Gallo v. Unknown Number of Identity Thieves et al

Filing 34

Order by Hon. Lucy H. Koh Granting 24 Motion to Remand and Awarding Attorney's Fees.(lhklc2S, COURT STAFF) (Filed on 5/31/2017)

1
2
3
4
5
6
7
8

UNITED STATES DISTRICT COURT

9

NORTHERN DISTRICT OF CALIFORNIA

10
SAN JOSE DIVISION

United States District Court
Northern District of California

11
12

DAVID J. GALLO,
Plaintiff,

13

16

ORDER GRANTING MOTION TO
REMAND

v.

14
15

Case No. 17-CV-01465-LHK

Re: Dkt. No. 754
UNKNOWN NUMBER OF IDENTITY
THIEVES, et al.,
Defendants.

17
18

Plaintiff David Gallo (“Gallo”) brings this case against an “Unknown Number of Identity

19

Thieves”; Anthem Blue Cross Life and Health Insurance Company (“Anthem Blue Cross”);

20

Compass Bank; American Express Company; Paypal, Inc.; Powerpay, LLC; and Does 1–100

21

(collectively, “Defendants”). Before the Court is Plaintiff’s motion to remand the case to the

22

Superior Court of California, County of San Diego (“San Diego County Superior Court”). ECF

23

No. 754.

24

Having considered the submissions of the parties, the relevant law, and the record in this

25

case, the Court GRANTS Plaintiff’s motion to remand the case to San Diego County Superior

26

Court.

27

I.

28

BACKGROUND
1

Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1
2
3
4
5
6
7
8
9
10

United States District Court
Northern District of California

11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

A. Factual Background
Defendant David Gallo is a solo practitioner attorney based in the state of California.
Compl. ¶¶ 3, 11. In 1995, Gallo obtained health insurance through the State Bar of California
Group Health Insurance Program (“State Bar”) from Blue Cross of California. Id. 12. “[I]n or
around the late 1990s,” the State Bar stopped offering group insurance plans, and so Gallo
purchased an individual plan. Id. ¶ 14. At some point, Gallo alleges that Blue Cross of California
became Anthem Blue Cross, which Gallo alleges has been located in Del Mar, California since
1998. Id. ¶¶ 15, 20.
On December 28, 2016, Gallo’s offices were contacted by an attorney who stated that his
American Express Credit Card contained an unwarranted $4,000 charge to Gallo’s law offices. Id.
¶¶ 22–23. After Gallo investigated the incident, a company known as “LawPay” informed Gallo
that unknown identity thieves had opened a credit card merchant account in Gallo’s name using
Gallo’s correct residence address, business address, and social security number. Id. ¶ 28. The
identity thieves had used this account to defraud LawPay and numerous victims of thousands of
dollars. Id. Gallo called Compass Bank, where the merchant account was located, to report that
this account was fraudulent, but Compass Bank has refused to confirm or deny that any account
was opened in Gallo’s name. Id. ¶ 29–30.
In January 2017, Gallo was contacted by Powerpay, who informed Gallo that identity
thieves had opened a credit card merchant account with “one of Powerpay’s fictitious business
account names” using Gallo’s personal data. Id. ¶ 33. On January 10, 2017, Gallo was contacted
by another victim who claimed that he had been charged $415.00 by Gallo’s office through
Paypal. Id. ¶ 35. On January 22, 2017, Paypal stated that a fraudulent Paypal account had been
created for Gallo, but Paypal concluded that the fraud was “perpetrated by a member of Plaintiff’s
family.” Id. ¶ 36. Gallo instead alleges that this account was created by the unknown identity
thieves. Id.
In January 2017, Gallo was also contacted by an attorney who told Gallo that a fraudulent
LawPay account had been set up for the attorney using the attorney’s personal information. Id. ¶
2
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

43. The attorney also stated that she believed that her personal information had been stolen during

2

the hack of Anthem and Anthem affiliates. Id. Gallo alleges that this is the first time that he

3

learned that Anthem or any of its affiliates had been hacked. Id. ¶ 44. Gallo alleges that this hack

4

was the source of his personal information used by the identity thieves to open the fraudulent

5

accounts. Id. ¶ 45.

