Ristvet v. Fred Hutchinson Cancer Center

Opinion

UNITED STATES DISTRICT COURT AT SEATTLE IN RE: FRED HUTCHINSON DATA CASE NO. 2:23-cv-01893-JHC SECURITY LITIGATION ORDER GRANTING MOTION TO REMAND (DKT. # 36)

I This matter comes before the Court on Plaintiffs Alexander Irvine and Barbara Twaddell’s Motion to Remand. Dkt. # 36. This consolidated putative class action1 stems from an alleged data breach of a network containing confidential information of patients treated by

1 To date, the Court has consolidated 10 cases in this putative class action. Five cases were first filed in the Superior Court of Washington and removed to this Court: Beach, et al. v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv-00031; Aleshire v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv- 00034; Reed v. Fred Hutchinson Cancer Ctr., No. 2:24-cv-00029; Arneson v. Fred Hutchinson Cancer Ctr., No. 2:24-cv-00033; Irvine et al. v. Fred Hutchinson Cancer Ctr. et al., No. 2:24-cv-00030; and Irvine et al v. Univ. of Washington, No. 2:24-cv-00296. The remaining five were filed in federal court: Doe v. Fred Hutchinson Cancer Ctr., et al., No. 2:23-cv-01893; Hunter v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01988; Ayers v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01916; Holz, et al. v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01998; and Ristvet, et al. v. Fred Hutchinson Cancer Ctr., No. 2:24-cv-00019. Defendants Fred Hutchinson Cancer Center (“Fred Hutch”) and the University of Washington.2 Dkt. # 1 at 8. Movants Irvine and Twaddell contend that the Court lacks subject matter jurisdiction, seeking to remand the all member cases removed from King County Superior Court and dismiss without prejudice the remaining member cases filed in federal court. Dkt. # 36 at 2 n.1. Defendants and Plaintiffs Doe, Ayers, Hunter, Holz, Guay, Moncreif, Ristet, Martin, Kuhn, Beach, Paciocco, Browne, Peramas, Smith, Clayton, Aleshire, Rappaport, Reed, and Arneson (“Doe Plaintiffs”) oppose the motion. Dkt. ## 46, 47, 48. Because the discretionary home-state exception to the Class Action Fairness Act (CAFA) applies, the Court GRANTS the motion. II BACKGROUND On November 19, 2023, Fred Hutch detected unauthorized activity on parts of its clinical computer network. Dkt. # 1 at 8. An investigation determined that an unauthorized third party had accessed the clinical network and obtained patient information from Fred Hutch systems. Id. (citing Notice to Our Patients, Fred Hutch Cancer Center, https://www.fredhutch.org/en/about/ about-the-hutch/ accountability-impact/notice-to-our-patients-of-data-security-incident.html (last visited Mar. 18, 2024)). Not only did this data breach affect Fred Hutch patient information, but it also allegedly involved patient information within the broader medical system of the University of Washington. Id. Plaintiffs allege that, as a result of the breach, current and former patients have received “a flood of extortionary threats by cybercriminals.” Id. at 2.

2 Three complaints consolidated under this case number also include additional defendants: the University of Washington School of Medicine, University of Washington Medical Center, Harborview Medical Center, Valley Medical Center, University of Washington Physicians, University of Washington Neighborhood Clinics, Airlift Northwest, and Childrens University Medical Group. See Doe v. Fred Hutchinson Cancer Ctr., et al., No. 2:23-cv-01893; Aleshire v. Fred Hutchinson, et al., No. 2:24-cv- 00034-JHC; Beach, et al. v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv-00031. Because these defendant entities do not participate in the briefing on the motion to remand, this order refers only to Defendants Fred Hutch and the University of Washington. Plaintiffs bring these causes of action: (1) negligence; (2) negligence per se from duties arising under the Federal Trade Commission Act (FTCA), see 15 U.S.C. § 45(a)(1); (3) negligence per se from duties arising under Health Insurance Portability and Accountability Act

