Opinion
2:21-CV-01777-MMD-EJY
12-22-2022
LEISA WHITTUM; and NICOLE KILBURN, Plaintiffs, v. UNIVERSITY MEDICAL CENTER OF SOUTHERN NEVADA, Defendant.
KOELLER NEBEKER CARLSON & HALUCK, LLP MARK F. ROACH, ESQ. ANDREW C. GREEN, ESQ. Attorneys for Defendant, UNIVERSITY MEDICAL CENTER OF SOUTHERN NEVADA LAW OFFICES OF MILES N. CLARK, LLC MILES N. CLARK, ESQ. Attorneys for Plaintiffs KRIEGER LAW GROUP, LLC DAVID KRIEGER, ESQ. MORGAN & MORGAN, P.A. JOHN A. YANCHUNIS, ESQ. (Admitted Pro Hac Vice) RYAN D. MAXEY, ESQ. (Admitted Pro Hac Vice) Attorneys for Plaintiffs
KOELLER NEBEKER CARLSON & HALUCK, LLP
MARK F. ROACH, ESQ.
ANDREW C. GREEN, ESQ.
Attorneys for Defendant,
UNIVERSITY MEDICAL CENTER OF SOUTHERN NEVADA
LAW OFFICES OF MILES N. CLARK, LLC
MILES N. CLARK, ESQ.
Attorneys for Plaintiffs
KRIEGER LAW GROUP, LLC
DAVID KRIEGER, ESQ.
MORGAN & MORGAN, P.A.
JOHN A. YANCHUNIS, ESQ. (Admitted Pro Hac Vice)
RYAN D. MAXEY, ESQ. (Admitted Pro Hac Vice)
Attorneys for Plaintiffs
STIPULATION AND PROTECTIVE ORDER
Subject to the approval of this Court, the parties, by and through their attorneys of record, hereby stipulate to the following Protective Order:
The complaint in this matter (Plaintiffs' First Amended Complaint, ECF #15) includes class-action allegations, whereby Plaintiffs assert to be representatives for a putative class of unnamed individuals whom Plaintiffs contend are entitled to recover damages for causes of action within the operative complaint alleging that putative class members', "personal data was procured or potentially prepared by third parties as a result of the data breach due to UMC's failure to secure its internal systems of record.” (Id.)
The parties acknowledge Defendant is a hospital, and that the operative complaint identifies putative class members as patients or others whose data is required to be protected from disclosure, and for which the instance of Plaintiffs' operative complaint and the procedures of the litigation may not create authorization for disclosure. The parties also acknowledge that discoverable information that may pertain to this matter may be not previously published or generally available pursuant to legitimate interests and protection of sensitive information that may be protected personal information, proprietary, trade secrets, subject to non-disclosure agreements, important to safety and security, and intended to assist preservation of confidentiality, privacy and/or protection from disclosure pursuant to law and/or agreement. The parties therefore agree to the terms and substance of this stipulated protective order in an effort to facilitate discovery while protecting any sensitive information from improper disclosure.
Based thereon and to expedite the flow of discovery, facilitate the prompt resolution of disputes over confidentiality and protection of information of others, and to adequately protect material claimed to be confidential, private, sensitive and/or subject to protection, and ensure that protection is afforded to Defendant, UNIVERSITY MEDICAL CENTER OF SOUTHERN NEVADA (hereinafter referred to as “Defendant”) for disclosures or productions it may make or be required to make, and pursuant to the Court's authority under Federal Rule of Civil Procedure 26(c), it is hereby ORDERED that this Protective Order shall govern the disclosure, handling and disposition disclosure and productions by Defendant as follows:
1. Application . This Protective Order shall govern any disclosure or production in this case that contains confidential or private information, designated as containing “Confidential Information” as defined herein and produced in connection with this litigation by any person or entity [hereinafter referred to as the “producing party”], whether in response to a discovery request, subpoena or otherwise, to any other person or entity [hereinafter referred to as the “receiving party”], regardless of whether the person or entity producing or receiving such information is a party to this litigation.
