Whittum v. University Medical Center of Southern Nevada

Opinion

* * * LEISA WHITTUM, et al., Case No. 2:21-cv-01777-MMD-EJY

Plaintiffs, ORDER v. UNIVERSITY MEDICAL CENTER

Defendant.

Plaintiffs Leisa Whittum and Nichole Kilburn (“Plaintiffs”)1 sued Defendant University Medical Center of Southern Nevada (“UMC”) for injuries stemming from a data breach of UMC’s systems in June 2021. (ECF No. 15 at 3.) Before the Court is Plaintiffs’ motion to remand (ECF No. 14 (“Motion”))2 under the local controversy exception of the Class Action Fairness Act (“CAFA”), or alternatively, to stay the case pending class citizenship discovery. UMC also filed a motion to dismiss the first amended complaint (“FAC”). (ECF No. 30.) As further explained below, the Court finds that it does not have federal question jurisdiction over this case, and limited jurisdictional discovery is warranted to determine whether more than two-thirds of class members are Nevada citizens. The Court will therefore grant Plaintiffs’ request for limited discovery, stay the case, and deny the pending motions without prejudice. ///

1Plaintiff Leisa Whittum filed the Motion. (ECF No. 14.) However, a second Plaintiff, Nicole Kilburn, was later added to the lawsuit. (ECF No. 15.) Both Whittum and Kilburn replied to UMC’s response to the Motion. (ECF No. 36.) In the interest of convenience, the Court will hereafter refer to Whittum and Kilburn as “Plaintiffs” in this order. II. BACKGROUND3 UMC is a local Las Vegas hospital and affiliate of the University of Nevada School of Medicine that provides medical services to the community. (ECF Nos. 14 at 2, 15 at 3.) On June 14, 2021, a third party breached UMC’s systems. (ECF No. 15 at 3.) Plaintiffs are residents of Nevada and victims of the data breach. (Id. at 2.) They received a letter from UMC on August 2, 2021, which revealed that their “personally identifiable information” including “certain protected health information,” “demographic information (name, address, date of birth, Social Security Number), clinical information (history, diagnosis, test results)[,] or financial information (insurance number)” may have been compromised during the breach. (Id. at 3-4.) Plaintiffs allege that UMC failed to promptly and adequately notify them of the breach, and safeguard their personal information. (Id. at 4-5.) Plaintiffs, individually and on behalf of those similarly situated, brought this class action against UMC in the Eighth Judicial District of Clark County, Nevada. (ECF Nos. 1 at 1, 15 at 5.) Plaintiffs assert the following state-law claims against UMC: (1) negligence, (2) breach of implied contract, (3) negligent misrepresentation, and (4) violation of NRS § 41.600. (ECF No. 15 at 14-24.) UMC removed the case under CAFA. (ECF No. 1.) The Motion followed shortly thereafter. (ECF No. 14.) Federal courts are courts of limited jurisdiction, having subject-matter jurisdiction only over matters authorized by the Constitution and Congress. See U.S. Const. art. III, § 2, cl. 1; Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994). A suit filed in state court may be removed to federal court if the federal court would have had original jurisdiction over the suit at commencement of the action. See 28 U.S.C. § 1441(a). However, courts strictly construe the removal statute against removal jurisdiction, and “[f]ederal jurisdiction must be rejected if there is any doubt as to the right of removal in

