Pearson, Daniel v. Group Health Cooperative of South Central Wisconsin

• Court: District Court, W.D. Wisconsin
• Decided: February 12, 2025
• Docket: 3:24-cv-00310
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF WISCONSIN

DANIEL PEARSON, on behalf of himself and all others similarly situated,

Plaintiff, OPINION & ORDER v.

24-cv-310-jdp GROUP HEALTH COOPERATIVE OF SOUTH CENTRAL WISCONSIN,

Defendant.

GABRIELLA JENICH and MARGARET HETZLER, individually and on behalf of all others similarly situated,

Plaintiffs, OPINION & ORDER v. 24-cv-312-jdp GROUP HEALTH COOPERATIVE OF SOUTH CENTRAL WISCONSIN,

LISA MITCHELL, on behalf of herself and all others similarly situated,

Plaintiff, v. OPINION & ORDER

GROUP HEALTH COOPERATIVE OF 24-cv-313-jdp SOUTH CENTRAL WISCONSIN,

Defendant. SUE MAUER, individually and on behalf of all others similarly situated,

24-cv-314-jdp GROUP HEALTH COOPERATIVE OF SOUTH CENTRAL WISCONSIN,

MICHAEL COLLINS and JENNIFER JOHNSON-HEISS, individually and on behalf of all others similarly situated,

Plaintiffs, OPINION & ORDER v. 24-cv-315-jdp GROUP HEALTH COOPERATIVE OF SOUTH CENTRAL WISCONSIN,

MARY DONAHUE, individually and on behalf of all others similarly situated,

24-cv-316-jdp GROUP HEALTH COOPERATIVE OF SOUTH CENTRAL WISCONSIN,

Defendant. MALEAH MOSKOFF, individually and on behalf of all others similarly situated,

Plaintiff, OPINION 7 ORDER v.

24-cv-317-jdp GROUP HEALTH COOPERATIVE OF SOUTH CENTRAL WISCONSIN,

These seven cases are all proposed class actions about a data breach that occurred at Group Health Cooperative of South Central Wisconsin, which provides health care and health insurance. Plaintiffs are current or former members of Group Health, and they have received healthcare services from Group Health. Plaintiffs allege that Group Health breached various duties under state law by failing to protect their personal information from the data breach. All seven cases were filed in state court, but Group Health has removed them to this court, asserting multiple bases for federal jurisdiction. Plaintiffs move to remand the cases. The court had preliminarily concluded that Group Health adequately alleged jurisdiction under the Class Action Fairness Act (CAFA), but plaintiffs have shown that exceptions to federal jurisdiction apply. Most of the class members are, like Group Health, citizens of Wisconsin, so the court must decline to exercise jurisdiction under CAFA. And the court concludes that Group Health was not acting as a federal officer and that plaintiffs’ claims are not preempted by ERISA. Accordingly, the court will grant plaintiffs’ motions to remand. ANALYSIS Group Health asserts four bases for removing some or all of the seven lawsuits: (1) each case is a proposed class action that has minimal diversity and more than $5,000,000 in

controversy, see 28 U.S.C. § 1332(d); (2) Group Health is a federal officer based on its participation in the Merit-Based Incentive Payment Systems (MIPS), see 28 U.S.C. § 1442(a)(1); (3) Group Health is a federal officer based on its management of Federal Employment Health Benefit (FEHB) plans, see id.; and (4) the claims in some of the lawsuits are completely preempted under ERISA, see 28 U.S.C. § 1331. The court will consider each asserted basis for federal jurisdiction. A. Class Action Fairness Act A court may exercise jurisdiction under the Class Action Fairness Act, 28 U.S.C.

