Case Information
*1 FILED UNDER SEAL 1
UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY IN RE: AMERICAN MEDICAL Case No.: 2:19-MD-02904-MCA-MAH COLLECTION AGENCY, INC., CUSTOMER DATA SECURITY MDL No. 2904 BREACH LITIGATION
OPINION & ORDER REGARDING DISPUTES ECF NOS. 511 & 512
This Document Relates To: Quest/Optum360 Track
Before the Special Master are two discovery disputes between Plaintiffs and Defendants Quest Diagnostic Incorporated (“Quest”) and Optum360, LLC (“Optum”) (collectively, “Defendants”). Plaintiffs seek to compel the production of certain documents that Defendants have either withheld or clawed back under claims of attorney-client privilege and work-product doctrine. 2 The Special Master has considered the parties’ submissions, including their joint discovery dispute letters (ECF Nos. 511, 512), and the arguments of counsel made during the hearing held on July 26, 2024, during which the Special Master also conducted an in camera review of the documents at issue. 3 For the reasons set forth below, Plaintiffs’ requests are denied in part and granted in part. 1 The Special Master has temporarily sealed this Opinion because the documents at issue were submitted only for in camera review. To the extent any party wishes to seal any portion of this Opinion, that party shall make an appropriate motion in accordance with Local Civil Rule 5.3(c)(3), within fourteen days of this Opinion. If no party timely files such a motion, or otherwise moves to extend the deadline by which to file the same, the temporary seal will be lifted. 2 As to Quest, Plaintiffs also moved to compel Quest to provide a corporative representative for deposition or, in the alterative, to preclude Quest from asserting a certain defense. As discussed during the July 26, 2024 hearing, the Special Master will take no action as to these requests at this time. 3 The hearing was divided into two parts: a joint portion during which the parties presented oral argument; and an ex parte portion during which the Special Master reviewed the documents at issue
I.
*2 BACKGROUND
As the Special Master writes principally for the benefit of the parties, the Special Master will only briefly address those facts relevant to the resolution of this matter. This is a multidistrict litigation in which Plaintiffs allege that they are among the 11 million individuals who had their protected information compromised in a data breach suffered by American Medical Collection Agency (“AMCA”), a debt collections agency. Plaintiffs are current or former patients of Quest, a healthcare company that retained AMCA as a collections vendor and provided AMCA with sensitive patient information to facilitate collections. In September 2016, Quest outsourced its revenue services operation to Optum and, as part of that agreement, assigned its existing contract with AMCA to Optum.
The AMCA data breach allegedly occurred between late 2018 and March 2019. After being notified of the data breach on May 14, 2019, Quest and Optum each conducted their own internal investigation into the incident. About two weeks later, the first of several lawsuits were filed against Quest and Optum.
Documents related to certain aspects of the post-breach investigations conducted by Quest and Optum are at the center of these discovery disputes. A. Quest’s Dark Web Investigation According to Quest, after learning of the AMCA data breach, its in-house counsel directed an
internal security team at Quest (the IT and Security Incident Team) to investigate the incident. (ECF No. 511, at 8). That team has responded to security incidents at Quest since 2016, including by in camera and allowed Defendants to make supporting proffers. Both portions were transcribed by a Certified Court Reporter. The transcript of the joint portion is attached hereto as Exhibit A. Due to the confidential nature of the discussions held during the ex parte portion of the hearing, the transcript for that portion is not included, but is available to the Court upon request. *3 conducting dark web searches for patients’ information. ( Id. at 4). Quest also engaged
to assist in the investigation. 4 Through one of their present motions, Plaintiffs seek to compel Quest to produce 38 documents pertaining to its dark web investigation. 5 As discussed more fully below, these documents primarily consist of email communications among individuals from Quest’s IT department, legal . There is also a draft incident report. 6 department, and/or
Plaintiffs assert that they seek to uncover facts revealed to Quest during its post-breach investigation, including whether Quest found its patients’ protected information on the dark web in connection with the AMCA data breach and what steps it took to reach that conclusion. (ECF No. 511, at 1). Plaintiffs contend that the information they are seeking is not protected by privilege because the investigation conducted by Quest’s security team was carried out as part of its regular business operations. ( Id. , at 2). For its part, Quest argues that the information is privileged because the investigation was performed at the direction of counsel. ( Id. , at 11-13; see Joint Hearing Tr. 25:17:22 (“it’s Quest’s position that the steps taken in that investigation were directed by counsel and were privileged”). Quest also represents that it “did not find personal information associated with any of its patients on the dark web, let alone for the named Plaintiffs, that appeared to be connected to the *4 AMCA data breach.” (ECF No. 511, at 8). Thus, Quest argues, Plaintiffs already have the facts they seek. ( Id. ; see Joint Hearing Tr. 22:5-16).
B. Optum’s Risk Assessments of its Third-Party Vendors According to Optum’s Deputy General Counsel at the time, Mitchell W. Granberg, after being
notified of the AMCA data breach, he assembled and led a response team that included in-house counsel to investigate the incident “for purposes of assessing legal risk and providing legal advice to Optum360.” (Decl. of Mitchell W. Granberg (“Granberg Decl.”) ¶ 3). Mr. Granberg further asserts that “[i]n addition to the investigation into the AMCA Data Breach,
for purposes of assessing legal risk and providing legal advice to Optum360.” ( Id. ¶ 7). Mr. Granberg explains that ,” pointing out that “by August 1, 2019, more than 34 class action lawsuits had been filed.” 7 ( Id. ). Through their other motion, Plaintiffs seek to compel Optum to reproduce 13 clawed back documents that relate to Optum’s risk assessments of its third-party vendors. ( See ECF No. 512). As further discussed below, these documents consist of email communications and risk assessments attached thereto. Plaintiffs argue that these documents are not protected from disclosure because Optum prepared risk assessments of its vendors as part of its normal course of business. ( Id. , at 2). Optum, on the other hand, contends that these risk assessments and related communications are 7 In a separate discovery dispute, Plaintiffs sought information relating to Optum’s risk assessments of its other debt collection vendors; Optum opposed, arguing that “[r]isk assessments performed of third-party debt collection vendors other than AMCA are irrelevant to Plaintiffs’ claims.” (ECF No. 513, at 2). On March 6, 2024, the Special Master granted Plaintiffs’ request. ( See ECF No. 660). That decision was appealed and is currently still pending. *5 protected because they were created “for purposes of facilitating the rendition of legal advice concerning .” (Granberg Decl. ¶¶ 8-9).
II.
LEGAL STANDARDS
A. Attorney-Client Privilege The purpose of the attorney-client privilege is to encourage “full and frank communication
between attorneys and their clients.” Upjohn Co. v. United States , 449 U.S. 383, 389 (1981); Westinghouse Electric Corp. v. Republic of the Philippines , 951 F.2d 1414, 1423 (3d Cir. 1991). The privilege protects a client’s right to refuse to disclose “confidential communications between attorney and client made for the purpose of obtaining legal advice.” Genetech, Inc. v. U.S. Int’l Trade Comm'n , 122 F.3d 1409, 1415 (Fed. Cir. 1997). Even where the privilege protects attorney-client communications, the facts underlying the communications are always discoverable. See Upjohn , 449 U.S. at 395-96 (“Protection of the privilege extends only to communications not to facts.”).
Whether the privilege applies is decided on a case-by-case basis, and the party asserting the privilege bears the burden to show it applies. Matter of Bevill, Bresler & Schulman Asset Mgmt. Corp. , 805 F.2d 120, 124 (3d Cir. 1986). Because the attorney-client privilege obstructs the truth- finding process, however, it is construed narrowly. Westinghouse , 951 F.2d at 1423-24 (quoting Fisher v. United States , 425 U.S. 391, 403 (1976)). A party asserting the privilege must show “(1) that it submitted confidential information to a lawyer, . . . (2) that it did so with the reasonable belief that the lawyer was acting as the parties’ attorney,” Montgomery Acad. v. Kohn, 50 F. Supp. 2d 344, 350 (D.N.J. 1999), and (3) the purpose of the communications was to secure legal, as opposed to business, advice. In re Ford Motor Co. , 110 F.3d 954, 965 (3d Cir. 1997). The touchstone of the privilege, therefore, is that the communications between client and attorney were both made and maintained in *6 confidence. See Republic of Philippines v. Westinghouse Elec. Corp. , 132 F.R.D. 384, 388 (D.N.J. 1990) (stating “a litigant who wishes to assert confidentiality must maintain genuine confidentiality”).
The attorney-client privilege applies to both individuals and corporations. See Upjohn , 449 U.S. at 390. Corporations, as inanimate entities, must act through agents. Bevill , 805 F.2d at 124 (quoting Commodity Futures Trading Comm’n v. Weintraub , 471 U.S. 343, 348 (1985)). However, the privilege does not cease to exist solely because a client is a corporation. Id. Instead, the attorney- client privilege extends to communications of a corporation's management and employees where doing so would effectuate or enable legal advice. See Upjohn , 449 U.S. at 391, 394-95. Advice concerning a corporation’s business affairs, technical issues, or public relations is not protected by the attorney-client privilege. Dejewski v. Nat’l Beverage Corp. , Civ. No. 19-14532, 2021 WL 118929, at *1-2 (D.N.J. Jan. 12, 2021). Where communications contain both legal and business advice, courts must ascertain whether “the communication is designed to meet problems which can be fairly characterized as predominantly legal.” Leonen v. Johns-Manville , 135 F.R.D. 94, 99 (D.N.J. 1990) (quoting Cuno, Inc. v. Pall Corp. , 121 F.R.D. 198, 204 (E.D.N.Y. 1988)).
B. Work Product Doctrine The work product doctrine is a qualified privilege which precludes disclosure of “materials
prepared by an attorney, or an attorney’s agent, in anticipation of or for litigation,” as well as “[a]n attorney’s mental impressions, conclusions, opinions or legal theories.” In re Diet Drugs Prods. Liab. Lit. , MDL No. 1203, 2001 WL 34133955, at *4 (E.D. Pa. April 19, 2001) (citing In re Ford Motor Co. v. Kelly , 110 F.3d 954, 967 (3d Cir. 1997), abrogated on other grounds by Mohawk Indus., Inc. v. Carpenter , 558 U.S. 100 (2009)); see also Fed. R. Civ. P. 26(b)(3). The work product doctrine “shelters the mental processes of the attorney, providing a privileged area within which he can analyze and prepare his client’s case.” In re Cendant Corp. Sec. Litig. , 343 F.3d 658, 661-63 (3d Cir. 2003). *7 The party asserting the protection of the work product doctrine carries the burden of demonstrating that the doctrine applies. In re Gabapentin Litig. , 214 F.R.D. 178, 183 (D.N.J. 2003).
