Opinion
Case No. 15-MD-02617-LHK Case No. 15-CV-2874-LHK
09-09-2015
IN RE ANTHEM, INC. DATA BREACH LITIGATION JILL NOBLE, et al., Plaintiffs, v. RIGHTCHOICE MANAGED CARE, INC., et al., Defendants.
ORDER DENYING MOTION TO REMAND
Plaintiffs Jill Noble, Christina Novak, Cherri Hawes, and Jim Gioia (collectively, "Plaintiffs") bring a putative class action for breach of contract against defendants RightCHOICE Managed Care, Inc., HMO Missouri, Inc., and Healthy Alliance Life Insurance Company (collectively, "Defendants") arising out of a cyberattack on the computer system of Defendants' parent company, Anthem, Inc. ("Anthem"). Before the Court is Plaintiffs' motion to remand the case to the Circuit Court of St. Louis County, 21st Judicial Circuit, in the State of Missouri. ECF No. 16.
Unless otherwise indicated, all ECF references are to the docket of Case No. 15-CV-2874-LHK in the Northern District of California.
Having considered the submissions of the parties, the relevant law, and the record in this case, the Court DENIES Plaintiffs' motion to remand the case to the Circuit Court of St. Louis County, Missouri.
I. BACKGROUND
A. Factual Background
Defendants are affiliates of Anthem, an Indiana corporation that is one of the largest health benefits companies in the United States. ECF No. 1, Notice of Removal ("Removal Notice") ¶ 6. Through its affiliated health plans, Anthem delivers health benefit products and plans to tens of millions of members across the country. Id.
On February 4, 2015, Anthem announced that cyberattackers had gained unauthorized access to its data systems on or about December 10, 2014. See ECF No. 11, Second Amended Petition ("SAP") ¶¶ 1, 10. As a result of this breach, Plaintiffs allege that the personally identifiable information and personal health information ("PHI") of current and former Anthem members were compromised. Id. ¶ 1. The allegedly compromised information includes members' names, addresses, birthdates, telephone numbers, and social security numbers, as well as possibly credit card, medical, or clinical information. Id. According to Plaintiffs, their PHI is protected by the federal Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. § 1320d et seq. Id.
Plaintiffs are all residents of Missouri who claim that their PHI was compromised as a result of the Anthem data breach. SAP ¶¶ 11-15. Three of the four named Plaintiffs—Novak, Hawes, and Gioia—allege that fraudulent tax returns have been filed with the Internal Revenue Service on their behalf, preventing them from obtaining the tax refunds to which Plaintiffs say they are entitled. Id. ¶¶ 12-14. Plaintiff Noble claims she "was harmed by having her PHI compromised and faces the imminent and certainly impending threat of future additional harm from the increased threat of identity theft and fraud due to her PHI being sold on the Internet black market and/or misused by criminals." Id. ¶ 11.
B. Procedural History
On February 18, 2015—two weeks after Anthem announced the data breach—Plaintiff Noble filed the instant putative class action for breach of contract in the Circuit Court of St. Louis County, Missouri. Removal Notice ¶ 1. On March 11, 2015, she filed a first amended petition, see ECF No. 10, which was served on Defendants on March 17, 2015, see Removal Notice ¶ 2.
On April 14, 2015, the second amended petition ("SAP") was filed, adding the three other named Plaintiffs. See SAP. In the SAP, Plaintiffs assert ten causes of action under Missouri law: (1) unjust enrichment, id. ¶¶ 63-69; (2) money had and received, id. ¶¶ 70-76; (3) breach of contract, id. ¶¶ 77-90; (4) negligence, id. ¶¶ 91-100; (5) wantonness, id. ¶¶ 101-05; (6) negligence per se, id. ¶¶ 106-12; (7) breach of covenant of good faith and fair dealing, id. ¶¶ 113-18; (8) invasion of privacy, id. ¶¶ 119-25; (9) vicarious liability, id. ¶¶ 126-32; and (10) bailment, id. ¶¶ 133-44. Plaintiffs bring these ten causes of action on behalf of themselves and a statewide class of similarly situated individuals, defined as follows:
All citizens of Missouri who are current or former customers of RightChoice Managed Care, Inc., HMO Missouri, Inc., Healthy Alliance Life Insurance Company, Inc., or any of their subsidiaries and/or affiliates, or whose PHI was submitted to any of these entities, and whose PHI was wrongfully accessed, copied, or transferred between the time period of January 1, 2014 and February 5, 2015.Id. ¶ 54. According to Plaintiffs, the putative class includes more than 1,500,000 individuals. Id. ¶ 57.
