Sabatino v. HMO Missouri, Inc.

ORDER GRANTING MOTION TO REMAND LUCY H. KOH, District Judge Plaintiffs Monica Sabatino and Michael Sabatino (collectively, “Plaintiffs”) bring a putative class action against defendants HMO Missouri, Inc. and Healthy Alliance Life Insurance Company (collectively, “Defendants”) arising out of a cyberattack on the computer system of Defendants’ parent company, Anthem, Inc. (“Anthem”), Before the Court is Plaintiffs’ motion to remand the case to the Circuit Court of St. Louis City, 22d Judicial Circuit, in the State of Missouri. ECF No. 15.1 Having considered the submissions of the parties, the relevant law, and the record in this case, the Court GRANTS Plaintiffs’ motion to remand the case to the Circuit Court of St. Louis City, Missouri. I. BACKGROUND A. Factual Background Defendants are affiliates of Anthem, an Indiana corporation that is one of the largest health benefits companies in the United States. ECF No. 1, Notice of Removal (“Removal Notice”) ¶ 5. Through its affiliated health plans, Anthem delivers health benefit products and plans to tens of millions of members across the country. Id. On February 4, 2015, Anthem announced that cyberattackers had gained unauthorized access to its data systems on or about December 10, 2014. ECF No. 1-1, Class Action Petition (“Pet.”) ¶¶8-9. As a result of this breach, Plaintiffs allege that the personally identifiable information of up to 80 million current and former Anthem members was compromised. Id. ¶¶ 10-12. The allegedly compromised information includes members’ names, birthdays, medical identification numbers, social security numbers, street addresses, email addresses, and employment information, including income data. Id. ¶ 10. Plaintiffs are “adult residents of Saint Louis County, Missouri” who have been Anthem members since April 2014. Pet. ¶¶ 1, 21. Plaintiffs claim that their personal information was compromised as a result of the Anthem data breach. Id. ¶¶ 21-24. “By virtue of their membership in Anthem,” Plaintiffs allege, “the company obtained their sensitive medical records, personal information, including their birthdays, social security numbers, address, and employment information.” Id. ¶ 21. As a result of the data breach, Plaintiffs claim they “are at a heightened risk for future identity theft.” Id. ¶ 23. Plaintiffs claim further that they “have been harmed in that they (1) paid more for insurance record privacy protections than they otherwise would have, and (2) paid for insurance record privacy protections that they did not receive.” Id. ¶ 24. [891] B. Procedural History On February 16, 2015 — twelve days after Anthem announced the data breach— Plaintiffs filed the instant putative class action in the Circuit Court of St. Louis City, Missouri. Removal Notice ¶ 1. A copy of the class action petition was served on Defendants on March 6, 2015. Id. ¶ 2. In the petition, Plaintiffs, asserted four, causes of action under Missouri law: (1) violation of the Missouri Merchandising Practices Act (“MMPA”), Mo. Rev. Stat. § 407.010 et seq., Pet. ¶¶ 35-45; (2) breach of fiduciary duty, id. ¶¶ 46-52; (3) breach of contract, id. ¶¶ 53-57; and (4) negligence, id. ¶¶58-63. Plaintiffs brought these four.causes of action on behalf of themselves and a statewide class of similarly situated individuals, defined as follows: Missouri residents whose personal information was compromised as a result of the data breach announced in February 2015 and are (1) current-and former members of a health insurance plan administered by Defendants, and/or (2) current and former Anthem'employees. Id. ¶ 26 (emphasis added). “The precise number of Class members;” according to Plaintiffs, “can be obtained from information and records in Defendants’ possession and control.” Id. ¶ 29. Defendants estimate that the proposed class comprises at least 750,000 individuals. See Removal Notice ¶ 12. On April 3, 2015, Defendants removed this action to the United States District Court for the Eastern District of Missouri. See Removal Notice. . Defendants proffered two independent bases for subject matter jurisdiction in federal court: (1) diversity jurisdiction under the Class Action Fairness Act of 