Doe v. Kaiser Foundation Health Plan, Inc.

Background

The plaintiffs—John Doe, John Doe II, Jane Doe, Jane Doe II, Jane Doe III, Jane Doe IV, and Jane Doe V—brought a putative class action against Kaiser Foundation Health Plan, Inc., Kaiser Foundation Hospitals, and The Permanente Medical Group, Inc. The plaintiffs allege that code embedded in Kaiser’s website, patient portal, and mobile applications allowed third-party social-media and advertising-technology companies to intrude upon, read, intercept, and use sensitive personal and medical information without the plaintiffs’ knowledge or consent.

The order addressed joint letter briefs and supplemental status reports concerning the parties’ responses to document requests. The case was still in the period before any class had been certified, and discovery was divided into phases. The court explained that discovery must concern nonprivileged information relevant to a claim or defense and proportional to the needs of the case. The court also explained that precertification discovery is generally directed toward class-certification issues, although class-certification and merits discovery can overlap.

Rulings

The court ordered that the disputes concerning the plaintiffs’ responses to Kaiser’s first set of discovery requests, identified in Docket 183, were resolved because the parties had confirmed that they had resolved those issues.

The court deferred ruling on whether Phase II discovery had begun and whether particular requests exceeded the scope of Phase I. Kaiser’s request to change the Phase II start date remained pending before the presiding district judge. The parties were ordered to submit a joint status report by August 16, 2024, after the August 6, 2024 status conference.

Regarding Jira tickets, the court ordered Kaiser to supplement its interrogatory responses by August 8, 2024, identifying when each relevant web-tracking technology was first added to or implemented on the website and applications at issue. After that supplementation, the parties were ordered to meet and confer about a reasonable search and production process covering an appropriate period surrounding each technology’s introduction. They were ordered to report the outcome by August 16, 2024. If Kaiser reasonably believed responsive Jira tickets were privileged, it was ordered to provide a privilege log whether the tickets predated or postdated the complaint. The court also directed the parties to discuss appropriate handling of protected medical information under the protective order and applicable law.

For Kaiser’s internal-investigation documents, the court ordered Kaiser to produce a categorical privilege log for responsive documents generated by non-attorney Kaiser employees, with the order setting September 13, 2024, as the deadline. Based on the plaintiffs’ stated position, Kaiser did not have to log documents involving communications with its outside or in-house counsel, or containing attorney work product, relating to the internal investigation.

The court found that responsive organizational charts concerning Kaiser employees involved in developing third-party code were relevant and proportional to the needs of the case. Kaiser was ordered to produce nonduplicative charts, if they existed, covering January 1, 2019, through July 18, 2024, by September 13, 2024.

The court set a further discovery-management conference for September 24, 2024, and ordered the parties to file a joint status report by September 16, 2024. In its conclusion, the court stated that it resolved the disputes raised in Dockets 183, 185, 211, and 212; disputes resolved at the hearing or withdrawn were treated accordingly. Judge Peter H. Kang, a United States magistrate judge, issued the order.