Tafelski v. Johnson

552 P.3d 40

2024 MT 143

Patricia TAFELSKI, et al., on behalf of themselves and all others similarly situated, Plaintiffs and Appellees,

v.Mark JOHNSON, Tammi Fisher, Plaintiffs, Objectors, and Appellants.

v.Logan Health Medical Center, Defendant and Appellee.

DA 23-0215

Supreme Court of Montana.

Submitted on Briefs: December 20, 2023

Decided: July 9, 2024

APPEAL FROM: District Court of the Eighth Judicial District, In and For the County of Cascade, Cause No, ADV-22-0108 (D), Honorable John W. Parker, Presiding Judge

For Appellants: Matthew G, Monforton, Monforton Law Offices, P.C., Bozeman, Monlana

For Appellees Patricia Tafelski, et al: David R. Paoli, Paoli Law Firm, P.C., Missoula, Montana, John Heenan, Joseph P. Cook, Heenan & Cook, PLLC, Billings, Montana, Andrew W. Ferich, Ahdoot & Wolfson, PC, Radnor, Pennsylvania, John A. Yanchunis, Morgan & Morgan Complex Litigation Group, Tampa, Florida

For Appellee Logan Health Medical Center: Gary M. Zadick, Ugrin Alexander Zadick, P.C., Great Falls, Montana, Paulyne Gardner, Mullen Coughlin, LLC, Devon, Pennsylvania

Justice James Jeremiah Shea delivered the Opinion of the Court.

¶1 Appellants Mark Johnson and Tammi Fisher ("Objectors"), appeal the March 16, 2023 order granting final approval of the Settlement Agreement ("Final Approval Order"), awarding Class Counsel attorney fees, and denying Objectors’ motion for discovery. We address:

Issue One: Whether the District Court erred by awarding Class Counsel attorney fees of 33.33% of the settlement fund.

Issue Two: Whether the District Court erred by denying Objectors' motion for discovery.

¶2 We affirm.

PROCEDURAL AND FACTUAL BACKGROUND

¶3 This dispute arises from the third in a series of significant data breaches of defendant Logan Health Medical Center’s ("Logan Health") information technology systems, which occurred on November 22, 2021. On February 18, 2022, Logan Health announced the breach of highly sensitive personal identifying information and protected health information belonging to more than 200,000 current and former patients and others affiliated with Logan Health. This information included patient names, addresses, medical record numbers, dates of birth, telephone numbers, email addresses, diagnosis and treatment codes, dates of service, treating and referring physicians, medical bill account numbers, and health insurance information.

¶4 Numerous complaints followed shortly after Logan Health disclosed the breach.¹ Patricia Tafelski filed an Amended Complaint in Cascade County District Court on March 2, 2022. Allison Smeltz filed complaints in federal court on March 9, 2022, and Cascade County District Court on March 14, 2022. Two other plaintiffs filed separate actions in Flathead County District Court on March 11, 2022, and March 16, 2022, respectively. Smeltz moved for appointment of her counsel as interim Class Counsel on March 29, 2022, which the District Court granted on March 31, 2022. Tafelski moved the Cascade County District Court to consolidate the separate actions and appoint her counsel as additional co-lead interim Class Counsel, which the District Court granted on June 21, 2022.

¶5 Logan Health and Tafelski agreed to enter settlement negotiations under the supervision of a former Los Angeles Superior Court Judge, Hon. Louis M. Meisinger (Retired). The parties met on July 19, 2022, to negotiate a potential settlement, but no agreement resulted from the mediation. This led Judge Meisinger to propose a doubleblind settlement of $4.3 million for a common fund, to which Logan Health and Tafelski agreed. The substantive terms of the settlement were negotiated and agreed to, leading to the execution of the Settlement Agreement on October 7, 2022. The District Court granted Tafelski’s unopposed motion to direct the class notice ("Settlement Notice") and granted preliminary approval of the proposed settlement on December 6, 2022.

