In re Community Health Systems Inc., MDL 2595

Filing 166

MEMORANDUM OPINION Signed by Chief Judge Karon O Bowdre on 2/15/17. (SAC )

FILED
2017 Feb-15 PM 03:54
U.S. DISTRICT COURT
N.D. OF ALABAMA

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF ALABAMA
SOUTHERN DIVISION

IN RE: COMMUNITY HEALTH
SYSTEMS, INC.,
CUSTOMER SECURITY DATA
BREACH LITIGATION
(MDL 2595)

)
)
)
)
)
)
)

MASTER FILE NO.
15-CV-222-KOB

This document relates to all cases.

MEMORANDUM OPINION
This case is before the court on “Plaintiffs’ Renewed1 Motion for Certification for
Interlocutory Appeal.” (Doc. 154). The Plaintiffs present three proposed questions for
interlocutory appeal. Defendant PSC has filed an opposition to this motion (doc. 160), as has
Defendant CHSI (doc. 161). The Plaintiffs filed an omnibus reply. (Doc. 165).
For the reasons set out in this Memorandum Opinion, the court FINDS that the motion is
due to be DENIED as to all three questions. Although the court believes that important legal
questions as to the Plaintiffs’ standing may be appropriate for interlocutory appeal, the questions

1

On March 31, 2016, the Plaintiffs filed their first Motion for Certification of
Interlocutory Appeal (doc. 118) based on the court’s February 17, 2016 Order (doc. 95), ruling
on certain jurisdictional issues asserted in Defendants’ motions to dismiss. The court withdrew
(doc. 124) the February 17, 2016 Order and substituted a new Partial Order on Motions to
Dismiss dated April 14, 2016 (doc. 125). After the April 15, 2016 hearing on remaining parts of
the motions to dismiss, the court held a conference and discussed the Plaintiffs’ withdrawing
their motion for certification of interlocutory appeal until after the court entered orders ruling on
the remaining parts of the pending motions to dismiss. As a result, the Plaintiffs withdrew the
original motion for certification of interlocutory appeal with the express intention of re-filing it
following the court’s resolution of all issues raised in the motions to dismiss. (Doc. 128). On
September 12, 2016, the court entered an order (doc. 145) on the remaining issues asserted in the
motions to dismiss, and the Plaintiffs subsequently filed the pending renewed motion for
certification of interlocutory appeal.
1

as phrased are not they.
PROPOSED QUESTIONS FOR CERTIFICATION
Plaintiffs request that this court certify the following three questions to the Eleventh
Circuit Court of Appeals:
(1) Whether plaintiffs who have alleged that their confidential patient data was
stolen by data thieves, but not yet misused, have Article III standing to sue for
the mishandling of the data by a third party, when plaintiffs also allege that
other individuals’ confidential patient data obtained by data thieves through
the same security breach has already been misused and that plaintiffs paid a
third party for data security that was not provided (i.e., standing based on
overpayment).
(2) Whether plaintiffs who have alleged that their confidential patient data was
stolen by data thieves, but not yet misused, have Article III standing to sue for
the mishandling of the data by a third party, when plaintiffs also allege that
other individuals’ confidential patient data obtained by the data thieves
through the same security breach has already been misused and they are
themselves at a substantially2 increased risk of harm (i.e. standing based on
increased risk of harm).
(3) Whether plaintiffs who have alleged that their confidential patient data was
stolen by data thieves, but not yet misused, have Article III standing to sue for
the mishandling of the data by a third party where plaintiffs also allege that
other individuals’ confidential patient data obtained by the data thieves
through the same security breach has already been misused, that the third party
recommended that plaintiffs take measures to mitigate the risk of identity theft
or other misuse of the stolen data, and that plaintiffs incurred time and
monetary expense to undertake such mitigation measures (i.e. standing based
on mitigation).
STANDARD OF REVIEW
Section 1292(b) of title 28 of the United States Code explains when a district judge may
certify for interlocutory appeal an order that is not otherwise appealable:

2

The court notes that the Plaintiffs have invoked the “substantial risk” of harm standard,
and not the “certainly impending” standard.
2

