Colcord v. Premera Blue Cross

Filing 131

Opinion and Order - Plaintiffs' Motion to Compel (ECF 110 ) is GRANTED IN PART AND DENIED IN PART as described in this Opinion and Order. Signed on 10/27/2017 by Judge Michael H. Simon. filed in all Associated Cases of 3:15-md-02633-SI (mja)

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF OREGON

IN RE: PREMERA BLUE CROSS
CUSTOMER DATA SECURITY BREACH
LITIGATION

Case No. 3:15-md-2633-SI
OPINION AND ORDER

This Document Relates to All Actions.
Kim D. Stephens, Christopher I. Brain, Chase C. Alvord, and Jason T. Dennett, TOUSLEY BRAIN
STEPHENS PLLC, 1700 Seventh Avenue, Suite 2200, Seattle, WA 98101; Keith S. Dubanevich
and Steve D. Larson, STOLL STOLL BERNE LOKTING & SHLACHTER PC, 209 SW Oak Street,
Portland, OR 97204; Tina Wolfson, AHDOOT AND WOLFSON PC, 1016 Palm Avenue, West
Hollywood, CA 90069; James Pizzirusso, HAUSFELD LLP, 1700 K Street NW, Suite 650,
Washington, DC 20006; and Karen Hanson Riebel, LOCKRIDGE GRINDAL NAUEN PLLP, 100
Washington Avenue South, Suite 2200, Minneapolis, MN 55401. Of Attorneys for Plaintiffs.
Paul G. Karlsgodt, BAKERHOSTETLER LLP, 1801 California Street, Suite 4400, Denver, CO
80202; James A. Sherer, BAKERHOSTETLER LLP, 45 Rockefeller Plaza, New York, NY 10111;
Daniel R. Warren and David A. Carney, BAKERHOSTETLER LLP, 127 Public Square, Suite 2000,
Cleveland, OH 44114; and Darin M. Sands, LANE POWELL PC, 601 SW Second Avenue,
Suite 2100, Portland, OR 97204. Of Attorneys for Defendant Premera Blue Cross.

Michael H. Simon, District Judge.
Plaintiffs bring this putative class action against Defendant Premera Blue Cross
(“Premera”), a healthcare benefits servicer and provider. On March 17, 2015, Premera publicly
disclosed that its computer network had been breached. Plaintiffs allege that this breach
compromised the confidential information of approximately 11 million current and former
PAGE 1 – OPINION AND ORDER

members, affiliated members, and employees of Premera. The compromised confidential
information includes names, dates of birth, Social Security Numbers, member identification
numbers, mailing addresses, telephone numbers, email addresses, medical claims information,
financial information, and other protected health information (collectively, “Sensitive
Information”). According to Plaintiffs, the breach began in May 2014 and went undetected for
nearly a year. Plaintiffs allege that after discovering the breach, Premera unreasonably delayed in
notifying all affected individuals. Based on these allegations, among others, Plaintiffs bring
various state common law claims and state statutory claims.
Before the Court is Plaintiffs’ motion to compel. Plaintiffs request an order requiring
Premera to produce certain documents, described by category, that Premera has withheld based
on assertions of attorney-client privilege or protection under the attorney work-product doctrine.
For the reasons discussed below, Plaintiffs’ motion is granted in part and denied in part.
STANDARDS
A. Applicable Law
Plaintiffs originally argued that Oregon law, as the law of the forum state, applies to the
parties’ dispute regarding the scope of the attorney-client privilege. Premera responds that
Washington law applies. In supplemental briefing, Plaintiffs concede that there is no material
conflict between Oregon and Washington law on the specific issues of attorney-client privilege
relevant to the pending motion. Thus, Plaintiffs do not oppose the application of Washington
law. The parties also agree that federal law governs the work-product doctrine in federal court.
B. Attorney-Client Privilege
Washington law recognizes that “in our open civil justice system, parties may obtain
discovery regarding any unprivileged matter that is relevant to the subject matter of the pending
action” and that the attorney-client privilege is “an exception to the general duty to disclose.”
PAGE 2 – OPINION AND ORDER

Newman v. Highland Sch. Dist. No. 203, 186 Wash.2d 769, 777 (2016). “A party claiming that
otherwise discoverable information is exempt from discovery on grounds of the attorney-client
privilege carries the burden of establishing entitlement to the privilege.” Id. In Newman, the
Washington Supreme Court explained the attorney-client privilege as follows:
Washington’s attorney-client privilege provides that “[a]n attorney
or counselor shall not, without the consent of his or her client, be
examined as to any communication made by the client to him or
her, or his or her advice given thereon in the course of professional
employment.” RCW 5.60.060(2)(a). But the attorney-client
privilege does not automatically shield any conversation with any
attorney. To qualify for the privilege, communications must have
been made in confidence and in the context of an attorney-client
relationship. It is a narrow privilege and protects only
communications and advice between attorney and client. The
privilege extends to corporate clients and may encompass some
communications with lower level employees, as both the United
States Supreme Court and this court have recognized.
The attorney-client privilege does not shield facts from discovery,
even if transmitted in communications between attorney and client.
Rather, only privileged communications themselves are protected
in order to encourage full and frank communication between
attorneys and their clients and thereby promote broader public
interests in the observance of law and administration of justice.
The attorney-client privilege recognizes that sound legal advice or
advocacy serves public ends and that such advice or advocacy
depends upon the lawyer being fully informed by the client.
However, because the privilege sometimes results in the exclusion
of evidence which is otherwise relevant and material, contrary to
the philosophy that justice can be achieved only with the fullest
disclosure of the facts, the privilege cannot be treated as absolute;
rather, it must be strictly limited to the purpose for which it exists.
Id. at 777-78 (quotation marks and citations omitted) (alteration in original).
It is well accepted that “[t]he attorney client privilege is limited to information related to
obtaining [legal] advice.” Mechling v. City of Monroe, 152 Wash. App. 830, 853 (2009). The
privilege “applies to any information generated by a request for legal advice, including
documents created by clients with the intention of communicating with their attorneys.” Doehne
PAGE 3 – OPINION AND ORDER