§ 1332(d)(2), when the proponent of jurisdiction shows that there is “minimal diversity,” and the amount in controversy is more than $5,000,000. The court previously concluded that Group Health had established minimal diversity under § 1332(d)(2) at the pleading stage by alleging that it is a citizen of Wisconsin, and its records show that “tens of thousands” of its patients live outside of Wisconsin. See, e.g., Dkt. 12.1 It is also reasonable to infer that more than $5,000,000 is in controversy. The proposed classes include more than 500,0000 members, so even a small recovery for each class member would exceed the minimum. But that is not the end of the matter. Even when the proponent of jurisdiction satisfies

the preliminary jurisdictional requirements under § 1332(d)(2), the court must decline to exercise jurisdiction if the defendant and more than two-thirds of the proposed class members

1 Citations to the record are from Case no. 24-cv-310-jdp unless otherwise noted. are citizens of the forum state. 28 U.S.C. § 1332(d)(4)(B).2 And the court may decline to exercise jurisdiction if the defendant and more than one-third but less than two-thirds of the proposed class are citizens of the forum state. 28 U.S.C. § 1332(d)(3). The opponent of jurisdiction—in this case, plaintiffs—has the burden to show that the exceptions apply by a

preponderance of the evidence. Sabrina Roppo v. Travelers Commercial Ins. Co., 869 F.3d 568, 584 (7th Cir. 2017). Plaintiffs contend that they have satisfied both § 1332(d)(3) and § 1332(d)(4), citing the following evidence:  All named plaintiffs live in Wisconsin.  All of Group Health’s in-network clinics and hospitals are located in Wisconsin.  Some of Group Health’s health plans require members to live or work in Wisconsin.

 According to Group Health’s records, 489,267 out of 533,809 people affected by the data breach have last-known addresses in Wisconsin, or 91.7 percent.

 According to plaintiffs’ demography expert, an average of 1.77 percent of Wisconsin residents permanently migrate out of Wisconsin each year.

Two-thirds of 533,809 is 355,873; one-third is 177,937. Group Health does not dispute any of plaintiffs’ evidence or cite any additional evidence of its own about the state citizenship of potential class members. Instead, Group Health challenges the sufficiency of plaintiffs’ evidence on two grounds. First, Group Health says that citizenship is determined by where the individual intends to remain, not just where he or she lives, so mailing addresses are not sufficient to show

2 Section 1332(d)(4)(A) also requires the court to decline jurisdiction under other circumstances that are not at issue in this case. citizenship. Second, Group Health says that some of the addresses may be outdated or otherwise inaccurate. It cites the declaration of its chief compliance officer, who says that: (1) potential victims of the data breach include former Group Health members from as far back as 1976, and Group Health “does not seek updates to address information regarding former

members or their beneficiaries,” Dkt. 23, ¶¶ 6–8; (2) some of the addresses that Group Health has on file are post-office boxes, and Group Health does not know whether the members actually live at any residential address they provide to Group Health, id., ¶ 9. As for Group Health’s first objection, Group Health is correct that an individual’s citizenship is determined by his or her domicile, which is the “person’s long-term plan for a state of habitation,” not simply the person’s current residence. Myrick v. WellPoint, Inc., 764 F.3d 662, 664–65 (7th Cir. 2014). Plaintiffs cite cases from other circuits holding that residence is prima-facie evidence of domicile. See Hollinger v. Home State Mut. Ins. Co., 654 F.3d

564, 571 (5th Cir. 2011); Mondragon v. Capital One Auto Finance, 736 F.3d 880, 885–86 (9th Cir. 2013). That is a reasonable view, but the Court of Appeals for the Seventh Circuit has not yet embraced it, holding instead that “a court may not draw conclusions about the citizenship of class members based on things like their phone numbers and mailing addresses.” In re Sprint Nextel Corp., 593 F.3d 669, 674 (7th Cir. 2010). The court made a similar point in Myrick, concluding that it could not remand a case under § 1332(d)(4) based solely on evidence that that the class members “reside” in the forum state. 764 F.3d at 664–65. There is a key difference between this case and Myrick and Sprint, which is that, in this

case, we know more than just the members’ mailing addresses and phone numbers. Specifically. we know that the members are or were receiving their medical care in Wisconsin. Plaintiffs do not need to prove beyond a reasonable doubt that every class member is a Wisconsin citizen to satisfy the exception under § 1332(d)(4)(B); they only need to show by a preponderance of the evidence that two-thirds of the class is domiciled in this state. Sprint, 593 F.3d at 675–76. It is reasonable to infer that a person lives in Wisconsin and intends to remain there for the foreseeable future if he or she has a Wisconsin mailing address and is receiving medical care in

