Holz v. Fred Hutchinson Cancer Center

[5] UNITED STATES DISTRICT COURT 6 WESTERN DISTRICT OF WASHINGTON AT SEATTLE [7] IN RE: FRED HUTCHINSON DATA CASE NO. 2:23-cv-01893-JHC [8] SECURITY LITIGATION ORDER GRANTING MOTION TO [9] REMAND (DKT. # 36) [14] I 15 INTRODUCTION This matter comes before the Court on Plaintiffs Alexander Irvine and Barbara [16] Twaddell’s Motion to Remand. Dkt. # 36. This consolidated putative class action1 stems from [17] an alleged data breach of a network containing confidential information of patients treated by [19] 20 1 To date, the Court has consolidated 10 cases in this putative class action. Five cases were first filed in the Superior Court of Washington and removed to this Court: Beach, et al. v. Fred Hutchinson 21 Cancer Ctr., et al., No. 2:24-cv-00031; Aleshire v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv00034; Reed v. Fred Hutchinson Cancer Ctr., No. 2:24-cv-00029; Arneson v. Fred Hutchinson Cancer 22 Ctr., No. 2:24-cv-00033; Irvine et al. v. Fred Hutchinson Cancer Ctr. et al., No. 2:24-cv-00030; and Irvine et al v. Univ. of Washington, No. 2:24-cv-00296. The remaining five were filed in federal court: Doe v. Fred Hutchinson Cancer Ctr., et al., No. 2:23-cv-01893; Hunter v. Fred Hutchinson Cancer Ctr., [23] No. 2:23-cv-01988; Ayers v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01916; Holz, et al. v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01998; and Ristvet, et al. v. Fred Hutchinson Cancer Ctr., No. 24 2:24-cv-00019. [1] Defendants Fred Hutchinson Cancer Center (“Fred Hutch”) and the University of Washington.2 2 Dkt. # 1 at 8. Movants Irvine and Twaddell contend that the Court lacks subject matter 3 jurisdiction, seeking to remand the all member cases removed from King County Superior Court 4 and dismiss without prejudice the remaining member cases filed in federal court. Dkt. # 36 at 2 5 n.1. Defendants and Plaintiffs Doe, Ayers, Hunter, Holz, Guay, Moncreif, Ristet, Martin, Kuhn, 6 Beach, Paciocco, Browne, Peramas, Smith, Clayton, Aleshire, Rappaport, Reed, and Arneson 7 (“Doe Plaintiffs”) oppose the motion. Dkt. ## 46, 47, 48. Because the discretionary home-state 8 exception to the Class Action Fairness Act (CAFA) applies, the Court GRANTS the motion. 9 II BACKGROUND [10] On November 19, 2023, Fred Hutch detected unauthorized activity on parts of its clinical [11] computer network. Dkt. # 1 at 8. An investigation determined that an unauthorized third party [12] had accessed the clinical network and obtained patient information from Fred Hutch systems. Id. [13] (citing Notice to Our Patients, Fred Hutch Cancer Center, https://www.fredhutch.org/en/about/ [14] about-the-hutch/ accountability-impact/notice-to-our-patients-of-data-security-incident.html (last [15] visited Mar. 18, 2024)). Not only did this data breach affect Fred Hutch patient information, but [16] it also allegedly involved patient information within the broader medical system of the [17] University of Washington. Id. Plaintiffs allege that, as a result of the breach, current and former [18] patients have received “a flood of extortionary threats by cybercriminals.” Id. at 2. [20] 21 2 Three complaints consolidated under this case number also include additional defendants: the University of Washington School of Medicine, University of Washington Medical Center, Harborview 22 Medical Center, Valley Medical Center, University of Washington Physicians, University of Washington Neighborhood Clinics, Airlift Northwest, and Childrens University Medical Group. See Doe v. Fred Hutchinson Cancer Ctr., et al., No. 2:23-cv-01893; Aleshire v. Fred Hutchinson, et al., No. 2:24-cv23 00034-JHC; Beach, et al. v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv-00031. Because these defendant entities do not participate in the briefing on the motion to remand, this order refers only to 24 Defendants Fred Hutch and the University of Washington. 