2. Definitions .
2.1 Confidential Information. “Confidential Information” shall mean and include any and all of the following:
(a) information supplied in any form, or any portion thereof, that identifies an individual or subscriber in any manner and relates to the past, present, or future care, services, or supplies relating to the physical or mental health or condition of such individual or subscriber, the provision of health care to such individual or subscriber, or the past, present, or future payment for the provision of health care to such individual or subscriber. Confidential Health Information shall constitute a subset of Confidential Information, and shall be designated as Confidential Information and subject to all other terms and conditions governing the treatment of Confidential Information, as set forth herein. Confidential Health Information shall include, but is not limited to, claim data, claim forms, grievances, appeals, or other documents or records that contain any patient health information required to be kept confidential under any state or federal law, including 45 C.F.R. Parts 160 and 164 promulgated pursuant to HIPAA (see 45 C.F.R. §§ 164.501 & 160.103), and the following subscriber, patient, or member identifiers including but not limited to:
(1) names;
(2) all geographic subdivisions smaller than a State, including street address, city, county, precinct, and zip code;
(3) all elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, age, and date of death;
(4) telephone numbers;
(5) fax numbers;
(6) electronic mail addresses;
(7) social security numbers;
(8) medical record numbers;
(9) health plan beneficiary numbers;
(10) account numbers;
(11) certificate/license numbers;
(12) vehicle identifiers and serial numbers, including license plate numbers;
(13) device identifiers and serial numbers;
(14) web universal resource locators (“URLs”);
(15) internet protocol (“IP”) address numbers;
(16) biometric identifiers, including finger and voice prints;
(17) full face photographic images and any comparable images; and
(18) any other unique identifying number, characteristic, or code.
(b) includes but is not limited to: information that is confidential proprietary information, trade secrets, or information technology, that is related to and important for safety and security, that is intended to assist preservation of confidentiality, privacy and/or protection from disclosure pursuant to law and/or agreement, security policies, practices and procedures, that is related to personnel compensation, evaluations and other employment/engagement/contracting information, or that is confidential proprietary information of the parties to this action or others the parties have or had relationships for purposes such as business, professional services, regulatory review/oversight, reporting, licensing, certification, approval, and/or endorsement. 2.2 Documents. As used herein, the term “document” or “documents” includes all records of any kind, manuals, policies and procedures, including, without limitation, those produced in written, recorded, photographic, electronic, e-mail, video or audio format.
2.2 Protected Health Information. “Protected Health Information” shall mean individually identifiable health information created, received, maintained, or transmitted in any medium, including, without limitation, all information, data, documentation, and materials, including without limitation, demographic, medical and financial information, that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.
2.3 Electronic Health Information. “Electronic Health Information” shall mean “Protected Health Information”, as defined in Section 2.3 herein, which is transmitted by Electronic Media (as defined in the HIPAA rules) or maintained in Electronic Media.
3. Initial Designation .
3.1 Good Faith Claims. Claims of confidentiality will be made only with respect to documents or information the asserting party has a good faith belief are within the definition set forth in subparagraph 2.1 of this Protective Order. Objections to such claims made pursuant to paragraph 5, below, shall also be made only in good faith.
3.2 Produced Documents. A party producing documents or information that it believes constitute or contain Confidential Information or Protected Health Information, as defined herein shall state that the material is being produced under this Protective Order by describing the documents or materials to be treated as confidential in writing, by page or bates number wherever possible, and/or shall produce copies bearing a label that contains or includes language substantially identical to one of the following, as applicable:
CONFIDENTIAL INFORMATION
PROTECTED HEALTH INFORMATION
The applicable label shall be affixed in a manner that does not obliterate or obscure the contents of the copies. If any person or party makes copies of documents designated as containing Confidential Information or Protected Health Information, the copying person or party shall mark each such copy as containing Confidential Information or Protected Health Information in the same form as the Confidentiality notice on the original document.
A party producing documents that are stored on electronic, magnetic, optical or other non-paper media, such as compact discs, DVD's, video tapes and audio tapes (collectively, “data storage devices”) shall designate the data storage device as containing Confidential Information, or Protected Health Information by affixing a label or stamp to the data storage device in the manner described above at the time copies of such data storage devices are produced. If the receiving party or other persons or entities to whom disclosure is authorized pursuant to subparagraph 7.1 make a copy of any data storage device designated by the producing party as containing Confidential Information, Protected Health Information, the receiving party or other authorized person shall mark each such copy as containing Confidential Information, or Protected Health Information in the same form as the confidentiality notice on the original data storage device produced. If the receiving party or other authorized person prints out or otherwise makes copies of the documents or information stored on such data storage device, the receiving party or other authorized person shall mark each page so copied with the label or stamp specified in subparagraph
3.3 Documents and/or Information Already Produced. Documents and/or information already produced shall be subject to the terms of this Order.
