ORDER GRANTING MOTION TO REMAND
Plaintiffs Monica Sabatino and Michael Sabatino (collectively, “Plaintiffs”) bring a putative class action against defendants HMO Missouri, Inc. and Healthy Alliance Life Insurance Company (collectively, “Defendants”) arising out of a cyberattack on the computer system of Defendants’ parent company, Anthem, Inc. (“Anthem”), Before the Court is Plaintiffs’ motion to remand the case to the Circuit Court of St. Louis City, 22d Judicial Circuit, in the State of Missouri. ECF No. 15.
Having considered the submissions of the parties, the relevant law, and the record in this case, the Court GRANTS Plaintiffs’ motion to remand the case to the Circuit Court of St. Louis City, Missouri.
I. BACKGROUND
A. Factual Background
Defendants are affiliates of Anthem, an Indiana corporation that is one of the largest health benefits companies in the United States. ECF No. 1, Notice of Removal (“Removal Notice”) ¶ 5. Through its affiliated health plans, Anthem delivers health benefit products and plans to tens of millions of members across the country. Id.
On February 4, 2015, Anthem announced that cyberattackers had gained unauthorized access to its data systems on or about December 10, 2014. ECF No. 1-1, Class Action Petition (“Pet.”) ¶¶8-9. As a result of this breach, Plaintiffs allege that the personally identifiable information of up to 80 million current and former Anthem members was compromised. Id. ¶¶ 10-12. The allegedly compromised information includes members’ names, birthdays, medical identification numbers, social security numbers, street addresses, email addresses, and employment information, including income data. Id. ¶ 10.
Plaintiffs are “adult residents of Saint Louis County, Missouri” who have been Anthem members since April 2014. Pet. ¶¶ 1, 21. Plaintiffs claim that their personal information was compromised as a result of the Anthem data breach. Id. ¶¶ 21-24. “By virtue of their membership in Anthem,” Plaintiffs allege, “the company obtained their sensitive medical records, personal information, including their birthdays, social security numbers, address, and employment information.” Id. ¶ 21. As a result of the data breach, Plaintiffs claim they “are at a heightened risk for future identity theft.” Id. ¶ 23. Plaintiffs claim further that they “have been harmed in that they (1) paid more for insurance record privacy protections than they otherwise would have, and (2) paid for insurance record privacy protections that they did not receive.” Id. ¶ 24.
On February 16, 2015 — twelve days after Anthem announced the data breach— Plaintiffs filed the instant putative class action in the Circuit Court of St. Louis City, Missouri. Removal Notice ¶ 1. A copy of the class action petition was served on Defendants on March 6, 2015. Id. ¶ 2. In the petition, Plaintiffs, asserted four, causes of action under Missouri law: (1) violation of the Missouri Merchandising Practices Act (“MMPA”), Mo. Rev. Stat. § 407.010 et seq., Pet. ¶¶ 35-45; (2) breach of fiduciary duty, id. ¶¶ 46-52; (3) breach of contract, id. ¶¶ 53-57; and (4) negligence, id. ¶¶58-63. Plaintiffs brought these four.causes of action on behalf of themselves and a statewide class of similarly situated individuals, defined as follows:
Missouri residents whose personal information was compromised as a result of the data breach announced in February 2015 and are (1) current-and former members of a health insurance plan administered by Defendants, and/or (2) current and former Anthem'employees.
Id. ¶ 26 (emphasis added). “The precise number of Class members;” according to Plaintiffs, “can be obtained from information and records in Defendants’ possession and control.” Id. ¶ 29. Defendants estimate that the proposed class comprises at least 750,000 individuals. See Removal Notice ¶ 12.
On April 3, 2015, Defendants removed this action to the United States District Court for the Eastern District of Missouri. See Removal Notice. . Defendants proffered two independent bases for subject matter jurisdiction in federal court: (1) diversity jurisdiction under the Class Action Fairness Act of 2005 (“CAFA”), 28 U.S.C. § 1332(d); and (2) federal question jurisdiction under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 42 U.S.C. § 1320d et seq. See Removal Notice ¶¶ 10-23.
On April 10, 2015, Plaintiffs filed the instant motion to remand. ECF No. 15 (“Mot.”). Pursuant to a stipulation by the parties, see ECF Nos. 18, 19, Defendants opposed the motion on May 1, 2015, ECF No. 22 (“Opp.”). Plaintiffs replied on May 14, 2015. ECF Ño. 28 (“Reply”).
