Doe v. Kaiser Foundation Health Plan, Inc.

Background

This putative class action alleges that Kaiser Foundation Health Plan, Inc., Kaiser Foundation Hospitals, and The Permanente Medical Group, Inc. embedded code in Kaiser’s website, patient portal, and mobile applications that allowed outside social-media and advertising-technology companies to access, intercept, and use users’ personal and medical information without authorization or consent. The opinion does not decide whether those allegations are true. The case was referred to Magistrate Judge Edward Chen for discovery matters.

The parties submitted a joint letter brief asking the court to resolve disagreements about a stipulated protective order. They agreed that discovery should be governed by one of the Northern District of California’s model protective orders but disagreed about which model to use and whether to modify it.

Base Protective Order

The parties disputed whether to use the Tier 1 model for standard litigation or the Tier 2 model for litigation involving patents, highly sensitive confidential information, or trade secrets. Kaiser argued for the Tier 2 model because the plaintiffs sought information concerning Kaiser’s website functions, source code, trade secrets, financial information, and other sensitive materials. The plaintiffs argued that the Tier 1 model was appropriate because the case was not a patent case and did not involve competitors exchanging sensitive competitive data.

Judge Chen ordered the parties to use the Tier 2 model as the base protective order. He relied on the anticipated discovery concerning source code, potential trade secrets, highly confidential business information, and patients’ healthcare-related information. He also ordered that Sections 13.5 through 13.7 and Section 15 be included because the parties agreed to those provisions.

Disputed Modifications

Experts. The Tier 2 model excludes from the definition of an expert a past or current employee of a party or its competitor, as well as a person expected to become such an employee. The plaintiffs proposed removing those limits so they could hire past, current, or anticipated Kaiser employees and employees of competitors. Kaiser opposed the change because those individuals could receive highly confidential information, including source code. Judge Chen found that the existing limits were needed to reduce the risk of improper disclosure and ordered the protective order to use the default language of Section 2.7.

Attorneys’ Eyes Only information. The plaintiffs proposed adding examples concerning website security, trade secrets, and protected health information to the model’s definition of “Attorneys’ Eyes Only” information. Kaiser proposed different clarifications but acknowledged that clarification was not necessary. Judge Chen ordered the parties to use Section 2.8’s default definition without either side’s additional language.

Disclosure to the receiving party. The model’s Section 7.3(b) allows highly confidential and source-code materials to be disclosed to designated in-house counsel who are not involved in competitive decision-making and who need the information for the litigation. The plaintiffs proposed allowing disclosure to the receiving party generally as well as to designated in-house counsel. Kaiser opposed that broader access. Judge Chen agreed that allowing an entire receiving party to access the most sensitive information would weaken the protection and ordered the parties to use Section 7.3(b)’s default language without the proposed modification.

Disclosure about experts. Section 7.4 requires a party seeking to show highly confidential or source-code materials to an expert to provide information about that expert before disclosure, including the expert’s name, primary residence, resume, employers, certain compensation and professional-service relationships, and recent expert testimony. The plaintiffs proposed limiting this requirement to experts who were current or anticipated officers, directors, or employees of a competitor. Kaiser opposed the change. Judge Chen ordered the parties to use Section 7.4’s default language, finding that the broader disclosure requirement helps the designating party evaluate possible conflicts before exposing highly sensitive information.

Location for source-code review. The plaintiffs proposed allowing source-code production at a location reasonably convenient for them and their experts. Kaiser argued that review should occur only in the Northern District of California. Judge Chen ordered the parties to cooperate in selecting a mutually acceptable location. Under the procedure stated in the order, if they could not reach agreement, the plaintiffs’ counsel could select any domestic U.S. office of Kaiser’s outside counsel of record, provided the choice was communicated at least 30 days before the requested review. Review would occur during local business hours, and Kaiser’s counsel would reasonably cooperate with information-technology and logistical support.

Disposition

The court ordered the parties to coordinate and jointly file an edited Tier 2 protective order incorporating the court’s rulings and the parties’ agreements. They were required to file clean and redline versions and email the redline Word file to the court. The deadline was December 22, 2023. This was a discovery and protective-order ruling; the court expressly did not decide the merits of the plaintiffs’ claims. Judge Edward Chen entered the order on November 30, 2023.