3.4 Deposition Transcripts. Within ten (10) days after the receipt of a deposition transcript, a party may inform the other parties to the action of the portions of the transcript that it wishes to designate as or containing Confidential Information or Protected Health Information. Until such time has elapsed, deposition transcripts in their entirety are to be considered as Confidential Information or Protected Health Information. All parties in possession of a copy of a designated deposition transcript shall mark it appropriately. The court reporter shall comply with and be bound by this Order. In the event that the party furnishing deposition testimony designates portions or all of that testimony as Confidential Information or Protected Health Information, the court reporter shall separately transcribe and submit under seal, to counsel for the parties, transcriptions of the testimony so designated. Confidential transcripts of deposition testimony shall be treated the same and afforded the same protections as other documents designated as Confidential Information or Protected Health Information under this Order.
3.5 Multi-page Documents.. If a party wishes to an integrated or multi-page document as Confidential Information or Protected Health Information, it should designate such portions of the document and place the label specified in subparagraph 3.2 on each page of the document containing Confidential Information.
3.6 Disclosures/Identification/Responses. To protect the foregoing information during any disclosures, identifications and/or responses that may be required or occur, Defendant may elect to replace names and personal identification numbers of putative class members with a unique number that may be assigned for the purpose of this litigation for identification of the corresponding individual.
4. Designations by Another Party .
4.1 Notification of Designation. If a party other than the producing party believes that a producing party has produced a document that contains or constitutes Confidential Information or Protected Health Information of the non-producing party, the non-producing party may designate the document as Confidential Information or Protected Health Information by so notifying all parties in writing within fourteen (14) days of service of the document.
4.2 Return of Documents; Non-disclosure. Whenever a party other than the producing party designates a document produced by a producing party as Confidential Information or Protected Health Information in accordance with subparagraph 4.1, each party receiving the document shall either add the Confidential Information or Protected Health Information designation in accordance with subparagraph 3.2 or substitute a copy of the document bearing such designation for each copy of the document produced by the producing party. Each party shall destroy all undesignated copies of the document or return those copies to the producing party, at the direction of the producing party. No party shall disclose a produced document to any person, other than the persons authorized to receive Confidential Information or Protected Health Information, under subparagraph 7.1, until after the expiration of the fourteen (14) day designation period specified in subparagraph 4.1. If during the fourteen (14) day designation period a party discloses a produced document to a person authorized to receive Confidential Information or Protected Health Information, under subparagraph 7.1, and that document is subsequently designated as Confidential Information or Protected Health Information, in accordance with subparagraph 4.1, the disclosing party shall cause all copies of the document to be destroyed or returned to the producing party, at the direction of the producing party. The party may thereafter disclose a copy of the document that has been marked as Confidential Information or Protected Health Information by the designating party, in accordance with subparagraphs 3.2 and 7.1.
5. Objections to Designations . Any party objecting to a designation of Confidential Information or Protected Health Information, including objections to portions of designations of multi-page documents, shall notify the designating party and all other parties of the objection in writing within seven (7) days. This notice must specifically identify each document that the objecting party in good faith believes should not be designated as Confidential Information or Protected Health Information and provide a brief statement of the grounds for such belief. In accordance with the Federal Rules of Civil Procedure governing discovery disputes, the objecting and the designating parties thereafter shall confer within seven (7) days after the date of such objection in an attempt to resolve their differences. If the parties are unable to resolve their differences, the objecting party shall have seven (7) days after the conference concludes to file with the Court a motion to remove the Confidential Information or Protected Health Information . Where a party authored, created, owns, or controls a document, information or other material that another party designates as Confidential Information or Protected Health Information, the party that authored, created, owns, or controls the Confidential Information or Protected Health Information may so inform the objecting party and thereafter shall also be considered a designating party for purposes of this paragraph.