1 Plaintiffs bring these causes of action: (1) negligence; (2) negligence per se from duties 2 arising under the Federal Trade Commission Act (FTCA), see 15 U.S.C. § 45 (a)(1); (3) 3 negligence per se from duties arising under Health Insurance Portability and Accountability Act 4 (HIPAA), see 45 C.F.R. Part 160 and 164, Subparts A and E, and the HIPAA Security Rule; 45 5 C.F.R. Part 160 and Part 164, Subparts A and C; (4) breach of implied contract; (5) breach of 6 fiduciary duty; (6) invasion of privacy; (7) unjust enrichment; (8) violation of the Washington 7 Consumer Protection Act, see RCW 19.86.01 et seq.; (9) violation of the Washington Data 8 Breach Disclosure Law, see RCW 19.255.005 et seq.; and (10) violation of the Washington [9] Uniform Health Care Information Act, see RCW 80.02.005 et seq.. See Dkt. # 1 at 22–38.3 10 The first federal case related to this data breach was filed on December 10, 2023. See 11 Dkt. # 1. On January 5, 2024, the Court issued an order to consolidate related cases and an order 12 to appoint interim class counsel. Dkt. ## 9, 10. On January 8, 2023, Fred Hutch removed its 13 first case from state court, asserting federal jurisdiction under CAFA. See Aleshire v. Fred 14 Hutchinson, et al., No. 2:24-cv-00034-JHC, Dkt. # 1. On January 12, 2024, after their removed 15 case was consolidated, Irvine and Twaddell moved to vacate the order appointing interim [16] counsel and then filed the motion to remand on January 24, 2024. See Dkt. # 13.4 [18] 3 Because Plaintiffs have not yet filed a consolidated complaint, the Court has compiled all causes 19 of action pleaded in the 10 cases. See supra n.1. 4 Fred Hutch and Doe Plaintiffs contend that, per the Court’s order granting interim class counsel, 20 see Dkt. # 10, the Court should not consider the motion to remand because Irvine and Twaddell lack authority to speak for the putative class. See Dkt. # 46 at 3; Dkt. # 48 at 2. This argument is not 21 persuasive; no matter if the motion to remand is procedurally proper, the Court has an independent obligation to address whether it has subject matter jurisdiction. See Allstate Ins. Co. v. Hughes, 358 F.3d 22 1089, 1093 (9th Cir. 2004); Shamrock Dev. Co. v. City of Concord, 656 F.2d 1380 , 1384 (9th Cir. 1981) (citing Mansfield, Coldwater & Lake Michigan Ry. v. Swan, 111 U.S. 379 (1884)). In addition, recognizing that the CAFA home-state exception is not jurisdictional, but a form of federal abstention, the [23] Court may similarly raise abstention issues sua sponte. See Adams v. W. Marine Prod., Inc., 958 F.3d 1216 , 1223–24 (9th Cir. 2020) (collecting cases). The Court therefore considers the merits of the motion 24 to remand. 1 III DISCUSSION [2] CAFA applies to class action lawsuits when the aggregate number of members of all [3] proposed plaintiff classes is 100 or more and where the primary defendants are not “States, State [4] officials, or other governmental entities against whom the district court may be foreclosed from [5] ordering relief[.]” 28 U.S.C. § 1332 (d)(5); see 28 U.S.C. § 1332 (d)(1)(B) (defining “class action” [6] as “any civil action filed under rule 23 of the Federal Rules of Civil Procedure or similar State [7] statute or rule of judicial procedure authorizing an action to be brought by 1 or more [8] representative persons as a class action”); Serrano v. 180 Connect, Inc., 478 F.3d 1018 , 1020–21 [9] (9th Cir. 2007). [10] Once the prerequisites of 28 U.S.C. § 1332 (d)(5) are satisfied, CAFA vests federal courts [11] with “original” diversity jurisdiction over class actions if: (1) the aggregate amount in [12] controversy exceeds $5,000,000, and (2) any class member is a citizen of a state different from [13] any defendant. 28 U.S.C. § 1332 (d)(2). Therefore, under CAFA, complete diversity is not [14] required but “minimal diversity” suffices. Bush v. Cheaptickets, Inc., 425 F.3d 683, 684 (9th [15] Cir. 2005). [16] There are two statutory exceptions to CAFA jurisdiction that “allow truly intrastate class [17] actions to be heard in state court”: the local-controversy exception and the home-state exception. [18] Adams v. W. Marine Prod., Inc., 958 F.3d 1216, 1220 (9th Cir. 2020) (emphasis in original) [19] (citing Bridewell-Sledge v. Blue Cross of Cal., 798 F.3d 923, 928 (9th Cir. 2015)). At issue in [20] this case is the home-state exception, which consists of two parts: the mandatory home-state [21] exception and the discretionary home-state exception. Under the mandatory exception, “the [22] district court ‘shall’ decline to exercise jurisdiction where ‘two-thirds or more of the members of [23] all proposed plaintiff classes in the aggregate, and the primary defendants, are citizens of the [24] 1 State in which the action was originally filed.’” Id. (citing 28 U.S.C. § 1332 (d)(4)(B)). Under 2 the discretionary home-state exception, a district court “may, in the interests of justice and 3 looking at the totality of the circumstances, decline to exercise jurisdiction” when more than one- 4 third of the putative class, and the primary defendants, are citizens of the state where the action 5 was originally filed. Id. (citing 28 U.S.C. § 1332 (d)(3)). 