6
7

B. Procedural History
Gallo filed the complaint in this case on January 23, 2017. ECF No. 1-2. The complaint
asserts six causes of action under California law: (1) an injunction pursuant to California Business

9

& Professions Code §§ 17200, et seq., against the identity thieves; (2) a common law claim for

10

invasion of privacy against the identity thieves; (3) a claim for common law negligence against

11
United States District Court
Northern District of California

8

Anthem Blue Cross; (4) a claim for violation of Civil Code §§ 1798.80 against Anthem Blue

12

Cross; (5) a claim for declaratory relief against Compass Bank, American Express, Paypal, and

13

Powerpay; and (6) a claim for common law negligence against Compass Bank, American Express,

14

Paypal, and Powerpay. Id.

15

On February 21, 2017, Defendant Anthem Blue Cross removed this action to the United

16

States District Court for the Southern District of California. ECF No. 1. In the notice of removal,

17

Anthem Blue Cross proffered two bases for subject matter jurisdiction in federal court: (1) federal

18

question jurisdiction under 28 U.S.C. § 1331 based on the fact that “Plaintiff’s state law claims

19

implicate substantial federal interests” based on national security interests and the Health

20

Insurance Portability and Accountability Act of 1996 (“HIPAA”); and (2) federal question

21

jurisdiction under 28 U.S.C. § 1331 and the Employee Retirement Income Security Act

22

(“ERISA”), 29 U.S.C. §§ 1001, et seq. Id. at 5–7.

23

On March 21, 2017, Gallo filed the instant motion to remand. ECF No. 24. On April 5,

24

2017, Anthem Blue Cross filed an opposition to the motion to remand in the Multi-District

25

Litigation, In re Anthem, Inc. Data Breach Litigation, Case No. 5:15-MD-02617-LHK, before the

26
27
28

3
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

undersigned judge (“Anthem MDL”). ECF No. 774.1 On April 12, 2017, Gallo filed a reply. ECF

2

No. 31.

3

II.

LEGAL STANDARD
A suit may be removed from state court to federal court only if the federal court would

4
5

have had subject matter jurisdiction over the case in the first instance. 28 U.S.C. § 1441(a); see

6

Caterpillar Inc. v. Williams, 482 U.S. 386, 392 (1987) (“Only state-court actions that originally

7

could have been filed in federal court may be removed to federal court by the defendant.”). “In

8

civil cases, subject matter jurisdiction is generally conferred upon federal district courts either

9

through diversity jurisdiction, 28 U.S.C. § 1332, or federal question jurisdiction, 28 U.S.C.
§ 1331.” Peralta v. Hispanic Bus., Inc., 419 F.3d 1064, 1068 (9th Cir. 2005). If it appears at any

11
United States District Court
Northern District of California

10

time before final judgment that the federal court lacks subject matter jurisdiction, the federal court

12

must remand the action to state court. 28 U.S.C. § 1447(c).
The party seeking removal bears the burden of establishing federal jurisdiction. Provincial

13
14

Gov’t of Marinduque v. Placer Dome, Inc., 582 F.3d 1083, 1087 (9th Cir. 2009). “The removal

15

statute is strictly construed, and any doubt about the right of removal requires resolution in favor

16

of remand.” Moore-Thomas v. Alaska Airlines, Inc., 553 F.3d 1241, 1244 (9th Cir. 2009) (citing

17

Gaus v. Miles, Inc., 980 F.2d 564, 566 (9th Cir. 1992)).

18

III.

DISCUSSION
In their notice of removal, Anthem Blue Cross asserted two grounds for removal: (1)

19
20

federal question jurisdiction under 28 U.S.C. § 1331 based on the fact that “Plaintiff’s state law

21

claims implicate substantial federal interests” because the Anthem data breach implicates national

22

security interests and the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”);

23

and (2) federal question jurisdiction under 28 U.S.C. § 1331 and the Employee Retirement Income

24

Security Act (“ERISA”), 29 U.S.C. §§ 1001, et seq. ECF No. 1, at 5–7. However, in their

25
26
27
28

1

After removal, the instant case was transferred to the Anthem MDL on March 17, 2017. Anthem
Blue Cross filed their opposition to the motion to remand only in the Anthem MDL case and did
not file the opposition in the individual case, Gallo v. Unknown Identity Thieves, Case No. 17-CV01465-LHK.
4
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

opposition to the motion to remand, Anthem Blue Cross abandons its ERISA preemption