Wisconsin, at least without evidence to the contrary, which Group Health has not provided. Most people would not receive regular medical care from a clinic far from home. As for Group Health’s second objection about outdated addresses, Group Health does not explain how it squares this objection with its representation that it has sent notice of the data breach to all potential class members. See Dkt. 23, ¶ 6. Group Health does not say that more than 130,000 of those notices came back as undeliverable or that it otherwise learned during the notice process that a large percentage of its addresses were outdated. In any event, Group Health has not challenged the admissibility of Group Health’s demography expert, who

opined that only 1.77 percent of Wisconsin residents move out of the state every year, so it is reasonable to infer that at least two-thirds of potential class members still live in Wisconsin. Dkt. 19. Group Health also does not say that a significant number of members used post-office boxes. Group Health has access to that information, so it is reasonable to infer that Group Health would have provided figures if they undermined plaintiffs’ motion to remand. Group Health says that plaintiffs should have submitted affidavits or survey responses from class members establishing their citizenship. But that is a self-defeating argument. If

circumstantial evidence is not sufficient to show citizenship, then Group Health has not yet shown minimal diversity for the purpose of establishing jurisdiction under § 1332(d)(2). Group Health has not submitted an affidavit or survey response showing that any potential class member is a non-Wisconsin citizen. As previously discussed, Group Health’s only evidence of any class member’s citizenship is a statement in its amended notice of removal that “tens of thousands” of class members have addresses outside Wisconsin. See Dkt. 9, at 5–6. So if plaintiffs need affidavits or survey responses, so does Group Health, which would mean that

the court does not have jurisdiction under § 1332(d)(2). At the least, it is reasonable to infer by a preponderance of the evidence that more than one-third of the class members are domiciled in Wisconsin, so remand is appropriate under § 1332(d)(3). Group Health identifies no plausible scenario under which it would be likely that two-thirds of the more than 500,000 members who received medical care in this state are domiciled in states other than Wisconsin. Remand under § 1332(d)(3) is discretionary, and the court must consider six factors: (A) whether the claims asserted involve matters of national or interstate interest; (B) whether the claims asserted will be governed by laws of the State in which the action was originally filed or by the laws of other States; (C) whether the class action has been pleaded in a manner that seeks to avoid Federal jurisdiction; (D) whether the action was brought in a forum with a distinct nexus with the class members, the alleged harm, or the defendants; (E) whether the number of citizens of the State in which the action was originally filed in all proposed plaintiff classes in the aggregate is substantially larger than the number of citizens from any other State, and the citizenship of the other members of the proposed class is dispersed among a substantial number of States; and (F) whether, during the 3-year period preceding the filing of that class action, 1 or more other class actions asserting the same or similar claims on behalf of the same or other persons have been filed. “No single factor is dispositive, and not all factors need to favor remand for the court to decline jurisdiction.” 16 Moore’s Federal Practice § 107.91[6] (3d ed. 2024). Most of these factors favor remand: plaintiffs are raising only Wisconsin-law claims against a Wisconsin defendant who provided services to plaintiffs in Wisconsin only. Plaintiffs did not plead their complaint in a manner to avoid federal jurisdiction. A small fraction of members may have been citizens of nearby states while they were receiving services, and some former members may have moved to other states. But there is no basis to infer that there are

more potential class members domiciled in any state than in Wisconsin. Factor (F) does not favor remand because there are seven proposed class actions. But even this factor provides only weak support for retaining jurisdiction because all of the lawsuits were filed in Dane County Circuit Court, and consolidation will likely be appropriate after remand. So remanding the cases does not significantly heighten any risk of inefficiency or inconsistent outcomes. For these reasons, the court concludes that plaintiffs have satisfied both § 1332(d)(4)(B) and § 1332(d)(3). Remand is appropriate unless Group Health identifies

another basis for jurisdiction. B. Federal officer Under 28 U.S.C. § 1442(a)(1), an action may be removed to federal court when it is filed against “[t]he United States or any agency thereof or any officer (or any person acting under that officer) of the United States or of any agency thereof, in an official or individual capacity, for or relating to any act under color of such office.” Group Health contends that removal of all seven lawsuits is authorized under § 1442(a)(1) because plaintiffs’ claims relate Group Health’s participation in the Merit-Based Incentive Payment Systems (MIPS). Group Health also contends that removal of Case nos. 24-cv-312-jdp and 24-cv-315-jdp is authorized based on Group Health’s role in managing the Federal Employee Health Benefit (FEHB) plans of the plaintiffs in those two cases.

