority of damages awarded, and, if so, what, if any, impact this has. The Court will also address the following issues related to damages. 1) Adequacy of named representatives. The parties’ settlement agreement provides class members are entitled to “reimbursement of ordinary expenses incurred as a result of the Data Breach, such as: bank fees, long distance phone charges, cell phone charges (only if charged by

the minute), data charges (only if charged based on the amount of data used), postage, or gasoline for local travel; and fees for credit reports, credit monitoring, or other identity theft insurance product purchased between May 19, 2021 and the date of the Settlement Agreement,” and/or if the class member “was the victim of actual documented identity theft for proven monetary loss.” Doc. 39 at 14-15. Plaintiffs have not moved to amend the complaint to allege that the class representatives—or any class member—suffered these types of damages.2 At the hearing, the Court will inquire as to whether the named representatives are adequate representatives of the class if they have not suffered these actual damages. The Court will also inquire into whether there is evidence any member of the class suffered actual damages such as

identity theft. 2) Claims administration and claims administrator. The Court will inquire into the cost/rate of the Claims Administrator and the expected cost of administration, to include whether some costs are necessary. For instance, with respect to the portion of the settlement agreement that provides for two years of credit monitoring services for claimants, Doc. 39 at 15-16, the Court questions whether a claims process is necessary to administer this relief. It appears Defendant has already offered one year of credit monitoring to class members. Compl. ¶ 106 &

2 Plaintiffs do generally allege that Plaintiff Tsosie and the guardian for Plaintiff Hicks have spent “time and resources dealing with the impact of the data breach” but do not identify any specific expense incurred. Doc. 2 ¶ 111, 114. n.38. This service apparently was not encumbered by a claims process but simply made available if the person visited a website and enrolled online. Doc. 2 at 62. At the hearing, the Court will also inquire into the actual cost of this service to Defendant, its utilization rate, and the likely value to the class of extending it for another two years. The Court will further address whether the retail cost of a credit monitoring service that

Defendant chooses, and on which Defendant receives a bulk discount, is the appropriate measure of value to the class. If the retail cost is the measure used, the Court will inquire as to whether class members should be permitted to choose their own credit monitoring service, toward which Defendant will pay an amount equal to the retail cost of its preferred credit monitoring service. The Court will also inquire about whether the credit monitoring service is a “negative option” under which a class member must affirmatively cancel the service after two years to avoid being assessed future fees for the service. The Court will address whether the proposed manner in which claims will be administered could serve as a barrier to actual recovery. If the claims process discourages class

members from filing claims, and limits the recovery of those members who do file claims, the relief provided for the class may not be adequate, as Rule 23(e)(2)(C) requires. If administrative fees and costs approach, or exceed the actual value of the class recovery, the relief provided to the class may not be adequate. Cf. In re Bluetooth Headset Prod. Liab. Litig., 654 F.3d 935, 938 (9th Cir. 2011) (reversing where the settlement provided for a small cy près award, no economic damages to the class, and $800,000 in attorney’s fees). The Court has concerns that the fees and expenses Plaintiffs have identified as being recoverable may prove illusory. For instance, although class members may theoretically receive “up to $500.00 per person for reimbursement of ordinary expenses incurred as a result of the Data Breach” each class member’s reimbursement for time spent is capped at $60 (maximum of 4 hours at $15/hour). The remaining $440 that could potentially be recovered would presumably consist of reimbursable fees. But the examples of recoverable fees Plaintiffs provides describe fees a typical person in 2021 likely would not incur. For instance, in 2021 most class members may have had telephone plans through which they did not incur long distance phone charges, per

minute cell phone charges, and data usage charges. Other reimbursable expenses such as gas and postage are unlikely to approach $500. And, expenses such as gas and postage will be difficult to document. Few class members are likely to have retained documentation, for instance, related to the gas they purchased to drive to the post office or of the cost of mailing a document related to the breach once they arrived at the post office. The Court finds it unlikely that many class members will have detailed records of time spent dealing with the impact of the data breach or an accounting of ordinary costs incurred. If the value of time a class member must expend to obtain this information exceeds the recovery this investment of time would yield, it would be irrational for a class member to pursue these

damages. Accordingly, this category of damages would be illusory. Similarly, although the Court recognizes that number of class members who will file claims for extraordinary expenses is difficult to estimate, it appears that this number is likely to be low. This is because the reimbursement of extraordinary expenses requires an individual assessment of whether claimed losses were more likely than not caused by the data breach; whether documentation provided to support a loss is sufficient; and whether each individual claimant “made reasonable efforts to avoid, or seek reimbursement for, the loss, including but not limited to exhaustion of all available credit monitoring insurance and identity theft insurance.” Doc. 39 at 15. The Court will inquire as to the parties’ estimation of the average time per claim the Claims Administrator will need to make these assessments, to include what effort was made to exhaust recovery from any credit monitoring or identity theft insurance. Further regarding the requirement that a claimant with identity theft insurance demonstrate an exhaustive effort to recover insurance proceeds as a prerequisite to recovery, the Court is concerned that a class member who paid for identity theft insurance and suffered