(HIPAA), see 45 C.F.R. Part 160 and 164, Subparts A and E, and the HIPAA Security Rule; 45 C.F.R. Part 160 and Part 164, Subparts A and C; (4) breach of implied contract; (5) breach of fiduciary duty; (6) invasion of privacy; (7) unjust enrichment; (8) violation of the Washington Consumer Protection Act, see RCW 19.86.01 et seq.; (9) violation of the Washington Data Breach Disclosure Law, see RCW 19.255.005 et seq.; and (10) violation of the Washington Uniform Health Care Information Act, see RCW 80.02.005 et seq.. See Dkt. # 1 at 22–38.3 The first federal case related to this data breach was filed on December 10, 2023. See Dkt. # 1. On January 5, 2024, the Court issued an order to consolidate related cases and an order to appoint interim class counsel. Dkt. ## 9, 10. On January 8, 2023, Fred Hutch removed its first case from state court, asserting federal jurisdiction under CAFA. See Aleshire v. Fred Hutchinson, et al., No. 2:24-cv-00034-JHC, Dkt. # 1. On January 12, 2024, after their removed case was consolidated, Irvine and Twaddell moved to vacate the order appointing interim counsel and then filed the motion to remand on January 24, 2024. See Dkt. # 13.4 3 Because Plaintiffs have not yet filed a consolidated complaint, the Court has compiled all causes of action pleaded in the 10 cases. See supra n.1. 4 Fred Hutch and Doe Plaintiffs contend that, per the Court’s order granting interim class counsel, see Dkt. # 10, the Court should not consider the motion to remand because Irvine and Twaddell lack authority to speak for the putative class. See Dkt. # 46 at 3; Dkt. # 48 at 2. This argument is not persuasive; no matter if the motion to remand is procedurally proper, the Court has an independent obligation to address whether it has subject matter jurisdiction. See Allstate Ins. Co. v. Hughes, 358 F.3d 1089, 1093 (9th Cir. 2004); Shamrock Dev. Co. v. City of Concord, 656 F.2d 1380, 1384 (9th Cir. 1981) (citing Mansfield, Coldwater & Lake Michigan Ry. v. Swan, 111 U.S. 379 (1884)). In addition, recognizing that the CAFA home-state exception is not jurisdictional, but a form of federal abstention, the Court may similarly raise abstention issues sua sponte. See Adams v. W. Marine Prod., Inc., 958 F.3d 1216, 1223–24 (9th Cir. 2020) (collecting cases). The Court therefore considers the merits of the motion to remand. III DISCUSSION CAFA applies to class action lawsuits when the aggregate number of members of all proposed plaintiff classes is 100 or more and where the primary defendants are not “States, State officials, or other governmental entities against whom the district court may be foreclosed from ordering relief[.]” 28 U.S.C. § 1332(d)(5); see 28 U.S.C. § 1332(d)(1)(B) (defining “class action” as “any civil action filed under rule 23 of the Federal Rules of Civil Procedure or similar State statute or rule of judicial procedure authorizing an action to be brought by 1 or more representative persons as a class action”); Serrano v. 180 Connect, Inc., 478 F.3d 1018, 1020–21 (9th Cir. 2007). Once the prerequisites of 28 U.S.C. § 1332(d)(5) are satisfied, CAFA vests federal courts with “original” diversity jurisdiction over class actions if: (1) the aggregate amount in controversy exceeds $5,000,000, and (2) any class member is a citizen of a state different from any defendant. 28 U.S.C. § 1332(d)(2). Therefore, under CAFA, complete diversity is not required but “minimal diversity” suffices. Bush v. Cheaptickets, Inc., 425 F.3d 683, 684 (9th Cir. 2005). There are two statutory exceptions to CAFA jurisdiction that “allow truly intrastate class actions to be heard in state court”: the local-controversy exception and the home-state exception. Adams v. W. Marine Prod., Inc., 958 F.3d 1216, 1220 (9th Cir. 2020) (emphasis in original) (citing Bridewell-Sledge v. Blue Cross of Cal., 798 F.3d 923, 928 (9th Cir. 2015)). At issue in this case is the home-state exception, which consists of two parts: the mandatory home-state exception and the discretionary home-state exception. Under the mandatory exception, “the district court ‘shall’ decline to exercise jurisdiction where ‘two-thirds or more of the members of all proposed plaintiff classes in the aggregate, and the primary defendants, are citizens of the State in which the action was originally filed.’” Id. (citing 28 U.S.C. § 1332(d)(4)(B)). Under the discretionary home-state exception, a district court “may, in the interests of justice and looking at the totality of the circumstances, decline to exercise jurisdiction” when more than one-