When a district judge, in making in a civil action an order not otherwise
appealable under this section, shall be of the opinion that such order involves a
controlling question of law as to which there is substantial ground of difference
of opinion and that an immediate appeal from the order may materially advance
the ultimate termination of the litigation, he shall so state in writing in such
order.
28 U.S.C. § 1292(b). The “screening procedure” of requiring consent from the trial judge
“serves the dual purpose of ensuring that such review will be confined to appropriate cases and
avoiding time-consuming jurisdictional determinations in the court of appeals.” Coopers &
Lybrand v. Livesay, 437 U.S. 463, 474-75 (1978). Only “exceptional circumstances justify a
departure from the basic policy of postponing appellate review until after the entry of a final
judgment.” Id at 475.
The Eleventh Circuit explained that Ҥ 1292(b) sets a high threshold for certification to
prevent piecemeal appeals.” OFS Fitel, LLC v. Epstein, Becker and Green, P.C., 549 F.3d 1344,
1359 (11th Cir. 2008). “Because permitting piecemeal appeals is bad policy, permitting liberal
use of § 1292(b) is bad policy.” McFarlin v. Conseco Servs., LLC, 381 F.3d 1251, 1259 (11th
Cir. 2004) . “Unless a litigant can show that an interlocutory order of the district court might
have a serious, perhaps irreparable, consequence, and that the order can be effectually challenged
only by immediate appeal, the general congressional policy against piecemeal review will
preclude interlocutory appeal.” Carson v. American Brands, Inc., 450 U.S. 79, 84 (1981)
(interior quotations removed). The movant seeking interlocutory appeal bears the burden of
showing that all § 1292(b) requirements are satisfied and that the case is one of the rare
exceptions in which the court should exercise judicial discretion to grant the remedy. See
McFarlin, 381 F.3d at 1264.

3

DISCUSSION
In its April and September Memorandum Opinions and Orders, this court found that
certain Plaintiffs lacked Article III standing to sue based on theories of (1) overpayment for data
security; (2) increased risk of becoming victims of identity theft, fraud, or abuse, where that risk
is not accompanied by misuse of the stolen data; and (3) time and money spent to investigate and
mitigate the increased risk of harm, where that risk is not accompanied by misuse of the stolen
data.
The Plaintiffs assert that each of these three questions based on this court’s rulings
regarding standing meet all three elements of the standard for discretionary appellate review of
non-final orders. According to Plaintiffs, they are controlling questions of law as to which
substantial grounds exist for difference of opinion and immediate appeal may materially advance
the ultimate termination of the litigation. The Defendants disagree that any of the three questions
meet all elements of the 1292(b) standard.
(1) Controlling Questions of Law
The “controlling question of law” element has two components: first, the issue must be
one of “pure law”; and second, the legal issue must be controlling to the litigation in district
court. As to the pure law requirement, the Eleventh Circuit has stated that Ҥ 1292(b) appeals
were intended, and should be reserved, for situations in which the court of appeals can rule on a
pure, controlling question of law without having to delve beyond the surface of the record in
order to determine the facts.” McFarlin, 381 F.3d at 1259. Put another way, “[t]he legal
question must be stated at a high enough level of abstraction to lift the question out of the details
of the evidence or facts of a particular case and give it general relevance to other cases in the
4

same area of law.” Id. The Eleventh Circuit has denied motions for interlocutory appeal when
the determination “was too fact-intensive an inquiry for interlocutory review.” Id. at 1258
(giving examples of when interlocutory appeals were inappropriate because the ruling challenged
did not involve a controlling question of law).
The Sixth and Ninth Circuit Courts of Appeals have explained that, for the question of
law to be controlling, the court must determine that “the resolution of the issue on appeal could
materially affect the outcome of litigation in the district court.” In re City of Memphis, 293 F.3d
345, 352 (6th Cir. 2002) (quoting In re Cement Antitrust Litig., 673 F.2d 1020, 1026 (9th Cir.
1981)).
The Plaintiffs argue that the questions they wish this court to certify for interlocutory
appeal meet this criterion because they are standing issues, and if these standing decisions were
erroneous, they would constitute reversible error. See, e.g., E.F. Hutton & Co., Inc. v. Hadley,
901 F.2d 979, 987 (11th Cir. 1990) (vacating the district court’s denial of the motion for
summary judgment raising standing; the Court of Appeals remanded the case with instructions to
the district court to dismiss the case for lack of standing). Defendants do not challenge the second
and third questions presented for certification as controlling issues of law, but assert that the
overpayment issue does not meet this criterion.
a. Question Number One: Overpayment
The Plaintiffs’ proposed question regarding overpayment states “that plaintiffs paid a
third party for data security that was not provided.” As worded, the Eleventh Circuit could
reasonably understand that the plaintiffs in fact paid a certain amount for data security and did
not receive the security purchased. However, the facts alleged are that Plaintiffs paid health
5

