In re HealthEquity,Inc. Data Security Incident Litigation

Opinion

THE UNITED STATES DISTRICT COURT DISTRICT OF UTAH

KRISTIN HAFOKA, individually and on MEMORANDUM DECISION AND behalf of all others similarly situated, et al. ORDER

Plaintiffs, Case No. 2:24-cv-00528-JNP-DBP v. Chief District Judge Jill N. Parrish HEALTHEQUITY, INC., FURTHER OPERATIONS, LLC and WAGEWORKS, Chief Magistrate Judge Dustin B. Pead INC.,

Defendants.

Before the court are two related motions. Plaintiffs move the court to overrule Defendants’ objections to certain discovery requests and compel better answers and production.1 Defendant HealthEquity, Inc. moves for leave to conduct “reciprocal arbitration-related discovery on Plaintiffs.”2 The court addresses each of the parties’ motions herein.3 BACKGROUND As noted in the court’s prior order, this case is a putative class action for a data breach. Defendants administer health savings accounts and work with various clients. Plaintiffs are consumers that had their personal identifiable information, or protected health information, compromised in a data breach. Defendants seek to arbitrate the parties’ dispute.

1 ECF No. 80. 2 ECF No. 86. 3 This matter is referred to the undersigned from Judge Jill Parrish pursuant to 28 U.S.C. § 636(b)(1)(A) to hear and determine all nondispositive pretrial matters. ECF No. 62. The court elects to decide the Motion based on the written memoranda. DUCivR 7-1(g) (2024). On April 18, 2025, the court granted Plaintiffs’ Motion allowing arbitration discovery related to the issue of contract formation. In essence, Plaintiffs contest the formation of any contract requiring arbitration, while in contrast, Defendants aver that arbitration is required. In the April 18th Order the court set forth the framework for determining whether the

parties agreed to arbitration, so it need not be set forth again. However, one important tenet bears repeating here in connection with arbitration related discovery. The Tenth Circuit has specifically stated “round after round of discovery and motions practice isn't the answer. Parties should not have to endure years of waiting and exhaust legions of photocopiers in discovery and motions practice merely to learn where their dispute will be heard. The [Arbitration] Act requires courts process the venue question quickly so the parties can get on with the merits of their dispute in the right forum. It calls for a summary trial—not death by discovery.”4 Thus, discovery on the question of whether the parties agreed to arbitrate should be limited and this case should not descend into “death by discovery.” On June 5, 2025, the court denied without prejudice HealthEquity’s Motion to Dismiss and its Motion to Compel Arbitration.5 The court did so in “order to allow the parties time to

resolve their discovery disputes, and to afford HealthEquity the opportunity to incorporate the discovery into its motion.”6 After the parties compete arbitration-related discovery, the court noted, “HealthEquity may refile a motion to compel arbitration.”7 The instant motions both focus on arbitration-related discovery.

4 Howard v. Ferrellgas Partners, L.P., 748 F.3d 975, 978, 2014 WL 1363963 (10th Cir. 2014). 5 Order Denying Without Prejudice Motion to Compel Arbitration, Denying Without Prejudice Motion to Dismiss and Denying as Moot Motion for An Extension of Time, ECF No. 83 (June 5th Order). 6 Id.at 1. 7 Id. DISCUSSION I. Plaintiffs’ Discovery Motion Plaintiffs request the court overrule Defendants’’ objections and order Defendants to provide better answers and productions to Plaintiff’s arbitration-related discovery requests.

Plaintiffs also seeks to have Defendants prepare a corporate representative for deposition on two general topics “(a) non-HSA agreements and (b) procedures for enrolling Plaintiffs as customers.”8 Specifically, Plaintiffs seek complete answers and production to Interrogatories 2- 4, and Request for Production 6-8, 14-16 and 20, along with a Rule 30(b)(6) designee to testify as to Topics 3 and 6. Plaintiffs argue the absence of an arbitration in the non-HSA agreements is “directly relevant to contract formation.” Further, if one agreement has an arbitration provision, but another does not, then according to Plaintiffs, such circumstances do not demonstrate a meeting of the minds regarding arbitration. In support Plaintiffs rely on three cases, Bellman v. I3Carbon, Ltd.,9 Summit Contractors, Inc. v. Legacy Corner, L.L.C.,10 and Penhall v. Young Living Essential Oils.11

In Bellman the defendants pointed to an investment binder as evidence the parties agreed to arbitration. On appeal, the Tenth Circuit found the defendants failed to show an enforceable arbitration agreement as there were differences in the investment binder. The operating agreement provided for arbitration, while the subscription agreement did not. Tellingly, the court noted the uncontroverted evidence showed the defendant never requested that plaintiffs