Courts in this Circuit have traditionally applied a two-step inquiry in deciding whether a document is protected under the work product doctrine. Id. at 183-84. First, courts look at whether the document was created “in anticipation of litigation,” and second, whether the document was created “primarily for the purpose of litigation.” Id. A party must show more than the “remote prospect” of litigation in satisfying the anticipation of litigation prong. Id . at 183. Instead, the party must show the “existence of an identifiable specific claim or impending litigation at the time the materials were prepared.” SmithKline Beecham Corp. v. Apotex Corp. , 232 F.R.D. 467, 473 (E.D. Pa. 2005). “The mere involvement of, or investigation by an attorney does not, in itself, evidence the ‘anticipation of litigation.’” In re Gabapentin Litig. , 214 F.R.D. at 183. In determining whether a document was created primarily for the purpose of litigation, courts look to the motive behind the document’s creation. Id. at 184. “The proper inquiry is whether in light of the nature of the document and the factual situation in the particular case, the document can fairly be said to have been prepared or obtained because of the prospect of litigation.” Id. “Documents created for other purposes that prove useful in subsequent litigation are not attorney work product; similarly, documents that are routinely prepared in the ordinary course of business are outside the scope of work product protection.” Id.
III.
DISCUSSION
As a preliminary matter, the Special Master notes that in recent years there have been several data breach cases that have implicated similar issues concerning attorney-client privilege and the work-product doctrine. The most recent one is In re Samsung Customer Data Security Breach *8 Litigation , No. 23-3055, 2024 WL 3861330 (D.N.J. Aug. 19, 2024), where former Chief Judge Freda L. Wolfson issued a well-reasoned and highly instructive opinion that warrants discussion here first.
In In re Samsung Customer Data Security Breach Litig. , after suffering a data breach, Samsung retained the law firm of Hunton Andrews Kurth LLP (“Hunton”) to provide legal advice regarding the incident. Id. at *2. Hunton in turn retained Stroz Friedberg LLC (“Stroz”), a third-party cybersecurity firm, and directed Stroz to conduct a forensic investigation into the data breach incident. Id. “According to Hunton, a forensic investigator was necessary to provide its attorneys technical background and knowledge for rendering informed legal advice to Samsung.” Id. The engagement letter between Hunton and Stroz indicated that Stroz was retained to assist Hunton in rendering legal advice to Samsung. 8 Id.
During its investigation, Stroz prepared several PowerPoint presentations (“Stroz PowerPoint”) that it used to provide investigative updates to both Hunton and select Samsung personnel, including in-house counsel and senior security and data executives. Id. Stroz also prepared a “draft one-page Cloud and Host Analysis,” which outlined “Stroz’s conclusions regarding the background and potential scope of the data breach incident (‘Stroz Analysis’).” Id. As with the Stroz PowerPoint, Stroz shared the analysis with Hunton and Samsung personnel, including in-house counsel and senior security and privacy executives. Id. In addition, after completing its investigation, and at Hunton’s request, Stroz prepared a draft memorandum that summarized its investigative findings and conclusions (“Stroz Draft Memorandum”). Id. at *3. Unlike the other two documents, Stroz only showed Hunton—not Samsung—portions of the Stroz Draft Memorandum. Id. Finally, 8 Specifically, the engagement letter stated: “The purpose of the Engagement is to enable Counsel to render legal advice to Client regarding a potential security issue and/or, where applicable, in anticipation of litigation, a regulatory inquiry, or an internal investigation.” Id. at *2. *9 at Hunton’s request, Stroz prepared a document to help explain certain issues related to the breach to government authorities, including the Federal Bureau of Investigations (“FBI Update”). Id.
During an early phase of discovery, the plaintiffs sought production of the above documents. Id. at *1. In response, Samsung moved to shield the documents from disclosure based on assertions of the attorney-client privilege and work product doctrine. Id. In general terms, the plaintiffs argued that the documents were not protected from disclosure because Stroz’s investigation was conducted for business purposes rather than legal purposes, while Samsung argued the opposite. Id. at *2-3.
Judge Wolfson began her analysis by surveying data breach cases across the nation that also dealt with attorney-client and work-product issues, including this case. Id. at *7-11 (collecting cases). 9 From these cases, Judge Wolfson distilled six non-exhaustive factors that she found helpful in reaching her decision. Id. at *11-12. Those factors are:
1. Type of services rendered by the third-party consulting firm to outside counsel; 2. The purpose and scope of the investigation as evidenced by the investigative materials or the services contract between outside counsel and third-party consulting firm;
3. Existence of a two-track investigation[, one for business purposes and the other for legal purposes,] commissioned by the impacted company;
4. The extent of a preexisting relationship between the impacted company and the third-party consulting firm; *10 5. The extent to which the third-party consulting firm's investigative materials were shared with members of the impacted company and/or any other outside entities, including the government; and
6. Whether the third-party consulting firm's investigative services assisted the law firm in providing legal advice to the impacted company; put differently, whether the purported privileged materials would not have been created in the ordinary course of business irrespective of litigation.
Id. at *12. After considering the above factors and reviewing the documents in camera , Judge Wolfson determined that the Stroz PowerPoint, Stroz Analysis, and FBI Update (together, “Stroz Materials”) were not protected from disclosure, but that the Stroz Draft Memorandum was protected by attorney-client privilege.
Judge Wolfson first discussed her finding concerning the Stroz Material. Citing Judge Michael A. Hammer’s recent decision in this case, Judge Wolfson explained that the attorney-client privilege inquiry focuses on “whether the Stroz Materials were intrinsic to the attorney client communication and the understanding of legal advice being rendered to Samsung, as opposed to some other business purpose.” Id. at *11 (citing In re Am. Med. Collection Agency , 2023 WL 8595741, at *8). Judge Wolfson found that although Hunton retained Stroz and their engagement letter stated that Stroz was retained for legal purposes, the record revealed that the investigation performed by Stroz was done for business purposes. Id. at 12-13.
In reaching that conclusion, Judge Wolfson recognized that “discovering how [a] breach occurred [is] a necessary business function regardless of litigation or regulatory inquiries.” Id. at *13 (citing Wengui , 338 F.R.D. at 10; In re Premera Blue Cross Customer Data Sec. Breach Litig. , 296 F. Supp 3d at 1245). She observed that in the few cases where a court has upheld assertions of privilege over materials generated from a data breach investigation, the impacted company had employed a two-track approach involving two separate investigations into the breach—one for *11 business purposes and a separate one for legal purposes; but Samsung had failed to demonstrate it had done so. Id. at *15. Judge Wolfson noted the fact that the Stroz PowerPoint presentations were shared not just with Hunton, but also Samsung personnel, “cast[ed] doubt on Samsung’s position that the outside investigation was not for a business purpose.” Id. at *14. She also noted that “[t]he breadth of Samsung’s involvement or participation in Stroz’s process and the wide dissemination of the Stroz Analysis undermine[d] Samsung’s assertion that Stroz was only retained to provide technical interpretation for the benefit of Hunton.” Id. Judge Wolfson concluded: 10
while Samsung maintains that Hunton directed and controlled Stroz's investigation, the mere delegation of certain business functions to an attorney is insufficient to shield otherwise unprotected factual investigation from discovery. Here, Samsung has not provided sufficient evidence that Hunton retained Stroz to create the Stroz Materials in order to either translate or interpret attorney client communications between Samsung and Hunton; rather, the fact that Hunton hired Stroz to perform that particular business function does not shield the Stroz Materials from production based on attorney client privilege.
Id. at *16 (citation omitted). For substantially the same reasons, Judge Wolfson found that the Stroz Materials also did not qualify as work product; that is, the materials were created primarily for a business purpose. Id.
Next, Judge Wolfson discussed her finding concerning the Stroz Draft Memorandum. She noted that after the investigation was complete and five months after litigation began, Hunton asked Stroz to prepare a memorandum that it could rely on to provide legal advice to Samsung. Id. Judge Wolfson found it significant that, unlike the other documents, the memorandum was only shared with 10 Judge Wolfson further pointed out that “another indicator that the Stroz Materials, particularly the FBI Update, were prepared for business reasons—even if also to advise counsel—[was] that the conclusion, manner and scope of Stroz’s investigation were used to draft the FBI Update.” Id. at *14. Had Samsung conducted its own investigation, Judge Wolfson reasoned, then it could have utilized those findings to address the FBI’s inquiry rather than relying on Stroz to prepare the response. Id. “This further belie[d] Samsung’s position that Stroz’s investigation served no business purpose.” Id. *12 Hunton and not with any Samsung personnel. Id. Consequently, Judge Wolfson found that the Stroz Draft Memorandum was prepared to assist Hunton in providing legal advice to Samsung. Id.
The Special Master agrees with Judge Wolfson’s well-reasoned analysis and, accordingly, will utilize the same set of factors that Judge Wolfson considered in reaching her decision. A. Documents Related to Quest’s Dark Web Investigation 1. Documents at Issue The 38 documents in dispute (Exhibits 1 through 38) can be divided into the following five categories. The first category consists of Exhibits 1, 3 through 14, 18 and 33. These are all internal email communications involving Quest personnel, including in-house counsel, that were exchanged (with the exception of Exhibit 33) between May 16 and May 22, 2019. Exhibit 1 is an email dated May 16 from Anthony Cusano, Quest’s Director of IT Security, to Donna Salerno, Quest’s Privacy Officer, regarding the AMCA data breach. According to Quest, this is a draft email that Mr. Cusano prepared to send to counsel and sought Ms. Salerno’s input. (Sealed Tr. 4:8-13). Mr. Cusano appears to have later sent a revised version of the email to two other members of Quest’s security team, copying in- house counsel. And that revised email serves as the starting point for Exhibits 3 through 14, and 18, all of which are different iterations of the same internal email thread. ( See id. at 9:2-13:9). Quest argues that these emails are privileged and reflect Quest’s legal department’s need to be involved in these discussions to understand the information being presented so that they can render legal advice. ( Id. at 13:4-16). Lastly, Exhibit 33 is a June 18, 2019 email exchange between Mr. Cusano and Paul Kattas, Quest’s in-house counsel, in which Mr. Kattas requested an update on the investigation.
