Citations
- 162 F. Supp. 3d 953
Full opinion text
ORDER GRANTING IN PART AND DENYING IN PART ANTHEM DEFENDANTS’ MOTION TO DISMISS AND ORDER GRANTING IN PART AND DENYING IN PART NON-ANTHEM DEFENDANTS’ MOTION TO DISMISS
Re: Dkt. No. 410, 413
LUCY H. KOH, United States District Judge
Plaintiffs bring this putative class action against Anthem, Inc., 28 Anthem affiliates, Blue Cross Blue Shield Association, and 17 non-Anthem Blue Cross Blue Shield Companies. The Court shall refer to Anthem, Inc. and the Anthem affiliates as the “Anthem Defendants,” and shall refer to Blue Cross Blue Shield Association and the non-Anthem Blue Cross Blue Shield Companies as the “Non-Anthem Defendants.” The Court shall refer to the Anthem and Non-Anthem Defendants collectively as “Defendants.”
Before the Court are separate motions to dismiss Plaintiffs’ consolidated amended complaint (“CAC”) filed by the Anthem and Non-Anthem Defendants. See ECF No. 334-6 (“CAC”); ECF No. 410 (“Anthem Mot.”); ECF No. 413 (“Non-Anthem Mot.”). Having considered the parties’ submissions, the relevant law, and the record in this, case, the Court hereby GRANTS in part and DENIES in part the Anthem Defendants’ motion to dismiss and GRANTS in part and DENIES in part the Non-Anthem Defendants’ motion to dismiss.
I. BACKGROUND
A. Factual Background
Defendant Anthem, Inc. (“Anthem”) is one of the largest health benefits and health insurance companies in the United States. CAC ¶ 109. Anthem serves its members through various Blue Cross Blue Shield (“BCBS”) licensee affiliates and other non-BCBS affiliates. Id. ¶ 155. Anthem also cooperates with the Blue Cross Blue Shield Association (“BCBSA”) and several independent BCBS licensees via the BlueCard program. Id. ¶ 156. “Under the BlueCard program, members of one BCBS licensee may access another BCBS licensee’s provider networks and discounts when the members are out of state.” Id.
In order to provide certain member services, the Anthem and Non-Anthem Defendants “collect, receive, and access their customers’ and members’ extensive individually identifiable health record information.” Id. ¶ 157. “These records include personal information (such as names, dates of birth, Social Security numbers, health care ID numbers, home addresses, email addresses, and employment information, including income data) and individually-identifiable health information (pertaining to the individual claims process, medical history, diagnosis codes, payment and billing records, test records, dates of service, and all other health information that an insurance company has or needs to have to process claims).” Id. The Court shall refer to members’ personal and health information as Personal Identification Information, or “PII.”
Anthem maintains a common computer database which contains the PII of current and former members of Anthem, Anthem’s affiliates, BCBSA, and independent BCBS licensees. Id. ¶ 158. In total, Anthem’s database contains the PII of approximately 80 million individuals. Id. ¶ 204. According to Plaintiffs, both the Anthem and Non-Anthem Defendants promised their members that their PII would be protected. Blue Cross of California, for instance, mailed the following privacy notice to its members:
We keep your oral, written and electronic [PII] safe using physical, electronic, and procedural means. These safeguards follow federal and state laws. Some of the ways we keep your [PII] safe include securing offices that hold [PII], password-protecting computers, and locking storage areas and filing cabinets. We require our employees to protect [PII] through written policies and procedures .... Also, where required by law, our affiliates and nonaffiliates must protect the privacy of data we share in the normal course of business. They are not allowed to give [PII] to others without your written OK, except as allowed by law and outlined in this notice.
Id. ¶ 168 (emphasis removed). In February 2015, Anthem announced to the public that “cyberattackers had breached the Anthem Database, and [had] accessed [the PII of] individuals in the Anthem Database.” Id. ¶ 203. This was not the first time that Anthem had experienced problems with data security. In late 2009, approximately 600,000 customers of Wellpoint (Anthem’s former trade name) “had their personal information and protected healthcare information compromised due to a data breach.” Id. ¶ 194. In addition, in 2013, the U.S. Department of Health and Human Services fined Anthem $1.7 million for various HIPAA violations related to data security. Id. ¶ 195. Finally, in 2014, the federal government informed Anthem and other healthcare companies of the possibility of future cyberattacks, and advised these companies to take appropriate measures, such as data encryption and enhanced password protection. Id. ¶¶ 200-01.
Plaintiffs allege that Defendants did not sufficiently heed these warnings, which allowed cyberattackers to extract massive amounts of data from Anthem’s database between December 2014 and January 2015. Id. ¶ 226. After Anthem discovered the extent of this data breach, it proceeded to implement various containment measures. Id. ¶ 232. The cyberattacks ceased by January 31, 2015. Id. In addition, after learning of the cyberattacks, Anthem proceeded to retain Mandiant, a cybersecurity company, “to assist in assessing and responding to the Anthem Data Breach and to assist in developing security protocols for Anthem.” Id. ¶207. Mandiant’s work culminated in the production of an Intrusion Investigation Report (“Mandiant Report”), which Mandiant provided to Anthem in July 2015. Id.
According to Plaintiffs, the Mandiant Report found that “Anthem and [its] Affiliates [had] failed to take reasonable measures to secure the [PII] in their possession.” Id. ¶ 236. Likewise, Plaintiffs allege that “Anthem and Anthem Affiliates [] lacked reasonable encryption policies.” Id. ¶ 237. Additionally, “BCBSA and non-Anthem BCBS allowed the [PII] that their current and former customers and members had entrusted with them to be placed into the Anthem Database even though there were multiple public indications and warnings that the Anthem and Anthem Affiliates’ computer systems and data security practices were inadequate.” Id. ¶ 243. Plaintiffs further aver that although Anthem publicly disclosed the data breach in February 2015, many affected customers were not personally informed until March 2015, if at all. Id. ¶ 250. Finally, Plaintiffs contend that Anthem still has not disclosed whether it has made any changes to its security practices to prevent a future cyberattack.
B. Procedural History
A number of lawsuits were filed against the Anthem and Non-Anthem Defendants in the wake of the Anthem data breach. In general, these lawsuits bring putative class action claims alleging (1) failure to adequately protect Anthem’s data systems, (2) failure to disclose to customers that Anthem did not have adequate security practices, and (3) failure to timely notify customers of the data breach.