v. EmpRes Healthcare Mgmt., LLC, 190 Wash. App. 274, 281 (2015). It does not, however,
“protect documents that are prepared for some other purpose than communicating with an
attorney.” Morgan v. City of Fed. Way, 166 Wash.2d 747, 755 (2009) (quotation marks omitted).
Thus, “a document prepared for a purpose other than or in addition to obtaining legal advice and
intended to be seen by persons other than the attorney, does not become subject to the privilege
merely by being shown to the attorney.” Mechling, 152 Wash. App. at 853 (emphasis added).
Further, “if a portion of a document is not covered by the attorney-client privilege, under the
civil rules of discovery it must be disclosed.” Id.
In evaluating assertions of the attorney-client privilege in a corporate setting, the
Washington Supreme Court has adopted the U.S. Supreme Court’s “flexible” approach set forth
in Upjohn Co. v. United States, 449 U.S. 383 (1981). See Newman, 186 Wash.2d at 779. This
analysis allows non-managerial employees to qualify as the “client” for purposes of privilege
protection, based on considerations including:
whether the communications at issue (1) were made at the
direction of corporate superiors, (2) were made by corporate
employees, (3) were made to corporate counsel acting as such,
(4) concerned matters within the scope of the employee’s duties,
(5) revealed factual information not available from upper-echelon
management, (6) revealed factual information necessary to supply
a basis for legal advice, and whether the communicating employee
was sufficiently aware that (7) he was being interviewed for legal
purposes, and (8) the information would be kept confidential.
Id. at 778-779 (quotation marks omitted). The corporate attorney-client privilege, however, does
not extend to former employees. Id. at 779.
C. Work-Product Doctrine
The work-product doctrine “is not a privilege but a qualified immunity protecting from
discovery documents and tangible things prepared by a party or his representative in anticipation
of litigation.” Admiral Ins. Co. v. U.S. Dist. Court for the Dist. of Ariz., 881 F.2d 1486, 1494 (9th
PAGE 4 – OPINION AND ORDER

Cir. 1989) (citing Fed. R. Civ. P. 26(b)(3)). Documents or the compilation of materials prepared
by agents of the attorney in preparation for litigation may be covered by the work-product
doctrine. U. S. v. Richey, 632 F.3d 559, 567 (9th Cir. 2011). To qualify for work-product
protection, materials must: “(1) be prepared in anticipation of litigation or for trial and (2) be
prepared by or for another party or by or for that other party’s representative.” Id. (quotation
marks omitted).
When materials are prepared for a “dual purpose,” meaning they are not prepared
exclusively for litigation, then the “because of” test applies. Id. at 568. Under that test, “[d]ual
purpose documents are deemed prepared because of litigation if ‘in light of the nature of the
document and the factual situation in the particular case, the document can be fairly said to have
been prepared or obtained because of the prospect of litigation.’” Id. Courts, however, must view
“the totality of the circumstances and determine whether the document was created because of
anticipated litigation, and would not have been created in substantially similar form but for the
prospect of litigation.” Id. (quotation marks omitted).
The work-product doctrine also affords special or heightened protection to materials that
reveal an attorney’s mental impressions and opinions, i.e., “opinion” or “core” work product.
Admiral Ins. Co., 881 F.2d at 1494; Fed. R. Civ. P. 26(b)(3)(B). Work-product that does not rise
to the level of opinion or core work product may be ordered produced to an opposing party upon
a showing of substantial need for the information or that the information cannot be otherwise
obtained without undue hardship. Admiral Ins. Co., 881 F.2d at 1494; Fed R. Civ.
P. 26(b)(3)(A)(ii). To obtain the opinion or core work product, however, an opposing party must
show that the mental impressions of counsel are at issue in the case and the need for the material
is compelling. Holmgren v. State Farm Mutual Auto. Ins. Co., 976 F.2d 573, 577 (9th Cir. 1992).

PAGE 5 – OPINION AND ORDER

The primary purpose of the work-product doctrine is to “prevent exploitation of a party’s
efforts in preparing for litigation.” Admiral Ins. Co., 881 F.2d at 1494. Work-product protection,
like the attorney-client privilege, is waivable. Richey, 632 F.3d at 567.
D. Common Interest Doctrine
“The ‘common interest’ doctrine provides that when multiple parties share confidential
communications pertaining to their common claim or defense, the communications remain
privileged as to those outside their group.” Sanders v. State, 169 Wash.2d 827, 853 (2010); see
also C.J.C. v. Corp. of Catholic Bishop of Yakima, 138 Wash.2d 699, 716 (1999) (noting that
under the common interest or joint defense rule, “communications exchanged between multiple
parties engaged in a common defense remain privileged under the attorney-client privilege”).
“The common interest doctrine is an exception to the general rule that the voluntary disclosure of
a privileged attorney client or work product communication to a third party waives the
privilege.” Kittitas Cty. v. Allphin, 195 Wash. App. 355, 368 (2016), review granted in part, 187
Wash.2d 1001 (2017).
DISCUSSION
Plaintiffs move to compel production of four categories of documents. Plaintiffs seek:
(1) documents that Premera asserts incorporate the advice of counsel, but were not prepared by
or sent to counsel; (2) documents that Premera asserts were prepared at the request of counsel,
but were not prepared by or sent to counsel and appear to be business documents not prepared
because of litigation; (3) documents that relate to third-party vendor work on the data breach
investigation and remediation, including Mandiant’s work for Premera and other third-party
vendors working on technical and public relations aspects of the investigation and analysis; and
(4) documents that Premera is withholding, despite being sent to third-parties, based on what
Plaintiffs contend is an improper assertion of the joint defense or common interest exception to
PAGE 6 – OPINION AND ORDER

