Ryan Morales v. Conifer Revenue Cycle Solutions, LLC

Opinion

RYAN MORALES, individually and Case No. 2:23-cv-01987-AB-AGR on behalf of all others similarly situated,

Plaintiff, ORDER DENYING PLAINTIFF’S MOTION FOR REMAND v. CONIFER REVENUE CYCLE SOLUTIONS, LLC, a Texas corporation; and DOES 1 through 100, inclusive, Defendant. Before the Court is Plaintiff Ryan Morales’s Motion for Remand (“Motion,” Dkt. No. 15). Defendant Conifer Revenue Cycle Solutions, LLC (“Defendant”) filed an opposition, and Plaintiff filed a reply. (Dkt. Nos. 20 and 21.) For the following reasons, the Court DENIES Plaintiff’s Motion. Plaintiff filed his putative class action Complaint in Los Angeles County Superior Court on March 16, 2023. See Complaint (Notice of Removal (“NOR,” Dkt. No. 1) Ex. A). The Complaint alleges as follows. Defendant Conifer Revenue Cycle Solutions, LLC (“Defendant”), “a self- proclaimed global streaming media platform with approximately 20 million users,” had been entrusted with Plaintiff and Class Members’ personally identifiable information (“PII”). Compl. ¶ 7 and ¶ 19. On January 20, 2022, a cyber-attack against Defendant allowed a malicious third party to access Defendant’s computer systems and data, resulting in the compromise of highly sensitive personal information in Defendant’s possession. Id. at ¶ 5. Sensitive personal information of Plaintiff and Class Members was unlawfully accessed and stolen due to the cyber-attack. Id. at ¶ 7. Information compromised in the cyber-attack includes the following: full name, date of birth, address, and medical/treatment information, including medical record number, provider name, diagnosis or symptom information, and prescription/medication, health insurance information (such as payor name and subscriber/Medicare/Medicaid number), and billing and claims information. Id. Based on these allegations, the Complaint alleges five causes of action against Defendant: negligence, negligence per se, breach of implied contract, breach of confidence, and unfair business practices in violation of Cal. Bus. & Prof. Code § 17200, et seq. Plaintiff brings these claims on behalf of himself and a putative class. Id. at ¶ 81. The Complaint defines the putative class as, “All individuals whose PII was compromised in the January 20, 2022 data breach announced by Conifer on or around September 30, 2022, who reside in the state of California.” Id. On March 16, 2023, Defendant removed the case to this court, invoking jurisdiction under the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332. Plaintiff responded with a motion to remand, arguing that the district court lacks jurisdiction under CAFA because Defendant failed to meet the jurisdictional requirements. II. LEGAL STANDARD A defendant may remove a civil action filed in state court to federal court when the federal district court has original jurisdiction over the action. 28. U.S.C. § 1441(a). “A suit may be removed to federal court under 28 U.S.C. § 1441(a) only if it could have been brought there originally.” Sullivan v. First Affiliated Sec., Inc., 813 F.2d 1368, 1371 (9th Cir. 1987). “The burden of establishing federal subject matter jurisdiction falls on the party invoking removal.” Marin Gen. Hosp. v. Modesto & Empire Traction Co., 581 F.3d 941, 944 (9th Cir. 2009). Pursuant to the Class Action Fairness Act (“CAFA”), federal district courts have original jurisdiction over particular class actions. 28 U.S.C. § 1332. In order to properly remove a case under CAFA, the burden is on the defendant to establish that (1) the parties are minimally diverse, (2) the proposed class has more than 100 members, and (3) the total amount in controversy exceeds $5 million. 28 U.S.C. § 1332(d). The Supreme Court has explained that CAFA’s “provisions should be read broadly, with a strong preference that interstate class actions should be heard in federal court if properly removed by any defendant.” Dart Cherokee Basin Operating Co., LLC v. Owens, 135 S. Ct. 547, 554 (2014). III. DISCUSSION Plaintiff argues that this action should be remanded to Los Angeles County Superior Court because Defendant failed to satisfy CAFA’s jurisdictional requirements. A. CAFA Requirements CAFA gives federal courts jurisdiction over certain class actions if (1) the parties are minimally diverse, (2) the aggregate number of members of all proposed plaintiff classes is 100 or more persons, and (3) the amount in controversy exceeds $5 million, exclusive of interests and costs. 