6 Parties seeking remand under a CAFA exception—here, Irvine and Twaddell—“must 7 provide some facts in evidence from which the district court may make findings regarding class 8 members’ citizenship.” Brinkley v. Monterey Fin. Servs., Inc., 873 F.3d 1118, 1121 (9th Cir. 9 2017) (quotation marks omitted). “The district court makes these factual findings under a 10 preponderance of the evidence standard.” Id. (citing Mondragon v. Cap. One Auto Fin., 736 11 F.3d 880, 884 (9th Cir. 2013)). Although such a finding must be based on more than mere 12 “guesswork,” courts “may make reasonable inferences from facts in evidence.” Id. (citing 13 Mondragon, 736 F.3d at 884, 886). 14 According to Irvine and Twaddell, the Court should decline to exercise jurisdiction under [15] the discretionary home-state exception to CAFA jurisdiction.5 Dkt. 36 at 2. Fred Hutch and Doe 16 Plaintiffs oppose, while the University of Washington takes no position on this issue. See 17 generally Dkt. ## 46, 47, 48. [22] 5 Irvine and Twaddell make two additional arguments why the Court lacks jurisdiction. First, they claim that the University of Washington is a government entity and a primary defendant, precluding CAFA jurisdiction. See 28 § 1332(d)(5). Because the Court remands on other grounds, it declines to [23] address this argument. Second, Movants contend that CAFA’s mandatory home-state exception applies, which requires the Court decline to abstain. Dkt. # 36 at 2. The Court similarly declines to explore this 24 as a basis for remand. 1 A. Citizenship of the Putative Class 2 Irvine and Twaddell contend that because more than one-third of the putative class has a 3 last-known address in the state of Washington, the citizenship threshold of the discretionary [4] home-state exception is satisfied. Dkt. # 36 at 12–13.6 According to preliminary information 5 shared by Fred Hutch with Movants, Fred Hutch mailed notice letters to the last-known 6 addresses of its current and former patients, mailing notices to 896,793 recipients, 809,707 7 (about 90%) of those were sent to Washington addresses. Id. at 9; Dkt. # 37 at 4–5. Irvine and 8 Twaddell assert that these notice letters are a prima-facie showing of class member citizenship, 9 Dkt. # 36 at 9–10 (citing Mondragon, 736 F.3d 880 ; Hollinger v. Home State Mut. Ins. Co., 654 10 F.3d 564 , 571 (5th Cir. 2011)), and conclude that the one-third threshold of the discretionary 11 exception has been met. Id. at 12 (“The requirement of the discretionary exception are met if 12 approximately 298,931 of the 809,707 Washington addresses belong to Washington citizens. It 13 would require more than 510,776 of the Washington addresses to belong to non-Washington 14 citizens for the discretionary exception’s one-third threshold to not be met.”). 15 Fred Hutch and Doe Plaintiffs counter that, by relying on last-known mailing addresses, 16 Irvine and Twaddell have engaged in impermissible “guesswork” regarding the citizenship of 17 class members. Dkt. # 46 at 11 (citing Johnson v. Yuma Reg’l Med. Ctr., 2:22-cv-01061-SMB, [18] 2023 U.S. Dist. LEXIS 181993 , at *10 (D. Ariz. 2023)). Fred Hutch says that after further 19 investigation, their data security firm “identified 1,323,532 unique records” that were 20 compromised in the breach, and that each record corresponds to a “unique individual.” Dkt. # 46 21 at 12; Dkt. 46-2 at 4. They state that, “[o]f that total, Fred Hutch has valid Washington addresses 22 for 879,004—approximately 66.41% of the total population.” Dkt. # 46 at 12 (citing Dkt. # 46-2 [23] 6 The parties agree that Fred Hutch and the University of Washington are citizens of Washington. 24 See Dkt. # 1 at 4; Dkt. # 36 at 3. 1 at 3) (“After assessing these records for valid addresses and submitting these addresses to the 2 National Change of Address database to update them, valid Washington addresses were available 3 for 879,003 records. This equates to approximately 66.41% of the total population of unique 4 records.”). 5 Fred Hutch and Doe Plaintiffs also contend that, even with this updated data, the notice 6 letters cannot show the recipient’s citizenship because “domicile requires residency plus intent.” 7 Dkt. # 46 at 10; see Dkt. # 48 at 17. According to Fred Hutch, merely counting valid 8 Washington addresses is insufficient and Irvine and Twaddell should ideally perform an 9 “individual inquiry . . . to assess each Washington resident’s intent to remain in Washington.” 