On May 14, 2015 — the same day Plaintiffs filed their reply — Plaintiffs also filed a first amended complaint. ECF No. 27, First Amended Complaint (“FAC”). In the FAC, Plaintiffs clarified that they “are citizens of Saint . Louis County, Missouri,” not just “residents.” Id. ¶ 1., Plaintiffs also amended the class definition, replacing the word “residents” with ,“[c]itizens.” Id. ¶ 25. The class definition now reads:
Citizens of Missouri whose personal information was compromised as a result of the data breach announced in February 2015 and are (1) current and former members of a health insurance plan administered by Defendants, and/or (2) current and former Anthem employees.
Id. (emphasis added). In all other respects, Plaintiffs’ FAC is materially the same as the original class action petition. For example, Plaintiffs continue to assert four causes of action under Missouri law:
(1) violation of the MMPA,' id'. ¶¶ 34-44;
(2) breach of fiduciary duty, id. ¶¶ 45-51;
(3) breach of contract, id. ¶¶ 52-56; and
(4) negligence, id. ¶¶ 57-62.
On May 18, 2015, in response to Plaintiffs’ FAC, Defendants filed a motion for leave to file a sur-reply. ECF No. 30. The district court granted the motion the next day. ECF No. 31. On May 28, 2015, Defendants filed their sur-reply, ECF No. 33, which argued that Plaintiffs’ “last-ditch effort to avoid federal court” by amending their complaint was unavailing because the district court should only consider “what
On June 8, 2015, the Judicial Panel on Multidistrict Litigation (“JPML”) issued a transfer order pursuant to 28 U.S.C. § 1407 selecting the undersigned judge as the transferee court for “coordinated or consolidated pretrial proceedings” in the multidistrict litigation (“MDL”) arising out of the Anthem data breach “that allegedly occurred sometime between December 10, 2014, and February 4, 2015.” Case No. 15-MD-02617-LHK, ECF No. at 1-3. Accordingly, on June 17, 2015, the JPML transferred the instant putative class action from the Eastern District of Missouri to the undersigned judge in the Northern District of California. ECF No. 34.
On July 31, 2015, the Court held a preliminary case management conference. See ECF No. 39. Counsel for Plaintiffs appeared at the case management conference and communicated to the Court Plaintiffs’ intent to pursue their pending motion to remand. Id. at 2. The Court set the motion for hearing on September 10, 2015, at 1:30 p.m. Id.
On August 27, 2015, the Court ordered the parties to file supplemental briefing, on Plaintiffs’ motion to remand no -later than September 4, 2015, ECF No. .40. The Court did so because the parties’ briefs, which were filed in.the Eastern District of Missouri, a division of the Eighth Circuit, did not cite to or otherwise address relevant Ninth Circuit precedent, which this Court must apply. See Newton v. Thomason,
Plaintiffs filed their supplemental brief on September 4, 2015. Case No. 15-MD-02617-LHK, ECF No. 258 (“Pls.Supp.Br.”). Defendants did the same. ECF No. 41 (“Defs.Supp.Br,”).
II. LEGAL STANDARD
A suit may be removed from state court to federal court only if the federal court would have had subject matter jurisdiction over the case in the first instance. 28 U.S.C. § 1441(a); see Caterpillar Inc. v. Williams,
There is no’ presumption against removal jurisdiction in CAFA eases. See Dart Cherokee Basin Operating Co., LLC v. Owens, — U.S. -,
III. DISCUSSION.
Defendants argue that there are two independent bases for subject matter jurisdiction in federal court: (1) diversity jurisdiction under CAFA; and (2) federal question jurisdiction under HIPAA. See Removal Notice ,¶¶ 10-23; Opp. at 3-12; Defs. Supp. Br. at 2-9. Plaintiffs dispute both of these bases for jurisdiction.
