Whittum v. University Medical Center of Southern Nevada

• Court: District Court, D. Nevada
• Decided: September 23, 2022
• Docket: 2:21-cv-01777
• Status: Unknown

Opinion

1 2

3 UNITED STATES DISTRICT COURT

4 DISTRICT OF NEVADA

5 * * * 6 LEISA WHITTUM, et al., Case No. 2:21-cv-01777-MMD-EJY

7 Plaintiffs, ORDER v. 8 UNIVERSITY MEDICAL CENTER 9 OF SOUTHERN NEVADA,

10 Defendant.

11 12 I. SUMMARY 13 Plaintiffs Leisa Whittum and Nichole Kilburn (“Plaintiffs”)1 sued Defendant 14 University Medical Center of Southern Nevada (“UMC”) for injuries stemming from a data 15 breach of UMC’s systems in June 2021. (ECF No. 15 at 3.) Before the Court is Plaintiffs’ 16 motion to remand (ECF No. 14 (“Motion”))2 under the local controversy exception of the 17 Class Action Fairness Act (“CAFA”), or alternatively, to stay the case pending class 18 citizenship discovery. UMC also filed a motion to dismiss the first amended complaint 19 (“FAC”). (ECF No. 30.) As further explained below, the Court finds that it does not have 20 federal question jurisdiction over this case, and limited jurisdictional discovery is 21 warranted to determine whether more than two-thirds of class members are Nevada 22 citizens. The Court will therefore grant Plaintiffs’ request for limited discovery, stay the 23 case, and deny the pending motions without prejudice. 24 /// 25

26 1Plaintiff Leisa Whittum filed the Motion. (ECF No. 14.) However, a second Plaintiff, Nicole Kilburn, was later added to the lawsuit. (ECF No. 15.) Both Whittum and Kilburn 27 replied to UMC’s response to the Motion. (ECF No. 36.) In the interest of convenience, the Court will hereafter refer to Whittum and Kilburn as “Plaintiffs” in this order. 28 1 II. BACKGROUND3 2 UMC is a local Las Vegas hospital and affiliate of the University of Nevada School 3 of Medicine that provides medical services to the community. (ECF Nos. 14 at 2, 15 at 3.) 4 On June 14, 2021, a third party breached UMC’s systems. (ECF No. 15 at 3.) Plaintiffs 5 are residents of Nevada and victims of the data breach. (Id. at 2.) They received a letter 6 from UMC on August 2, 2021, which revealed that their “personally identifiable 7 information” including “certain protected health information,” “demographic information 8 (name, address, date of birth, Social Security Number), clinical information (history, 9 diagnosis, test results)[,] or financial information (insurance number)” may have been 10 compromised during the breach. (Id. at 3-4.) Plaintiffs allege that UMC failed to promptly 11 and adequately notify them of the breach, and safeguard their personal information. (Id. 12 at 4-5.) 13 Plaintiffs, individually and on behalf of those similarly situated, brought this class 14 action against UMC in the Eighth Judicial District of Clark County, Nevada. (ECF Nos. 1 15 at 1, 15 at 5.) Plaintiffs assert the following state-law claims against UMC: (1) negligence, 16 (2) breach of implied contract, (3) negligent misrepresentation, and (4) violation of NRS 17 § 41.600. (ECF No. 15 at 14-24.) UMC removed the case under CAFA. (ECF No. 1.) The 18 Motion followed shortly thereafter. (ECF No. 14.) 19 III. LEGAL STANDARD 20 Federal courts are courts of limited jurisdiction, having subject-matter jurisdiction 21 only over matters authorized by the Constitution and Congress. See U.S. Const. art. III, 22 § 2, cl. 1; Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). A suit 23 filed in state court may be removed to federal court if the federal court would have had 24 original jurisdiction over the suit at commencement of the action. See 28 U.S.C. § 1441(a). 25 However, courts strictly construe the removal statute against removal jurisdiction, and 26 “[f]ederal jurisdiction must be rejected if there is any doubt as to the right of removal in

