In re Community Health Systems Inc., MDL 2595

Filing 166

MEMORANDUM OPINION Signed by Chief Judge Karon O Bowdre on 2/15/17. (SAC )

Download PDF
FILED 2017 Feb-15 PM 03:54 U.S. DISTRICT COURT N.D. OF ALABAMA IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ALABAMA SOUTHERN DIVISION IN RE: COMMUNITY HEALTH SYSTEMS, INC., CUSTOMER SECURITY DATA BREACH LITIGATION (MDL 2595) ) ) ) ) ) ) ) MASTER FILE NO. 15-CV-222-KOB This document relates to all cases. MEMORANDUM OPINION This case is before the court on “Plaintiffs’ Renewed1 Motion for Certification for Interlocutory Appeal.” (Doc. 154). The Plaintiffs present three proposed questions for interlocutory appeal. Defendant PSC has filed an opposition to this motion (doc. 160), as has Defendant CHSI (doc. 161). The Plaintiffs filed an omnibus reply. (Doc. 165). For the reasons set out in this Memorandum Opinion, the court FINDS that the motion is due to be DENIED as to all three questions. Although the court believes that important legal questions as to the Plaintiffs’ standing may be appropriate for interlocutory appeal, the questions 1 On March 31, 2016, the Plaintiffs filed their first Motion for Certification of Interlocutory Appeal (doc. 118) based on the court’s February 17, 2016 Order (doc. 95), ruling on certain jurisdictional issues asserted in Defendants’ motions to dismiss. The court withdrew (doc. 124) the February 17, 2016 Order and substituted a new Partial Order on Motions to Dismiss dated April 14, 2016 (doc. 125). After the April 15, 2016 hearing on remaining parts of the motions to dismiss, the court held a conference and discussed the Plaintiffs’ withdrawing their motion for certification of interlocutory appeal until after the court entered orders ruling on the remaining parts of the pending motions to dismiss. As a result, the Plaintiffs withdrew the original motion for certification of interlocutory appeal with the express intention of re-filing it following the court’s resolution of all issues raised in the motions to dismiss. (Doc. 128). On September 12, 2016, the court entered an order (doc. 145) on the remaining issues asserted in the motions to dismiss, and the Plaintiffs subsequently filed the pending renewed motion for certification of interlocutory appeal. 1 as phrased are not they. PROPOSED QUESTIONS FOR CERTIFICATION Plaintiffs request that this court certify the following three questions to the Eleventh Circuit Court of Appeals: (1) Whether plaintiffs who have alleged that their confidential patient data was stolen by data thieves, but not yet misused, have Article III standing to sue for the mishandling of the data by a third party, when plaintiffs also allege that other individuals’ confidential patient data obtained by data thieves through the same security breach has already been misused and that plaintiffs paid a third party for data security that was not provided (i.e., standing based on overpayment). (2) Whether plaintiffs who have alleged that their confidential patient data was stolen by data thieves, but not yet misused, have Article III standing to sue for the mishandling of the data by a third party, when plaintiffs also allege that other individuals’ confidential patient data obtained by the data thieves through the same security breach has already been misused and they are themselves at a substantially2 increased risk of harm (i.e. standing based on increased risk of harm). (3) Whether plaintiffs who have alleged that their confidential patient data was stolen by data thieves, but not yet misused, have Article III standing to sue for the mishandling of the data by a third party where plaintiffs also allege that other individuals’ confidential patient data obtained by the data thieves through the same security breach has already been misused, that the third party recommended that plaintiffs take measures to mitigate the risk of identity theft or other misuse of the stolen data, and that plaintiffs incurred time and monetary expense to undertake such mitigation measures (i.e. standing based on mitigation). STANDARD OF REVIEW Section 1292(b) of title 28 of the United States Code explains when a district judge may certify for interlocutory appeal an order that is not otherwise appealable: 2 The court notes that the Plaintiffs have invoked the “substantial risk” of harm standard, and not the “certainly impending” standard. 2 When a district judge, in making in a civil action an order not otherwise appealable under this section, shall be of the opinion that such order involves a controlling question of law as to which there is substantial ground of difference of opinion and that an immediate appeal from the order may materially advance the ultimate termination of the litigation, he shall so state in writing in such order. 