Fox, Yvonne v. Iowa Health System

Opinion

UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WISCONSIN

YVONNE MART FOX, GRANT NESHEIM, DANIELLE DUCKLEY, and SHELLEY Case No.: 3:18-cv-00327-JDP KITSIS, individually and on behalf of all others similarly situated,

Plaintiffs,

v.

IOWA HEALTH SYSTEM, doing business as UNITYPOINT HEALTH, an Iowa non-profit corporation,

Defendant.

ORDER GRANTING PLAINTIFFS’ MOTION FOR FINAL APPROVAL OF CLASS ACTION SETTLEMENT Plaintiffs in this proposed class action brought 14 claims against Defendant Iowa Health System, d.b.a. UnityPoint Health (“UnityPoint”), regarding its alleged failure to protect Plaintiffs’ personal data in two data security incidents. Dkt. 22. After the Court granted UnityPoint’s motion to dismiss in part, this left Plaintiffs’ claims for breach of contract, breach of the implied covenant of good faith and fair dealing, and unjust enrichment, as well as Plaintiffs Yvonne Mart Fox and Grant Nesheim’s claims under Wisconsin law for negligence, negligence per se, and violation of Wisconsin’s law regarding Confidentiality of Patient Health Care Records, Wis. Stat. §§ 146.81, et seq. Dkt. 55. On June 25, 2020, Plaintiffs filed a Motion for Preliminary Approval of the proposed settlement. Dkt. 84. The settlement, which is memorialized in the Class Action Settlement Agreement filed with this Court on June 25, 2020 (Dkt. 86-1) (“Settlement”), resolves all claims against UnityPoint in the litigation. On September 16, 2020, the Court entered an Order Granting Preliminary Approval of the proposed Settlement. Dkt. 94. In its Preliminary Approval Order, the Court certified the Class for settlement purposes and concluded the terms of the Settlement “are ‘within the range of possible approval.’” Id. The Court also approved the proposed notice plan and set the final approval hearing for February 19, 2021 at 3:00 p.m. Following preliminary approval,

Epiq Class Action & Claims Solutions, Inc., the Court-appointed settlement administrator, implemented the notice plan approved by the Court. Plaintiffs have filed a motion for final approval of a proposed settlement of this lawsuit. Dkt. 100. In their motion, Plaintiffs ask this Court to certify the Class for settlement purposes under Rules 23(b)(2) and 23(b)(3), find that the Settlement is fair, reasonable and adequate under Rule 23(e)(2), find that the distribution of the Notice complied with the terms of the Settlement, provided the best notice practicable under the circumstances, fully satisfied the requirements of Federal Rule of Civil Procedure 23 and due process, and thus grant final approval of the Settlement. For the reasons below, the Court grants their motion. ANALYSIS Approval of class action settlements proceeds in two stages: (1) preliminary approval, followed by notice to the class, and then (2) final approval. See Manual for Complex Litigation (Fourth) § 21.63 (2004). The Court completed the first stage in the settlement approval process when it granted preliminary approval on the Settlement and provisionally certified the Settlement Class. Dkt. 94. The Preliminary Approval order made specific preliminary findings that the Class met each of the four Rule 23(a) requirements of numerosity, commonality, typicality, and adequacy. Dkt. 94. The Court also found that the Class met each of the Rule 23(b)(3) requirements: predominance and superiority. Dkt. 94. The Court now grants final approval of the Settlement because Rule 23’s requirements have been satisfied, the Settlement is fair, reasonable and adequate, and the Court-approved notice plan satisfies due process requirements and has been fully implemented. A. Settlement Class Certification The parties propose the following class definition for purposes of settlement:

[A]ll Persons to whom UnityPoint sent notification that their personal information and/or protected health information may have been or was exposed to unauthorized third parties as a result of the data security incidents described as the First Data Breach and the Second Data Breach in the Second Amended Class Action Complaint. Dkt. 85-1, ¶ 17(z). Although the parties have settled, the court must still certify that the Settlement Class satisfies the requirements of Federal Rule of Civil Procedure 23. Federal Rule of Civil Procedure 23(a) enumerates four prerequisites for class certification: (1) numerosity; (2) commonality; (3) typicality; and (4) adequacy of representation. Fed. R. Civ. P. 23(a). Each is satisfied here. Numerosity requires the proposed class to be so numerous that joinder is impracticable. Fed. R. Civ. P. 23(a). The court of appeals has deemed classes of 40 members to be sufficient. See Swanson v. Am. Consumer Indus., Inc., 415 F.2d 1326, 1333 n.9 (7th Cir. 1969). UnityPoint sent notification as described in the Settlement Class definition to approximately 1.4 million customers, so numerosity is easily met. Commonality requires that the action involve “questions of law or fact common to the class.” Fed. R. Civ. P. 23(a)(2). In other words, a proposed class meets this requirement if “determining the truth or falsity of [a] common contention will resolve an issue that is central to the validity of each claim.” Chi. Teachers Union, Local No. 1. v. Bd. of Educ., 797 F.3d 426, 434 (7th Cir. 2015). Plaintiffs’ claims involve many common questions, including whether UnityPoint was contractually obliged to protect Class members’ data, whether UnityPoint failed to take reasonable measures to protect that data, whether the data breaches were caused by such failures, and whether Class members are entitled to relief because of the data breaches. These questions will be answered by evidence that applies to all Plaintiffs, such as what contracts UnityPoint has with its customers, what security measures UnityPoint took before the data breaches, and the ways in which UnityPoint’s data was breached. Thus, commonality is met as well. Typicality requires the Class Representatives’ claims to be typical of the claims of the proposed class. Plaintiffs suffered the same harm that all members of the proposed Class suffered—their personal data was exposed during the data breaches, exposing them to the threat of future identity theft and fraud. See Lewert v. P.F. Chang’s China Bistro, 819 F.3d 963, 966–67 (7th Cir. 2016) (discussing concrete harm of “increased risk of fraudulent charges and identity theft” resulting from data breach). Nothing in Plaintiffs’ declarations suggests that their claims differ in any fundamental way from other Class members’ claims. See Dkts. 89–92. Therefore, the Class Representatives have satisfied this requirement. Adequacy of representation has two components: (1) whether the class representatives’ interests are aligned with the class’s interests; and (2) whether class counsel can capably litigate the case. Gomez v. St. Vincent Health, Inc., 649 F.3d 583, 592 (7th Cir. 2011). The court sees no apparent conflicts between the named Plaintiffs’ interests and those of the rest of the Class. Plaintiffs’ counsel has capably litigated the case so far, surviving UnityPoint’s motion to dismiss, and nothing in the litigation up to this point calls counsel’s capabilities into question. As such, this requirement is met as well. In addition to satisfying Rule 23(a)’s four prerequisites, the Settlement Class must also satisfy the requirements of one of Rule 23(b)’s three subsections. Plaintiffs contend that this action satisfies Rule 23(b)(3), which requires that the action’s common questions of law or fact predominate over questions that affect only individual members, and that the controversy would best be resolved through a class action. To determine whether common questions predominate, the court considers (1) the class members’ interests in individually controlling their own claims; (2) the nature and extent of any other litigation about the controversy; (3) the desirability of concentrating the litigation here; and (4) any management challenges that the case may present. Fed. R. Civ. P. 23(b)(3). First, although individual Class members have an interest in controlling their own claims, they also have an interest in efficiently resolving their claims, which a class action and the proposed settlement provide. Individual litigation of each Class member’s claims would be expensive and time-consuming, and the cost of litigation would likely exceed any recovery. Second, there is no indication that any Class members are pursuing other litigation related to the claims at issue in this case. Third, consolidating the common issues and resolving them in one case is efficient. Fourth, the case presents no management difficulties because the parties have settled. See Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 620 (1997) (courts need not inquire into management difficulties when considering class certification for purposes of settlement). Accordingly, the predominance requirement is satisfied. Superiority is also satisfied. This action involves a large number of low-value claims. Resolving those claims through a class action will save time and expense for both the class members and UnityPoint, and it will also conserve court resources. The proposed Class satisfies all of Rule 23’s requirements, so the court will finally certify the Settlement Class. B. Notice The approved Notice plan provided for direct mail notice to all class members at their last known address according to UnityPoint’s records, as updated by the administrator through the U.S. Postal Service. For postcards returned undeliverable, the administrator tried to find updated addresses for those class members. The administrator maintained the Settlement website and made Spanish versions of the Long Form Notice and Claim Form available upon request. The administrator also maintained a toll-free telephone line which provides class members detailed information