In spring 2015, Plaintiffs in several lawsuits moved to centralize pretrial proceedings in a single judicial district. See 28 U.S.C. § 1407(a) (“When civil actions involving one or more common questions of fact are pending in different districts, such actions may be transferred to any district for coordinated or consolidated pretrial proceedings.”). On June 12, 2015, the Judicial Panel on Multidistrict Litigation (“JPML”) issued a transfer order selecting the undersigned judge as the transferee court for “coordinated or consolidated pretrial proceedings” in the multidistrict litigation (“MDL”) arising out of the Anthem data breach. See ECF No. 1 at 1-3.
On September 10, 2015, the Court held a hearing to appoint Lead Plaintiffs’ counsel. Following this hearing, the Court issued an order appointing Co-Lead Plaintiffs’ counsel and requesting that counsel file a single consolidated amended complaint by October 19, 2015. ECF No. 284 at 2. On October 19, 2015, Plaintiffs filed their consolidated amended complaint, which organized Plaintiffs’ causes of action into thirteen different counts, with claims pursuant to various state and federal laws asserted under each count. The complaint’s prayer for relief included requests for class certification, injunctive relief, and damages.
On this final form of relief, Plaintiffs seek damages arising from four separate economic losses. First, Plaintiffs allege that they “paid Anthem money for services that should have included protecting their [PII] from unauthorized disclosure”; Plaintiffs refer to these losses as “Benefit of the Bargain” losses. ECF No. 424 at 3. Second, Plaintiffs seek recovery for “the theft of Plaintiffs’ [PII],” which Plaintiffs refer to as the “Loss of Value of PII.” Id. Third, Plaintiffs allege that many class members “incurred out-of-pocket losses, including delayed tax returns, and the time and costs of credit monitoring.” Plaintiffs refer to these losses as “Out of Pocket” costs. Id. Finally, Plaintiffs allege that all class members “are at significant risk of imminent identity theft...as a result of the exfiltration of their [PII],” which Plaintiffs refer to as the “Imminent Risk of Further Costs.” Id.
At the October 25, 2015 case management conference, the Court determined that the Anthem Defendants and Non-Anthem Defendants would file separate motions to dismiss. Both motions would be “limited to a combined total of 10 claims, with 5 claims selected by Plaintiffs, 3 claims selected by the Anthem Defendants, and 2 claims selected by the [Non-Anthem Defendants].” ECF No. 326-at 2-3. At the November 10, 2015 case management conference, the parties informed the Court of the 10 claims that would be addressed in Defendants’ motions to dismiss. ECF No. 366 at 2.
On November 23, 2015, the Anthem Defendants and Non-Anthem Defendants filed their respective motions to dismiss. ECF No. 410 (“Anthem Mot.”); ECF No. 413 (“Non-Anthem Mot.”). Plaintiffs filed their oppositions on December 21, 2015, and the Anthem Defendants and Non-Anthem Defendants filed their replies on January 19, 2016. ECF No. 424 (“Anthem Opp’n”); ECF No. 425 (“Non-Anthem Opp’n”); ECF No. 432 (“Anthem Reply”); ECF No. 433 (“Non-Anthem Reply”).
II. LEGAL STANDARD
A. Motion to Dismiss
Pursuant to Federal Rule of Civil Procedure 12(b)(6), a defendant may move to dismiss an action for failure to allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged. The plausibility standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Ashcroft v. Iqbal, 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (internal citations omitted). For purposes of ruling on a Rule 12(b)(6) motion, the Court “aecept[s] factual allegations in the complaint as true and eonstrue[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir.2008).
Nonetheless, the Court is not required to “ ‘assume the truth of legal conclusions merely because they are cast in the form of factual allegations.’ ” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir.2011) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir.1981)). Mere “eon-clusory allegations of law and unwarranted inferences are insufficient to defeat a motion to dismiss.” Adams v. Johnson, 355 F.3d 1179, 1183 (9th Cir.2004); accord Iqbal, 556 U.S. at 678, 129 S.Ct. 1937. Furthermore, “ ‘a plaintiff may plead [himjself out of court’ ” if he “plead['s] facts which establish that he cannot prevail on his... claim.” Weisbuch v. Cnty. of Los Angeles, 119 F.3d 778, 783 n. 1 (9th Cir.1997) (quoting Warzon v. Drew, 60 F.3d 1234, 1239 (7th Cir.1995)).
For purposes of motions to dismiss, as with virtually all motions touching upon substantive legal matters, the general rule “is that the MDL transferee court is generally bound by the same substantive legal standards, if not always the same interpretation of them, as would have applied in the transferor court.” In re Korean Air Lines Co., Ltd., 642 F.3d 685, 699 (9th Cir.2011).
B. Leave to Amend
Under Rule 15(a) of the Federal Rules of Civil Procedure, leave to amend “shall be freely granted when justice so requires,” bearing in mind “the underlying purpose of Rule 15 to facilitate decision on the merits, rather than on the pleadings or technicalities.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir.2000) (en banc) (ellipses omitted). Generally, leave to amend shall be denied only if allowing amendment would unduly prejudice the opposing party, cause undue delay, or be futile, or if the moving party has acted in bad faith. Leadsinger, Inc. v. BMC Music Publ’g, 512 F.3d 522, 532 (9th Cir.2008).
III. DISCUSSION
A. Standing
Before addressing any of the specific claims at issue, the Court turns first to the three arguments that the Non-Anthem Defendants have raised regarding standing. First, “not one of the 98 named plaintiffs in the CAC alleges that he or she was insured by or had any connection with... Blue Cross and Blue Shield of Arizona, Inc., BlueCross BlueShield of Tennessee, Inc., and Highmark West Virginia, Inc.” Non-Anthem Mot. at 2 (emphasis added). Thus, the Non-Anthem Defendants request that these three Non-Anthem Defendants be dismissed from this action in its entirety.
Second, the consolidated amended complaint fails “to allege any facts regarding ten Non-Anthem Defendants with respect to” the selected claims at issue in the instant motions to dismiss. Non-Anthem Mot. at 1 (emphasis removed). Accordingly, the Non-Anthem Defendants request that the selected “claims...be dismissed as to those ten Non-Anthem Defendants.” Non-Anthem Reply at 3.
Third, the consolidated amended complaint fails to allege any specific facts as to Plaintiffs’ Indiana negligence, Kentucky Consumer Protection Act, New Jersey breach of contract, New York unjust enrichment, New York General Business Law § 349, and California Unfair Competition Law claims against 16 of the 17 Non-Anthem Defendants. Specifically, the consolidated amended complaint identifies a New .Jersey Plaintiff — Elizabeth Ames— who was enrolled in a plan managed by Non-Anthem Defendant Horizon Blue Cross Blue Shield of New Jersey. See CAC ¶ 146; Non-Anthem Mot. at 3. Plaintiffs have thus properly asserted a New Jersey breach of contract claim against Horizon Blue Cross Blue Shield of New Jersey, but have not alleged any specific facts as to the remaining 16 Non-Anthem Defendants. The Non-Anthem Defendants therefore request dismissal of those Non-Anthem Defendants who have not had any specific facts alleged against them as to Plaintiffs’ Indiana negligence, Kentucky Consumer Protection Act, New Jersey breach of contract, New York unjust enrichment, New York General Business Law § 349, and California Unfair Competition Law claims.
