Fero v. Excellus Health Plan, Inc.

• Decision Date: 23 November 2020
• Docket Number: 6:15-cv-06569 EAW
• Citation: 502 F.Supp.3d 724
• Parties: Matthew FERO, et al., Plaintiffs, v. EXCELLUS HEALTH PLAN, INC., et al., Defendants.
• Court: U.S. District Court — Western District of New York

502 F.Supp.3d 724

Matthew FERO, et al., Plaintiffs,

v.EXCELLUS HEALTH PLAN, INC., et al., Defendants.

6:15-cv-06569 EAW

United States District Court, W.D. New York.

Signed November 23, 2020

Jason T. Dennett, Pro Hac Vice, Tousley Brain Stephens PLLC, Seattle, WA, Kathryn Lee Bruns, Stephen G. Schwarz, Hadley L. Matarazzo, Faraci Lange LLP, Rochester, NY, Robin L. Greenwald, Pro Hac Vice, James J. Bilsborrow, Weitz & Luxenberg, P.C., New York, NY, Joshua Mankoff, Lopez McHugh, LLP, Moorestown, NJ, for Plaintiffs Matthew Fero, James J. Smith, Jr., Sharon C. Smith, Barbara A. Palmer.

Jason T. Dennett, Pro Hac Vice, Tousley Brain Stephens PLLC, Seattle, WA, Joshua Mankoff, Lopez McHugh, LLP, Moorestown, NJ, Hadley L. Matarazzo, Faraci Lange LLP, Rochester, NY, for Plaintiffs Cathryn Kwit, Robert Kwit, Roger A. Carroll, D.D.S., Andres Curbelo, Brenda Caltagarone, Cindy Harden, Nina Mottern, Thomas Albrecht, Don Korn, Dwayne Church.

Hadley L. Matarazzo, Kathryn Lee Bruns, Faraci Lange LLP, Rochester, NY, James J. Bilsborrow, Robin L. Greenwald, Pro Hac Vice, Weitz & Luxenberg, P.C., New York, NY, Jason T. Dennett, Pro Hac Vice, Tousley Brain Stephens PLLC, Seattle, WA, Joshua Mankoff, Lopez McHugh, LLP, Moorestown, NJ, for Plaintiff Harold Jackling.

Anna L.R. Mercado Clark, Phillips Lytle LLP, Edward John Jacobs, Emily Fedeles, Pro Hac Vice, Robyn Mara Feldstein, Karin Scholz Jenson, Baker & Hostetler LLP, New York, NY, Jennifer A. Beckage, Beckage PLLC, John G. Schmidt, Jr., Phillips Lytle LLP, Buffalo, NY, Paul G. Karlsgodt, Baker & Hostetler LLP, Denver, CO, David A. Carney, Baker & Hostetler LLP, Cleveland, OH, Mark J. Moretti, Phillips Lytle LLP, Rochester, NY, for Defendants Excellus Health Plan, Inc., Lifetime Healthcare, Inc.

Anna L.R. Mercado Clark, Phillips Lytle LLP, Edward John Jacobs, Emily Fedeles, Pro Hac Vice, Robyn Mara Feldstein, Baker & Hostetler LLP, New York, NY, Jennifer A. Beckage, Beckage PLLC, Buffalo, NY, David A. Carney, Baker & Hostetler LLP, Cleveland, OH, for Defendants Lifetime Benefit Solutions, Inc., Genesee Region Home Care Association, Inc., Genesee Valley Group Health Association, MedAmerica, Inc., Univera Healthcare.

Adam P. Feinberg, Miller & Chevalier Chartered, Washington, DC, Jeffrey J. Harradine, Thomas S. D'Antonio, Ward Greenberg Heller & Reidy LLP, Rochester, NY, Kate Warner, Pro Hac Vice, Luke C. Ruse, Pro Hac Vice, Sunil Shenoi, Pro Hac Vice, Brian P. Kavanaugh, Pro Hac Vice, Daniel Laytin, Pro Hac Vice, Zachary Holmstead, Pro Hac Vice, Kirkland & Ellis LLP, Chicago, IL, for Defendant Blue Cross and Blue Shield Association.

