1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 CENTRAL DISTRICT OF CALIFORNIA 10 RYAN MORALES, individually and Case No. 2:23-cv-01987-AB-AGR on behalf of all others similarly 11 situated,

12 Plaintiff, ORDER DENYING PLAINTIFF’S

MOTION FOR REMAND

13 v. 14

CONIFER REVENUE CYCLE

15 SOLUTIONS, LLC, a Texas corporation; and DOES 1 through 100, inclusive, 16 17 Defendant. 18 19 Before the Court is Plaintiff Ryan Morales’s Motion for Remand (“Motion,” 20 Dkt. No. 15). Defendant Conifer Revenue Cycle Solutions, LLC (“Defendant”) filed 21 an opposition, and Plaintiff filed a reply. (Dkt. Nos. 20 and 21.) For the following 22 reasons, the Court DENIES Plaintiff’s Motion. 23 I. BACKGROUND 24 Plaintiff filed his putative class action Complaint in Los Angeles County 25 Superior Court on March 16, 2023. See Complaint (Notice of Removal (“NOR,” Dkt. 26 No. 1) Ex. A). The Complaint alleges as follows. 27 Defendant Conifer Revenue Cycle Solutions, LLC (“Defendant”), “a self- 28 1 proclaimed global streaming media platform with approximately 20 million users,” 2 had been entrusted with Plaintiff and Class Members’ personally identifiable 3 information (“PII”). Compl. ¶ 7 and ¶ 19. On January 20, 2022, a cyber-attack against 4 Defendant allowed a malicious third party to access Defendant’s computer systems 5 and data, resulting in the compromise of highly sensitive personal information in 6 Defendant’s possession. Id. at ¶ 5. Sensitive personal information of Plaintiff and 7 Class Members was unlawfully accessed and stolen due to the cyber-attack. Id. at ¶ 7. 8 Information compromised in the cyber-attack includes the following: full name, date 9 of birth, address, and medical/treatment information, including medical record 10 number, provider name, diagnosis or symptom information, and 11 prescription/medication, health insurance information (such as payor name and 12 subscriber/Medicare/Medicaid number), and billing and claims information. Id. 13 Based on these allegations, the Complaint alleges five causes of action against 14 Defendant: negligence, negligence per se, breach of implied contract, breach of 15 confidence, and unfair business practices in violation of Cal. Bus. & Prof. Code § 16 17200, et seq. Plaintiff brings these claims on behalf of himself and a putative class. 17 Id. at ¶ 81. The Complaint defines the putative class as, “All individuals whose PII 18 was compromised in the January 20, 2022 data breach announced by Conifer on or 19 around September 30, 2022, who reside in the state of California.” Id. 20 On March 16, 2023, Defendant removed the case to this court, invoking 21 jurisdiction under the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332. 22 Plaintiff responded with a motion to remand, arguing that the district court lacks 23 jurisdiction under CAFA because Defendant failed to meet the jurisdictional 24 requirements. 25

II. LEGAL STANDARD

26 A defendant may remove a civil action filed in state court to federal court when 27 the federal district court has original jurisdiction over the action. 28. U.S.C. § 1441(a). 28 1 “A suit may be removed to federal court under 28 U.S.C. § 1441(a) only if it could 2 have been brought there originally.” Sullivan v. First Affiliated Sec., Inc., 813 F.2d 3 1368, 1371 (9th Cir. 1987). “The burden of establishing federal subject matter 4 jurisdiction falls on the party invoking removal.” Marin Gen. Hosp. v. Modesto & 5 Empire Traction Co., 581 F.3d 941, 944 (9th Cir. 2009). 6 Pursuant to the Class Action Fairness Act (“CAFA”), federal district courts 7 have original jurisdiction over particular class actions. 28 U.S.C. § 1332. In order to 8 properly remove a case under CAFA, the burden is on the defendant to establish that 9 (1) the parties are minimally diverse, (2) the proposed class has more than 100 10 members, and (3) the total amount in controversy exceeds $5 million. 28 U.S.C. § 11 1332(d). 12 The Supreme Court has explained that CAFA’s “provisions should be read 13 broadly, with a strong preference that interstate class actions should be heard in 14 federal court if properly removed by any defendant.” Dart Cherokee Basin Operating 15 Co., LLC v. Owens, 135 S. Ct. 547, 554 (2014). 16

III. DISCUSSION

17 Plaintiff argues that this action should be remanded to Los Angeles County 18 Superior Court because Defendant failed to satisfy CAFA’s jurisdictional 19 requirements. 20