All three of these arguments implicate the same thorny legal question: when, in the context of a nationwide consumer class action, should a federal court address issues of standing? Indeed, “[a]lthough standing is a ‘threshold issue’ usually considered at the outset of the case,” two U.S. Supreme Court decisions — Amchem Products, Inc. v. Windsor, 521 U.S. 591, 117 S.Ct. 2231, 138 L.Ed.2d 689 (1997), and Ortiz v. Fibreboard Corp., 527 U.S. 815, 119 S.Ct. 2295, 144 L.Ed.2d 715 (1999)— “make clear that there are situations in which a court may defer that issue to later in the case.” In re Target Corp. Data Sec. Breach Litig., 66 F.Supp.3d 1154, 1160 (D.Minn.2014). As the In re Target court summarized, both Amchem and Ortiz involved “global settlements of [consumer] class actions” where the district court “was simultaneously presented with class certification issues and Article III issues.” Id. at 1159-60. In both Amchem and Ortiz, the U.S. Supreme Court determined that the district court could defer standing questions until after class certification. In the instant case, Plaintiffs request that the Court adopt the same approach.
Neither Amchem nor Windsor, however, created a blanket exception for standing in the consumer class action context. Rather, the U.S. Supreme Court “in both cases stated that class certification questions could be addressed first [because] they were ‘logically antecedent’ to the standing questions.” In re Carrier IQ, Inc., 78 F.Supp.3d 1051, 1071 (N.D.Cal.2015) (quoting Ortiz, 527 U.S. at 831, 119 S.Ct. 2295; Amchem, 521 U.S. at 612, 117 S.Ct. 2231). The scope and applicability of this “logically antecedent” exception has, in the aftermath of Amchem and Windsor, confounded both courts and commentators alike. See, e.g., In re Target, 66 F.Supp.3d at 1160 (“Although some courts [have] interpreted [Amchem and Windsor] to require deferral of the Article III standing determination until after class certification, [others courts have] found more persuasive the decisions that interpreted the Supreme Court precedent to allow consideration of the named plaintiffs Article III standing at an earlier stage, thus requiring a named plaintiff to establish standing for each claim set forth in a class action when the issue is presented prior to class certification.”) (internal quotation marks omitted); Linda S. Mullenix, Standing and Other Dispositive Motions After Amchem and Ortiz : The Problem of “Logically Antecedent” Inquiries, 2004 Mich. St. L. Rev. 703. Even district courts within the Northern District of California have split ways on when (and how) Amchem and Ortiz should apply in the consumer class action context. See generally In re Carrier IQ, 78 F.Supp.3d at 1068-75 (reviewing cases that have considered standing before and after class certification).
On this particular question, the Court finds instructive the reasoning in In re Carrier IQ. In In re Carrier IQ, the district court undertook a comprehensive analysis of U.S. Supreme Court and Ninth Circuit precedent, decisions from various federal district courts, and pertinent legal scholarship. See id. After surveying these sources in detail, the In re Carrier IQ court concluded “that it ha[d] the discretion to defer questions of standing until after class certification” — which it could decide to exercise on a case by case (or even an issue by issue) basis. Id. at 1074. In exercising this discretion, the In re Carrier IQ court noted that a district court might consider factors such as the cost and burden of discovery, “the breadth of the proposed class and the number of state law claims asserted on behalf of the class,” and whether a named plaintiffs “claim is typical of those individuals whose claims arise under the laws of.. .other states.” Id. at 1072-75. Following In re Carrier IQ, the Court finds that it has discretion to decide in the instant action when to consider issues of standing, and shall exercise this discretion as follows.
1. All Claims as to Three Non-Anthem Defendants
As to Blue Cross and Blue Shield of Arizona, Inc., BlueCross BlueShield of Tennessee, Inc., and Highmark West Virginia, Inc., “not one of the 98 named plaintiffs in the CAC alleges that he or she was insured by or had any connection with” these entities. Non-Anthem Mot. at 2. The Non-Anthem Defendants request that these three entities be dismissed from this action in its entirety. The Court finds the Non-Anthem Defendants’ contentions well taken, for the reasons stated below.
First, each of the factors described in In re Carrier IQ weigh in favor of the Court addressing standing questions at the outset of this litigation, rather than deferring such questions until class certification. As to the cost and burden of discovery, for instance, the Court observes that the parties must litigate the selected claims “through two motions to dismiss, through class certification], [and] through summary judgment.” ECF No. 359 at 60. The parties expect discovery to be expensive and time-consuming. As this action moves forward, Plaintiffs may not be able to find a single class member who can assert any claim with specific factual allegations against Blue Cross and Blue Shield of Arizona, Inc., BlueCross BlueShield of Tennessee, Inc., and Highmark West Virginia, Inc. Under such circumstances, it would make little sense to require these three Non-Anthem Defendants to be subject to extensive discovery and motions practice.
In addition, there are nearly 80 million potential class members, with each class member asserting a variety of state and federal law claims. Deferring questions of standing until class certification would only make the Court’s class certification decision all the more unwieldy, and would not be in the interest of promoting efficient litigation. See In re Carrier IQ, 78 F.Supp.3d at 1074-75 (“Moreover, given the breadth of the proposed class and the number of state law claims asserted on behalf of the class, there is a meaningful risk that the requirements of class certification under Rule 23 may not be met or, if they are, subclasses may have to be created which would engender delay.”).
Furthermore, as the parties acknowledge, there are subtle but significant differences in the various state and federal law claims at issue. Plaintiffs might, for instance, be able to move forward with a breach of contract claim under California law but not a breach of contract claim under the law of a different state. Under such circumstances, grouping all Non-Anthem Defendants together — particularly those who have had no specific factual allegations asserted against them — makes little sense. See id. at 1072 (holding that deferring issues of standing until after class certification may be appropriate where a claim brought by an individual with standing “is typical of those individuals whose claims arise under the laws of the other states.”).
