IN RE: PERRY JOHNSON & ASSOCIATES MEDICAL TRANSCRIPTION DATA SECURITY BREACH LITIGATION (2024)

TRANSFER ORDER

Before the Panel:* Plaintiffs in four District of Nevada actions (Gil, Lowery, Levitt and Shanahan) move under 28 U.S.C. § 1407 to centralize this litigation in the District of Nevada or, alternatively, the Eastern District of Michigan or the Southern District of Ohio. Plaintiffs’ motion includes 26 actions pending in two districts, as listed on Schedule A. Since the filing of the motion, the Panel has been notified of fourteen related actions in seven districts.¹

The parties largely support centralization but differ as to selection of the transferee district. Plaintiffs in two District of Nevada actions support centralization in the District of Nevada. Plaintiffs in the Eastern District of New York Hvidsten action support centralization in the District of Nevada or, alternatively, the Eastern District of New York. Plaintiffs in three actions and two potential tag-along actions in the Eastern District of New York support centralization in the Eastern District of New York. Plaintiffs in three actions in three districts support centralization in the Eastern District of New York or, alternatively, the Northern District of Ohio. Defendants Perry Johnson & Associates, Inc. (Perry Johnson), Northwell Health, Inc. (Northwell), Bon Secours Mercy Health, Inc., and Salem Regional Medical Center support centralization in the Eastern District of New York or, alternatively, the Eastern District of Michigan.

Cook County Health and Cook County Health and Hospitals System (the CCH defendants), which are defendants in five District of Nevada actions, request separation and remand under Section 1407(a) of the claims against them. Alternatively, they suggest denial of centralization. As a further alternative, the CCH defendants request centralization in the Eastern District of Michigan.

After considering the argument of counsel, we find that centralization of these actions in the Eastern District of New York will serve the convenience of the parties and witnesses and promote the just and efficient conduct of the litigation. All actions will share factual questions arising from allegations of a 2023 data security breach of a portion of Perry Johnson's computer network. Plaintiffs, who are patients of the various medical provider defendants that used Perry Johnson's medical transcription services, allege that the data security breach potentially affected approximately nine million individuals’ protected health information (PHI) or personal identifying information (PII). The further allege that Perry Johnson and the medical provider defendants failed to put in place reasonable data security protections, which allowed hackers to steal their PII and PHI. All actions propose overlapping nationwide classes of individuals whose information allegedly was compromised in the data breach. Plaintiffs in all cases assert largely similar allegations and nearly identical claims against defendants, including negligence, negligence per se, breach of implied contract, and state consumer protection act violations.

Discovery concerning how Perry Johnson's system was hacked, how and when the breach was identified, what security measures Perry Johnson and other defendants had in place to protect customer PII and PHI, and what steps it took after discovering the breach likely will be complex and time-consuming. Given the number of actions (35) and involved districts (six), as well as the early stage of the cases (all actions were filed after November 10, 2023), centralization likely will avoid duplicative discovery and other pretrial proceedings, as well as prevent conflicting pretrial rulings, particularly with respect to evidentiary issues and class certification. Given the number of customers affected by the breach and the sensitive nature of the health information Perry Johnson handles in the course of its medical transcription business, it seems likely additional potential tag-along actions will be forthcoming. With the relative infancy of the actions, the likelihood of additional tag-along actions, and support from nearly all plaintiffs and several defendants, we view centralization as offering substantial opportunities to streamline pretrial proceedings, reduce duplicative discovery, and conserve the resources of the parties, their counsel, and the judiciary.

The CCH defendants argue that they should not be included in the MDL because they may pursue meritorious motions to dismiss based on personal jurisdiction and because they prefer to pursue alternatives to Section 1407 transfer such as dismissal via the first-to-file rule in favor of proceeding in Illinois state court. These issues can be presented to the transferee judge. While defendants’ concerns are understandable, “the Panel must weigh the interests of all the plaintiffs and all the defendants, and must consider multiple litigation as a whole in the light of the purposes of the law.” In re Library Editions of Children's Books, 297 F. Supp. 385, 386 (J.P.M.L. 1968). In light of the undisputed common factual backdrop among the actions arising out of the Perry Johnson data breach, inclusion of actions that name the CCH defendants and PJ&A is appropriate. We deny the CCH defendants’ request to separate and remand the claims against them. These defendants are sued alongside Perry Johnson in five District of Nevada actions. Separation and remand under Section 1407(a) is not a feasible solution for the claims against the CCH defendants, as certain claims are brought against both Perry Johnson and the CCH defendants.² It is beneficial at this early stage of litigation to include all claims against all defendants involved in this data breach.