10 Dkt. # 46 at 14. Fred Hutch concludes that for these reasons, and because it is a renowned 11 cancer treatment center that attracts and serves patients without regard to citizenship, Movants 12 have failed to show that between one-third and two-thirds of the putative class action are 13 Washington citizens. Id. 14 1. Whether last known addresses are evidence of citizenship 15 The first issue to resolve is whether the Court may consider last-known addresses as 16 prima facie evidence for a person’s citizenship. Under CAFA, “A person’s state of citizenship is 17 established by domicile, not simply residence.” King v. Great Am. Chicken Corp, Inc., 903 F.3d 18 875, 879 (9th Cir. 2018). 19 One’s domicile is her “permanent home”—that is, where (i) she resides, (ii) “with the intention to remain or to which she intends to return.” Id. At minimum, a 20 person’s residence constitutes some evidence of domicile. Mondragon, 736 F.3d at 886 . “[A] party with the burden of proving citizenship may rely on the 21 presumption of continuing domicile, which provides that, once established, a person's state of domicile continues unless rebutted with sufficient evidence of 22 change.” Id. at 885 . Adams, 958 F.3d at 1221 . [24] 1 Fred Hutch, relying on Johnson v. Yuma Regional Medical Center, contends that last2 known addresses “do not establish citizenship even for the discretionary home-state exception.” 3 Dkt. # 46 at 15. In Johnson, plaintiffs filed a putative class action against a medical center in 4 state court and the action was later removed to the District Court of Arizona under CAFA 5 jurisdiction; plaintiffs alleged injuries caused by the medical center’s failure to protect sensitive 6 patient information. 2023 U.S. Dist. LEXIS 181993 , *5. Plaintiffs moved to remand under the 7 discretionary home-state exception and relied on the putative class member’s last-known 8 addresses as a presumption of citizenship. In its analysis, the Johnson court cautioned that the 9 Ninth Circuit had not adopted a presumption that residence is prima facie evidence of domicile. [10] Id. at *7 (citing Mondragon, 736 F.3d at 886 ) (“It does not appear that this circuit has yet 11 adopted this presumption. Because the issue is not squarely presented by this appeal, we decline 12 to reach that issue here.”)). The district court then concluded that last-known addresses could 13 not establish domicile, despite plaintiffs’ demonstration that 77% of the notice letters sent to 14 former patients were directed to Arizona addresses. Id. at *9 (“Plaintiffs still only provide the 15 total number of notification letters sent (720,217), and the total number of notification letters sent 16 to Arizona addresses (560,513).”). The Johnson court reasoned that this was because “Yuma is a 17 ‘snowbird city’—meaning many putative class members are likely to only spend a portion of the 18 year at their Arizona residence but are domiciled elsewhere.” Id. at *10. Under those facts, the 19 Johnson plaintiffs failed “to provide sufficient evidence for the Court to determine that greater 20 than one third of the putative class members are currently domiciled, or even residing in, 21 Arizona.” Id. 22 Given the different facts in Johnson, the Court is not convinced that the case should 23 instruct the analysis here. First, Fred Hutch does not argue that there is a statistically significant 24 portion of the greater Seattle area that is transient—like the “snowbirds” in Johnson—so as to 1 cast doubt on the validity of the last-known addresses in Washington. Second, although the 2 Ninth Circuit has not adopted a presumption of domicile based on proof of residence, it has 3 stated that “[a]t minimum, a person’s residence constitutes some evidence of domicile” and once 4 established the court may apply a “presumption of continuing domicile . . . unless rebutted with 5 sufficient evidence of change.” Adams, 958 F.3d at 1221–22 (concluding that it was “[f]ar more 6 likely than not” that class citizenship exceeded the one-third threshold because over 90% of the 7 class had last-known addresses in California). Because the last-known addresses of those 8 affected by the Fred Hutch data breach is some evidence of domicile, the Court accepts that last9 known addresses may provide rebuttable evidence of citizenship. 