8 Plaintiffs’ Motion to Overrule Objections at 2, ECF No. 80. 9 563 F. App’x 608 (10th Cir 2014). 10 147 F. App’x 798 (10th Cir. 2005). 11 220CV61DBBCMR, 2022 U.S. Dist. LEXIS 156686, 2022 WL 3716928 (D. Utah Aug. 29, 2022), vacated in part sub nom. Penhall v. Young Living Essential Oils, LC, No. 220CV00617DBBCMR, 2022 WL 15504063 (D. Utah Oct. 27, 2022). sign the operating agreement, and in fact, the plaintiffs never did sign the operating agreement.12 Thus, the documents with “conflicting provisions regarding arbitration” in the investment binder did not “demonstrate a meeting of the minds regarding arbitration.”13 The Tenth Circuit reached a similar decision in Summit Contractors. There the court

considered a construction contract and an identity of interest agreement. In considering the two documents together, “their clear and unambiguous language indicate[ed] that the parties did not intend to arbitrate”.14 In reaching that decision, the court noted that both documents contained merger clauses, the failure of the construction contract to incorporate or mention the identity of interest agreement, and the identity of interest agreement did not contain an arbitration clause. In Penhall the court denied the defendant’s motion to compel arbitration. The court noted the differences between the original arbitration agreement and the forum selection clause. Due to their irreconcilable conflicts, the original arbitration agreement was not a valid agreement.15 Defendants seek to distinguish Plaintiffs’ cited authority by asserting it only applies if the conflicting agreements cover the same subject matter. For example, in Bellmon the separate agreements governed the same investment transaction16 and in Penhall, the conflicting clauses

were contained in a packet of required agreements.17 In contrast here, Defendants move to

12 The Tenth Circuit noted that while the Federal Arbitration Act dose not require signatures of the parties to have an enforceable arbitration agreement, the “parties must still have entered into a valid arbitration agreement under state law.” Bellman, 563 F. App'x at 614. 13 Id. 14 Summit Contractors, 147 F. App’x at 801. 15 Penhall, 2022 WL 3716928, at *5. 16 Bellmon 563 F. App’x at 614 (“Defendants argue that Plaintiffs manifested their acceptance of the Operating Agreement, and specifically the arbitration provision, when they invested in i3Carbon following receipt of the approximately 200–page Investment Binder.”). 17 Penhall, 2022 WL 3716928, at *2 (“Directly below the clickwrap agreement text, members were presented with distinct hyperlinks, each of which contained the then-operative versions of the Member Agreement, the P&Ps, and the Compensation Agreement.”). compel arbitration for Plaintiffs that “expressly agreed to arbitration as a condition of selecting HealthEquity to serve as their HSA custodian, pursuant to the HSA Custodial Agreement.”18 For other non-HSA products, HealthEquity “serves as a directed third-party administrator of employer sponsored benefit plans and contracts directly with those plan sponsors—not plan participants.”19 Therefore, according to Defendants, there are no product specific agreements

between HealthEquity and Plaintiffs except for HSAs. And any disagreements between the product agreements are irrelevant as they are not between the same parties. Finally, Defendants note Plaintiffs’ discovery is limited to the “issue of contract formation” as set forth by the court in its April 18, 2025, order. Thus, Plaintiffs are not entitled to discovery on “irrelevant, non- HSA products and agreements.”20 The court agrees with Defendants arguments. Defendants seek to compel arbitration for Plaintiffs that agreed for HealthEquity to serve as their HSA custodian. The other non-HSA products are not relevant here and this case is not like those relied on by Plaintiffs with conflicting agreements covering the same subject matter. HealthEquity’s agreements with plan

sponsors are not relevant to HealthEquity’s agreements with the putative Plaintiffs here. Thus, the court is not persuaded to overrule Defendants’ objections and order Defendants to serve better answers. Additionally, the court reviewed the responses Defendants gave to Plaintiffs’ Interrogatives and Requests for Production that are at issue here. After doing so, the court finds they are not as evasive as Plaintiffs suggest. The court also agrees with Defendants that HealthEquity’s enrollment policies are irrelevant. Defendants assert that for HSA owners,

