Judith Koegler v. Munson Healthcare

• Court: District Court, W.D. Michigan
• Decided: June 3, 2026
• Docket: 1:26-cv-00803
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF MICHIGAN SOUTHERN DIVISION

JUDITH KOEGLER,

Plaintiff, Case No. 1:26-cv-803 v. Hon. Hala Y. Jarbou MUNSON HEALTHCARE,

Defendant. ___________________________________/ OPINION Before the Court are two putative class actions against Defendant Munson Healthcare related to its handling of patients’ healthcare data. Plaintiff Terri Gerhart is the named plaintiff in Gerhart v. Munson Healthcare, No. 1:26-cv-775 (W.D. Mich.) (“Gerhart”). Plaintiff Judith Koegler is the named plaintiff in Koegler v. Munson Healthcare, No. 1:26-cv-803 (W.D. Mich.) (“Koegler”). Both actions were originally filed in state court, but Munson removed here under 28 U.S.C. § 1441, claiming that the Court has jurisdiction under the Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d). Munson then moved to transfer both actions to the Western District of Missouri, which is where Munson’s electronic health records vendor, non-party Cerner Corporation, is based. It is also where dozens of other putative class actions are pending in a consolidated proceeding, which involves not only claims against Cerner but also against other hospitals that used Cerner’s services. In the two actions before the Court, Plaintiffs move to remand the actions to state court, arguing that the home-state exception to CAFA jurisdiction applies. Plaintiffs also oppose Munson’s motions to transfer venue. For the following reasons, the Court will deny Munson’s motions to transfer venue and order Munson to show cause as to the composition of the class to determine whether CAFA’s home-state exception applies. I. BACKGROUND Munson is a non-profit healthcare system with locations across northern Michigan. It is incorporated in Michigan and has its principal place of business in Traverse City, Michigan. Like

Munson, Plaintiffs Gerhart and Koegler are citizens of Michigan. On January 12, 2026, Munson sent letters to Plaintiffs explaining that their personal information may have been breached when “an unauthorized third party gained access to and obtained data that was maintained by an electronic health record (EHR) vendor, Cerner.” (Gerhart, Compl. ¶ 5, ECF No. 1-1; see Koegler, Compl. ¶ 4, ECF No. 1-1.) On February 2 and 11, 2026, respectively, Gerhart and Koegler filed complaints against Munson in Grand Traverse County Circuit Court. Both asserted claims for negligence, negligence per se, breach of implied contract, and unjust enrichment. Koegler also asserted claims for breach of fiduciary duty and negligent training, hiring, and supervision. Both Gerhart and Koegler claim to represent a class of people affected by the data breach. Gerhart defines her proposed class of plaintiffs as: “All individuals within the United States whose

[personally identifiable information (PII)] and/or [protected health information (PHI)] were identified as compromised in the Data Breach.” (Gerhart, Compl. ¶ 80.) Gerhart uses the phrase “Data Breach” to refer to the “recent data security incident and data breach that was perpetrated against [Munson],” which held Plaintiffs’ PII and PHI in its possession. (Id. ¶ 2.) Koegler defines her class along similar lines: “All individuals whose PII/PHI may have been accessed and/or acquired in the Data Breach, including all those individuals who received Notice of Data Breach letters.” (Koegler, Compl. ¶ 150.) Koegler defines “Data Breach” to mean the data breach that resulted from “[Munson’s] negligent failure” to protect the class members’ information. (Id. ¶ 1.) And “Notice of Data Breach letter” refers to the letter that Munson sent to those potentially affected by the data breach. (Id. ¶ 33.) Before Plaintiffs filed their complaints in state court, federal courts were already handling putative class actions related to the data breach involving Cerner. Dozens of actions have been filed in or transferred to the Western District of Missouri, where Cerner is based. One of those

actions, Thomas v. Cerner Corp., No. 1:26-cv-331 (W.D. Mich.), was filed in this Court against both Cerner and Munson. The parties in that case all consented to transfer to the Western District of Missouri, so the Court transferred the case there, where it is now pending as part of a consolidated proceeding. On March 10 and 12, 2026, respectively, Munson removed Gerhart and Koegler’s proposed class actions to this Court. (Gerhart, Notice of Removal, ECF No. 1; Koegler, Notice of Removal, ECF No. 1.) On March 17, 2026, Munson moved to transfer each case to the Western District of Missouri. Unlike the plaintiff in Thomas, however, Gerhart and Koegler oppose transfer. On March 31, 2026, Gerhart and Koegler moved to remand their cases to state court.

