Rubenstein v. Scripps Health

[7] 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA [10] 11 Case No.: 21cv1135-GPC(MSB) [12] IN RE: SCRIPPS HEALTH DATA ORDER GRANTING DEFENDANTS’ 13 SECURITY BREACH LITIGATION MOTION TO DISMISS FOR LACK OF SUBJECT MATTER [14] JURISDICTION [15] [DKT. NO. 14.] [17] Before the Court is Defendant Scripps Health’s motion to dismiss pursuant to [18] Federal Rule of Civil Procedure 12(b)(1) for lack of subject matter jurisdiction under the [19] Class Action Fairness Act (“CAFA”) or, in the alternative, motion to stay the action [20] under the Colorado River doctrine. (Dkt. No. 14.) Plaintiffs filed a response and [21] Defendant replied. (Dkt. Nos. 18, 20.) Based on the reasoning below, the Court [22] GRANTS Defendants’ motion to dismiss for lack of subject matter jurisdiction. [23] Background [24] This case involves a consolidated purported class action complaint against [25] Defendant Scripps Health (“Defendant” or “Scripps”) regarding a ransomware attack [26] where cybercriminals infiltrated Defendant’s network servers and accessed highly [27] sensitive personal and medical information around April 29, 2021. (Dkt. No. 13, Consol. [28] 1 Compl. ¶¶ 1, 2.) Plaintiffs allege that Defendant failed to properly secure and safeguard 2 its patient’s personally identifiable information (“PII”) and personal health information 3 (“PHI”) stored within Defendant’s information networks and have been damaged. (Id. ¶¶ 4 1, 2, 7.) 5 Plaintiffs seek to certify a nationwide class and a California subclass defined as: 6 Nationwide Class: “All individuals within the United States of America whose PII/PHI [7] was stored by Defendant and/or was exposed to unauthorized third 8 parties as a result of the compromise of Scripps Health’s data systems, as announced on or about June 1, 2021.” [9] 10 California Subclass: “All individuals within the State of California whose PII/PHI was [11] stored by Defendant and/or was exposed to unauthorized third parties 12 as a result of the compromise of Scripps Health’s data systems, as announced on or about June 1, 2021.” [14] (Id. ¶ 69.) The six state law causes of action alleged against Scripps are negligence, [15] invasion of privacy, breach of confidence and declaratory relief on behalf of the [16] Nationwide Class or, alternatively, on behalf of the California Subclass, and violations of [17] the California Customer Records Act, Cal. Civil Code section 1798.80, and violation of [18] California Confidentiality of Medical Records Act, Cal. Civ. Code section 56 et seq. on [19] behalf of the California subclass. [20] Discussion [21] A. Legal Standard on Federal Rule of Civil Procedure 12(b)(1) [22] Federal Rule of Civil Procedure (“Rule”) 12(b)(1) provides for dismissal of a [23] complaint for lack of subject-matter jurisdiction. Fed. R. Civ. P. 12(b)(1). Rule 12(b)(1) [24] jurisdictional attacks can be either facial or factual. White v. Lee, 227 F.3d 1214 , 1242 [28] 1 (9th Cir. 2000). Here, Defendant claims it is mounting a factual attack on subject matter 2 jurisdiction and provides evidence outside the complaint. (Dkt. No. 14-1 at 18-19.1) 3 In a factual attack, the challenger provides evidence that an alleged fact in the 4 complaint is false, thereby resulting in a lack of subject matter jurisdiction. Safe Air for 5 Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). Under a factual attack, the 6 allegations in the complaint are not presumed to be true, White, 227 F.3d at 1242 , and 7 “the district court is not restricted to the face of the pleadings, but may review any 8 evidence, such as affidavits and testimony, to resolve factual disputes concerning the 9 existence of jurisdiction.” McCarthy v. United States, 850 F.2d 558, 560 (9th Cir. 1988). 10 “Once the moving party has converted the motion to dismiss into a factual motion by 11 presenting affidavits or other evidence properly brought before the court, the party 12 opposing the motion must furnish affidavits or other evidence necessary to satisfy its 13 burden of establishing subject matter jurisdiction.” Savage v. Glendale Union H.S., Dist. 14 No. 205, Maricopa Cnty., 343 F.3d 1036 , 1039 n. 2 (9th Cir. 2003). The district court 15 may review evidence beyond the complaint without converting the motion to dismiss into 16 a motion for summary judgment. See id. However, “[a] court may not resolve genuinely 17 disputed facts where ‘the question of jurisdiction is dependent on the resolution of factual 18 issues going to the merits.’” Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987) 19 (citations omitted) ). Ultimately, Plaintiff has the burden to demonstrate that subject 20 matter jurisdiction exists. Kokkonen v. Guardian Life Ins. Co. of America, 511 U.S. 375 , 21 377 (1994). 22 CAFA provides an independent basis for original jurisdiction. 