2005 (“CAFA”), 28 U.S.C. § 1332(d); and (2) federal question jurisdiction under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. § 1320d et seq. See Removal Notice ¶¶ 10-23. On April 10, 2015, Plaintiffs filed the instant motion to remand. ECF No. 15 (“Mot.”). Pursuant to a stipulation by the parties, see ECF Nos. 18, 19, Defendants opposed the motion on May 1, 2015, ECF No. 22 (“Opp.”). Plaintiffs replied on May 14, 2015. ECF Ño. 28 (“Reply”). On May 14, 2015 — the same day Plaintiffs filed their reply — Plaintiffs also filed a first amended complaint. ECF No. 27, First Amended Complaint (“FAC”). In the FAC, Plaintiffs clarified that they “are citizens of Saint . Louis County, Missouri,” not just “residents.” Id. ¶ 1., Plaintiffs also amended the class definition, replacing the word “residents” with ,“[c]itizens.” Id. ¶ 25. The class definition now reads: Citizens of Missouri whose personal information was compromised as a result of the data breach announced in February 2015 and are (1) current and former members of a health insurance plan administered by Defendants, and/or (2) current and former Anthem employees. Id. (emphasis added). In all other respects, Plaintiffs’ FAC is materially the same as the original class action petition. For example, Plaintiffs continue to assert four causes of action under Missouri law: (1) violation of the MMPA,' id'. ¶¶ 34-44; (2) breach of fiduciary duty, id. ¶¶ 45-51; (3) breach of contract, id. ¶¶ 52-56; and (4) negligence, id. ¶¶ 57-62. On May 18, 2015, in response to Plaintiffs’ FAC, Defendants filed a motion for leave to file a sur-reply. ECF No. 30. The district court granted the motion the next day. ECF No. 31. On May 28, 2015, Defendants filed their sur-reply, ECF No. 33, which argued that Plaintiffs’ “last-ditch effort to avoid federal court” by amending their complaint was unavailing because the district court should only consider “what [892] was pleaded at the time of removal,” id. at 1-2. On June 8, 2015, the Judicial Panel on Multidistrict Litigation (“JPML”) issued a transfer order pursuant to 28 U.S.C. § 1407 selecting the undersigned judge as the transferee court for “coordinated or consolidated pretrial proceedings” in the multidistrict litigation (“MDL”) arising out of the Anthem data breach “that allegedly occurred sometime between December 10, 2014, and February 4, 2015.” Case No. 15-MD-02617-LHK, ECF No. at 1-3. Accordingly, on June 17, 2015, the JPML transferred the instant putative class action from the Eastern District of Missouri to the undersigned judge in the Northern District of California. ECF No. 34. On July 31, 2015, the Court held a preliminary case management conference. See ECF No. 39. Counsel for Plaintiffs appeared at the case management conference and communicated to the Court Plaintiffs’ intent to pursue their pending motion to remand. Id. at 2. The Court set the motion for hearing on September 10, 2015, at 1:30 p.m. Id. On August 27, 2015, the Court ordered the parties to file supplemental briefing, on Plaintiffs’ motion to remand no -later than September 4, 2015, ECF No. .40. The Court did so because the parties’ briefs, which were filed in.the Eastern District of Missouri, a division of the Eighth Circuit, did not cite to or otherwise address relevant Ninth Circuit precedent, which this Court must apply. See Newton v. Thomason, 22 F.3d 1455, 1460 (9th Cir.1994) (holding that “when reviewing federal claims, a transferee court in this circuit is bound only by our circuit’s precedent”); see also In re Gen. Am. Life Ins, Co. Sales Practices Litig., 391 F.3d 907, 911 (8th Cir.2004) (“When a transferee court receives a case from the MDL Panel, the transferee court applies the law of the circuit in which it is located to issues of federal law.”); In re Sony Gaming Networks & Customer Data Sec. Breach Litig., 996 F.Supp.2d 942, 959 (S.D.Cal.2014) (“In interpreting federal law, a transferee court in a multidistrict case should look to the law of its own circuit rather than the law: of the transferor courts’ circuits."). Plaintiffs filed their supplemental brief on September 4, 2015. Case No. 15-MD-02617-LHK, ECF No. 258 (“Pls.Supp.Br.”). Defendants did the same. ECF No. 41 (“Defs.Supp.Br,”). II. LEGAL STANDARD A suit may be removed from state court to federal court only if the federal court would have had subject matter jurisdiction over the case in the first instance. 