(Gerhart, Mot. to Remand, ECF No. 11; Koegler, Mot. to Remand, ECF No. 15.) Munson argues that remand is not warranted. The parties’ briefings in both cases are nearly identical to one another, so the Court addresses the motions in both cases together. II. DISCUSSION A. Order of the Motions The Court has discretion to decide which of these motions (transfer or remand) to answer first. See Lalewicz v. WarnerMedia Direct, LLC, 742 F. Supp. 3d 781, 787 (E.D. Tenn. 2024) (“The Court is not required to decide the motion to remand before the motion to transfer, and courts regularly transfer cases instead of deciding motions to remand when related cases are pending in the transferee district.”) Although the parties agree that the Court has this discretion, they disagree about how it should use it. Plaintiffs argue that the Court should decide remand first to avoid transferring a case lacking subject-matter jurisdiction. Munson argues that the Court should decide transfer first to avoid the risk of outcomes that are inconsistent with similar cases before the Western District of Missouri and to preserve judicial economy. The Sixth Circuit does not provide any guidance on which decision should come first, so

the Court instead relies on a test used in the Eastern District of Tennessee, which effectively balances the parties’ concerns in these cases: Deciding a motion to transfer venue before a motion to remand is particularly appropriate where a related suit is already pending in the transferee district, the remand motion will not suffer any prejudice as a result of the transfer, and transfer at this juncture permits the court who would ultimately try the case to rule on the remand motion. Jabo’s Pharm., Inc. v. Cephalon, Inc., No. 2:09-CV-289, 2010 WL 3851966, at *1 (E.D. Tenn. Sept. 27, 2010) (quoting Doubletree Partners, L.P. v. Land Am. Am. Title Co., No. 3-08-CV-1547- O, 2008 WL 5119599, at *2 (N.D. Tex. Dec. 3, 2008)). Here, a related suit, Thomas, is already pending before the transferee court. And if these cases are transferred, it will be up to the Western District of Missouri to decide whether remand is warranted. Plaintiffs have not argued that their remand motions would be prejudiced if decided in the Western District of Missouri, so that factor is at most neutral. After all, there is no reason to believe that the transferee court would decide the issue any differently from this Court. Accordingly, based on these considerations, the Court will address Munson’s motions to transfer first. B. Motions to Transfer “For the convenience of parties and witnesses, in the interest of justice, a district court may transfer any civil action to any other district or division where it might have been brought or to any district or division to which all parties have consented.” 28 U.S.C. § 1404(a). The moving party bears the burden of proof to show why a court should transfer the action absent the consent of all other parties. See Cincinnati Ins. Co. v. O’Leary Paint Co., Inc., 676 F. Supp. 2d 623, 630 (W.D. Mich. 2009). That burden includes proving that the transferee court is a court where the action “might have been brought,” meaning that, at the time the action was filed, the proposed transferee district would have been able to exercise personal jurisdiction over the defendant. See

Hoffman v. Blaski, 363 U.S. 335, 343–44 (1960); Bunting ex rel. Gray v. Gray, 2 F. App’x 443, 448 (6th Cir. 2001); see also 15 Wright & Miller’s Federal Practice and Procedure § 3845 (4th ed. 2019) (“[T]he transferee court must be a proper venue and must have personal jurisdiction over the defendant.”); Manual on Complex Litigation (Fourth) § 10.123 (“Other courts can transfer cases . . . to the consolidation court, but only if personal jurisdiction and venue lie in the transferee forum.”). Notably, the power to transfer does not depend upon whether the defendant is willing to accept personal jurisdiction in the transferee court. Hoffman, 363 U.S. at 343–44. Personal jurisdiction may be general or specific. General personal jurisdiction over a corporation exists in its state of incorporation, its principal place of business, and, in the