10 2. Whether the updated data from Fred Hutch establishes citizenship 11 The next issue to resolve is whether the last-known addresses in this case may establish, 12 by a preponderance of the evidence, that the class is made up of more than one-third Washington 13 residents. Rebutting Irvine and Twaddell’s position that 90% of last-known addresses are from 14 Washington, Fred Hutch asserts that the preliminary figures on which Movants rely are flawed 15 because they are outdated; Fred Hutch states that it has since refined the scope of its 16 investigation and has valid last-known addresses for 879,004 individuals in Washington, which 17 is actually “approximately 66.41% of the total population.” Dkt. # 46 at 12 (citing Dkt. # 46-2 at 18 3). Fred Hutch adds that despite this refined data, the last-address approach is still unreliable and 19 incomplete. Dkt. # 46 at 12. For example, Fred Hutch highlights that since sending its notice 20 letters to valid Washington addresses: 21 • 58,235 letters have been returned as undeliverable; 22 • 29,701 records belong to deceased persons; 23 • 3,161 addresses belong to military bases and those individuals have likely moved; 24 • 48,005 addresses are post office boxes; 1 • 592 addresses are hospitals; and 2 • Nearly 17,000 are non-residential addresses. 3 Dkt. # 46 at 12–14; Dkt. # 46-2 at 3–4.7 4 The above “unreliable” addresses total 156,694 or around 17.82% of the total valid 5 Washington addresses. For the sake of a cautious analysis, even if the Court were to assume that 6 all of the patients associated with these addresses are U.S. citizens who no longer reside in 7 Washington, eliminating them from the total number of Washington residences (879,004) would 8 reduce the number of valid Washington addresses to 722,310 or 54.57% of the total 1,323,532 9 unique records affected by the breach. 10 The Court further notes that: 11 CAFA does not demand a plaintiff show the citizenship of each class member with certainty beyond a reasonable doubt. And, as the Fifth Circuit observed, requiring 12 a district court to “examin[e] the domicile of every proposed class member before ruling on the citizenship requirement” would render class actions “totally 13 unworkable.” [Preston v. Tenet Healthsystem Mem’l Med. Ctr., Inc., 485 F.3d 793, 816 (5th Cir. 2007)] (internal citations omitted). Rather, CAFA requires only that 14 a plaintiff show, by a mere preponderance of the evidence, that the citizenship requirement is met. This burden should not be “exceptionally difficult to 15 bear,” Mondragon, 736 F.3d at 886 , and should be considered with the goal of CAFA in mind: to keep interstate actions in federal court and truly intrastate actions 16 in the state courts. King, 903 F.3d at 878 . [17] Adams, 958 F.3d at 1223 .8 18 Acknowledging that Irvine and Twaddell’s burden should not be “exceptionally difficult 19 to bear,” and given the there is a buffer of at least 21.24% between this cautious 54.57% of [20] 7 Fred Hutchinson also provides a declaration from an attorney who says that they performed “a 21 search of a small sample from the population of last-known Washington mailing addresses” and identified 10 addressees that are residents of another state. Dkt. # 46-4 at 3. The attorney did not provide any 22 details on how many addressees made up this “small sample” and, without more statistical information, this declaration does not help the Court. 8 Fred Hutch also suggests that Plaintiffs should show each class member’s intent to remain in [23] Washington and provide additional evidence such as tax payments in Washington, place of employment, or driver’s licenses, Dkt. # 46 at 15 (citing Lew v. Moss, 797 F.2d 747, 750 (9th Cir. 1986)), this position 24 misconstrues the applicable “mere preponderance” standard. 1 Washington addresses and the one-third (33.33%) threshold, the Court concludes it is more 2 likely than not that more than one-third of the putative class are Washington citizens. Id. at 1223 3 (“Nevertheless, given the substantial cushion afforded by the percentage of class members with 4 last known California addresses, as compared to the percentage of class member citizens 5 required for a discretionary remand, Adams readily met her burden.”). 