extraordinary expenses ultimately might be made worse off for having purchased such insurance. This is because the purchase of insurance to protect against harm caused by identity theft ironically makes it harder to recover damages for harm caused by identity theft; those who purchased insurance, as a prerequisite to recovery, must demonstrate exhaustion of all possible means of recovery from the insurance company. The Court will also discuss what sort of evidence class members would be expected to provide to demonstrate that this Data Breach was the cause of the identity theft they suffered. According to the parties’ settlement agreement, the Claims Administrator will be charged with determining whether a loss was more likely than not caused by the Data Breach. The Court will

inquire as to the criteria the Claims Administrator will use to make this assessment and how much of the assessment will be a subjective determination on the part of the Claims Administrator. Finally, the Court will further inquire into the expected cost of making these assessments. The Court is concerned that the effort required to obtain reimbursement would dissuade most class members from seeking reimbursement and, for those class members who do seek reimbursement, the expense of administering any recovery might approach or exceed the actual recovery. C. Predominance In considering, under Rule 23(b)(3), whether “questions of law or fact common to class members predominate over any questions affecting only individual members,” the Tenth Circuit requires that district courts “consider the extent to which material differences in damages determinations will require individualized inquiries.” Wallace B. Roderick Revocable Living Tr. v. XTO Energy, Inc., 725 F.3d 1213, 1220 (10th Cir. 2013). “Although ‘individualized monetary claims belong in Rule 23(b)(3),’ predominance may be destroyed if individualized issues will

overwhelm those questions common to the class.” Id. (quoting Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 362 (2011)); see Ward v. Dixie Nat’l Life Ins. Co., 595 F.3d 164, 180 (4th Cir. 2010) (“To be sure, individualized damage determinations cut against class certification under Rule 23(b)(3).”); Steering Comm. v. Exxon Mobil Corp., 461 F.3d 598, 602 (5th Cir. 2006); see also McLaughlin v. Am. Tobacco Co., 522 F.3d 215, 231 (2d Cir. 2008) (“[W]hile the fact that damages may have to be ascertained on an individual basis is not, standing alone, sufficient to defeat class certification, it is nonetheless a factor we must consider in deciding whether issues susceptible to generalized proof ‘outweigh’ individual issues.”), abrogated in part on other grounds by Bridge v. Phoenix Bond & Indem. Co., 553 U.S. 639 (2008).

Per the parties’ settlement agreement, before reimbursement for extraordinary damages is permitted, the Claims Administrator must assess whether each individual claimant “made reasonable efforts to avoid, or seek reimbursement for, the loss, including but not limited to exhaustion of all available credit monitoring insurance and identity theft insurance.” Doc. 39 at 15. Efforts made to avoid a loss, the existence of credit monitoring and identity insurance, and what effort was made to exhaust recovery from such insurance is likely to vary from individual to individual. Accordingly, at the hearing, the Court will address whether the variances in damages related to variances in expenses incurred create predominance issues. D. Expected Claims In the data breach case of In re Heartland Payment Systems, Inc. Customer Data Security Breach Litigation, which involved damage theories similar to the present case, 11 valid claims were filed out of over 100 million class members, for a total compensation to the class of $1,925. 851 F. Supp. 2d 1040 (S.D. Tex. 2012). Although the Court appreciates the difficulty of predicting how many members of a class might file claims, the Court would like more information from the parties about the number and amount of claims they expect to be filed in

this case and the basis for that estimate. Cf. Doc. 39 at 32 (asserting, without elaboration, the existence of “actual costs incurred by Settlement Class Members (as relayed in conversations with Plaintiffs’ Counsel)”). The Court is concerned that a small number and dollar amount of claims filed would not justify the administrative and attorney’s fees contemplated in connection with the proposed settlement agreement. Further, such a potential imbalance bears on whether class certification is the superior method for fairly and efficiently adjudicating the controversy. This is particularly true if the Claims Administrator must, on an individual basis for the class members with extraordinary claims, assess whether those class members have exhausted any potential method of recovery from insurance and whether it is more likely than not that the Data