28 U.S.C. § 1332(d)(2). Although the substance of Plaintiff’s Motion addresses only the amount in controversy requirement, the Motion also suggests, albeit without substantial argument, that Defendant did not satisfy the other requirements either. See Mot. 1:4-21. Out of an abundance of caution, the Court addresses all CAFA requirements. 1. Minimal Diversity Under CAFA, complete diversity is not required; “minimal diversity” suffices. Serrano v. 180 Connect, Inc., 478 F.3d 1018, 1021 (9th Cir. 2007). “Minimal diversity” is met when “any member of a class of plaintiffs is a citizen of a State different from any defendant.” 28 U.S.C. § 1332(d)(2). Plaintiff is a citizen of California. Compl. ¶ 4. Conifer Revenue Cycle Solutions, LLC, the only named defendant, is a limited liability company. An LLC is a citizen of every state which its owners/members are citizens. Johnson v. Columbia Properties Anchorage, LP, 437 F.3d 894, 899 (9th Cir. 2006). Defendant filed the Declarations of Joel Dustin Kellner, its Director, Compliance and Privacy, Ethics, and Compliance, to establish its citizenship. See Kellner Decl. (Dkt. No. 4), and Suppl. Kellner Decl. (Dkt. No. 20). None of Conifer’s members are a citizen of California. Conifer Revenue Cycle Solutions, LLC’s sole member is Conifer Health Solutions, LLC. Kellner Decl. ¶ 3. Conifer Health Solutions, LLC is a Delaware limited liability company with its principal place of business in Frisco, Texas. Id. Conifer Health Solutions, LLC has two members: CommonSpirit Health and Conifer Holdings, Inc. Id. at ¶ 4. CommonSpirit Health is a Colorado non-profit corporation with its principal place of business in Denver, Colorado. Id. Conifer Holdings, Inc. is a Delaware corporation with its principal place of business in Frisco, Texas. Id. Because Plaintiff is a citizen of a State different from Defendant, CAFA’s minimal diversity of citizenship requirement is satisfied. 2. Numerosity CAFA applies to class action lawsuits where the aggregate number of members of all proposed plaintiff classes is 100 or more persons and where the primary defendants are not “States, State officials, or other governmental entities against whom the district court may be foreclosed from ordering relief.” 28 U.S.C § 1332. Defendants have established that Plaintiff’s proposed class exceeds 100 members. Plaintiff seeks to represent a class of “all similarly situated individuals whose Private Information was accessed and/or removed from the network during the Cyber-Attack.” Compl. ¶ 16. The Complaint specifically states that “Defendant has identified more than 100 persons whose PII may have been improperly accessed in the Data Breach, and the Class is identifiable within Defendant’s records.” Id. at ¶ 84. Conifer determined that over 120,000 California residents who may have been affected by the data breach were sent a notice of the incident. Kellner Decl. ¶ 5; Suppl. Kellner Decl. ¶ 2. Thus, the allegations of the Complaint and Kellner’s Declaration satisfy CAFA’s numerosity requirement. 3. Amount in Controversy A defendant removing a putative class action need only demonstrate that the “matter in controversy exceeds the sum or value of $5,000,000.” 28 U.S.C. § 1332(d)(2). “The amount in controversy is simply an estimate of the total amount in dispute, not a prospective assessment of defendant’s liability.” Lewis v. Verizon Commc’ns, Inc., 627 F.3d 395, 400 (9th Cir. 2010). A defendant who has removed an action may “simply allege or assert in the notice removal that the jurisdictional threshold has been met.” Dart Cherokee Basin Operating Co., LLC, 135 S. Ct. at 554. Where the amount of controversy is challenged, “both sides may submit proof and the court decides, by a preponderance of the evidence,” whether the requirement has been satisfied. Id. “Defendants do not need to prove to a legal certainty that the amount in controversy requirement has been met.” Id. To determine whether it has jurisdiction, the court must add up the value of the claims of all persons (named or unnamed) who fall within the definition of the “proposed class” and determine whether the resulting sum exceeds $5 million. 