1. MIPS participation MIPS is a voluntary federal program that provides incentive payments to healthcare providers that achieve goals related to quality, resource use, clinical practice improvement activities, and meaningful use of certified electronic health records technology. 42 U.S.C. § 1395w-4(q)(1)(A), (2)(A), (5)(A); Mississippi v. Becerra, 727 F. Supp. 3d 559, 568 (S.D. Miss. 2024). Group Health’s chief compliance officer says that Group Health participates in the program through “GHCMyChart,” which is an online patient portal. Dkt. 23, ¶¶ 25–28.

For the purpose of this case, the parties agree that MIPS is essentially the same thing as the federal Promoting Interoperability Program, which is “a voluntary federal program that gives incentive payments to eligible healthcare providers for facilitating patient online access to health records.” Doe v. Gundersen Lutheran Health System, Inc., No. 23-cv-694-wmc, 2024 WL 489327, at *1 (W.D. Wis. Feb. 8, 2024). This court has determined in three cases that participation in such a program does not make a party a federal officer under § 1442(a)(1). Gundersen Lutheran, 2024 WL 489327, at *3; Doe v. Prairie Ridge Health, Inc., No. 23-cv-426-jdp, 2024 WL 1191108, at *2 (W.D. Wis. Mar. 20, 2024); Doe v. Prairie du Chien Memorial Hospital

Association, Inc., No. 24-cv-67-wmc, 2024 WL 2955717, at *3 (W.D. Wis. June 12, 2024). A private party qualifies as a federal officer under § 1442(a)(1) only if the party is “acting under” the federal government. This means that the removing party’s conduct “must involve an effort to assist, or to help carry out, the duties or tasks of the federal superior.” Baker v. Atlantic Richfield Company, 962 F.3d 937, 942 (7th Cir. 2020) (internal quotation marks omitted). Participating in MIPS does not meet that test because giving patients online access to their records is not a government function that has been delegated to a private party, nor is it a service to the government. See Prairie Ridge, 2024 WL 1191108, at *2. Simply acting

pursuant to a federal policy is not enough. Id. Numerous other courts have reached the same conclusion. See Gundersen Lutheran, 2024 WL 489327, at *2 (collecting cases). The Court of Appeals for the Seventh Circuit has not yet addressed this issue, but four other circuits have, and each has concluded that providing online patient portals does not provide a basis for officer removal under § 1442(a)(1). See Doe v. Cedars-Sinai Health System, 106 F.4th 907 (9th Cir. 2024); Martin v. LCMC Health Holdings, Inc., 101 F.4th 410 (5th Cir. 2024); Mohr v. Trs. of the Univ. of Pa., 93 F.4th 100 (3d Cir. 2024); Doe v. BJC Health Sys., 89 F.4th 1037, 1047 (8th Cir. 2023).

Group Health says that these cases are distinguishable because they were about tracking software, not a data breach. But Group Health fails to explain why that is a meaningful distinction. This and other courts’ reasoning was about the nature of the federal program that served as the asserted basis for federal-officer removal; the nature of the plaintiff’s claim was irrelevant. As already noted, Group Health admits that there are no relevant differences between MIPS and the programs discussed in those cases. So MIPS does not provide a basis for removal under § 1442(a)(1). 2. Management of FEHB plans