3The following allegations are adapted from the FAC unless otherwise indicated. (ECF No. 15.) the first instance.” Gaus v. Miles, Inc., 980 F.2d 564, 566 (9th Cir. 1992) (emphasis added). The party seeking removal bears the burden of establishing federal jurisdiction. See Durham v. Lockheed Martin Corp., 445 F.3d 1247, 1252 (9th Cir. 2006). The Court first addresses UMC’s argument that the Court has independent federal question jurisdiction. The Court finds there is no federal question jurisdiction because Plaintiffs’ state-law claims do not implicate significant federal issues and are not completely preempted by federal law. The Court then addresses Plaintiffs’ request for remand under the CAFA local controversy exception, or alternatively, for limited jurisdictional discovery. The Court will grant Plaintiffs’ request for discovery because Plaintiffs have limited access to class citizenship information and because more data is necessary for the Court to resolve the remand issue. A. Substantial Federal Question To start, UMC argues that the Court has independent federal question jurisdiction because Plaintiffs seek protected health information safeguarded by the Health Insurance Portability and Accountability Act (“HIPAA”),4 which creates substantial federal questions. (ECF No. 31 at 16.) Plaintiffs counter, in part, that UMC’s HIPAA-related discovery argument is inconsistent with congressional judgment about the division of labor between federal and state courts. (ECF No. 36 at 7-10.) The Court agrees with Plaintiffs. A federal district court may preside over civil actions that “aris[e] under the Constitution, laws, or treaties of the United States.” 28 U.S.C. § 1331. Plaintiffs are