In addition to the specific In re IQ Carrier factors discussed above, Plaintiffs acknowledge that “named Plaintiffs from a particular state do not bring their individual state law claims against Non-Anthem Defendants with whom they did not have a relationship.” Non-Anthem Opp’n at 5; see also Armstrong v. Davis, 275 F.3d 849, 860 (9th Cir.2001), recognized as abrogated on other grounds by Nordstrom v. Ryan, 762 F.3d 903, 911 (9th Cir.2014) (“In order to assert claims on behalf of a class, a named plaintiff must have personally sustained or be in immediate danger of sustaining some direct injury as a result of the challenged statute or official conduct.”). Thus, under Plaintiffs’ own theory of the case, there is little reason to keep certain Non-Anthem Defendants in this action when no specific factual allegations have been asserted against them with respect to any of the claims in the consolidated amended complaint.
As a final point, in this particular instance, ease law appears to tilt in the Non-Anthem Defendants’ favor. In In re Carrier IQ, for instance, the district court addressed standing prior to class certification and “require[d] the [plaintiffs to present a named class member who possesses individual standing to assert each state law’s claims against Defendants.” 78 F.Supp.3d at 1074. As in the instant case, the In re Carrier IQ court cited both “the expense and burden of nationwide discovery” and “the breadth of the proposed class” in reaching this determination. Id. Likewise, in Pardini v. Unilever United States, Inc., 961 F.Supp.2d 1048, 1061 (N.D.Cal.2013), the district court observed that “there is only one named plaintiff and she has not alleged that she purchased [defendant’s product] outside of California.” Thus, “[pjlaintiff does not have standing to assert a claim under the consumer protection laws of the other states named in the Complaint.” Id.; accord Harris v. CVS Pharmacy, Inc., 2015 WL 4694047, *4 (C.D.Cal. Aug. 6, 2015) (finding that, “[a]s the party advocating for the application of Rhode Island law, [p]laintiff must make at least [a] prima facie showing that the RIDTPA applies to him such that he would have standing to bring that claim.”).
Plaintiffs’ attempt to distinguish this line of cases by relying on In re Target is unavailing. Although the In re Target court did defer issues of standing until after class certification, the district court reasoned that, “[a]s Target undoubtedly knows, there are consumers in Delaware, Maine, Rhode Island, Wyoming, and the District of Columbia whose personal financial information was stolen in the 2013 breach.” 66 F.Supp.3d at 1160. Accordingly, even though no named plaintiffs hailed from these specific jurisdictions at the time Target filed its motion to dismiss, residents from these jurisdictions were almost certainly affected by the data breach and could almost certainly be identified at some later point in the litigation.
This same principle does not apply with equal force in the instant case. Here, unlike in In re Target, Plaintiffs do not bring their claims against a single nationwide entity. Instead, Plaintiffs have brought suit against Anthem, 28 Anthem affiliates, and 17 Non-Anthem Defendants. The Non-Anthem Defendants do not dispute that the Anthem data breach affected upwards of 80 million individuals, and that these individuals have standing to bring their claims against at least some Defendants. The Non-Anthem Defendants, however, contest whether three specific Non-Anthem Defendants should remain in this action when not a single named Plaintiff has been able to assert any specific factual allegations against these three Non-Anthem Defendants. Unless and until Plaintiffs demonstrate otherwise, the Court finds that there is little use in keeping these three Non-Anthem Defendants in this action.
Accordingly, the Court DISMISSES Blue Cross and Blue Shield of Arizona, Inc., BlueCross BlueShield of Tennessee, Inc., and Highmark West Virginia, Inc. from this action in its entirety. Plaintiffs, however, shall have leave to amend. It is possible that Plaintiffs may be able to assert specific factual allegations against the three Non-Anthem Defendants listed above by, for instance, adding a new named Plaintiff. See Lopez, 203 F.3d at 1127 (holding that “a district court should grant leave to amend.. .unless it determines that the pleading could not possibly be cured by the allegation of other facts.”). The Court therefore GRANTS with leave to amend the Non-Anthem Defendants’ motion to dismiss Blue Cross and Blue' Shield of Arizona, Inc., BlueCross BlueSh-ield of Tennessee, Inc., and Highmark West Virginia, Inc. from this action in its entirety.
2. All Selected Claims as to Ten Non-Anthem Defendants
For substantially the same reasons, the Court also GRANTS with leave to amend the Non-Anthem Defendants’ motion to dismiss the ten selected claims at issue in the instant motion to dismiss against Blue Cross and Blue Shield of Alabama; Blue Cross and Blue Shield of Arizona, Inc.; CareFirst of Maryland, Inc.; Blue Cross and Blue Shield of Michigan; Blue Cross and Blue Shield of North Carolina, Inc.; Highmark Health Services; Highmark West Virginia, Inc.; BlueCross BlueShield of Tennessee, Inc.; Blue Cross and Blue Shield of Vermont; and Blue Cross and Blue Shield of Illinois.
As noted above, the consolidated amended complaint fails to allege any specific facts regarding these ten Non-Anthem Defendants with respect to the selected claims at issue in the instant motions to dismiss. Non-Anthem Mot. at 1. Requiring these particular Non-Anthem Defendants to undergo extensive discovery and motions practice in this action is both costly and unnecessary. Moreover, dismissing these ten Non-Anthem Defendants from the ten selected claims at issue does not altogether absolve these Defendants from liability. By requiring the parties to focus on a set of selected claims, the Court sought to narrow the issues presented in order to move forward with this MDL in a timely and cost-effective manner. The Court’s decision to adopt such a streamlined approach, however, does not result in dismissal of the many remaining, non-selected claims against these ten Non-Anthem Defendants asserted in the consolidated amended complaint'.
3. Selected Claims as to Most Non-Anthem Defendants
Finally, the Non-Anthem Defendants request that the Court dismiss Plaintiffs’ Indiana negligence, Kentucky Consumer Protection Act, New Jersey breach of contract, California Unfair Competition Law (“UCL”), New York unjust enrichment, and New York General Business Law (“GBL”) § 349 claims against all Non-Anthem Defendants about whom the consolidated amended complaint makes no factual allegations.
As an initial matter, this argument is moot with respect to Plaintiffs’ Indiana negligence and Kentucky Consumer Protection Act claims. As discussed in greater detail below, Plaintiffs can not maintain these claims as a matter of law. These claims will therefore be dismissed with prejudice.
That leaves the Court with the following four claims: New Jersey breach of contract, California Unfair Competition Law (“UCL”), New York unjust enrichment, and New York General Business Law (“GBL”) § 349. Although the Non-Anthem Defendants acknowledge that Plaintiffs have properly brought these claims against at least one Anthem or Non-Anthem Defendant, the Non-Anthem Defendants contend that there is little point in keeping all Non-Anthem Defendants in this litigation with respect to these particular claims. The Court agrees.