We are persuaded that the Eastern District of New York is the appropriate transferee district for these cases. Relevant documents and witnesses likely will be found in this district by virtue of defendant Northwell Health's presence there. This medical provider defendant's clients (which have brought 24 actions against Northwell Health and Perry Johnson in various districts) constitute an estimated four million individuals affected by the breach—nearly half of the total impacted individuals. To date, ten actions and potential tag-along actions are pending in the Eastern District of New York, which enjoys the support of defendants and numerous plaintiffs. Assigning this litigation to Judge Rachel P. Kovner allows us to select a skilled jurist who has not yet had an opportunity to serve as a transferee judge. We are confident that Judge Kovner will steer this litigation on a prudent course to resolution.

IT IS THEREFORE ORDERED that the actions listed on Schedule A and pending outside the Eastern District of New York are transferred to the Eastern District of New York and, with the consent of that court, assigned to the Honorable Rachel P. Kovner for coordinated or consolidated proceedings with the actions pending there and listed on Schedule A.

SCHEDULE A

MDL No. 3096 — IN RE: PERRY JOHNSON & ASSOCIATES MEDICAL TRANSCRIPTION DATA SECURITY BREACH LITIGATION

 District of Nevada

GILL v. PERRY JOHNSON & ASSOCIATES, INC., ET AL., C.A. No. 2:23−01851

LOWERY v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−01857

CARTER v. COOK COUNTY HEALTH, ET AL., C.A. No. 2:23−01866

RODRIGUEZ, ET AL. v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−01874

O'ROURKE v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−01880

LEVITT v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−01892

VETERE v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−01900

KURTEV, ET AL. v. COOK COUNTY HEALTH & HOSPITAL SYSTEM, ET AL., C.A. No. 2:23−01905

COLON, ET AL. v. PERRY, JOHNSON & ASSOCIATES, INC., C.A. No. 2:23−01910

BELOV, ET AL. v. PERRY JOHNSON & ASSOCIATES, INC., C.A. No. 2:23−01925

FAIVRE v. PERRY JOHNSON & ASSOCIATES, INC., ET AL., C.A. No. 2:23−01926

DAVIS v. PERRY JOHNSON & ASSOCIATES, INC., C.A. No. 2:23−01932

KAUFMAN v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−01935

SHANAHAN, ET AL. v. PERRY JOHNSON & ASSOCIATES, INC., ET AL., C.A. No. 2:23−01947

O'NEILL, ET AL. v. PERRY JOHNSON & ASSOCIATES, INC., ET AL., C.A. No. 2:23−01964

SEPT, ET AL. v. PERRY JOHNSON & ASSOCIATES, INC., C.A. No. 2:23−01983

L.G. v. PERRY JOHNSON & ASSOCIATES, INC., ET AL., C.A. No. 2:23−01987

RUDERMAN, ET AL. v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−02014

 Eastern District of New York

GERBER v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−08467

MAYO, ET AL. v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−08517

HVIDSTEN, ET AL. v. NORTHWELL HEALTH, INC., C.A. No. 2:23−08538

VASQUEZ v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−08544

BELOV, ET AL. v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−08583

JEROME v. NORTHWELL HEALTH, C.A. No. 2:23−08624

BREWSTER v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−08627

MARCONI, ET AL. v. NORTHWELL HEALTH, INC., ET AL., C.A. No. 2:23−08638

FOOTNOTES

FOOTNOTE.   One or more Panel members who could be members of the putative classes in this litigation have renounced their participation in these classes and have participated in this decision.

1.   These and any other related actions are potential tag-along actions. See Panel Rules 1.1(h), 7.1 and 7.2.

2.   See, e.g., Kurtev v. Cook County Health & Hosp. Sys., D. Nevada, C.A. No. 2:23-01905, ECF No. 1, at ¶¶ 96–130 (negligence claim against all defendants).

KAREN K. CALDWELL, Chair