waiver of privilege. Premera responds that the first three categories involve documents prepared
by either Premera employees or third party vendors hired by outside counsel at the request of
counsel or under the supervision of counsel. Thus, argues Premera, they are properly withheld as
privileged or as protected under the work-product doctrine. Premera further responds that it
properly entered into common interest agreements with other Blue Cross-related entities, and
thus there was no waiver of privilege for documents sent to those entities.
Plaintiffs also argue that Premera is required to produce certain documents based on the
fiduciary exception to the attorney-client privilege because Premera admits that some of the
plans involved are governed by the Employee Retirement Income Security Act of 1974
(“ERISA”). Premera responds that the Court’s earlier decisions on Premera’s motions to dismiss
render this argument without merit, that Washington has not yet adopted the fiduciary exception,
and that even if the exception applies in Washington it would not apply to the specific documents
being withheld in this case.
A. Application of Attorney-Client Privilege and Work-Product Doctrine
1. Documents that Premera asserts incorporate advice of counsel, but were not
prepared by or sent to counsel (Category 1)
The documents in Category 1 were drafted by persons who are not attorneys and were
sent to and from persons who are not attorneys. Although these documents contain or reference
business, technical, or public relations information, Premera argues that they are properly
withheld as privileged because they are “drafts” that incorporate the advice of counsel. Some of
these documents include edits or “redlines” from counsel. Others are drafts prepared by counsel
that include edits or redlines by Premera personnel who are not attorneys. For some of these
drafts, Premera has produced to Plaintiffs the final version, e.g., certain press releases and
notices.
PAGE 7 – OPINION AND ORDER

Premera argues that Washington’s law on attorney-client privileged communications is
broader than the law governing other jurisdictions. Premera asserts that under Washington law
any communication made during the course of an attorney-client relationship, regardless of
whether the communication pertains to business or legal advice, is protected. In support of this
broad proposition, Premera primarily relies on a state trial court’s opinion in Sanders v. State,
2007 WL 77774753, at *13 (Wash. Superior Ct., Thurston Cty., Jan. 12, 2007). The Court in the
pending case, however, generally relies upon and follows the articulation of Washington law
announced by the Washington Supreme Court or the Washington Court of Appeals, rather than
by a state trial court in Washington.
The Washington Supreme Court recently reiterated, after quoting Washington’s privilege
statute, that the attorney-client privilege is a “narrow privilege,” that it “does not shield facts
from discovery, even if transmitted in communications between attorney and client,” and that it
“must be strictly limited to the purpose for which it exists.” Newman, 186 Wash.2d at 777-78.
The Washington Supreme Court also has explained that the attorney-client privilege “does not
protect documents that are prepared for some other purpose than communicating with an
attorney.” Morgan, 166 Wash.2d at 755. Additionally, the Washington Court of Appeals has
explained that the privilege is limited only “to information related to obtaining [legal] advice”
and that documents “prepared for a purpose other than or in addition to obtaining legal advice
and intended to be seen by persons other than the attorney, does not become subject to the
privilege merely by being shown to the attorney.” Mechling, 152 Wash. App. at 853 (emphasis
added). Thus, the Court rejects Premera’s broad construction of Washington’s law of attorneyclient privilege.

PAGE 8 – OPINION AND ORDER

Considering the attorney-client privilege as explained by Washington’s appellate courts,
it appears that many of the documents in Category 1 being withheld by Premera are not protected
under the attorney-client privilege. Premera has withheld entire drafts of documents that it was
required as a business to prepare in response to the data breach. Premera prepared press releases
and notices to be sent to its customers. The fact that Premera planned eventually to have an
attorney review those documents or that attorneys may have provided initial guidance as to how
Premera should draft internal business documents does not make every internal draft and every
internal communication relating to those documents privileged and immune from discovery.
All of the withheld documents are not internal factual or investigatory reports prepared at
the request of counsel to inform counsel of the underlying facts so that counsel can provide
adequate legal advice or representation, such as was the case in Doehne, relied on by Premera.
Instead, the Category 1 documents include business documents that the company would have
prepared regardless of any concern about litigation. Placing them under the supervision of
outside counsel and then labelling all communications relating to them as privileged does not
properly establish an attorney-client privilege. The focus of the privilege must be the purpose for
which a document was created. See Doehne, 190 Wash. App. at 282-83. The primary purpose of
drafting press releases, notices to customers, and similar documents was not to communicate
with counsel or prepare for litigation.
There may be some documents, however, that contain protected attorney-client
communications, such as drafts that include edits or redlines by an attorney communicating legal
advice. If underlying edited or redlined documents contain legal advice from counsel, those
documents (or at least the edits or redlines) are entitled to protection. Although an attorney may
wear “two hats” when reviewing a document for both a business and a legal purpose, some of the

