Geleng v. Independent Living Systems, LLC

Filing 74

ORDER granting 68 Motion for Protective Order. Signed by Magistrate Judge Lisette M. Reid on 7/3/2024. See attached document for full details. (ari)

Download PDF
UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF FLORIDA MIAMI DIVISION Master File No. 1:23-cv-21060-Williams In re INDEPENDENT LIVING SYSTEMS DATA BREACH LITIGATION This Document Relates To: ALL ACTIONS. ) ) ) ) ) ) ) ) CLASS ACTION STIPULATED HIPAA QUALIFIED PROTECTIVE ORDER 1. PURPOSES AND LIMITATIONS Disclosure and discovery activity in the above-captioned action (“Proceeding”) are likely to involve production of highly sensitive confidential, proprietary, and personal information for which a party or non-party may claim special protection from public disclosure and from use for any purpose other than prosecuting this Proceeding may be warranted. Such confidential and proprietary information consists of, among other things, confidential business or financial information, personal identifying information (as defined herein), confidential protected health information (as defined herein), information regarding confidential security and other business practices, or other confidential research, development, or commercial information (including information implicating privacy rights of third parties), and other information that a party or nonparty in this Proceeding may claim to be privileged or otherwise protected from disclosure. Accordingly, the parties hereby stipulate to and petition the Court to enter the following Stipulated HIPAA Qualified Protective Order. The parties acknowledge that this Order does not confer blanket protections on all disclosures or responses to discovery and that the protection it affords from public disclosure and use extends only to the limited information or items that are entitled to confidential treatment under the applicable legal principles. The parties further acknowledge that this Stipulated HIPAA Qualified Protective Order does not entitle them to file confidential information under seal. Regarding sealed filings, the parties agree to follow the procedures outlined in S.D. Fla. L.R. 5.4. 2. APPLICABILITY This Stipulated HIPAA Qualified Protective Order is applicable to all plaintiffs, defendants, any additional parties joined in this Proceeding (collectively, the “Parties”), and any non-parties required to respond to discovery in the Proceeding, for the sole purpose of facilitating discovery in the Proceeding and protecting the confidentiality and other interests of the Parties and third-parties throughout the course of the Proceeding including, but not limited to, trial. This Order authorizes the Parties and any and all Covered Entities to disclose information protected by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (the “HITECH Act”), including all applicable regulations and guidance issued by the Secretary of the United States Department of Health and Human Services (collectively, the “HIPAA Rules”), including specifically 42 C.F.R. Part 2 and 45 C.F.R. §164.512(e)(1)(v), as well as all state laws and regulations regarding the privacy and security of personal information and personal health information (collectively with HIPAA Rules, the “Privacy and Security Rules”). This Order constitutes a HIPAA Qualified Protective Order, as that term is defined in the Privacy and Security Rules. The Parties are expressly prohibited from using or disclosing information protected by the Privacy and Security Rules obtained pursuant to this Order for any purpose other than this Proceeding. 3. DEFINITIONS 3.1 Challenging Party: a Party or Non-Party that challenges the designation of information or items under this Order. 3.2 “CONFIDENTIAL” Information or Items: information (regardless of how it is generated, stored, or maintained) or tangible things that qualify for protection from public disclosure including trade secrets; confidential research, development, or commercial information, as such terms are used in Rule 26(c)(1)(G) of the Federal Rules of Civil Procedure and any applicable case law interpreting Rule 26(c)(1)(G) that would cause harm to the Designating Party 3 if made public; and sensitive personal information such as protected health information, payment card numbers, financial account numbers, Social Security numbers, and tax identification numbers. 3.3 “CONFIDENTIAL – Attorneys’ Eyes Only” Information or Items: A Party may designate as “Confidential – Attorneys’ Eyes Only” any Confidential Material that it reasonably and in good faith believes is of such a commercially or competitively sensitive nature that disclosure to persons other than those listed in Paragraph 11.3 could reasonably be expected to result in injury. 3.4 Counsel (without qualifier): Outside Counsel and In-House Counsel (as well as their support staff). 3.5 Designating Party: a Party or Non-Party that designates information or items that it produces in disclosures or in responses to discovery as “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only.” 3.6 Disclosure or Discovery Material: all items or information, regardless of the medium or manner in which it is generated, stored, or maintained (including, among other things, testimony, transcripts, and tangible things), that are produced or generated in disclosures or responses to discovery in this matter. 3.7 Expert/Consultant: a person with specialized knowledge or experience in a matter pertinent to the litigation who has been retained by a Party or its counsel to serve as an expert witness or as a consultant in this Proceeding. 3.8 In-House Counsel: attorneys who are employees of a party to this Proceeding. In-House Counsel does not include Outside Counsel in this action or any other outside counsel. 4 3.9 Non-Party: any natural person, partnership, corporation, association, or other legal entity not named as a Party to this Proceeding. 3.10 Outside Counsel: attorneys who are not employees of a party to this Proceeding but are retained to represent or advise a party to this Proceeding and have appeared in this Proceeding on behalf of that party or are affiliated with a law firm which has appeared on behalf of that party. 