third of the putative class, and the primary defendants, are citizens of the state where the action was originally filed. Id. (citing 28 U.S.C. § 1332(d)(3)). Parties seeking remand under a CAFA exception—here, Irvine and Twaddell—“must provide some facts in evidence from which the district court may make findings regarding class members’ citizenship.” Brinkley v. Monterey Fin. Servs., Inc., 873 F.3d 1118, 1121 (9th Cir. 2017) (quotation marks omitted). “The district court makes these factual findings under a preponderance of the evidence standard.” Id. (citing Mondragon v. Cap. One Auto Fin., 736 F.3d 880, 884 (9th Cir. 2013)). Although such a finding must be based on more than mere “guesswork,” courts “may make reasonable inferences from facts in evidence.” Id. (citing

Mondragon, 736 F.3d at 884, 886). According to Irvine and Twaddell, the Court should decline to exercise jurisdiction under the discretionary home-state exception to CAFA jurisdiction.5 Dkt. 36 at 2. Fred Hutch and Doe Plaintiffs oppose, while the University of Washington takes no position on this issue. See generally Dkt. ## 46, 47, 48.

5 Irvine and Twaddell make two additional arguments why the Court lacks jurisdiction. First, they claim that the University of Washington is a government entity and a primary defendant, precluding CAFA jurisdiction. See 28 § 1332(d)(5). Because the Court remands on other grounds, it declines to address this argument. Second, Movants contend that CAFA’s mandatory home-state exception applies, which requires the Court decline to abstain. Dkt. # 36 at 2. The Court similarly declines to explore this as a basis for remand. A. Citizenship of the Putative Class Irvine and Twaddell contend that because more than one-third of the putative class has a last-known address in the state of Washington, the citizenship threshold of the discretionary

home-state exception is satisfied. Dkt. # 36 at 12–13.6 According to preliminary information shared by Fred Hutch with Movants, Fred Hutch mailed notice letters to the last-known addresses of its current and former patients, mailing notices to 896,793 recipients, 809,707 (about 90%) of those were sent to Washington addresses. Id. at 9; Dkt. # 37 at 4–5. Irvine and Twaddell assert that these notice letters are a prima-facie showing of class member citizenship, Dkt. # 36 at 9–10 (citing Mondragon, 736 F.3d 880; Hollinger v. Home State Mut. Ins. Co., 654 F.3d 564, 571 (5th Cir. 2011)), and conclude that the one-third threshold of the discretionary exception has been met. Id. at 12 (“The requirement of the discretionary exception are met if approximately 298,931 of the 809,707 Washington addresses belong to Washington citizens. It would require more than 510,776 of the Washington addresses to belong to non-Washington citizens for the discretionary exception’s one-third threshold to not be met.”). Fred Hutch and Doe Plaintiffs counter that, by relying on last-known mailing addresses, Irvine and Twaddell have engaged in impermissible “guesswork” regarding the citizenship of class members. Dkt. # 46 at 11 (citing Johnson v. Yuma Reg’l Med. Ctr., 2:22-cv-01061-SMB, 2023 U.S. Dist. LEXIS 181993, at *10 (D. Ariz. 2023)). Fred Hutch says that after further investigation, their data security firm “identified 1,323,532 unique records” that were compromised in the breach, and that each record corresponds to a “unique individual.” Dkt. # 46 at 12; Dkt. 46-2 at 4. They state that, “[o]f that total, Fred Hutch has valid Washington addresses for 879,004—approximately 66.41% of the total population.” Dkt. # 46 at 12 (citing Dkt. # 46-2