2

argument. The opposition also raises for the first time the argument that “it is only because

3

Plaintiff (either intentionally or inadvertently) named the wrong entity as a defendant that this

4

Court lacks diversity jurisdiction over Plaintiff’s claims.” ECF No. 774, at 3.
The Court first considers the issue of diversity jurisdiction. The Court then considers the

5
6

issues of national security interests, ERISA, and HIPAA in turn. Finally, the Court considers

7

Gallo’s argument that he is entitled to attorney’s fees under 28 U.S.C. § 1447(c) because Anthem

8

Blue Cross “lacked an objectively reasonable basis for seeking removal.” Mot. at 14.

9

A. Diversity
Under 28 U.S.C. § 1332(a)(1), federal courts have original jurisdiction over civil actions

10

United States District Court
Northern District of California

11

“where the matter in controversy exceeds the sum or value of $75,000 . . . and is between . . .

12

citizens of different States.” 28 U.S.C. § 1332. A “core principle of federal removal jurisdiction on

13

the basis of diversity . . . is [that it is] determined (and must exist) as of the time the complaint is

14

filed and removal is effected.” Strotek Corp. v. Air Transport Ass’n of Am., 300 F.3d 1129, 1131

15

(9th Cir. 2002). “28 U.S.C. § 1332 requires that the parties be in complete diversity and the

16

amount in controversy exceed $75,000.” Matheson v. Progressive Specialty Ins. Co., 319 F.3d

17

1089, 1090 (9th Cir. 2003) (per curiam). However, fraudulently joined defendants who destroy

18

diversity do not defeat removal. McCabe v. Gen. Foods Corp., 811 F.2d 1336, 1339 (9th Cir.

19

1987).

20

Gallo is a citizen of California and has sued Anthem Blue Cross, which is a California

21

corporation. Compl. ¶ 5. However, Anthem Blue Cross argues that “it is only because Plaintiff

22

(either intentionally or inadvertently) named the wrong entity as a defendant that this Court lacks

23

diversity jurisdiction over Plaintiff’s claims.” Opp. at 3. Specifically, Anthem Blue Cross states

24

that “Plaintiff did not name Anthem, an Indiana corporation, as a defendant, even though the

25

Complaint itself alleges that Anthem was the entity that possessed Plaintiff’s personal information,

26

failed to take appropriate steps to protect that information, and suffered the data breach.” Id.

27
28

However, a close reading of Gallo’s complaint makes clear that the complaint never refers
5
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

to Anthem, Inc. Instead, in paragraph 5 of the complaint, Gallo names Anthem Blue Cross as a

2

defendant and then defines Anthem Blue Cross as “Anthem” for the purposes of the complaint.

3

Compl. ¶ 5 (“Anthem Blue Cross Life and Health Insurance Company (hereinafter, ‘Anthem’), is

4

a corporation organized and existing under the laws of the State of California.”). Thus, all

5

references to “Anthem” in the complaint are references to Anthem Blue Cross, a California

6

corporation.
There is no reason to believe that Gallo improperly sued Anthem Blue Cross. Anthem Blue

7
8

Cross is the successor of the entity from which Gallo purchased his health insurance and to which

9

Gallo provided his personal information. Compl. ¶¶ 14–15. As such, Gallo alleges that Anthem
Blue Cross is liable for common law negligence and violation of California Civil Code §§

11
United States District Court
Northern District of California

10

1798.80, et seq., because Anthem Blue Cross failed to adequately protect Gallo’s personal

12

information from disclosure. Compl. ¶¶ 51–55. Anthem Blue Cross offers no reason to believe that

13

this claim is improper or that Anthem Blue Cross is fraudulently joined. Because Anthem Blue

14

Cross is a California corporation, as long as Anthem Blue Cross remains in the case there is no

15

diversity jurisdiction.
In short, Gallo is a citizen of California and has properly sued Anthem Blue Cross, a

16
17

California corporation. Thus, the Court does not have diversity jurisdiction over the instant case

18

and removal therefore is not justified under 28 U.S.C. § 1332.