In the second category is Exhibit 2, a document entitled “Incident Report: QINC-19-012 AMCA Security Incident” that is stamped “DRAFT,” and dated May 16, 2019 (the “Draft Incident *13 Report”). Quest asserts that the draft report was prepared by Mr. Cusano at the direction of counsel and it follows the investigation into the AMCA incident. ( Id. at 5:5-8). The draft report appears to reflect
. According to Quest, this document was prepared to facilitate legal advice. ( Id. at 5:14-15). Exhibits 15 through 17, 19, 20, and 23 through 32 comprise the third category; these are primarily email communications between Mr. Cusano and . ( See id. at 13:17-16:2). Quest argues that these emails are privileged because Mr. Kattas directed the investigative steps to be taken and producing these documents would necessarily disclose legal advice. ( Id. at 14:21-25).
Of note, among these exhibits is It states in part that ( See Exhibit 29). The fourth category consists of Exhibits 21 and 22, which are Quest communications involving or relating to Optum. Exhibit 21 is an email dated May 23, 2019, that Mr. Cusano sent to an Optum employee in the information risk management division, copying Mr. Kattas, in which Mr. Cusano . Exhibit 22 is another email in which Mr. Cusano forwarded the email in Exhibit 21 to the Chief Information and Digital Officer at Quest.
The last category consists of Exhibits 34 through 38. These are email communications from June 21 to June 22, 2019, between Mr. Cusano and Terri Cetera, Quest’s Senior Director of IT *14 Security, discussing requests from counsel for certain information and supplying such information. Quest argues that these documents are protected both by attorney-client privilege and the work- product doctrine.
In sum, Quest contends that all 38 Exhibits are protected by attorney client privilege and that Exhibits 34 through 38 are also protected by the work product doctrine. 2. Application of the Attorney Client Privilege Quest’s primary argument appears to be that all 38 documents in dispute, and its investigation in general, are protected by attorney-client privilege because the investigation was directed by and performed on the advice of counsel. ( See Joint Hearing Tr. 25:17:22 (“it’s Quest’s position that the steps taken in that investigation were directed by counsel and were privileged”); see also id. at 31:9- 12 (same)). As more fully set out below, the Special Master disagrees in large part.
It seems settled that “discovering how [a] breach occurred [is] a necessary business function regardless of litigation or regulatory inquires.” In re Samsung , 2014 WL 3861330, at *13 ( citing Wengui , 338 F.R.D. at 11; In re Premera , 296, F. Supp. 3d at 1245). Quest does not appear to dispute this point. As Quest acknowledges, Quest has had a security team in place since 2016 that investigates security incidents in the ordinary course of business. 11 Nevertheless, Quest maintains that although its security team investigated the AMCA security breach, and was generally tasked with investigating security incidents in the normal course, this investigation is different because it was performed at the direction of counsel. ( See ECF No. 511 (“That the Security Team may at times perform certain actions without direction from counsel does not mean that this time —in response to a high-profile data breach 11 ( See ECF No. 511, at 4 (quoting from the deposition transcript of Donna Salerno, Quest’s former Privacy Officer: Q. “Okay. Are you aware of a Quest IT and Security Incident Team was in place prior to the data breach incident; correct?” A. “Yes.” Q. “And their function was to response to, in the normal course of business, security incidents correct?” A. “Generally. Yes.” Q. And that’s what they did in response to the AMCA data breach?” A. “Yes.”)). *15 for which notice was provided to millions of Quest patients, and where both in-house and outside counsel took a direct role in breach response immediately upon learning of the breach—their investigation was not directed by counsel”). But as Judge Wolfson and courts have found, “the mere delegation of certain business functions to an attorney is insufficient to shield otherwise unprotected factual investigation from discovery.” See In re Samsung , 2014 WL 3861330, at *7.
Again, the AMCA investigation was conducted by Quest’s security team – the same team that since 2016 has investigated security incidents in the normal course of business, including by conducting dark web searches for patients’ information. (ECF No. 511, at 4-5). Quest has failed to show how this investigation was materially different than any of its prior investigations. The mere involvement of counsel is not sufficient. See In re Samsung , 2014 WL 3861330, at *7. Thus, to the extent that Quest argues its investigation is entirely privileged because it was directed by counsel, the Special Master disagrees.
The same is true with respect to . Quest, “as it bears the burden of showing the privilege applies, must demonstrate that served some specialized purpose facilitating the attorney client communications and was essentially indispensable in that regard.” In re Samsung , 2014 WL 3861330, at *11. Statedly differently, the question is whether
“were intrinsic to the attorney client communication and the understanding of legal advice being rendered to [Quest], as opposed to some other business purpose.” Id. Having considered the relevant factors and reviewed the documents at issue in camera , the Special Master finds that Quest engaged primarily for a business, rather than legal, purpose.
First, there appears to be no dispute that Quest had a Second, and relatedly, *16 . ( See Exhibit 29). There is no indication in that document that was engaged for the purpose of assisting counsel in providing legal advice to Quest.
Next, and more importantly, nothing in the record suggests that Quest conducted a two-track investigation—one as a business response and a separate one to assist counsel in the rendering of legal advice. To the contrary, the Special Master’s in camera review revealed that
( See Exhibits 15-17, 19, 20, and 23-32). This would undermine any assertion from Quest that was engaged to assist counsel in providing legal advice. See In re Samsung , 2024 WL 3861330, at *14 (“The breadth of Samsung’s involvement or participation in Stroz’s process and the wide dissemination of the Stroz Analysis undermine Samsung’s assertion that Stroz was only retained to provide technical interpretation for the benefit of Hunton.”). The fact the counsel was involved— jointly with Quest’s security team—in instructing
does “not shield otherwise unprotected factual investigation from discovery.” See In re Samsung , 2024 WL 3861330, at *7. Thus, to the extent that Quest argues that are also privileged because they were directed by counsel, the Special Master rejects that argument.
That brings us to the documents in dispute. As the party asserting attorney client privilege, Quest must show “(1) that it submitted confidential information to a lawyer, . . . (2) that it did so with the reasonable belief that the lawyer was acting as the parties’ attorney,” Montgomery Acad., 50 F. Supp. 2d 344 at 350, and (3) the purpose of the communications was to secure legal, as opposed to business, advice. In re Ford Motor Co. , 110 F.3d 954 at 965.
*17 Beginning with the Draft Incident Report (Exhibit 2), Quest argues that this document is privileged because it was prepared at the direction of counsel to furnish information to lawyers in order to render informed legal advice. (Sealed Tr. 5:15-18). The Special Master’s in camera review, however, revealed that much of this document contains investigative facts, and those facts are not privileged. See In re Samsung , 2024 WL 3861330, at *13 (finding privilege did not apply to documents that contained investigative facts; recognizing that discovering how a breach occurred, including its scope and the information extracted, is a necessary business function); see also Leonard , 2023 WL 8447918, at *5 (rejecting an impacted company’s argument that an investigation report was privileged “because it was ‘created at the request of counsel, by a third party engaged to assist in the provision of legal advice’ and the report note[d] that it [was] confidential and privileged,” since the report was not related to legal advice).
For example, the first paragraph of the draft report states that (Exhibit 2, at 1). These are facts. The next two paragraphs indicate that . ( See id. ). These, too, are facts. The same is true with respect to the portions of the draft report that relate to . ( See e.g., id. at 3). That said, as Quest points out, the draft report does contain
( See e.g., id. at 5 (last paragraph, dated May 21, 2019)). Those portions can be redacted. Accordingly, Quest is directed to produce a redacted version of the Draft Incident Report consistent with the guidance set forth herein.
*18 The rest of the documents in dispute are email communications and the two copies of the . As noted, to be protected by the attorney-client privilege, “the communications with employees, counsel, and must be related to legal advice.” Leonard , 2023 WL 8447918, at *5. Where communications contain both legal and business advice, courts must ascertain whether “the communication is designed to meet problems which can be fairly characterized as predominantly legal.” Leonen, 135 F.R.D. at 99.
Beginning with the first category, Exhibits 1, 3 through 14, 18 and 33, the Special Master finds that the communications in these documents are privileged. These are the internal email communications involving Quest personnel, including in-house counsel, regarding the AMCA data breach. These communications can be fairly characterized as predominantly legal and need not be produced.
As to the next category, Exhibits 15 through 17, 19, 20, and 23 through 32, which are the email exchanges between Mr. Cusano and as well as the , the Special Master finds that Quest has failed to meet its burden of showing that the privilege applies. Having already found that was engaged primarily for a business, rather than legal, purpose, the Special Master further finds that the communications in question are predominantly business in nature. See Leonard , 2023 WL 8447918, at *5 (finding that “communications involving [a third-party cybersecurity firm] concerning facts of the attack and McMenamins’s response, investigation(s), and remediation are not privileged,” where “neither the engagement letter nor the scope of work identifie[d] any work by [the firm] related to the provision of legal advice” and the “evidence demonstrate[d] that [the firm] was providing a business service, by seeking and providing factual information to McMenamins and their counsel.”). Accordingly, Quest is directed to produce these documents in their entirety.
*19 As to Exhibits 21 and 22, which concern the communications between Mr. Cusano and Optum regarding , Quest is directed to produce these documents in their entirety. Although Mr. Kattas is copied on the emails, the communications are between Mr. Cusano and an Optum employee—not a confidential communication between an attorney and a client. And in the emails, Mr. Cusano is
which, for reasons already discussed, was primarily conducted for business purposes. Accordingly, these documents are not privileged and shall be produced.
The remaining documents, Exhibits 34 through 38, are privileged. These are the internal communications where, . As Quest points out, these communications took place well after litigation began and reflect specific information sought on counsel’s behalf. These communications can be characterized as predominately legal in nature and need not be produced. 12
B. Documents Related to Optum’s Risk Assessments of its Third-Party Vendors 1. Documents at issue With respect to Optum, there are 13 documents at issue, Exhibits A through M, which can be divided into three separate categories. The first consists of Exhibit A. It is an internal email thread that begins with a May 29, 2019 email from Carl Stevens, Optum’s Associate Director of Privacy, to Delmar Howard, Optum’s Vendor Liaison, and Ed Balu, Optum’s VP of Vendor Management, copying Lenie Hermanson, Senior Associate General Counsel, and Sharon Rogers, a privacy officer at Optum. In the email, Mr. 12 Having found Exhibits 34 through 38 are privileged, the Special Master does not address whether the documents are also protected by the work-product doctrine. *20 Stevens indicates that
. The rest of the email thread is Ms. Rodgers forwarding herself certain information. In his declaration, Mr. Granberg states that this email chain “reflects employees and counsel acting in response to a request from the counsel-led Incident Response Team to collect relevant information regarding Optum360’s .” (Granberg Decl. ¶ 5). According to Mr. Granberg, “[t]his information was requested so that Optum360’s in-house team could provide legal advice to the company in response to anticipated litigation regarding Optum360’s vendor oversight in relation to the AMCA Data Breach.” ( Id. ).