A. CAFA Requirements

21 CAFA gives federal courts jurisdiction over certain class actions if (1) the 22 parties are minimally diverse, (2) the aggregate number of members of all proposed 23 plaintiff classes is 100 or more persons, and (3) the amount in controversy exceeds $5 24 million, exclusive of interests and costs. 28 U.S.C. § 1332(d)(2). Although the 25 substance of Plaintiff’s Motion addresses only the amount in controversy requirement, 26 the Motion also suggests, albeit without substantial argument, that Defendant did not 27 satisfy the other requirements either. See Mot. 1:4-21. Out of an abundance of caution, 28 1 the Court addresses all CAFA requirements. 2 1. Minimal Diversity 3 Under CAFA, complete diversity is not required; “minimal diversity” suffices. 4 Serrano v. 180 Connect, Inc., 478 F.3d 1018, 1021 (9th Cir. 2007). “Minimal 5 diversity” is met when “any member of a class of plaintiffs is a citizen of a State 6 different from any defendant.” 28 U.S.C. § 1332(d)(2). 7 Plaintiff is a citizen of California. Compl. ¶ 4. Conifer Revenue Cycle 8 Solutions, LLC, the only named defendant, is a limited liability company. An LLC is 9 a citizen of every state which its owners/members are citizens. Johnson v. Columbia 10 Properties Anchorage, LP, 437 F.3d 894, 899 (9th Cir. 2006). Defendant filed the 11 Declarations of Joel Dustin Kellner, its Director, Compliance and Privacy, Ethics, and 12 Compliance, to establish its citizenship. See Kellner Decl. (Dkt. No. 4), and Suppl. 13 Kellner Decl. (Dkt. No. 20). 14 None of Conifer’s members are a citizen of California. Conifer Revenue Cycle 15 Solutions, LLC’s sole member is Conifer Health Solutions, LLC. Kellner Decl. ¶ 3. 16 Conifer Health Solutions, LLC is a Delaware limited liability company with its 17 principal place of business in Frisco, Texas. Id. Conifer Health Solutions, LLC has 18 two members: CommonSpirit Health and Conifer Holdings, Inc. Id. at ¶ 4. 19 CommonSpirit Health is a Colorado non-profit corporation with its principal place of 20 business in Denver, Colorado. Id. Conifer Holdings, Inc. is a Delaware corporation 21 with its principal place of business in Frisco, Texas. Id. Because Plaintiff is a citizen 22 of a State different from Defendant, CAFA’s minimal diversity of citizenship 23 requirement is satisfied. 24 2. Numerosity 25 CAFA applies to class action lawsuits where the aggregate number of members 26 of all proposed plaintiff classes is 100 or more persons and where the primary 27 28 1 defendants are not “States, State officials, or other governmental entities against 2 whom the district court may be foreclosed from ordering relief.” 28 U.S.C § 1332. 3 Defendants have established that Plaintiff’s proposed class exceeds 100 4 members. Plaintiff seeks to represent a class of “all similarly situated individuals 5 whose Private Information was accessed and/or removed from the network during the 6 Cyber-Attack.” Compl. ¶ 16. The Complaint specifically states that “Defendant has 7 identified more than 100 persons whose PII may have been improperly accessed in the 8 Data Breach, and the Class is identifiable within Defendant’s records.” Id. at ¶ 84. 9 Conifer determined that over 120,000 California residents who may have been 10 affected by the data breach were sent a notice of the incident. Kellner Decl. ¶ 5; Suppl. 11 Kellner Decl. ¶ 2. Thus, the allegations of the Complaint and Kellner’s Declaration 12 satisfy CAFA’s numerosity requirement. 13 3. Amount in Controversy 14 A defendant removing a putative class action need only demonstrate that the 15 “matter in controversy exceeds the sum or value of $5,000,000.” 28 U.S.C. § 16 1332(d)(2). “The amount in controversy is simply an estimate of the total amount in 17 dispute, not a prospective assessment of defendant’s liability.” Lewis v. Verizon 18 Commc’ns, Inc., 627 F.3d 395, 400 (9th Cir. 2010). A defendant who has removed an 19 action may “simply allege or assert in the notice removal that the jurisdictional 20 threshold has been met.” Dart Cherokee Basin Operating Co., LLC, 135 S. Ct. at 554. 21 Where the amount of controversy is challenged, “both sides may submit proof and the 22 court decides, by a preponderance of the evidence,” whether the requirement has been 23 satisfied. Id. “Defendants do not need to prove to a legal certainty that the amount in 24 controversy requirement has been met.” Id. 25 To determine whether it has jurisdiction, the court must add up the value of the 26 claims of all persons (named or unnamed) who fall within the definition of the 27 “proposed class” and determine whether the resulting sum exceeds $5 million. 