28 U.S.C. § 1441(a); see Caterpillar Inc. v. Williams, 482 U.S. 386, 392, 107 S.Ct. 2425, 96 L.Ed.2d 318 (1987) (“Only state-court actions that originally could have been filed in federal court may be removed to federal court by the defendant.”). “In civil cases, subject matter jurisdiction is generally conferred upon federal district courts-either» through diversity jurisdiction, 28 U.S.C. § 1332, or federal question jurisdiction, 28 U.S.C. § 1331.” Peralta v. Hispanic-Bus., Inc., 419 F.3d. 1064, 1068 (9th Cir.2005). If it,appears at any time before final judgment that,the federal court lacks subject matter jurisdiction, the federal court must remand the action to state court. 28 U.S.C. § 1447(c). There is no’ presumption against removal jurisdiction in CAFA eases. See Dart Cherokee Basin Operating Co., LLC v. Owens, — U.S. -, 135 S.Ct. 547, 554, 190 L.Ed.2d 495 (2014) (vacating district court’s remand order-in putative class action on the ground that “a defendant’s notice of removal need include only a plausible allegation that the amount in controversy exceeds the jurisdictional threshold”). The defendant, however, still bears [893] the burden of establishing removal jurisdiction. See id, A notice of removal must contain a “short and plain statement of the grounds for removal,” a requirement that tracks the general pleading standard of Rule 8(a) of the Federal Rules of Civil Procedure. Id. at 553 (citing 28 U.S.C. § 1446(a)). III. DISCUSSION. Defendants argue that there are two independent bases for subject matter jurisdiction in federal court: (1) diversity jurisdiction under CAFA; and (2) federal question jurisdiction under HIPAA. See Removal Notice ,¶¶ 10-23; Opp. at 3-12; Defs. Supp. Br. at 2-9. Plaintiffs dispute both of these bases for jurisdiction.2 See Mot. at 3-12; Reply at 1-6; Pls. Supp. Br. at 2-9. For the reasons stated below, the Court agrees with Plaintiffs. A. Diversity Jurisdiction Under CAFA CAFA gives federal courts jurisdiction over certain class actions if (1) “the class has more than 100 members”; (2) “the parties are minimally diverse”; and (3) “the amount in controversy exceeds $5 million.” Dart Cherokee, 135 S.Ct. at 552 (citing 28 U.S.C. § 1332(d)(2), (5)(B)). CAFA’s “minimal diversity” requirement means that “a federal court may exercise jurisdiction over a class action if ‘any member of a class of plaintiffs is a citizen of a State different from any defendant.’ ” Mississippi ex rel. Hood v. AU Optronics Corp., — U.S. -, 134 S.Ct. 736, 740, 187 L.Ed.2d 654 (2014) (quoting 28 U.S.C. § 1332(d)(2)(A)). If a defendant cannot establish that CAFA’s minimal diversity has been satisfied, then CAFA cannot serve as a basis for subject matter jurisdiction. See Weight v. Active Network, Inc., 29 F.Supp.3d 1289, 1292 (S.D.Cal.2014) (explaining that if “there is no minimal diversity” under CAFA, “the Court must remand this case”). As the Ninth Circuit has explained, “the diversity jurisdiction statute, 28 U.S.C. § 1332, speaks of citizenship, not of residency.” Kanter v. Warner-Lambert Co., 265 F.3d 853, 857 (9th Cir.2001). A “natural person’s state citizenship is ... determined by her state of domicile, not her state of residence.” Id. “A person’s domicile,” in turn, “is her permanent Home, where she resides with the intention to remain or to which she intends to return,” and “[a] person residing in a given state. is not necessarily domiciled there, and thus is not necessarily a citizen of that state.” Id.; see also, e.g., Weible v. United States, 244 F.2d 158, 163 (9th Cir.1957) (“Residence is physical, whereas domicile is generally a compound of physical presence plus an intention to make a, certain definite place one’s permanent abode, though, to be sure, domicile often hangs on the slender thread of intent alone, as for instance where one is a wanderer over the earth.”). In the instant case, Plaintiffs’ original petition stated that “Plaintiffs are adult residents of Saint Louis County, Missouri.” Pét. ¶ 1 (emphasis added). The