3.11 Party: any party to this Proceeding, including all of its officers, directors, employees, and Outside Counsel (and their support staff). 3.12 Personal Identifiable Information (“PII”): information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information, as defined in 2 C.F.R. §200.79. 3.13 Producing Party: a Party or Non-Party that produces Disclosure or Discovery Material in this Proceeding. 3.14 Professional Vendors: persons or entities that provide litigation support services (e.g., photocopying, videotaping, translating, preparing exhibits or demonstrations, and organizing, storing, or retrieving data in any form or medium) and their employees and subcontractors. 3.15 Protected Health Information (“PHI”): means protected health information, as that term is used in HIPAA and the Privacy Standards defined in 45 C.F.R. §§160 and 164, as explained further below. 3.16. Protected Material: any Disclosure or Discovery Material that is designated as “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only.” 5 3.17 Receiving Party: a Party that receives Disclosure or Discovery Material from a Producing Party. 4. SCOPE The protections conferred by this Stipulated HIPAA Qualified Protective Order cover not only Protected Material (as defined above), but also (1) any information copied or extracted from Protected Material; (2) all copies, excerpts, summaries, or compilations of Protected Material; and (3) any testimony, conversations, or presentations by Parties or their Counsel that might reveal Protected Material. However, the protections conferred by this Stipulated HIPAA Qualified Protective Order do not cover the following information: (a) any information that is in the public domain at the time of disclosure to a Receiving Party or becomes part of the public domain after its disclosure to a Receiving Party as a result of publication not involving a violation of this Order, including becoming part of the public record through trial or otherwise; and (b) any information known to the Receiving Party prior to the disclosure or obtained by the Receiving Party after the disclosure from a source who obtained the information lawfully and under no obligation of confidentiality to the Designating Party. PII and PHI shall qualify as Protected Material under this Stipulation and Order regardless of whether such PII and PHI has been publicly disclosed. Finally, any use of Protected Material at trial shall be governed by a separate agreement or order. 5. CONFIDENTIAL HEALTH INFORMATION: The Parties desire to ensure the privacy of any medical records and other information that the Parties have determined might contain sensitive personal health information (“Confidential Health Information”). Confidential Health Information is intended to encompass any patient health information protected by any state or federal law, including, but not limited to, “Protected Health Information,” as defined below. That Parties agree that any Confidential Health Information 6 involving named Plaintiffs shall be deemed “Confidential” and that any such information concerning a third party, including putative class members, shall be deemed “Confidential – Attorneys’ Eyes Only” and, as such, subject to the terms of this Stipulated HIPAA Qualified Protective Order. a. Protected Health Information. Covered Entities as used herein, means those entities as defined by 45 C.F.R. §160.103. Protected Health Information as used herein, means protected health information, as that term is used in HIPAA and the Privacy Standards defined in 45 C.F.R. §§160 and 164. Without limiting the generality of the foregoing, Protected Health Information includes, but is not limited to, information reflecting the past, present, or future physical or mental health or condition of an individual, medical records, and documents based on or derived from Protected Health Information, regardless of form or format. “Confidential Health Information” does not include any document or information in which the Producing Party has redacted personal identifiers and does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is the subject of the information. A Producing Party may, but is not required to, perform such redactions before producing documents that originally contained “Confidential Health Information,” so long as the redactions do not result in prejudice to another Party. b. Safeguards for Confidential Information. The Parties also seek to ensure that any person who receives and stores Confidential Health Information in connection with this Proceeding will develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the privacy, integrity, and confidentiality of any Confidential Health Information, and to prevent unpermitted use or disclosure of any Confidential Health Information they may receive from any person in connection with this Proceeding. At a minimum, 7 all Parties and persons or entities who might receive Confidential Health Information (including all signatories to Exhibit A of this Order) agree that they will: (1) comply with the Privacy and Security Rules; (2) establish contractual controls that require any vendors, experts, or third parties that might receive Confidential Health Information to comply with the Privacy and Security Rules; and (3) undertake due diligence to verify that the privacy and security protections of any such vendors, experts, or third parties comply with the Privacy and Security Rules. Confidential Health Information will be securely destroyed, 1 deleted, or returned pursuant to the provisions of Paragraph 17 below. 