PAGE 9 – OPINION AND ORDER

documents described in Category 1 appear to have been created with anticipated litigation in
mind. Therefore, when an edit or redline was not done solely for a business purpose and the edit
or redline communication appears to constitute legal advice under Washington’s law of attorneyclient privilege, that edit or redline need not be disclosed. Additionally, if there are documents
for which the primary purpose was to prepare for litigation, to advise counsel of underlying facts
to help with counsel’s legal representation, or otherwise to communicate with counsel for the
purpose of receiving legal advice or representation, those documents would be protected under
the attorney-client privilege.
2. Documents that Premera asserts were prepared at the request of counsel, but
were not prepared by or sent to counsel and appear to be business documents
not prepared because of litigation (Category 2)
The documents in Category 2 include those prepared by Premera employees and thirdparty vendors who are not attorneys. According to Premera, these documents contain information
requested by counsel, including information relating to technical aspects of the breach and its
mitigation, company policies, public relations and media matters, and remediation activities. The
third-party vendors were retained by Premera’s outside counsel. Premera argues that the
documents are properly withheld as both privileged and protected under the work-product
doctrine. Premera asserts that these are documents that were prepared primarily in anticipation of
litigation and for the purpose of facilitating legal advice.
a. Attorney-client privilege
As with the Category 1 documents, the Court finds that the primary purpose of many of
the documents in Category 2 was not to communicate with counsel or obtain legal advice,
Morgan, 166 Wash.2d at 755, but instead to perform a business function. For example, one of
the third-party vendors is Edelman, a public relations firm. As discussed above, drafting press
releases relating to a security breach is a business function that Premera would have engaged in,
PAGE 10 – OPINION AND ORDER

regardless of actual or potential litigation. Having outside counsel hire a public relations firm is
insufficient to cloak that business function with the attorney-client privilege. See Brawner v.
Allstate Indem. Co., 2007 WL 3229169, at *4 (E.D. Ark. Oct. 29, 2007) (“Defendant may not
generally assert a blanket privilege as to those facts that were generated by its investigation
merely because those facts were subsequently incorporated into a communication to counsel, or
because they elected to delegate their ordinary business obligations to legal counsel.” (quotation
marks omitted)); Lumber v. PPG Indus., Inc., 168 F.R.D. 641, 646 (D. Minn. 1996) (noting that
the plaintiffs could not “shield their investigation . . . merely because they elected to delegate
their ordinary business obligations to legal counsel”); SCM Corp v. Xerox Corp., 70 F.R.D. 508,
515 (D. Conn. 1976) (“Legal departments are not citadels in which public, business or technical
information may be placed to defeat discovery and thereby ensure confidentiality.”); cf. Simon v.
G.D. Searle & Co., 816 F.2d 397, 403 (8th Cir. 1987) (noting that the “attorney-client privilege
does not protect client communications that relate only [to] business or technical data”); United
States v. Heine, 2016 WL 6138245, *1-2 (D. Or. Oct. 21, 2016) (noting the “vexing legal
challenge” of corporate entities “exaggerat[ing] attorney-client privilege claims” by including
attorneys on email communications and making “blanket, sweeping invocations of the privilege”
that “ignore the principle that communications received by an attorney are protected by the
privilege only if the primary purpose of the communications (or segregable portions of them)
was to obtain legal advice or assistance” and not when “the communication’s primary purpose is
business, not legal”); Becker v. Willamette Cmty. Bank, 2014 WL 2949334, at *3 (D. Or. June
30, 2014) (“While a corporation is certainly free to seek business advice from counsel, business
advice does not become legal advice simply because it is rendered by counsel.”); Kaufman &
Broad Monterey Bay v. Travelers Prop. Cas. Co. of Am., 2011 WL 2181692, at *6, n.3 (N.D.

PAGE 11 – OPINION AND ORDER

Cal. June 2, 2011) (noting that an insurer cannot delegate a coverage investigation to an attorney,
which is part of the insurer’s business and then claim “work product privilege”). The fact that
litigation may have been reasonably anticipated to occur at some point in the future does not
convert these business functions into legal functions or make all communications relating to
these functions privileged or subject to work product protection. See Piatkowski v. Abdon Callais
Offshore, L.L.C., 2000 WL 1145825, at *2 (E.D. La. Aug. 11, 2000) (“[C]ourts have routinely
recognized that the investigation and evaluation of claims is part of the regular, ordinary, and
principal business of insurance companies. Thus, even though litigation is pending or may
eventually ensue does not cloak such routinely generated documents with work product
protection.”).
Premera relies primarily on In re Copper Market Antitrust Litig., 200 F.R.D. 213
(S.D.N.Y. 2001), to support its argument that press releases and media relations, when
supervised by attorneys, are legal advice and privileged. Copper Market, however, involved
different facts and different types of communications. In Copper Market, the public relations
firm was hired by the corporation, not the attorneys. Id. at 215. The court found that the public
relations firm was the “functional equivalent of an in-house public relations department,” id.
at 216, and “was, essentially, incorporated into [the corporation’s] staff to perform a corporate
function.” Id. at 219. Because the public relations firm was an agent of the corporation, it could
step into the shoes of the corporation for purposes of asserting the corporation’s attorney-client
privilege. Id. at 219. Thus, the court found that confidential communications between the public
relations firm and the corporation, inside counsel, or outside counsel “that were made for the
purpose of facilitating the rendition of legal services to [the corporation] can be protected from
disclosure by the attorney-client privilege.” Id. The Cooper Market case, thus, does not support