4Plaintiffs correctly note that UMC is raising a new HIPAA-related argument in its response. (ECF No. 36 at 5.) UMC only cited to the Federal Trade Commission Act (“FTCA”) as an alternative basis for federal question jurisdiction in the removal petition. (ECF No. 1 at 5.) Notably, UMC’s argument for federal “arising under” jurisdiction is almost solely premised on HIPAA, not FTCA. (ECF No. 31 at 16-24.) Nonetheless, the analysis is the same and the Court declines to exercise federal question jurisdiction under FTCA because the statute does not confer a private right of action, and Plaintiffs’ brief mention of the statute in their FAC is insufficient, given that they articulated independent and alternative state-law theories under negligence and NRS §§ 41.600, 598.0915, 598.0923, 603A.210. (ECF No. 15 at 14-20, 24-26.) See Dreisbach v. Murphy, 658 F.2d 720, 730 (9th Cir. 1981); Nevada v. Bank of Am. Corp., 672 F.3d 661, 674-75 (9th Cir. 2012) (citations omitted); Caron v. Fletcher Jones Motor Cars, Inc., 715 F. App'x. 803, 804 (9th Cir. 2018). generally the masters of their claims and can “avoid federal jurisdiction if a federal question does not appear on the face of the complaint.” Cnty. of San Mateo v. Chevron Corp., 32 F.4th 733, 746 (9th Cir. 2022) (citations omitted). However, there are exceptions to this well-pleaded complaint rule, including (1) when state-law claims implicate significant federal issues and (2) when a federal statute completely preempts an area of state law. See id. at 746-48 (citations omitted). As to the first exception, “federal jurisdiction over a state law claim will lie if a federal issue is: (1) necessarily raised, (2) actually disputed, (3) substantial, and (4) capable of resolution in federal court without disrupting the federal-state balance approved by Congress.” Id. at 746 (citing Grable & Sons Metal Prods., Inc. v. Darue Eng’g & Mfg., 545 U.S. 308, 314 (2005)). However, “[o]nly a few cases have ever fallen into this narrow category.” Chevron, 32 F.4th at 746 (citation omitted). Plaintiffs’ state-law claims do not implicate significant federal issues under Grable. First, Plaintiffs’ claims do not necessarily turn on substantial federal questions. UMC’s HIPAA-related discovery argument conflates evidence Plaintiffs need to support their claims with the actual substance of Plaintiffs’ claims. (ECF No. 31 at 20 (“Ultimately, the substantial Federal question presented to this Court is whether the two Plaintiffs are permitted in any circumstance to circumvent the exclusive authority of the DHHS and HIPAA to compel receipt of protected health information”).) In reviewing the substance of Plaintiffs’ state-law claims, federal issues are not pivotal to the claims and HIPAA is not a necessary element of the claims. (ECF No. 15 at 14-26.) See Lippitt v. Raymond James Fin. Servs., Inc., 340 F.3d 1033, 1045 (9th Cir. 2003) (In determining whether a state-law claim triggers subject matter jurisdiction, the court should assess whether the federal question is “pivotal” versus merely “incidental”) (citation omitted). In the FAC, Plaintiffs clearly rely on independent or alternative legal theories to argue that UMC violated Nevada common and statutory law by failing to promptly notify them of the breach, failing to maintain adequate security systems, and making misrepresentations about their security practices. (Id.) See Rains v. Criterion Sys., Inc., 80 F.3d 339, 346 (9th Cir. 1996) (“When a claim can be supported by alternative and independent theories—one of which is a state law theory and one of which is a federal law theory—federal question jurisdiction does not attach because federal law is not a necessary element of the claim”). In fact, Plaintiffs do not reference or mention HIPAA anywhere in the FAC. (ECF No. 15.) See Nevada v. Bank of Am. Corp., 672 F.3d 661, 675 (9th Cir. 2012) (finding that the plaintiff’s “glancing reference to federal law is insufficient to confer federal jurisdiction over [the plaintiff’s] state law claims”); see also In re Anthem, Inc., 129 F. Supp. 3d 887, 897 (N.D. Cal. 2015) (finding that the plaintiffs’ “single reference to HIPAA in a sixty-three-paragraph complaint does not convert [the] [p]laintiffs' state law claim for breach of fiduciary duty into a federal cause of action”). At most, UMC suggests that HIPAA may be important to discovery and challenges Plaintiffs’ ability to obtain private health information for class members. (ECF No. 31 at 16-20.) However, this is not a disputed issue since the pertinent code of federal regulations provide clear guidance on disclosure of protected health information, without individual authorization, during litigation. (ECF No. 36 at 9.) See 45 CFR §§ 164.500(b)(1)(V), 164.512(e); Grable, 545 U.S. at 314. The plain language of 45 CFR § 164.512(e) explicitly allows for disclosure of protected health information through a court order or a qualified protective order. Thus, the Court finds that Plaintiffs’ state-law claims do not necessarily raise a substantial federal issue that is actually disputed. See Grable, 545 U.S. at 314. Second, the exercise of federal question jurisdiction would disturb the “congressionally approved balance of federal and state judicial responsibilities” under Grable. See id. State courts often handle state-law data privacy and breach suits that reference or are predicated on standards set forth in federal statutes like HIPAA. See Nevada, 672 F.3d at 676 (citation omitted). Exercising federal question jurisdiction over such cases would “herald[ ] a potentially enormous shift of traditionally state cases into federal courts,” thereby disturbing the federal-state division of labor. Id. Moreover, HIPAA itself does not provide for a private federal right of action, which suggests that Congress did not intend for HIPAA-related state-law claims to be in federal court. See Webb v. Smart Document Sols., LLC, 499 F.3d 1078, 1082-83 (9th Cir. 2007) (“where there is no federal private right of action, federal