6. DURATION Even after final disposition of this Proceeding, the confidentiality obligations imposed by this Order shall remain in effect until a Designating Party agrees otherwise in writing or a court order otherwise directs. Final disposition shall be deemed to be the later of: (a) dismissal of all claims and defenses in this Proceeding, with or without prejudice; (b) final approval of settlement between and among all Parties; and (c) final judgment herein after the completion and exhaustion of all appeals, rehearings, remands, trials, or reviews of this Proceeding, including the time limits for filing any motions or applications for extension of time pursuant to applicable law. 7. DESIGNATING PROTECTED MATERIAL 7.1 Exercise of Restraint and Care in Designating Material for Protection. Each Party or Non-Party that designates information or items for protection under this Order must take care to limit any such designation to specific material that qualifies under the appropriate standards. The Designating Party must designate for protection only those parts of material, “Secure destruction” means: “Securely overwriting or wiping data using a secure file deletion utility to ensure that the information cannot be recovered. For those devices that cannot be overwritten (e.g., defective hard drives, CDs/DVDs), the devices must be destroyed prior to disposal.” 1 8 documents, items, or oral or written communications that qualify – so that other portions of the material, documents, items, or communications for which protection is not warranted are not swept unjustifiably within the ambit of this Order. Mass, indiscriminate, or routinized designations are prohibited. If it comes to a Designating Party’s attention that information or items that it designated for protection do not qualify for protection, that Designating Party must promptly notify all other Parties that it is withdrawing the mistaken designation. 7.2 Manner and Timing of Designations. Except as otherwise provided in this Order, or as otherwise stipulated or ordered, Disclosure or Discovery Material that qualifies for protection under this Order must be clearly so designated before the material is disclosed or produced. Designation in conformity with this Order requires: (a) For information in documentary form (e.g., paper or electronic documents, but excluding transcripts of depositions or other pretrial or trial proceedings), that the Producing Party shall indicate in the accompanying cover letter that the production includes protected information and affix the legend “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only” to each page of the production that contains protected material. For documents produced in native format, the “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only” legend shall be affixed to the placeholder bates numbered TIFF image that accompanies the native file and shall include the “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only” designation in the file name of the natively produced document. A Party or Non-Party that makes original documents or materials available for inspection need not designate them for protection until after the inspecting Party has indicated which material it would 9 like copied and produced. Then, before producing the specified documents, the Producing Party must affix the “CONFIDENTIAL” legend to each page that contains Protected Material. With respect to any document or ESI or other material that is produced or disclosed by any Non-Party without a designation of “Confidential,” or “Confidential – Attorneys’ Eyes Only,” any Party may designate such material as Confidential Material within 30 days of actual knowledge of the production or disclosure of the material, or such other time as may be agreed upon by the Parties; provided, however, that a Party may only designate such material if it contains the Designating Party’s data or information. (i) Parties may designate such material by sending written notice of a designation to all other Parties in possession or custody of such previously undesignated material. The Designating Party shall either provide the Bates number(s) of the material in the written notice or provide a copy of the designated material bearing the appropriate legend. Within 30 days of receipt of such notice or copy of the designated material pursuant to this subparagraph, the receiving Party shall return to the Designating Party all undesignated copies of such material in their custody or possession, shall inform the designating Party that all undesignated copies of such material in their custody or possession have been discarded, or shall affix the legend to all copies of such designated material in their custody or possession. (ii) Upon notice of designation pursuant to this Paragraph, the Parties also shall: (a) make no further disclosure of such designated material or information contained therein, except as allowed under this Order; (b) take reasonable steps to notify any persons who were provided copies of such designated material of the terms of this Order; and (c) take reasonable steps to reclaim any such designated material in the possession of any person not permitted access to such information under the terms of this Order. 10 (iii) No Party shall be deemed to have violated this Order for the sole reason that such material has been disclosed or used in a manner inconsistent with the subsequent designation, prior to notification of the subsequent designation. (b) For testimony given in deposition or in other pretrial or trial proceedings, nothing contained in this Order shall prevent the use of Protected Material, with appropriate safeguards. In particular, unless otherwise agreed by the Parties, a deponent who is not a Party or a present officer, director, employee, or representative of a Party shall not be examined about Protected Material and shall not have Protected Material revealed to her or him unless she or he has been furnished with a copy of this Order and has read and signed a confidentiality agreement in the form of Exhibit A. Persons in attendance at depositions, other than those listed in Paragraphs 11.2–11.3, may be limited at the request of a Party during the disclosure of Protected Material. A Party may designate on the record information disclosed during a deposition as “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only” or Protected Material. Regardless of whether such information was designated as Protected Material at the time of the deposition, each party shall have 30 calendar days after the deposition transcript has been made available to designate as Protected Material those portions of the deposition testimony or exhibits that they deem to contain or reveal Protected Material. Until expiration of the thirty-day period, the entire deposition transcript shall be treated as “CONFIDENTIAL”, unless otherwise agreed by the Parties. If no Party timely affirmatively designates information disclosed during a deposition as Protected Material, then upon expiration of the 30-day period, none of the deposition or its exhibits (except those previously designated as “CONFIDENTIAL”) will be treated as designated. 