about the settlement and allows individuals to request a claim form be mailed to them. The Court finds that this Notice (i) constituted the best notice practicable under the circumstances; (ii) was reasonably calculated, under the circumstances, to apprise Settlement Class members of the Settlement, the effect of the Settlement (including the release therein), and their right to object to the terms of the settlement and appear at the Final Approval Hearing; (iii) constituted due and sufficient notice of the Settlement to all reasonably identifiable persons entitled to receive such notice; (iv) satisfied the requirements of due process, Federal Rule of Civil Procedure 23(e)(1) and the Class Action Fairness Act of 2005, 28 U.S.C. § 1715, and all applicable laws and rules. C. Final approval The Class has been certified, so the court must determine whether to finally approve the proposed Settlement. The court may grant final approval to a settlement only after a hearing and on a finding that the settlement is “fair, reasonable and adequate.” Bills v. TLC Homes Inc., No. 19-CV-148-PP, 2020 WL 5982880, at *1 (E.D. Wis. Oct. 8, 2020) (citing Fed. R. Civ. P. 23(e)(2)). The Court, having conducted the required hearing and finding that the settlement is fair, reasonable, and adequate, now grants final approval. Rule 23(e)(2) requires consideration of the following factors: (A) the class representatives and class counsel have adequately represented the class; (B) the proposal was negotiated at arm's length; (C) the relief provided for the class is adequate, taking into account: (i) the costs, risks, and delay of trial and appeal; (ii) the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims; (iii) the terms of any proposed award of attorney's fees, including timing of payment; and (iv) any agreement required to be identified under Rule 23(e)(3); and (D) the proposal treats class members equitably relative to each other. Here, each factor weighs in favor of final approval of this settlement. As to the first factor, as discussed above, Plaintiffs and Class Counsel have adequately represented the Settlement Class—prosecuting the claims against UnityPoint and working to gather the documents and information necessary to properly evaluate the case, to prepare for trial, and then Settlement. Second, the Settlement was negotiated at arm’s length. The Settlement was negotiated between Plaintiffs’ counsel and UnityPoint’s counsel both directly between the parties and in consultation with the Honorable Morton Denlow (Ret.), and involved both in-person and additional telephonic mediation sessions to secure an agreement. The involvement of the mediator and the work it took to resolve this litigation demonstrates that the Settlement was reached as the result of an arms-length negotiation. Third, the relief provided for the Class is adequate. The Settlement, Dkt. 85-1, would provide one year of credit monitoring for all Class members, deferable for up to one year. It would reimburse Class members for 100 percent of what the agreement describes as “ordinary” out-of- pocket expenses, most notably costs and up to three hours of lost time for purchasing credit monitoring services and requesting credit freezes, up to $1,000. It would also reimburse Class members for 100 percent of costs and up to 10 hours of lost time incurred responding to actual identity theft, up to $6,000. Class members must document their actual costs but aren’t required to document their lost time compensable as ordinary expenses, which is to be reimbursed at $15 per hour. The Settlement does not cap the total amount of monetary benefits available to the Class, meaning that all Class members who submit valid claims will be reimbursed for the full amount of their expenses up to the stated limits, regardless of how many Class members submit claims. The Settlement would also require UnityPoint to adopt a set of security measures to reduce the risk of future data breaches. In addition, UnityPoint will engage an independent third-party professional services firm to conduct an annual assessment, which will include review of UnityPoint’s compliance with the business practice commitments set forth in Exhibit A to the Settlement, and UnityPoint will provide Class Counsel a copy of this annual assessment for two years after the Settlement. Class Counsel will have the opportunity to inquire about each assessment produced, and UnityPoint will be obligated to respond to each such inquiry within thirty days. If Class Counsel believes that UnityPoint is not complying with its business practice commitments, Class Counsel will meet and confer with UnityPoint’s Counsel before seeking relief from the Court. Within two weeks of receiving the assessment, Class Counsel will file the assessment and any inquiry with the Court under Seal. In sum, all Class members who make valid claims will receive a year of free credit monitoring and will benefit from UnityPoint’s improved security measures, and all Class members who have incurred actual expenses, including lost time, will be reimbursed for those expenses up to the agreement’s limits. In addition to the other amounts due under the Settlement, UnityPoint will pay the cost of class notice and claims administration. This relief is particularly adequate given the costs, risks, and delay of trial and appeal. Data breach litigation is evolving; there is no guarantee of the ultimate result. See Gordon v. Chipotle Mexican Grill, Inc., No. 17-cv-01415-CMA-SKC, 2019 WL 6972701, at *1 (D. Colo. Dec. 16, 2019) (“Data breach cases . . . are particularly risky, expensive, and complex.”). Plaintiffs also faced the risk that UnityPoint would successfully oppose class certification, obtain summary judgment on one or more of their claims, or win at trial or on appeal. Also, the cost for UnityPoint and Plaintiffs to maintain the lawsuit would be high, given the amount of documentary evidence as well as the expert costs both parties would incur in the context of class certification, summary judgment, and trial. As such, the current Settlement strikes an appropriate balance