courts [generally] may not entertain a claim that depends on the presence of federal question jurisdiction”); Anthem, 129 F. Supp. 3d at 898 (“allowing federal question jurisdiction based on [the] [p]laintiffs' single reference to HIPAA would effect an end-run around clear precedent precluding a private right of action under HIPAA”) (citations and quotation marks omitted); Dickman v. MultiCare Health Sys., Case No. C15-5193 BHS, 2015 WL 3477178, at *3 (W.D. Wash. June 2, 2015) (“it would undermine congressional intent to allow claims for private relief into federal court through a state cause of action when a federal private right of action is unavailable”) (citation omitted). Accordingly, UMC also fails to meet the fourth Grable prong. In sum, UMC fails to demonstrate that Plaintiffs’ state-law claims implicate significant federal questions under Grable. See 545 U.S. at 314; Durham, 445 F.3d at 1252. Thus, this case does not belong to the “special and small category” of cases where federal “arising under” jurisdiction exists. See Nevada, 672 F.3d at 674. B. Complete Preemption Next, UMC argues that the Court has federal question jurisdiction because HIPAA completely preempts Plaintiffs’ state-law claims. (ECF No. 31 at 21-24.) Plaintiffs counter, in part, that this interpretation is contrary to congressional intent. (ECF No. 36 at 9.) The Court agrees with Plaintiffs. Where a federal law completely preempts an area of state law, removal is proper because “any claim purportedly based on that pre-empted state law is considered, from its inception, a federal claim, and therefore arises under federal law.” Chevron, 32 F.4th at 748 (citation omitted). “[C]omplete preemption applies when Congress (1) intended to displace a state-law cause of action, and (2) provided a substitute cause of action.” Id. (citation and quotation marks omitted); see also Hansen v. Grp. Health Coop., 902 F.3d 1051, 1057 (9th Cir. 2018) (noting that “[c]omplete preemption refers to the situation in which federal law not only preempts a state-law cause of action, but also substitutes an exclusive federal cause of action in its place”). However, complete preemption is “rare.” Hansen, 902 F.3d at 1057 (citations omitted). Plaintiffs’ state-law claims are not completely preempted by HIPAA. First, complete preemption is extremely rare. The Supreme Court has only acknowledged three statutes where complete preemption applies, and HIPAA is not one of these statutes. See Chevron, 32 F.4th at 748 (citation omitted). Second, HIPAA does not preempt or supersede state laws that do not conflict with or are more stringent than its requirements. See 45 CFR § 160.203; Fossen v. Blue Cross & Blue Shield of Mont., Inc., 660 F.3d 1102, 1108 (9th Cir. 2011) (citations omitted). Indeed, even UMC acknowledges that HIPAA only provides “the minimum standards for safeguards for disclosure for protected health information.” (ECF No. 31 at 16.) Here, UMC fails to identify any Nevada laws, in Plaintiffs’ FAC or elsewhere, which directly conflict with HIPAA requirements or fall below the minimum HIPAA standards. (Id. at 21-24.) Third, as explained above, HIPAA itself does not provide for a private federal right of action, which strongly undermines a congressional intent to displace state laws in the area of data privacy/security, and substitute HIPAA as the exclusive remedy. See Webb, 499 F.3d at 1082-83; Hansen, 902 F.3d at 1057. Finally, UMC argues that the novelty of the HIPAA-related discovery issue “inherently” supports a finding of complete preemption. (Id. at 21.) The Court disagrees because whether a state-law claim arises under federal law does not depend on the novelty of the federal discovery issue. See Merrell Dow Pharm. Inc. v. Thompson, 478 U.S. 804, 816-17 (1986); see also Nevada, 672 F.3d at 675 (“the Supreme Court has cautioned against finding federal question jurisdiction on the ground that a case presents a novel issue of federal law”). Thus, the Court declines to exercise federal “arising under” jurisdiction based on complete preemption. See Chevron, 32 F.4th at 748 (citation omitted). /// /// /// C. CAFA Exception & Jurisdictional Discovery The parties’ dispute primarily focuses on whether Plaintiffs have demonstrated5 that more than two-thirds of class members are Nevada citizens under the CAFA local controversy exception. See 28 U.S.C. § 1332(d)(4)(A) (a district court must decline to exercise jurisdiction when “greater than two-thirds of the members of all proposed plaintiff classes in the aggregate are citizens of the State in which the action was originally filed”). Plaintiffs argue that publicly available information about out-of-state victims, along with “common sense,” show that the two-thirds threshold has been met. (ECF No. 14 at 3.) UMC argues6 that the Court should deny remand and jurisdictional discovery because (1) Plaintiffs failed to properly investigate class members, and (2) UMC’s addresses for breach victims are irrelevant for current citizenship. (ECF No. 31 at 13-14, 25.) The Court agrees that jurisdictional discovery is warranted for the following reasons. As to UMC’s first argument, the Court disagrees that Plaintiffs failed to conduct “any investigation” of the class members. (Id. at 13.) Plaintiffs have made reasonable efforts to investigate class citizenship using publicly available information, including news reports about the breach, UMC’s notifications to out-of-state breach victims, and UMC’s letters to four state attorney general offices. (ECF No. 14 at 3-7.) However, Plaintiffs’ efforts were constrained by the limited public record and lack of access to the addresses of breach victims, which are currently in UMC’s possession and which UMC has refused to provide. (Id. at 2, 16.) The Court therefore declines to deny the Motion on this basis. As to UMC’s second argument, the Court disagrees that the last known addresses of breach victims “do not suggest any indicia of relevance to current citizenship, and are