6 The parties agree that Fred Hutch and the University of Washington are citizens of Washington. See Dkt. # 1 at 4; Dkt. # 36 at 3. at 3) (“After assessing these records for valid addresses and submitting these addresses to the National Change of Address database to update them, valid Washington addresses were available for 879,003 records. This equates to approximately 66.41% of the total population of unique

records.”). Fred Hutch and Doe Plaintiffs also contend that, even with this updated data, the notice letters cannot show the recipient’s citizenship because “domicile requires residency plus intent.” Dkt. # 46 at 10; see Dkt. # 48 at 17. According to Fred Hutch, merely counting valid Washington addresses is insufficient and Irvine and Twaddell should ideally perform an “individual inquiry . . . to assess each Washington resident’s intent to remain in Washington.” Dkt. # 46 at 14. Fred Hutch concludes that for these reasons, and because it is a renowned cancer treatment center that attracts and serves patients without regard to citizenship, Movants have failed to show that between one-third and two-thirds of the putative class action are

Washington citizens. Id. 1. Whether last known addresses are evidence of citizenship The first issue to resolve is whether the Court may consider last-known addresses as prima facie evidence for a person’s citizenship. Under CAFA, “A person’s state of citizenship is established by domicile, not simply residence.” King v. Great Am. Chicken Corp, Inc., 903 F.3d 875, 879 (9th Cir. 2018). One’s domicile is her “permanent home”—that is, where (i) she resides, (ii) “with the intention to remain or to which she intends to return.” Id. At minimum, a person’s residence constitutes some evidence of domicile. Mondragon, 736 F.3d at 886. “[A] party with the burden of proving citizenship may rely on the presumption of continuing domicile, which provides that, once established, a person's state of domicile continues unless rebutted with sufficient evidence of change.” Id. at 885. Adams, 958 F.3d at 1221. Fred Hutch, relying on Johnson v. Yuma Regional Medical Center, contends that last- known addresses “do not establish citizenship even for the discretionary home-state exception.” Dkt. # 46 at 15. In Johnson, plaintiffs filed a putative class action against a medical center in

state court and the action was later removed to the District Court of Arizona under CAFA jurisdiction; plaintiffs alleged injuries caused by the medical center’s failure to protect sensitive patient information. 2023 U.S. Dist. LEXIS 181993, *5. Plaintiffs moved to remand under the discretionary home-state exception and relied on the putative class member’s last-known addresses as a presumption of citizenship. In its analysis, the Johnson court cautioned that the Ninth Circuit had not adopted a presumption that residence is prima facie evidence of domicile. Id. at *7 (citing Mondragon, 736 F.3d at 886) (“It does not appear that this circuit has yet adopted this presumption. Because the issue is not squarely presented by this appeal, we decline to reach that issue here.”)). The district court then concluded that last-known addresses could

not establish domicile, despite plaintiffs’ demonstration that 77% of the notice letters sent to former patients were directed to Arizona addresses. Id. at *9 (“Plaintiffs still only provide the total number of notification letters sent (720,217), and the total number of notification letters sent to Arizona addresses (560,513).”). The Johnson court reasoned that this was because “Yuma is a ‘snowbird city’—meaning many putative class members are likely to only spend a portion of the year at their Arizona residence but are domiciled elsewhere.” Id. at *10. Under those facts, the Johnson plaintiffs failed “to provide sufficient evidence for the Court to determine that greater than one third of the putative class members are currently domiciled, or even residing in, Arizona.” Id. Given the different facts in Johnson, the Court is not convinced that the case should

instruct the analysis here. First, Fred Hutch does not argue that there is a statistically significant portion of the greater Seattle area that is transient—like the “snowbirds” in Johnson—so as to cast doubt on the validity of the last-known addresses in Washington. Second, although the Ninth Circuit has not adopted a presumption of domicile based on proof of residence, it has stated that “[a]t minimum, a person’s residence constitutes some evidence of domicile” and once