PAGE 12 – OPINION AND ORDER

Premera’s contention that its outside counsel can hire a public relations firm and then exclude
from discovery under the attorney-client privilege all communications relating to public
relations.
The same is true of the other business functions that Premera delegated to its outside
counsel for supervision. Premera has not met its burden of demonstrating that all of these
documents are privileged. Accordingly, drafts of documents prepared by Premera employees and
third-party vendors relating to the business functions that Premera had to perform regardless of
litigation, including preparing press releases, media interactions, and notices, are not privileged.
Communications relating to those drafts similarly are not automatically privileged. If, however,
communications were sent to or from counsel seeking or providing actual legal advice, such as
about possible legal consequences of proposed text or an action being contemplated by Premera,
then such communications would be privileged. See Dawson v. New York Life Ins. Co., 901 F.
Supp. 1362, 1367 (N.D. Ill. 1995) (noting that there is a difference between providing “legal
information” and “legal advice,” that privilege only attaches to the latter, that the latter would
include consultation “concerning the legal consequences of what they might say in their speeches
or . . . advice on the legal consequences of what was included” in a document, but finding that
because such information was not sought “the attorneys were acting more as courier[s] of factual
information, rather than legal advisers” and the communications were not privileged (alterations
in original) (quotation marks omitted)).
b. Work-product protection
Assuming without deciding that the Category 2 draft documents and communications had
a dual purpose—both business and legal, the Court must consider whether the communications
and documents were prepared “because of” the prospect of litigation. Richey, 632 F.3d at 568.
Looking at the totality of the circumstances, the Category 2 documents generally are not
PAGE 13 – OPINION AND ORDER

protected by the work-product doctrine. Premera has not shown that the documents were created
because of litigation rather than for business reasons, or that the documents “would not have
been created in substantially similar form but for the prospect of litigation.” Id. (quotation marks
omitted). Moreover, as discussed above, delegating business functions to counsel to oversee does
not provide work-product protection to the materials created for those business functions. See
Kaufman, 2011 WL 2181692, at *6, n.3; Brawner, 2007 WL 3229169, at *4; Piatkowski, 2000
WL 1145825, at *2; Lumber, 168 F.R.D. at 646. If Premera can show that a particular document
was prepared specifically in anticipation of litigation, contains the mental impressions of
counsel, and would not have been prepared in substantially the same form but for the prospect of
litigation, then Premera may assert work-product protection for that specific document.
3. Documents that relate to Mandiant’s work for Premera, including the Mandiant
Remediation Report, and other third-party vendors’ technical and public
relations aspects of the investigation and analysis (Category 3)
a. Mandiant
The facts surrounding the Mandiant report(s) are not particularly clear to the Court.
Plaintiffs move to have Premera produce the Mandiant “Remediation Report.” Premera states
that it already has produced the Mandiant “Intrusion Report,” subject to an agreement that such
production does not constitute a waiver of privilege, but adds that drafts and other documents
relating to that report are privileged and protected by the work-product doctrine. It is not clear to
the Court whether the “Intrusion Report” and “Remediation Report” are two different
documents.
Mandiant was hired by Premera in October 2014 to review Premera’s data management
system. On January 29, 2015, Mandiant discovered the existence of malware in Premera’s
system. On February 20, 2015, Premera hired outside counsel in anticipation of litigation as a
result of the recently discovered data breach. On February 21, 2015, Premera and Mandiant
PAGE 14 – OPINION AND ORDER

entered into an amended statement of work that shifted supervision of Mandiant’s work to
outside counsel. The amended statement of work, however, did not otherwise change the scope
of Mandiant’s work from what was described in the Master Services Agreement between
Mandiant and Premera entered into on October 10, 2014. Several weeks after the February 21st
agreement, Mandiant issued a report.
Premera argues that Mandiant is the equivalent of a private investigator or other
investigative resource hired by an attorney to conduct an investigation on behalf of an attorney,
and thus that Mandiant’s work is privileged and protected as work-product. The flaw in
Premera’s argument, however, is that Mandiant was hired in 2014 to perform a scope of work for
Premera, not outside counsel. That scope of work did not change after outside counsel was
retained. The only thing that changed was that Mandiant was now directed to report directly to
outside counsel and to label all of Mandiant’s communications as “privileged,” “work-product,”
or “at the request of counsel.” Premera argues that, with respect to Mandiant, after the breach
was discovered and outside counsel was hired it became an entirely different situation. The
amended statement of work, however, does not support that assertion. The only thing that
appears to have changed involving Mandiant was the identity of its direct supervisor, from
Premera to outside counsel. The amended statement of work confirms that the scope of the work
remained the same. Thus, Premera’s argument that Mandiant’s focus shifted in February 25,
2015, and that Mandiant then became more like an investigator working on behalf of outside
counsel instead of performing its original role on behalf of Premera, is not supported by the
amended statement of work.
This situation is unlike the Target data breach case relied upon by Premera. In Target, the
company performed its own independent data breach investigation that was produced in