The second category consists of Exhibits B and C. Exhibit B is an internal email thread from August 16 to August 23, 2019, that involves several Optum personnel, including Mr. Granberg, Brian Troen, Optum’s Director of Enterprise Information Security, and Robert Booker, Senior VP & Chief Information Security Officer.
, which is Exhibit C. This document is a PowerPoint titled Optum360 Vendor Analysis, which contains risk analysis and outstanding remediation tasks. Of note, Optum’s privilege log indicates that this document was originally created in December 2016.
The third category consists of Exhibits D through M; these are internal email communications from August 15 to August 18, 2019, which attach risk assessments in the form of excel spreadsheets. The email communications are primarily between Mr. Brian and Megan Trafton, A Senior IT Security Consultant at Optum, and Susan Maxim, a Sourcing & Procurement Consultant and Quest. ( See *21 Exhibits D, F, H, J). In the emails,
. ( See Exhibits E, G, I, K, L, M). With respect to Exhibits B through M, Mr. Granberg asserts that counsel directed Optum employees to “gather, compile, and analyze” the information therein (Granberg Decl. ¶ 8). 2. Application of the Attorney Client Privilege & Work Product Doctrine Optum argues that all 13 documents are protected by both attorney client privilege and the work product doctrine. (ECF No. 512, at 3-7; see Optum’s Supplemental Privilege Log). At bottom, Optum contends that the documents are protected because, as part of Optum’s investigation, counsel directed the employees to prepare the attached risk assessments to facilitate legal advice and in anticipation of litigation regarding Optum’s oversight of debt collection vendors. ( See id. ) Conversely, Plaintiffs contend that the documents are not protected because Optum would have prepared the risk assessments regardless of litigation, pointing out that Optum normally does so in its regular course of business. (Joint Hearing Tr. 38:18-40:25).
Based on the Special Masters’s in camera review, the declaration of Mr. Granberg, and the arguments of counsel, the Special Master finds that the emails (Exhibits A, B, D, F, H, J) are protected by attorney client privilege and the excel spreadsheets (Exhibits E, G, I, K, L, M) are work product. Plaintiffs’ argument that these documents would have been generated regardless of litigation is misplaced; as part of a separate discovery dispute, Optum was already ordered to provide Plaintiffs with information concerning the risk assessments of its other debt collection vendors that were prepared in the ordinary course of business. These documents are different. The email communications at issue took place immediately before (Exhibit A), or weeks after (Exhibits B, D, *22 F, H, J) lawsuits were filed against Optum alleging that “Optum360 failed to maintain adequate oversight of its third-party vendors.” (ECF No. 512, at 4 n.3). Mr. Granberg avers that he directed Optum employees to to advise Optum regarding same. On these facts, the Special Master finds that these email communications are predominantly legal in nature. For this same reason, the Special finds that the excel risk assessments (Exhibits E, G, I, K, L, M), which were prepared for the first time after litigation began, are work product and need not be produced.
That leaves us with Exhibit C, the PowerPoint titled Optum360 Vendor Analysis. The Special Master finds that this document is neither privileged nor work product. Critically, unlike the excel risk assessments, the PowerPoint was created years before litigation, in 2016. While Optum describes the PowerPoint as a living document, (Sealed Tr. 26:11-13), the Special Master’s in camera review revealed that this document contains only facts, and it is unclear to what extent the document was updated in response to the AMCA data breach and any potential litigation. Regardless, considering that the PowerPoint was originally created in 2016, and that Optum performs risk assessments in the normal course of business, it seems apparent that this particular document was, and would continue to have been, modified regardless of litigation. That said, the PowerPoint appears to contain information concerning
. Having previously ruled that Optum need only provide risk assessment information concerning its other debt collection vendors, Optum may redact the portions in the PowerPoint that relate to its . Accordingly, Optum is directed to produce a redacted version of the PowerPoint consistent with the guidance set forth herein.
IV.
*23 CONCLUSION
For the reasons stated above, Plaintiffs’ requests are denied in part and granted in part as follows: • Quest is directed to produce Exhibit 2 with appropriate redactions, and Exhibits 15, 16, 17, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, and 32 in their entirety; Quest need not produce Exhibits 1, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 18, 33, 34, 35, 36, 37, and 38.
• Optum is directed to produce Exhibit C with appropriate redactions; Optum need not produce Exhibits A, B, D, E, F, G, H, I, J, K, L, and M. ______________________________ Mark Falk, Special Master
*24 Page 1
IN RE: )
) ) 2:19-MD-02904- AMERICAN MEDICAL COLLECTION ) MCA-MAH AGENCY - QUEST ) ) ) _______________________________ Walsh Pizzi O'Reilly Falanga 100 Mulberry Street, 15th Floor Three Gateway Center Newark, New Jersey Friday, July 26, 2024 10:20 a.m.
B E F O R E:
HONORABLE JUDGE MARK FALK (Ret.) Reported by: Lydia Fucci-McDonnell, CSR Job No. NJ6826087
Veritext Legal Solutions 800-227-8440 973-410-4040 *25 Page 2 Page 4 1 A P P E A R A N C E S: 1 I N D E X
2 SEEGER WEISS LLP
2
BY: HILLARY FIDLER, ESQ.
3 -and- 3
CHRISTOPHER AYERS, ESQ.
4 4 55 Challenger Road Ridgefield Park, New Jersey 07660 5 E X H I B I T S 5 973-639-9100 6 hfidler@seegerweiss.com 6 cayers@seegerweiss.com NUMBER DESCRIPTION PAGE Attorneys for the Plaintiff, 7 7 Optum360 [8] Exhibit 1 Email........................... 18
SIDLEY AUSTIN LLP
8
9 BY: HEATHER BENZMILLER SULTANIAN, ESQ.
One South Dearborn Exhibit 2 Email........................... 19 10 Chicago, Illinois 60603 9 312-853-7883 11 hsultanian@sidley.com 10 Attorneys for the Defendant, 11 12 Quest 13 -and- 12
14 SIDLEY AUSTIN LLP
13
BY: LAURA SORICE, ESQ.
15 787 Seventh Avenue 14 New York, New York 10019 15 16 212-839-5861 lsorice@sidley.com 16 17 Attorneys for the Defendant, 17 Quest [18] 18 19 ALSTON & BIRD LLP
19
BY: DONALD HOUSER, ESQ.
20 One Atlantic Center 20 1201 West Peachtree Street, Suite 4900 21 21 Atlanta, Georgia 30309 404-881-4749 22 22 donald.houser@alston.com 23 Attorneys for the Defendant, 23 Quest 24 24 -and-
25 [25] Page 3 Page 5 1 A P P E A R A N C E S: (Cont'd) 1 JUDGE FALK: Okay. Good morning. So 2 ALSTON & BIRD LLP 2 we're here today to deal with disputes of 511, and
BY: LEILA KNOX, ESQ.
3 90 Park Avenue, 15th Floor 3 then 512, which, I think, are kind of some of the New York, New York 10016 4 last, or the last that I have. 4 212-210-9400 leila.knox@alston.com 5 MR. AYERS: We hope so. 5 Attorneys for the Defendant, 6 JUDGE FALK: Yeah. I guess. Quest 6 7 I got another letter from Sonic -- the
7 CARLTON FIELDS, P.A.
8 Sonic people, but I think they may have worked it BY: MICHAEL T. HENSLEY, ESQ. 8 180 Park Avenue, Suite 106 9 out. I'm not sure. Florham Park, New Jersey 07932 10 MR. AYERS: Yeah. I'm not sure. I 9 973-604-2600 mhensley@carltonfields.com 11 think the Sonic track has a couple of outstanding 10 Attorneys for the Defendant, 12 disputes, but I'm not -- Quest 11 13 JUDGE FALK: Sure.