established the court may apply a “presumption of continuing domicile . . . unless rebutted with sufficient evidence of change.” Adams, 958 F.3d at 1221–22 (concluding that it was “[f]ar more likely than not” that class citizenship exceeded the one-third threshold because over 90% of the class had last-known addresses in California). Because the last-known addresses of those affected by the Fred Hutch data breach is some evidence of domicile, the Court accepts that last- known addresses may provide rebuttable evidence of citizenship. 2. Whether the updated data from Fred Hutch establishes citizenship The next issue to resolve is whether the last-known addresses in this case may establish, by a preponderance of the evidence, that the class is made up of more than one-third Washington

residents. Rebutting Irvine and Twaddell’s position that 90% of last-known addresses are from Washington, Fred Hutch asserts that the preliminary figures on which Movants rely are flawed because they are outdated; Fred Hutch states that it has since refined the scope of its investigation and has valid last-known addresses for 879,004 individuals in Washington, which is actually “approximately 66.41% of the total population.” Dkt. # 46 at 12 (citing Dkt. # 46-2 at 3). Fred Hutch adds that despite this refined data, the last-address approach is still unreliable and incomplete. Dkt. # 46 at 12. For example, Fred Hutch highlights that since sending its notice letters to valid Washington addresses: • 58,235 letters have been returned as undeliverable; • 29,701 records belong to deceased persons;

• 3,161 addresses belong to military bases and those individuals have likely moved; • 48,005 addresses are post office boxes; • 592 addresses are hospitals; and • Nearly 17,000 are non-residential addresses. Dkt. # 46 at 12–14; Dkt. # 46-2 at 3–4.7

The above “unreliable” addresses total 156,694 or around 17.82% of the total valid Washington addresses. For the sake of a cautious analysis, even if the Court were to assume that all of the patients associated with these addresses are U.S. citizens who no longer reside in Washington, eliminating them from the total number of Washington residences (879,004) would reduce the number of valid Washington addresses to 722,310 or 54.57% of the total 1,323,532 unique records affected by the breach. The Court further notes that: CAFA does not demand a plaintiff show the citizenship of each class member with certainty beyond a reasonable doubt. And, as the Fifth Circuit observed, requiring a district court to “examin[e] the domicile of every proposed class member before ruling on the citizenship requirement” would render class actions “totally unworkable.” [Preston v. Tenet Healthsystem Mem’l Med. Ctr., Inc., 485 F.3d 793, 816 (5th Cir. 2007)] (internal citations omitted). Rather, CAFA requires only that a plaintiff show, by a mere preponderance of the evidence, that the citizenship requirement is met. This burden should not be “exceptionally difficult to bear,” Mondragon, 736 F.3d at 886, and should be considered with the goal of CAFA in mind: to keep interstate actions in federal court and truly intrastate actions in the state courts. King, 903 F.3d at 878. Adams, 958 F.3d at 1223.8 Acknowledging that Irvine and Twaddell’s burden should not be “exceptionally difficult to bear,” and given the there is a buffer of at least 21.24% between this cautious 54.57% of 7 Fred Hutchinson also provides a declaration from an attorney who says that they performed “a search of a small sample from the population of last-known Washington mailing addresses” and identified 10 addressees that are residents of another state. Dkt. # 46-4 at 3. The attorney did not provide any details on how many addressees made up this “small sample” and, without more statistical information, this declaration does not help the Court. 8 Fred Hutch also suggests that Plaintiffs should show each class member’s intent to remain in Washington and provide additional evidence such as tax payments in Washington, place of employment, or driver’s licenses, Dkt. # 46 at 15 (citing Lew v. Moss, 797 F.2d 747, 750 (9th Cir. 1986)), this position misconstrues the applicable “mere preponderance” standard. Washington addresses and the one-third (33.33%) threshold, the Court concludes it is more likely than not that more than one-third of the putative class are Washington citizens. Id. at 1223 (“Nevertheless, given the substantial cushion afforded by the percentage of class members with

last known California addresses, as compared to the percentage of class member citizens required for a discretionary remand, Adams readily met her burden.”). B. Six Discretionary Factors