providers for health care and that an indeterminate portion of those payments “was made for the
protection of confidential patient data in Defendants’ allegedly secure computer network [and
further, that the failure of Defendants] to secure and protect Plaintiffs’ . . . confidential patient
data” means that the “Defendants’ retention of fees paid for that security and protection . . .
represents an overpayment for which Plaintiff . . . should be compensated.” (Doc. 53, at 3 ¶ 10).
The Plaintiffs do not allege that they paid anything specific for the protection; that patients who
did not pay for services received or were offered a different level of protection from those who
did pay; that Plaintiffs paid a premium for data protection or otherwise bargained for the
protection; or that Plaintiffs received any information about data protection other than a HIPAA
Notice that did not indicate any payment for protection was required.
As worded, the Plaintiffs’ proposed question covers a broad range of circumstances, some
of which afford standing and some of which this court found did not. For example, to the extent
that plaintiffs paid a specific amount for security protection or otherwise bargained for security
protection which they did not receive, they would presumably have an injury-in-fact for Article
III standing purposes. In contrast, the proposed question also covers a set of circumstances
where plaintiffs paid for other products and services, such as healthcare30
and food, and, in paying for those products and services, may expect, correctly or not, that an
indeterminate amount of what they paid was for security protection of their personal data.
Some courts, including this one, have found that the second set of circumstances does not
afford injury-in-fact and Article III standing. See Memo Op. Doc. 144, at 15-16; see, e.g., other
cases finding no standing: In re Zappos.com, Inc., 108 F. Supp. 3d 949, 962 n. 5 (D. Nev. 2015);
In re Science Applications Int’l Corp. (SAIC) Backup Tape Data Theft Litig., 45 F. Supp. 3d 14,
6

30 (D.D.C. 2014). Some Courts of Appeal did not specifically find that a claim based on the
theory of overpayment would not support Article III standing, but acknowledged their doubts that
it could do so: Lewert v. P.F. Chang’s China Bistro, Inc., 819 F.3d 963, 968 (7th Cir. 2016);
Remijas v. Neiman Marcus Group, 794 F.3d 688, 694-95 (7th Cir. 2015). But see Carlsen v.
Gamestop, Inc., 833 F.3d 903, 908-09 (8th Cir. 2016) (acknowledging the district court’s
rejection of standing based on an “overpayment” theory, but finding that standing existed
because the plaintiff provided sufficient facts alleging that he was party to a binding contract).
Therefore, the broad scope of the proposed question arguably places the Eleventh Circuit
Court of Appeals in the inappropriate position of addressing a question that has, or may have,
different answers depending on facts not provided. To meet the “controlling question of law”
element, the proposed question “must be stated at a high enough level of abstraction to lift the
question out of the details of the evidence or facts of a particular case.” See McFarlin, 381 F.3d
at 1259. However, the level of abstraction must not be so high and broad that the Court of
Appeals cannot give a definitive answer or must delve into a fact-intensive inquiry to limit the
breadth of the inquiry and resulting answer. The Plaintiffs’ proposed question number one
suffers from such overbreadth and, to provide a resolution that would be helpful to this case,
would require an inquiry delving into facts not provided in the proposed question.
Further, the proposed question arguably implies facts that are different from those in front
of this court: that plaintiffs paid a specific amount for data protection or that the plaintiffs
bargained for data protection when they paid for services. To the extent that the proposed
question implies such facts that are not present in this litigation, an answer to the question would
not control the litigation in this court and would not meet the “controlling question of law”
7

element.
The court also notes that the question suffers from other wording problems that raise
confusion. For example, when the question asks whether the Plaintiffs have Article III “standing
to sue for the mishandling of the data by a third party,” does the term “third party” refer to the
Defendants as third parties to the healthcare relationship, or to the thieves? Does the word
“mishandling” refer to the Defendants’ alleged failure to protect the data, or to the theft itself?
Because the Eleventh Circuit would be making a determination based on the precise question
presented, the wording must be carefully crafted to provide a helpful answer that would control
the outcome of this case for the dismissed Plaintiffs; this question is not so crafted.
For all of these reasons, the court FINDS that proposed question number one regarding
the overpayment issue does not meet the “controlling question of law” element and is not
appropriate for interlocutory appeal; therefore, the court WILL DENY the motion as to this
question. Recognizing that the Plaintiffs may be able to re-word proposed question number one
to avoid the court’s problems with its certification, the court’s accompanying Order will give the
Plaintiffs an opportunity to do so.
b. Questions Number Two (Increased Risk of Harm) and Three (Mitigation)
Defendants do not challenge that questions number two and three meet the “controlling
question of law” requirement of § 1292(b). In light of the court’s subsequent rulings that
questions number two and three do not meet the § 1292(b) requirements on issues that
Defendants do raise, the court does not specifically make a finding on this issue.
(2) Substantial Grounds for Difference of Opinion
The second element for a successful interlocutory appeal is the existence of substantial
8

