Rasmuzzen v. Scripps Health

Opinion

Case No.: 21cv1135-GPC(MSB)

IN RE: SCRIPPS HEALTH DATA ORDER GRANTING DEFENDANTS’ SECURITY BREACH LITIGATION MOTION TO DISMISS FOR LACK OF SUBJECT MATTER JURISDICTION [DKT. NO. 14.]

Before the Court is Defendant Scripps Health’s motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction under the Class Action Fairness Act (“CAFA”) or, in the alternative, motion to stay the action under the Colorado River doctrine. (Dkt. No. 14.) Plaintiffs filed a response and Defendant replied. (Dkt. Nos. 18, 20.) Based on the reasoning below, the Court GRANTS Defendants’ motion to dismiss for lack of subject matter jurisdiction. Background This case involves a consolidated purported class action complaint against Defendant Scripps Health (“Defendant” or “Scripps”) regarding a ransomware attack where cybercriminals infiltrated Defendant’s network servers and accessed highly sensitive personal and medical information around April 29, 2021. (Dkt. No. 13, Consol. Compl. ¶¶ 1, 2.) Plaintiffs allege that Defendant failed to properly secure and safeguard its patient’s personally identifiable information (“PII”) and personal health information (“PHI”) stored within Defendant’s information networks and have been damaged. (Id. ¶¶ 1, 2, 7.) Plaintiffs seek to certify a nationwide class and a California subclass defined as: Nationwide Class: “All individuals within the United States of America whose PII/PHI was stored by Defendant and/or was exposed to unauthorized third parties as a result of the compromise of Scripps Health’s data systems, as announced on or about June 1, 2021.”

California Subclass: “All individuals within the State of California whose PII/PHI was stored by Defendant and/or was exposed to unauthorized third parties as a result of the compromise of Scripps Health’s data systems, as announced on or about June 1, 2021.”