DECISION AND ORDER

ELIZABETH A. WOLFORD, United States District Judge

INTRODUCTION

This putative class action arises out of a data breach where hackers gained access to defendant Excellus Health Plan, Inc.’s ("Excellus") computer network and the personal information stored therein. Plaintiffs are individuals whose personal information was stored on Excellus's computer network at the time of the data breach. They assert claims of negligence, negligence per se , breach of contract and of the implied covenant of good faith and fair dealing, and unjust enrichment against defendants Excellus, Lifetime Healthcare, Inc. ("Lifetime"), Lifetime Benefit Solutions, Inc., Genesee Region Home Care Association, Inc. d/b/a Lifetime Care, Genesee Valley Group Health Association d/b/a Lifetime Health Medical Group, MedAmerica, Inc., and Univera Healthcare (collectively the "Excellus Defendants"), and claims for the violation of various state consumer protection laws against the Excellus Defendants and defendant Blue Cross and Blue Shield Association ("BCBSA").¹ (Dkt. 312).

Presently before the Court are five motions: (1) the Excellus Defendants’ motion for clarification of the Court's prior orders as to standing (Dkt. 376); (2) Plaintiffs’ motion for class certification (Dkt. 387); (3) Defendants’ motion to exclude the expert declarations of James Van Dyke and Gregory Allenby (Dkt. 417); (4) Plaintiffs’ motion to strike the declaration of Excellus employee James Keddell and for sanctions (Dkt. 446); and (5) Plaintiffs’ motion to exclude certain testimony of Defendants’ experts Robert E. Anderson, Jr. and C. Federico Campbell (Dkt. 456). For the reasons that follow, the Court: (1) grants in part and denies in part the Excellus Defendants’ motion for clarification; (2) denies Defendants’ motion to exclude the testimony of Plaintiffs’ experts as moot; (3) denies Plaintiffs’ motion to exclude the testimony of Defendants’ experts as moot; (4) denies Plaintiffs’ motion to strike and for sanctions; and (5) grants in part and denies in part Plaintiffs’ motion for class certification.

BACKGROUND

I. Factual Background

The Court has described the factual background of this matter in detail in earlier Decisions and Orders. (See Dkt. 140; Dkt. 181). The Court briefly summarizes Plaintiffs’ factual allegations, as set forth in their Second Amended Consolidated Master Complaint. (Dkt. 312) (the "SACMC").

Excellus is a licensee of BCBSA and "the primary healthcare provider in upstate New York." (Id. at ¶ 37). Excellus is also a subsidiary of Lifetime and the parent of the remaining Excellus Defendants. (Id. at ¶¶ 39-50). Plaintiffs are individuals whose Personally Identifiable Information ("PII") and/or Protected Health Information ("PHI") was stored on Defendants’ computer networks. (Id. at ¶¶ 17-35). "Beginning on or before December 23, 2013, hackers infiltrated Defendants’ cybersecurity systems, acquired high-level access to Defendants’ computer networks ..., and gained access to the [PII] and [PHI] of approximately 10 million individuals." (Id. at ¶ 1) These hackers "operated in" Defendants’ computer networks "with impunity" for at least nine months. (Id. ).

II. Procedural Background

The instant action was commenced on September 18, 2015. (Dkt. 1). Several other lawsuits arising out of the Excellus data breach were thereafter commenced in this District. (See Dkt. 9-2 at 1-2). On November 5, 2015, the Honorable Michael A. Telesca issued an Order consolidating all then-pending actions in this District related to the Excellus data breach into the instant action and transferring the matter to the undersigned. (Dkt. 27). On November 10, 2015, the Court entered a Text Order directing that any subsequently filed lawsuit arising out of the same facts or involving the same claims be consolidated into this case. (Dkt. 28). On January 25, 2016, the Court appointed interim class counsel and directed Plaintiffs to file a consolidated master complaint. (Dkt. 80).