28 U.S.C. § 23 1332(d)(2). CAFA jurisdiction requires that the case is a class action involving: (1) 24 minimal diversity, or in other words, that any member of the class is a citizen of a state 25 different from any defendant; (2) at least 100 putative members; and (3) over $5,000,000 [28] 1 in controversy exclusive of interest and costs. 28 U.S.C. §§ 1332 (d)(2), (d)(5)(B). 2 Despite these requirements, Congress also provided exceptions to CAFA jurisdiction, 3 which requires the district court to decline to exercise jurisdiction. 28 U.S.C. § 4 1332(d)(4); see King v. Great American Chicken Corp., Inc., 903 F.3d 875, 878 (9th Cir. 5 2018) (“The statute includes a number of exceptions that require a federal district court to 6 decline jurisdiction even if the above requirements were met.”). The purpose is to allow 7 truly intrastate class actions to be heard in state court. Adams v. W. Marine Prods., Inc., [8] 958 F.3d 1216, 1220 (9th Cir. 2020). 9 1. Home State Controversy Exception 10 In its motion, Defendant relies on the home-state controversy exception. (Dkt. No. 11 14-1 at 20; Dkt. No. 18 at 8.) Under the home-state controversy exception, a district 12 court must decline to exercise jurisdiction where “two-thirds or more of the members of 13 all proposed plaintiff classes in the aggregate, and the primary defendants, are citizens of 14 the State in which the action was originally filed.” 28 U.S.C. § 1332 (d)(4)(B). To meet 15 this burden, the moving party must provide “some facts in evidence from which the 16 district court may make findings regarding class members’ citizenship.” Mondragon v. 17 Capital One Auto Fin., 736 F.3d 880, 884 (9th Cir. 2013); see also Brinkley v. Monterey 18 Fin. Servs., Inc., 873 F.3d 1118, 1121 (9th Cir. 2017). While this “jurisdictional finding 19 of fact should be based on more than guesswork,” the burden of proof “should not be 20 exceptionally difficult to bear” and a court may “make reasonable inferences from facts 21 in evidence.” Mondragon, 736 F.3d at 884, 886 . The district court makes these factual 22 findings under a preponderance of the evidence standard. Id. at 884 . 23 Once CAFA jurisdiction has been established, see 28 U.S.C. § 1332 (d)(2) and 24 (d)(5), the “party seeking to defeat jurisdiction by invoking this exception carries the 25 burden of proving it applies.” Skogebo v. Cofiroute USA, LLC, Case No. SACV 1926 00739 AG (JDEx), 2019 WL 6711701 , at *2 (C.D. Cal. Oct. 24, 2019) (citing King, 903 27 F.3d at 876); Edward & Marjorie Austin Unitrust v. U.S. Mortgage Corp., No. 2:06–cv– 28 01235–BES–PAL, 2007 WL 2886036 , at *2 (D. Nev. Sept. 27, 2007) (party challenging 1 court’s jurisdiction on a 12(b)(1) motion must prove “that CAFA exceptions to federal 2 jurisdiction divest the district court of subject matter jurisdiction” and bears burden of 3 establishing requirements of those exceptions.); see also Anirudh v. CitiMortgage, Inc., [4] 598 F. Supp. 2d 448, 451 (S.D.N.Y. 2009), (“while plaintiffs bear the initial burden of 5 establishing federal subject matter jurisdiction under CAFA, defendant bears the burden 6 of proving that an exception to CAFA applies.”). 7 2. Analysis 8 Here, the consolidated purported class action complaint alleges that “the amount in 9 controversy exceeds the sum or value of $5 million, exclusive of interest and costs, there 10 are more than 100 members in the proposed class, and at least one other Class Member is 11 a citizen of a state different from Defendant as Defendant treats patients who are citizens 12 of other states who come to its facilities for medical care and from whom Defendant has 13 collected PII/PHI.” (Dkt. No. 13, Consol. Compl. ¶ 13.) Plaintiffs have sufficiently 14 alleged diversity jurisdiction under CAFA. In its motion, Defendant seeks to defeat 15 jurisdiction and invokes the home-state controversy exception which requires Defendant 16 to show, by a preponderance of the evidence, that two-thirds or more of the proposed 17 class are citizens of California. (See Dkt. No. 14-1 at 20; Dkt. No. 18 at 8.) Neither party 18 disputes that Defendant is a citizen of California. 19 “To be a citizen of a state, a natural person must first be a citizen of the United 20 States.” Kanter v. Warner-Lambert Co., 265 F.3d 853, 857 (9th Cir. 2001) (citation 21 omitted). A person’s citizenship then is determined by his or her state of domicile which 22 is his or “her permanent home, where [he or] she resides with the intention to remain or 23 to which she intends to return.” Id. (citations omitted). While “[a] person residing in a 24 given state is not necessarily domiciled there, and thus is not necessarily a citizen of that 25 state[]”, at a minimum, a person’s residence constitutes some evidence of domicile. 26 Mondragon, 736 F.3d at 886 . “[A] party with the burden of proving citizenship may rely 27 on the presumption of continuing domicile, which provides that, once established, a [28] 1 person's state of domicile continues unless rebutted with sufficient evidence of change.” [2] Id. at 885 . 