between Plaintiffs’ “likelihood of success on the merits” and “the amount and form of the relief offered in the settlement.” See Carson v. Am. Brands, Inc., 450 U.S. 79, 88 n.14 (1981). The Settlement also provides an effective method of distributing relief to the Settlement Class through simplified processing of claims. The Court previously reviewed the proposed notice to the Class and found that it complies with the requirements of Federal Rule of Civil Procedure 23. The claims administrator is maintaining a settlement website, a toll-free telephone number, and a mailing address through which settlement class members can obtain information and file claims. Claimants can complete and submit either a written or online claim form to the claims administrator, postmarked or electronically submitted on or before March 2, 2021. If the claims administrator determines that a claim is incomplete, the claimant is given an opportunity to supplement the Claim. An anonymized list of putative members of the Settlement Class who have elected to opt- out of the Settlement and the Settlement Class, in accordance with the requirements in the Settlement, has been submitted to the Court as an attachment to the Supplemental Declaration of Cameron R. Azari, Esq. on Implementation of Settlement Notice Plan, Adequacy of Notice and Claims Process, filed in advance of the Final Approval Hearing. The Claims Administrator received one untimely opt out who requested that her opt out be considered timely because she received her notice after the opt-out deadline. UnityPoint opposed allowance of the untimely opt out. The Court ordered both parties to brief the issue, after which the Court held that the untimely opt out should be considered timely. Dkt. No. 111. Thus, all persons included on the Exhibit to the Supplemental Declaration of Cameron R. Azari, Esq. on Implementation of Settlement Notice Plan, Adequacy of Notice and Claims Process, filed in advance of the Final Approval Hearing, including the late-received opt-out addressed in this Court’s February 26 order at Dkt. 111, are not bound by the Settlement or this Final Approval Order, and they are not entitled to any of the benefits under the Settlement. There were no objections to the Settlement. The terms of any proposed award of attorneys’ fees support the adequacy of the relief. Plaintiffs seeks and UnityPoint has agreed not to oppose an award of attorneys’ fees and reimbursement of litigation costs and expenses in an amount not to exceed $1,575,000. UnityPoint will pay the fee award in addition to any benefits provided to Settlement Class members and the cost of settlement administration. The named Plaintiffs also seek and UnityPoint has agreed to pay an incentive award of $2,500 to each named Plaintiff, subject to Court approval. The parties did not negotiate attorneys’ fees and costs or incentive awards until after they had agreed upon all substantive elements of the Settlement. Further, this component of the Settlement was negotiated at arm’s-length under the direction of an experienced mediator. Fourth and finally, the Settlement treats Settlement Class members equitably relative to each other. All Settlement Class members are eligible for one year of credit monitoring—a consistent remedy appropriate across the entire settlement class. The Settlement provides for different relief to Settlement Class members who have incurred different damages resulting from the security incidents, allowing specific claims for ordinary expenses or extraordinary expenses. To the extent Settlement Class members receive different compensation under the Settlement, it will reflect their different losses and be proportionate to their actual harms. Additionally, all Settlement Class members will benefit from UnityPoint’s improved security measures. After considering the Rule 23(e)(2) factors, the Court determines that the Settlement is fair, reasonable, and adequate and the Settlement is therefore approved. Plaintiffs’ Motion for Final Approval of the Class Action Settlement is granted. The Court has considered Class Counsel’s Fee Application along with the declaration submitted by Class Counsel, for in camera review, setting forth their time and expenses incurred in connection with this litigation. The Court finds that the attorneys’ fees and costs in the amount of $1,575,000 requested by Class Counsel are fair and reasonable, given Class Counsel’s efforts to date, the results achieved through this litigation, and the contingent nature of any fee award. Accordingly, Class Counsel are hereby awarded $1,575,000 in attorneys’ fees and costs. This award of attorneys’ fees and costs is independent of the Court’s consideration of the fairness, reasonableness, and adequacy of the Settlement. Pursuant to the Settlement, Class Counsel’s attorneys’ fees and in costs in the amount of $1,575,000 are to be paid separately by Defendant. Further, as contemplated in paragraph 58 of the Settlement Agreement, one or more Plaintiffs’ counsel shall have the option to receive any attorneys’ fees and costs awarded hereunder in the form of periodic payments in lieu of a lump sum payment, and the Parties may authorize a qualified settlement fund under 26 U.S.C. § 468B to be established with any qualified trustee, including the Settlement Administrator, if any Plaintiffs’ counsel desires to receive periodic payments in lieu of a lump sum payment of attorneys’ fees and costs. Without affecting the finality of the Court’s Judgment in any way, the Court retains jurisdiction over this matter in accordance with the Settlement Agreement. The Court further finds that the requested incentive awards of $2,500 to each individual Class Representative, as provided in the Settlement, are fair and reasonable given the time and effort expended by the Class Representatives on behalf of the Settlement Class. Pursuant to the Settlement, the incentive awards are to be paid separately by Defendant.

Entered this 4th day of March, 2021.

/s/ __________________________________ JAMES D. PETERSON United States District Judge 4823-3794-6842, v. 6 4823-3794-6842, v. 6