PAGE 15 – OPINION AND ORDER

discovery and the attorneys performed a separate investigation through a retained expert
company that was privileged and protected from discovery. In re Target Corp. Customer Data
Sec. Breach Litig., 2015 WL 6777384, at *2 (D. Minn Oct. 23, 2015). With Premera, however,
there was only one investigation, performed by Mandiant, which began at Premera’s request.
When the supervisory responsibility later shifted to outside counsel, the scope of the work
performed did not change. Thus, the change of supervision, by itself, is not sufficient to render
all of the later communications and underlying documents privileged or immune from discovery
as work product.
This situation also is unlike the Experian case relied on by Premera. In re Experian Data
Breach Litig., Case No. 8:15-cv-01592-AG-DFM (C.D. Cal.). In that case, outside counsel was
hired by the compnay and outside counsel then hired Mandiant. Id. ECF 239 at 3. Here, Premera
had already hired Mandiant, which was performing an ongoing investigation under Premera’s
supervision before outside counsel became involved. Premera has the burden of showing that
Mandiant changed the nature of its investigation at the instruction of outside counsel and that
Mandiant’s scope of work and purpose became different in anticipation of litigation versus the
business purpose Mandiant was performing when it was engaged by Premera before the
involvement of outside counsel. Premera has not made that showing.
Considering work-product protection, the Court looks at the “dual-purpose” test. Looking
at the totality of the circumstances, particularly the fact that the amended statement of work did
not change the scope of work and there is no evidence that Mandiant changed its scope or
purpose at the direction of outside counsel, the Court concludes that Premera has not shown that
all of the underlying documents relating to the Mandiant reports were created because of
anticipated litigation and “would not have been created in substantially similar form but for the

PAGE 16 – OPINION AND ORDER

prospect of litigation.” Richey, 632 F.3d at 568. Premera, however, has expressed concern, which
the Court shares, that given Mandiant’s role in working with outside counsel, there may be some
privileged communications or work-product protected information in the withheld documents.
Thus, if there are specific documents or portions of documents that Premera contends contain
privileged information (in the sense that they were prepared for the purpose of communicating
with an attorney for the provision of legal advice) or work-product information (in the sense that
they contain the mental impressions of counsel prepared in anticipation of litigation,
communications to counsel to provide factual information so that counsel can prepare for
litigation, or involve a factual investigation done solely at the behest of counsel for purposes of
litigation and no longer under the scope of work as originally agreed upon with Premera), then
they may properly be withheld.
b. Third-party vendors
The analysis for these Category 3 documents is the same as for the documents in
Categories 1 and 2. These are the documents created by the third-party vendors hired by outside
counsel. Many of these documents appear to be related to business functions delegated to
counsel. There appear to be some documents, however, that are or may be related to legal
functions and are thus properly protected by the attorney-client privilege or work-product
doctrine. The documents relating to Epiq appear to be legal in nature and thus not a business
function; they may be withheld. There also appear to be several electronic discovery vendors for
whom it is unclear whether the work performed is of a legal or business nature. Premera
provided the Court with the written agreement between Altep, Inc. and Premera, which
references a statement of work, but Premera did not provide a copy of the statement of work.
Without reviewing the statement of work, it is not clear whether Altep was performing litigation
discovery services for counsel or computer technical assistance services for Premera. If it was
PAGE 17 – OPINION AND ORDER

the former, then Altep would not be performing a business function and the information would
be privileged or protected by the work-product doctrine. Similarly, e-Discovery, iDiscover, LLC,
and Navigant are vendors that appear to be providing services relating to electronic discovery or
discovery-related computer forensic assistance. If those services are being performed for counsel
as litigation-support for discovery, they would not constitute non-legal business functions and
would be privileged or protected by the work-product doctrine. If, however, they are services
being performed for the benefit of Premera as part of the investigation or remediation of the
breach, they likely would be a business function and thus discoverable. The other third-party
vendors appear to be performing business functions and thus their documents and
communications would not be protected by privilege or work-product.
Premera argues that under Upjohn and Washington law attorneys are entitled to obtain
factual information from third parties in order to be able to provide legal advice. First, the Court
notes that the Washington Supreme Court, although noting that Washington has adopted Upjohn,
also expressly noted that “[t]he attorney-client privilege does not shield facts from discovery,
even if transmitted in communications between attorney and client.” Newman, 186 Wash.2d
at 778. Second, the Court notes that it appears that Premera has withheld as privileged all
communications relating to press releases, notifications, remediation, and the like, and not just
communications to counsel that constitute “the giving of information to the lawyer to enable him
to give sound and informed advice.” Upjohn, 449 U.S. at 390. As discussed above, Premera’s
attempt to label all communications on these subjects as necessary investigative steps required to
give information to Premera’s counsel in connection with legal advice is not persuasive.

PAGE 18 – OPINION AND ORDER

4. Documents that Premera is withholding, despite being sent to third-parties,
based on what Plaintiffs contend is an improper assertion of the joint defense (or
common interest) exception (Category 4)
The documents described in Category 4 involve Premera’s assertion of a common interest
or joint defense exception to waiver of privilege for other entities, such as Blue Cross Blue
Shield, CareFirst,1 and Anthem entities, all of which have suffered data breaches and are facing
similar litigation. The purported common interest is that defendants are defending different cases
and government investigations throughout the country with common issues. These cases and
investigations include, among others, In Re Anthem, Inc. Data Breach Litigation, MDL 2617,
Case No. 15-md-02617-LHK (N.D. Cal.); Ross v. Blue Cross Blue Shield Association, et al.,
Case No. 1:15-cv-2006 (N.D. Ill); and Ames, et al. v. Anthem, Inc., Case No. 1:15-cv-465-SEBTAB (S.D. Ind.). Premera and these entities have entered into common interest agreements that
purport to allow them to share confidential and privileged information without waiving attorneyclient privilege. Plaintiffs argue that because Premera and these entities are not defendants in the
same litigation, they cannot assert the common interest or joint defense exception to waiver of
privilege, and thus any documents that have been provided to these third parties have had the
privilege waived for those communications, and all other communications on the same subject
matter.
Generally, joint defense or common interest parties are parties within the same litigation.
Cf. C.J.C., 138 Wash.2d at 716 (noting that the joint defense or common interest rule applies
where “multiple parties [are] engaged in a common defense” (emphasis added)); Kittitas
Cty., 195 Wash. App. at 368 (noting that the communications must be “made by separate parties

