Judge Orders Gov’t to Produce Docs in Anthem Data Breach Class Action

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

This week, a D.C. federal judge granted a request by plaintiffs in the Anthem data breach class action lawsuit to access documents from a 2013 government audit of Anthem’s systems. However, the judge found some of the information was protected and therefore only granted access to a portion of the documents the plaintiffs were seeking.

The Anthem data breach class action lawsuit was filed in the wake of a massive cyberattack on Anthem’s computer systems that took place sometime between December 2014 and January 2015. The hackers allegedly stole the private health data and personally identifiable information of close to 80 million people.

More than 100 data breach class action lawsuits were filed against Anthem, alleging Anthem failed to adequately safeguard the personal information of subscribers and failed to adequately notify those whose personal information was compromised in the Anthem data breach.

The Anthem class action lawsuits were consolidated into multidistrict litigation (MDL) titled In re: Anthem Inc. Data Breach Litigation.

According to the court documents, the plaintiffs in the Anthem MDL issued a subpoena to the U.S. Office of Personnel Management (OPM) in May 2016 for documents relating to its IT systems audits of Anthem and its affiliates, both before and after the Anthem data breach.

OPM reportedly released a portion of the requested documents but claimed other documents were protected from disclosure under the deliberative process privilege and/or the law enforcement privilege. The plaintiffs subsequently filed a motion to compel OPM to provide the withheld records.

The withheld documents reportedly included audit documents related to Anthem’s refusal to permit OPM to conduct certain audit testing, auditor reviews and conclusions about Anthem’s information system security practices, writeups documenting meetings between auditors and Anthem representatives about network security and risk assessment, and emails discussing potential changes to federal contracts and whether Anthem implemented recommendations made as part of the 2013 audit.

OPM asserted that all of these categories of documents were protected from disclosure, and a court hearing was held on the plaintiffs’ motion to compel compliance with the subpoena. The court ordered OPM to submit the withheld documents for the court to inspect. OPM complied and submitted unredacted copies of the documents which were reviewed by the court.

On Tuesday, U.S. District Judge Amit P. Mehta determined that some of the withheld documents (or portions of those documents) contain only factual information, and that neither the deliberative process nor the law enforcement privilege applies. The judge therefore granted in part the plaintiffs’ motion to compel OPM to release the documents, but denied the plaintiffs access to the documents that are protected from disclosure.

In granting the plaintiffs access to the documents, Judge Mehta found that the “balance of interest tips in favor of disclosing” the documents to the plaintiffs, and that the information contained in the documents falls outside the types of records the privilege is meant to protect. The judge also found that disclosing the documents to the plaintiffs would not carry the risks anticipated by the government because the materials will be covered by a protective order in the litigation.

The plaintiffs are represented by Stull Stull & Brody, Milberg LLP, Cohen Milstein Sellers & Toll PLLC and Altshuler Berzon LLP.

The Anthem Data Breach Class Action Lawsuit is In re: Anthem Inc. Data Breach Litigation, Case No. 1:16-cv-02210, in the U.S. District Court for the District of Columbia.

UPDATE: On June 23, 2017, Anthem agreed to pay $115 million to end class action litigation over a 2015 data breach that exposed information of nearly 80 million individuals.

UPDATE 2: October 2017, the Anthem data breach class action settlement is now open. Click here to file a claim.

UPDATE 3: On Nov. 20, 2018, Top Class Actions viewers started receiving checks from the Anthem data breach class action settlement worth as much as $50. Congratulations to everyone who filed a valid claim and got PAID!

UPDATE 4: On Nov. 21, 2019, Top Class Actions viewers started receiving checks from the Anthem data breach class action settlement for out-of-pocket expenses worth as much as $5,000. Congratulations to everyone who filed a valid claim and got PAID!