A. Diversity Jurisdiction Under CAFA
CAFA gives federal courts jurisdiction over certain class actions if (1) “the class has more than 100 members”; (2) “the parties are minimally diverse”; and (3) “the amount in controversy exceeds $5 million.” Dart Cherokee,
As the Ninth Circuit has explained, “the diversity jurisdiction statute, 28 U.S.C. § 1332, speaks of citizenship, not of residency.” Kanter v. Warner-Lambert Co.,
In the instant case, Plaintiffs’ original petition stated that “Plaintiffs are adult residents of Saint Louis County, Missouri.” Pét. ¶ 1 (emphasis added). The original petition’s, class definition also spoke of residency, rather than citizenship:
*893 Missouri residents whose personal information was compromised as a result of the data breach announced in February 2015 and are (1) current .and former members of a health insurance plan administered by Defendants, and/or (2) current and former Anthem employees.
Citizens of Missouri whose personal .information was compromised as a result of the data breach announced in February 2015 and are (1) current and former members of a health insurance plan administered by Defendants, and/or (2) current and former Anthem employees.
Id. (emphasis added).
Ordinarily, “post-removal amendments to the pleadings cannot affect whether a case is removable, because the propriety of removal is determined solely on the basis of the pleadings filed in state court.” Williams v. Costco Wholesale Corp.,
Here, Plaintiffs amended their state'court petition to “clarify” that they are not only residents of Missouri, but citizens as well. Benko,
In reaching this conclusion, the Court notes its agreement with several other district courts in the Ninth Circuit. In Weight, for example, the district court considered the plaintiffs amended complaint, which had revised the class definition to include “citizens of California” rather than “California residents,” in determining whether CAFA’s minimal diversity requirement was satisfied.
Even more on point are the recent decisions in Wickens v. Blue Cross of California, Inc., No. 15CV834-GPC JMA,
Similarly, the district court in Smilow found it appropriate to consider the plain
Defendants’ citation to Doyle v. OneWest Bank, FSB,
Doyle is distinguishable, however, because the plaintiff there did not seek to merely clarify her complaint to aid in the federal court’s jurisdictional analysis. Instead, the Doyle plaintiff sought to dramatically narrow the scope of the action from a nationwide class action to a statewide class action on behalf of California plaintiffs only. In the instant case, by contrast, Plaintiffs have sought from the outset to represent Missourians only. The FAC simply clarifies that Plaintiffs, as well as the proposed class, are citizens of Missouri, hot just residents, see FAC ¶¶ 1, 25 — a distinction that was of no moment "when Plaintiffs filed this action in state court. The district courts in Wick-ens and Smilow distinguished Doyle on similar grounds. See Wickens,
Accordingly, the Court considers Plaintiffs’ clarifications in the FAC and concludes that CAFA’s minimal diversity requirement has not been, mét in this action because both Plaintiffs and Defendants are citizens of Missouri. See FAC ¶¶ 1-3, 25. CAFA, therefore, cannot serve as a basis for this Court’s subject matter jurisdiction. See Weight,
B. Federal Question Jurisdiction Under HIPAA
“Absent diversity of citizenship, federal-question jurisdiction is required.” Caterpillar,
“[I]n certain cases,” the Supreme Court has explained, “federal-question- jurisdiction will lie over state-law claims that implicate significant federal issues.” Grable & Sons Metal Prods., Inc. v.. Darue Eng’g & Mfg.,
Defendants assert here that Plaintiffs’ “claims raise important federal questions and implicate a compelling federal interest that warrants this Court’s exercise of federal question jurisdiction.” Removal Notice ¶ 18 (citing Grable,
The Court is not persuaded that Grable’s third and fourth prongs have been met.
Furthermore, the Ninth Circuit has held post-Grable that “HIPAA itself does not provide for a private right of action.” Webb v. Smart Document Solutions, LLC,
Accordingly, the Court concludes that Defendants have not met their burden to show that federal question jurisdiction exists over this action.'
IV. CONCLUSION
For the foregoing reasons, the Court hereby GRANTS Plaintiffs’ motion to remand the case to the Circuit Court of St. Louis City, Missouri.
IT IS SO ORDERED.
Notes
. Unless otherwise indicated, all ECF references are to the docket of Case No. 15-CV-2873-LHK in the Northern District of California.
. Plaintiffs also raise the “home state exception" as a ground for remand. See Mot. at 8-10; Pls. Supp. Br. at 8-9. The Court need not address this argument because the Court remands on other grounds.
. The defendants in Wickens and Smilow have sought permission to appeal the district court rulings to the Ninth Circuit. See Defs. Supp. Br. at 5.