11 If all or part of the transcript of deposition testimony or exhibits are treated as Protected Material (whether by automatic operation of this Order or by a party so designated), but are used in other depositions, such Protected Material and all portions of the transcripts of such other depositions and exhibits thereto that refer to such Protected Material shall be treated as designated, and if filed with the Court, shall be filed under seal in accordance with S.D. Fla. L.R. 5.4. (c) For information produced in some form other than documentary and for any other tangible items, that the Producing Party affix in a prominent place on the exterior of the container or containers in which the information or item is stored the legend “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only.” If only a portion or portions of the information or item warrant protection, the Producing Party, to the extent practicable, shall identify the protected portion(s). 7.3 Inadvertent Failures to Designate. If timely corrected, an inadvertent failure to designate qualified information or items does not waive the Designating Party’s right to secure protection under this Order for such material. The failure to designate Protected Material may be remedied by the prompt supplemental written notice upon discovery of the disclosure, with the effect that such Protected Material will be subject to the protections of this Order. The Receiving Party shall exercise good faith efforts to ensure that copies made of Protected Material produced to it, and copies made by others who obtained such Protected Material directly or indirectly from the Receiving Party, include the appropriate confidentiality legend, to the same extent that the Protected Material has been marked with the appropriate confidentiality legend by the Producing Party. 12 8. PRODUCTION – RECEIPT AND STORAGE OF PROTECTED MATERIAL The recipient of any Protected Material shall exercise the same care with regard to the storage, custody, or use of such Protected Material as they would apply to their own material of the same or comparable sensitivity, but no less than the reasonable precautions set forth in this paragraph. The recipient must take reasonable precautions to protect Protected Material from loss, misuse and unauthorized access, disclosure, alteration, and destruction. Such measures shall include: (a) Reasonably preventing unauthorized persons from gaining access to Protected Material (physical access control); (b) Reasonably preventing Protected Material from being used without authorization (logical access control) including, but not limited to, the use of passwords; (c) Reasonably ensuring that persons entitled to use Protected Material gain access only to such Protected Material as they are entitled to access in accordance with their access rights (data access control); (d) Reasonably ensuring that the Protected Material cannot be read, copied, modified, or deleted without authorization during electronic transmission, transport, or storage on storage media, and that the target entities for any transfer of Protected Material by means of data transmission facilities can be established and verified (data transfer control); (e) Reasonably ensuring the establishment of an audit trail to document whether and by whom Protected Material have been entered into, modified, or removed from Protected Material processing systems (entry control). (f) The Receiving Party shall not load, import, submit, or otherwise transfer documents or data produced by the Producing Party to a publicly accessible Large Language Model (“LLM”) 13 or Artificial Intelligence (“AI”) platform. LLM or AI platforms may be utilized with industry standard data security provisions and the Party has ensured the documents or data will not be utilized to train public models or otherwise made accessible to other users of the LLM or AI platform. (g) If the recipient discovers any loss of Protected Material or a breach of security, including any actual or suspected unauthorized access, relating to the produced Protected Material, the Receiving Party shall: (1) Promptly provide written notice to Producing Party of such breach within twenty-four (24) hours of the breach discovery; (2) Investigate and make reasonable efforts to remediate the effects of the breach, and provide Producing Party with assurances that such breach shall not recur; (3) Provide sufficient information about the breach that the Producing Party can reasonably ascertain the size and scope of the breach. The Requesting Party agrees to cooperate with the Producing Party or law enforcement in investigating any such security incident; and (4) The Requesting Party shall promptly take all necessary and appropriate corrective action to terminate the unauthorized access and/or correct the breach. 9. PRODUCTION OF PRIVILEGED MATERIAL 9.1. No Waiver by Disclosure. This Order is entered pursuant to Rule 502(d) of the Federal Rules of Evidence. Subject to the provisions of this Order, if a Party or subpoenaed Non-Party (the “Disclosing Party”) discloses information in connection with the pending litigation that the Disclosing Party thereafter claims to be privileged or protected by the attorney-client privilege or work product protection (“Privileged Information”), the disclosure of that Privileged Information will not constitute or be deemed a waiver or forfeiture – in this or any other federal or 14 state action – of any claim of privilege or work product protection that the Disclosing Party would otherwise be entitled to assert with respect to the Privileged Information and its subject matter. This Order shall be interpreted to provide the maximum protection allowed by Federal Rule of Evidence 502(d). 