The Settlement Notice was distributed to 202,677 putative class members shortly after the District Court granted preliminary approval of the Settlement Agreement. The Settlement Notice informed putative class members of the nature of the lawsuit and the potential risks members faced as a result of the data breach. The Settlement Notice spelled out in great detail the rights and options of the class members. Those receiving the Settlement Notice were provided with information regarding the benefits of the Settlement Agreement, which included: (1) three years of credit monitoring services paid from the $4.3 million Settlement Fund; or, alternatively, (2) payments of up to $125 per class member; and in addition, (3) cash payments of up to $25,000 per class member for reimbursement of out of pocket expenses; and/or (4) cash payments of up to $125 per class member for reimbursement of attested time. The benefits, and the specific procedures for invoking each, were also described in the document. The very next sentence following the summary of these benefits also noted that the settlement fund would be used to pay for the costs of the settlement administration, court-approved service awards for the named plaintiffs, and the fee and cost award for Class Counsel.

¶7 In terms of the rights and responsibilities of class members, the Settlement Notice provided information regarding deadlines and described the legal consequences of filing a claim, requesting exclusion from the class, objecting to or commenting on the Settlement Agreement, appearing at the Final Approval Hearing, and doing nothing. More specifically, class members were informed that filing a claim by the April 3, 2023 deadline was "the only way that you can receive any of the Settlement Benefits provided by this Settlement." The Settlement Notice explained that by submitting a claim form, class members would "give up the right to sue Logan Health and certain related parties in a separate lawsuit about the legal claims this Settlement resolves." Paragraphs 16 and 17 of the Settlement Notice explained in even greater detail the claims forfeited by opting into the Settlement and led class members to more information posted on the website created and administered under the Settlement. Class members were informed that "the only option that allows you to sue, continue to sue, or be part of another lawsuit against Logan Health, or certain related parties" was to request exclusion by February 13, 2023.

¶8 The Settlement Notice informed putative class members of their right to object or comment on the Settlement Agreement by February 13, 2023, and the substantive and procedural requirements for doing so. The document informed recipients that "[i]f you object, you may also file a Claim Form to receive Settlement Benefits, but you will give up the right to sue Logan Health in a separate lawsuit about the legal claims this Settlement resolves." Later in the Settlement Notice was a paragraph advising of the difference between objecting and requesting exclusion.

¶9 Regarding Class Counsel’s fees, the Settlement Notice informed recipients of the identities of Class Counsel, the details of the fee request, and how Class Counsel’s fees would be paid. The Settlement Notice also informed class members that the fee request would be made available online or by requesting it from the Settlement Administrator prior to the deadline for commenting, objecting, or requesting exclusion. The Settlement Notice and Agreement also provided the contact information of Class Counsel and invited contact if the class members needed additional information. In addition, the entire 22-page Settlement Agreement itself was made readily available to class members online, which contained in terms and substance most of the same information conveyed by the Settlement Notice.

¶10 Within approximately one month of distributing the Settlement Notice, 6,026 responses were received. Of those responses, 6,017 people (2.9% of the putative class) submitted claims for benefits, six (0.003% of the putative class) opted out of the class, and three (0.0015% of the putative class) objected.² Class Counsel noted that the claims rate was "on par with or exceed[ed] data breach claims rates across the United States" and that because the claims deadline had not passed yet, "numerous additional claims [were] expected."

¶11 On January 13, 2023, Class Counsel filed a motion for attorney fees and expenses, and service awards for the ten class representatives. Objectors filed timely objections on February 8, 2023, arguing the attorney fees sought by Class Counsel—33.33% of the settlement fund—were unreasonable considering the short amount of time between commencement and settlement of the action. Objectors did not object to any of the terms of the Settlement Agreement, or to the benefits and settlement fund created by the Agreement.

¶12 Based on this objection, Objectors sought leave to obtain discovery from Tafelski and Logan Health. Through five requests for production, Objectors sought from Tafelski:

1) All timesheets, billing records, or other documents supporting the claim for attorney fees;

2) All documents supporting the claim for expenses;

3) All communications between Tafelski and any person serving as a mediator in this action, including but not limited to settlement briefs and brochures;

4) All communications between Tafelski and Defendant relating to the data breach; and

5) To the extent not already produced in prior responses, all documents relating to any insurance policy applicable to any damages or injuries arising from the data breach, including documents evidencing such policies and communications between Tafelski and Logan Health.

Objectors also sought leave to serve three requests for production on Logan Health. These requests included:

1) All communications between Logan Health and any person serving as a mediator in this action, including but not limited to settlement briefs and brochures;

2) All communications between Logan Health and the Settlement Class,...