19

B. “Substantial Federal Interests” Based on National Security Concerns
28 U.S.C. § 1331 provides that federal courts have original jurisdiction over civil actions

20
21

“arising under the Constitution, laws, or treaties of the United States.” Federal question

22

jurisdiction “is determined (and must exist) as of the time the complaint is filed and removal is

23

effected.” Strotek, 300 F.3d at 1131. Removal pursuant to § 1331 is governed by the “well-pleaded

24

complaint rule,” which provides that federal question jurisdiction exists only when “a federal

25

question is presented on the face of plaintiff’s properly pleaded complaint.” Caterpillar, 482 U.S.

26

at 392.

27
28

“[I]n certain cases,” the United States Supreme Court has explained, “federal-question
6
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

jurisdiction will lie over state-law claims that implicate significant federal issues.” Grable & Sons

2

Metal Prods., Inc. v. Darue Eng’g & Mfg., 545 U.S. 308, 312 (2005). Under Grable, a federal

3

court may exercise jurisdiction over a state-law claim only if (1) the action necessarily raises an

4

issue of federal law that is (2) disputed and (3) substantial, and if (4) the court may entertain the

5

case without disturbing the congressionally approved balance of federal and state judicial

6

responsibilities. Id. at 314.

7

In the instant case, Anthem Blue Cross argues that “[t]he cyberattack that forms the basis
of Plaintiff’s Complaint carries extraordinary national significance” and therefore “Plaintiff’s

9

Complaint is capable of and best suited for resolution in federal court” under 28 U.S.C. § 1331.

10

Opp. at 2, 10–11. Anthem Blue Cross claims that “[t]he cyberattack on Anthem was perpetrated

11
United States District Court
Northern District of California

8

by a highly sophisticated Advanced Persistent Threat (“APT”) affiliated with the Chinese

12

government’s intelligence ministry.” Opp. at 7. Anthem Blue Cross then argues extensively that

13

cyberattacks by foreign state-affiliated actors constitute an “extraordinary threat” to the United

14

States’ national security. Id. at 11. Essentially, Anthem Blue Cross argues that the cybersecurity

15

threats from state actors constitute such an important “national emergency” that federal courts

16

have jurisdiction over state law claims related to data breaches by foreign state actors. Id.

17

However, under Grable, in order to fall under § 1331, a state law claim must necessarily

18

raise a disputed and substantial “issue[] of federal law.” Grable, 545 U.S. at 319 (emphasis

19

added). Although Anthem Blue Cross argues extensively that cybersecurity is an issue of national

20

scope and importance, Anthem Blue Cross does not identify any federal law that would be

21

implicated by the instant case. Instead, Anthem Blue Cross concedes that state common law and

22

statutory law governs each of Gallo’s claims.

23

Indeed, New SD Inc. v. Rockwell Intl’s Corp., 79 F.3d 953 (9th Cir. 1996), which Anthem

24

Blue Cross cites in support of its argument, demonstrates precisely why federal jurisdiction does

25

not exist in the instant case. Anthem Blue Cross cites New SD for the proposition that “federal

26

jurisdiction over a state law breach of contract claim is appropriate where the claims impact

27

national security issues.” Opp. at 11. However, the dispute in New SD was based on a contract

28

7
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

with the United States Air Force for the development of military hardware. The Ninth Circuit held

2

that this dispute must be governed by federal law because of the essentially federal nature of the

3

contract, and therefore “state law [wa]s totally displaced by federal common law.” 79 F.3d at 955.

4

In other words, the dispute in New SD was not a “state law breach of contract claim” because

5

federal law preempted state law. Opp. at 11. Thus, in New SD jurisdiction existed under § 1331

6

because the claim arose under federal common law.
In the instant case, unlike New SD, Anthem Blue Cross does not argue that Gallo’s state

7
8

law claims are preempted by federal common law.2 In fact, Anthem Blue Cross admits that Gallo

9

has “sued only under state statutes” and raised only “state law claims.” Opp. at 3. The Ninth
Circuit has held that there is no jurisdiction under § 1331 if federal law “is not a necessary element

11
United States District Court
Northern District of California

10

of the state law claim and no preemption exists.” Easton v. Crossland Mortgage Corp., 114 F.3d

12

979, 982 (9th Cir. 1997). In the instant case, Gallo’s claims are not preempted by federal law and

13

there is no “necessary element” of federal law. Therefore, the Court does not have federal

14

jurisdiction under 28 U.S.C. § 1331.

