Griggs v. NHS Management LLC

• Court: District Court, N.D. Alabama
• Decided: June 26, 2023
• Docket: 2:22-cv-00565
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ALABAMA SOUTHERN DIVISION SHYMIKKA GRIGGS, } } Plaintiff, } } v. } Case No.: 2:22-cv-00565-RDP } NHS MANAGEMENT LLC, } } Defendant. }

MEMORANDUM OPINION AND ORDER

“The first principle governing the jurisdiction of the federal courts is that federal courts are courts of limited rather than general jurisdiction.” Kelly v. Harris, 331 F.3d 817, 819 (11th Cir. 2003). For this reason, “federal courts always have an obligation to examine sua sponte their jurisdiction before reaching the merits of any claim.” Id. In keeping with that obligation, the court ordered supplemental briefing on whether it has subject matter jurisdiction over this action under the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332(d). (Doc. # 25). After careful review of the record, briefings, and applicable law, the court finds that Plaintiff has failed to allege sufficient facts plausibly establishing this court’s subject matter jurisdiction under CAFA. Accordingly, this action is due to be dismissed without prejudice. I. Background This case arises from a “sophisticated cyberattack” perpetrated against Defendant NHS Management, LLC (“NHS”) between February 25, 2021 and March 16, 2021. (Doc. # 1 ¶ 1). NHS is a limited liability company established in 2002 under Delaware law that maintains its principal place of business in Alabama. (Id. ¶ 18). It provides management and consulting services for nursing homes and physical rehabilitation facilities located in Alabama (35 facilities), Arkansas (5 facilities), Florida (5 facilities), and Missouri (5 facilities). (Id. ¶¶ 22–23). Plaintiff Shymikka Griggs is an Alabama citizen and former NHS employee. (Id. ¶¶ 17, 99). On April 4, 2022, NHS notified Plaintiff that her personal information was accessed during the 2021 data breach. (Id. ¶¶ 99–101). The accessed information included Plaintiff’s name, date of birth, Social Security number, medical information, and health insurance information. (Id. ¶ 101).

According to Plaintiff, the personal information of over 500 individuals was exposed during the data breach. (Id. ¶ 32). This included NHS employees and vendors, as well as patients and residents of the facilities NHS serves and their family members and guardians. (Id. ¶ 31). Plaintiff filed the instant action on May 4, 2022, claiming that NHS is responsible for the data breach because of its failure to follow industry standard practices for securing sensitive information. (Id. ¶ 26). She alleges that NHS “inadequately trains its employees on cybersecurity policies, fails to enforce those polices, or maintains unreasonable or inadequate security practices and systems.” (Id.). Plaintiff’s class action complaint against NHS contains seven counts, and each claim arises

from state common law: (1) Negligence; (2) Negligence Per Se; (3) Breach of Implied Contract; (4) Invasion of Privacy; (5) Unjust Enrichment; (6) Breach of Confidence; and (7) Breach of Fiduciary Duty. (Id. ¶¶ 140–94). Plaintiff also seeks to bring these claims on behalf of similarly situated individuals whose personal information was accessed during the data breach. She proposes two classes. The first includes “[a]ll persons whose Personal Information was compromised as a result of the Data Breach reported to HHS on or about October 29, 2021 by Defendant NHS (the ‘Class’).” (Id. ¶ 128). The second is a “subclass of those Alabama citizens who Personal Information was compromised as a result of the Data Breach reported to HHS on or about October 29, 2021 by Defendant NHS (the “Alabama subclass”). (Id.). Plaintiff claims that “members of the proposed Class are citizens of states different from Defendant.” (Id. ¶ 19). Plaintiff provides no other information about the identity or citizenship of proposed class members.