6 B. Six Discretionary Factors 7 Once the Court has resolved the CAFA citizenship requirement, it must then determine 8 whether the matter is “indeed local in nature” and appropriate for remand. S. REP NO. 109-14, at 9 28 (2005). CAFA provides six factors for a district court to consider when deciding whether to 10 decline jurisdiction under the discretionary home-state exception: 11 (A) whether the claims asserted involve matters of national or interstate interest; 12 (B) whether the claims asserted will be governed by laws of the State in which the action was originally filed or by the laws of other States; [13] (C) whether the class action has been pleaded in a manner that seeks to avoid 14 Federal jurisdiction; 15 (D) whether the action was brought in a forum with a distinct nexus with the class members, the alleged harm, or the defendants; [16] (E) whether the number of citizens of the State in which the action was originally 17 filed in all proposed plaintiff classes in the aggregate is substantially larger than the number of citizens from any other State, and the citizenship of the other members 18 of the proposed class is dispersed among a substantial number of States; and 19 (F) whether, during the 3-year period preceding the filing of that class action, 1 or more other class actions asserting the same or similar claims on behalf of the same 20 or other persons have been filed. 28 U.S.C. § 1332 (d)(3). [21] 1. Factor one: National or interstate interest [22] Irvine and Twaddell contend that because Defendants are Washington citizens and serve [23] primarily Washington citizens who all sought treatment or healthcare in Washington, the data [24] 1 breach is not of national or interstate interest. Dkt. # 36 at 13. Fred Hutch responds that not all 2 persons involved in the data breach sought health care in Washington, some patients received 3 treatment at other institutions and merely had laboratory testing done by Fred Hutch. Dkt. # 46 4 at 16. According to Fred Hutch, because there are putative class members located all over the 5 country and issues such as data security incidents are “of national significance[,]” this factor 6 weighs in their favor. Id. 7 In reply, Irvine and Twaddell cite Flath v. Barnes Jewish Hospital, a data breach case in 8 which defendants similarly argued that a putative class action involved matters of national or 9 interstate interest because, although 66.14% of the putative class were citizens of Missouri, the 10 defendant hospital received “pathology specimens from all over the country[.]” No. 11 4:12CV00721 ERW, 2012 WL 4809179 , *2, *4 (E.D. Mo. Oct. 10, 2012). The Eastern District 12 of Missouri was not persuaded and held that “solely having services or products in other states 13 does not necessarily create a national or interstate interest.” Id. at *4 . 14 Like the defendants in Flath, Fred Hutch claims that an unknown number of out-of-state 15 patients may have had laboratory testing done by Fred Hutch, without necessarily entering 16 Washington to receive treatment. As in Flath, the Court is similarly unconvinced that an 17 unknown number of patients from outside Washington that availed themselves to Fred Hutch 18 laboratory services could make this matter of national or interstate interest. Further, although 19 Fred Hutch contends that data breach class actions are becoming more prevalent across the 20 country, see Dkt. # 46 at 16 n.1, the Court struggles to see how that fact would make this data 21 breach—a breach centered in Washington that primarily involved Washington patients—of 22 national or interstate interest. Considering the likelihood that most affected class members reside 23 in Washington, factor one favors remand. [24] 1 2. Factor two: Claims governed by Washington law or other state law 2 Irvine and Twaddell contend that all causes of action in this case are based on 3 Washington law. Dkt. # 36 at 13. Fred Hutch responds that not all claims arise under 4 Washington law, as Irvine and Twaddell “expressly rely” on HIPAA and the FTCA “in seeking 5 to establish Fred Hutch’s alleged duties” under negligence per se claims, and thus this factor 6 supports federal jurisdiction. Dkt. # 46 at 16 (citing Irvine et al. v, Fred Hutchinson et al., No. [7] 2:24-cv-00030, Dkt. # 1-2 at 21).9 In reply, Irvine and Twaddell assert that a claim’s “reference 8 to federal law is not determinative, especially where the law of decision is state law.” Dkt. # 51 9 at 11 (citing Hirschbach v. NVE Bank, 496 F. Supp. 2d 451, 461 (D.N.J. 2007); Scott v. Cerner 10 Corp., No. 4:15-CV-00326-SRB, 2015 WL 5227431 (W.D. Mo. Sept. 8, 2015)). 