All documents initially designated as Confidential Information or Protected Health Information shall be treated as such in accordance with this Protective Order unless and until the Court rules otherwise. If the Court rules that a designation should not be maintained as to a particular document, the producing party shall, upon written request by a party, provide that party a copy of that document without the designation described in subparagraph 3.2.
If an objecting party elects not to make such a motion with respect to documents within seven (7) days after the conference, information or other materials to which an objection has been made, the objection shall be deemed withdrawn. The designating party shall have seven (7) days to respond to the objecting party's motion. If no response is filed by the designating party within seven (7) days, the designating party shall be deemed to have consented to the objecting party's motion.
6. Custody . All Confidential Information or Protected Health Information and any and all copies, extracts and summaries thereof, including memoranda relating thereto, shall be retained by the receiving party in the custody of counsel of record, or by persons to whom disclosure is authorized under subparagraph 7.1.
7. Handling Prior to Trial .
7.1 Authorized Disclosures. Confidential Information or Protected Health Information shall be disclosed by the receiving party only to the following persons:
a. Counsel for the parties in this litigation, including their associates, clerks, paralegals, and secretarial personnel;
b. Qualified persons (such as court reporters) taking testimony in this litigation involving such Confidential Information or Protected Health Information, and necessary stenographic, videotape and clerical personnel;
c. Experts and their staff who are retained by counsel as expert witnesses for a party in this litigation;
d. Experts and their staff who are consulted by counsel for a party in this litigation;
e. Parties to this litigation, limited to the named party and, if that party is a corporate entity, a limited number of employees of the corporate entity and its insurers;
f. Designated in-house counsel and a limited number of assistants, administrative or otherwise;
g. Outside vendors employed by counsel for copying, scanning and general handling of documents;
h. Any person of whom testimony is taken regarding the Confidential Information or Protected Health Information, except that such person may only be shown Confidential Information or Protected Health Information during his/her testimony, and may not retain a copy of such Confidential Information or Protected Health Information; and
i. This Court and this Court's staff, subject to the Court's processes for filing materials under seal.
Such disclosures are authorized only to the extent necessary to investigate, prosecute, or defend the litigation.
Confidential Information or Protected Health Information may not be disclosed to persons under subparagraphs (c) or (d) until the receiving party has obtained a written acknowledgment from the person receiving Confidential Information or Protected Health Information, in the form of the Declaration attached hereto as Exhibit “A”, that they received a copy of this Protective Order and agree to be bound by it. A party who discloses Confidential Information or Protected Health Information in accordance with subparagraph 7.1 shall retain the written acknowledgment from each person receiving Confidential Information or Protected Health Information, shall maintain a list of all persons to whom a receiving party has disclosed Confidential Information or Protected Health Information and identify what documents have been disclosed, and shall furnish the written acknowledgments and disclosure list to opposing counsel as follows: (i) for a person under subparagraph (c), within thirty (30) days after the person signs the Declaration; and (ii) for a person under subparagraph (d), within thirty (30) days after the matter is finally concluded. A party who discloses Confidential Information or Protected Health Information in accordance with subparagraph 7.1 shall also furnish the written acknowledgements and disclosures list to the Court for in camera review upon its request or order. Furnishing the written acknowledgments and disclosure list to the Court shall not constitute a waiver of the attorney work product or attorney-client privilege. Disclosure of Confidential Information or Protected Health Information to the Court, including staff of same, shall be made in accordance with subparagraph 7.3 of this Protective Order.
The Parties acknowledge that information disclosed or produced in discovery, regardless of its designation under this Stipulated Protective Order, may contain personal and/or health information which is subject to the protections of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the applicable requirements of the Standards for Privacy of Individually Identifiable Health Information and its implementing regulations issued by the U.S. Department of Health and Human Services (45 C.F.R. Parts 160-64; HIPAA Privacy Regulations), and NRS 603A.210, which protect the confidentiality of individually identifiable personal and health information. The Parties and all third party signatories to this Agreement agree to take all measures necessary to comply with the requirements of these laws and any other applicable laws governing the privacy of personal and health information
7.2 Unauthorized Disclosures. All persons receiving Confidential Information Protected Health Information under the terms of this Protective Order are under the jurisdiction of the state courts and U.S. federal courts located in Nevada for all matters arising from the improper disclosure or use of such information. If Confidential Information or Protected Health Information is disclosed to any person other than in the manner authorized by this Protective Order, the party or person responsible for the disclosure, and any other party or person who is subject to this Protective Order and learns of such disclosure, shall immediately bring such disclosure to the attention of the designating party. Without prejudice to other rights and remedies of the designating party, the responsible party or person shall make every effort to obtain and return the Confidential Information or Protected Health Information and to prevent further disclosure on its own part or on the part of the person who was the unauthorized recipient of such information.