On April 15, 2015—the day after Plaintiffs filed the SAP—Defendants removed this action to the United States District Court for the Eastern District of Missouri. See Removal Notice. Defendants proffered three independent bases for subject matter jurisdiction in federal court: (1) diversity jurisdiction under the Class Action Fairness Act of 2005 ("CAFA"), 28 U.S.C. § 1332(d); (2) federal question jurisdiction under the Employee Retirement Income Security Act of 1974 ("ERISA"), 29 U.S.C. § 1001 et seq.; and (3) federal question jurisdiction under HIPAA and the Health Information Technology for Economic and Clinical Health ("HITECH") Act, 42 U.S.C. § 17921 et seq. See Removal Notice ¶¶ 11-30.
On April 16, 2015, Plaintiffs filed the instant motion to remand. ECF No. 16 ("Mot."). Defendants opposed the motion on April 27, 2015. ECF No. 27 ("Opp."). Plaintiffs replied on May 5, 2015. ECF No. 30 ("Reply").
On June 8, 2015, the Judicial Panel on Multidistrict Litigation ("JPML") issued a transfer order pursuant to 28 U.S.C. § 1407 selecting the undersigned judge as the transferee court for "coordinated or consolidated pretrial proceedings" in the multidistrict litigation ("MDL") arising out of the Anthem data breach "that allegedly occurred sometime between December 10, 2014, and February 4, 2015." Case No. 15-MD-02617-LHK, ECF No. 1 at 1-3. Accordingly, on June 17, 2015, the JPML transferred the instant putative class action from the Eastern District of Missouri to the undersigned judge in the Northern District of California. ECF No. 32.
On July 31, 2015, the Court held a preliminary case management conference. See ECF No. 37. Counsel for Plaintiffs appeared at the case management conference and communicated to the Court Plaintiffs' intent to pursue their pending motion to remand. Id. at 2. The Court set the motion for hearing on September 10, 2015, at 1:30 p.m. Id.
On August 27, 2015, the Court ordered the parties to file supplemental briefing on Plaintiffs' motion to remand no later than September 4, 2015. ECF No. 38. The Court did so because the parties' briefs, which were filed in the Eastern District of Missouri, a division of the Eighth Circuit, did not cite to or otherwise address relevant Ninth Circuit precedent, which this Court must apply. See Newton v. Thomason, 22 F.3d 1455, 1460 (9th Cir. 1994) (holding that "when reviewing federal claims, a transferee court in this circuit is bound only by our circuit's precedent"); see also In re Gen. Am. Life Ins. Co. Sales Practices Litig., 391 F.3d 907, 911 (8th Cir. 2004) ("When a transferee court receives a case from the MDL Panel, the transferee court applies the law of the circuit in which it is located to issues of federal law."); In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 996 F. Supp. 2d 942, 959 (S.D. Cal. 2014) ("In interpreting federal law, a transferee court in a multidistrict case should look to the law of its own circuit rather than the law of the transferor courts' circuits.").
Plaintiffs filed their supplemental brief on September 3, 2015. Case No. 15-MD-02617-LHK, ECF No. 235 ("Pls. Supp. Br."). Defendants filed their supplemental brief on September 4, 2015. ECF No. 39 ("Defs. Supp. Br.").
II. LEGAL STANDARD
A suit may be removed from state court to federal court only if the federal court would have had subject matter jurisdiction over the case in the first instance. 28 U.S.C. § 1441(a); see Caterpillar Inc. v. Williams, 482 U.S. 386, 392 (1987) ("Only state-court actions that originally could have been filed in federal court may be removed to federal court by the defendant."). "In civil cases, subject matter jurisdiction is generally conferred upon federal district courts either through diversity jurisdiction, 28 U.S.C. § 1332, or federal question jurisdiction, 28 U.S.C. § 1331." Peralta v. Hispanic Bus., Inc., 419 F.3d 1064, 1068 (9th Cir. 2005). If it appears at any time before final judgment that the federal court lacks subject matter jurisdiction, the federal court must remand the action to state court. 28 U.S.C. § 1447(c).
There is no presumption against removal jurisdiction in CAFA cases. See Dart Cherokee Basin Operating Co., LLC v. Owens, 135 S. Ct. 547, 554 (2014) (vacating district court's remand order in putative class action on the ground that "a defendant's notice of removal need include only a plausible allegation that the amount in controversy exceeds the jurisdictional threshold"). The defendant, however, still bears the burden of establishing removal jurisdiction. See id. A notice of removal must contain a "short and plain statement of the grounds for removal," a requirement that tracks the general pleading standard of Rule 8(a) of the Federal Rules of Civil Procedure. Id. at 553 (citing 28 U.S.C. § 1446(a)).