Consistent with its reasoning throughout this section, the Court finds that it would be improvident to require all 17 non-Anthem Blue Cross Blue Shield Defendants to answer for a claim when Plaintiffs assert factual allegations against only a handful of these 17 Defendants. The breadth and complexity of this action make streamlining this litigation all the more important. Thus, the Court GRANTS the Non-Anthem Defendants’ motion to dismiss Plaintiffs’ Indiana negligence, Kentucky Consumer Protection Act, New Jersey breach of contract, California Unfair Competition Law (“UCL”), New York unjust enrichment, and New York General Business Law (“GBL”) § 349 claims against all Non-Anthem Defendants about whom the consolidated amended complaint makes no factual allegations. As above, Plaintiffs shall have leave to amend.
B. Indiana Negligence (against Anthem and Non-Anthem Defendants)
“The elements of a negligence claim under Indiana law are: (1) a duty owed to plaintiff by defendant, (2) breach of duty by allowing conduct to fall below the applicable standard of care, and (3) a compensable injury proximately caused by defendant’s breach of duty.” Pisciotta v. Old Nat’l Bancorp, 499 F.3d 629, 635 (7th Cir.2007) (internal quotation marks omitted). Here, Plaintiffs allege that the Anthem and Non-Anthem Defendants “violated the duty of care owed Indiana Plaintiffs and Class Members by collecting and storing their [PII] without adequate data security.” Anthem Opp’n at 3.
Defendants contend that Plaintiffs’ negligence claim fails for three reasons. First, Defendants assert “that Indiana law does not allow a cause of action in tort against a database owner for failing to protect adequately personal information.” Anthem Mot. at 2. Second, Defendants argue that the economic loss doctrine bars recovery for Defendants’ alleged negligence. Id. at 3. Third, Defendants contend that the allegations in the consolidated amended complaint fail to establish proximate causation. Non-Anthem Mot. at 8.
As to whether Indiana law provides Plaintiffs a private cause of action, the parties acknowledge that no Indiana court has yet ruled on this question. The Court therefore looks to the law of the Seventh Circuit, of which Indiana is a part. On this point, the Court finds instructive the Seventh Circuit’s decision in Pisciotta v. Old National Bancorp. In Pisciotta, Old National Bancorp (“ONB”) maintained a website containing the personal information of potential customers. In 2005, ONB learned that its website had been hacked, and ONB subsequently informed affected potential customers of this breach. Upon receiving this information, Luciano Pisciotta (“Pisciotta”) and Daniel Mills (“Mills”) proceeded to file a putative class action complaint against ONB. As in the instant case, the Pisciotta complaint asserted a negligence claim under Indiana law. The District Court for the Southern District of Indiana determined that Pisciotta and Mills could not bring such a claim as a matter of law, and granted ONB’s motion for judgment on the pleadings. 499 F.3d at 632-33 (reciting procedural history). The Seventh Circuit upheld the district court’s decision on appeal.
In reaching this conclusion, the Seventh Circuit first observed that “Neither the parties’ efforts nor our own have identified any Indiana precedent addressing” whether “Indiana would consider that the harm caused by identity information exposure, coupled with the attendant costs to guard against identity theft, constitutes an existing compensable injury and consequent damages required to state a claim for negligence.” Id. at 635. Accordingly, “[without state authority to guide us, ‘[w]hen given a choice between an interpretation of [state] law which reasonably restricts liability, and one which greatly expands liability, we should” — as a general matter — “choose the narrower and more reasonable path (at least until the [state] Supreme Court tells us differently).’ ” Id. at 635-36 (quoting Todd v. Societe Bic, S.A., 21 F.3d 1402, 1412 (7th Cir.1994) (en banc)) (alterations in original).
With this general canon of interpretation in mind, the Seventh Circuit further observed that “the Indiana authority most closely addressed to the issue” — a series of statutes enacted by the Indiana legislature in 2006 — weighed against finding that Pis-ciotta and Mills could assert a private right of action against ONB. Id. at 636-37. The statutory provisions “applicable to private entities storing personal information require only that a database owner disclose a security breach to potentially affected consumers; they do not require the database owner to take any other affirmative act in the wake of a breach.” Id. at 637. Moreover, “[i]f the database owner fails to comply with the only affirmative duty imposed by the statute — the duty to disclose — the statute provides for enforcement only by the Attorney General of Indiana. It creates no private right of action against the database owner.” Id. Thus, disclosure to those affected is the only duty imposed upon the database owners by Indiana’s data breach statutes, and these statutes only allow for enforcement by the Indiana Attorney General.
The Seventh Circuit went on to reject the view “that the statute is evidence that the Indiana legislature believes that an individual has suffered a compensable injury at the moment his personal information is exposed because of a security breach.” Id. Indeed, “given the novelty of the legal questions posed by information exposure and theft, it is unlikely that the legislature intended to sanction the development of common law tort remedies that would apply to the same factual circumstances addressed by the statute.” Id.
The Court finds Pisciotta persuasive for the following reasons. First, this Court, as an MDL court, “must apply the law of the transferor forum, that is, the law of the state in which the action was filed.” In re Vioxx Prods. Liab. Litig., 478 F.Supp.2d 897, 903 (E.D.La.2007); see also In re Korean Air, 642 F.3d at 699 (“[T]he MDL transferee court is generally bound by the same substantive legal standards ... as would have applied in the transferor court.”). This legal principle means that, for á negligence claim brought under the laws of Indiana, the MDL court should — as a general matter — follow the lead of the Seventh Circuit.
Second, although Pisciotta was decided in 2007, the parties have identified no subsequent cases — state or federal — that have discussed Indiana’s data breach statutes. The Court has found none in its own research. Thus, Pisciotta continues to serve as the final word on how courts should interpret Indiana’s data breach statutes and, critically, whether individuals may maintain a private cause of action for negligence. 499 F.3d at 637 (“Had the Indiana legislature intended that a cause of action should be available against a database owner for failing to protect adequately personal information, we believe that it would have made some more definite statement of that intent.”).
Third, the Pisciotta decision is consistent with the negligence law of other jurisdictions. In Amburgy v. Express Scripts, Inc., 671 F.Supp.2d 1046, 1054 (E.D.Mo. 2009), for instance, plaintiff alleged “that defendant was negligent in its failure to properly secure its computerized database system[,] thereby rendering the system vulnerable to a security breach and, further, was negligent in its failure to timely disclose the alleged breach.” In rejecting plaintiffs claim, the Amburgy court “note[d] that the Missouri legislature [had] recently enacted a data breach notification law.” Id. at 1055. That law, like Indiana’s statutes, holds that the state “Attorney General [is] to have exclusive authority in bringing claims against data handlers for a violation of the notice requirements.” Id. The Missouri statute did not provide a private cause of action, and the Amburgy court declined to create a cause of action “wheie one does not exist.” Id.