15

Indeed, the Court has already rejected a similar argument in this Multi-District Litigation,

16

In re Anthem, Inc. Data Breach Litigation, Case No. 5:15-MD-02617-LHK (“Anthem MDL”). In

17

removing the case Sabatino et al. v. HMO Missouri, Inc., et al., 15-CV-02873-LHK, other

18

Anthem affiliates (represented by the same law firm that represents Anthem Blue Cross in the

19

instant case) argued that federal question jurisdiction was warranted because “how Anthem and

20

similarly situated companies respond to the threat of cyber attacks raises substantial federal

21

questions and implicates a compelling federal interest under Grable because cyber attacks are one

22

of the most serious national security challenges we must confront.” Sabatino et al. v. HMO

23

Missouri, Inc., et al., 129 F. Supp. 3d 887, 897 (N.D. Cal. 2015) (internal quotation marks

24

omitted). However, the Court found that “[a]lthough this action resulted from a data breach that

25
26
27
28

2

As discussed below, Anthem Blue Cross’s notice of removal mentioned ERISA preemption as a
ground for removal. However, Anthem Blue Cross abandoned this ground in its opposition to the
motion to remand. See ECF No. 1; Opp.
8
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

has had consequences nationwide, at bottom this particular lawsuit is between Missouri plaintiffs

2

and Missouri defendants based on alleged violations of Missouri law.” Id. Therefore, the Court

3

found that there was no federal question jurisdiction and remanded the case to state court.

4

Similarly, in the instant case, although the breach at issue had nationwide consequences,

5

and although the cause of the breach may implicate national security interests, the instant case is at

6

bottom a lawsuit between a California plaintiff and California defendants based on alleged

7

violations of California law.

8
9

Indeed, even for claims arising from the September 11 attacks, which had obvious and farreaching national security implications, Congress felt compelled to enact a specific statute
providing for federal jurisdiction. See Air Transportation Safety and System Stabilization Act of

11
United States District Court
Northern District of California

10

2001, Pub. L. No. 107-42, § 408 (“There shall exist a Federal cause of action [for claims related to

12

the September 11 attacks.” . . . The United States District Court for the Southern District of New

13

York shall have original and exclusive jurisdiction over all actions brought for any claim

14

(including any claim for loss of property, personal injury, or death) resulting from or relating to

15

the terrorist-related aircraft crashes of September 11, 2001.”). In other words, “if Congress deems

16

it appropriate for federal courts to exercise jurisdiction over a certain type of case, it knows how to

17

do ensure that this occurs.” Magdaleno v. S. California Reg’l Rail Auth., 2009 WL 56773, at *3

18

(C.D. Cal. Jan. 8, 2009) (discussing the Air Transportation Safety and System Stabilization Act of

19

2001). Congress has not so provided in the instant case.

20
21
22

For these reasons, the Court finds that national security interests do not justify jurisdiction
under § 1331.
C. ERISA Preemption

23

As discussed above, Anthem Blue Cross’s notice of removal asserted that federal

24

jurisdiction exists because “the Complaint asserts claims . . . that are completely preempted by”

25

ERISA. ECF No. 1, at 7. Anthem Blue Cross abandoned this argument in its opposition to Gallo’s

26

motion to remand. Nevertheless, the Court considers this argument for the sake of completeness.

27
28

As the U.S. Supreme Court has explained, “Section 514(a) [of ERISA] provides that
9
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

ERISA ‘shall supersede any and all State laws insofar as they . . . relate to any employee benefit

2

plan’ covered by the statute.” N.Y. State Conference of Blue Cross & Blue Shield Plans v.

3

Travelers Ins. Co., 514 U.S. 645, 651 (1995) (citing 29 U.S.C. § 1144(a)). An “employee benefit

4

plan” is a plan “established or maintained by an employer or by an employee organization.” 29

5

U.S.C. § 1002(3). An “employee” is defined as “any individual employed by an employer.” Id. §

6

1002(6).