27 3The following allegations are adapted from the FAC unless otherwise indicated. (ECF No. 15.) 28 1 the first instance.” Gaus v. Miles, Inc., 980 F.2d 564, 566 (9th Cir. 1992) (emphasis 2 added). The party seeking removal bears the burden of establishing federal jurisdiction. 3 See Durham v. Lockheed Martin Corp., 445 F.3d 1247, 1252 (9th Cir. 2006). 4 IV. DISCUSSION 5 The Court first addresses UMC’s argument that the Court has independent federal 6 question jurisdiction. The Court finds there is no federal question jurisdiction because 7 Plaintiffs’ state-law claims do not implicate significant federal issues and are not 8 completely preempted by federal law. The Court then addresses Plaintiffs’ request for 9 remand under the CAFA local controversy exception, or alternatively, for limited 10 jurisdictional discovery. The Court will grant Plaintiffs’ request for discovery because 11 Plaintiffs have limited access to class citizenship information and because more data is 12 necessary for the Court to resolve the remand issue. 13 A. Substantial Federal Question 14 To start, UMC argues that the Court has independent federal question jurisdiction 15 because Plaintiffs seek protected health information safeguarded by the Health Insurance 16 Portability and Accountability Act (“HIPAA”),4 which creates substantial federal questions. 17 (ECF No. 31 at 16.) Plaintiffs counter, in part, that UMC’s HIPAA-related discovery 18 argument is inconsistent with congressional judgment about the division of labor between 19 federal and state courts. (ECF No. 36 at 7-10.) The Court agrees with Plaintiffs. 20 A federal district court may preside over civil actions that “aris[e] under the 21 Constitution, laws, or treaties of the United States.” 28 U.S.C. § 1331. Plaintiffs are

