Doe v. Kaiser Foundation Health Plan, Inc.

District Court, N.D. California·Decided November 30, 2023·No. 3:23-cv-02865·Unknown

Opinion

JOHN DOE, et al., Case No. 23-cv-02865-EMC (PHK) Plaintiffs,

v. ORDER ON JOINT DISCOVERY DISPUTE LETTER BRIEF RE INC., et al., Re: Dkt. No. 73 Defendants. This action has been referred to the undersigned Magistrate Judge for discovery purposes. See Dkt. 56. This is a putative class action brought by Plaintiffs John Doe, John Doe II, Jane Doe, Jane Doe II, Jane Doe III, Jane Doe IV, and Jane Doe V (“Plaintiffs”) against Defendants Kaiser Foundation Health Plan, Inc., Kaiser Foundation Hospitals, and The Permanente Medical Group, Inc. (collectively, “Kaiser”). See Dkt. 44. Plaintiffs allege that Kaiser has unlawfully embedded code in its website, including its patient portal and mobile applications, that allows third-party social media and ad tech companies to intrude upon, read, intercept, and use Plaintiffs’ sensitive personal and medical information without Plaintiffs’ knowledge or consent. Id. Now pending before the Court is a joint letter brief regarding the Parties’ dispute as to the contents of a proposed stipulated protective order. [Dkt. 73]. The Court finds the dispute suitable for resolution without oral argument. Civil L.R. 7-1(b). In the instant joint letter brief, the Parties ask the Court to resolve their disputes concerning entry of a proposed protective order. [Dkt. 73]. The Parties agree that a protective order based on one of the Northern District of California’s model protective orders should govern discovery but they first disagree as to which model protective order best fits the needs of the case. Id. at 1. Next, the Parties present a set of disputes on whether any modifications are warranted to the selected model protective order, and if so, what those modifications should be. Id. A. The Base Model Protective Order At a high level, the initial dispute centers on whether the Protective Order in this case should be based on a model order which has more or fewer levels and provisions for confidentiality designations. The Court’s website makes available to the public two different model orders for consideration: (1) the Model Stipulated Protective Order for Standard Litigation (“Tier 1 MPO”); and (2) the Model Protective Order for Litigation Involving Patents, Highly Sensitive Confidential Information and/or Trade Secrets (“Tier 2 MPO”). See https://www.cand.uscourts.gov/forms/model-protective-orders/ (“The protective orders on this page are court-approved model forms.”) (last visited November 30, 2023). Kaiser argues that the Tier 2 MPO should serve as the base model protective order in this case. [Dkt. 73 at 1]. Kaiser argues the Tier 2 MPO is appropriate because Plaintiffs seek discovery of “highly confidential Kaiser materials including detailed information about the function of Kaiser’s website that could lead to security risks, source code, and trade secrets and financial and other information that would be harmful to Kaiser if disclosed to competitors or former employees.” Id. Plaintiffs, on the other hand, propose using the Tier 1 MPO because “this is neither a patent case, nor one between competitors exchanging sensitive competitive data.” Id. at 3-4. The Court may, for good cause shown, “protect a party . . . from annoyance, embarrassment, oppression, or undue burden or expense” by issuing a protective order which “specif[ies] terms” for how discovery shall occur. Fed. R. Civ. P. 26(c)(1). The Court’s Tier 1 the Court’s Tier 2 MPO contains “presumptively reasonable conditions” for a Protective Order to be used in a case involving discovery of highly sensitive materials. Corley v. Google, Inc., No. 16-cv-00473-LHK (HRL), 2016 WL 3421402, at *1 (N.D. Cal. June 22, 2016) (quoting Barnes & Noble, Inc. v. LSI Corp., No. 11-cv-02709-LB, 2012 WL 601806, at *1 (N.D. Cal. Feb. 23, 2012)). While the Court expresses no opinions on the merits of this dispute, the Parties’ pleadings and filings discuss the issues to be litigated and indicate that several technological issues are likely to be the subject of discovery. According to Plaintiffs, this lawsuit implicates technical issues surrounding the Kaiser website and mobile apps, as well as healthcare-related information: Kaiser has embedded code in Kaiser’s Website (the “Site”), including the patient portal, and Mobile Applications (the “Apps”) that allows social media and other companies, without patients’ authorization or consent, to intrude upon, read, intercept, and/or use patient medical information and records and the contents of patients’ communications with Kaiser and providers. Kaiser knew that by embedding this code in their Site and Apps, Kaiser was allowing these Third Party Wiretappers to intercept Site and App users’ (“Users”) personal and sensitive information and/or information that Kaiser was required to protect under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. § 1320d-6. [Dkt. 68 at 2]; see also [Dkt. 44 at 4 ¶ 4 (“Kaiser Permanente has installed code from multiple third parties throughout the Kaiser Permanente website and mobile applications that allows third party companies such as Quantum Metric, Twitter, Adobe, Bing, and Google . . . to intercept the content of Plaintiffs and Class Members’ . . . information shared and communications with their medical providers, including personally identifiable medical information and other confidential information and communications[.]”)]. Further, according to Plaintiffs, this case implicates code of a third party, Quantum Metric, and technology used by third parties Adobe, Bing, Twitter, Google, and Dynatrace: [O]n both Kaiser’s public webpage and inside its purportedly “secure” patient portal (“Portal”) on the Site, Kaiser installed Quantum Metric’s “Session Replay” code, which intercepts and redirects Users’ every move on the Site to Quantum Metric’s servers. As a result, Quantum Metric essentially received a “live stream” of Users’ activities on the Website and inside the Portal. Kaiser also allowed Adobe, Bing, Twitter, Google, and Dynatrace to intercept an array of sensitive, healthcare-related information about Users from both within and outside the Portal [Dkt. 68 at 3]; see also [Dkt. 44 at 21 ¶ 76 (“Kaiser Permanente has placed Quantum Metric’s ‘Session Replay’ code on its Homepage, Portal Login Page, and other pages on the Site— including within the Portal—which intercepts and records the contents of Kaiser Plan Members’ information and confidential communications, and sends that information and those communications to Quantum Metric.”)]. Similarly, according to Plaintiffs, this case implicates code “connected with” the Adobe Experience Cloud and activity on Adobe’s servers: 107. Kaiser Permanente allows Adobe to intercept Kaiser Plan Members’ personal and sensitive identifying and medical information and private and confidential communications through code connected with the Adobe Experience Cloud a/k/a Adobe Marketing Cloud service embedded on the Site, including within the Portal. 108. The Adobe Experience Cloud service is a suite of products offered by Adobe, which allow businesses to personalize and improve their marketing on websites, apps, and social media pages by collecting and analyzing information about website visitors. *** 112. The Adobe Experience Cloud collects this information through an array of tracking technologies, including cookies and/or web beacons (also known as tags or pixels), such as the thirdparty cookies omtrdc.net, demdex.net, and the Adobe Experience Platform Launch, which delivers a library containing specified tags for other Adobe Experience Cloud solutions. *** 114. Adobe has established subdomains on its own server, such as the subdomain kaiser.tt.omtrdc.net on Adobe’s omtrdc.net server, where Adobe receives and stores the communication

Free access — add to your briefcase to read the full text and ask questions with AI

Doe v. Kaiser Foundation Health Plan, Inc., (N.D. Cal. 2023).

Doe v. Kaiser Foundation Health Plan, Inc. (Doe v. Kaiser Foundation Health Plan, Inc.) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related

§ 15
42 U.S.C. § 15