7

However, according to the allegations in Gallo’s complaint and Gallo’s declaration in

8

support of his motion to remand, Gallo has practiced law as a sole proprietorship “[f]rom

9

approximately 1993 to present,” including all times relevant to the complaint. Compl. ¶ 11; ECF
No. 3-2 (“Gallo Decl.”), ¶ 4. Thus, when Gallo purchased the insurance plans at issue in the

11
United States District Court
Northern District of California

10

instant case, Gallo was self-employed. As Gallo points out in his motion, self-employed persons

12

are beyond the scope of ERISA. See In re Watson, 161 F.3d 593, 596-599 (9th Cir. 1998) (holding

13

that an individual “was the sole participant in his own pension plan” and therefore was properly

14

“not considered an ‘employee’ for purposes of ERISA.”); see also Matinchek v. John Alden Life

15

Ins. Co., 93 F.3d 96, 101 (3rd Cir. 1996) (“At least five courts of appeal have similarly recognized

16

that ERISA does not govern a ‘plan’ that is merely an insurance policy under which the only

17

beneficiaries are the company’s owners.”) (citing Peterson v. American Life & Health Ins. Co., 48

18

F.3d 404, 407 (9th Cir. 1995)). Thus, because Gallo’s insurance plan was not governed by ERISA,

19

ERISA does not preempt Gallo’s claims.

20

In its opposition, Anthem Blue Cross abandons its ERISA preemption argument and does

21

not challenge Gallo’s assertion that Gallo was self-employed and purchased insurance for himself

22

alone as sole proprietor of his law practice. Therefore, the Court concludes that Anthem Blue

23

Cross has not met its burden to establish that removal is proper on the basis of ERISA preemption.

24
25

D. HIPAA
Anthem Blue Cross also asserts that removal is proper because “Plaintiff’s state law and

26

statutory causes of action are predicated on alleged violations of [HIPAA] and therefore raise

27

important questions of federal law.” Opp. at 13. Specifically, Anthem Blue Cross states that

28

10
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

Gallo’s allegation that Anthem Blue Cross “failed to implement and maintain reasonable security

2

procedures and practices . . . to protect [Gallo’s] information from unauthorized access, use, and

3

disclosure” is “implicitly based on HIPAA.” Id.

4

However, Gallo’s complaint contains no reference to HIPAA at all, and Anthem Blue

5

Cross does not argue that HIPAA preempts Gallo’s claims. In fact, as Gallo points out, his

6

complaint “does not even assert that ‘health information’ has been taken or misused.” Mot. at 11;

7

see also 42 U.S.C.A. § 1320d(4)(B) (limiting the definition of “health information” to information

8

that “relates to the past, present, or future physical or mental health or condition of an individual,

9

the provision of health care to an individual, or the past, present, or future payment for the
provision of health care to an individual.”). Instead, Gallo alleges only that his personal

11
United States District Court
Northern District of California

10

identification information was stolen. Thus, neither the complaint nor Anthem Blue Cross’s

12

opposition establish that HIPAA is relevant to the instant case, let alone that HIPAA is an

13

“actually disputed and substantial” issue sufficient to establish federal jurisdiction. Grable, 545

14

U.S. at 310, 314.

15

Indeed, this Court has previously held in the Anthem MDL that a “single reference to

16

HIPAA in a sixty-three paragraph complaint” is insufficient to justify federal jurisdiction.

17

Sabatino, 129 F. Supp. 3d at 897. This holding was based on the well-established principle that

18

“the mere reference of a federal statute in a pleading will not convert a state law claim into a

19

federal cause of action if the federal statute is not a necessary element of the state law claim and

20

no preemption exists.” Easton, 114 F.3d at 982. This is all the more true in the instant case, in

21

which the complaint contains no reference to HIPAA and no allegations establishing that HIPAA

22

is at all relevant to Gallo’s claims.

23

Furthermore, the Ninth Circuit has held that “HIPAA itself does not provide for a private

24

right of action.” Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1082 (9th Cir. 2007).