On January 24, 2023, the court entered an order requiring the parties to provide supplemental briefing on the existence of subject matter jurisdiction under CAFA. (Doc. # 25). In response to that order, NHS provided Plaintiff with an email communication outlining the number of putative plaintiffs who were sent notices of the 2021 data breach which was broken down by the state to which each individual’s notice was sent. (Doc. # 26-1). This document shows that NHS sent notice letters to putative class members at addresses in nearly every state. (Doc. # 26 at 3). It also shows that slightly more than two-thirds of the notice letters dispatched by NHS to putative class members were sent to Alabama addresses. (Id. at 7). II. Legal Standard

“Consistent with the limited nature of federal jurisdiction, the party seeking a federal venue must establish the venue’s jurisdictional requirements.” Lowery v. Ala. Power Co., 483 F.3d 1184, 1207–08 (11th Cir. 2007) (finding that this “longstanding, near-canonical rule” applies in CAFA cases). So, “[w]hen a plaintiff files suit in federal court, she must allege facts that, if true, show federal subject matter jurisdiction over her case exists.” Travaglio v. Am. Express Co., 735 F.3d 1266, 1268 (11th Cir. 2013). Conclusory allegations are insufficient to meet this burden. Pretka v. Kolter City Plaza II, Inc., 608 F.3d 744, 752 (11th Cir. 2010). If a complaint’s non-conclusory factual allegations, taken as true, do not establish the existence of subject matter jurisdiction, the court must dismiss the action. See Travaglio, 735 F.3d at 1269 (“That is, if a complaint’s factual allegations do not assure the court it has subject matter jurisdiction, then the court is without power to do anything in the case.”); Lawrence v. Dunbar, 919 F.2d 1525, 1529 (11th Cir. 1990) (per curiam) (“Facial attacks on the complaint require the court merely to look and see if the plaintiff has sufficiently alleged a basis of subject matter jurisdiction, and the allegations in his complaint are taken as true for the purposes of the motion.”

(cleaned up)). Moreover, even when a plaintiff plausibly alleges that the jurisdictional requirements are met, if the opposing party or the court questions those allegations, the plaintiff must show by a preponderance of the evidence that the jurisdictional requirements are met. See Anderson v. Wilco Life Ins. Co., 943 F.3d 917, 925 (11th Cir. 2019); King v. Cessna Aircraft Co., 505 F.3d 1160, 1171 (11th Cir. 2007) (“Where, as here, the plaintiff asserts diversity jurisdiction, he has the burden to prove that there is diversity.”). To determine whether the plaintiff has carried its burden, a court may rely on evidence provided by the parties, as well as reasonable inferences and deductions drawn from that evidence. Anderson, 943 F.3d at 925.

III. Discussion Plaintiff alleges that this court has subject matter jurisdiction under CAFA, 28 U.S.C. § 1332(d). CAFA provides that federal courts have original jurisdiction over class actions that meet four threshold requirements. “These requirements are: (1) an amount in controversy requirement of an aggregate of $5,000,000 in claims; (2) a diversity requirement of minimal diversity; (3) a numerosity requirement that the action involve the monetary claims of 100 or more plaintiffs; and (4) a commonality requirement that the plaintiffs’ claims involve common questions of law or fact.” Lowery, 483 F.3d at 1202–03; 28 U.S.C. § 1332(d). But, CAFA also provides exceptions to federal jurisdiction: (1) the local controversy exception, § 1332(d)(4)(A); (2) the home state exception, § 1332(d)(4)(B); and (3) the discretionary exception, § 1332(d)(3). The local controversy exception mandates that a district court cannot exercise jurisdiction when (1) more than two-thirds of the plaintiffs are citizens of the state in which the action was

filed; (2) at least one “significant” defendant is a citizen of the state of filing; and (3) the principal injuries were incurred in the state of filing. Smith v. Marcus & Millichap, Inc., 991 F.3d 1145, 1155 (11th Cir. 2021); 28 U.S.C. § 1332(d)(4)(A). “The home state exception applies if ‘two-thirds or more of the members of all proposed plaintiff classes in the aggregate, and the primary defendants, are citizens of the State in which the action was originally filed.’” Hunter v. City of Montgomery, 859 F.3d 1329, 1335 (11th Cir. 2017) (quoting 28 U.S.C. § 1332(d)(4)(B)). Finally, the discretionary exception grants a district court discretion to decline to exercise jurisdiction “in the interests of justice and looking at the totality of the circumstances” when (1)