On April 15, 2016, Plaintiffs filed their Consolidated Master Complaint. (Dkt. 99) (the "CMC"). The Excellus Defendants filed a motion to dismiss the CMC on May 31, 2016. (Dkt. 107). BCBSA filed a motion to dismiss the CMC on June 17, 2016. (Dkt. 111). On February 22, 2017, the Court issued a Decision and Order granting in part and denying in part Defendants’ respective motions to dismiss. (Dkt. 140) (the "Dismissal Decision"). As relevant here, the Court dismissed for lack of standing all claims asserted by the "non-misuse Plaintiffs," which it defined as "Plaintiffs who have not alleged any actual misuse of their data[.]" (Id. at 10, 29).

On March 22, 2017, Plaintiffs filed a motion for reconsideration, asking the Court to revisit its conclusion that the non-misuse Plaintiffs lacked standing. (Dkt. 142). The Court granted Plaintiffs’ motion for reconsideration on January 19, 2018. (Dkt. 181) (the "Reconsideration Decision"). In particular, based on the Second Circuit's decision in Whalen v. Michaels Stores, Inc. , 689 F. App'x 89 (2d Cir. 2017), the Court concluded that the "non-misuse Plaintiffs’ allegations of the threat of future identity theft" were sufficient to establish standing. (Dkt. 181 at 13). However, the Court left intact "all other aspects" of the Dismissal Decision. (Id. at 2).

With leave of Court and no objection from Defendants (see Dkt. 191), on March 22, 2018, Plaintiffs filed an Amended Consolidated Master Complaint (Dkt. 193). Pursuant to a stipulation of the parties, the Court granted Plaintiffs leave to file the SACMC on March 15, 2019. (Dkt. 305).

The SACMC was filed on March 25, 2019. (Dkt. 312).

On September 24, 2019, the Excellus Defendants moved for clarification of the Dismissal Decision and the Reconsideration Decision. (Dkt. 376). Plaintiffs responded on October 16, 2019 (Dkt. 381), and the Excellus Defendants replied on October 23, 2019 (Dkt. 383).

Plaintiffs filed their motion for class certification and supporting papers on November 22, 2019. (Dkt. 387; Dkt. 388; Dkt. 389; Dkt. 390; Dkt. 391; Dkt. 392; Dkt. 393; Dkt. 394; Dkt. 395; Dkt. 396). BCBSA and the Excellus Defendants filed their respective oppositions to the class certification motion on January 28, 2020. (Dkt. 414; Dkt. 418; Dkt. 419; Dkt. 420; Dkt. 421; Dkt. 422). Also on January 28, 2020, Defendants jointly filed a motion to exclude the expert declarations of James Van Dyke and Gregory Allenby. (Dkt. 417).

On April 27, 2020, Plaintiffs filed: (1) a motion for sanctions and to strike the declaration of James Keddell, which the Excellus Defendants had submitted in opposition to the class certification motion (Dkt. 446; Dkt. 447; Dkt. 448; Dkt. 449); (2) their reply papers in further support of their motion for class certification (Dkt. 450; Dkt. 451; Dkt. 452); (3) their opposition to Defendants’ motion to exclude (Dkt. 453; Dkt. 454; Dkt. 455); and (4) a motion to exclude the testimony of Defendants’ experts Robert E. Anderson, Jr. and C. Federico Campbell (Dkt. 456; Dkt. 457).

The Excellus Defendants filed their opposition to Plaintiffs’ motion for sanctions and to strike on May 18, 2020. (Dkt. 462). Plaintiffs filed reply papers on May 27, 2020. (Dkt. 470; Dkt. 472).

On June 5, 2020, Defendants filed a reply in further support of their motion to exclude and a response to Plaintiffs’ motion to exclude. (Dkt. 477; Dkt. 478; Dkt. 479). On July 7, 2020,...