Similarly, in Willingham v. Global Payments, Inc., 2013 WL 440702, *17 n. 19 (N.D.Ga. Feb. 5, 2013), plaintiffs sought to assert a common law negligence claim against defendant. In arguing that defendant owed plaintiffs such a duty, plaintiffs cited data breach statutes from Kansas and California. Id. After carefully reviewing these statutes, - the Willingham court concluded that the statutes “do not give [pjlaintiffs a [private] cause of action for negligence.” Id. As the district court explained, these statutes contain a notice provision which requires companies to provide notice to affected customers of a data breach. Like the statutes at issue in Pisci-otta and Amburgy, however, these statutes do not contain a private enforcement mechanism.
Third, and finally, Plaintiffs’ attempts to distinguish Pisciotta are unavailing. Plaintiffs, for instance, point to the fact that the Indiana legislature amended Indiana’s data breach statutes in 2009. The statutes now require database owners to “maintain reasonable procedures.. .to protect and safeguard from unlawful use or disclosure any personal information,” a provision that did not exist at the time Pisciotta was decided. Anthem Opp’n at 4. The amendments also exempt some “database owners with security policies under HIPAA from some... [statutory] requirements.” Anthem Mot. at 2 n.3. None of these amendments, however, address whether individual plaintiffs may maintain a private cause of action in negligence. Indiana’s data breach statutes continue to provide a single,enforcement mechanism: an action brought by the state Attorney General. Ind. Code. Ann. § 24-4.9-4-2. The Court thus fails to see how the 2009 amendments give support to Plaintiffs’ attempts to maintain a private cause of action. Pisciotta was decided in 2007. The Indiana legislature, presumably aware of the Pisciotta decision, declined to provide plaintiffs a private cause of action when given the opportunity to amend the state’s data breach statutes in 2009.
Plaintiffs also contend that Indiana courts “frequently borrow from statutes that do not contain a private right of action to impose common law duties.” Anthem Opp’n at 4. Plaintiffs cite Kho v. Pennington, 875 N.E.2d 208, 212 (Ind.2007), where the Indiana Supreme Court recognized a private right of action for statutory negligence “arising from the violation of the identity confidentiality provision in Indiana Code § 34-18-8-7(a)(l).”
There are two key flaws with Plaintiffs’ reliance on Kho. First, the fact that Indiana courts have recognized claims for statutory negligence in some cases does not suggest that this Court should recognize a private cause of action in the instant case. This point is all the more pronounced where, as here, the District Court for the Southern District of Indiana and the Seventh Circuit — two federal courts that are significantly more familiar with Indiana law than this Court — declined to recognize a private cause of action under nearly identical circumstances in Pisciotta. Cf. Butner v. United States, 440 U.S. 48, 58, 99 S.Ct. 914, 59 L.Ed.2d 136 (1979) (“The federal judges who deal regularly with questions of state law in their respective districts and circuits are in a better position than we to determine how local courts would dispose of comparable issues.”).
Second — and relatedly — all of the decisions cited in Kho are Indiana Supreme Court or Indiana Court of Appeals decisions. None are federal court decisions, much less decisions by a federal court sitting in a different state. This result is, in the Court’s view, consistent with the view of the Seventh Circuit, that “[w]hen [a federal court is] given a choice between an interpretation of [state] law which reasonably' restricts liability, and one which greatly expands liability, [the federal court] should choose the narrower and more reasonable path.” Todd, 21 F.3d at 1412. In light of these circumstances, Plaintiffs can not pursue their Indiana negligence claim against Defendants.
Because Plaintiffs can not pursue such a claim as a matter of law, the Court need not address Defendants’ arguments concerning the economic loss doctrine and proximate causation. Accordingly, Defendants’ motions to dismiss Plaintiffs’ Indiana negligence claim is GRANTED.
Moreover, the Court finds that amendment would be futile. Case law and statutory authority indicates that, in Indiana, data breach actions must be brought by the Indiana Attorney General. Plaintiffs have identified no relevant authority that would allow private individuals to bring an Indiana data breach action under a common law negligence theory. In the absence of supporting authority for Plaintiffs’ position, the Court finds that leave to amend would be futile, and therefore denies leave to amend. See Bonin v. Calderon, 59 F.3d 815, 845 (9th Cir.1995) (“Futility of amendment can, by itself, justify the denial of a motion for leave to amend.”). Therefore, Plaintiffs’ Indiana negligence claim is DISMISSED with prejudice.
C. California Breach of Contract (against Anthem Defendants)
The consolidated amended complaint asserts against the Anthem Defendants a breach of contract claim under California law. Specifically, Plaintiffs allege that “Anthem and Anthem Affiliates did not satisfy their promises and obligations to Plaintiffs and Statewide Class Members under the contracts in that they did not take reasonable measures to keep Plaintiffs’ and Statewide Class Members’ [PII] secure and confidential and did not comply with the applicable laws, regulations, and industry standards.” CAC ¶ 305. In moving to dismiss Plaintiffs’ claim, the Anthem Defendants contend that “(a) the CAC fails to identify the contractual provisions that allegedly were breached, (b) the CAC fails to allege facts showing any breach caused Plaintiffs to suffer damages that are cognizable under California law, and (c) certain Plaintiffs’ claims are preempted by ERISA.” Anthem Mot. at 4.
As to whether the consolidated amended complaint identifies the contractual provisions that were breached, the Court observes that, “[u]nder California law, to state a claim for breach of contract a plaintiff must plead the contract, plaintiffs’ performance (or excuse for nonperformance), defendant’s breach, and damage to plaintiff therefrom.” Low v. LinkedIn Corp., 900 F.Supp.2d 1010, 1028 (N.D.Cal.2012) (internal quotation marks omitted). With respect to this first requirement — the need to plead the contract — a plaintiff must, in actions involving breach of a written contract, “allege the specific provisions in the contract creating the obligation the defendant is said to have breached.” Young v. Facebook, Inc., 790 F.Supp.2d 1110, 1117 (N.D.Cal. 2011); see also Frances T. v. Vill. Green Owners Ass’n, 42 Cal.3d 490, 229 Cal.Rptr. 456, 723 P.2d 573, 586 (1986) (“Plaintiffs allegation that defendants breached that contract.. .must fail because she does not allege that any provision in any of the writings imposed such an obligation on defendant.”); Murphy v. Hartford Accident & Indent. Co., 177 Cal.App.2d 539, 2 Cal.Rptr. 325, 328 (Ct.App. 1960) (“In order for an action to be based upon an instrument in writing, the writing must express the obligation sued upon.”).