18 Defendant HealthEquity, Inc.’s Opposition at 2, ECF No. 87. 19 Id. 20 Id. contract formation happens with they agree to the terms of the HSA Custodial agreement by “(1) utilizing and accepting the benefits of the account, and/or (2) clicking “I agree” to the terms of the HSA Custodial agreement upon registering their online member portal.”21 This makes information relating to the enrolment process irrelevant to contract formation and outside the

scope of arbitration discovery ordered by this court. Lastly Plaintiffs seek a Rule 30(b)(6) designee to testify on Topics 3 and 6. Topic 3 seeks information concerning: “All agreements, notices, and documents displayed or provided to each Plaintiff (a) when he or she enrolled for any of the Defendants’ Products, and (b) subsequent to the Plaintiff’s enrollment.”22 Defendants responded to this Topic asserting it “goes beyond the scope of arbitration-related discovery as set forth in Defendant’s Response to Plaintiffs’ Arbitration-Related Interrogatories No. 4 and Defendant’s Response to Plaintiffs’ Arbitration- Related Requests for Production No. 16.”23 As set forth previously, the court is not persuaded that Plaintiffs are entitled to discovery concerning non-HSA products. This Topic focuses on “any of the Defendants’ Products” which is beyond the scope of arbitration-related discovery.

Therefore, the court finds this Topic to be overbroad and will not compel a Rule 30(b)(6) designee to testify concerning it. Topic 6 states, “For each Plaintiff, all agreements or Documents signed by the Plaintiff or otherwise reflecting the Plaintiff’s affirmative expression of agreement related to any of the Defendants’ Products.”24 Once again this Topic seeks information concerning “any of the Defendants’ Products.” This is overbroad. Plaintiffs may narrow these topics to focus on the

21 Id. at 3. 22 Defendants Objection to Plaintiffs’ Notice of Rule 30(b)(6) Deposition at 5, ECF No. 84-3. 23 Id. 24 Id.at 6. HSA agreements that Defendants seek to have arbitrated. In essence any 30(b)(6) deposition conducted by Plaintiffs should mirror those depositions Defendant seeks. It should be narrowly tailored to contract formation. Accordingly, Plaintiffs’ Motion to Compel a Rule 30(b)(6) deposition on Topics 3 and 6

is DENIED. II. Defendants’ Discovery Motion Defendant HealthEquity seeks leave to conduct reciprocal arbitration-related discovery including “depositions of all Plaintiffs on [the] narrow issue of contract formation.”25 “Specifically, Defendant … seeks to obtain information related to each Plaintiff’s use of the HealthEquity online member portal and website”.26 Defendant also seeks “any confirmation or data” in Plaintiffs possession relating to the HealthEquity HSA Custodial Agreement and HealthEquity’s Terms of Use.27 Plaintiffs oppose HealthEquity’s discovery requests arguing the requests are procedurally improper, Defendant has failed to show good cause, and the discovery requests are a “tacit admission” that moving to compel arbitration was improper as Defendant

did not verify the evidence they had in support of that motion. In its June 5th order the court denied without prejudice HealthEquity’s Motion to Dismiss and Motion to Compel Arbitration to allow the parties to resolve discovery disputes, and for HealthEquity, to incorporate discovery into its motion. Although a Rule 26(f) conference has not been held, there is nothing precluding HealthEquity from seeking to engage in discovery. Indeed, as has been done in other cases, courts deny such motions without prejudice to permit

25 Defendant HealthEquity, Inc.’s Motion for Arbitration-Related Discovery at 4, ECF No. 86. 26 Motion at 3. 27 Id. discovery.28 Moreover, discovery is even expected by the Federal Arbitration Act that “calls for a summery trial with discovery, wherein evidence on the motion may be received by the Court.”29 Plaintiffs’ procedural argument that because a motion to compel arbitration is not

pending, then Defendant cannot engage in discovery is unavailing. Under that logic, Plaintiffs would also now be precluded from engaging in discovery. The court denied Defendant’s motions without prejudice so the parties could engage and complete arbitration-related discovery, not to preclude them from doing so.30 In addition, the court did not limit discovery only to Plaintiffs in its order granting Plaintiffs’ Motion for Discovery.31 Defendant argues its Motion to Compel Arbitration was based in part on Plaintiffs’ allegation in its Consolidated Class Action Complaint that “Plaintiffs received HSAs and HSA/CDB third-party administration services from Defendants.”32 This allegation, according to Defendant, leads to Plaintiffs entering into valid arbitration agreements, something which, Plaintiffs dispute. HealthEquity’s requested discovery is not a “tacit admission” that it lacks

evidence as asserted by Plaintiffs. Rather, it is a response to Plaintiffs’ Amended Complaint and contesting the formation of a contract to arbitrate in the first instance as the court previously noted.33 This case is not analogous to Cambpell Invs. LLC, v. Dickey’s Barbecue Rests, Inc.