28 U.S.C. § 1292(b). The “screening procedure” of requiring consent from the trial judge “serves the dual purpose of ensuring that such review will be confined to appropriate cases and avoiding time-consuming jurisdictional determinations in the court of appeals.” Coopers & Lybrand v. Livesay, 437 U.S. 463, 474-75 (1978). Only “exceptional circumstances justify a departure from the basic policy of postponing appellate review until after the entry of a final judgment.” Id at 475. The Eleventh Circuit explained that “§ 1292(b) sets a high threshold for certification to prevent piecemeal appeals.” OFS Fitel, LLC v. Epstein, Becker and Green, P.C., 549 F.3d 1344, 1359 (11th Cir. 2008). “Because permitting piecemeal appeals is bad policy, permitting liberal use of § 1292(b) is bad policy.” McFarlin v. Conseco Servs., LLC, 381 F.3d 1251, 1259 (11th Cir. 2004) . “Unless a litigant can show that an interlocutory order of the district court might have a serious, perhaps irreparable, consequence, and that the order can be effectually challenged only by immediate appeal, the general congressional policy against piecemeal review will preclude interlocutory appeal.” Carson v. American Brands, Inc., 450 U.S. 79, 84 (1981) (interior quotations removed). The movant seeking interlocutory appeal bears the burden of showing that all § 1292(b) requirements are satisfied and that the case is one of the rare exceptions in which the court should exercise judicial discretion to grant the remedy. See McFarlin, 381 F.3d at 1264. 3 DISCUSSION In its April and September Memorandum Opinions and Orders, this court found that certain Plaintiffs lacked Article III standing to sue based on theories of (1) overpayment for data security; (2) increased risk of becoming victims of identity theft, fraud, or abuse, where that risk is not accompanied by misuse of the stolen data; and (3) time and money spent to investigate and mitigate the increased risk of harm, where that risk is not accompanied by misuse of the stolen data. The Plaintiffs assert that each of these three questions based on this court’s rulings regarding standing meet all three elements of the standard for discretionary appellate review of non-final orders. According to Plaintiffs, they are controlling questions of law as to which substantial grounds exist for difference of opinion and immediate appeal may materially advance the ultimate termination of the litigation. The Defendants disagree that any of the three questions meet all elements of the 1292(b) standard. (1) Controlling Questions of Law The “controlling question of law” element has two components: first, the issue must be one of “pure law”; and second, the legal issue must be controlling to the litigation in district court. As to the pure law requirement, the Eleventh Circuit has stated that “§ 1292(b) appeals were intended, and should be reserved, for situations in which the court of appeals can rule on a pure, controlling question of law without having to delve beyond the surface of the record in order to determine the facts.” McFarlin, 381 F.3d at 1259. Put another way, “[t]he legal question must be stated at a high enough level of abstraction to lift the question out of the details of the evidence or facts of a particular case and give it general relevance to other cases in the 4 same area of law.” Id. The Eleventh Circuit has denied motions for interlocutory appeal when the determination “was too fact-intensive an inquiry for interlocutory review.” Id. at 1258 (giving examples of when interlocutory appeals were inappropriate because the ruling challenged did not involve a controlling question of law). The Sixth and Ninth Circuit Courts of Appeals have explained that, for the question of law to be controlling, the court must determine that “the resolution of the issue on appeal could materially affect the outcome of litigation in the district court.” In re City of Memphis, 293 F.3d 345, 352 (6th Cir. 2002) (quoting In re Cement Antitrust Litig., 673 F.2d 1020, 1026 (9th Cir. 1981)). The Plaintiffs argue that the questions they wish this court to certify for interlocutory appeal meet this criterion because they are standing issues, and if these standing decisions were erroneous, they would constitute reversible error. See, e.g., E.F. Hutton & Co., Inc. v. Hadley, 901 F.2d 979, 987 (11th Cir. 1990) (vacating the district court’s denial of the motion for summary judgment raising standing; the Court of Appeals remanded the case with instructions to the district court to dismiss the case for lack of standing). Defendants do not challenge the second and third questions presented for certification as controlling issues of law, but assert that the overpayment issue does not meet this criterion. a. Question Number One: Overpayment The Plaintiffs’ proposed question regarding overpayment states “that plaintiffs paid a third party for data security that was not provided.” As worded, the Eleventh Circuit could reasonably understand that the plaintiffs in fact paid a certain amount for data security and did not receive the security purchased. However, the facts alleged are that Plaintiffs paid health 5 providers for health care and that an indeterminate portion of those payments “was made for the protection of confidential patient data in Defendants’ allegedly secure computer network [and further, that the failure of Defendants] to secure and protect Plaintiffs’ . . . confidential