12 HOGAN LOVELLS US LLP
BY: COURTNEY E. HELT, ESQ. 14 MR. AYERS: I'm not on the.... 13 Columbia Square 15 JUDGE FALK: Yeah. I didn't -- that's 555 Thirteenth Street, NW 14 Washington, D.C. 20004 16 it, but.... 202-637-5600 17 So let me give you the day, the way I 15 courtney.helt@hoganlovells.com Attorneys for the Defendant, 18 see it, which, I think, won't -- will not be long. 16 Quest 19 Obviously, we've read everything, but I
17 ALSO PRESENT:
Eric S. Padilla, Esq. - Walsh Pizzi 20 guess -- let me just see what we've got here. This 18 Patrick S. Salamea, Esq. - Walsh Pizzi 21 is.... 19 20 22 (Pause.) 21
23 JUDGE FALK: Okay. So we're gonna start 22 23
24 with 511, and I want to just discuss the issues that 24 25 were raised in the letters. 25 2 (Pages 2 - 5) Veritext Legal Solutions 800-227-8440 973-410-4040 *26 Page 6 Page 8 1 sent in. That was May of 2023, more than a year ago, 1 Of course, these letters were sent in a 2 but the dispute arises out of the Plaintiff's request 2 long time ago. It's not your fault. I got into it a 3 for documents and information relating to an 3 little later and time has passed. 4 investigation conducted by Quest's IT security 4 I guess Judge Arleo just came out, or 5 incident team and, perhaps, others into the 5 recently came out, with her decision on the Charles 6 River appeal, which sort of relates to some of this 6 availability of Quest patient information on the dark 7 web following the AMCA data breach. 7 in a way, but my thought is to discuss, generally, 8 And the Plaintiffs, in this letter, 8 511. 9 request that I, as special master -- special 9 I have some questions; I may want to 10 discovery master, enter an order compelling Quest to 10 hear from you folks, if you want to be heard from, 11 produce all documents pertaining to the 11 and then -- and, I mean, sort of the general 12 investigation, compelling Quest to produce a 12 questions because different things were asked for. 13 And then we have in camera review of 13 corporate representative to testify regarding the 14 facts obtained by the investigation, and Quest's 14 documents, and I'm gonna want to run through those 15 response to the AMCA breach, or alternatively 15 and allow Quest to make any proffer supporting the 16 precluding Quest from asserting a defense that 16 documents, and the -- the Plaintiffs will be asked to 17 Plaintiffs' information is not available on the -- on 17 leave the room for that because you can't see the 18 the dark web. 18 documents. That's the way we do it, right? 19 And I -- I guess I will foreshadow, I 19 And then we have 512, which really is 20 clawback issues with respect to -- how many documents 20 don't plan to issue that kind of an order. I don't 21 are there? 21 have enough involvement in the case, and 22 understanding, as to precluding people from bringing 22 MR. PADILLA: Thirteen. 23 defenses, depending on what happens. I think that's 23 JUDGE FALK: -- 13 documents, and I'm 24 really for the trial judge, or it could be the 24 gonna go through those one by one. And I guess it's 25 magistrate judge, you know. It could be an in limine 25 up to Optum, you know, whether you want the
Page 7 Page 9 1 Plaintiffs present or not. 1 motion. Things that aren't disclosed are not usually 2 The only reason I say this -- not that 2 permitted to be raised. 3 you should, but presumably they've already seen these 3 So I guess I'll turn to Plaintiffs' 4 documents. Whether they read them, you know, 4 counsel first on -- on this issue, not any specific 5 obviously, if you come into possession of privileged 5 document necessarily, but if you have anything that 6 documents, you're supposed to stop right there. I 6 you want to say? 7 don't know what happened, if you didn't, but.... So 7 MS. FIDLER: Yeah. Absolutely. Thank 8 it may be a very short day for some of the 8 you. 9 Plaintiffs. I doubt the Plaintiffs are not gonna 9 JUDGE FALK: Okay. 10 be -- I don't mean "not." I mean, the Plaintiffs are 10 MS. FIDLER: You know, Plaintiffs' 11 not gonna be sticking around for that. 11 information being available on the dark web has 12 And then it's my decision to quickly 12 always been highly relevant to this litigation. It's 13 issue a -- a short opinion on the issues, which will 13 one of our core injury theories. Quest knows this. 14 include charts that deal with a decision on each of 14 You know, in the motion that they 15 the documents, with a little explanation. 15 brought for sanctions, they argued that without the 16 It seems that everything is appealed in 16 dark web allegation, Plaintiffs have no injuries at 17 this case. I'm actually fine with that. And the 17 all, so Plaintiffs have repeatedly requested to get 18 first two things that I did, I did just on the 18 discovery on Quest's knowledge of information being 19 record, and I think that's harder for whoever's 19 available on the dark web after the AMCA data breach. 20 deciding it, whether it's Judge Hammer or Judge 20 We served requests for production 21 Arleo, on appeal, not to have something written, so I 21 No. 48, which was subject to a prior letter dispute, 22 decided to do it that way. So that's the day, okay, 22 letter dispute 474, and that -- and then we also 23 folks? 23 reserved requests for production -- or excuse me -- 24 So we'll get started with 511. These 24 requests for admission, 106 through 108, where we 25 are all based on, I think, joint letters that were 25 sought admissions on Quest's knowledge of information
3 (Pages 6 - 9) Veritext Legal Solutions 800-227-8440 973-410-4040 *27 Page 10 Page 12 1 on the dark web. 1 produced, which I have, if you would like a copy of, 2 Quest never once argued that those 2 that 3 documents were privileged. It largely argued that 4 the documents were irrelevant or that they had 5 searched the documents and had not had -- and could 6 not locate any responsive documents. . So Plaintiffs -- upon looking at those 7 The parties jointly noticed the Gemini 7 documents, Plaintiffs requested that Quest produce 8 Advisory deposition, which is the original firm that 8 all documents related to the 9 published that Quest patient data -- or data related . Quest refused to do so, claiming that 10 to the AMCA data breach was found on the dark web. 10 it was too late for Plaintiffs to do so because 11 We went to this, and in the letter brief 474 that was 11 discovery had closed a year ago and that it was 12 submitted to this Court, Quest argued that if we 12 privileged. 13 wanted to investigate Quest's knowledge of 13 You know, Quest has, in their responses 14 information on the dark web, the appropriate place to 14 to our -- or to requests for admission 106 through 15 do so was a deposition. 15 108, we specifically sought Quest's knowledge that 16 We didn't have any documents, but we 16 information was available on the dark web after the 17 took that to heart, and so we went to the 30(b)(6) 17 data breach. Quest denied that knowledge and said it 18 deposition, and we learned for the very first time 18 would supplement its answers. It never did. 19 that Quest has an IT security team that was 19 Quest said in response to document 48 in 20 established in 2016, well before this data breach, 20 this meet -- in meet and confers, in letter 474 to 21 and 21 the Court, in its objection to Your Honors' order,
22 and in this letter brief, that it had searched for 23 documents and it had no responsive documents.
. The Court They produced those documents to us that 25 subsequently ordered -- issued that Quest should 25 explicitly related to Page 11 Page 13 1 submit 25 documents for in camera review on that and, 1 2 shortly thereafter that, Quest filed an objection. they never objected to it on privilege 3 Quest kind of walked back and said 3 grounds. 4 that -- it acknowledged that it's possible that some 4 And, in fact, in this letter before the 5 responsive documents may exist, existing from the 5 Court, in footnote 13, they disclaim work product --
6 work product privilege over the entire subject , then the parties continued to 7 matter, so we know that Quest, this entire time, have 8 meet and confer and -- hopefully, to resolve the 8 responsive documents. The documents that Quest 9 disputes of this issue so we wouldn't have to come 9 offered to produce were never logged, they were 10 before Your Honor again. 10 withheld until a year after the close of discovery, 11 JUDGE FALK: Great. Sure. 11 and that is nothing more than bad faith. 12 MS. FIDLER: Quest ultimately produced 12 You know, they denied knowledge of the 13 some documents, but withheld others on the basis of 13 dark web. They sought sanctions against Plaintiffs, 14 privilege, which it had not ever asserted to 14 claiming that we have no viable injury theory. The 15 Plaintiffs before. So in those documents, we learned 15 entire time, 16 for the very first time, after the -- after the close and at the very 17 of discovery, that the 17 basis, they disclaimed work product being work
18 product privilege over its own investigation, , and they claimed that ; also, we learned that Quest 20 attorney-client privilege covers everything because 21 had a 21 it was directed at counsel. 22 We know that communications -- we know 23 that communications are covered by the work product
. 24 privilege; facts are not. We are seeking facts that 25 We found from the documents that were 25 underlie Quest's knowledge of the extent and scope of 4 (Pages 10 - 13) Veritext Legal Solutions 800-227-8440 973-410-4040 *28 Page 14 Page 16 1 dark web -- or information being available on the 1 this Court -- or being in front of this Court before 2 dark web, and the 30(b)(6) witness testified at the 2 on the issues of documents responsive to RFP 48, and 3 deposition that this was done in the ordinary course 3 we think that conduct is -- is sanctionable. 4 of business, not at the direction of counsel and that 4 You know, there's a case in New Jersey, 5 it -- it would have undertaken this regardless. 5 a recent case from 2023, called O'Reilly vs. Home 6 You know, Quest says that investigations 6 Depot. There, Plaintiff had not produced 81 photos 7 that are directed at the -- directed by counsel are 7 and videos that were related to the incident at hand. 8 privileged. The cases that they cite for that are 8 Defendant brought a motion after that revealed that 9 work product claims. Quest disclaimed work product 9 those photos existed in a deposition. They ordered 10 privilege, so it has no basis to assert that that's 10 sanctions by allowing Defendant to redepose the 11 the case. 11 Plaintiff regarding the pictures and videos withheld 12 You know, they -- they had no good faith 12 and ordered the production of withheld documents, and 13 basis to withhold these documents based on privilege 13 we argue that that relief is more than appropriate 14 and, you know, we followed up with Quest after the 14 here. 15 , you know, telling them that 15 In sum, there's no work product claim at 16 they had not disclosed in their Rule 26(f) 16 issue here; they've waived that. There's -- they're 17 disclosures or in their -- in their Rule 26 17 not protected by attorney-client privilege. We are 18 disclosures. They said they weren't -- they didn't 18 seeking the facts, not communications. And to the 19 have to because 19 extent that some of the communications have lawyers
. That 20 on them, and to say the ones that we know about, of 21 seems not to be the case. 21 the 32 logged entries that Quest provided to us, only 22 And they also have said that they were 22 eight of those communications actually have attorneys 23 not intending to rely on that -- on those kinds of 23 on them. Over, I think, 12 of them are between 24 documents for its offenses -- or excuse me -- for its 24 Quest's 25 defenses. Well, either Quest 25 This was not to seek legal advice; it was strictly to
Page 15 Page 17 1 1 assess the impact of Quest. and Quest has withheld 2 We have a document right here where 3 Terri Cetera, the.... 3 those documents, or , and 4 JUDGE FALK: Thank you. 4 Quest is relying on those. At any rate, it should 5 MS. SULTANIAN: Could I have a copy of 5 have been disclosed. 6 that? 6 And, you know, they argue a lot that -- 7 MS. FIDLER: Yes. Absolutely. 7 that the -- when we argue that they did not claim 8 JUDGE FALK: So, Senior Director of IT 8 privilege, that they said some of these 9 documents were logged on the privilege log, you know, 9 Security at Quest, Terri Cetera. Is that correct? 10 MS. FIDLER: Yes. You know, she sent an 10 a year ago and that Plaintiffs should have been aware 11 email to Anthony Cusano asking him 11 of it, Rule 26(b)(5) requests that -- or requires 12 that Quest expressly state the claim that it is At that -- 13 withholding documents based on privilege, and Quest 14 MS. SULTANIAN: Counsel, I'm sorry to 14 never did that. They never told us the documents 15 interrupt, but I don't think it's the same email. 15 were privileged, and we had no reason to believe that 16 Quest was withholding documents based on privilege. 16 MS. FIDLER: It's not the same email? 17 MS. SULTANIAN: No. I just want to make 17 And so, you know, we believe that 18 sure I have what you're looking at. 18 because they have never asserted privilege on the 19 MS. FIDLER: Oh, I apologize. You're 19 grounds that they have, one, likely waived that. You 20 right. It's this one. 20 know, the failure to timely object to documents 21 MS. SULTANIAN: Okay. 21 responsive to an RFP as privileged is a -- is a 22 MS. FIDLER: Thank you. Sorry. 22 waiver, and they have never once done that. They -- 23 you know, we think that they have withheld highly 23 JUDGE FALK: Can I cut you off for one 24 relevant and highly adverse material despite, you 24 second? 25 MS. FIDLER: Yes. 25 know, repeated requests for such material, despite
5 (Pages 14 - 17) Veritext Legal Solutions 800-227-8440 973-410-4040 *29 Page 18 Page 20 1 JUDGE FALK: I wonder if I could ask you 1 JUDGE FALK: Yes. Go ahead. 2 to mark this as Plaintiffs' Exhibit 1. 2 MS. SULTANIAN: I want to start just by 3 (P-1, Email, marked for identification.) 3 saying the scope of this dispute has fundamentally 4 JUDGE FALK: Go ahead. I'm sorry. 4 changed when this letter was -- was submitted. We 5 MS. FIDLER: Yes. So in that email, 5 met and conferred with Plaintiffs, we narrowed the 6 you'll see that Terri Cetera -- I think she -- her 6 category of documents, we voluntarily produced some 7 title is the Director of IT -- emailed another IT 7 maintaining our assertion of privilege, and the 8 employee and asked them 8 waiver of the 502 Agreement. So we've done our best
9 to narrow this to the documents we -- that are -- 10 they were all privileged, but the -- you know, the 11 ones that we think are most critical. 12 And so there's a small set of documents 13 remaining at issue that were submitted to Your Honor.