exceptional case, wherever a corporation’s contacts are “so substantial and of such a nature as to render [it] at home.” BNSF Ry. Co. v. Tyrrell, 581 U.S. 402, 413 (2017) (quoting Daimler AG v. Bauman, 571 U.S. 117, 139 n.19 (2014)). Here, Munson is neither incorporated in Missouri nor does it have its principal place of business there, so general personal jurisdiction is not applicable. Specific personal jurisdiction exists when a non-resident defendant satisfies two separate prerequisites. First, the forum state’s long-arm statute must be satisfied. Viasystems, Inc. v. EBM– Papst St. Georgen GmbH, 646 F.3d 589, 593 (8th Cir. 2011). Second, the court must determine whether the defendant has sufficient contacts with the forum state to satisfy the due process concerns of the Fourteenth Amendment. Miller v. Nippon Carbon Co., 528 F.3d 1087, 1090 (8th Cir. 2008). Part of the Constitutional analysis includes an assessment of whether the defendant purposefully availed itself of the transferee court’s forum state: The purposeful availment requirement ensures that a defendant will not be haled into a jurisdiction solely as the result of random, fortuitous, or attenuated contacts or of the unilateral activity of another party or a third person. For a State to exercise jurisdiction consistent with due process, the defendant’s suit-related conduct must create a substantial connection with the forum State. Mitchell v. Eli Lilly and Co., 159 F. Supp. 3d 967, 974 (E.D. Mo. 2016) (citations omitted). In its motion, Munson fails to argue that a Missouri court would have had specific personal jurisdiction over it. This failure aside, Munson highlights two facts that could support personal jurisdiction in Missouri: (1) the breached data was stored by Cerner, a Missouri-based company, and (2) an action against Munson is now pending in the Missouri-based consolidated proceedings. Even assuming that the facts alleged here satisfy Missouri’s long-arm statute, neither fact is sufficient to show that Munson purposefully availed itself of Missouri so as to create a substantial connection with the state. It is true that Cerner is a Missouri-based company, but “a defendant’s relationship with a . . . third party, standing alone, is an insufficient basis for jurisdiction.” Walden v. Fiore, 571 U.S. 277, 286 (2014). What matters is the relationship between the defendant and the forum state. Bristol-Myers Squibb Co. v. Super. Ct. of Cal., 582 U.S. 255, 268 (2017). It is not alleged that Munson engaged in relevant acts together with Cerner in Missouri. Nor is it alleged that Munson is derivatively liable for Cerner’s conduct in Missouri. See id. (analyzing relationship between defendant and third party). Moreover, a “contract with an out-of-state party alone” does not establish sufficient minimum contacts with the other state. Burger King Corp. v. Rudzewicz, 471 U.S. 462, 478 (1985). It is also true that there is an action similar to these cases pending against Munson in the Western District of Missouri because Munson agreed to have the case transferred to that district. But consent to be sued in one action in the transferee forum does not create personal jurisdiction in another later action. See Simpson v. Wright Med. Grp., Inc., No. 5:17-CV-00062-KGB, 2018 WL 1570795, at *6 (E.D. Ark. Mar. 30, 2018) (“Consent to a forum’s personal jurisdiction in a prior case does not, by itself, constitute indefinite consent to be haled into court in that jurisdiction.”) (collecting cases). And even if it did, that consent must exist at the time the action

is filed, not after. See Hoffman, 363 U.S. at 342–43. Here, Plaintiffs filed their cases before the parties in Thomas agreed to transfer that case to Missouri. The presence of that case in Missouri then fails to support any potential argument in favor of transferring the cases before this Court. In short, Munson has not met its burden of showing that transfer is warranted. Accordingly, its motions to transfer will be denied. C. Motions to Remand Munson argues that the Court has subject-matter jurisdiction over these cases under CAFA. That statute permits the Court to exercise jurisdiction when: (1) a case has minimal diversity of citizenship; (2) the proposed class has at least 100 putative members; and (3) the aggregate amount in controversy exceeds $5 million dollars. See 28 U.S.C. § 1332(d); Dart Cherokee Basin

