IN RE: CHANGE HEALTHCARE (2024)

TRANSFER ORDER

Before the Panel:^* Plaintiffs in four actions pending in the Middle District of Tennessee move under 28 U.S.C. § 1407 to centralize this litigation in the Middle District of Tennessee. The litigation consists of six actions pending in two districts, as listed on Schedule A. Since the filing of the motion, the Panel has been notified of 44 related actions pending in an additional ten districts.¹ All actions on the motion are brought on behalf of persons whose personally identifiable information and protected health information (“private information”) were compromised in a cyberattack on the systems of defendants Change Healthcare, Inc., UnitedHealth Group Incorporated, UnitedHealthcare, Inc., and Optum, Inc. (together, Change Healthcare) announced February 21, 2024. Thirteen of the 43 potential tag-along actions also are brought on behalf of such individuals; the other 30 are brought by physicians, hospitals, and other healthcare providers whose ability to submit insurance claims and receive payments were disrupted by the cyberattack and the ensuing lockdown of Change Healthcare's systems.

Defendants and plaintiffs in sixteen actions support the motion. Plaintiff in the Middle District of Tennessee Mt. Rainier Emergency Physicians potential tag-along action supports centralization of the health care provider actions but opposes inclusion of actions brought by individual consumers affected by the data breach. Plaintiff in the District of Minnesota Only Choice potential tag-along action supports centralization of the consumer actions in the Middle District of Tennessee but requests that the healthcare provider actions be centralized separately in the District of Minnesota. Plaintiffs in the Eastern District of Louisiana Diagnostic and Interventional Spinal Care potential tag-along action suggest centralization in the Eastern District of Louisiana. Defendant HealthFirst, Inc., in the Middle District of Tennessee Lemke potential tag-along action opposes inclusion of the claims against HealthFirst in any MDL but takes no position with respect to centralization of other claims or actions.

On the basis of the papers filed and the hearing session held, we find that these actions involve common questions of fact and that centralization in the District of Minnesota will serve the convenience of the parties and witnesses and promote the just and efficient conduct of this litigation. The actions share common questions of fact arising from allegations that Change Healthcare failed to take adequate measures to prevent and address the consequences of the cyberattack on its network announced in February 2024, which exposed the private information of millions of individuals and severely disrupted the ability of physicians, pharmacies, and other healthcare providers to use Change Healthcare's digital platform to access insurance information, fill prescriptions, submit insurance claims, and receive payment for services provided to patients. Plaintiffs seek certification of overlapping nationwide and statewide class actions of individuals and healthcare providers, and assert virtually identical claims for negligence, negligence per se, breach of contract or implied contract, unjust enrichment, and violation of state consumer protection laws.

Discovery in all actions will focus on how Change Healthcare's system was breached, what security measures Change Healthcare had in place, and the measures taken after the data breach was discovered to notify those impacted and to restore healthcare providers’ access to insurance and other information stored in the Change Healthcare platform. Centralization will avoid the possibility of inconsistent pretrial rulings, particularly with respect to class certification. With a total of 50 actions pending in twelve districts and dozens of involved plaintiffs’ counsel, centralization will serve the convenience of the parties and witnesses, and conserve judicial resources.

Plaintiffs in the Middle District of Tennessee Mt. Rainier Emergency Physicians and District of Minnesota Only Choice potential tag-along actions support centralization of the healthcare provider actions but argue that the consumer actions should be excluded from the MDL or centralized in a separate MDL. They maintain that the two types of actions will involve different legal theories and few, if any, common issues of fact. This argument is not convincing. While the consumer and healthcare provider plaintiffs to some extent allege different harms, their claims all arise from the same data breach, and all will involve discovery as to the circumstances and consequences of that breach. Many of the consumer plaintiffs claim injury both from the disclosure of their private information and from their inability to fill prescriptions following the cyberattack and thus—like the healthcare provider actions—will involve discovery regarding the lockdown of Change's systems that interrupted the flow of insurance claims and payments. The legal claims asserted in all cases overlap extensively as well. To the extent discovery in different groups of cases does not overlap, “[t]he transferee court may employ any number of pretrial techniques—such as establishing separate discovery and motion tracks—to manage th[e] litigation efficiently.” In re Home Depot, Inc., Customer Data Sec. Breach Litig., 65 F. Supp. 3d 1398, 1400 (J.P.M.L. 2014).²

The District of Minnesota, where eight actions are pending, is an appropriate transferee district for this litigation. Defendant UnitedHealth Group Inc.—the corporate parent of Change Healthcare Inc.—as well as defendants UnitedHealthcare, Inc., and Optum, Inc., are headquartered in Minnesota, and much of the relevant evidence will be found there. We assign the litigation to Judge Donovan W. Frank, a skilled jurist and experienced transferee judge. We are confident that he will steer this matter on an efficient and prudent course.

IT IS THEREFORE ORDERED that the actions listed on Schedule A and pending outside the District of Minnesota are transferred to the District of Minnesota and, with the consent of that court, assigned to the Honorable Donovan W. Frank for coordinated or consolidated pretrial proceedings.

SCHEDULE A

MDL No. 3108 — IN RE: CHANGE HEALTHCARE, INC., CUSTOMERDATA SECURITY BREACH LITIGATION

 District of Minnesota

KERIAZIS v. UNITEDHEALTH GROUP INCORPORATED, ET AL., C.A. No. 0:24−00751

MACKEY v. UNITEDHEALTH GROUP INCORPORATED, ET AL., C.A. No. 0:24−00771

 Middle District of Tennessee

MERRY v. CHANGE HEALTHCARE INC., C.A. No. 3:24−00239

REESE v. CHANGE HEALTHCARE INC., C.A. No. 3:24−00240

STUMP v. CHANGE HEALTHCARE, INC., C.A. No. 3:24−00255

ALLEN v. CHANGE HEALTHCARE, INC., C.A. No. 3:24−00263

FOOTNOTES

FOOTNOTE.   One or more Panel members who could be members of the putative classes in this litigation have renounced their participation in these classes and have participated in this decision.

1.   These and any other related actions are potential tag-along actions. See Panel Rules 1.1(h), 7.1 and 7.2.

2.   Defendant Healthfirst is named only in the Middle District of Tennessee Lemke potential tag-along action, which asserts an unjust enrichment claim against HealthFirst for rejecting insurance claims that were not timely filed because of the Change Healthcare security breach. Plaintiffs in Lemke seek certification of a “stale claims” class of healthcare providers whose claims were rejected as untimely and to have HealthFirst appointed as the representative of a defendant class of insurance companies. The question whether the claims against HealthFirst should be included in the MDL will be addressed via the conditional transfer order process. See Panel Rule 7.1.

KAREN K. CALDWELL, Chair