3 Defendant presents the declaration of Taunya Juliano, the Corporate Privacy 4 Officer for Scripps.2 (Dkt. No. 14-2, Juliano Decl.) She declares that Scripps is 5 incorporated in California and has its principal place of business in San Diego, CA. (Dkt. 6 No. 14-2, Juliano Decl. ¶ 2.) In early 2021, when the ransomware attack occurred, 7 Scripps investigated and based on its investigation, notified about 144,011 individuals by 8 direct mail about the ransomware attack. (Id. ¶¶ 3-6.) Of the 144,011 individuals, about 9 138,831 individuals, or 96.3% had California addresses. (Id. ¶ 7.) This percentage of 10 individuals with California addresses is consistent with the approximate percentage of 11 Scripps’ overall patient population that it serves. (Id. ¶ 8.) 12 In opposition, Plaintiffs do not respond with rebutting evidence but with arguments 13 based upon speculation. First, they assert that Juliano’s declaration amounts to 14 guesswork arguing that because Scripps’ location is in sunny San Diego, many patients 15 are snowbirds who come to San Diego during the harsh winter months but are citizens of 16 other states or countries. (Dkt. No. 18 at 11.) While snowbirds do flock to San Diego, 17 Plaintiffs have not offered any data that these snowbirds include patients of Scripps. 18 Next, Plaintiffs argue that Defendant fails to state how many individuals to whom it sent 19 notices are United States or California citizens and her assertion that the 96% is 20 “consistent with the approximate percentage of Scripps’ overall patient population that it 21 services” does not satisfy the burden. However, the statute does not require that Scripps 22 specifically state how many of its patients are United States citizens and how many are 23 California citizens, and a court is not required to “examin[e] the domicile of every [25] 2 While Plaintiffs question the declaration of Juliano because she is merely a Corporate Privacy Officer, 26 they fail to explain how she does not have personal knowledge of the contents of her declaration. (Dkt. No. 18 at 9-11.) Moreover, Plaintiffs argue Juliano fails to provide any substantiating information about 27 the last known addresses to whom Scripps sent the data breach notices. (Id.) Yet, they fail to provide legal authority that her declaration, itself, has no evidentiary value to the Court’s determination of [28] 1 proposed class member before ruling on the citizenship requirement [as] it would render 2 class actions ‘totally unworkable.’” See Adams, 958 F.3d at 1223 . Further, the Court 3 agrees that Juliano’s general statement that 96% is consistent with the percentage 4 Scripps’ patient population does not support Defendant’s position, but notwithstanding 5 that statement, Scripps has already provided “some evidence” showing that 96.3% of 6 those that received notices concerning the data breach have California addresses. 7 Here, the class size is around 144,011. For the home state controversy exception to 8 apply “greater than 2/3” or 66 2/3%3 of 144,011 must be California citizens. In this case, 9 the ransomware attack occurred in April 2011 and the letter from Scripps was received by 10 class members around June 1, 2021, (Dkt. No. 13, Consol. Compl. ¶¶ 47, 36, 69), 11 indicating that most addresses are most likely current. See Romano v. SLS Residential, 12 Inc., 812 F. Supp. 2d 282, 288 (S.D.N.Y. 2011) (because class included residents of a 13 facility where more than four years had passed, court could not conclude that most 14 remained in New York). Scripps is the second largest healthcare provider in San Diego. 15 (Dkt. No. 13, Consol. Compl. ¶¶ 8, 54.) Given the significant cost of healthcare and 16 patients’ goal of maximizing the healthcare benefits furnished by a provider, it stands to 17 reason that the vast majority of Scripps patients are from the San Diego or nearby area. 18 While the Court recognizes that there may be members who specifically seek out 19 Scripps’ renown medical care from out of state, they would likely be included in the 20 3.7% that do not have California addresses. It is also to be noted that all the named 21 Plaintiffs are residents of California. (Id. ¶¶ 17, 31, 40, 48.) Further, there is no 22 indication that Scripps provides medical care for seasonal workers who are migratory or 23 transitory. See Ali v. Setton Pistachio of Terra Bella Inc., Case 1:19-cv-00959-NONE24 BAM, 2021 WL 389659 , at *4 (E.D. Cal. Feb. 4, 2021) (addresses of seasonal workers 25 who were migratory did not support conclusion that their address was their domicile); [27] 3 The Ninth Circuit confirmed that “two-thirds actually translates into 66 & 2/3 percent, not 67 percent.” [28] 1 Romano, 812 F. Supp. 2d at 288 (residential psychiatric facility where out of staters could 2 seek treatment and where these patients would less likely remain in the area once 3 treatment was completed did not support New York citizenship). Therefore, based on 4 these facts, the Court can reasonably infer that more than 2/3 of the class are citizens of 5 California. See Mondragon, 736 F.3d at 886 (“district courts are permitted to make 6 reasonable inferences from facts in evidence”). 