9.2. Notification Requirements; Best Efforts of Receiving Party. A Disclosing Party must promptly notify the Party receiving the Privileged Information (the “Receiving Party”), in writing (email or letter), that it has disclosed that Privileged Information without intending a waiver by the disclosure. Upon such notification, the Receiving Party must – unless it contests the claim of attorney-client privilege or work product protection in accordance with Paragraph 9.3 – promptly: (a) notify the Disclosing Party that it will make best efforts to identify and return, sequester, or destroy (or in the case of electronically stored information, delete) the Privileged Information and any reasonably accessible copies it has; and (b) provide a written notification (email or letter) that it will cease further review, dissemination, and use of the Privileged Information. Within five business days of receipt of the notification from the Receiving Party, the Disclosing Party must explain as specifically as possible why the Protected Information is privileged and provide a privilege log with respect to such Privileged Information. 9.3. Contesting Claim of Privilege or Work Product Protection. If the Receiving Party contests the claim of attorney-client privilege or work product protection, within fifteen business days of receipt of the privilege log, the Receiving Party must move the Court for an Order compelling disclosure of the information claimed as unprotected (a “Disclosure Motion”), or otherwise request a hearing on this issue in accordance with any applicable discovery standing order. 15 The Disclosure Motion must be filed under seal in compliance with S.D. Fla. L.R. 5.4, and must not assert as a ground for compelling disclosure the fact or circumstances of the disclosure to the Receiving Party. Pending resolution of the Disclosure Motion, the Receiving Party must not use the challenged information in any way or disclose it to any person other than those required by law to be served with a copy of the sealed Disclosure Motion. 9.4. Stipulated Time Periods. The Parties may stipulate to extend the time periods set forth in Paragraphs 9.2 and 9.3. 9.5. Attorney’s Ethical Responsibilities. Nothing in this Order overrides any attorney’s ethical responsibilities to refrain from examining or disclosing materials that the attorney knows or reasonably should know to be privileged and to inform the Disclosing Party that such materials have been produced. 9.6. Burden of Proving Privilege or Work-Product Protection. The Disclosing Party retains the burden at all times in the Proceeding of establishing the privileged or protected nature of the Protected Information. 9.7. In camera Review. Nothing in this Order limits the right of any Party to petition the Court for an in camera review of the Privileged Information. 9.8. Voluntary and Subject Matter Waiver. This Order does not preclude a Party from voluntarily waiving the attorney-client privilege or work product protection. The provisions of Federal Rule of Evidence 502(a) apply when the Disclosing Party uses or indicates that it may use information produced under this Order to support a claim or defense. 9.9. Review. Nothing contained herein is intended to or shall serve to limit a Party’s right to conduct a review of documents, ESI, or information (including metadata) for relevance, responsiveness, and/or segregation of privileged and/or protected information before 16 production. Further, nothing contained herein is intended to reduce the time frame provided to the Disclosing Party to complete their review should they choose to do so. 10. CHALLENGING CONFIDENTIALITY DESIGNATIONS 10.1 Timing of Challenges. Any Party or Non-Party may challenge a designation of confidentiality at any time. Unless a prompt challenge to a Designating Party’s confidentiality designation is necessary to avoid foreseeable, substantial unfairness, unnecessary economic burdens, or a significant disruption or delay of the litigation, a Party does not waive its right to challenge a confidentiality designation by electing not to mount a challenge promptly after the original designation is disclosed. 10.2 Meet and Confer. The Challenging Party shall initiate the dispute resolution process by providing written notice of each designation it is challenging, by providing a description of the Protected Material (to include a Bates number identifier for each individual item for which a designation challenge is made), and a concise statement of the basis for the challenge as to each individual document or other item so-identified, which the Challenging Party believes should be released from some or all of the constraints of this Stipulated HIPAA Qualified Protective Order, and serve copies of such notice to all Parties and the producing third party if applicable. The Challenging Party and Designating Party shall attempt to resolve each challenge in good faith and must begin the process by conferring directly (by phone, video conference, or in person). If the objection cannot be resolved by agreement within 30 days from the date of service of the written objection, a Challenging Party may proceed to the next stage of the challenge process only if it has engaged in this meet and confer process first or establishes that the Designating Party is unwilling to participate in the meet and confer process in a timely manner. 