more than one-third but less than two-thirds of the plaintiffs are citizens of the state in which the action was originally filed; and (2) the primary defendants are citizens of the state in which the action was originally filed. Smith, 991 F.3d at 1150; 28 U.S.C. § 1332(d)(3). However, the court need not address the applicability of CAFA’s exceptions in this case because Plaintiff has failed to establish the threshold requirements for original CAFA jurisdiction. A. Plaintiff has failed to plausibly allege minimal diversity. “To determine whether minimal diversity exists, courts consider the citizenship of all the class members (including putative), both named and unnamed.” Id. at 1149 (citing 28 U.S.C. § 1332(d)(1)(D)). Therefore, CAFA requires only that at least one plaintiff is diverse from at least one defendant. Id. The normal rule regarding citizenship of a limited liability company does not apply in CAFA cases. Instead, CAFA provides that “an unincorporated association shall be deemed to be a citizen of the State where it has its principal place of business and the State under whose laws it

is organized.” 28 U.S.C. § 1332(d)(10). Therefore, for purposes of this case, NHS is a citizen of Delaware and Alabama because it was formed under Delaware law and maintains its principal place of business in Alabama. (Doc. # 1 ¶ 18). The parties agree that Plaintiff is a citizen of Alabama. (Id. ¶ 17). Thus, to satisfy CAFA’s minimal diversity requirement, Plaintiff must demonstrate that at least one putative class member is a citizen of a state other than Delaware or Alabama. See King, 505 F.3d at 1171 (“Where, as here, the plaintiff asserts diversity jurisdiction, [s]he has the burden to prove that there is diversity.”). In her complaint, Plaintiff alleges that “members of the proposed Class are citizens of states different from Defendant.” (Doc. # 1 ¶ 19). But Plaintiff provides no

facts supporting this conclusory allegation. Plaintiff alleges that the victims of the data breach included NHS employees and vendors, as well as patients and residents of the facilities NHS serves and their family members and guardians. (Id. ¶ 31). She further alleges that NHS serves 35 facilities in Alabama, 5 in Arkansas, 5 in Florida, and 5 in Missouri. (Id. ¶ 23). Plaintiff argues that these allegations are sufficient to establish minimal diversity because “[l]ogically it follows that at least one class member must be a citizen of a state other than either Alabama or Delaware[.]” (Doc. # 26 at 3). Plaintiff also contends that “this inference is buttressed by NHS’s disclosures regarding the addresses to which Notice Letters were mailed” because letters “were sent to one or more individuals in virtually every state[.]” (Id.). However, “[c]itizenship, not residence, is the key fact that must be alleged in the complaint to establish diversity for a natural person.” Maier v. Green Eyes USA, Inc., 845 F. App’x 869, 876 (11th Cir. 2021) (per curiam) (quoting Taylor v. Appleton, 30 F.3d 1365, 1367 (11th Cir. 1994)).

“Citizenship is equivalent to ‘domicile’ for purposes of diversity jurisdiction.” Id. (quoting McCormick v. Aderholt, 293 F.3d 1254, 1257 (11th Cir. 2002) (per curiam)). “And domicile requires both residence in a state and an intention to remain there indefinitely.” Id. (quoting Travaglio, 735 F.3d at 1269); see Smith, 991 F.3d at 1157 (noting that allegations of residence alone are insufficient to establish minimal diversity because “citizenship for purposes of CAFA jurisdiction is based on current residency and an intent to remain”). At best, the NHS notice letters establish residency, not citizenship. And, the mere fact that NHS serves facilities in states other than Alabama or Delaware is insufficient to establish the citizenship of any putative class member, especially when Plaintiff has not specifically identified any putative plaintiffs.1 Plaintiff’s factual allegations do not provide sufficient information for the

court to determine the citizenship of any putative class members. Therefore, Plaintiff has not met her burden to establish the existence of subject matter jurisdiction under CAFA. See Crist v. Carnival Corp., 410 F. App’x 197, 200 (11th Cir. 2010) (per curiam) (“The allegation that [the