Operating Co., LLC v. Owens, 574 U.S. 81, 84–85 (2014). The removing party must establish each element by a preponderance of the evidence to show that federal jurisdiction is proper. Smith v. Nationwide Prop. & Cas. Ins. Co., 505 F.3d 401, 404 (6th Cir. 2007). In these cases, the parties agree that the second and third elements are met, but they dispute the first element, minimal diversity. Parties are minimally diverse from each other when “any member of a class of plaintiffs is a citizen of a State different from any defendant.” 28 U.S.C. § 1332(d)(2)(B). In affidavits attached to its responses, Munson’s Chief Security Officer states that Munson sent data-breach notices to thousands of citizens from states outside of Michigan. (Gerhart, Olmsted Aff. ¶ 5, ECF No. 15-1; Koegler, Olmsted Aff. ¶ 5, ECF No. 16-1.) Therefore, CAFA’s minimal-diversity requirement is satisfied. That said, Plaintiffs argue that the Court must decline subject-matter jurisdiction under CAFA’s home-state exception. Plaintiffs bear the burden of demonstrating that this exception applies. See Brown v. Paducah & Louisville Ry., Inc., No. 3:12–CV–00818–CRS, 2013 WL

5273773 (W.D. Ky. Sep. 17, 2023) (collecting cases). Under the exception, a district court “shall decline to exercise jurisdiction” when “two-thirds or more of the members of all proposed plaintiff classes in the aggregate, and the primary defendants, are citizens of the State in which the action was originally filed.” 28 U.S.C. § 1332(d)(4)(B). The Sixth Circuit interprets the term “citizen” in CAFA exceptions “as being equivalent to ‘domicile.’” Mason v. Lockwood, Andrews & Newnam, P.C., 842 F.3d 383, 390 (6th Cir. 2016). There is a rebuttable presumption that a person’s residence is their domicile. Id. Plaintiffs argue that the facts here support an inference that more than two-thirds of the class members are Michigan citizens:

Munson operates a system of eight community hospitals located exclusively in northern Michigan and provides northern Michigan residents access to sophisticated diagnostic treatment services that require continuity of care. The proposed class is comprised of Munson’s patients, who provided Private Information to Munson in order to receive those services. In other words, Munson is a regional health care provider serving an inherently local population. (Gerhart, Mot. to Remand 8–9 (internal citations omitted); Koegler, Mot. to Remand 8–9 (same).) Plaintiffs have a point. Patients are likely to seek medical care at a location that is close to where they live. Also, many health insurance plans operate with a network of providers; those networks are more likely to include local medical providers than providers in other states. That said, the state where one receives medical care is not as strong an indicator of domicile as residence. It is not unusual for patients to travel out of state to receive care (though it may be unusual to travel from out of state to northern Michigan for care). Also, it is possible that Munson maintains patient information for individuals who left the state after receiving services at its facilities. Indeed, Munson itself asserts that it sent its data breach notices to all 50 states. Thus, it is possible that less than two-thirds of the proposed class members are Michigan citizens. In these circumstances, some additional discovery is warranted to determine whether the

home-state exception applies. For instance, Plaintiffs request discovery of the addresses where Munson sent its data-breach notices.1 If Munson sent a notice to a Michigan address for a patient who received services from Munson, that address would be enough to infer Michigan citizenship for the recipient. Courts routinely use this type of information to infer citizenship for the sake of CAFA. See, e.g., Christensen v. St. Elizabeth Med. Ctr., Inc., No. 219-CV-0043-WOBCJS, 2020 WL 3491371, at *7 (E.D. Ky. June 26, 2020) (inferring citizenship of the proposed class using addresses where defendant sent data-breach notices); Bey v. SolarWorld Industries Am., Inc., 904 F. Supp. 2d 1103, 1105 (D. Or. 2012) (inferring citizenship of the proposed class from employees’ addresses at the time they worked for defendant); Singh v. IQ Data, No. C22-418RSM, 2022 WL

5133744, at *2–3 (W.D. Wash. Oct. 5, 2022) (inferring citizenship of the proposed class from a list of plaintiffs’ last-known addresses). Still, Munson argues that Plaintiffs’ proposed discovery would be unworkable because the proposed classes include members that have no relationship with Munson. Munson believes that Plaintiffs intend to certify classes that include everyone affected by the underlying data breach involving Cerner. Munson argues that it cannot provide information about all those individuals.