(Id. ¶ 69.) The six state law causes of action alleged against Scripps are negligence, invasion of privacy, breach of confidence and declaratory relief on behalf of the Nationwide Class or, alternatively, on behalf of the California Subclass, and violations of the California Customer Records Act, Cal. Civil Code section 1798.80, and violation of California Confidentiality of Medical Records Act, Cal. Civ. Code section 56 et seq. on behalf of the California subclass. Discussion A. Legal Standard on Federal Rule of Civil Procedure 12(b)(1) Federal Rule of Civil Procedure (“Rule”) 12(b)(1) provides for dismissal of a complaint for lack of subject-matter jurisdiction. Fed. R. Civ. P. 12(b)(1). Rule 12(b)(1) jurisdictional attacks can be either facial or factual. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). Here, Defendant claims it is mounting a factual attack on subject matter jurisdiction and provides evidence outside the complaint. (Dkt. No. 14-1 at 18-19.1) In a factual attack, the challenger provides evidence that an alleged fact in the complaint is false, thereby resulting in a lack of subject matter jurisdiction. Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Under a factual attack, the allegations in the complaint are not presumed to be true, White, 227 F.3d at 1242, and “the district court is not restricted to the face of the pleadings, but may review any evidence, such as affidavits and testimony, to resolve factual disputes concerning the existence of jurisdiction.” McCarthy v. United States, 850 F.2d 558, 560 (9th Cir. 1988). “Once the moving party has converted the motion to dismiss into a factual motion by presenting affidavits or other evidence properly brought before the court, the party opposing the motion must furnish affidavits or other evidence necessary to satisfy its burden of establishing subject matter jurisdiction.” Savage v. Glendale Union H.S., Dist. No. 205, Maricopa Cnty., 343 F.3d 1036, 1039 n. 2 (9th Cir. 2003). The district court may review evidence beyond the complaint without converting the motion to dismiss into a motion for summary judgment. See id. However, “[a] court may not resolve genuinely disputed facts where ‘the question of jurisdiction is dependent on the resolution of factual issues going to the merits.’” Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987) (citations omitted) ). Ultimately, Plaintiff has the burden to demonstrate that subject matter jurisdiction exists. Kokkonen v. Guardian Life Ins. Co. of America, 511 U.S. 375, 377 (1994). CAFA provides an independent basis for original jurisdiction. 28 U.S.C. § 1332(d)(2). CAFA jurisdiction requires that the case is a class action involving: (1) minimal diversity, or in other words, that any member of the class is a citizen of a state different from any defendant; (2) at least 100 putative members; and (3) over $5,000,000 in controversy exclusive of interest and costs. 28 U.S.C. §§ 1332(d)(2), (d)(5)(B). Despite these requirements, Congress also provided exceptions to CAFA jurisdiction, which requires the district court to decline to exercise jurisdiction. 28 U.S.C. § 1332(d)(4); see King v. Great American Chicken Corp., Inc., 903 F.3d 875, 878 (9th Cir. 2018) (“The statute includes a number of exceptions that require a federal district court to decline jurisdiction even if the above requirements were met.”). The purpose is to allow truly intrastate class actions to be heard in state court. Adams v. W. Marine Prods., Inc., 958 F.3d 1216, 1220 (9th Cir. 2020). 1. Home State Controversy Exception In its motion, Defendant relies on the home-state controversy exception. (Dkt. No. 14-1 at 20; Dkt. No. 18 at 8.) Under the home-state controversy exception, a district court must decline to exercise jurisdiction where “two-thirds or more of the members of all proposed plaintiff classes in the aggregate, and the primary defendants, are citizens of the State in which the action was originally filed.” 28 U.S.C. § 1332(d)(4)(B). To meet this burden, the moving party must provide “some facts in evidence from which the district court may make findings regarding class members’ citizenship.” Mondragon v. Capital One Auto Fin., 736 F.3d 880, 884 (9th Cir. 2013); see also Brinkley v. Monterey Fin. Servs., Inc., 873 F.3d 1118, 1121 (9th Cir. 2017). While this “jurisdictional finding of fact should be based on more than guesswork,” the burden of proof “should not be exceptionally difficult to bear” and a court may “make reasonable inferences from facts in evidence.” Mondragon, 736 F.3d at 884, 886. The district court makes these factual findings under a preponderance of the evidence standard. Id. at 884. Once CAFA jurisdiction has been established, see 28 U.S.C. § 1332(d)(2) and (d)(5), the “party seeking to defeat jurisdiction by invoking this exception carries the burden of proving it applies.” Skogebo v. Cofiroute USA, LLC, Case No. SACV 19- 00739 AG (JDEx), 2019 WL 6711701, at *2 (C.D. Cal. Oct. 24, 2019) (citing King, 903 F.3d at 876); Edward & Marjorie Austin Unitrust v. U.S. Mortgage Corp., No. 2:06–cv– 01235–BES–PAL, 2007 WL 2886036, at *2 (D. Nev. Sept. 27, 2007) (party challenging court’s jurisdiction on a 12(b)(1) motion must prove “that CAFA exceptions to federal jurisdiction divest the district court of subject matter jurisdiction” and bears burden of establishing requirements of those exceptions.); see also Anirudh v. CitiMortgage, Inc., 598 F. Supp. 2d 448, 451 (S.D.N.Y. 2009), (“while plaintiffs bear the initial burden of establishing federal subject matter jurisdiction under CAFA, defendant bears the burden of proving that an exception to CAFA applies.”). 