11 Here, Plaintiffs bring 10 causes of action: three are based on Washington statutes and 12 seven are based on the common law of torts. Two of the tort claims sound in negligence per se, 13 referencing violations of duties that arise under federal law: HIPAA and the FTCA. Because the 14 plain language of this factor asks whether the claims rely on “laws of other States[,]” 28 U.S.C. 15 § 1332(d)(3)(B), and none of the causes of actions in this case involve another state’s law, this 16 factor favors remand. See Scott, 2015 WL 5227431 , *5 (“Plaintiff asserts a Missouri claim 17 pursuant to a Missouri statute that references the federal Fair Labor Standards Act. Taken 18 literally, 1332(d)(3) requires this Court to determine if other state’s laws will be involved, which 19 they will not.”). [22] 9 Fred Hutch also claims that “while Washington law will likely apply to many class members, this may not be true for individuals with no connection to Washington, such as those persons whose [23] information was provided to Fred Hutch for laboratory testing.” Dkt. # 46 at 16. Because this statement does not address whether the claims are governed by Washington law or other state law, the Court will 24 not consider it. 1 3. Factor three: Pleaded in a manner to avoid federal jurisdiction 2 Irvine and Twaddell contend that their case was initially brought in state court and was 3 not pleaded in a way to avoid federal jurisdiction as they seek to represent a national class and 4 have not limited their class to Washington citizens. Dkt. # 36 at 13. Fred Hutch responds that 5 the motion to remand is “gamesmanship” that threatens to “orphan” a case in state court, despite 6 federal consolidation and a leadership order in place. Dkt. # 46 at 16–17. 7 The Court disagrees. There is no indication that remand of this matter would “orphan” 8 any case in state court, considering that this case and all member cases would either be remanded 9 to state court for adjudication or dismissed without prejudice so the parties may re-file in state 10 court. See Dkt. # 36 at 2 n.1. Furthermore, the Irvine and Twaddell complaint does not appear 11 to be pleaded in a way to avoid federal jurisdiction: there is no apparent limitation to the 12 damages pleaded to avoid CAFA jurisdiction and the Irvine and Twaddell wish to represent a 13 national class. See Hirschbach, 496 F. Supp. 2d at 461 (“Additionally, the Amended Complaint 14 shows no indication that it was pleaded in a manner seeking to avoid federal jurisdiction. 15 Plaintiff could have expressly limited the class to citizens of New Jersey but did not.”). This 16 factor therefore weighs toward remand. 17 4. Factor four: Brought in a forum with a distinct nexus with the class members, the alleged harm, or defendants [18] According to Irvine and Twaddell, “Defendants are based in King County, and therefore [19] that forum has a ‘distinct nexus’ to the potential class members, who sought treatment or [20] healthcare in King County.” Dkt. # 36 at 13. Fred Hutch responds that the fourth factor requires [21] Irvine and Twaddell to establish the class’s citizenship and, because they have not done so, “the [22] Court should accord these factors little weight.” Dkt. # 46 at 17. [24] 1 It is undisputed that Defendants are citizens of Washington and the harm, a data breach, 2 targeted Fred Hutch, a citizen of Washington. Although Fred Hutch seeks to cast doubt on the 3 citizenship of the class members, as discussed above, its updated data show that it is more likely 4 than not that most class members are Washington citizens. Considering the class, the alleged 5 harm, and defendants have a nexus with Washington, this factor favors remand. 6 5. Factor five: The number of Washington citizens in the proposed class is substantially larger than the number of citizens from any other state and the 7 citizenship of the other members is dispersed among a substantial number of states [8] Irvine and Twaddell contend that this factor favors remand because Fred Hutch mailed [9] notices to all 50 states, the District of Columbia, and abroad. Dkt. # 36 at 13. Relying on the [10] preliminary data provided by Fred Hutch, Irvine and Twaddell maintain that the “87,086 [11] potential class members with non-Washington addresses are widely dispersed across a number of [12] states.” Id. Fred Hutch responds that because the last-known address data are still unclear, this [13] factor should have “little weigh in [the Court’s] analysis.” Dkt. # 46 at 17. [14] According to the updated data supplied by Fred Hutch’s data security firm, and as [15] discussed previously, somewhere between 33.58% and 45.43% of the unique records [16] compromised in the breach are linked