patient data” means that the “Defendants’ retention of fees paid for that security and protection . . . represents an overpayment for which Plaintiff . . . should be compensated.” (Doc. 53, at 3 ¶ 10). The Plaintiffs do not allege that they paid anything specific for the protection; that patients who did not pay for services received or were offered a different level of protection from those who did pay; that Plaintiffs paid a premium for data protection or otherwise bargained for the protection; or that Plaintiffs received any information about data protection other than a HIPAA Notice that did not indicate any payment for protection was required. As worded, the Plaintiffs’ proposed question covers a broad range of circumstances, some of which afford standing and some of which this court found did not. For example, to the extent that plaintiffs paid a specific amount for security protection or otherwise bargained for security protection which they did not receive, they would presumably have an injury-in-fact for Article III standing purposes. In contrast, the proposed question also covers a set of circumstances where plaintiffs paid for other products and services, such as healthcare30 and food, and, in paying for those products and services, may expect, correctly or not, that an indeterminate amount of what they paid was for security protection of their personal data. Some courts, including this one, have found that the second set of circumstances does not afford injury-in-fact and Article III standing. See Memo Op. Doc. 144, at 15-16; see, e.g., other cases finding no standing: In re Zappos.com, Inc., 108 F. Supp. 3d 949, 962 n. 5 (D. Nev. 2015); In re Science Applications Int’l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 6 30 (D.D.C. 2014). Some Courts of Appeal did not specifically find that a claim based on the theory of overpayment would not support Article III standing, but acknowledged their doubts that it could do so: Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 968 (7th Cir. 2016); Remijas v. Neiman Marcus Group, 794 F.3d 688, 694-95 (7th Cir. 2015). But see Carlsen v. Gamestop, Inc., 833 F.3d 903, 908-09 (8th Cir. 2016) (acknowledging the district court’s rejection of standing based on an “overpayment” theory, but finding that standing existed because the plaintiff provided sufficient facts alleging that he was party to a binding contract). Therefore, the broad scope of the proposed question arguably places the Eleventh Circuit Court of Appeals in the inappropriate position of addressing a question that has, or may have, different answers depending on facts not provided. To meet the “controlling question of law” element, the proposed question “must be stated at a high enough level of abstraction to lift the question out of the details of the evidence or facts of a particular case.” See McFarlin, 381 F.3d at 1259. However, the level of abstraction must not be so high and broad that the Court of Appeals cannot give a definitive answer or must delve into a fact-intensive inquiry to limit the breadth of the inquiry and resulting answer. The Plaintiffs’ proposed question number one suffers from such overbreadth and, to provide a resolution that would be helpful to this case, would require an inquiry delving into facts not provided in the proposed question. Further, the proposed question arguably implies facts that are different from those in front of this court: that plaintiffs paid a specific amount for data protection or that the plaintiffs bargained for data protection when they paid for services. To the extent that the proposed question implies such facts that are not present in this litigation, an answer to the question would not control the litigation in this court and would not meet the “controlling question of law” 7 element. The court also notes that the question suffers from other wording problems that raise confusion. For example, when the question asks whether the Plaintiffs have Article III “standing to sue for the mishandling of the data by a third party,” does the term “third party” refer to the Defendants as third parties to the healthcare relationship, or to the thieves? Does the word “mishandling” refer to the Defendants’ alleged failure to protect the data, or to the theft itself? Because the Eleventh Circuit would be making a determination based on the precise question presented, the wording must be carefully crafted to provide a helpful answer that would control the outcome of this case for the dismissed Plaintiffs; this question is not so crafted. For all of these reasons, the court FINDS that proposed question number one regarding the overpayment issue does not meet the “controlling question of law” element and is not appropriate for interlocutory appeal; therefore, the court WILL DENY the motion as to this question. Recognizing that the Plaintiffs may be able to re-word proposed question number one to avoid the court’s problems with its certification, the court’s accompanying Order will give the Plaintiffs an opportunity to do so. b. Questions Number Two (Increased Risk of Harm) and Three (Mitigation) Defendants do not challenge that questions number two and three meet the “controlling question of law” requirement of § 1292(b). In light of the court’s subsequent rulings that questions number two and three do not meet the § 1292(b) requirements on issues that Defendants do raise, the court does not specifically make a finding on this issue. (2) Substantial Grounds for Difference of Opinion The second element for a successful interlocutory appeal is the existence of substantial 8 grounds for a difference of opinion on the question. “The antithesis of a proper § 1292(b) appeal is one that turns on whether . . . the district court properly applied settled law to the facts or evidence of a particular case.” McFarlin, 381 F.2d at 1259. Rather, the question should be one on which courts have reached different decisions, or the question should be one of first impression or particularly difficult. See Reese v. BP Exploration (Alaska) Inc., 643 F.3d 681, 688 (9th Cir. 2011) (explaining that interlocutory appeal is appropriate for questions about which “fair-minded jurists might reach contradictory conclusions”); Klinghoffer v. S.N.C. Achille Lauro, 921 F.2d 21, 25 (2d Cir. 1990) (pointing to question that “are difficult and of first impression” as meeting the “substantial grounds for difference of opinion” element). The court will address this element as to proposed questions number two and three separately. a. Question Number Two: Increased Risk of Harm The Plaintiffs’ second question addresses the court’s ruling that those Plaintiffs who have alleged that their confidential patient data was stolen by data thieves but not yet misused have no standing. As this court acknowledged in its September 12, 2016 Memorandum Opinion addressing this standing issue, a split exists in the Circuit Courts of Appeal that have addressed it. Compare cases finding standing, e.g.: Remijas, 794 F.3d at 690 (concluding that increased risk of fraudulent credit- or debit-card charges and increased risk of identity theft were “certainly impending” future harm sufficient to establish standing); Krottner v. Starbucks Corp., 628 F.3d 1139, 1142-43 (9th Cir. 2010) (finding that Starbucks employees whose names, addresses and social security numbers stored on a laptop that was stolen met standing requirement despite lack of misuse of employees’ data); Galaria v. Nationwide Mutual Ins. Co., ___ F. App’x ____, 2016 WL 4728027, at *3-5 (6th Cir. Sept. 12, 2016) (finding where plaintiffs data was stolen but not 9 yet misused and where they had reasonably incurred mitigation costs, they had Article III standing to pursue negligence and bailment claims); with cases finding no standing, e.g: Beck v. McDonald, ___ F.3d ___, 2017 WL 477781, at *7-9 (4th Cir. Feb. 6, 2017) (affirming district court dismissal of plaintiffs’ claims for lack of subject matter jurisdiction based on the harm from the increased risk of future identity theft); Katz v. Pershing, LLC, 672 F.3d 64, 80 (1st Cir. 2012) (brokerage account holder’s increased risk of unauthorized access and identity theft theory was insufficient to constitute “actual or impending injury,” because the plaintiff failed to “identify any incident in which her data has ever been accessed by an unauthorized person”); Reilly v. Ceridian Corp., 664 F.3d 38, 42-43 (3d Cir. 2011) (affirming the district court’s dismissal for lack of standing based on an increased risk of harm when unaccompanied by misuse). The Eleventh Circuit has not chosen a side in this fray. See Resnick, 693 F.3d at 1323 n. 1 (“As Plaintiffs have alleged only actual–not speculative– identity theft, we need not address the issue of whether speculative identity theft would be sufficient to confer standing.”). Therefore, the court has no guidance regarding on which side of the split the Eleventh Circuit would fall. As these cases make abundantly clear, a substantial difference of opinion exists regarding whether increased risk of harm after a data breach without accompanying misuse of the data is an injury-in-fact sufficient to confer standing. If the wording of question number two presented that issue in an appropriate way, the court would consider finding that question number two met this element for purposes of interlocutory appeal, and it would proceed to evaluate whether such appeal may materially advance the ultimate termination of the litigation, which it probably would. However, the wording of the question is not appropriate. The question states that Plaintiffs have alleged that 10 “they are themselves at a substantially increased risk of harm.” Here is the rub: the question contains an improper conclusion by characterizing the risk as substantial. The Plaintiffs could not properly allege that the risk at issue is a substantial one, without stating facts supporting that conclusion; conclusions without supporting facts do not meet the Supreme Court’s pleading standards of Ashcroft v. Iqbal, 556 U.S. 662, 678-79 (2009). This court found that the pleadings did not include sufficient facts to support their conclusion given the limited type of information