Breach caused any losses for which they are claiming reimbursement. On the other hand, as Plaintiffs note, potential damages are uncapped in the aggregate. Doc. 39 at 14. The Court interprets this to mean that the theoretical cap is the approximately 200,000 class members multiplied by the $4,000 potential damage amount per individual, yielding a total potential exposure of $800 million. The Court will address whether there is a point at which claims would create solvency concerns and, if so, whether this effectively creates a “solvency cap.” If so, the Court will inquire whether this affects how class members should be paid so that whether a class member is paid turns on whether the member is one of the first, or one of the last, to file a claim. E. Data Security Enhancements The proposed settlement agreement notes that “RMCHCS has implemented security- related improvements since the Data Breach designed to better protect Plaintiffs’ and Settlement Class Members’ PII and PHI in the future.” Doc. 39 at 16. The Court will inquire as to whether these enhancements are a product of the settlement agreement or enhancements that RMCHCS

implemented, or would have implemented, independent of the lawsuit. Further, the Court will inquire into the nature and cost of these enhancements, whether the proposed settlement agreement contemplates future maintenance or enhancement, whether the failure to provide such future maintenance or enhancements would constitute a breach of the settlement agreement, the value of this relief to the class, and whether this relief does more than bring Defendant into compliance with a duty it already owes. F. Attorney’s Fees The Court recognizes Plaintiffs’ representation that, “The payment of attorneys’ fees, costs, and expenses and Service Awards were negotiated after the primary terms of the Settlement were negotiated.” Doc. 39 at 19. The Court will ask the parties to expand on this statement.

The parties’ settlement agreement stipulates that Plaintiffs’ counsel may seek up to $300,000 in attorney’s fees, which Plaintiffs represent constitutes 10% of the total benefit to the class. Doc. 39 at 29. At the hearing, the Court will discuss whether this calculation will need to be modified according to the actual rate of claims made after the claims deadline is closed. Fager v. CenturyLink Commc'ns, LLC, 854 F.3d 1167, 1177 (10th Cir. 2016) (“We see merit in an approach that ties attorney recovery to the amount actually paid to the class.”). The Court will hear from the parties as to whether “the fee arrangement outlined in the settlement should be characterized as a constructive common fund or as a fee-shifting contract” and whether the Court should assess the reasonableness of the fee agreement through the percentage method, lodestar method, or hybrid method in which one method is cross-checked with the other. See In re Home Depot Inc., 931 F.3d 1065, 1071 (11th Cir. 2019). The Court advises the parties that it is inclined to adopt a hybrid approach where it assesses the reasonableness of the attorney fees agreement using a percentage-of-fund approach that uses the amount actually paid to the class rather than a

percentage of the theoretical maximum that could be paid to the class. The Court would then cross-check that amount with a lodestar calculation. The Court will also inquire as to whether the attorney’s fees provision of the settlement agreement is a “clear sailing” agreement that requires heightened scrutiny from a district court. Cf. In re Samsung Top-Load Washing Mach. Mktg., Sales Pracs. & Prod. Liab. Litig., 997 F.3d 1077, 1080 (10th Cir. 2021). G. Incentive Awards The Court will also hear from Plaintiffs on the specific basis of the incentive awards to class representatives. The Tenth Circuit has indicated that incentive awards can be justified as “an incentive to act as a named plaintiff” on the basis of risk or burden of acting as such, or

because it would fairly compensate the representative for the services rendered. Chieftain Royalty Co. v. Enervest Energy Institutional Fund XIII-A, L.P., 888 F.3d 455, 467-68 (10th Cir. 2017). Plaintiffs’ motion does not provide the specific details the Tenth Circuit indicates are necessary under either of these standards. The Court will need to find this does not present an obstacle to the adequacy of the representation of the named class representatives prior to preliminarily certifying the class. H. Notice To Government Regulators The Class Action Fairness Act requires that within ten days after a proposed settlement is filed in court, each participating defendant must serve notice of specified settlement-related papers on (1) the U.S. Attorney General or, in the case of a depository institution, the primary federal regulatory official and (2) the primary state regulatory official. 28 U.S.C. § 1715(a) & (b). The Court will inquire which federal and state government regulators received the notice in question and whether notice should be directed to any other agencies. I. Motion Hearing The Court will hold a motion hearing on Tuesday, November 22, 2022 at 10:00 a.m. Mountain time by Zoom video conference. The invitation to the Zoom hearing will be docketed as a separate docket entry, and will be viewable only by the parties. If a member of the public wishes to view the hearing, he or she should contact the Court for connection information. Counsel are responsible for ensuring that all hearing participants have the information necessary to participate in the Zoom hearing. The Court asks that all participants log in to the Zoom hearing five minutes prior to the starting time in case there are any technical issues that need to be addressed prior to the hearing. SO ORDERED. Mire STEVEN C. YARBROUGH UNITED STATES MAGIST E JUDGE