7.3 Court Filings. In the event any Confidential Information or Protected Health Information must be filed with the Court prior to trial, the proposed filing shall comply with the Federal Rules of Civil Procedure and the requirements set forth in Kamakana v. City and County of Honolulu, 447 F.3d 1172 (9th Cir. 2006). In accordance with these rules and requirements, the proposed filing shall be accompanied by a motion to file the Confidential Information or Protected Health Information under seal and a proposed order, and the application and proposed order shall be directed to the judge to whom the Confidential Information or Protected Health Information is directed. This provision is applicable to briefs, memoranda, and other filings which quote the Confidential Information or Protected Health Information.
8. Care in Storage . Any person in possession of Confidential Information or Protected Health Information produced by another party shall exercise reasonable and appropriate care with regard to the storage, custody, copying, and use of such information to ensure that the confidential and sensitive nature of same is maintained.
9. Handling During Trial . Confidential Information or Protected Health Information that is subject to this Order may be marked and used as trial exhibits by either party, subject to terms and conditions as imposed by the Court upon application by any party.
10. No Implied Waivers . This Protective Order shall not be interpreted as a waiver of the right to object, under applicable law, to the furnishing of information in response to discovery requests or to object to a requested inspection of documents or facilities. Parties producing Confidential Information or Protected Health Information in this litigation are doing so only pursuant to the terms of this Protective Order. The taking of any action in accordance with the provisions of this Protective Order shall not be interpreted as a waiver of any claim or position or defense in this action, or any other actions. Review of the Confidential Information or Protected Health Information by counsel, experts, or consultants for the litigants in the Case shall not waive the confidentiality of the documents or objections to production or from otherwise objecting to discovery that it believes to be improper. The inadvertent, unintentional, or in camera disclosure of Confidential Information or Protected Health Information shall not be deemed a waiver in whole or in part, of any party's claims of confidentiality. Nothing herein shall be deemed to waive any applicable privilege or work product protection, nor shall an inadvertent disclosure of material protected by privilege or work product protection constitute a waiver of such privilege or protection. The Parties stipulate that this order is intended to and does conform with the requirements of Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), specifically but not limited to 45 CFR §164.512(e)(1)(ii)(A) and (e)(1)(v). Nothing contained in this Order and no action taken pursuant to it shall prejudice the right of any party to contest the alleged confidentiality, relevancy, authenticity, admissibility, or discoverability of the Confidential Information or Protected Health Information sought. The terms of this Order shall survive and remain in effect after the termination of this Case.
11. No Admission . The designation of any item as Confidential Information or Protected Health Information shall not be construed as an admission that such material, or any testimony concerning such material, would be admissible in evidence in this litigation or in any other proceeding. Entering into, agreeing to, and/or producing or receiving Confidential
Information or Protected Health Information or otherwise complying with the terms of this Order shall not Operate as or constitute an admission by any party that any Confidential Information or Protected Health Information contains or reflects trade secrets, proprietary or commercially sensitive information, or any other type of confidential matter, or as or constitute an admission by any party that the restrictions and process set forth herein constitute adequate protection for any particular information deemed by such Producing Party to be Confidential within the meaning of section 2.1.