grounds for a difference of opinion on the question. “The antithesis of a proper § 1292(b) appeal
is one that turns on whether . . . the district court properly applied settled law to the facts or
evidence of a particular case.” McFarlin, 381 F.2d at 1259. Rather, the question should be one
on which courts have reached different decisions, or the question should be one of first
impression or particularly difficult. See Reese v. BP Exploration (Alaska) Inc., 643 F.3d 681,
688 (9th Cir. 2011) (explaining that interlocutory appeal is appropriate for questions about which
“fair-minded jurists might reach contradictory conclusions”); Klinghoffer v. S.N.C. Achille
Lauro, 921 F.2d 21, 25 (2d Cir. 1990) (pointing to question that “are difficult and of first
impression” as meeting the “substantial grounds for difference of opinion” element). The court
will address this element as to proposed questions number two and three separately.
a. Question Number Two: Increased Risk of Harm
The Plaintiffs’ second question addresses the court’s ruling that those Plaintiffs who have
alleged that their confidential patient data was stolen by data thieves but not yet misused have no
standing. As this court acknowledged in its September 12, 2016 Memorandum Opinion
addressing this standing issue, a split exists in the Circuit Courts of Appeal that have addressed
it. Compare cases finding standing, e.g.: Remijas, 794 F.3d at 690 (concluding that increased
risk of fraudulent credit- or debit-card charges and increased risk of identity theft were “certainly
impending” future harm sufficient to establish standing); Krottner v. Starbucks Corp., 628 F.3d
1139, 1142-43 (9th Cir. 2010) (finding that Starbucks employees whose names, addresses and
social security numbers stored on a laptop that was stolen met standing requirement despite lack
of misuse of employees’ data); Galaria v. Nationwide Mutual Ins. Co., ___ F. App’x ____, 2016
WL 4728027, at *3-5 (6th Cir. Sept. 12, 2016) (finding where plaintiffs data was stolen but not
9

yet misused and where they had reasonably incurred mitigation costs, they had Article III
standing to pursue negligence and bailment claims); with cases finding no standing, e.g: Beck v.
McDonald, ___ F.3d ___, 2017 WL 477781, at *7-9 (4th Cir. Feb. 6, 2017) (affirming district
court dismissal of plaintiffs’ claims for lack of subject matter jurisdiction based on the harm from
the increased risk of future identity theft); Katz v. Pershing, LLC, 672 F.3d 64, 80 (1st Cir. 2012)
(brokerage account holder’s increased risk of unauthorized access and identity theft theory was
insufficient to constitute “actual or impending injury,” because the plaintiff failed to “identify
any incident in which her data has ever been accessed by an unauthorized person”); Reilly v.
Ceridian Corp., 664 F.3d 38, 42-43 (3d Cir. 2011) (affirming the district court’s dismissal for
lack of standing based on an increased risk of harm when unaccompanied by misuse).
The Eleventh Circuit has not chosen a side in this fray. See Resnick, 693 F.3d at 1323 n.
1 (“As Plaintiffs have alleged only actual–not speculative– identity theft, we need not address the
issue of whether speculative identity theft would be sufficient to confer standing.”). Therefore,
the court has no guidance regarding on which side of the split the Eleventh Circuit would fall.
As these cases make abundantly clear, a substantial difference of opinion exists regarding
whether increased risk of harm after a data breach without accompanying misuse of the data is an
injury-in-fact sufficient to confer standing.
If the wording of question number two presented that issue in an appropriate way, the
court would consider finding that question number two met this element for purposes of
interlocutory appeal, and it would proceed to evaluate whether such appeal may materially
advance the ultimate termination of the litigation, which it probably would. However, the
wording of the question is not appropriate. The question states that Plaintiffs have alleged that
10

“they are themselves at a substantially increased risk of harm.”
Here is the rub: the question contains an improper conclusion by characterizing the risk as
substantial. The Plaintiffs could not properly allege that the risk at issue is a substantial one,
without stating facts supporting that conclusion; conclusions without supporting facts do not
meet the Supreme Court’s pleading standards of Ashcroft v. Iqbal, 556 U.S. 662, 678-79 (2009).
This court found that the pleadings did not include sufficient facts to support their conclusion
given the limited type of information stolen.