25

“[W]here there is no federal private right of action,” the Ninth Circuit continued, federal courts

26

generally “may not entertain a claim that depends on the presence of federal question jurisdiction

27

under 28 U.S.C. § 1331.” Id. at 1083 (citing Merrell Dow Pharm. Inc. v. Thompson, 478 U.S. 804,

28

11
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

817 (1986)). Indeed, Anthem Blue Cross has conceded that it “recognizes that HIPAA provides no

2

private right of action and that state law claims based on alleged violations of HIPAA may not in

3

and of themselves be sufficient to confer federal jurisdiction.” Opp. at 13. Thus, allowing federal

4

question jurisdiction based on Anthem Blue Cross’s contention that some of Gallo’s assertions are

5

“implicitly based on HIPAA,” Opp. at 13, would effect an “end-run around clear precedent

6

precluding a private right of action under HIPAA.” Huling v. City of Los Banos, 2012 WL

7

253251, at *8 (E.D. Cal. Jan. 25, 2012); see also Dickman v. MultiCare Health Sys., 2015 WL

8

3477178, at *3 (W.D. Wash. June 2, 2015) (concluding that “it would undermine congressional

9

intent to allow claims for private relief into federal court through a state cause of action when a

10

United States District Court
Northern District of California

11
12
13

federal private right of action is unavailable” (citing Merrell Dow, 478 U.S. at 812)).
Accordingly, the Court concludes that Anthem Blue Cross has not met its burden to show
that federal question jurisdiction exists over this action based on HIPAA.
E. Attorney’s Fees

14

Finally, Gallo argues that he is entitled to attorney’s fees under 28 U.S.C. § 1447(c)

15

because Anthem Blue Cross “lacked an objectively reasonable basis for seeking removal.” Mot. at

16

14. Under 28 U.S.C. § 1447(c), after a motion to remand “[a]n order remanding the case may

17

require payment of just costs and any actual expenses, including attorney fees, incurred as a result

18

of the removal.” However, “the standard for awarding fees should turn on the reasonableness of

19

the removal. Absent unusual circumstances, courts may award attorney’s fees under § 1447(c)

20

only where the removing party lacked an objectively reasonable basis for seeking removal.”

21

Martin v. Franklin Capital Corp., 546 U.S. 132, 141 (2005).

22

In the instant case, Anthem Blue Cross asserted two grounds for removal in its notice of

23

removal: (1) an important federal issue regarding national security and HIPAA, and (2) ERISA.

24

The Court concludes that Anthem Blue Cross “lacked an objectively reasonable basis for seeking

25

removal” on any of these grounds. Id.

26

When Anthem Blue Cross filed its notice of removal, the Court had already decided

27

Sabatino et al. v. HMO Missouri, Inc., et al., 129 F. Supp. 3d 887, 897 (N.D. Cal. 2015). In

28

12
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

Sabatino, the Court rejected Anthem’s argument that the complaint “implicate[d] a compelling

2

federal interest under Grable because cyber attacks are one of the most serious national security

3

challenges we must confront.” Id. The Sabatino case was part of the same Anthem MDL to which

4

the instant case was transferred after removal. ECF No. 22. Additionally, the same firm, Hogan

5

Lovells US LLP, represented the Defendants in both Sabatino and the instant case. Thus, Anthem

6

Blue Cross was well aware of the Court’s prior order remanding Sabatino when Anthem Blue

7

Cross removed the instant case.

8

Nevertheless, despite the Court’s ruling in Sabatino, Anthem Blue Cross asserts similar

9

“national security implications” as a ground for removal in the instant case. Opp. at 1. Anthem
Blue Cross claims that the federal interests from the nationwide data breach are especially urgent

11
United States District Court
Northern District of California

10

because the breach of Anthem was “a cyberattack of national significance perpetrated by a foreign

12

nation-state actor.” Id. at 2. However, Anthem Blue Cross makes no attempt to distinguish

13

Sabatino and cites no law establishing that “national security implications” alone can confer

14

federal jurisdiction over straightforward state law claims. Instead, Anthem Blue Cross relies

15

primarily on New SD Inc. v. Rockwell Intl’s Corp., 79 F. 3d 953 (9th Cir. 1996), which found

16

federal jurisdiction because state law was preempted by federal common law. However, Anthem

17

Blue Cross makes no argument that Gallo’s state law claims are preempted by federal common

18

law in the instant case. Furthermore, as Gallo points out in his Reply, Anthem Blue Cross does not

19

even provide any evidence for its assertion that the Anthem data breach was caused by a state

20

actor. ECF No. 789, at 2. As noted above, even for state law claims arising from the September

21

11, 2001 attacks, Congress felt compelled to enact a specific statute providing for federal

22

jurisdiction. See Air Transportation Safety and System Stabilization Act of 2001, Pub. L. No. 107-

23

42, § 408. No such statute exists here.