1 Indeed, Plaintiff readily admits this deficiency. In her response to the court’s supplemental briefing order, Plaintiff argues that CAFA’s local controversy exception does not apply, despite the fact that that more than two- thirds of NHS’s facilities are located in Alabama, and more than two-thirds of putative class members received notice letters at Alabama addresses. (Doc. # 26 at 7–8). (The local controversy exception only applies when more than two- thirds of plaintiffs are citizens of the state in which the action was originally filed. Smith, 991 F.3d at 1155.) Plaintiff acknowledges that “the fact that a person lives in a certain geographic area does not establish necessarily that the person is a citizen of that state.” (Doc. # 26 at 8). And, she admits that “the Notice Letter delivery addresses do not indicate the citizenship (i.e., residency and intent to remain) of people admitted to NHS’s nursing facilities” and that “these addresses provide little or no proof of class members’ state of residence or their intent to remain in Alabama.” (Id. at 7–8). plaintiff] is a ‘resident’ of Florida is insufficient for diversity jurisdiction purposes because residency is not the equivalent of citizenship.”); Beavers v. A.O. Smith Elec. Prods. Co., 265 F. App’x 772, 778 (11th Cir. 2008) (per curiam) (“The plaintiff’s complaint alleges only the residence of the nearly 100 plaintiffs, not their states of citizenship. Because the plaintiffs have the burden to ‘affirmatively allege facts demonstrating the existence of jurisdiction,’ and failed to allege the

citizenship of the individual plaintiffs, the district court lacked subject matter jurisdiction on the face of the complaint.” (citation omitted)); Calmes v. Boca W. Country Club, Inc., No. 17-CV- 80574, 2017 WL 4621112, at *2 (S.D. Fla. Oct. 16, 2017) (“Although Plaintiff alleges that there are class members who are citizens of states other than Florida, he does not offer any support for these statements or even name the state of which the other class members are citizens. This is insufficient to persuade the Court that minimal diversity is met and that it has subject-matter jurisdiction under CAFA to hear this case.”). IV. Conclusion Although Defendant does not challenge the court’s jurisdiction under CAFA, “[i]t is

axiomatic that federal jurisdiction can never be created by the parties. Even though a particular litigant or both litigants in a case may for some reason desire to be in federal court, there is an obligation to admit the lack of jurisdiction where it does not exist and to make inquiry when jurisdiction is uncertain.” Fitzgerald v. Seaboard Sys. R.R., Inc., 760 F.2d 1249, 1251 (11th Cir. 1985) (per curiam). Courts are required to independently examine their own jurisdiction. DeRoy v. Carnival Corp., 963 F.3d 1302, 1311 (11th Cir. 2020). So, a court cannot simply rely upon the parties’ agreement that the court has jurisdiction. “If the court determines at any time that it lacks subject-matter jurisdiction, the court must dismiss the action.” Fed. R. Civ. P. 12(h)(3). For the reasons explained above, based on the allegations of Plaintiff's Complaint, the court cannot say that it has CAPA jurisdiction over this case. However, the court is cognizant of the possibility that Plaintiff may be able replead her Complaint with allegations that establish CAFA jurisdiction. Should Plaintiff believe she may have information which, if pled, could establish CAFA jurisdiction, on or before July 21, 2023, she SHALL file an amended complaint. Any amended complaint MUST appropriately address the citizenship of putative class members. If no amendment is filed, the court will dismiss the case without prejudice. DONE and ORDERED this June 26, 2023.

UNITED STATES DISTRICT JUDGE