28 U.S.C. § 1332(d)(6), (d)(1)(D). The amount in controversy includes damages “(compensatory, punitive, or otherwise), and the costs of complying with an injunction, as well as attorneys’ fees awarded under fee-shifting statutes or contract.” Gonzales v. CarMax Auto Superstores, LLC, 840 F.3d 644, 648-649 (9th Cir. 2016). Plaintiff seeks “injunctive relief including improvements to Defendant’s data security systems, future annual audits, and adequate credit monitoring services funded by Defendant” and “an award of compensatory, statutory, and nominal damages in an amount to be determined.” Compl. at ¶ 17; see also Compl. Prayer for Relief. Defendant determined “that personal information of at least 120,000 California residents may have been accessed by the unauthorized party.” Suppl. Kellner Decl. ¶ 2 (“Notice of the data incident was sent to over 120,000 California residents.”) Based on the class size of 120,000, Defendant has calculated the amount put in controversy by the “ongoing credit monitoring and identity theft repair services” Compl. ¶ (b)(xvii), that Plaintiff seeks. Defendant has presented evidence of the costs of credit monitoring through the declaration of its counsel Rachel E. K. Lowe (“Lowe Decl.,” Dkt. No. 20-2). The cost of credit monitoring by TransUnion is $29.95 per month. Lowe Decl. ¶ 2. The cost of credit monitoring and identity theft protection by Equifax is $4.95 for the first 30 days, then $19.95 per month. Id. Ex. A p 3. The parties disagree over the cost of Experian’s credit monitoring services—Defendant says it is $24.99, while Plaintiff says it is free. Dkt. No. 20 at 7:21; Dkt. No. 21 at 8:18-21. However, for purposes of this Motion, the Court can disregard the dispute over Experian’s cost because the cost of “ongoing” credit monitoring and identity theft protection by Equifax and TransUnion alone will exceed the $5 million dollar minimum required for CAFA. No party has defined the duration of “ongoing” credit monitoring, so for purposes of this Motion, the Court considers it to be a bare minimum of two months. For the first two months of credit monitoring, TransUnion charges $59.90 and Equifax charges $24.90, for a total of $84.80. For 120,000 class members, this adds up to $10,176,000.00 for just the first two months of service. Plaintiff seeks various other kinds of relief, and Defendant has presented some evidence that making changes to Defendant’s data systems and complying with an injunction would cost in excess of $2 million. Kellner Decl. ¶ 6. Plaintiff argues that Defendant has not sufficiently explained these costs. But, because the cost of credit monitoring alone would exceed $5 million, the Court need not consider the other types of relief Plaintiff seeks. Defendant has met its burden of proving by a preponderance of the evidence that the amount in controversy exceeds $5,000,000.00 for federal court jurisdiction. B. Plaintiff’s Requests for Jurisdictional Discovery and to Amend the Complaint are DENIED. In the alternative, Plaintiff asks the Court to permit jurisdictional discovery. In the Ninth Circuit, “discovery should ordinarily be granted where pertinent facts bearing on the question of jurisdiction are controverted or where a more satisfactory showing of the facts is necessary.” Nuance Commc’ns, Inc. v. Abby Software House, 626 F.3d 1222, 1235 (Fed, Cir. 2010) (citing Laub v. U.S. Dep’t of the Interior, 342 F.3d 1080, 1093 (9th Cir. 2003)). But, if the jurisdictional discovery request amounts only to a “fishing expedition” it need not be granted. Johnson v Mitchell, No. CIV S- 10-1968 GEB GGH PS, 2012 WL 1657643, *7 (E.D. Cal. May 10, 2012). In his Motion, Plaintiff does not explain what facts he would seek discovery on, so the request necessarily fails. In his reply, Plaintiff indicates he would seek discovery on the “exact number of the putative class members,” Reply 12:6-9, but Defendant has already presented evidence showing that there are at least 120,000 likely class members, and Plaintiff has not meaningfully controverted this assertion. Plaintiff’s request for jurisdictional discovery is therefore denied. l Plaintiff also asks to amend the complaint to “clarify certain jurisdictional facts.” Mot. 7:10-13. But Plaintiff has not specified which jurisdictional facts he would clarify. The request is denied. For the foregoing reasons, the Court DENIES Plaintiff's Motion for Remand. IT IS SO ORDERED. lu 8 Dated: August 15, 2023 HONORABLE ANDRE BIROTTE JR. UNITED STATES DISTRICT COURT JUDGE 8.