. 14 We'll -- we'll discuss them, you know, document by 15 If you look at this email as Exhibit 2, 15 document. 16 it's an email that is from one day before that. In 16 JUDGE FALK: We'll go through them 17 that email, Anthony Cusano, a Quest IT employee, 17 document by document.
18 MS. SULTANIAN: Yeah. But at a more 19 general level, Plaintiffs' arguments here are really 20 based on two completely and factually incorrect
. This 21 arguments. One is that they argue that, because the 22 investigation was not at the direction of counsel; it 22 Quest IT team sometimes performs some dark web 23 was done in the ordinary course of business. It 23 monitoring without the direction of counsel, that 24 would have been done regardless if the lawyers were 24 means that this time they must have as well; but 25 cc'd on an email or were included on an email in 25 as -- as the documents that we submitted in camera
Page 19 Page 21 1 which a report was attached. The purpose of the 1 show, that's not correct. 2 investigation was not to obtain legal advice; it was 2 Terri Cetera, Quest's 30(b)(6) witness, 3 she testified that the IT Security Incident Response 3 to assess the business impact to Quest. 4 Team performed some monitoring in the ordinary 4 And all that Quest can offer in that is 5 course. 5 because the 30(b)(6) witness testified that the IT . 6 security team performed these investigations in the 7 Just kind of ordinary course. But there's a 7 routine course of business is just because they had 8 distinction between that ordinary monitoring that the 8 done it previously doesn't mean they did it without 9 the direction of counsel now. That is insufficient 9 security team did and the specific steps they took to 10 investigate whether patient information was on the 10 to meet the burden for them to prove specific facts 11 dark web after Quest learned of the breach, which 11 that each and every document on a 12 were directed by counsel. 12 document-by-document basis is privileges, and it -- 13 You know, at the -- at the time this was 13 they're not privileged at the end of the day. 14 kind of a rapidly evolving situation, May 14, 15, 16, 14 thank you. 15 around then, and at that time, Quest understood 15 JUDGE FALK: All right. Thank you very 16 much. but 17 Just make that Exhibit 2 for us. 18 it made sense given that, to bring legal counsel in 18 (Exhibit 2, Email, marked for 19 right away and immediately begin directing an 19 identification.) 20 investigation of what could be such a high-profile 20 JUDGE FALK: Does anyone from Quest want 21 breach. This wasn't kind of ordinary-course stuff, 21 to respond, generally? 22 this was a five-alarm fire. 22 MR. HOUSER: I'll have some specific 23 questions after that, but.... 23 Counsel was brought in right away, and 24 MS. SULTANIAN: Yes, Your Honor. 24 the privilege documents show that regardless of what 25 the IT security team was doing in the ordinary 25 Heather Sultanian from Sidley on behalf of Quest.
6 (Pages 18 - 21) Veritext Legal Solutions 800-227-8440 973-410-4040 *30 Page 22 Page 24 1 not found any data on the dark web that it could 1 course, they deviated this time and sought direction 2 identify as having been Quest data -- Quest patient 2 from counsel as to specific steps that were going to 3 data. 3 be taken to search the dark web. They were different 4 JUDGE FALK: Right. And, I mean, 4 than that ordinary coursework. 5 assuming you're at a trial and you're asked, Well, 5 The second main argument I heard from 6 Plaintiffs is that the facts of what the security 6 what did you do to make that decision? Who's gonna 7 testify? 7 team learned during the investigation are not 8 MS. SULTANIAN: I'm sorry. I -- I want 8 privileged, including whether they found Quest 9 to make sure -- 9 patient data on the dark web, but the facts have 10 JUDGE FALK: In other words, you know, 10 already been disclosed. The fact is that Quest 11 there's a jury there -- 11 found, as -- as shown in, I think it was Exhibit 1, 12 MS. SULTANIAN: Yeah. 12 found a dark web post that was alluded to in the 13 Gemini Advisory report, but as Ms. Cetera testified, 13 JUDGE FALK: -- let's just say. Hey, we 14 didn't find any -- none there. Plaintiffs, of 14 Quest never was made aware that Quest patient data 15 course, say they have information from, you know, 15 was on the dark web. They never found it; so they 16 different places. They put that right in the letter 16 have the facts. 17 that there's information of Quest patients, but 17 I'll leave kind of the more, you know, 18 someone's gonna get on the stand and say, We didn't 18 specific discussion of documents to a later stage, 19 find any. And then the question might be, Well, what 19 but one final thing I want to respond to is the 20 accusations of bad faith and -- and hiding things. I 20 did you do to find out? How did you come to this 21 want to be very clear that documents have been logged 21 determination? Who's gonna testify and say what? 22 And I know I'm not -- I'm not putting 22 on the privilege log that are, on their face,
23 you in a trial. I know we're not. 24 MS. SULTANIAN: Yeah. 24 There's a November 21st, 2022 letter 25 JUDGE FALK: But there's -- there's 25 that was attached as Exhibit B, Plaintiffs'
Page 23 Page 25 1 Exhibit B, to Docket 511 that is specifically about 1 something that is bugging me, I guess, and that is -- 2 the RFP 48, which was the -- the requests for 2 well, I'll keep going, and then I'll let you go. I 3 mean, first of all, was there ever a report of the 3 documents about the dark web, and we said "Defendants 4 investigation that was done, and was that report 4 will produce non-privileged documents identified 5 provided to the Plaintiffs? 5 after a reasonable search." It has never been hidden 6 MS. SULTANIAN: Your Honor, 6 that we were asserting privilege over portions of the . 7 dark -- over this dark web investigation. 8 JUDGE FALK: All right. 8 And the -- the case that Counsel cited, 9 O'Reilly v. Home Depot, where -- where sanctions . And then you have a 30(b)(6) witness who's 10 asked -- who says, Ms. Cetera, that she's -- she does 10 were, apparently, imposed, there was no reference in 11 this. It's a regular thing. One of the things they 11 the privilege log to those documents at issue. That 12 do is monitor the dark web. They do it all. 12 is not the case here. So, you know, I won't -- I 13 And what you do here, and then there's 13 won't belabor that unless Your Honor has a need for 14 an objection -- and I can read the very specific 14 further questions, but I -- I want to be clear that 15 stuff I'm dealing with, but there's an objection of 15 this has been aboveboard and fully disclosed. Things 16 have been in the privilege log. That's -- that's all 16 privilege; don't answer the question. 17 So, in other words, is it Quest's 17 I have on that. 18 position that they don't have to disclose what was 18 JUDGE FALK: Okay. That's fine. So I 19 done in the investigation? 19 just want to ask a few questions, but I guess from 20 MS. SULTANIAN: It's -- it's Quest's 20 the letter -- and I don't know how this is -- well, 21 position that the steps taken in that investigation 21 Quest is saying that there was no patient 22 were directed by counsel and were privileged. 22 information -- none of Quest's patient information on 23 the dark web. Is that true? 23 JUDGE FALK: So -- and when you say it 24 MS. SULTANIAN: Yes. As -- as far as 24 was directed by counsel, who are we talking about? 25 MS. SULTANIAN: So, specifically -- 25 Quest is aware, and from its investigation, it has
7 (Pages 22 - 25) Veritext Legal Solutions 800-227-8440 973-410-4040 *31 Page 26 Page 28 1 and -- and I don't want to get into the details of a 1 "QUESTION: And so following the data 2 specific document first, but there -- 2 breach in 2019, the threat and incident team would, 3 JUDGE FALK: Well, it's the lawyers, I 3 in the normal course, finding out that there was 11.5 4 think you said. 4 million people potentially exposed, monitor the dark 5 MS. SULTANIAN: Yeah, the lawyers. 5 web with respect to that activity?" 6 So -- yes. Paul Kattas was involved in that, and 6 And then there's an objection by 7 he's in-house counsel for Quest. 7 Counsel: "Objection. I instruct the witness not to 8 JUDGE FALK: So an in-house counsel was 8 answer on the grounds of privilege. That team and 9 involved in the investigation, and -- so that makes 9 others acting at the direction of counsel in 10 everything non-discoverable after that. 10 anticipation of litigation" -- that's more of a work 11 MS. SULTANIAN: Well, not just involved; 11 product concept, I -- I agree. From what I've seen, 12 there's -- there's emails where it specifically says 12 I don't think Quest is claiming work product, but to 13 Paul made the decision, right? It's directed by 13 finish: -- "in anticipation of litigation is 14 counsel. 14 protected by privilege, and I will instruct the 15 JUDGE FALK: And -- and how about just 15 witness not to answer." 16 what was done in the investigation? Is that not -- 16 And the witness testifies at other times 17 are they not facts? 17 that that's what they do on a day-to-day basis. It 18 MS. SULTANIAN: I don't believe so, Your 18 actually says that. So they do that, and would you 19 Honor. I -- I believe that the steps taken in the 19 agree that that's a -- a business function? 20 investigation are directed -- are counsel-directed. 20 MS. SULTANIAN: The -- the normal-course 21 So the facts are what was found, and that has been 21 monitoring, yes, Your Honor, I agree. The difference 22 disclosed. 22 here is that the -- the scale of what, at the time, 23 JUDGE FALK: Okay. I hear what you're 23 we understood this breach could potentially be meant 24 saying. 24 that counsel got involved right away and directed 25 Ms. Cetera goes a long way to say that, 25 specific steps. And, again, it gets into the
Page 27 Page 29 1 you know, obviously they're security experts, they -- 1 documents, so I don't want to be too forthcoming 2 well, let me just read some of it. And there's more 2 right now. We can -- we can discuss in more detail, 3 things here that I can refer to, but.... 3 but there's a difference between that ordinary-course 4 So I'm reading from, actually, page 4 of 4 monitoring, which -- which is a business function, 5 the letter, May 9th. 5 and what happens right after a breach of this 6 "QUESTION: Are you aware of any Quest 6 potential scale is learned and counsel gets involved, 7 IT Security Incident team that was in place prior to 7 and there were specific things that were directed 8 the data breach? 8 that are different than what the ordinary-course 9 "ANSWER: Yes. 9 monitoring was. 10 "QUESTION: And their function was to 10 JUDGE FALK: Right. But it's these 11 respond to, in the normal course of business, 11 people, it's that team that did the investigation. 12 security incidents, correct? 12 Is that true? 13 "ANSWER: Generally, yes. 13 MS. SULTANIAN: Yeah. The security team 14 "QUESTION: And that's what they did in 14 actually, you know, boots on the ground, did the 15 response to the AMCA data breach? 15 investigation. That's not something counsel has the 16 "ANSWER: Yes." 16 skills to do. 17 I think that's -- that's kind of just 17 JUDGE FALK: Right. 18 information. And then later we have another witness 18 MS. SULTANIAN: But it -- it was 19 on page 6: 19 directed by counsel to obtain information that would 20 "QUESTION: And monitoring the dark web 20 allow them to give informed legal advice. 21 and identifying if there's -- following an incident 21 JUDGE FALK: Okay. And did -- is it 22 or data breach is part of the day-to-day 22 Paul Kattas we're talking about? 23 normal-course functions of Quest's threat incident 23 MS. SULTANIAN: Yeah. He was primarily 24 team? 24 the one -- 25 "ANSWER: Yes, it is. 25 JUDGE FALK: Right.