12. Inadvertent Disclosure . Issues regarding inadvertent disclosures shall be resolved under the provisions of FRCP 26. Notwithstanding the procedures herein, disclosures documents or other discovery materials produced and not designated as “CONFIDENTIAL” through mistake or inadvertence may be designated as Confidential Information or Protected Health Information upon notice of such mistake or inadvertence, with the Receiving Party reserving the right to assert, depending on the circumstances, that such later designation is improper. Disclosure (including production) of information that a Party or non-party later claims should not have been shall not automatically constitute a waiver of, or estoppel as to, any claim of attorney-client privilege, attorney work-product, or other ground for withholding production as to which the Producing Party would be entitled in the Case, any other litigation, or any other federal or state proceeding. This Order, as entered by the Court and agreed to by the Parties, is intended to provide protection consistent with the full protection afforded by Federal Rule of Evidence 502(d), providing that “A Federal court may order that the privilege or protection is not waived by disclosure connected with the litigation pending before the court-in which even the disclosure also is not a waiver in any other Federal or State proceeding.” Where a Producing Party has inadvertently produced a document which the Producing Party later claims should not have been produced because of privilege, the Producing Party may at any time require the return of any such document. A request for the return of any document shall identify the document by Bates number and the basis for asserting that the specific document (or portions thereof) is subject to the attorney-client privilege, the work product doctrine, or any other applicable privilege or immunity from discovery, the basis for asserting that the production was inadvertent, and the date of discovery that there had been an inadvertent production. If a Producing Party requests the return, pursuant to this Paragraph, of any such document from another party, the party to whom the request is made shall within thirty (30) days return to the Producing Party all copies of the document within its possession, custody, or control, including all copies in the possession of experts, consultants, or others to whom the document was provided. In the event that only portions of the document contain privileged subject matter, the Producing Party shall substitute a redacted version of the document at the time of making the request for the return of the requested document. In the event the Receiving Party contests the claim of privilege or inadvertent production, the Receiving Party shall file a motion within thirty (30) days after return of the document to obtain a determination that the document is not privileged.
13. Parties' Own Documents . This Protective Order shall in no way restrict the parties in their use of their own documents or information, and nothing in this Protective Order shall preclude any party from voluntarily disclosing its own documents or information to any party or nonparty.
14. Motion to Compel Production of Confidential Information . If any third party subpoenas Confidential Information or Protected Health Information from a party to this action or moves to compel a party to this action to produce any such information, such party shall immediately notify the parties who originally produced and/or designated such information that a subpoena has been served or a motion has been made in order to allow the parties who originally produced and/or designated such information the opportunity to seek a protective order or oppose the motion or application. If, within thirty (30) days after receiving notice of a subpoena seeking Confidential Information or Protected Health Information from a receiving party, the party who originally produced and/or designated such information fails to move for a protective order, the party subject to the subpoena may produce said information. In addition, if a party is ordered to produce Confidential Information or Protected Health Information covered by this Protective Order, then notice and, if available, a copy of the order compelling disclosure shall immediately be given the parties who originally produced and/or designated such information. Nothing in this Protective Order shall be construed as requiring the party who is ordered to produce such Confidential Information or Protected Health Information to challenge or appeal any order requiring the production of such information or to subject himself/herself to any penalty for non-compliance with any legal process or seek any relief from the Court.
15. Modification . In the event any party hereto seeks a Court order to modify the terms of this Protective Order, or seeks a protective order which incorporates the terms and conditions of this Protective Order said party shall make such request by written stipulation or noticed motion to all parties that must be served and filed in accordance with local court rules.
16. Handling Upon Conclusion of Litigation . All parties, counsel, and persons to whom disclosure was made agree to return all Confidential Information to the designating party within ninety (90) days of the conclusion of litigation between the parties, including final appellate action or the expiration of time to appeal or seek further review. In addition, counsel shall certify in writing that all such Confidential Information or Protected Health Information has been returned. Counsel for each party also shall contact each person to whom that party has provided a copy of any Confidential Information or Protected Health Information and request the documents be returned. In lieu of returning Confidential Information or Protected Health Information, the person or party in possession of such information may elect to destroy it. If the person or party in possession of Confidential Information or Protected Health Information elects to destroy it rather than return it, that person or party must notify the designating party in writing of the destruction of the information within ninety (90) days of the conclusion of litigation between the parties, including final appellate action or the expiration of time to appeal or seek further review.
17. Survival of the Terms of this Protective Order . Even after the termination of this litigation, the confidentiality obligations imposed by this Protective Order shall remain in effect until a Designating Party states otherwise in writing or a court order otherwise directs.
IT IS SO ORDERED.