Once the Court has resolved the CAFA citizenship requirement, it must then determine whether the matter is “indeed local in nature” and appropriate for remand. S. REP NO. 109-14, at 28 (2005). CAFA provides six factors for a district court to consider when deciding whether to decline jurisdiction under the discretionary home-state exception: (A) whether the claims asserted involve matters of national or interstate interest;

(B) whether the claims asserted will be governed by laws of the State in which the action was originally filed or by the laws of other States; (C) whether the class action has been pleaded in a manner that seeks to avoid Federal jurisdiction;

(D) whether the action was brought in a forum with a distinct nexus with the class members, the alleged harm, or the defendants; (E) whether the number of citizens of the State in which the action was originally filed in all proposed plaintiff classes in the aggregate is substantially larger than the number of citizens from any other State, and the citizenship of the other members of the proposed class is dispersed among a substantial number of States; and

(F) whether, during the 3-year period preceding the filing of that class action, 1 or more other class actions asserting the same or similar claims on behalf of the same or other persons have been filed. 28 U.S.C. § 1332(d)(3). 1. Factor one: National or interstate interest Irvine and Twaddell contend that because Defendants are Washington citizens and serve primarily Washington citizens who all sought treatment or healthcare in Washington, the data breach is not of national or interstate interest. Dkt. # 36 at 13. Fred Hutch responds that not all persons involved in the data breach sought health care in Washington, some patients received treatment at other institutions and merely had laboratory testing done by Fred Hutch. Dkt. # 46

at 16. According to Fred Hutch, because there are putative class members located all over the country and issues such as data security incidents are “of national significance[,]” this factor weighs in their favor. Id. In reply, Irvine and Twaddell cite Flath v. Barnes Jewish Hospital, a data breach case in which defendants similarly argued that a putative class action involved matters of national or interstate interest because, although 66.14% of the putative class were citizens of Missouri, the defendant hospital received “pathology specimens from all over the country[.]” No. 4:12CV00721 ERW, 2012 WL 4809179, *2, *4 (E.D. Mo. Oct. 10, 2012). The Eastern District of Missouri was not persuaded and held that “solely having services or products in other states

does not necessarily create a national or interstate interest.” Id. at *4. Like the defendants in Flath, Fred Hutch claims that an unknown number of out-of-state patients may have had laboratory testing done by Fred Hutch, without necessarily entering Washington to receive treatment. As in Flath, the Court is similarly unconvinced that an unknown number of patients from outside Washington that availed themselves to Fred Hutch laboratory services could make this matter of national or interstate interest. Further, although Fred Hutch contends that data breach class actions are becoming more prevalent across the country, see Dkt. # 46 at 16 n.1, the Court struggles to see how that fact would make this data breach—a breach centered in Washington that primarily involved Washington patients—of national or interstate interest. Considering the likelihood that most affected class members reside

in Washington, factor one favors remand. 2. Factor two: Claims governed by Washington law or other state law Irvine and Twaddell contend that all causes of action in this case are based on Washington law. Dkt. # 36 at 13. Fred Hutch responds that not all claims arise under