22 4Plaintiffs correctly note that UMC is raising a new HIPAA-related argument in its response. (ECF No. 36 at 5.) UMC only cited to the Federal Trade Commission Act 23 (“FTCA”) as an alternative basis for federal question jurisdiction in the removal petition. (ECF No. 1 at 5.) Notably, UMC’s argument for federal “arising under” jurisdiction is 24 almost solely premised on HIPAA, not FTCA. (ECF No. 31 at 16-24.) Nonetheless, the analysis is the same and the Court declines to exercise federal question jurisdiction under 25 FTCA because the statute does not confer a private right of action, and Plaintiffs’ brief mention of the statute in their FAC is insufficient, given that they articulated independent 26 and alternative state-law theories under negligence and NRS §§ 41.600, 598.0915, 598.0923, 603A.210. (ECF No. 15 at 14-20, 24-26.) See Dreisbach v. Murphy, 658 F.2d 27 720, 730 (9th Cir. 1981); Nevada v. Bank of Am. Corp., 672 F.3d 661, 674-75 (9th Cir. 2012) (citations omitted); Caron v. Fletcher Jones Motor Cars, Inc., 715 F. App'x. 803, 28 804 (9th Cir. 2018). 1 generally the masters of their claims and can “avoid federal jurisdiction if a federal 2 question does not appear on the face of the complaint.” Cnty. of San Mateo v. Chevron 3 Corp., 32 F.4th 733, 746 (9th Cir. 2022) (citations omitted). However, there are exceptions 4 to this well-pleaded complaint rule, including (1) when state-law claims implicate 5 significant federal issues and (2) when a federal statute completely preempts an area of 6 state law. See id. at 746-48 (citations omitted). As to the first exception, “federal 7 jurisdiction over a state law claim will lie if a federal issue is: (1) necessarily raised, (2) 8 actually disputed, (3) substantial, and (4) capable of resolution in federal court without 9 disrupting the federal-state balance approved by Congress.” Id. at 746 (citing Grable & 10 Sons Metal Prods., Inc. v. Darue Eng’g & Mfg., 545 U.S. 308, 314 (2005)). However, 11 “[o]nly a few cases have ever fallen into this narrow category.” Chevron, 32 F.4th at 746 12 (citation omitted). 13 Plaintiffs’ state-law claims do not implicate significant federal issues under Grable. 14 First, Plaintiffs’ claims do not necessarily turn on substantial federal questions. UMC’s 15 HIPAA-related discovery argument conflates evidence Plaintiffs need to support their 16 claims with the actual substance of Plaintiffs’ claims. (ECF No. 31 at 20 (“Ultimately, the 17 substantial Federal question presented to this Court is whether the two Plaintiffs are 18 permitted in any circumstance to circumvent the exclusive authority of the DHHS and 19 HIPAA to compel receipt of protected health information”).) In reviewing the substance of 20 Plaintiffs’ state-law claims, federal issues are not pivotal to the claims and HIPAA is not 21 a necessary element of the claims. (ECF No. 15 at 14-26.) See Lippitt v. Raymond James 22 Fin. Servs., Inc., 340 F.3d 1033, 1045 (9th Cir. 2003) (In determining whether a state-law 23 claim triggers subject matter jurisdiction, the court should assess whether the federal 24 question is “pivotal” versus merely “incidental”) (citation omitted). In the FAC, Plaintiffs 25 clearly rely on independent or alternative legal theories to argue that UMC violated 26 Nevada common and statutory law by failing to promptly notify them of the breach, failing 27 to maintain adequate security systems, and making misrepresentations about their 28 security practices. (Id.) See Rains v. Criterion Sys., Inc., 80 F.3d 339, 346 (9th Cir. 1996) 1 (“When a claim can be supported by alternative and independent theories—one of which 2 is a state law theory and one of which is a federal law theory—federal question jurisdiction 3 does not attach because federal law is not a necessary element of the claim”). 4 In fact, Plaintiffs do not reference or mention HIPAA anywhere in the FAC. (ECF 5 No. 15.) See Nevada v. Bank of Am. Corp., 672 F.3d 661, 675 (9th Cir. 2012) (finding 6 that the plaintiff’s “glancing reference to federal law is insufficient to confer federal 7 jurisdiction over [the plaintiff’s] state law claims”); see also In re Anthem, Inc., 129 F. 8 Supp. 3d 887, 897 (N.D. Cal. 2015) (finding that the plaintiffs’ “single reference to HIPAA 9 in a sixty-three-paragraph complaint does not convert [the] [p]laintiffs' state law claim for 10 breach of fiduciary duty into a federal cause of action”). At most, UMC suggests that 11 HIPAA may be important to discovery and challenges Plaintiffs’ ability to obtain private 12 health information for class members. (ECF No. 31 at 16-20.) However, this is not a 13 disputed issue since the pertinent code of federal regulations provide clear guidance on 14 disclosure of protected health information, without individual authorization, during 15 litigation. (ECF No. 36 at 9.) See 45 CFR §§ 164.500(b)(1)(V), 164.512(e); Grable, 545 16 U.S. at 314. The plain language of 45 CFR § 164.512(e) explicitly allows for disclosure of 17 protected health information through a court order or a qualified protective order. Thus, 18 the Court finds that Plaintiffs’ state-law claims do not necessarily raise a substantial 19 federal issue that is actually disputed. See Grable, 545 U.S. at 314. 20 Second, the exercise of federal question jurisdiction would disturb the 21 “congressionally approved balance of federal and state judicial responsibilities” under 22 Grable. See id. State courts often handle state-law data privacy and breach suits that 23 reference or are predicated on standards set forth in federal statutes like HIPAA. See 24 Nevada, 672 F.3d at 676 (citation omitted). Exercising federal question jurisdiction over 25 such cases would “herald[ ] a potentially enormous shift of traditionally state cases into 26 federal courts,” thereby disturbing the federal-state division of labor. Id. Moreover, HIPAA 27 itself does not provide for a private federal right of action, which suggests that Congress 28 did not intend for HIPAA-related state-law claims to be in federal court. See Webb v. 1 Smart Document Sols., LLC, 499 F.3d 1078, 1082-83 (9th Cir. 2007) (“where there is no 2 federal private right of action, federal courts [generally] may not entertain a claim that 3 depends on the presence of federal question jurisdiction”); Anthem, 129 F. Supp. 3d at 4 898 (“allowing federal question jurisdiction based on [the] [p]laintiffs' single reference to 5 HIPAA would effect an end-run around clear precedent precluding a private right of action 6 under HIPAA”) (citations and quotation marks omitted); Dickman v. MultiCare Health Sys., 7 Case No. C15-5193 BHS, 2015 WL 3477178, at *3 (W.D. Wash. June 2, 2015) (“it would 8 undermine congressional intent to allow claims for private relief into federal court through 9 a state cause of action when a federal private right of action is unavailable”) (citation 10 omitted). Accordingly, UMC also fails to meet the fourth Grable prong. 