1

Although Premera referred to “CareFirst” at oral argument, that entity does not appear
to be a party to any of the common interest agreements. If the Court’s conclusion is incorrect,
Premera has leave to provide additional documentary support.
PAGE 19 – OPINION AND ORDER

in the course of a matter of common interest or joint defense” (emphasis added) (quoting
Avocent Edmond Corp. v. Rose Elecs., Inc., 516 F. Supp. 2d 1199, 1203 (W.D. Wash. 2007))).
Some of the entities with whom Premera has asserted a common interest are not only not part of
this litigation, but they are not subject to potential liability from the same data breach. The
lawsuits that they face may involve similar legal theories, claims, and defenses, but they arise
from different facts and, most importantly, different data breaches. Premera relies primarily upon
Broyles v. Thurston County, 147 Wash. App. 409 (2008), to argue that defendants in different
lawsuits involving different underlying facts but similar claims can rely on the common interest
doctrine. Premera, however, reads too much into Broyles.
Broyles involved a situation where a group of four employees visited two attorneys to
discuss a situation at work and decide whether to bring claims of sexual harassment and hostile
work environment. Id. at 417, 441. Three of the group pursued the case with those two attorneys
and the fourth decided not to pursue the case and later attempted to testify about the original
meeting. Id. at 442. The trial court found that because all four people went “as a group with a
common problem, statements of all are protected” under the common interest doctrine. Id. at
443. The Washington Court of Appeals found no error in that conclusion. Id.
Broyles, however, does not support Premera’s contention that defendants in separate
lawsuits based on separate data breaches occurring on separate occasions nevertheless can
invoke the common interest doctrine when they discuss related legal issues and concepts. Broyles
supports the traditional interpretation of “common” interest—that the parties share either a claim
or potential liability in “common,” which depends on a common nucleus of operative facts.
Generally, this means that the common interest parties are in the same lawsuit, or at the
minimum may share a common or related liability or claim. See also Mockovak v. King Cty., 197

PAGE 20 – OPINION AND ORDER

Wash. App. 1013, 2016 WL 7470087, at *11 (Dec. 19, 2016) (unpub.) (finding common interest
doctrine applied when federal and state agencies shared privileged investigative and prosecuting
information, even though only the state agency ended up prosecuting), rev. denied, 188 Wash.2d
1009, 394 P.3d 1015 (2017), and cert. denied, 2017 WL 3386658 (U.S. Oct. 10, 2017).2
Premera stretches the definition of “common interest” beyond reasonable bounds. Under
Premera’s interpretation, different people or entities around the country that have a similar
alleged product defect, or allegedly engaged in similar fraudulent schemes, or have been accused
of similar forms of misconduct generally can claim a common interest and enter into common
interest agreements. Under Premera’s argument, as long as the claims asserted against those
parties are the same or reflect the same the theory of liability, then they would have a “common”
defense. That is not, however, how the common interest or joint defense doctrine works.
The common interest agreement between Premera and the Anthem entities fails under the
proper definition of a “common” interest because that agreement involves different underlying
data breaches. The common interest agreement between Premera and the Blue Cross and Blue
Shield Association, however, states that its underlying matters “involve claimed liability for and
as a result of a recent criminal intrusion into Premera’s computer systems” (emphasis added).
This appears to indicate that the potential shared liability is specific to the intrusion that is the
subject matter of this pending litigation. To the extent that there are other matters arising out of
the very same intrusion at issue in this case, and thus involving the same nucleus of operative
facts that are part of this case, they would be part of the common liability and subject to the
2

The Court does not imply that there are no circumstances under which the common
interest doctrine could apply to separate lawsuits. There may, for example, be circumstances in
which parties share a common liability based on the same underlying set of facts but because of
diversity issues some defendants are sued in state court and others are sued in federal court. The
Court is not making any ruling about such a circumstance.
PAGE 21 – OPINION AND ORDER

protections of the common interest doctrine. The agreement continues, however, to state that it
includes litigation and investigations “involving other conduct alleged to be similar to or
connected with” the intrusion (emphasis added). Data breaches that merely are “similar to” the
underlying data breach or otherwise somehow “connected with” it are not a common liability,
properly understood, with this case and thus are not properly subject to the common interest
doctrine. From the Court’s review of the matters identified or described in Schedule A that was
attached to the purported common interest agreement, they are all cases that are included in the
multi-district litigation before this Court concerning the data breach at Premera. Thus, those
parties are properly part of a common interest agreement. To the extent, however, that any
documents were shared with any third party whose purported common interest is not based on
the same underlying data breach as is the subject matter in this case, there is no common interest
doctrine protection for those disclosures.
As discussed above, communications between Premera and entities with data breaches
other than the data breach that is the subject of this case, even if the data breach is “similar” or
“connected to,” are not protected by the common interest doctrine. Thus, those communications
are not privileged, and otherwise privileged information contained in such communications has
had the privilege waived. Regarding the scope of this waiver, “[t]he widely applied standard for
determining the scope of a waiver of attorney-client privilege is that the waiver applies to all
other communications relating to the same subject matter.” Fort James Corp. v. Solo Cup
Co., 412 F.3d 1340, 1349 (Fed. Cir. 2005). The party asserting privilege bears the “burden to
show that fairness does not require waiver of the privilege over documents relating to the same
subject matter as the documents disclosed.” Theranos, Inc. v. Fuisz Techs., Ltd., 2013
WL 2153276, at *3 (N.D. Cal. May 16, 2013). The Court finds that because Premera believed in