17 10.3 Judicial Intervention. If the Parties cannot resolve a challenge without court intervention, the Challenging Party may move the Court, or follow any other rules or procedures the Court orders, challenging the designation by the Designating Party. The burden of persuasion in any such challenge proceeding shall be on the Designating Party. Unless the Designating Party has waived the confidentiality designation by failing to timely seek to retain confidentiality as described above, all parties shall continue to afford the material in question the level of protection to which it is entitled under the Producing Party’s designation until the Court rules on the challenge. 11. ACCESS TO AND USE OF PROTECTED MATERIAL 11.1 Basic Principles. A Receiving Party may use Protected Material that is disclosed or produced by another Party or by a Non-Party in connection with this case only for prosecuting, defending, or attempting to settle this Proceeding. Such Protected Material may be disclosed only to the categories of persons and under the conditions described in this Order. When the Proceeding has been terminated, a Receiving Party must comply with the provisions regarding the Final Disposition of Protected Material. Protected Material shall be used solely for purposes of this Proceeding, including any appeal. Nothing in this Order shall prevent a Producing Party from any use of its own documents and information. 11.2 Disclosure of “CONFIDENTIAL” Information or Items. Unless otherwise ordered by the court or permitted in writing by the Designating Party, a Receiving Party may disclose any information or item designated “CONFIDENTIAL” only to: (a) the Parties, including any officers, directors, and employees of the Receiving Party to whom disclosure is reasonably necessary for this Proceeding; 18 (b) Outside and In-House Counsel for any Party engaged in the litigation of this litigation and the personnel who work with such attorneys to whom it is necessary that the material be shown for purposes of this Proceeding; (c) experts/consultants and their staff and who have signed the attachment to this Stipulated HIPAA Qualified Protective Order “Acknowledgment and Agreement to Be Bound by HIPAA Qualified Protective Order” (Exhibit A); (d) the Court and its personnel, special masters, and any court appointed (e) court reporters, videographers, and their staff, in connection with the official and their staff; course of a deposition in this matter, provided that such persons have signed the attachment to this Stipulated HIPAA Qualified Protective Order (Exhibit A); (f) professional jury or trial consultants and mock jurors who have signed the attachment to this Stipulated HIPAA Qualified Protective Order (Exhibit A); (g) professional vendors and their staff, provided that such persons have signed the attachment to this Stipulated HIPAA Qualified Protective Order (Exhibit A); (h) mediators, special masters, and their staff, provided that such persons have signed the attachment to this Stipulated HIPAA Qualified Protective Order (Exhibit A); (i) a witness who is the author, bona fide recipient, or is reasonably expected to possess knowledge of the information discussed in the document, but only in connection with the preparation for or during the course of a noticed deposition, court hearing, or trial in this Proceeding; 19 (j) the author or recipient of a document containing the information or a custodian or other person who otherwise possessed or knew the information; and (k) 11.3 insurance carriers providing coverage in this matter. Disclosure of “CONFIDENTIAL – Attorneys’ Eyes Only” Information or Items. Except as agreed in writing by the designating Party or as otherwise provided herein, no information that is designated “Confidential – Attorneys’ Eyes Only” pursuant to this Stipulated HIPAA Qualified Protective Order, or extracts or summaries therefrom, shall be disclosed or shown to any person except those persons listed in paragraphs 11.2(b)–(k). 12. EXECUTING THE NON-DISCLOSURE AGREEMENT Each person to whom Protected Material is disclosed, except as identified in Paragraphs 11.2–11.3 above, shall execute a non-disclosure agreement in the form annexed hereto as Exhibit A before receiving Protected Material. Copies of the executed Exhibit A shall be retained by counsel disclosing Protected Material to such a person. 13. PROTECTED MATERIAL SUBPOENAED OR ORDERED PRODUCED IN OTHER LITIGATION If a Party is served with a subpoena or a court order issued in other litigation that compels disclosure of any information or items designated in this Proceeding as “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only,” that Party must: (a) promptly notify in writing the Designating Party. Such notification shall include a copy of the subpoena or court order; (b) promptly notify in writing the party who caused the subpoena or order to issue in the other litigation that some or all of the material covered by the subpoena or order is subject to this Protective Order. Such notification shall include a copy of this Stipulated Protective Order; and 20 (c) cooperate with respect to all reasonable procedures sought to be pursued by the Designating Party whose Protected Material may be affected. If the Designating Party timely seeks a protective order, the Party served with the subpoena or court order shall not produce any information designated in this Proceeding as “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only” before a determination by the court from which the subpoena or order issued, unless the Party has obtained the Designating Party’s permission. The Designating Party shall bear the burden and expense of seeking protection in that court of its confidential material – and nothing in these provisions should be construed as authorizing or encouraging a Receiving Party in this Proceeding to disobey a lawful directive from another court. 14. A NON-PARTY’S PROTECTED MATERIAL SOUGHT TO BE PRODUCED IN THIS LITIGATION The terms of this Order are applicable to information produced by a Non-Party in this Proceeding and designated as “CONFIDENTIAL” or “CONFIDENTIAL – Attorneys’ Eyes Only.” A Party issuing a subpoena to a Non-Party shall enclose a copy of this Protective Order and advise the Non-Party that, to the extent the Non-Party intends to produce Confidential Information subject to the protection of this Stipulated HIPAA Qualified Protective Order, the non-Party shall notify the issuing Party at the time of production and follow the procedures set forth herein. Nothing in these provisions should be construed as prohibiting a Non-Party from seeking additional protections. 