It is undisputed that at least some of the named plaintiffs in Case nos. 24-cv-312-jdp and 24-cv-315-jdp are federal employees who are covered by an FEHB plan that is managed by Group Health. Providing an FEHB plan qualifies as “acting under” the federal government because it is a responsibility that the government has delegated to a private party, and something the government would otherwise have to do it itself. Ray v. Tabriz, 110 F.4th 949, 956–57 (7th Cir. 2024). The parties dispute a different element under § 1442(a)(1), which is whether plaintiffs

are suing Group Health “for” providing healthcare benefits on behalf of the government or for acts “relating to” doing that. In Ray, the court framed this question as whether there is a “causal connection between the charged conduct and asserted official authority.” Id. at 957. Previously, the court of appeals stated that it “join[s] all the courts of appeals that have replaced causation with connection,” but the court suggested that there was not a significant difference between the two standards. Baker v. Atlantic Richfield Company, 962 F.3d 937, 944 (7th Cir. 2020). In Ray, the insurance company was seeking reimbursement for the benefits it paid under the federal employee’s health plan, and the court concluded that there was a sufficient

connection between the lawsuit and the insurer’s status as a federal officer because the federal government had delegated responsibility to the insurer to pursue reimbursement claims on the government’s behalf. 110 F.4th at 952–53, 957. The other cases Group Health discusses involving FEHB insurers also involved disputes about benefits payments. See Jacks v. Meridian Resource Co., LLC, 701 F.3d 1224, 1234–35 (8th Cir. 2012); Aurora Health Care Inc v. Blue Cross Blue Shield of Wisconsin, No. 22-cv-1159, 2023 WL 6129431, at *2–3 (E.D. Wis. Sept. 19, 2023). This case is not about plaintiffs’ benefits under their health plans. Group Health does

not have a contract with the federal government about data security or data privacy, and Group Health’s policies and practices regarding storing member data are not for the benefit of the federal government. As plaintiffs point out, a federal regulation makes clear that an FEHBP carrier’s record retention practices are private acts: “Records retained by FEHBP carriers on Federal subscribers and members of their families serve the carriers’ own commercial function of paying health benefits claims and are not maintained to accomplish an agency function of [the Office of Personnel Management].” 48 C.F.R. §1624.104. Group Health does not address

this statement. Instead, it points to a different regulation that requires carriers to keep a federal employee’s medical information “confidential.” 48 C.F.R. § 1652.224–70. But this regulation says nothing about data security or storage policies. Regardless, compliance with a federal rule does not provide a basis for removal under § 1442(a)(1). Watson v. Philip Morris Companies, Inc., 551 U.S. 142, 152 (2007). It is true that at least part of the reason Group Health was storing federal employee data was Group Health’s contract with the federal government to administer health plans. (Group Health also was likely storing that data as part of its provision of healthcare services.)

But that sort of “but for” causation is not sufficient: “a bona fide federal officer could not remove a trespass suit that occurred while he was taking out the garbage.” Betzner v. Boeing Company, 910 F.3d 1010, 1015 (7th Cir. 2018) (internal quotation marks omitted). To qualify for removal under § 1442(a)(1), the plaintiff’s allegations must be “directed at the relationship between the [defendant] and the federal government.” Baker, 962 F.3d at 944–45. In this case, plaintiffs’ allegations are directed at conduct that falls outside the services that Group Health is providing for the federal government. So the court concludes that the FEHB plans do not create a right of removal under the circumstances of this case.

C. ERISA preemption Group Health contends that Case nos. 24-cv-312-jdp, 24-cv-315-jdp, and 24-cv-316-jdp are preempted because the named plaintiffs in those cases have employer-sponsored health plans that are governed by ERISA, and those plans “contain comprehensive terms regarding data privacy.” Case no. 23-cv-312-jdp, Dkt. 22, at 11. ERISA can trigger two types of preemption: complete and conflict. See Halperin v. Richards, 7 F.4th 534, 540–41 (7th Cir. 2021). Group Health relies solely on complete preemption, so the court

will not consider conflict preemption. Group Health has the burden to show that ERISA preempts plaintiffs’ claims, all of which rely solely on state common-law theories, such as negligence. See Trustees of AFTRA Health Fund v. Biondi, 303 F.3d 765, 775 (7th Cir. 2002). The parties agree that a state-law claim is completely preempted under ERISA only if two conditions are satisfied: (1) the plaintiff could have brought a claim under ERISA; and (2) no other independent legal duty is implicated by the defendant’s actions. See Aetna Health Inc. v. Davila, 542 U.S. 200, 210–11 (2004); Studer v. Katherine Shaw Bethea Hospital, 867 F.3d 721, 724 (7th Cir. 2017). Group Health has not shown that either condition is satisfied.