PAGE 22 – OPINION AND ORDER

good faith that it and these entities were subject to the common interest exception to waiver,
under the unique circumstances of this case, fairness requires that the waiver of privilege extend
only to the communications actually shared among the entities and not to all documents relating
to the same subject matter that was addressed in the communications that were shared.
Plaintiffs also move to compel production of the common interest agreements
themselves, relying on federal case authority. Although there is no Washington case on point, the
Washington Court of Appeals has cited with approval federal cases discussing the common
interest doctrine. See Kittitas Cty., 195 Wash. App. at 368; Sharbono v. Univ. Underwriters Ins.
Co., 162 Wash. App. 1050, 2011 WL 2848801, at *8-9 (2011) (unpub.). Premera does not
specifically respond to this argument or legal authority, other than to state that it has described
the agreements and that it has produced a “sample” agreement. This response is neither
persuasive nor sufficient. Moreover, in light of the fact that the Court finds most of the claim of
common interest not to be valid and that the Court has reviewed the agreements and finds them
not to contain privileged information, the Court directs that the agreements themselves be
produced.
B. Redactions
Plaintiffs argue that Premera may redact documents that contain some privileged and
some nonprivileged information and must then produce the nonredacted portions. The Court
agrees. When an email chain contains an email that is privileged or contains privileged
information and the remaining emails in that chain do not contain privileged information, the
privileged material may be redacted but the remaining material must be produced.
The Court notes that Premera represents that some email chains contain no more than
“FYI” or the like for the nonprivileged portion and that it would be burdensome to redact the
entire privileged portion to only produce a document containing “FYI.” The Court agrees. But
PAGE 23 – OPINION AND ORDER

that was done before this Court issued this Opinion and Order, in which many of Premera’s
privilege assertions have been rejected. Going forward, if there is an email string and the only
nonprivileged portion is something without substance such as “FYI,” Premera need only identify
it as such on the privilege log and need not redact and produce the meaningless nonprivileged
portion.
C. Fiduciary Exception to the Attorney-Client Privilege
Plaintiffs argue that, for purposes of the attorney-client privilege in the ERISA context,
the “real client” on matters of plan administration is not the trustee but the plan beneficiaries,
citing to United States v. Mett, 178 F.3d 1058, 1063 (9th Cir. 1999). Thus, argue Plaintiffs, the
holder of the attorney-client privilege is not Premera and, therefore, Premera may not withhold
documents from plan beneficiaries on matters of plan administration on the basis of privilege.
Premera responds that the Court has already found that no fiduciary relationship exists in this
case, that Washington law has not recognized the fiduciary exception and the Court should not
expand the law of privilege in Washington, and that even if the exception were recognized in
Washington the privilege is not being asserted on matters of plan administration.
The Court previously ruled that Plaintiffs failed to state a claim under state law for breach
of fiduciary duty. In re Premera Blue Cross Customer Data Sec. Breach Litig., 198 F. Supp. 3d
1183, 1203 (D. Or. 2016). The Court did not, however, find that Premera did not owe any duties
as an ERISA fiduciary. That issue was not before the Court. Similarly, when the Court decided
that ERISA did not preempt Plaintiffs’ state law claims, the Court did not find that Premera was
not an ERISA fiduciary. In fact, the Court found that ERISA applied and that some of Plaintiffs’
claims could have been brought under ERISA, but that Plaintiffs’ claims were not preempted
because Plaintiffs alleged an independent duty based on state law. In re: Premera Blue Cross
Customer Data Sec. Breach Litig., 2017 WL 539578, at *20-22 (D. Or. Feb. 9, 2017).
PAGE 24 – OPINION AND ORDER

Regarding whether the so-called fiduciary exception to attorney-client privilege applies in
Washington, Plaintiffs argue that it is not an exception at all. Plaintiffs quote Mett, in which the
Ninth Circuit explained that “the fiduciary exception is not an ‘exception’ to the attorney-client
privilege at all. Rather, it merely reflects the fact that, at least as to advice regarding plan
administration, a trustee is not ‘the real client’ and thus never enjoyed the privilege in the first
place.” Mett, 178 F.3d at 1063.
The Court need not reach the issue of the scope of Premera’s fiduciary obligations under
ERISA or whether the so-called fiduciary exception applies in Washington. Even assuming that
Premera has fiduciary obligations and that the so-called fiduciary exception applies in
Washington, the types of documents that the Court has allowed Premera to maintain as
privileged, as more fully described above, are all documents that are “defensive on the trustees’
part and aimed at advising the trustees how far they were in peril.” Mett, 178 F.3d at 1064
(quotation marks omitted). Thus, “the attorney-client privilege remains intact” because the “plan
fiduciary [had] retain[ed] counsel in order to defend herself against the plan beneficiaries.” Id.
As discussed earlier in this decision, the Court has already ordered to be produced documents
that could be considered related to benefitting plan members (where the “client” could be
ERISA-covered Plaintiffs) and not as constituting legal advice for the trustees.
CONCLUSION
Plaintiffs’ Motion to Compel (ECF 110) is GRANTED IN PART AND DENIED IN
PART as described in this Opinion and Order.
IT IS SO ORDERED.
DATED this 27th day of October, 2017.
/s/ Michael H. Simon
Michael H. Simon
United States District Judge
PAGE 25 – OPINION AND ORDER