The Court finds that the consolidated amended complaint fails to satisfy this requirement, based on a review of (1) the language in the consolidated amended complaint, (2) the language on Anthem’s public websites and in various privacy notices, (3) the exhibits submitted in connection with the consolidated amended complaint, and (4) relevant state and federal law. The Court addresses these four areas in detail below.
1. Language in Consolidated Amended Complaint
First, with respect to the language in the consolidated amended complaint, Plaintiffs allege that class members “who purchased individual insurance plans from Anthem Affiliates or who received health insurance... under a contract between an employer... and Anthem or Anthem Affiliates had valid, binding, and enforceable express, third party beneficiary, or implied contracts with Anthem and Anthem Affiliates.” CAC ¶ 303.
However, under the section of the consolidated amended complaint titled “Breach of Contract,” id. ¶¶ 302-311, Plaintiffs do not refer to any contractual language or any contractual provisions that the Anthem Defendants allegedly breached. Instead, Plaintiffs state — without reference to an underlying contract or other documents — that class members provided “Anthem and/or Anthem Affiliates with their [PII].” Id. ¶ 303(a). In exchange, the Anthem Defendants promised “to protect [class members’ PII] in compliance with federal and state laws and regulations, including HIPAA, and industry standards.” Id. In the very next paragraph, Plaintiffs state that “[t]he terms of Plaintiffs’ and Statewide Class Members’ contracts with Anthem and Anthem Affiliates that concern the protection of Plaintiffs’ [PII] [are] set forth above.” Id. ¶304. However, this paragraph does not refer specifically to any other part of the consolidated amended complaint. The remaining paragraphs in this section do no better. One paragraph addresses Plaintiffs’ implied contract theory, id. ¶ 303(c), another paragraph alleges that Plaintiffs “fully performed their obligations under their contracts,” id. ¶ 307, and several paragraphs address the damages that Plaintiffs seek, id. ¶¶ 308-310. Considered together, none of these paragraphs identify a specific contractual provision that the Anthem Defendants breached.
These stray allegations mirror the facts in Young v. Facebook, where plaintiff stated in the complaint that “Facebook did not perform in accordance with the terms of [the] agreement in their Statement of Rights and Responsibilities contract by arbitrarily and impulsively handling [plaintiffs] member account.” Young, 790 F.Supp.2d at 1117 (internal quotation marks omitted). However, as the district court pointed out, plaintiffs “complaint [did] not allege any provision of the contract prohibiting Facebook from terminating an account in the manner alleged.” Id. Because plaintiff had failed to identify a relevant contractual provision that was breached, the Young court granted Face-book’s motion to dismiss plaintiffs California breach of contract claim. Id. (finding that plaintiff had failed to “allege the specific provisions in the contract creating the obligation the defendant is said to have breached.”). As in Young, Plaintiffs’ eon-clusory statements in the “Breach of Contract” section of the consolidated amended complaint are insufficient to survive a motion to dismiss.
2. Language on Public Websites and in Privacy Notices
Plaintiffs, however, contend that the paragraphs discussed above constitute “only.. .the summary language [of Plaintiffs’] breach of contract count.” Anthem Opp’n at 5. Instead, Plaintiffs note, “specific promises.. .regarding data security” are located in paragraphs 161 through 170. Id. at 5-6. These paragraphs include language from the public websites of the Anthem Defendants and from statements made by the Anthem Defendants in various privacy notices. The website for every Anthem BCBS affiliate, for instance, states:
[PII] (including Social Security Number) Privacy Protection Policy [Name of Anthem BCBS Affiliate] maintains policies that protect the confidentiality of [PII], including Social Security numbers, obtained from its members and associates in the course of its regular business functions. [Name of Anthem BCBS Affiliate] is committed to protecting information about its customers and associates, especially the confidential nature of their [PII].
CAC ¶ 166 (second and fourth alterations in original). Likewise, Blue Cross of California mailed the following privacy notice to customers:
We keep your oral, written and electronic [PII] safe using physical, electronic, and procedural means. These safeguards follow federal and state laws. Some of the ways we keep your [PII] safe include securing offices that hold [PII], password-protecting computers, and locking storage areas and filing cabinets. We require our employees to protect [PII] through written policies and procedures. These policies limit access to [PII] to only those employees who need the data to do their job. Employees are also required to wear ID badges to help keep people who do not belong out of areas where sensitive data is kept. Also, where required by law, our affiliates and nonaffiliates must protect the privacy of data we share in the normal course of business. They are not allowed to give [PII] to others without your written OK, except as allowed by law and outlined in this notice.
Id. ¶ 163. Although this language is more specific than the conclusory paragraphs discussed above, this language still does not give rise to a viable California breach of contract claim.
First, the consolidated amended complaint provides no information on when the language at issue was posted onto the Anthem Defendants’ websites and when the various privacy notices were sent to class members. Clearly, such notices would be of little assistance to Plaintiffs’ claim if Plaintiffs received these notices after the data breach at issue.
More importantly, the consolidated amended complaint makes no attempt to connect the language in paragraphs 161 through 170 with the terms of Plaintiffs’ alleged contracts. At no point in paragraphs 161 through 170 do Plaintiffs allege that the privacy notices or public website statements were part of or were incorporated by reference into Plaintiffs’ contracts with the Anthem Defendants. In fact, the word “contract” does not appear at all in paragraphs 161 through 170. By this same token, under the section of the consolidated amended complaint titled “Breach of Contract,” id. ¶¶ 302-311, Plaintiffs do not at any point refer to the privacy notices or public websites discussed in paragraphs 161 through 170.
Plaintiffs can not bring a breach of contract claim based on language from documents that might have been issued after the alleged breach and based on language from documents that might not even have been part of the alleged contract. In reaching this conclusion, the Court returns to the legal principle discussed above: that, “[i]n an action for breach of a written contract, a plaintiff must allege the specific provisions in the contract creating the obligation the defendant is said to have breached.” Young, 790 F.Supp.2d at 1117; see also Miron v. Herbalife Int'l Inc., 11 Fed.Appx. 927, 929 (9th Cir.2001) (“The district court’s dismissal of the Mirons’ breach of contract claims was proper because the Mirons failed to allege any provision of the contract which supports their claim.”). Plaintiffs have failed to identify any such contractual provision because Plaintiffs have made no effort to connect the language in paragraphs 161 through 170 with the terms in Plaintiffs’ contracts with the Anthem Defendants. On this basis alone, the Court finds that dismissal of Plaintiffs’ California breach of contract claim is warranted. Below, the Court addresses additional bases upon which Plaintiffs’ California breach of contract claim is unavailing.