original petition’s, class definition also spoke of residency, rather than citizenship: [894] Id. ¶ 26 (emphasis added). Defendants, both of whom are Missouri citizens, see id. ¶¶ 2-3, assert “that at least one member of the putative class is presently a resident of Missouri while maintaining citizenship in another state,” Removal Notice ¶ 15. In support of that assertion, Defendants allege that their “insurance programs do not restrict membership to citizens of Missouri,” and that their “members include individuals enrolled in Defendants’ plans as ‘guests’ while resident in Missouri on a semi-permanent or extended basis, but who maintain citizenship ... in other states.” Removal Notice ¶ 15a-b. According to Defendants, in 2014 they enrolled 513 “guest”‘members, whose states of domicile varied from Connecticut to Hawaii. ECF No. 22-1, Déclaration of Val Curry 115. On this basis, Defendants argue that they have established minimal diversity by a preponderance. See Defs. Supp. Br. at 3. [893] Missouri residents whose personal information was compromised as a result of the data breach announced in February 2015 and are (1) current .and former members of a health insurance plan administered by Defendants, and/or (2) current and former Anthem employees. [894] However, on May 14, 2015 — more than one month after Defendants had removed the case to federal court — Plaintiffs filed the FAC, which clarified that Plaintiffs “are citizens of Saint Louis County, Missouri,” not just “residents.” FAC ¶ 1. Plaintiffs also amended the class definition, replacing the word “residents” with “[citizens.” Id. 1125. The class definition in the FAC reads:. Citizens of Missouri whose personal .information was compromised as a result of the data breach announced in February 2015 and are (1) current and former members of a health insurance plan administered by Defendants, and/or (2) current and former Anthem employees. Id. (emphasis added). Ordinarily, “post-removal amendments to the pleadings cannot affect whether a case is removable, because the propriety of removal is determined solely on the basis of the pleadings filed in state court.” Williams v. Costco Wholesale Corp., 471 F.3d 975, 976 (9th Cir.2006); see also Sparta Surgical Corp. v. Nat’l Ass’n of Sec. Dealers, Inc., 159 F.3d 1209, 1213 (9th Cir.1998) (explaining that “jurisdiction must be analyzed on the basis -of the pleadings filed at the time of removal without reference to subsequent amendments”). That said, the Ninth Circuit recently held that “plaintiffs should be permitted to amend a complaint after removal to clarify issues pertaining to federal jurisdiction under CAFA.” Benko v. Quality Loan Serv. Corp., 789 F.3d 1111, 1117 (9th Cir.2015). In Benko, the issue was not CAFA’s minimal diversity requirement, but whether the in-state defendant was “significant” for purposes of the “local controversy exception” to CAFA jurisdiction. Id. at 1116-17 (quoting 28 U.S.C. § 1332(d)(4)(A)(i)). The Ninth Circuit explained that when “a defendant removes a case to federal court under CAFA, and the plaintiffs amend the complaint to explain the nature of the action for purposes of our jurisdictional analysis, we may consider the amended complaint to determine whether remand to the state court is appropriate.” Id. at 1117. In Benko, “the Plaintiffs amended the [complaint] to elaborate on estimates of the percentage of total claims asserted against Meridian, an in-state Defendant, and the dollar value of those claims” — i.e., information that “is directly related to CAFA’s local controversy exception.” Id. The Benko plaintiffs, unlike the plaintiff in Sparta Surgical, “did not amend the [complaint] to eliminate a federal question so as to avoid federal jurisdiction.” Id. Here, Plaintiffs amended their state'court petition to “clarify” that they are not only residents of Missouri, but citizens as well. Benko, 789 F.3d at 1117. They also “amend[ed] the complaint to explain the nature of the action,” id. — namely, that Plaintiffs are pursuing their four state law claims on behalf of themselves [895] and a class of similarly situated “[citizens of Missouri,” FAC ¶ 25. When Plaintiffs filed their petition-in state