7 While addresses are not the same as domicile, it constitutes some evidence of 8 domicile, which is all that is needed for the Court to make a finding regarding the CAFA 9 exception. See Mondragon, 736 F.3d at 884 (“we conclude that there must ordinarily be 10 at least some facts in evidence from which the district court may make findings regarding 11 class members' citizenship for purposes of CAFA's local controversy exception.”). 12 Therefore, without any evidence by Plaintiffs to challenge Defendant’s fact that 96.3% of 13 the notices were sent to California addresses, or that the recipients are not California 14 citizens, Defendant has shown that the home-state controversy exception applies, and 15 thus, the Court lacks subject matter jurisdiction over the case. 16 Plaintiffs rely on King v. Great American Chicken Corp., Inc., 903 F.3d 875 (9th 17 Cir. 2018) and Adams v. West Marine Prods., Inc., 958 F.3d 1216 (9th Cir. 2020) to 18 support their argument. However, neither provides succor. For example, in King, the 19 Ninth Circuit reversed the district court’s order granting a motion to remand under the 20 home-state controversy exception because there was no evidence that greater than two21 thirds of members of all proposed plaintiffs were citizens of California. In that case, the 22 district court relied on the defendant’s stipulation that “at least two-thirds of the putative 23 class members had last-known addresses in California.” Id. at 879. First, the court noted 24 that the stipulation which stated “at least two-thirds” and the CAFA exception requiring 25 “greater than two-thirds” are not the same. Id. The Ninth Circuit concluded that because 26 there was a “narrow cushion provided by the stipulation, the likelihood that some putative 27 class members were legally domiciled in or subsequently relocated to another state, and 28 the probability that some class members were not United States citizens, [it could not] 1 conclude that there was sufficient evidence to support a finding that greater than two2 thirds of the putative class members were California citizens.” Id. at 779-80. The court 3 explained that the stipulation would have required it to assume that nearly 100% of class 4 members with last known addresses in California were also California citizens which the 5 court asserted was an assumption that would have amounted to little more than 6 guesswork. Id. at 880. Here, 96.3% of those who received the data breach notice had 7 California addresses, and unlike in King, establishes more than a “narrow cushion” 8 establishing a probability that more than two-thirds of the class members are California 9 citizens. 10 In contrast to King, in Adams, the Ninth Circuit, addressing the discretionary home 11 state controversy exception standard of “greater than one-third”, the plaintiff provided 12 evidence that more than 90% of class members had last known mailing addresses in 13 California which was not a “narrow cushion” but a “percentage far greater than the one14 third (or roughly, 33%) required for remand and offered a declaration that only citizens of 15 California were hired and no foreign nationals were ever hired by the defendant. Adams, [16] 958 F.3d 1222 -23. Recognizing that the “last known mailing addresses are not a direct 17 proxy for residence, and residence is not a direct proxy for citizenship”, and that “[s]ome 18 of the verified California addresses probably belong to people who are not California 19 citizens, or even citizens of the United States”, nonetheless, “given the substantial 20 cushion afforded by the percentage of class members with last known California 21 addresses, as compared to the percentage of class member citizens required for a 22 discretionary remand [33%], [the plaintiff] readily met her burden.” Id. at 1223 . Here, 23 even though the percentage gap is less than in Adams, there exists a far greater margin to 24 support the Court’s conclusion. 25 Accordingly, the Court GRANTS Defendant’s motion to dismiss for lack of 26 subject matter jurisdiction. As such, the Court also DENIES Defendant’s alternative 27 argument that the Court stay the action pursuant to the Colorado River doctrine as moot. 28 / / / 1 Conclusion 2 Based on the reasoning above, the Court GRANTS Defendant’s motion to dismiss 3 lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and 4 || DENIES its motion to stay as MOOT. The hearing set on January 28, 2022 shall be 5 || vacated. 6 IT IS SO ORDERED. 7 ||Dated: January 25, 2022 8 Hon. athe Cae 9 United States District Judge