1 Plaintiffs claim they have already requested this information from Munson, but Munson has refused to provide it. Munson’s concern is unfounded. Plaintiffs here sued Munson alone based on the actions it took (or did not take) with respect to the storage and security of its own patients’ information.2 True, Plaintiffs’ classes are not limited to residents of a single state. But they are necessarily limited to current and former patients of Munson. Plaintiffs sue Munson because the data breach involved private health information in Munson’s possession (Gerhart, Compl. ¶ 2), that Plaintiffs

allegedly provided to Munson (Koegler, Compl. ¶ 10).3 Plaintiffs claim that Munson had a duty to safeguard this information, which only makes sense for information that Munson received and maintained for its own patients. Finally, Munson argues that, even if Plaintiffs’ claims are limited to its patients, the Court should “pierce the pleadings” and interpret the complaint in a way where the class encompasses all those affected by the underlying breach against Cerner. Munson explains that “piercing the pleadings” here would be consistent with CAFA’s primary purposes: to prevent plaintiffs’ attempts to defeat federal jurisdiction, to consolidate “copycat” lawsuits before a single court, and to place “the determination of more interstate class action lawsuits in the proper forum—the federal

courts.” Freeman v. Blue Ridge Paper Prods., Inc., 551 F.3d 405, 408 (6th Cir. 2008) (quoting S. Rep. No. 109-14) (citation modified). But CAFA does not give courts carte blanche to exercise federal jurisdiction whenever there are multiple, overlapping lawsuits. The Court must follow the text of the statute, including the home-state exception. Also, it is not clear that these cases are copycat lawsuits or are among the interstate class actions that Congress intended to give to federal courts when it drafted CAFA.

2 None of the parties argue that joining Cerner or some other third party is necessary for the just adjudication of these cases. Glancy v. Taubman Centers, Inc., 373 F.3d 656, 665–77 (6th Cir. 2004) (explaining how joinder under Rule 19 of the Federal Rules of Civil Procedure impacts parties’ attempts to manipulate federal jurisdiction). 3 Koegler’s proposed class definition also includes those who received “Notice of Data Breach letters,” a phrase that refers to the letters sent by Munson. (Koegler, Compl. ¶¶ 33, 150.) Plaintiffs—Michigan residents—have sued a single defendant that is also located in Michigan, based on their theory that Munson bears responsibility for the data breach. By contrast, most of the cases in Missouri concern Cerner’s conduct. Yet Plaintiffs here elected not to sue Cerner. As the “masters of their complaint,” Plaintiffs “can choose whom they want to sue” even after CAFA. Roberts v. Mars Petcare US, Inc., 874 F.3d 953, 958 (6th Cir. 2017); see also Royal Canin U.S.A.,

Inc. v. Wullschleger, 604 U.S. 22, 35 (2025) (“[Plaintiff] gets to determine which substantive claims to bring against which defendants. And in so doing, [Plaintiffs] can establish—or not—the basis for a federal court’s subject matter jurisdiction.”). Given that choice, the Court must evaluate whether the home-state exception applies and, accordingly, whether remand is appropriate. III. CONCLUSION For the reasons above, the Court will deny Munson’s motions to transfer venue. The Court will also order Munson to show cause no later than June 14, 2026, as to whether this action should be remanded to state court pursuant to 28 U.S.C. § 1332(d)(4)(B). To show cause, Munson will be directed to disclose to the Court by affidavit the total number of individuals to whom it sent a data breach notice, as well as the total number of those individuals who were sent a notice at a

Michigan address. An order will enter consistent with this Opinion.

Dated: June 3, 2026 /s/ Hala Y. Jarbou HALA Y. JARBOU CHIEF UNITED STATES DISTRICT JUDGE