court, there was no reason under state law for them to distinguish between residency and citizenship for pleading purposes. See Weight, 29 F.Supp.3d at 1291, 1293 (considering plaintiffs revised class definition, which had been amended to include “citizens” of a state rather than “residents,” because “the instant action was originally filed in the California state court system, which has no equivalent of diversity jurisdiction and thus does not require the careful distinction between ‘residents’ and ‘citizens’ ”). That distinction only became relevant when Defendants sought removal to federal court under CAFA. As the Ninth Circuit recognized in Benko, state court complaints “may not address CAFA-specific issues.” 789 F.3d at 1117. “By amending their complaint in these circumstances,” the Ninth Circuit continued, “plaintiffs can provide a federal court with the information required to determine whether a suit is within the court’s jurisdiction under CAFA.” Id, That is precisely what Plaintiffs did here. See FAC ¶¶ 1, 25. Consequently, the Court considers Plaintiffs’ clarifications in the FAC and finds that CAFA’s minimal diversity requirement has not been met in this action between citizens of Missouri. In reaching this conclusion, the Court notes its agreement with several other district courts in the Ninth Circuit. In Weight, for example, the district court considered the plaintiffs amended complaint, which had revised the class definition to include “citizens of California” rather than “California residents,” in determining whether CAFA’s minimal diversity requirement was satisfied. 29 F.Supp.3d at 1291, 1293. The district court did so because “when a pleading is amended to clarify the original complaint rather than manipulate the forum, the court can look to the amended complaint to determine whether- the court exercised jurisdiction over the action at the. time of removal.” Id. at 1292 (citing Schuster v. Gardner, 319 F.Supp.2d 1159, 1164-65 (S.D.Cal.2003)). Finding the plaintiffs revision to be a mere “clarification,” the court in Weight granted the-plaintiffs motion to remand due to lack of minimal diversity under CAFA. Id. at 1293-94. Even more on point are the recent decisions in Wickens v. Blue Cross of California, Inc., No. 15CV834-GPC JMA, 2015 WL 4255129 (S.D.Cal. July 14, 2015), and Smilow v. Anthem Blue Cross Life & Health Ins. Co., No. CV 15-4556-MWF(AGRX), 2015 WL 4778824 (C.D.Cal. Aug. 13, 2015), both of which involve putative class actions arising out of the same Anthem data breach giving rise to this action.3 In Wickens, the district court, relying on Benko, found it proper to consider the plaintiffs amended complaint because “the change from ‘residents’ to ‘citizens’ of California in the class description is a clarification of the Court’s jurisdiction.” 2015 WL 4255129, at *4-5. Taking the 'amended complaint into consideration was “especially” appropriate, the Wickens court held, because “the Complaint alleges claims against California based Defendants, alleges only California law causes of action, and the class was intended to be limited to individuals who entered into contracts with California corporations for future - services in California.” Id. at *5. Finding no minimal diversity under CAFA in light of the plaintiffs clarification to the class definition, the court in Wickens remanded the case to state court. Id. Similarly, the district court in Smilow found it appropriate to consider the plain [896] tiffs amended complaint because “an amendment to change ‘residents’ of California to ‘citizens’ of California, in this case, would constitute a clarification”'of the court’s jurisdiction. 