stolen. So, when the question presented for certification includes a statement that the Plaintiffs alleged a substantially increased risk of harm, the Plaintiffs are asking the court to confirm a finding that the court did not in fact find. Rather, the court found that the factual allegations regarding Plaintiffs’ increased risk of becoming victims of identity theft crimes were insufficient to meet the substantial risk of harm standard where that risk was not accompanied by misuse of the stolen data. (Memo Op. Doc. 144, at 21). Put another way, Plaintiffs beg the question. The question asks, in effect, whether the Plaintiffs’ conclusory allegations that they faced substantial risk of harm would meet the substantial risk of harm test for standing, a circular question. To establish standing in a “increased risk of harm” case, the Supreme Court has explained that a plaintiff must meet one of two standards, the “substantial risk” of harm standard or the “certainly impending” harm standard. See Susan B. Anthony List v. Driehaus, ___ U.S. __, 134 S. Ct. 2334, 2342-46 (2004); Clapper v. Amnesty Intern., USA, ___ U.S. ___, 133 S. Ct. 1138, 1147-49 & 1150 n. 5 (2013). Therefore, the question as worded assumes their allegations meet one of the standards, the “substantial risk” standard. While certification of that question might seem to be a “slam dunk” for a successful 11 appeal, the court cannot certify that their factual allegations met this standard. To the contrary, this court found that they did not, and the fact assumed in the question is actually part of the issue to be resolved. In addition to this problem with question number two, the question also includes the imprecise phrase, “mishandling of the data by a third party,” discussed above regarding question number one. Consistent with its treatment of question number one, the court WILL DENY the motion as to question number two, but will give the Plaintiffs an opportunity to re-word that question. b. Question Number Three: Mitigation The mitigation issue works in tandem with increased risk of harm. In Clapper, the Supreme Court explained that plaintiffs “cannot manufacture standing by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” 133 S. Ct. at 1151. Thus, the Supreme Court has answered the question of whether mitigation costs, standing alone without accompanying risk of harm that is substantial or certainly impending, confer standing; they cannot, even if the fear of harm is reasonable. The Court has said that the key issue is whether the harm is certainly impending or the risk of harm is substantial. If the answer to either part of that key issue is yes, then accompanying mitigation costs constitute injury-in-fact; if the answer to both parts is no, then mitigation costs, no matter how substantial, cannot alone support standing because a plaintiff cannot manufacture standing by guarding against a risk that is neither substantial nor certainly impending. See id. at 151 & n. 5 (citing cases finding “standing based on a ‘substantial risk’ that the harm will occur, which may prompt plaintiffs to reasonably incur costs to mitigate or avoid that harm”): Monsanto Co. v. Geertson 12 Seed Farms, 561 U.S. 139, 153-56 (2010); Blum v. Yaretsky, 457 U.S. 991, 1000-1001 (1982); Babbitt v. Farm Workers, 442 U.S. 289, 298 (1979)). Thus, in this proceeding, when the Plaintiffs attempt to separate the standing issue regarding mitigation costs from that of the substantial risk of harm, they are ignoring the Supreme Court’s directive in Clapper. This court can find no substantial difference of opinion regarding whether the mitigation costs, standing alone, constitute injury-in-fact sufficient to confer standing. The difference of opinion lies in whether the increased risk from the data breach without misuse of the stolen data meets the standard, and however that question is answered, accompanying mitigation costs receive the same answer. Therefore, the court FINDS that question number three does not meet the “substantial difference of opinion” element; the court WILL DENY the motion as to question number three. Because re-wording question number three will not solve the problem, the court will not give the Plaintiffs that opportunity. Because the court has found that the motion is due to be DENIED as to all three questions based on the failure to meet at least one of the first two elements of § 1292(b), the court need not address the third element, whether interlocutory appeal will materially advance the ultimate termination of the litigation.3 Dated this fifteenth day of February, 2017. ____________________________________ KARON OWEN BOWDRE CHIEF UNITED STATES DISTRICT JUDGE 3 However, the court notes that, without specifically addressing and deciding the “materially advance” element, the court is inclined to view favorably an argument that interlocutory appeal of the “increased risk of harm without misuse” issue, if properly phrased, would most likely materially advance this litigation’s ultimate termination. 13

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.


Why Is My Information Online?