III. DISCUSSION
Defendants argue that there are three independent bases for subject matter jurisdiction in federal court: (1) diversity jurisdiction under CAFA; (2) federal question jurisdiction due to ERISA complete preemption; and (3) federal question jurisdiction under HIPAA and the HITECH Act. See Removal Notice ¶¶ 11-30; Opp. at 3-15; Defs. Supp. Br. at 2-9. Plaintiffs dispute each of these bases for jurisdiction. See Mot. at 3-8; Reply at 1-5; Pls. Supp. Br. at 2-7. For the reasons stated below, the Court finds that Plaintiffs' breach of contract claims are completely preempted by ERISA's civil enforcement provision and that, as a result, the Court has subject matter jurisdiction over this action. The Court therefore need not address the independent questions of whether diversity jurisdiction exists under CAFA or whether federal question exists under HIPAA and the HITECH Act.
As the U.S. Supreme Court has explained, ERISA contains "expansive pre-emption provisions . . . which are intended to ensure that employee benefit plan regulation would be 'exclusively a federal concern.'" Aetna Health Inc. v. Davila, 542 U.S. 200, 208 (2004) (quoting Alessi v. Raybestos-Manhattan, Inc., 451 U.S. 504, 523 (1981)). One form of ERISA preemption is "complete pre-emption" under ERISA section 502(a)(1)(B), id. at 207, which provides that a civil enforcement action may be brought:
(1) by a participant or beneficiary—. . . (B) to recover benefits due to him under the terms of his plan, to enforce his rights under the terms of the plan, or to clarify his rights to future benefits under the terms of the plan.29 U.S.C. § 1132(a). Pursuant to this provision, "any state-law cause of action that duplicates, supplements, or supplants the ERISA civil enforcement remedy" is preempted because it "conflicts with the clear congressional intent to make the ERISA remedy exclusive." Davila, 542 U.S. at 209.
"A party seeking removal based on federal question jurisdiction must show either that the state-law causes of action are completely preempted by § 502(a) of ERISA, or that some other basis exists for federal question jurisdiction." Marin Gen. Hosp. v. Modesto & Empire Traction Co., 581 F.3d 941, 945 (9th Cir. 2009). "Complete preemption under § 502(a) is 'really a jurisdictional rather than a preemption doctrine, [as it] confers exclusive federal jurisdiction in certain instances where Congress intended the scope of a federal law to be so broad as to entirely replace any state-law claim.'" Id. (alteration in original) (quoting Franciscan Skemp Healthcare, Inc. v. Cent. States Joint Bd. Health & Welfare Tr. Fund, 538 F.3d 594, 596 (7th Cir. 2008)). Removal based on ERISA section 502(a) is therefore "an exception to the otherwise applicable rule that a 'plaintiff is ordinarily entitled to remain in state court so long as its complaint does not, on its face, affirmatively allege a federal claim.'" Id. (quoting Pascack Valley Hosp. v. Local 464A UFCW Welfare Reimbursement Plan, 388 F.3d 393, 398 (3d Cir. 2004)).
To determine whether removal is proper on the basis of ERISA complete preemption, the Ninth Circuit, following Davila, applies a two-pronged test. See Marin Gen. Hosp., 581 F.3d at 946. Specifically, a state law cause of action is completely preempted and therefore removable to federal court "if (1) 'an individual, at some point in time, could have brought [the] claim under ERISA § 502(a)(1)(B),' and (2) 'where there is no other independent legal duty that is implicated by a defendant's actions.'" Id. (alteration in original) (quoting Davila, 542 U.S. at 210). Because Davila's two-pronged test is stated "in the conjunctive," a state law cause of action is preempted and removal is proper "only if both prongs of the test are satisfied." Id. at 947.
The Court finds that both prongs have been satisfied here. As to the first prong, Defendants have shown that two of the named Plaintiffs could have brought their breach of contract claims under section 502(a)(1)(B). There is no dispute that Plaintiffs Novak and Hawes received health benefits during the relevant time period pursuant to employer-sponsored ERISA plans administered by Defendants. See ECF No. 27-1, Declaration of Mary Derhake ¶¶ 4-7; see also Pls. Supp. Br. at 5 (declining to dispute that "at least two of the named Plaintiffs (Novak and Hawes) have ERISA plans" (internal quotation marks omitted)).
Moreover, section 502(a)(1)(B) provides a cause of action for an ERISA "participant or beneficiary" to "enforce . . . rights under the terms of [an ERISA] plan." 29 U.S.C. § 1132(a)(1)(B). As the SAP makes clear, Plaintiffs Novak and Hawes seek to enforce certain rights under the terms of their ERISA plans through their breach of contract claims. See SAP ¶¶ 78-80. According to the SAP, Plaintiffs' "agreement for services" with Defendants "included promises to secure, safeguard, protect, keep private, and not disclose Plaintiffs' and Class Members' PHI." Id. ¶¶ 78, 80. Defendants' purported "obligations" in this regard, Plaintiffs allege, were "memorialize[d]" in "documents [that] were provided in a manner and during a time where they became part of the agreement for services." Id. ¶¶ 79-80. Plaintiffs also seek "restitution" of the difference between "the price Plaintiffs and Class Members paid" and the value of the "actual services" Defendants allegedly rendered. Id. ¶ 145(f). Thus, as the breach of contract claims asserted by Plaintiffs Novak and Hawes are premised on "promises" and "obligations" allegedly "included" in and made a "part of" their ERISA plans, and because Plaintiffs Novak and Hawes seek a partial refund of their insurance premiums as a result, their suit is one "to enforce . . . rights under the terms of [their ERISA] plan[s]." 29 U.S.C. § 1123(a)(1)(B); see Nunez v. Monterey Peninsula Eng'g, 867 F. Supp. 895, 906 (N.D. Cal. 1994) ("Essentially, subsection [1132](a)(1)(B) allows an action in the form of breach of contract, the contractual instrument being the [ERISA] plan.").