3. Exhibits Submitted in Connection With Consolidated Amended Complaint
Plaintiffs have failed to submit any relevant exhibits, such as a copy of the contract between an Anthem Defendant and a California Plaintiff, which might counsel against dismissal. Although Plaintiffs are not required to submit such exhibits, these exhibits would certainly provide clarity on the scope and nature of the Anthem Defendants’ obligations. Thus, in Young, plaintiff included a copy of Facebook’s Statement of Rights and Responsibility with the complaint. 790 F.Supp.2d at 1118. Likewise, in Zepeda v. PayPal, Inc., 777 F.Supp.2d 1215, 1220 (N.D.Cal.2011), plaintiff included Paypal’s user agreement as an exhibit to accompany the complaint. In Woods v. Google Inc., 2011 WL 3501403, *3-4 (N.D.Cal. Aug. 10, 2011), plaintiff also filed a copy of Google’s advertising contract with the complaint. In all of these cases — Young, Zepeda, and Woods— the district court, after reviewing the allegations made in the complaint and the terms of the pertinent agreement, determined that the plaintiff could not maintain a cause of action for breach of contract under California law. Here, on the other hand, there is nothing for the Court to review as Plaintiffs have submitted no contracts or other materials for the Court to examine.
In fact, the only possibly relevant exhibits filed were submitted by the Anthem Defendants, not Plaintiffs. The Anthem Defendants, for instance, filed a copy of the Summary Plan Description under which Plaintiffs Daniel and Kelly Tharp allegedly received coverage. See ECF No. 411 at 1-2. This Plan Description includes a five page “Privacy Notice.” See ECF No. 411-4 at 58-62. This Privacy Notice provides a list of specific circumstances where Anthem or an Anthem affiliate might disclose a member’s personal health information. Id. The Notice further provides that “[o]ther than as stated above, the Health Plan will not disclose your health information other than with your written authorization.” Id. at 61. Moreover, “[t]he Health Plan is required by law to maintain the privacy of your health information and to provide you with this Notice of the Plan’s legal duties and privacy practices with respect to your health information. If you participate in an insured plan option, you will receive a notice directly from the Insurer.” Id. at 62. This final statement in the Summary Plan Description could plausibly be taken to incorporate by reference future privacy notices sent to class members.
However, the problem with relying on this Summary Plan Description is that Plaintiffs have, in the consolidated amended complaint, stated that such documents do not represent the contract between class members and the Anthem Defendants. See CAC ¶ 303(b) (“With respect to contracts between employers and Anthem and/or Anthem Affiliates, the applicable contract is the services agreement between the employer and Anthem and/or Anthem Affiliates, not the employer benefits plan document.”). Plaintiffs repeat this assertion in opposing the Anthem Defendants’ motion to dismiss. See Anthem Opp’n at 25 (describing Summary Plan Description documents as “non-enforceable”). Given Plaintiffs’ position, the Court can not rely upon the Summary Plan Description to save Plaintiffs’ breach of contract of claim from dismissal.
4. Incorporation of Applicable State and Federal Law
As a final point, Plaintiffs state that, “[u]nder California law, Defendants’ contracts necessarily incorporate applicable laws even absent specific promises.” Anthem Opp’n at 7 (citing Edwards v. Arthur Andersen LLP, 44 Cal.4th 937, 81 Cal.Rptr.3d 282,189 P.3d 285, 297 (2008)). This contention alone, however, does not save Plaintiffs’ breach of contract claim.
First, the consolidated amended complaint provides little guidance as to which “applicable laws” were incorporated into the contract. Instead, the consolidated amended complaint merely alleges that the Anthem Defendants were required to comply with “federal and state laws and regulations, including HIPAA, and industry standards.” CAC ¶ 303(a). In other words, outside of a single passing reference to HIPAA, Plaintiffs have provided little detail on what other laws, regulations, or standards the Anthem Defendants might have violated. As other district courts have noted, “plaintiffs must...do something more to allege a breach of contract claim than merely point to allegations of a statutory violation.” Wiebe v. NDEX West, LLC, 2010 WL 2035992, *3 (C.D.Cal. May 17, 2010) (quoting Berger v. Home Depot U.S.A, Inc., 476 F.Supp.2d 1174, 1177 (C.D.Cal.2007)). The consolidated amended complaint fails to meet this requirement.
Second, Plaintiffs’ breach of contract claim reaches beyond mere violation of “applicable laws.” Plaintiffs, for instance, also allege that the Anthem Defendants’ actions ran afoul of certain “industry standards.” CAC ¶ 303(a). Thus, simply stating that Defendants’ contracts incorporate applicable laws does not accurately reflect the nature of Plaintiffs’ breach of contract claim.
In sum, after examining the consolidated amended complaint, the exhibits (or lack thereof) filed in connection with the consolidated amended complaint, and relevant case law and statutory authority, the Court finds that Plaintiffs have failed to identify the specific contractual provisions that were breached, as Plaintiffs must do in order to bring a breach of written contract claim under California law.
5. Breach of Implied Contract
In addition to Plaintiffs’ breach of express contract claim, Plaintiffs also state that “[b]y demanding and accepting Plaintiffs’ and Statewide Class Members’ [PII], Anthem and Anthem Affiliates entered into implied contracts with Plaintiffs and Statewide Class Members.” CAC ¶ 303(c). The consolidated amended complaint does not delve into additional detail on the terms and scope of this alleged implied contract. In moving to dismiss Plaintiffs’ California breach of contract claim, the Anthem Defendants contend that “[t]he CAC fails to allege any facts showing that [any] implied contracts existed beyond vague, conclusory allegations.” Anthem Mot. at 6. Relying upon both federal and state case law, the Anthem Defendants argue that Plaintiffs’ implied contract theory is not well taken. Id.
Plaintiffs declined to respond to these arguments in Plaintiffs’ opposition. See Anthem Opp’n at 6 n.7 (“The fact that Plaintiffs have pled theories of contract formation in the alternative is no reason to dismiss Plaintiffs’ breach of contract claims. This Court need not resolve now the merits of any challenge to these alternative theories of contract formation.”) (citation omitted). In light of Plaintiffs’ position, the Court finds Plaintiffs’ implied contract theory unavailing. If Plaintiffs intend to pursue an implied contract theory in lieu of an express contract claim, Plaintiffs must elaborate upon the nature and scope of the implied contract in the pleadings and must respond to any specific arguments made by the Anthem Defendants.
6. Conclusion
The consolidated amended complaint fails to identify the contractual provisions that were breached. In addition, Plaintiffs’ opposition fails to respo