11 In sum, UMC fails to demonstrate that Plaintiffs’ state-law claims implicate 12 significant federal questions under Grable. See 545 U.S. at 314; Durham, 445 F.3d at 13 1252. Thus, this case does not belong to the “special and small category” of cases where 14 federal “arising under” jurisdiction exists. See Nevada, 672 F.3d at 674. 15 B. Complete Preemption 16 Next, UMC argues that the Court has federal question jurisdiction because HIPAA 17 completely preempts Plaintiffs’ state-law claims. (ECF No. 31 at 21-24.) Plaintiffs counter, 18 in part, that this interpretation is contrary to congressional intent. (ECF No. 36 at 9.) The 19 Court agrees with Plaintiffs. 20 Where a federal law completely preempts an area of state law, removal is proper 21 because “any claim purportedly based on that pre-empted state law is considered, from 22 its inception, a federal claim, and therefore arises under federal law.” Chevron, 32 F.4th 23 at 748 (citation omitted). “[C]omplete preemption applies when Congress (1) intended to 24 displace a state-law cause of action, and (2) provided a substitute cause of action.” Id. 25 (citation and quotation marks omitted); see also Hansen v. Grp. Health Coop., 902 F.3d 26 1051, 1057 (9th Cir. 2018) (noting that “[c]omplete preemption refers to the situation in 27 which federal law not only preempts a state-law cause of action, but also substitutes an 28 1 exclusive federal cause of action in its place”). However, complete preemption is “rare.” 2 Hansen, 902 F.3d at 1057 (citations omitted). 3 Plaintiffs’ state-law claims are not completely preempted by HIPAA. First, complete 4 preemption is extremely rare. The Supreme Court has only acknowledged three statutes 5 where complete preemption applies, and HIPAA is not one of these statutes. See 6 Chevron, 32 F.4th at 748 (citation omitted). Second, HIPAA does not preempt or 7 supersede state laws that do not conflict with or are more stringent than its requirements. 8 See 45 CFR § 160.203; Fossen v. Blue Cross & Blue Shield of Mont., Inc., 660 F.3d 1102, 9 1108 (9th Cir. 2011) (citations omitted). Indeed, even UMC acknowledges that HIPAA 10 only provides “the minimum standards for safeguards for disclosure for protected health 11 information.” (ECF No. 31 at 16.) Here, UMC fails to identify any Nevada laws, in Plaintiffs’ 12 FAC or elsewhere, which directly conflict with HIPAA requirements or fall below the 13 minimum HIPAA standards. (Id. at 21-24.) 14 Third, as explained above, HIPAA itself does not provide for a private federal right 15 of action, which strongly undermines a congressional intent to displace state laws in the 16 area of data privacy/security, and substitute HIPAA as the exclusive remedy. See Webb, 17 499 F.3d at 1082-83; Hansen, 902 F.3d at 1057. Finally, UMC argues that the novelty of 18 the HIPAA-related discovery issue “inherently” supports a finding of complete preemption. 19 (Id. at 21.) The Court disagrees because whether a state-law claim arises under federal 20 law does not depend on the novelty of the federal discovery issue. See Merrell Dow 21 Pharm. Inc. v. Thompson, 478 U.S. 804, 816-17 (1986); see also Nevada, 672 F.3d at 22 675 (“the Supreme Court has cautioned against finding federal question jurisdiction on 23 the ground that a case presents a novel issue of federal law”). Thus, the Court declines 24 to exercise federal “arising under” jurisdiction based on complete preemption. See 25 Chevron, 32 F.4th at 748 (citation omitted). 26 /// 27 /// 28 /// 1 C. CAFA Exception & Jurisdictional Discovery 2 The parties’ dispute primarily focuses on whether Plaintiffs have demonstrated5 3 that more than two-thirds of class members are Nevada citizens under the CAFA local 4 controversy exception. See 28 U.S.C. § 1332(d)(4)(A) (a district court must decline to 5 exercise jurisdiction when “greater than two-thirds of the members of all proposed plaintiff 6 classes in the aggregate are citizens of the State in which the action was originally filed”). 7 Plaintiffs argue that publicly available information about out-of-state victims, along with 8 “common sense,” show that the two-thirds threshold has been met. (ECF No. 14 at 3.) 9 UMC argues6 that the Court should deny remand and jurisdictional discovery because (1) 10 Plaintiffs failed to properly investigate class members, and (2) UMC’s addresses for 11 breach victims are irrelevant for current citizenship. (ECF No. 31 at 13-14, 25.) The Court 12 agrees that jurisdictional discovery is warranted for the following reasons. 13 As to UMC’s first argument, the Court disagrees that Plaintiffs failed to conduct 14 “any investigation” of the class members. (Id. at 13.) Plaintiffs have made reasonable 15 efforts to investigate class citizenship using publicly available information, including news 16 reports about the breach, UMC’s notifications to out-of-state breach victims, and UMC’s 17 letters to four state attorney general offices. (ECF No. 14 at 3-7.) However, Plaintiffs’ 18 efforts were constrained by the limited public record and lack of access to the addresses 19 of breach victims, which are currently in UMC’s possession and which UMC has refused 20 to provide. (Id. at 2, 16.) The Court therefore declines to deny the Motion on this basis. 21 As to UMC’s second argument, the Court disagrees that the last known addresses 22 of breach victims “do not suggest any indicia of relevance to current citizenship, and are 23