As to the second prong, Defendants have shown that Plaintiffs do not allege any other independent legal duty implicated by Defendants' conduct as it relates to Plaintiffs' claims for breach of contract. As stated above, the breach of contract claims asserted by Plaintiffs Novak and Hawes are expressly predicated on "promises" and "obligations" allegedly "included" in and made a "part of" their ERISA plans, SAP ¶¶ 78-80, not on some independent legal duty that Plaintiffs neglected to plead. Indeed, the sole "agreement[s] for services" between Defendants and Plaintiffs Novak and Hawes are their employer-sponsored ERISA plans. Id. ¶ 80 (emphasis added). Plaintiffs do not argue otherwise. See Pls. Supp. Br. at 5-7; see also Dewalt v. G.E. Fin., No. 04CV1293WDMBNB, 2005 WL 6332668, at *2 (D. Colo. Aug. 4, 2005) (exercising removal jurisdiction over plaintiff's "claim for breach of a privacy contract" because the claim sought "to enforce his rights under the terms of the ERISA plan, the only contract alleged to exist between the parties").
Rather, Plaintiffs argue that they "produced a contract they entered into with Defendants - outside an ERISA plan - which Defendants breached." Pls. Supp. Br. at 5. The "contract" to which Plaintiffs refer, however, is the HIPAA Notice of Privacy Practices attached to the ERISA plans of Plaintiffs Novak and Hawes. See ECF No. 16-2. This HIPAA notice, which Defendants "are required by federal law to give," merely "explains" Plaintiffs' privacy "rights" and Defendants' "legal duties and privacy practices." Id. at 2. Importantly, Plaintiffs do not contend that the HIPAA notice is the "agreement for services" referenced in the SAP. SAP ¶ 80. To the contrary, the HIPAA notice appears to be one of the "documents" cited in the SAP "that memorialize the obligations" of Defendants to "protect, secure, keep private, and not disclose Plaintiffs' and Class Members' PHI." Id. ¶ 79. Those "documents," Plaintiffs allege, are "part of the agreement for services." Id. ¶ 80 (emphasis added). The fairest reading of Plaintiffs' SAP, then, is that the "agreement[s] for services" between Defendants and Plaintiffs Novak and Hawes are their employer-sponsored ERISA plans. The HIPAA notices accompanying the ERISA plans are therefore "part of" those "agreement[s] for services," and not the agreements themselves. See ECF No. 27-2 at 2, 119-24 (showing HIPAA notice attached to Plaintiff Hawes's ERISA plan); ECF No. 27-3 at 2, 115-19 (showing HIPAA notice attached to Plaintiff Novak's ERISA plan).
The specificity of Plaintiffs' SAP is what distinguishes the instant case from Wickens v. Blue Cross of California, Inc., No. 15CV834-GPC JMA, 2015 WL 4255129 (S.D. Cal. July 14, 2015). In Wickens, the district court rejected the defendants' argument for complete preemption under ERISA because the defendants did not raise the argument in their notice of removal as a basis for subject matter jurisdiction. See id. at *2 (finding that "Defendants' argument as to ERISA preemption is without merit" because "Defendants cannot now raise a new basis for the Court's federal jurisdiction" that was "not raised in the notice of removal").
In dicta, the Wickens court found no ERISA preemption because "Plaintiff does not allege any express provisions of the plan that were breached," and found "an independent legal duty that would exist with or without the ERISA plan." 2015 WL 4255129, at *3-4. --------
Accordingly, the Court finds that Plaintiffs' breach of contract claims are completely preempted by ERISA section 502(a)(1)(B), that the Court has subject matter jurisdiction over this action under 28 U.S.C. § 1331, and that removal was therefore proper under 28 U.S.C. § 1441(a).
IV. CONCLUSION
For the foregoing reasons, the Court hereby DENIES Plaintiffs' motion to remand the case to the Circuit Court of St. Louis County, Missouri.
IT IS SO ORDERED.
Dated: September 9, 2015
/s/_________
LUCY H. KOH
United States District Judge