8 (Pages 26 - 29) Veritext Legal Solutions 800-227-8440 973-410-4040 *32 Page 30 Page 32 1 MR. HOOPER -- involved in it. 1 We didn't get them until more than a year after the 2 JUDGE FALK: And did he stay involved 2 close of discovery, so we had no opportunity to 3 and 3 investigate that further. When we tried to do so, 4 MS. SULTANIAN: Yes. Because he, you 4 Quest told us that it was too late, so we could not 5 know, through this whole couple-week, even to 5 do that any further. 6 couple-month period, was involved in these ongoing 6 And to that end, I just wanted to note 7 discussions, and you'll see in the documents, was 7 that the documents I passed out didn't have the Bates 8 directing specific things that were done. 8 numbers them, but -- 9 JUDGE FALK: So, I guess to sum up -- 9 JUDGE FALK: No. 10 and I guess I already asked this question; I don't 10 MS. FIDLER: -- they end -- I can 11 really need to ask much more -- it's Quest's position 11 provide that after, but they end in 0024406, 0024408. 12 that an investigation done by the -- the team that 12 And those documents relating to this -- to that 13 has done these investigations before, et cetera, 13 investigation were never logged, they were never 14 is -- as soon as counsel gets involved, that makes 14 asserted privilege over them, and so they were 15 everything that they did privileged. 15 withheld for the entire course of discovery. 16 MS. SULTANIAN: But I -- I'd put a finer 16 But at a more broader aspect, basically 17 point on it, Your Honor, in that it's not just, Oh, 17 what Quest is trying to do here is use its privilege 18 they get involved, everything becomes privileged. 18 as both a sword and a shield. It wants to shield 19 It's counsel got involved and directed them to do 19 itself by saying that, you know, just because an 20 specific things that they ordinarily did not do. 20 attorney may have asked someone to do something that 21 JUDGE FALK: Privilege. Okay. 21 it would have done anyway in the normal course of 22 MS. FIDLER: Can I respond? 22 business, that it is privileged, and then it has 23 JUDGE FALK: What? 23 tried to use that improperly asserted privilege as a 24 MS. FIDLER: Can I respond? 24 sword to assert that they have no knowledge of 25 JUDGE FALK: In a minute. Because I'm 25 information being found on the dark web because that
Page 31 Page 33 1 still -- I want to satisfy myself, but I guess I have 1 information is privileged. 2 to accept it. I mean, I'm trying to figure out how 2 That is not how discovery works. You 3 that plays out, you know, in a trial. 3 don't get to use privilege to assert claims in 4 In other words, basically what Quest is 4 defenses, and then withhold that privilege, and 5 saying here is that the Plaintiffs are not permitted 5 that's exactly what they are asserting: that 6 to know what Quest did to investigate the data 6 information on the dark web is not available because 7 breach. That's what this comes down to. And if 7 they have any -- they don't have knowledge of it, and 8 that's the position, I'd like to know it. 8 to the extent those documents and communications that 9 MS. SULTANIAN: It -- it is our position 9 would be reflected of that true knowledge -- or of 10 that steps that were taken to investigate the breach 10 that knowledge and the fact that they -- excuse me -- 11 that were directed by counsel, it's -- it's 11 the fact that they found out in the investigation are 12 privileged. That -- that is our position. 12 privileged. 13 JUDGE FALK: And were there any steps 13 You know, my colleague says that the 14 that weren't taken by counsel that have been 14 facts -- we have the facts. They never produced the 15 disclosed? 15 documents. We were not allowed to ask the witness 16 MS. SULTANIAN: Well, for example, 16 about what they did in response to the AMCA data 17 these -- these emails that Ms. Fidler put in front of 17 breach. They asserted privilege on that, and the 18 you, they are showing things that Quest did to 18 communications were shut down. The only facts that 19 investigate, and they've been produced, right? These 19 we have regarding what Quest did in response to 20 are not the specific things that counsel directed. 20 information on the dark web are these documents that 21 JUDGE FALK: Okay. I appreciate it. 21 we got a year after discovery, and that's all we 22 You would like to respond? 22 have. 23 MS. FIDLER: Yes. Just on that last 23 And so to the extent that Quest is going 24 point. Heather said -- or my colleague -- said 24 to claim that all of -- all of these documents are 25 that -- you know, that these documents were produced. 25 privileged, then they should be precluded from having
9 (Pages 30 - 33) Veritext Legal Solutions 800-227-8440 973-410-4040 *33 Page 34 Page 36 1 MR. HOUSER: Well, definitely. I mean, 1 a defense that relies on any facts of that 2 just -- our position is these are privileged. So, of 2 investigation, whether it be that Plaintiffs' 3 course, we -- we would expect we'd get the same 3 information was not found on the dark web or whether 4 treatment as other documents that were withheld on 4 Plaintiffs' information that -- or Plaintiffs' 5 privilege and that Counsel would not be in the room 5 evidence that their information was found on the dark 6 web is -- is wrong. They can't shield the facts and 6 for any such proffers. 7 JUDGE FALK: Okay. And before we split 7 then -- and then use them against Plaintiffs. 8 up, are there any other discovery disputes out there 8 JUDGE FALK: Understood. Thank you. 9 that need to be decided? 9 MS. FIDLER: Thank you. 10 MR. AYERS: I don't -- I don't think of 10 JUDGE FALK: Mr. Ayers, do you have any 11 the issues that are still pending. 11 questions? 12 JUDGE FALK: Okay. 12 MR. AYERS: Nothing to add. 13 JUDGE FALK: Okay. 13 MR. AYERS: Do you want to -- how would 14 Your Honor want to -- how would you want to handle 14 MR. AYERS: Ms. Sultanian handled it 15 this? Would you want to have argument on -- on this 15 well. Thank you. 16 Optum dispute letter and then handle both in camera 16 JUDGE FALK: So -- and now it's my 17 submissions after we leave the room, or handle -- 17 intention to go through the documents and allow -- 18 finish with 512, 511, and then have us come back, or 18 you know, there are many ways to decide privilege 19 are you not having oral argument at all? 19 disputes, as you must all know, from, actually, you 20 know, having affidavits, and things like that, to 20 JUDGE FALK: Well, if you feel it's 21 having testimony, you know. I'm talking about in a 21 necessary, you know, I'm not sure. I mean, as far as 22 511, I'm done with that for today. I'm gonna issue 22 closed courtroom. 23 an opinion, and it's gonna be, you know, I think, 23 In this case, I'm gonna ask -- and it's 24 short, but we'll address everything we talked about 24 only if the party wishes to offer proffers about what 25 and we'll address the documents in a -- in a chart. 25 you would be prepared to prove, and we're going to
Page 35 Page 37 1 seal that portion of the transcript in both cases. 1 But as to Optum, I don't know. That's a little 2 But I only say that because you folks may want to 2 different situation. These are documents that were 3 stick around, because with both cases -- I think with 3 inadvertently produced. Is there something general 4 Optum, we don't have any real issues to argue, unless 4 that you would want to say about that before.... 5 something -- has anything new come up? I don't know. 5 MR. AYERS: Yeah. I think we -- we 6 I mean, we have documents that were, 6 would like an opportunity to address -- to briefly 7 apparently, inadvertently produced and clawed back 7 address it. 8 and there's a dispute. That's what I have before me. 8 JUDGE FALK: Well, I mean, generally, 9 MR. HOUSER: Yeah. That's -- that's 9 though, because I don't think that -- I think Optum 10 correct. That's the 512 dispute. 10 is -- if these -- these are privileged documents. 11 MR. AYERS: Yes. And we've seen these 11 MR. AYERS: We -- we can talk about them 12 documents. I mean, we -- we don't believe they're 12 in general terms. 13 anything close to privilege or work product, so we 13 JUDGE FALK: Yeah. I'm happy to hear 14 don't believe we have any -- any way to suspect that 14 from you in general. We'll move on to 512. 15 they might have been privileged. We actually had 15 MR. HOUSER: So just process-wise, do we 16 reviewed them prior to -- 16 want to do that, and then we'll -- 17 JUDGE FALK: Oh. 17 JUDGE FALK: Oh. 18 MR. AYERS: -- prior to counsel clawing 18 MR. HOUSER: -- do the splitting? 19 them back. 19 JUDGE FALK: I don't -- I don't care. 20 MR. HOUSER: I -- I don't know if that's 20 MR. HOUSER: Okay. 21 the case, but.... 21 JUDGE FALK: It's more like how long do 22 MR. AYERS: But more to just put it on 22 you want to stick around for. I don't think it's 23 the record, we have -- we have seen them. So if that 23 gonna be long, anyway, today. 24 influences your decision of whether we're in or out 24 MR. AYERS: I think it makes sense, 25 of the room.... 25 maybe, to have any argument that we're going to have,