to non-Washington addresses. Dkt. # 46-2 at 3–5, see [17] supra Part A.2. Although the preliminary data relied on by Irvine and Twaddell shows an [18] estimate of how many patients reside in states other than Washington, Fred Hutch does not [19] include these details in its updated data. Although there are class members scattered across the [20] United States, U.S. territories, and abroad, Fred Hutch does not contend that any one state has a [21] significantly greater interest in this case over any other. Dkt. # 37 at 4–5. See Hirschbach, 496 [22] F. Supp. 2d at 461 (“While there is no proof before the Court regarding the domicile of the non23 New Jersey members of the class, there is no indication that any other single state has as great an [24] 1 interest in litigating the controversy as New Jersey does.”). Because the preliminary data shows 2 that class members are distributed throughout all 50 states and the updated data does not speak to 3 this issue, this factor favors remand. 4 6. Factor six: In the past three years, one or more other class actions asserting similar claims have been filed on behalf of the same or other persons [5] Irvine and Twaddell concede that “[s]everal other class actions over the same data breach [6] were filed in response . . . in Washington state court and Washington federal court.” Dkt. # 36 at [7] 14. Fred Hutch agrees, acknowledging that five cases were filed in state court and five others [8] were filed in federal district court, all of which have been consolidated under this case number. [9] Dkt. # 46 at 17.10 Because multiple putative class actions have been filed alleging the same or [10] similar claims related to the data breach, this factor favors denying remand. That said, the Court [11] notes that, to date, all pending cases alleging similar claims have been removed and [12] consolidated. Therefore, while this factor does not support remand, there is nothing to suggest [13] that there are any significant obstacles to remanding this consolidated action to state court. Cf. [14] Hirschbach, 496 F. Supp. 2d at 462 (“In other words, with regard to this last factor, nothing [15] suggests that there is a need for coordination of various overlapping or parallel actions.”). [16] Five of the six discretionary factors support remand, and remand would not create [17] inefficiency or deprive the federal judiciary consideration of a truly national or interstate matter. [21] 10 Since filing the motion to remand, Irvine and Twaddell filed another case against the 22 University of Washington, which was removed to federal court and consolidated with this case. See Irvine et al. v. Univ. of Washington, No. 2:24-cv-00296-JHC, Dkt. # 1-1. This new filing appears to be related to Irvine and Twaddell’s argument that the University of Washington cannot waive sovereign [23] immunity in federal court. See Dkt. # 50 at 2. Because this argument does not affect this order’s analysis and because it was raised in Movants’ reply, the Court declines to address it. See Graves v. Arpaio, 623 24 F.3d 1043, 1048 (9th Cir. 2010). l IV CONCLUSION [2] For these reasons, the Court abstains from this case under the discretionary home-state [3] exception to CAFA. See 28 U.S.C. § 1332 (d)(3). Thus, the Court GRANTS the motion to [4] remand. Dkt. #36. Accordingly, the Court REMANDS the six member cases consolidated [5] under this case number and previously removed from King County Superior Court!! and [6] DISMISSES without prejudice this case and the four other member cases originally filed in [7] federal court.'? Finally, the Court STRIKES as moot Plaintiffs’ Motion to Vacate Order. Dkt. # [8] 13. [9] Dated this 22nd day of March, 2024. 10 Cok. 4. Char 11 John H. Chun United States District Judge [20] 2] "! Beach, et al. v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv-00031; Aleshire v. Fred Hutchinson Cancer Ctr., et al., No. 2:24-cv-00034; Reed v. Fred Hutchinson Cancer Ctr., No. 2:24-cv2 00029; Arneson v. Fred Hutchinson Cancer Ctr., No. 2:24-cv-00033; Irvine et al. v. Fred Hutchinson Cancer Ctr. et al., No. 2:24-cv-00030; and Irvine et al v. Univ. of Washington, No. 2:24-cv-00296. 3 © Doe v. Fred Hutchinson Cancer Ctr., et al., No. 2:23-cv-01893; Hunter v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01988; Ayers v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01916; Holz, et al. v. Fred Hutchinson Cancer Ctr., No. 2:23-cv-01998; and Ristvet, et al. v. Fred Hutchinson Cancer Ctr., 24 || No. 2:24-cv-00019.