So, when the question presented for certification

includes a statement that the Plaintiffs alleged a substantially increased risk of harm, the
Plaintiffs are asking the court to confirm a finding that the court did not in fact find. Rather, the
court found that the factual allegations regarding Plaintiffs’ increased risk of becoming victims of
identity theft crimes were insufficient to meet the substantial risk of harm standard where that
risk was not accompanied by misuse of the stolen data. (Memo Op. Doc. 144, at 21).
Put another way, Plaintiffs beg the question. The question asks, in effect, whether the
Plaintiffs’ conclusory allegations that they faced substantial risk of harm would meet the
substantial risk of harm test for standing, a circular question. To establish standing in a
“increased risk of harm” case, the Supreme Court has explained that a plaintiff must meet one of
two standards, the “substantial risk” of harm standard or the “certainly impending” harm
standard. See Susan B. Anthony List v. Driehaus, ___ U.S. __, 134 S. Ct. 2334, 2342-46 (2004);
Clapper v. Amnesty Intern., USA, ___ U.S. ___, 133 S. Ct. 1138, 1147-49 & 1150 n. 5 (2013).
Therefore, the question as worded assumes their allegations meet one of the standards, the
“substantial risk” standard.
While certification of that question might seem to be a “slam dunk” for a successful
11

appeal, the court cannot certify that their factual allegations met this standard. To the contrary,
this court found that they did not, and the fact assumed in the question is actually part of the
issue to be resolved.
In addition to this problem with question number two, the question also includes the
imprecise phrase, “mishandling of the data by a third party,” discussed above regarding question
number one. Consistent with its treatment of question number one, the court WILL DENY the
motion as to question number two, but will give the Plaintiffs an opportunity to re-word that
question.
b. Question Number Three: Mitigation
The mitigation issue works in tandem with increased risk of harm. In Clapper, the
Supreme Court explained that plaintiffs “cannot manufacture standing by inflicting harm on
themselves based on their fears of hypothetical future harm that is not certainly impending.” 133
S. Ct. at 1151. Thus, the Supreme Court has answered the question of whether mitigation costs,
standing alone without accompanying risk of harm that is substantial or certainly impending,
confer standing; they cannot, even if the fear of harm is reasonable. The Court has said that the
key issue is whether the harm is certainly impending or the risk of harm is substantial. If the
answer to either part of that key issue is yes, then accompanying mitigation costs constitute
injury-in-fact; if the answer to both parts is no, then mitigation costs, no matter how substantial,
cannot alone support standing because a plaintiff cannot manufacture standing by guarding
against a risk that is neither substantial nor certainly impending. See id. at 151 & n. 5 (citing
cases finding “standing based on a ‘substantial risk’ that the harm will occur, which may prompt
plaintiffs to reasonably incur costs to mitigate or avoid that harm”): Monsanto Co. v. Geertson
12

Seed Farms, 561 U.S. 139, 153-56 (2010); Blum v. Yaretsky, 457 U.S. 991, 1000-1001 (1982);
Babbitt v. Farm Workers, 442 U.S. 289, 298 (1979)). Thus, in this proceeding, when the
Plaintiffs attempt to separate the standing issue regarding mitigation costs from that of the
substantial risk of harm, they are ignoring the Supreme Court’s directive in Clapper.
This court can find no substantial difference of opinion regarding whether the mitigation
costs, standing alone, constitute injury-in-fact sufficient to confer standing. The difference of
opinion lies in whether the increased risk from the data breach without misuse of the stolen data
meets the standard, and however that question is answered, accompanying mitigation costs
receive the same answer. Therefore, the court FINDS that question number three does not meet
the “substantial difference of opinion” element; the court WILL DENY the motion as to question
number three. Because re-wording question number three will not solve the problem, the court
will not give the Plaintiffs that opportunity.
Because the court has found that the motion is due to be DENIED as to all three questions
based on the failure to meet at least one of the first two elements of § 1292(b), the court need not
address the third element, whether interlocutory appeal will materially advance the ultimate
termination of the litigation.3
Dated this fifteenth day of February, 2017.

____________________________________
KARON OWEN BOWDRE
CHIEF UNITED STATES DISTRICT JUDGE
3

However, the court notes that, without specifically addressing and deciding the
“materially advance” element, the court is inclined to view favorably an argument that
interlocutory appeal of the “increased risk of harm without misuse” issue, if properly phrased,
would most likely materially advance this litigation’s ultimate termination.
13