2015 WL 4778824, at *6 (internal quotation marks omitted). Citing Benito, the Smilow court concluded that “the Ninth Circuit has recognized an exception to the general rule that courts must look to pre-removal filings to determine jurisdiction, where a party amends a complaint in order to clarify certain jurisdictional facts.” Id. Concluding that there was no minimal diversity under CAFA ip light of the plaintiffs clarification to the class definition, the court in Smilow granted the plaintiffs. motion to remand the case to state court. Id. Defendants’ citation to Doyle v. OneWest Bank, FSB, 764 F.3d 1097 (9th Cir.2014) (per curiam), which predates Benko, does not counsel a different result. See Defs. Supp. Br. at 7. In Doyle, the defendants removed a putative nationwide class action under CAFA. After removal, the California plaintiff amended her complaint by “narrow[ing] the putative class definition to a California-class only,” . Id. (alteration in original). The plaintiff then moved to remand the action to state court under one. of the exceptions to CAFA jurisdiction, and the district court granted the motion based on the amended class definition. Doyle, 764 F.3d at 1098. Vacating the district court’s remand order, the Ninth. Circuit held that the district court “should have determined the citizenship of the proposed plaintiff class based on Doyle’s complaint ‘as of the date the case became removable.’” Id. (quoting Mondragon v. Capital One Auto Fin., 736 F.3d 880, 883 (9th Cir.2013)). Doyle is distinguishable, however, because the plaintiff there did not seek to merely clarify her complaint to aid in the federal court’s jurisdictional analysis. Instead, the Doyle plaintiff sought to dramatically narrow the scope of the action from a nationwide class action to a statewide class action on behalf of California plaintiffs only. In the instant case, by contrast, Plaintiffs have sought from the outset to represent Missourians only. The FAC simply clarifies that Plaintiffs, as well as the proposed class, are citizens of Missouri, hot just residents, see FAC ¶¶ 1, 25 — a distinction that was of no moment "when Plaintiffs filed this action in state court. The district courts in Wick-ens and Smilow distinguished Doyle on similar grounds. See Wickens, 2015 WL 4255129, at *4 (distinguishing Doyle because it “did not address any amendment or clarification by Plaintiff to support federal jurisdiction or an exception to the rule that jurisdiction is determined at the time of removal”); Smilow, 2015 WL 4778824, at *6 (finding Doyle “inapposite” because “the Ninth Circuit was not asked to make a determination between an amendment, and a clarification, which is the issue presented in this case”). Accordingly, the Court considers Plaintiffs’ clarifications in the FAC and concludes that CAFA’s minimal diversity requirement has not been, mét in this action because both Plaintiffs and Defendants are citizens of Missouri. See FAC ¶¶ 1-3, 25. CAFA, therefore, cannot serve as a basis for this Court’s subject matter jurisdiction. See Weight, 29 F.Supp.3d at 1292. B. Federal Question Jurisdiction Under HIPAA “Absent diversity of citizenship, federal-question jurisdiction is required.” Caterpillar, 482 U.S. at 392, 107 S.Ct. 2425. Federal question jurisdiction is governed by 28 U.S.C. § 1331, which provides that federal courts have original jurisdiction over civil actions “arising under the Constitution, laws, or treaties of the United States.” Federal question ju [897] risdietion “is determined (and must exist) as of the time the complaint is filed and removal is effected.” Strotek Corp. v. Air Transp. Ass’n of Am., 300 F.3d 1129, 1131 (9th Cir.2002). Removal pursuant to § 1331 is governed by the “well-pleaded complaint rule,” which provides that federal question jurisdiction exists only when “a federal question is presented on the face of plaintiff’s properly pleaded complaint.” Caterpillar, 482 U.S. at 392, 107 S.Ct. 2425. “[I]n certain cases,” the Supreme Court has explained, “federal-question- jurisdiction will lie over state-law claims that implicate significant federal issues.” Grable & Sons Metal Prods., Inc. v.. Darue Eng’g & Mfg., 545 U.S. 308, 312, 125 S.Ct. 2363, 162 L.Ed.2d 257 (2005). Under Grable, a federal court may exercise jurisdiction over a state-law claim only if (1) the action necessarily raises a federal issue that is (2) disputed and (3) substantial, and if (4) the court may entertain the case without disturbing the congressionally approved balance of federal and state judicial responsibilities. Id. at 314, 125 S.Ct. 2363. The party seeking to establish jurisdiction must justify a need for “the experience, solicitude, and hope of uniformity that a federal forum offers on federal