10 (Pages 34 - 37) Veritext Legal Solutions 800-227-8440 973-410-4040 *34 Page 38 Page 40 1 made regardless as it related to Optum's business 1 and then we can leave the room, and Defendants -- 2 impact. It was to see whether they were at risk of 2 JUDGE FALK: Sure. Okay. 3 this happening again; it was not to obtain legal 3 MR. AYERS: -- can have their in camera 4 advice. And the mere fact that Optum's counsel 4 show. 5 was -- in-house counsel was copied on an email with 5 JUDGE FALK: That's fine. 6 MS. FIDLER: Hillary Fidler on behalf of 6 11 other employees doesn't make it privilege. 7 There's been case law on that for years, that 7 the Plaintiffs. Thank you. 8 including an attorney on a distribution list of an 8 You know, there are 13 documents at 9 interoffice memo or cc'ing numerous people on an 9 issue that Optum has clawed back: Six are 10 ancillary discussion, one who happens to be an 10 communications, and seven appear to be various 11 attorney, is not privilege. 11 working copies of a vendor assessment. These 12 When in-house counsel is involved, the 12 documents are responsive to Plaintiffs' interrogatory 13 15, 16 and 18, which sought information regarding 13 Court must determine whether the purpose of the 14 communication was predominantly legal. It was not 14 Defendants' risk assessments. Optum largely objected 15 predominantly legal. As it was, it was to assess the 15 to producing these documents, based on relevancy. 16 business impact, and Quest tries -- or excuse me -- 16 Your Honor has already ruled that these are documents 17 Optum argues that it -- that they were privileged 17 that are relevant to Plaintiffs' negligence claim. 18 because the IT employees were working to provide -- 18 In sum, Optum has not shown that 19 assist with the attorney providing legal advice. 19 these -- it can claim privilege over these, and it 20 has not done a specific demonstration of facts 20 What that legal advice is remains unclear, but these 21 showing that they are privileged. At a basis, the 21 IT employees were working in their normal course of 22 business to assess the vendors that they were 22 seven working copies of a vendor assessment are 23 responsible for tracking, and the vendor risk 23 facts, not communications and they are not covered by 24 assessment is -- and the working copies of it are not 24 attorney-client privilege. That pretty much ends 25 work product. 25 the -- ends the dispute with that as it -- as it
Page 39 Page 41 1 applies to work -- or excuse me -- as it applies to 1 If you look at the supplemental 2 an attorney-client privilege. 2 privilege log that Quest -- or excuse me, pardon 3 The remaining five exhibits are 3 me -- that Optum provided, the master date of the 4 communications. 4 final spreadsheet is December 2016. That's right on
5 the supplemental privilege log that they provided. 6 That's the same date that Optum took over Quest's 7 revenue management. That -- it means that that was 8 likely a living document that Quest employees updated 9 and revised throughout the ordinary course of 10 business. This time, it just so happened to be after
11 You know, the attorney-client privilege 11 a data breach. 12 protects only disclosures that are necessary to 12 You know, Optum has to show that this 13 obtain legal advice. This was not to obtain legal 13 document was prepared because of reasonably 14 advice. What is likely what happened is that the 14 anticipated litigation, and that it was prepared for 15 AMCA data breach sounded the alarm for Optum that 15 the prospect of litigation and for no other purpose. 16 they had been asleep at the wheel on these -- on 16 It simply cannot do that. Optum has spent the last 17 these risk assessments in making sure that their 17 years arguing that this litigation is solely limited 18 vendors had adequate security. 18 to the AMCA data breach and nothing else. All that
19 is relevant, in Optum's view, is its oversight of the 20 AMCA. How an assessment of other vendors could have 21 been reasonably anticipated in this litigation has -- 22 has not been explained.
. 23 You know, it's even -- it's even more 24 This disclosure would have been made 24 obvious when you consider Optum's objections to 25 regardless of Optum's -- of -- it would have been 25 Docket 513 where they were ordered to provide them
11 (Pages 38 - 41) Veritext Legal Solutions 800-227-8440 973-410-4040 *35 Page 42 Page 44 1 based under the relevancy objections, and they say 1 addressing a limited number of documents that are not 2 that "The risk assessment of Optum360 performed of 2 routine risk assessments. They were documents 3 other third-party collection agencies are irrelevant 3 created after the AMCA incident, after a lawyer 4 to the AMCA data breach and Plaintiffs claims against 4 launched an investigation in the face of numerous 5 Optum, which turn on the reasonableness of Optum's 5 lawsuits that had been filed, regulator inquiries 6 oversight of AMCA's data security. Plaintiff's 6 that had been already initiated, and the purpose was 7 negligence claims do not rise out of security 7 to facilitate that lawyer's legal advice 8 deficiencies or lack of oversight of other debt of as well as the AMCA data breach. 9 collection agencies." 9 And I think, without getting into the 10 10 specifics, if you look at the clawed-back documents,
11 they were in the immediate wake of the incident. It 12 was from the August time period, and it's this narrow
to the extent it was because 13 subset, Your Honor. It is the employees are working 14 they anticipated it would be used in a litigation 14 around the clock. The dates of the emails and the 15 regarding AMCA. That has been their position this 15 documents are demonstrating that they are going a 16 entire litigation, and they can't withhold documents 16 million miles an hour. It is anything but ordinary 17 by taking a complete 180 turn on that now. To that 17 course. They're working over the weekend, and it's a 18 end, they -- Optum's assessment that they were 18 living, breathing analysis. 19 conducted at the direction of counsel is inadequate 19 This isn't our standard risk assessment 20 to confer work -- work product protections. 20 that we're performing for vendors, which, again, is a 21 You know, if documents are created 21 totally different issue and is an issue that we were 22 through a routine business purpose by non-attorneys, 22 here on earlier, but this is an analysis that was 23 they do not fall within the purview of work product 23 requested by counsel. And we've come forward with 24 privilege. And just because an email -- an attorney 24 evidence from the lawyer that expressly went through 25 happened to be cc'ed on an email in which that work 25 on a document-by-document basis and makes clear that
Page 43 Page 45 1 product was sent to does not make it privilege. 1 these specific documents would not have been created 2 JUDGE FALK: Okay. Thank you very much. 2 but for this investigation. This is not ordinary 3 Do you want to respond? 3 course. This would never have happened but for the 4 MR. HOUSER: I would like to respond, 4 lawyer making this request. 5 Your Honor. 5 I heard a couple of other things I'd 6 JUDGE FALK: Then we'll get to the 6 like to quickly respond to. One is this idea that 7 documents. 7 there's this alleged inconsistency between our 8 MR. HOUSER: Sure. And I'll try to be 8 position about relevancy of other vendor risk 9 brief. What I would like to do is just level-set a 9 assessments and whether or not a document was created 10 little bit about what we're talking about -- 10 at the direction of counsel as part of an 11 JUDGE FALK: Sure. 11 investigation, or whether we reasonably anticipated 12 MR. HOUSER: -- and what we're not 12 litigation. I think that's a false equivalence. 13 talking about, because I think that's important to 13 Simply because we don't believe, for the 14 zoom out. 14 specific claims remaining in this case, that other 15 JUDGE FALK: Okay. 15 vendor risk assessments are relevant doesn't mean 16 MR. HOUSER: We're not talking about 16 that these documents created in the wake of the 17 Optum360's ordinary course of business risk 17 incident were not created at the direction of 18 assessments of other vendors. The risk assessments 18 counsel, or were not created in reasonable 19 that were at issue in prior discovery disputes, those 19 anticipation of litigation. I think 34 lawsuits have 20 are not these. That's not what we're talking about. 20 been filed by this time. I mean, it is -- it is a 21 Those are the -- we've never claimed privilege over 21 lot going on at this time, and it, of course, makes 22 the ordinary course of business, routine risk 22 sense that you have lawyers involved to assess -- 23 assessments. 23 assess the risk. 24 And, again, those are a -- that is a 24 You also have a document that has an 25 different issue than what we have here. We are 25 initial create date of 2016. That may be the initial
12 (Pages 42 - 45) Veritext Legal Solutions 800-227-8440 973-410-4040
NOTES
[4] During the July 26, 2024 hearing, Plaintiffs commented that they learned about involvement in the investigation for the first time earlier this year, after Quest produced certain documents in connection with an earlier decision in which the Special Master ordered that Quest produce a sample set of documents responsive to Request for Production No. 48, which requested: “Documents and communications related to the sale of PII and PHI, including price for PII and PHI on the dark web.” ( See Joint Hearing Tr. 10:24-11-24). 5 Plaintiffs originally moved to compel the production of an unspecified number of documents. After meeting and conferring, the parties were able to narrow the number of documents in dispute to 38. 6 Apparently, . ( See Joint Hearing Tr. 25:2-7).
[9] In re Experian Data Breach Litig. , No. 15-01592, 2017 WL 4325583 (C.D. Cal. May 18, 2017); Wengui v. Clark Hill, PLC , No. 19-3195, 2021 WL 106417 (D.D.C. Jan. 12, 2021); In re Target Corp. Customer Data Sec. Breach Litig. , No. 14-2522, 2015 WL 6777384 (D. Minn. Oct. 23, 2015); In re Premera Blue Cross Customer Data Sec. Breach Litig. , 296 F. Supp. 3d 1230 (D. Or. 2017); Maldondo v. Solara Med. Supplies, LLC , No. 20-12198, 2021 WL 8323636 (D. Maa. June 2, 2021); In re Am. Med. Collection Agency, Inc. , 2023 WL 8595741 (D.N.J. Oct. 16, 2023); In re Dominion Dental Servs ., 429 F. Supp. 3d 190 (E.D. Va. 2019); Leonard v. McMenamins Inc. , No. 22-0094, 2023 WL 8447918, at *5 (W.D. Wash. Dec. 6, 2023).