Washington law, as Irvine and Twaddell “expressly rely” on HIPAA and the FTCA “in seeking to establish Fred Hutch’s alleged duties” under negligence per se claims, and thus this factor supports federal jurisdiction. Dkt. # 46 at 16 (citing Irvine et al. v, Fred Hutchinson et al., No. 2:24-cv-00030, Dkt. # 1-2 at 21).9 In reply, Irvine and Twaddell assert that a claim’s “reference to federal law is not determinative, especially where the law of decision is state law.” Dkt. # 51 at 11 (citing Hirschbach v. NVE Bank, 496 F. Supp. 2d 451, 461 (D.N.J. 2007); Scott v. Cerner Corp., No. 4:15-CV-00326-SRB, 2015 WL 5227431 (W.D. Mo. Sept. 8, 2015)). Here, Plaintiffs bring 10 causes of action: three are based on Washington statutes and seven are based on the common law of torts. Two of the tort claims sound in negligence per se, referencing violations of duties that arise under federal law: HIPAA and the FTCA. Because the plain language of this factor asks whether the claims rely on “laws of other States[,]” 28 U.S.C. § 1332(d)(3)(B), and none of the causes of actions in this case involve another state’s law, this factor favors remand. See Scott, 2015 WL 5227431, *5 (“Plaintiff asserts a Missouri claim pursuant to a Missouri statute that references the federal Fair Labor Standards Act. Taken literally, 1332(d)(3) requires this Court to determine if other state’s laws will be involved, which they will not.”).

9 Fred Hutch also claims that “while Washington law will likely apply to many class members, this may not be true for individuals with no connection to Washington, such as those persons whose information was provided to Fred Hutch for laboratory testing.” Dkt. # 46 at 16. Because this statement does not address whether the claims are governed by Washington law or other state law, the Court will not consider it. 3. Factor three: Pleaded in a manner to avoid federal jurisdiction

Irvine and Twaddell contend that their case was initially brought in state court and was not pleaded in a way to avoid federal jurisdiction as they seek to represent a national class and have not limited their class to Washington citizens. Dkt. # 36 at 13. Fred Hutch responds that the motion to remand is “gamesmanship” that threatens to “orphan” a case in state court, despite federal consolidation and a leadership order in place. Dkt. # 46 at 16–17. The Court disagrees. There is no indication that remand of this matter would “orphan” any case in state court, considering that this case and all member cases would either be remanded to state court for adjudication or dismissed without prejudice so the parties may re-file in state court. See Dkt. # 36 at 2 n.1. Furthermore, the Irvine and Twaddell complaint does not appear to be pleaded in a way to avoid federal jurisdiction: there is no apparent limitation to the damages pleaded to avoid CAFA jurisdiction and the Irvine and Twaddell wish to represent a

national class. See Hirschbach, 496 F. Supp. 2d at 461 (“Additionally, the Amended Complaint shows no indication that it was pleaded in a manner seeking to avoid federal jurisdiction. Plaintiff could have expressly limited the class to citizens of New Jersey but did not.”). This factor therefore weighs toward remand. 4. Factor four: Brought in a forum with a distinct nexus with the class members, the alleged harm, or defendants According to Irvine and Twaddell, “Defendants are based in King County, and therefore that forum has a ‘distinct nexus’ to the potential class members, who sought treatment or healthcare in King County.” Dkt. # 36 at 13. Fred Hutch responds that the fourth factor requires Irvine and Twaddell to establish the class’s citizenship and, because they have not done so, “the Court should accord these factors little weight.” Dkt. # 46 at 17. It is undisputed that Defendants are citizens of Washington and the harm, a data breach, targeted Fred Hutch, a citizen of Washington. Although Fred Hutch seeks to cast doubt on the citizenship of the class members, as discussed above, its updated data show that it is more likely