5UMC correctly notes that Plaintiffs bear the burden of showing, by a preponderance of the evidence, that the citizenship requirement is met—although this burden “should not be exceptionally difficult to bear.” See Adams v. W. Marine Prods., Inc., 958 F.3d 1216, 1223 (9th Cir. 2020) (citation omitted).

6UMC also argues that HIPAA does not permit UMC to voluntarily release the names, addresses, and identifying information of patients affected by the breach. (ECF No. 31 at 13.) However, as explained above, protected health information may be obtained for the purposes of litigation through court order or a qualified protective order. See 45 CFR § 164.512(e). not relevant to the local controversy exception.” (ECF No. 31 at 25.) The Ninth Circuit has stated that an individual’s residence/address constitutes, at a minimum, some evidence of their domicile. See Adams v. W. Marine Prods., Inc., 958 F.3d 1216, 1221 (9th Cir. 2020) (citation omitted). The district court is also permitted to make reasonable inferences from the facts in the evidence. See Brinkley v. Monterey Fin. Servs., Inc., 873 F.3d 1118, 1121 (9th Cir. 2017) (citation omitted). The data breach occurred in June 2021, and it appears that UMC began notifying victims a little over a year ago. (ECF No. 15 at 3.) From this short timeframe, it is reasonable to infer that many of the victims’ addresses are relatively current and pertinent to the determination of domicile. See id. Moreover, granting jurisdictional discovery before remand appears to be favored by the Ninth Circuit. See Mondragon v. Capital One Auto Fin., 736 F.3d 880, 885 (9th Cir. 2013) (instructing the district court to allow the plaintiff “to take jurisdictional discovery tailored to proving that more than two-thirds of the putative class are citizens of California”); King v. Great Am. Chicken Corp., Inc., 903 F.3d 875, 881 (9th Cir. 2018) (holding that on remand, the plaintiff “should be given an opportunity to seek additional jurisdictional discovery and to renew her motion to remand”). Finally, the data breach in this case involves a local Las Vegas hospital that services the Las Vegas community. (ECF Nos. 14 at 2, 15 at 3.) If jurisdictional discovery reveals that Nevada residents were disproportionately impacted by the breach, state courts have a stronger interest in adjudicating this uniquely local matter. See Benko v. Quality Loan Serv. Corp., 789 F.3d 1111, 1119 (9th Cir. 2015) (citation omitted) (noting that the local controversy exception “is intended to respond to concerns that class actions with a truly local focus should not be moved to federal court under this legislation because state courts have a strong interest in adjudicating such disputes”); Adams, 958 F.3d at 1220 (explaining that “Congress provided exceptions to CAFA jurisdiction . . . to allow truly intrastate class actions to be heard in state court”) (citation omitted). The Court therefore grants class citizenship discovery because pertinent facts bearing on jurisdiction are disputed, and additional citizenship data is necessary to 1 determine whether the CAFA local controversy exception applies. See 28 U.S.C. § 1332(d)(4)(A); Boschetto v. Hansing, 539 F.3d 1011, 1020 (9th Cir. 2008) (citations omitted). V. CONCLUSION The Court notes that the parties made several arguments and cited to several cases not discussed above. The Court has reviewed these arguments and cases and determines that they do not warrant discussion as they do not affect the outcome of the issues before the Court. It is therefore ordered that Plaintiffs’ request for limited jurisdictional discovery, as to class citizenship, is granted. It is further ordered that Plaintiffs’ motion to remand (ECF No. 14) is denied without prejudice, with leave to file a renewed motion at the conclusion of jurisdictional discovery. It is further ordered that UMC’s motion to dismiss (ECF No. 30) the first amended complaint (ECF No. 15) is denied without prejudice, with leave to file a renewed motion at the conclusion of jurisdictional discovery. It is further ordered that all deadlines in this case are stayed for 60 days pending the conclusion of jurisdictional discovery. It is further ordered that any renewed motions must be filed within 30 days of the conclusion of jurisdictional discovery. DATED THIS 23" Day of September 2022.

CHIEF UNITED STATES DISTRICT JUDGE 10