2. Analysis Here, the consolidated purported class action complaint alleges that “the amount in controversy exceeds the sum or value of $5 million, exclusive of interest and costs, there are more than 100 members in the proposed class, and at least one other Class Member is a citizen of a state different from Defendant as Defendant treats patients who are citizens of other states who come to its facilities for medical care and from whom Defendant has collected PII/PHI.” (Dkt. No. 13, Consol. Compl. ¶ 13.) Plaintiffs have sufficiently alleged diversity jurisdiction under CAFA. In its motion, Defendant seeks to defeat jurisdiction and invokes the home-state controversy exception which requires Defendant to show, by a preponderance of the evidence, that two-thirds or more of the proposed class are citizens of California. (See Dkt. No. 14-1 at 20; Dkt. No. 18 at 8.) Neither party disputes that Defendant is a citizen of California. “To be a citizen of a state, a natural person must first be a citizen of the United States.” Kanter v. Warner-Lambert Co., 265 F.3d 853, 857 (9th Cir. 2001) (citation omitted). A person’s citizenship then is determined by his or her state of domicile which is his or “her permanent home, where [he or] she resides with the intention to remain or to which she intends to return.” Id. (citations omitted). While “[a] person residing in a given state is not necessarily domiciled there, and thus is not necessarily a citizen of that state[]”, at a minimum, a person’s residence constitutes some evidence of domicile. Mondragon, 736 F.3d at 886. “[A] party with the burden of proving citizenship may rely on the presumption of continuing domicile, which provides that, once established, a person's state of domicile continues unless rebutted with sufficient evidence of change.” Id. at 885. Defendant presents the declaration of Taunya Juliano, the Corporate Privacy Officer for Scripps.2 (Dkt. No. 14-2, Juliano Decl.) She declares that Scripps is incorporated in California and has its principal place of business in San Diego, CA. (Dkt. No. 14-2, Juliano Decl. ¶ 2.) In early 2021, when the ransomware attack occurred, Scripps investigated and based on its investigation, notified about 144,011 individuals by direct mail about the ransomware attack. (Id. ¶¶ 3-6.) Of the 144,011 individuals, about 138,831 individuals, or 96.3% had California addresses. (Id. ¶ 7.) This percentage of individuals with California addresses is consistent with the approximate percentage of Scripps’ overall patient population that it serves. (Id. ¶ 8.) In opposition, Plaintiffs do not respond with rebutting evidence but with arguments based upon speculation. First, they assert that Juliano’s declaration amounts to guesswork arguing that because Scripps’ location is in sunny San Diego, many patients are snowbirds who come to San Diego during the harsh winter months but are citizens of other states or countries. (Dkt. No. 18 at 11.) While snowbirds do flock to San Diego, Plaintiffs have not offered any data that these snowbirds include patients of Scripps. Next, Plaintiffs argue that Defendant fails to state how many individuals to whom it sent notices are United States or California citizens and her assertion that the 96% is “consistent with the approximate percentage of Scripps’ overall patient population that it services” does not satisfy the burden. However, the statute does not require that Scripps specifically state how many of its patients are United States citizens and how many are California citizens, and a court is not required to “examin[e] the domicile of every 2 While Plaintiffs question the declaration of Juliano because she is merely a Corporate Privacy Officer, they fail to explain how she does not have personal knowledge of the contents of her declaration. (Dkt. No. 18 at 9-11.) Moreover, Plaintiffs argue Juliano fails to provide any substantiating information about the last known addresses to whom Scripps sent the data breach notices. (Id.) Yet, they fail to provide legal authority that her declaration, itself, has no evidentiary value to the Court’s determination of proposed class member before ruling on the citizenship requirement [as] it would render class actions ‘totally unworkable.’” See Adams, 958 F.3d at 1223. Further, the Court agrees that Juliano’s general statement that 96% is consistent with the percentage Scripps’ patient population does not support Defendant’s position, but notwithstanding that statement, Scripps has already provided “some evidence” showing that 96.3% of those that received notices concerning the data breach have California addresses. Here, the class size is around 144,011. For the home state controversy exception to apply “greater than 2/3” or 66 2/3%3 of 144,011 must be California citizens. In this case, the ransomware attack occurred in April 2011 and the letter from Scripps was received by class members around June 1, 2021, (Dkt. No. 13, Consol. Compl. ¶¶ 47, 36, 69), indicating that most addresses are most likely current. See Romano v. SLS Residential, Inc., 812 F. Supp. 2d 282, 288 (S.D.N.Y. 2011) (because class included residents of a facility where more than four years had passed, court could not conclude that most remained in New York). Scripps is the second largest healthcare provider in San Diego. (Dkt. No. 13, Consol. Compl. ¶¶ 8, 54.) Given the significant cost of healthcare and patients’ goal of maximizing the healthcare benefits furnished by a provider, it stands to reason that the vast majority of Scripps patients are from the San Diego or nearby area. While the Court recognizes that there may be members who specifically seek out Scripps’ renown medical care from out of state, they would likely be included in the 3.7% that do not have California addresses. It is also to be noted that all the named Plaintiffs are residents of California. (Id. ¶¶ 17, 31, 40, 48.) Further, there is no indication that Scripps provides medical care for seasonal workers who are migratory or transitory. See Ali v. Setton Pistachio of Terra Bella Inc., Case 1:19-cv-00959-NONE- BAM, 2021 WL 389659, at *4 (E.D. Cal. Feb. 4, 2021) (addresses of seasonal workers who were migratory did not support conclusion that their address was their domicile);