28 28 1 U.S.C. § 1332(d)(6), (d)(1)(D). The amount in controversy includes damages 2 “(compensatory, punitive, or otherwise), and the costs of complying with an 3 injunction, as well as attorneys’ fees awarded under fee-shifting statutes or contract.” 4 Gonzales v. CarMax Auto Superstores, LLC, 840 F.3d 644, 648-649 (9th Cir. 2016). 5 Plaintiff seeks “injunctive relief including improvements to Defendant’s data 6 security systems, future annual audits, and adequate credit monitoring services funded 7 by Defendant” and “an award of compensatory, statutory, and nominal damages in an 8 amount to be determined.” Compl. at ¶ 17; see also Compl. Prayer for Relief. 9 Defendant determined “that personal information of at least 120,000 California 10 residents may have been accessed by the unauthorized party.” Suppl. Kellner Decl. ¶ 2 11 (“Notice of the data incident was sent to over 120,000 California residents.”) 12 Based on the class size of 120,000, Defendant has calculated the amount put in 13 controversy by the “ongoing credit monitoring and identity theft repair services” 14 Compl. ¶ (b)(xvii), that Plaintiff seeks. Defendant has presented evidence of the costs 15 of credit monitoring through the declaration of its counsel Rachel E. K. Lowe (“Lowe 16 Decl.,” Dkt. No. 20-2). The cost of credit monitoring by TransUnion is $29.95 per 17 month. Lowe Decl. ¶ 2. The cost of credit monitoring and identity theft protection by 18 Equifax is $4.95 for the first 30 days, then $19.95 per month. Id. Ex. A p 3. The 19 parties disagree over the cost of Experian’s credit monitoring services—Defendant 20 says it is $24.99, while Plaintiff says it is free. Dkt. No. 20 at 7:21; Dkt. No. 21 at 21 8:18-21. However, for purposes of this Motion, the Court can disregard the dispute 22 over Experian’s cost because the cost of “ongoing” credit monitoring and identity 23 theft protection by Equifax and TransUnion alone will exceed the $5 million dollar 24 minimum required for CAFA. No party has defined the duration of “ongoing” credit 25 monitoring, so for purposes of this Motion, the Court considers it to be a bare 26 minimum of two months. For the first two months of credit monitoring, TransUnion 27 28 1 charges $59.90 and Equifax charges $24.90, for a total of $84.80. For 120,000 class 2 members, this adds up to $10,176,000.00 for just the first two months of service. 3 Plaintiff seeks various other kinds of relief, and Defendant has presented some 4 evidence that making changes to Defendant’s data systems and complying with an 5 injunction would cost in excess of $2 million. Kellner Decl. ¶ 6. Plaintiff argues that 6 Defendant has not sufficiently explained these costs. But, because the cost of credit 7 monitoring alone would exceed $5 million, the Court need not consider the other 8 types of relief Plaintiff seeks. 9 Defendant has met its burden of proving by a preponderance of the evidence 10 that the amount in controversy exceeds $5,000,000.00 for federal court jurisdiction. 11 B. Plaintiff’s Requests for Jurisdictional Discovery and to Amend 12 the Complaint are DENIED. 13 In the alternative, Plaintiff asks the Court to permit jurisdictional discovery. In 14 the Ninth Circuit, “discovery should ordinarily be granted where pertinent facts 15 bearing on the question of jurisdiction are controverted or where a more satisfactory 16 showing of the facts is necessary.” Nuance Commc’ns, Inc. v. Abby Software House, 17 626 F.3d 1222, 1235 (Fed, Cir. 2010) (citing Laub v. U.S. Dep’t of the Interior, 342 18 F.3d 1080, 1093 (9th Cir. 2003)). But, if the jurisdictional discovery request amounts 19 only to a “fishing expedition” it need not be granted. Johnson v Mitchell, No. CIV S- 20 10-1968 GEB GGH PS, 2012 WL 1657643, *7 (E.D. Cal. May 10, 2012). In his 21 Motion, Plaintiff does not explain what facts he would seek discovery on, so the 22 request necessarily fails. In his reply, Plaintiff indicates he would seek discovery on 23 the “exact number of the putative class members,” Reply 12:6-9, but Defendant has 24 already presented evidence showing that there are at least 120,000 likely class 25 members, and Plaintiff has not meaningfully controverted this assertion. Plaintiff’s 26 request for jurisdictional discovery is therefore denied. 27 28 l Plaintiff also asks to amend the complaint to “clarify certain jurisdictional 2 | facts.” Mot. 7:10-13. But Plaintiff has not specified which jurisdictional facts he would clarify. The request is denied. 4 IV. CONCLUSION 5 For the foregoing reasons, the Court DENIES Plaintiff's Motion for Remand. 6 7 IT IS SO ORDERED. lu 8 8 9 | Dated: August 15, 2023 10 HONORABLE ANDRE BIROTTE JR. 11 UNITED STATES DISTRICT COURT JUDGE 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 8.