issues.” Id. at 312, 125 S.Ct. 2363. Defendants assert here that Plaintiffs’ “claims raise important federal questions and implicate a compelling federal interest that warrants this Court’s exercise of federal question jurisdiction.” Removal Notice ¶ 18 (citing Grable, 545 U.S. at 314, 125 S.Ct. 2363). The basis for Defendants’ assertion is that Plaintiffs’ breach of fiduciary duty claim “turn[s] on the allegation that Defendants ‘fail[ed] to institute’ certain ‘safeguards’ purportedly described and required by regulations promulgated by federal authorities under HIPAA.” Defs. Supp. Br. at 9 (quoting Pet. ¶¶ 49-50). Moreover, Defendants assert-that “how Anthem and similarly situated- companies respond, to the threat of cyber attacks raises substantial federal questions and implicates -a compelling federal interest” under Grable because “cyber attacks” are “one of the most serious national security challenges we must confront.” Removal Notice ¶¶ 19, 23 (quoting Exec. Order No. 13,636, 78 Fed.Reg. 11,739, 11,739 (Feb. 12, 2013)). The Court is not persuaded that Grable’s third and fourth prongs have been met. 545 U.S. at 314, 125 S.Ct. 2363. It is well established that “the mere reference of a federal statute in' a pleading will not convert a state law claim into a federal cause of action if the federal statute is not a necessary element of the state law claim and no preemption exists.” Easton v. Crossland Mortgage Corp., 114 F.3d 979, 982 (9th Cir.1997). Plaintiffs’ single reference to HIPAA in a sixty-three-paragraph complaint does not convert Plaintiffs’ state law claim for breach of fiduciary duty into a federal cause of action. See Pet. ¶48. Indeed, the previous paragraph makes clear that Plaintiffs’ claim arises under state law: “Under Missouri common law, Defendants owed and continue to owe a fiduciary duty to Plaintiffs and the Class to maintain the privacy of their insurance records and medical information contained therein.” Id. ¶ 47 (emphasis added). Although this action resulted from a data breach that has had consequences nationwide, at bottom this particular lawsuit is between Missouri plaintiffs and Missouri defendants based on alleged violations of Missouri law. Furthermore, the Ninth Circuit has held post-Grable that “HIPAA itself does not provide for a private right of action.” Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1082 (9th Cir.2007). “[W]here there is no federal private right of action,” the Ninth Circuit [898] continued, federal courts generally “may not entertain a claim that depends on the presence of federal question jurisdiction under 28 U.S.C. § 1331.” Id. at 1083 (citing Merrell Dow Pharm. Inc. v. Thompson, 478 U.S. 804, 817, 106 S.Ct. 3229, 92 L.Ed.2d 650 (1986)). Thus, allowing federal question jurisdiction based on Plaintiffs’ single reference to HIPAA would effect an “end-run around clear precedent precluding a private right of action under HI-PAA.” Huling v. City of Los Banos, No. 1:11-CV-01797, LJO, 2012 WL 253251, at *8 (E.D.Cal. Jan. 25, 2012); see also Dickman v. MultiCare Health Sys., No. C15-5193 BHS, 2015 WL 3477178, at *3 (W.D.Wash. June 2, 2015) (concluding that “it would undermine congressional intent to allow claims for private relief into federal court' through a state cause of action when a federal private right of action is unavailable” (citing Merrell Dow, 478 U.S. at 812, 106 S.Ct. 3229)). Accordingly, the Court concludes that Defendants have not met their burden to show that federal question jurisdiction exists over this action.' IV. CONCLUSION For the foregoing reasons, the Court hereby GRANTS Plaintiffs’ motion to remand the case to the Circuit Court of St. Louis City, Missouri. IT IS SO ORDERED. Footnotes [1] Unless otherwise indicated, all ECF references are to the docket of Case No. 15-CV-2873-LHK in the Northern District of California. [2] Plaintiffs also raise the “home state exception" as a ground for remand. See Mot. at 8-10; Pls. Supp. Br. at 8-9. The Court need not address this argument because the Court remands on other grounds. [3] The defendants in Wickens and Smilow have sought permission to appeal the district court rulings to the Ninth Circuit. See Defs. Supp. Br. at 5.