3 The Ninth Circuit confirmed that “two-thirds actually translates into 66 & 2/3 percent, not 67 percent.” Romano, 812 F. Supp. 2d at 288 (residential psychiatric facility where out of staters could seek treatment and where these patients would less likely remain in the area once treatment was completed did not support New York citizenship). Therefore, based on these facts, the Court can reasonably infer that more than 2/3 of the class are citizens of California. See Mondragon, 736 F.3d at 886 (“district courts are permitted to make reasonable inferences from facts in evidence”). While addresses are not the same as domicile, it constitutes some evidence of domicile, which is all that is needed for the Court to make a finding regarding the CAFA exception. See Mondragon, 736 F.3d at 884 (“we conclude that there must ordinarily be at least some facts in evidence from which the district court may make findings regarding class members' citizenship for purposes of CAFA's local controversy exception.”). Therefore, without any evidence by Plaintiffs to challenge Defendant’s fact that 96.3% of the notices were sent to California addresses, or that the recipients are not California citizens, Defendant has shown that the home-state controversy exception applies, and thus, the Court lacks subject matter jurisdiction over the case. Plaintiffs rely on King v. Great American Chicken Corp., Inc., 903 F.3d 875 (9th Cir. 2018) and Adams v. West Marine Prods., Inc., 958 F.3d 1216 (9th Cir. 2020) to support their argument. However, neither provides succor. For example, in King, the Ninth Circuit reversed the district court’s order granting a motion to remand under the home-state controversy exception because there was no evidence that greater than two- thirds of members of all proposed plaintiffs were citizens of California. In that case, the district court relied on the defendant’s stipulation that “at least two-thirds of the putative class members had last-known addresses in California.” Id. at 879. First, the court noted that the stipulation which stated “at least two-thirds” and the CAFA exception requiring “greater than two-thirds” are not the same. Id. The Ninth Circuit concluded that because there was a “narrow cushion provided by the stipulation, the likelihood that some putative class members were legally domiciled in or subsequently relocated to another state, and the probability that some class members were not United States citizens, [it could not] conclude that there was sufficient evidence to support a finding that greater than two- thirds of the putative class members were California citizens.” Id. at 779-80. The court explained that the stipulation would have required it to assume that nearly 100% of class members with last known addresses in California were also California citizens which the court asserted was an assumption that would have amounted to little more than guesswork. Id. at 880. Here, 96.3% of those who received the data breach notice had California addresses, and unlike in King, establishes more than a “narrow cushion” establishing a probability that more than two-thirds of the class members are California citizens. In contrast to King, in Adams, the Ninth Circuit, addressing the discretionary home state controversy exception standard of “greater than one-third”, the plaintiff provided evidence that more than 90% of class members had last known mailing addresses in California which was not a “narrow cushion” but a “percentage far greater than the one- third (or roughly, 33%) required for remand and offered a declaration that only citizens of California were hired and no foreign nationals were ever hired by the defendant. Adams, 958 F.3d 1222-23. Recognizing that the “last known mailing addresses are not a direct proxy for residence, and residence is not a direct proxy for citizenship”, and that “[s]ome of the verified California addresses probably belong to people who are not California citizens, or even citizens of the United States”, nonetheless, “given the substantial cushion afforded by the percentage of class members with last known California addresses, as compared to the percentage of class member citizens required for a discretionary remand [33%], [the plaintiff] readily met her burden.” Id. at 1223. Here, even though the percentage gap is less than in Adams, there exists a far greater margin to support the Court’s conclusion. Accordingly, the Court GRANTS Defendant’s motion to dismiss for lack of subject matter jurisdiction. As such, the Court also DENIES Defendant’s alternative argument that the Court stay the action pursuant to the Colorado River doctrine as moot. / / / Conclusion Based on the reasoning above, the Court GRANTS Defendant’s motion to dismiss lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and DENIES its motion to stay as MOOT. The hearing set on January 28, 2022 shall be vacated. Dated: January 25, 2022 Hon. athe Cae United States District Judge