than not that most class members are Washington citizens. Considering the class, the alleged harm, and defendants have a nexus with Washington, this factor favors remand. 5. Factor five: The number of Washington citizens in the proposed class is substantially larger than the number of citizens from any other state and the citizenship of the other members is dispersed among a substantial number of states Irvine and Twaddell contend that this factor favors remand because Fred Hutch mailed notices to all 50 states, the District of Columbia, and abroad. Dkt. # 36 at 13. Relying on the preliminary data provided by Fred Hutch, Irvine and Twaddell maintain that the “87,086 potential class members with non-Washington addresses are widely dispersed across a number of states.” Id. Fred Hutch responds that because the last-known address data are still unclear, this factor should have “little weigh in [the Court’s] analysis.” Dkt. # 46 at 17. According to the updated data supplied by Fred Hutch’s data security firm, and as discussed previously, somewhere between 33.58% and 45.43% of the unique records compromised in the breach are linked to non-Washington addresses. Dkt. # 46-2 at 3–5, see supra Part A.2. Although the preliminary data relied on by Irvine and Twaddell shows an estimate of how many patients reside in states other than Washington, Fred Hutch does not include these details in its updated data. Although there are class members scattered across the United States, U.S. territories, and abroad, Fred Hutch does not contend that any one state has a significantly greater interest in this case over any other. Dkt. # 37 at 4–5. See Hirschbach, 496 F. Supp. 2d at 461 (“While there is no proof before the Court regarding the domicile of the non- New Jersey members of the class, there is no indication that any other single state has as great an interest in litigating the controversy as New Jersey does.”). Because the preliminary data shows that class members are distributed throughout all 50 states and the updated data does not speak to this issue, this factor favors remand.

6. Factor six: In the past three years, one or more other class actions asserting similar claims have been filed on behalf of the same or other persons Irvine and Twaddell concede that “[s]everal other class actions over the same data breach were filed in response . . . in Washington state court and Washington federal court.” Dkt. # 36 at 14. Fred Hutch agrees, acknowledging that five cases were filed in state court and five others were filed in federal district court, all of which have been consolidated under this case number. Dkt. # 46 at 17.10 Because multiple putative class actions have been filed alleging the same or similar claims related to the data breach, this factor favors denying remand. That said, the Court notes that, to date, all pending cases alleging similar claims have been removed and consolidated. Therefore, while this factor does not support remand, there is nothing to suggest that there are any significant obstacles to remanding this consolidated action to state court. Cf. Hirschbach, 496 F. Supp. 2d at 462 (“In other words, with regard to this last factor, nothing suggests that there is a need for coordination of various overlapping or parallel actions.”). Five of the six discretionary factors support remand, and remand would not create inefficiency or deprive the federal judiciary consideration of a truly national or interstate matter. 10 Since filing the motion to remand, Irvine and Twaddell filed another case against the University of Washington, which was removed to federal court and consolidated with this case. See Irvine et al. v. Univ. of Washington, No. 2:24-cv-00296-JHC, Dkt. # 1-1. This new filing appears to be related to Irvine and Twaddell’s argument that the University of Washington cannot waive sovereign immunity in federal court. See Dkt. # 50 at 2. Because this argument does not affect this order’s analysis and because it was raised in Movants’ reply, the Court declines to address it. See Graves v. Arpaio, 623 F.3d 1043, 1048 (9th Cir. 2010). l IV CONCLUSION For these reasons, the Court abstains from this case under the discretionary home-state exception to CAFA. See 28 U.S.C. § 1332(d)(3). Thus, the Court GRANTS the motion to remand. Dkt. #36. Accordingly, the Court REMANDS the six member cases consolidated under this case number and previously removed from King County Superior Court!! and DISMISSES without prejudice this case and the four other member cases originally filed in federal court.'? Finally, the Court STRIKES as moot Plaintiffs’ Motion to Vacate Order. Dkt. # 13. Dated this 22nd day of March, 2024. Cok. 4. Char John H. Chun United States District Judge 2] "! Beach, et al. v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv-00031; Aleshire v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv-00034; Reed v. Fred Hutchinson Cancer Ctr., No. 2:24-cv- 00029; Arneson v. Fred Hutchinson Cancer Ctr., No. 2:24-cv-00033; Irvine et al. v. Fred Hutchinson Cancer Ctr. et al., No. 2:24-cv-00030; and Irvine et al v. Univ. of Washington, No. 2:24-cv-00296. © Doe v. Fred Hutchinson Cancer Ctr., et al., No. 2:23-cv-01893; Hunter v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01988; Ayers v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01916; Holz, et al. v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01998; and Ristvet, et al. v. Fred Hutchinson Cancer Ctr., No. 2:24-cv-00019.