This is a putative class action arising out of a cyberattack and data breach at Defendant Kalispell Regional Healthcare's facilities. Plaintiffs Connie Doyle and Annette Nevidomsky allege subject matter jurisdiction under 28 U.S.C. § 1331. However, "a complaint alleging a violation of a federal statute as an element of a state cause of action, when Congress has determined that there should be no private, federal cause of action for the violation, does not state a claim 'arising under the Constitution, laws, or treaties of the United States.'" Merrell Dow Pharm. Inc. v. Thompson, 478 U.S. 804, 817 (1986) (quoting 28 U.S.C. § 1331).
Here, Plaintiffs allege that Kalispell Regional was negligent, negligent per se, and breached its fiduciary duties by violating federal statutory duties. (Compl., Doc. 1 at ¶¶ 89-90, 136-40, 151-60.) They have not brought a federal claim and none of the federal statutes they invoke allow private causes of action. See Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1082 (9th Cir. 2007) (HIPAA); Carlson v. Coca-Cola Co., 483 F.2d 279, 280 (9th Cir. 1973) (Federal Trade Commission Act); Barnett v. First Premier Bank, 475 F. App'x 174 (9th Cir. 2012) (Gramm-Leach-Bliley Act). This Court has an "independent obligation to determine whether subject-matter jurisdiction exists, even in the absence of a challenge from any party." Arbaugh v. Y&H Corp., 546 U.S. 500, 514 (2006). Accordingly,
IT IS ORDERED that by February 19, 2020, Kalispell Regional shall file a supplemental brief in support of its motion to dismiss, not to exceed five pages, addressing whether subject matter jurisdiction exists. Plaintiffs shall address subject matter jurisdiction in their response to the motion to dismiss. The deadline for Plaintiffs to respond to the motion to dismiss is extended to March 11, 2020.
DATED this 13th day of February, 2020.
Donald W. Molloy, District Judge
United States District Court