28 Gudge v. 109 Rest. Corp., 118 F. Supp. 3d 543, 547–48 (E.D.N.Y. Aug. 6, 2015) (“Defendants’ motion to compel arbitration is denied, without prejudice to renew following a hearing on whether the parties agreed to arbitrate and specifically whether Plaintiff signed a lease agreement.”). 29 Labertew for P.B. v. WinRed, Inc., No. 2:21-CV-555-TC, 2024 WL 4279035, at *12 (D. Utah Sept. 24, 2024) (citation modified); see also Howard v. Ferrellgas Partners, L.P., 748 F.3d 975, 978 (10th Cir. 2014) (finding district court erred in denying request for evidentiary hearing on validity of arbitration agreement). 30 See, e.g., Wilson v. Yellow Transp. Inc., No. 06-2281-CM, 2007 WL 445197, at *1 (D. Kan. Jan. 29, 2007) (finding “limited discovery on the issue of whether the parties formed a valid and binding contract is appropriate”). 31 Memorandum Decision and Order dated April 18, 2025, ECF No. 75. 32 Consolidated Class Action Complaint at 7, ECF No. 46. 33 Memorandum Decision and Order dated April 18, 2025, at 5. relied on by Plaintiffs, where discovery was denied because the “record admits … no evidence suggesting the existence of a written agreement to arbitrate this dispute.”34 In the instant case, Defendant presented some evidence that suggests an agreement to arbitrate which Plaintiffs dispute. Further, the court disagrees with any underlying notions of a lack of due diligence by

Defendant in bringing a motion to compel arbitration that Plaintiffs appear to suggest. As set forth by Plaintiffs, to “compel arbitration there must be ‘direct and specific evidence of an agreement between the parties.’”35 Defendant just like Plaintiffs, seeks to add to the evidence before the court. Finally, just like Plaintiffs, Defendant has shown good cause to engage in limited arbitration-related discovery concerning contract formation. The Supreme Court has explained that “[c]ourts should not assume that the parties agreed to arbitrate arbitrability unless there is ‘clea[r] and unmistakabl[e]’ evidence that they did so.”36 Thus, “before referring a dispute to an arbitrator, …. the court determines whether a valid arbitration agreement exists.”37 Evidence from all parties is essential to the court’s determination of a valid arbitration agreement.

Accordingly, the court finds Defendant’s requested discovery is permissible, relevant, and proportional to this putative class action. Defendant’s Motion is therefore GRANTED. Defendant’s discovery is to “be narrow, and depositions of …. Plaintiffs will be tailored to

34 Campbell Invs., LLC v. Dickey's Barbecue Restaurants, Inc., 784 F. App'x 627, 634, 2019 WL 4235345 (10th Cir. 2019). 35 Plaintiffs’ Response at 5, ECF No. 88. The court cautions Plaintiffs about misrepresenting legal authority in the future. Plaintiffs cite to La Frontera Ctr., Inc. v. United Behav. Health, Inc. 268 F. Supp. 3d 1167, 1196 (D.N.M. 2017), a case from the District of New Mexico, for this quotation and principle noting the La Frontera court cited to McCoy v. Bleu Cross & Blue Shield of Ut., 2001 UT 31 ¶ 17, 20 P.3d 901, from the Supreme Court of Utah. Neither is correct. The quotation is not found in La Frontera and the La Frontera court did not cite to McCoy. Rather, the quotation is found in McCoy. Plaintiffs also miscite Campbell Invs. as 785 Fed. App’x 627 rather than 784 Fed. App’x 627. The court does not fault scrivener’s errors such as may have occurred in citing Campbell Invs., but to miscite an entire quotation and the authority that provided it is cause for concern. 36 Coinbase, Inc. v. Suski, 602 U.S. 143, 149, 144 S. Ct. 1186, 1193 (2024) (citation modified). 37 Id. (citation modified). contract formation based on their respective website usage, member portal and HSA accounts.”** The requested depositions sought by Defendant are to be scheduled within 120 days from the date of this order. ORDER For the reasons set forth above, Plaintiffs’ Motion to Compel is DENIED. Defendants’ Motion is GRANTED. IT IS SO ORDERED.

DATED this 7 October 2025.

Dust Pyad ° United Stafes Mapistrate Judge

38 Reply in Support of Defendant HealthEquity Inc.’s Motion at 5, ECF No. 89.