15. UNAUTHORIZED DISCLOSURE OF PROTECTED MATERIAL If a Receiving Party learns that, by inadvertence or otherwise, it has disclosed Protected Material to any person or in any circumstance not authorized under this Stipulated HIPAA Qualified Protective Order, the Receiving Party must immediately (a) notify in writing the 21 Designating Party of the unauthorized disclosures, (b) use its best efforts to retrieve all unauthorized copies of the Protected Material, (c) inform the person or persons to whom unauthorized disclosures were made of all the terms of this Order, and (d) request such person or persons to execute the “Acknowledgment and Agreement to Be Bound by HIPAA Qualified Protective Order” that is attached hereto as Exhibit A. 16. MISCELLANEOUS 16.1 Right to Further Relief. Nothing in this Order abridges the right of any person to seek its modification by the Court in the future. 16.2 Right to Assert Other Objections/No Waiver. By stipulating to the entry of this Stipulated HIPAA Qualified Protective Order, no Party waives any right it otherwise would have to object to disclosing or producing any information or item on any ground not addressed in this Stipulated HIPAA Qualified Protective Order. Similarly, no Party waives any right to object on any ground to use in evidence of any of the material covered by this Stipulated HIPAA Qualified Protective Order. Nothing in this Stipulated HIPAA Qualified Protective Order waives the right to seek any discovery or to object to any specific discovery requests. 17. FINAL DISPOSITION Within 90 days of the final disposition of this Proceeding, upon the request of the Producing Party, the Receiving Party must return or destroy all Protected Material. As used in this subdivision, “all Protected Material” includes all copies, abstracts, compilations, summaries, and any other format reproducing or capturing any of the Protected Material. This provision does not require the return or destruction of Protected Material subject to legal hold obligations, or whose return or destruction would violate applicable federal or state law or regulations. Protected Material that may exist on any back-up media must also be returned or securely destroyed or 22 deleted within 90 days of the final disposition of this Proceeding, including any appeal. 2 Whether the Protected Material is returned or destroyed, upon request, the Receiving Party must submit a written (email or letter) confirmation to the Producing Party (and, if not the same person or entity, to the Designating Party) within 30 days of the request that affirms that the Receiving Party has not retained any copies, abstracts, compilations, summaries, or any other format reproducing or capturing any of the Protected Material. Notwithstanding this provision, Counsel of record are permitted to retain a copy of attorney work product, which may incorporate information from Protected Material, provided that: (a) all such retained attorney work product, and counsel’s further retention or further use thereof, shall remain subject to the terms of this Order, and (b) counsel’s retention of such attorney work product does not contain any Protected Health Information. For purposes of this Stipulated HIPAA Qualified Protective Order, the “final disposition of this Proceeding” shall be deemed to be the latter of: (i) full settlement of all claims; (ii) final judgment herein after the completion and exhaustion of all appeals, re-hearings, remands, trials and reviews, if any, of this Proceeding (excluding any time period under which the court has supervision or oversight over any relief issued through a consent decree or any non-preliminary injunction issued by the court); or (iii) the expiration of all time limits under federal law for the filing of or application for all appeals, rehearings, remands, trials or reviews of this Proceeding, including the time limits for the filing of any motions or applications for extension of time pursuant to applicable law. Any time period under which the Court has supervision or oversight over any relief issued through a consent decree or any non-preliminary injunction issued by the court will be considered after the conclusion of this Proceeding. 2 As used here backup media does not include systematic backups retained solely for the purpose of recovery from a catastrophic failure of a Party’s electronic files, which are automatically deleted at regular intervals, and accessed only in the event of a catastrophic failure. 23 18. PROTECTIVE ORDER REMAINS IN FORCE. This Order shall remain in force and effect until modified, superseded, or terminated by consent of the Parties or by order of the Court made upon reasonable written notice. Unless otherwise ordered or agreed upon by the Parties, this Order shall survive the termination of this Proceeding. The Court retains jurisdiction even after termination of this Proceeding to enforce this Order and to make such amendments, modifications, deletions and additions to this Order as the Court may from time to time deem appropriate. 