5UMC correctly notes that Plaintiffs bear the burden of showing, by a 24 preponderance of the evidence, that the citizenship requirement is met—although this burden “should not be exceptionally difficult to bear.” See Adams v. W. Marine Prods., 25 Inc., 958 F.3d 1216, 1223 (9th Cir. 2020) (citation omitted).

26 6UMC also argues that HIPAA does not permit UMC to voluntarily release the names, addresses, and identifying information of patients affected by the breach. (ECF 27 No. 31 at 13.) However, as explained above, protected health information may be obtained for the purposes of litigation through court order or a qualified protective order. 28 See 45 CFR § 164.512(e). 1 not relevant to the local controversy exception.” (ECF No. 31 at 25.) The Ninth Circuit has 2 stated that an individual’s residence/address constitutes, at a minimum, some evidence 3 of their domicile. See Adams v. W. Marine Prods., Inc., 958 F.3d 1216, 1221 (9th Cir. 4 2020) (citation omitted). The district court is also permitted to make reasonable inferences 5 from the facts in the evidence. See Brinkley v. Monterey Fin. Servs., Inc., 873 F.3d 1118, 6 1121 (9th Cir. 2017) (citation omitted). The data breach occurred in June 2021, and it 7 appears that UMC began notifying victims a little over a year ago. (ECF No. 15 at 3.) From 8 this short timeframe, it is reasonable to infer that many of the victims’ addresses are 9 relatively current and pertinent to the determination of domicile. See id. Moreover, 10 granting jurisdictional discovery before remand appears to be favored by the Ninth Circuit. 11 See Mondragon v. Capital One Auto Fin., 736 F.3d 880, 885 (9th Cir. 2013) (instructing 12 the district court to allow the plaintiff “to take jurisdictional discovery tailored to proving 13 that more than two-thirds of the putative class are citizens of California”); King v. Great 14 Am. Chicken Corp., Inc., 903 F.3d 875, 881 (9th Cir. 2018) (holding that on remand, the 15 plaintiff “should be given an opportunity to seek additional jurisdictional discovery and to 16 renew her motion to remand”). 17 Finally, the data breach in this case involves a local Las Vegas hospital that 18 services the Las Vegas community. (ECF Nos. 14 at 2, 15 at 3.) If jurisdictional discovery 19 reveals that Nevada residents were disproportionately impacted by the breach, state 20 courts have a stronger interest in adjudicating this uniquely local matter. See Benko v. 21 Quality Loan Serv. Corp., 789 F.3d 1111, 1119 (9th Cir. 2015) (citation omitted) (noting 22 that the local controversy exception “is intended to respond to concerns that class actions 23 with a truly local focus should not be moved to federal court under this legislation because 24 state courts have a strong interest in adjudicating such disputes”); Adams, 958 F.3d at 25 1220 (explaining that “Congress provided exceptions to CAFA jurisdiction . . . to allow 26 truly intrastate class actions to be heard in state court”) (citation omitted). 27 The Court therefore grants class citizenship discovery because pertinent facts 28 bearing on jurisdiction are disputed, and additional citizenship data is necessary to 1 || determine whether the CAFA local controversy exception applies. See 28 U.S.C. § 2 || 1332(d)(4)(A); Boschetto v. Hansing, 539 F.3d 1011, 1020 (9th Cir. 2008) (citations 3 || omitted). 4|| V. CONCLUSION 5 The Court notes that the parties made several arguments and cited to several 6 || cases not discussed above. The Court has reviewed these arguments and cases and 7 || determines that they do not warrant discussion as they do not affect the outcome of the 8 || issues before the Court. 9 It is therefore ordered that Plaintiffs’ request for limited jurisdictional discovery, as 10 || to class citizenship, is granted. 11 It is further ordered that Plaintiffs’ motion to remand (ECF No. 14) is denied without 12 || prejudice, with leave to file a renewed motion at the conclusion of jurisdictional discovery. 13 It is further ordered that UMC’s motion to dismiss (ECF No. 30) the first amended 14 || complaint (ECF No. 15) is denied without prejudice, with leave to file a renewed motion 15 || at the conclusion of jurisdictional discovery. 16 It is further ordered that all deadlines in this case are stayed for 60 days pending 17 || the conclusion of jurisdictional discovery. 18 It is further ordered that any renewed motions must be filed within 30 days of the 19 || conclusion of jurisdictional discovery. 20 DATED THIS 23" Day of September 2022. 21

23 CHIEF UNITED STATES DISTRICT JUDGE 24 25 26 27 28 10