As for the first condition, a plan participant may sue under ERISA “to recover benefits due to him under the terms of his plan, to enforce his rights under the terms of the plan, or to clarify his rights to future benefits under the terms of the plan.” 29 U.S.C. § 1132(a)(1)(B). Group Health does not contend that this lawsuit relates to “benefits” under a plan. Instead, Group Health contends that plaintiffs could “enforce [their] rights under the terms of the plan” because “their ERISA plans contain comprehensive terms regarding data privacy.” Case no. 24-cv-312-jdp. Dkt. 22, at 12. But Group Health does not explain what “rights” the plan gives plaintiffs regarding data privacy, and it does not identify a claim that plaintiffs could

bring under the plan. To support its contention that plaintiffs could sue under the plan, Group Health cites the declaration of its chief compliance officer, who cites the following portion of the plan: PRIVACY AT GHC-SCW We understand that information about individuals and their health is personal. At GHC-SCW, we’re committed to protecting personal information to the fullest extent possible and limiting disclosures to the minimum necessary to provide cost-effective, quality care. Our On-going Commitment GHC-SCW employees receive on-going training and education regarding patient confidentiality and privacy, along with GHC- SCW privacy policies and procedures. GHC-SCW regularly monitors access of confidential health information to ensure its appropriate use within the organization. We take our responsibility seriously, and each year we renew our promise to protect patient confidentiality by signing a Confidentiality Agreement. GHC-SCW’s Notice of Privacy Practices Our Notice of Privacy Practices, which describes how medical information may be used and disclosed, certain obligations we have regarding the use and disclosure of medical information and how you can get access to this information, is distributed to all Members as a part of new Member enrollment materials, is posted and available in GHC-SCW Clinics, and is readily available on our Website, at www.ghcscw.com. Id., Dkt. 23-1, at 4. Group Health does not point to any language in this passage or any part of the plan that gives enforceable rights about data privacy to plan participants. As for the second condition, plaintiffs’ claims do not rely on any duties created by their health plans. Rather, they are asserting various common-law claims, such as negligence and invasion of privacy. Plaintiffs’ claims would be the same regardless of any language in the plans about privacy. Group Health says that plaintiffs “do not establish that a plan administrator owes any duty to participants or beneficiaries under Wisconsin common law with respect to data security.” Id., Dkt. 22, at 12. But this argument confuses the issue of preemption with the merits. The important point is that plaintiffs’ claims do not rest on any rights or language in the plan. In any event, the Wisconsin Court of Appeals has allowed plaintiffs to proceed on a negligence theory for a data breach. Reetz v. Advocate Aurora Health, Inc., 2022 WI App 59, ¶¶ 11–17, 405 Wis. 2d 298, 983 N.W.2d 669; see also Dusterhoft v. OneTouchPoint Corp,

No. 22-cv-882, 2024 WL 4263762, at *10 (E.D. Wis. Sept. 23, 2024) (denying motion to dismiss negligence claim based on a data breach). The court concludes that plaintiffs’ claims are not preempted by ERISA. This is consistent with two other decisions holding that ERISA did not preempt state-law claims arising out of a data breach. In re Anthem, Inc. Data Breach Litigation, No. 15-md-2617, 2016 WL 3029783, at *45–50 (N.D. Cal. May 27, 2016) (no preemption because plaintiffs’ claims were not about ERISA benefits); In re: Premera Blue Cross Customer Data Security Breach Litigation, No. 15-md-2633, 2017 WL 539578, at *20–22 (D. Or. Feb. 9, 2017) (no preemption because

“Plaintiffs’ allegations include that Premera, irrespective of the ERISA plan, was obligated to protect Plaintiffs’ Sensitive Information.”). Group Health cites no contrary authority.

ORDER IT IS ORDERED that plaintiffs’ motions to remand these cases to Dane County Circuit Court are GRANTED. The clerk of court is directed to stay remand for 30 days pending Group Health Cooperative’s appeal deadline. Entered February 12, 2025. BY THE COURT:

/s/ ________________________________________ JAMES D. PETERSON District Judge