19. MODIFYING THIS ORDER. Nothing in this Order shall be construed to prohibit the Parties from agreeing to modify any provision of this Order or seeking relief from the Court. Nor shall anything in this Order or any Party’s compliance herewith be construed as a waiver of any Party’s rights under applicable law. IT IS SO STIPULATED, THROUGH COUNSEL OF RECORD. DATED: June 24, 2024 ROBBINS GELLER RUDMAN & DOWD LLP STUART A. DAVIDSON Florida Bar No. 84824 s/ Stuart A. Davidson STUART A. DAVIDSON 225 NE Mizner Boulevard, Suite 720 Boca Raton, FL 33432 Telephone: 561/750-3000 561/750-3364 (fax) sdavidson@rgrdlaw.com 24 MORGAN & MORGAN JOHN A. YANCHUNIS Florida Bar No. 324681 201 N. Franklin Street, 7th Floor Tampa, FL 33602 Telephone: 813/223-5505 jyanchunis@ForThePeople.com MILBERG COLEMAN BRYSON PHILLIPS GROSSMAN, PLLC ALEXANDRA M. HONEYCUTT# 800 S. Gay Street, Suite 1100 Knoxville, TN 37929 Telephone: 866/252-0878 ahoneycutt@milberg.com Plaintiffs’ Co-Lead Counsel BILZIN SUMBERG MICHAEL A. HANZMAN Florida Bar No. 510637 1450 Brickell Avenue, 23rd Floor Miami, FL 33131 Telephone: 305/350-2424 305/351-2253 (fax) mhanzman@bilzin.com Plaintiffs’ Liaison Counsel NUSSBAUM LAW GROUP, P.C. LINDA P. NUSSBAUM# 1211 Avenue of the Americas, 40th Floor New York, NY 10036 Telephone: 917-438-9189 lnussbaum@nussbaumpc.com LYNCH CARPENTER LLP PAIGE T. NOAH# 1133 Penn Avenue, Floor 5 Pittsburgh, PA 15222 Telephone: 412/322-9243 412/231-0246 (fax) paigen@lcllp.com 25 GEORGE FELDMAN McDONALD, PLLC BRITTANY L. BROWN Florida Bar No. 105071 9897 Lake Worth Road, Suite 302 Lake Worth, FL 33467 Telephone: 561/232-6002 BBrown@4-justice.com HAUSFELD LLP STEVEN M. NATHAN# 888 16th Street N.W., Suite 300 Washington, DC 20006 Telephone: 202/540-7200 202/540 7201 (fax) snathan@hausfeld.com Members of Plaintiffs’ Executive Committee ROBBINS GELLER RUDMAN & DOWD LLP ALEXANDER C. COHEN Florida Bar No. 1002715 225 NE Mizner Boulevard, Suite 720 Boca Raton, FL 33432 Telephone: 561/750-3000 561/750-3364 (fax) acohen@rgrdlaw.com STUEVE SIEGEL HANSON LLP JORDAN A. KANE# 460 Nichols Road Kansas City, MO 64112 Telephone: 816/714-7100 kane@stuevesiegel.com KOPELOWITZ OSTROW FERGUSON WEISELBERG GILBERT STEVEN SUKERT Florida Bar No. 1022912 1 West Las Olas Boulevard, 5th Floor Fort Lauderdale, FL 33301 Telephone: 954/525-4100 954/525-4300 (fax) sukert@kolawyers.com 26 LEVIN SEDRAN & BERMAN NICHOLAS J. ELIA# 510 Walnut Street, Suite 500 Philadelphia, PA 19106-3697 Telephone: 877/882-1011 215/592-4663 (fax) NElia@lfsblaw.com ZIMMERMAN REED LLP MICHAEL J. LAIRD# 1100 IDS Center 80 South 8th Street Minneapolis, MN 55402 Telephone: 612/341-0400 michael.laird@zimmreed.com AYLSTOCK, WITKIN, KREIS & OVERHOLTZ, PLLC MAURY GOLDSTEIN Florida Bar No. 1035936 17 East Main Street, Suite 200 Pensacola, FL 32502 Telephone: 844/794-7402 mgolstein@awkolaw.com BRADLEY/GROMBACHER LLP FERNANDO VALLE* 313 Oak Crest Drive, Suite 240 Westlake Village, CA 91361 Telephone: 805/270-7100 fvalle@bradleygrombacher.com Members of Plaintiffs’ Leadership Development Committee # Pro hac vice granted * Pro hac vice forthcoming 27 s/Brian M. Ercole Brian M. Ercole Florida Bar No. 102189 brian.ercole@morganlewis.com Melissa M. Coates Florida Bar No. 111420 melissa.coates@morganlewis.com Morgan, Lewis & Bockius LLP 600 Brickell Avenue Suite 1600 Miami, Florida 33131-3075 Telephone: 305.415.3000 Facsimile: 305.415.3001 Gregory T. Parks (admitted pro hac vice) gregory.parks@morganlewis.com Morgan, Lewis & Bockius LLP 2222 Market Street Philadelphia, PA 19103-3007 Telephone: 215.963.5000 Facsimile: 215.963.5001 Counsel for Defendant Independent Living Systems, LLC DONE AND ORDERED in Chambers at Miami, Florida this 3rd day of July, 2024. LISETTE M. REID UNITED STATES MAGISTRATE JUDGE 28 EXHIBIT A UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF FLORIDA MIAMI DIVISION Master File No. 1:23-cv-21060-Williams In re INDEPENDENT LIVING SYSTEMS DATA BREACH LITIGATION This Document Relates To: ALL ACTIONS. ) ) ) ) ) ) ) ) CLASS ACTION ACKNOWLEDGMENT AND AGREEMENT TO BE BOUND BY HIPAA QUALIFIED PROTECTIVE ORDER 1. I, _____________________________ [print or type full name], acknowledge that I have read in its entirety and understand the HIPAA Qualified Protective Order that was issued in the above captioned case on [INSERT DATE ORDERED]. I agree to comply with and to be bound by all the terms of this Stipulated Protective Order and I understand and acknowledge that failure to so comply could expose me to sanctions and punishment in the nature of contempt. I agree that I will not disclose in any manner any information or item that is subject to this HIPAA Qualified Protective Order to any person or entity except in strict compliance with the provisions of this Order. 2. I understand that all Confidential Health Information, as defined in the HIPAA Qualified Protective Order, is subject to state and federal statutory and regulatory privacy and security standards, including, but not limited to, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act of 2009 (the “HITECH Act”), and regulations adopted thereunder by the U.S. Department Health and Human Services, 45 C.F.R. Parts 160, 162, and 164 (the “HIPAA Rules”). All Confidential Material disclosed by any Party or third party to this Proceeding that contains Confidential Health Information shall be treated in accordance with those standards, as applicable. Capitalized terms used, but not otherwise defined in this agreement, shall have the same meanings as those terms in HIPAA Rules. 3. By executing this Acknowledgment and Agreement to Be Bound by HIPAA Qualified Protective Order, I agree that I will not use or disclose any Confidential Health Information in a manner that would violate the HIPAA Rules and will only use or disclose any Confidential Health Information for the purpose of this Proceeding or to comply with judicial process or any applicable statute or regulation. I also agree that I will develop, implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the privacy, integrity, and confidentiality of any Confidential Health Information, and to prevent unpermitted use or disclosure of any Confidential Health Information I receive from any person in connection with this Proceeding. 4. I further agree to submit to the jurisdiction of the United States District Court for the Southern District of Florida for the purpose of enforcing the terms of this Stipulated HIPAA Qualified Protective Order, even if such enforcement proceedings occur after termination of this action. I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Date: ______________________________________ Printed name: _______________________________ Signature: __________________________________ 2

Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.


Why Is My Information Online?