24

Additionally, in Sabatino the Court found that “Plaintiffs’ single reference to HIPAA in a

25

sixty-three-paragraph complaint does not convert Plaintiffs’ state law claim for breach of fiduciary

26

duty into a federal cause of action.” Sabatino, 129 F. Supp. 3d at 897. In the instant case, it is even

27

more obvious that HIPAA is not a basis for federal jurisdiction, because Gallo’s complaint

28

13
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

1

contains no references at all to HIPAA, and the complaint does not even allege that Gallo’s health

2

information was stolen. Mot. at 17. Anthem Blue Cross makes no attempt to distinguish Sabatino

3

or to support its assumption that HIPAA will be relevant in the instant case.

4

Finally, Anthem Blue Cross’s notice of removal asserted ERISA preemption as a ground

5

for removal even though Gallo’s complaint made clear that Gallo is self-employed and therefore is

6

not subject to ERISA. Compl. ¶ 11 (“Plaintiff is an attorney . . . who has practiced under the trade

7

name, ‘the Law Offices of David J. Gallo,’ since the early 1990s.”). Perhaps recognizing that it

8

lacked an objective basis to remove based on ERISA preemption, Anthem Blue Cross abandoned

9

its ERISA preemption argument in its opposition to the motion to remand.

10

In short, Anthem Blue Cross’s arguments for federal jurisdiction in this case were already

United States District Court
Northern District of California

11

either abandoned or squarely rejected by this Court in Sabatino. There is no jurisdiction under

12

§ 1331 if federal law “is not a necessary element of the state law claim and no preemption exists,”

13

and yet Anthem Blue Cross has presented almost no argument that either of these factors is met.

14

Easton, 114 F.3d at 982. Therefore, the Court finds that Anthem Blue Cross “lacked an objectively

15

reasonable basis for seeking removal.” Martin, 546 U.S. at 141. For that reason, the Court finds

16

that an award of attorney’s fees is proper.

17

In the declaration accompanying Gallo’s motion for remand, Gallo states that he has spent

18

ten hours in work associated with the motion for remand and the reply. Gallo also reports that his

19

“regular published hourly rate of compensation is $550.00.” ECF No. 25, at ¶ 8. Gallo graduated

20

from the University of Texas at Austin School of Law in 1985, was admitted to both the Texas and

21

California bars, and has been designated a Legal Specialist in Civil Trial Advocacy by the State

22

Bar of California. Id. at ¶ 9. Gallo also has substantial litigation experience and has worked as a

23

solo practitioner for 24 years. Id. ¶ 4. Additionally, at least one court has approved a rate of $550

24

for experienced litigators in San Diego. See, e.g., 569 E. Cty. Boulevard LLC v. Backcountry

25

Against the Dump, Inc., 6 Cal. App. 5th 426, 439 n.14 (Ct. App. 2016) (“$550 per hour for a

26

seasoned litigator fell within the range of appropriate market rates for San Diego attorneys . . . .”)

27

Finally, Anthem Blue Cross has not objected to Gallo’s hourly rate or his reported hours.

28

14
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND

For these reasons, Court concludes that a $550 hourly rate is reasonable for an attorney of

1
2

Gallo’s education and experience. The Court also concludes that ten hours is reasonable for the

3

work associated with the instant motion to remand and the reply. Therefore, the Court hereby

4

ORDERS Anthem Blue Cross to pay Gallo attorney’s fees in the amount of $5,500.

5

IV.

6

CONCLUSION
For the foregoing reasons, the Court GRANTS Gallo’s motion for remand and REMANDS

7

the instant case to San Diego County Superior Court. The Court also ORDERS Anthem Blue

8

Cross to pay Gallo attorney’s fees in the amount of $5,500.

9

IT IS SO ORDERED.

10

United States District Court
Northern District of California

11

Dated: May 31, 2017

12
______________________________________
LUCY H. KOH
United States District Judge

13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

15
Case No. 17-CV-01465-LHK
ORDER GRANTING MOTION TO REMAND