Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 1 of 29 Page ID #:1 1 2 3 4 5 6 7 8 9 10 11 VEDDER PRICE (CA), LLP Christopher R. Ramos (SBN 301556) cramos@vedderprice.com 125 Century Park East, Suite 1900 Los Angeles, California 90067 T: +1 424-204-7700 F: +1 424-204-7702 VEDDER PRICE P.C. Blaine C. Kimrey (to seek admission pro hac vice) bkimrey@vedderprice.com Jeanah Park (to seek admission pro hac vice) jpark@vedderprice.com 222 N. LaSalle Street Chicago, Illinois 60601 T: +1 312-609-7500 F: +1 312-609-5001 Attorneys for plaintiff KCC CLASS ACTION SERVICES, LLC UNITED STATES DISTRICT COURT CENTRAL DISTRICT OF CALIFORNIA WESTERN DIVISION 12 13 14 15 KCC CLASS ACTION SERVICES, LLC, Plaintiff, 16 17 18 19 Case No. 2:18-cv-1018 COMPLAINT (1) Breach of Contract and the Implied Covenant of Good Faith and Fair Dealing; v. AETNA INC., Defendant. (2) Negligence/Failure to Warn; 20 (3) Quantum Meruit/Goods and Services Rendered; 21 (4) Declaratory Judgment 22 Jury Trial Demanded 23 24 25 26 27 28 KCC CLASS ACTION SERVICES, LLC (“KCC” or “Plaintiff”), by and through its undersigned attorneys, brings this action against defendant AETNA INC. (“Aetna” or “Defendant”) for: (1) breach of contract and the implied covenant of good faith and fair dealing; (2) negligence/failure to warn; (3) quantum meruit/goods and services rendered; and (4) declaratory judgment (two counts). In VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 2 of 29 Page ID #:2 1 support of its Complaint, KCC states as follows: 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 NATURE OF THE ACTION 1. This is a case about the negligence, carelessness, and recklessness of Aetna and its agent and Business Associate, Gibson, Dunn & Crutcher LLP (“Gibson”), and their failure to adequately safeguard the protected health information (“PHI”) of thousands of Aetna insureds. 2. In 1996, Congress recognized the importance of protecting the privacy of all individually identifiable health information when it enacted the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §§ 300gg, 29 U.S.C. § 1181, et seq., and 42 U.S.C. § 1320d, et seq., and its associated regulations, 45 C.F.R. § 160, 162 and 164 (“HIPAA”), which established a federal floor of safeguards to protect the confidentiality of medical information. 3. Founded in 1853, Aetna is one of the country’s largest and oldest health insurers. Aetna’s mission is to “build a healthier world — one person, one community at a time.” According to Aetna’s website, Aetna reported earnings of approximately $63.2 billion in revenue in 2016. In December 2017, Aetna announced that CVS Health had agreed to purchase Aetna for $69 billion. 4. Aetna’s privacy policy claims Aetna “will safeguard member [PHI] from impermissible and unauthorized use and disclosure in accordance with federal and state law, the Company’s Code of Conduct, and industry standards.” 5. Gibson is a global law firm comprised of over 1,200 lawyers in 20 offices worldwide. Gibson markets itself as a sophisticated law firm with experience in health law and data privacy, among other things. 6. Contrary to representations Aetna and Gibson have made about their commitment to and expertise in health care privacy matters, Aetna and Gibson caused the disclosure of the HIV/AIDS status and HIV/AIDS drug prevention use of thousands of Aetna’s insureds throughout the country. 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES -2- COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 3 of 29 Page ID #:3 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 7. Indeed, KCC has learned from public documents that Aetna has been sued in no fewer than ten lawsuits arising from this disclosure and has agreed to pay over $17 million to resolve two of those lawsuits. Public documents also reveal that Aetna has agreed to pay over $1.1 million in penalties to the State of New York to resolve an investigation initiated by the New York Attorney General. 8. Instead of accepting responsibility for this unfortunate incident, Aetna has demanded that KCC indemnify and reimburse Aetna for any and all losses arising from the incident. 9. KCC is a settlement administrator that administers class action claims of all types. Aetna, through Business Associate Gibson, engaged KCC to mail notices relating to a settlement agreement and administer claims through that agreement. 10. Aetna, through its agent and Business Associate Gibson, is a party to a contract governing the services KCC was to provide and did provide related to the mailing of the notices. 11. Aetna, as a Covered Entity under HIPAA, and Aetna’s Business Associate, Gibson, had a duty under HIPAA to institute appropriate protective measures to maintain the safety and security of the PHI at issue in the mailing of the notices. 12. In violation of this duty, Aetna and Gibson failed to institute appropriate protective measures to maintain the safety and security of the PHI at issue in the mailing of the notices. And Aetna and Gibson failed to inform or warn KCC that they had failed to institute appropriate protective measures to ensure the safety and security of the PHI of the Aetna insureds. 13. In the absence of appropriate protective measures and without warning KCC that such measures had not been implemented, Aetna and Gibson provided 27 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES -3- COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 4 of 29 Page ID #:4 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 the PHI of the Aetna insureds to KCC without the insureds’ consent, in violation of HIPAA. 14. KCC with far more PHI of Aetna insureds than was minimally necessary for KCC to perform its job function. 15. 26 Without Aetna and Gibson having provided the PHI of the Aetna insureds, KCC would have had no direct access to or control over the PHI, which at all times was provided by Aetna and Gibson. 16. In connection with the engagement, KCC sent all draft notices to Gibson for approval, and upon receiving such approval, KCC mailed the notices. KCC did not mail any notices that did not receive the prior express approval of Gibson and/or Aetna. 17. In late July 2017, thousands of notices were sent on Aetna’s behalf to Aetna insureds in envelopes with a glassine window that exposed the insureds’ HIV/AIDS status and/or taking of HIV/AIDS preventative drugs. 18. Aetna and Gibson knew that windowed envelopes were being used in the mailings in question. KCC provided samples of the letters to Aetna and Gibson, and those letters demonstrated that windowed envelopes would be used. Aetna and Gibson approved the form and content of the letters before they were transmitted. 19. KCC now brings this action for breach of contract and the implied covenant of good faith and fair dealing, negligence/failure to warn, quantum meruit/goods and services rendered, and declaratory relief arising from Aetna’s and Gibson’s wrongful acts and carelessness. 24 25 Moreover, in further violation of HIPAA, Aetna and Gibson provided THE PARTIES 20. KCC is a Delaware limited liability company with its principal place of business in San Rafael, California. KCC’s sole member is Kurtzman Carson 27 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES -4- COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 5 of 29 Page ID #:5 1 2 3 4 Consultants, Inc., a Delaware corporation with its principal place of business in El Segundo, California. 21. business in Connecticut. 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 Aetna is a Pennsylvania corporation with its principal place of JURISDICTION AND VENUE 22. The Court has subject matter jurisdiction over this action pursuant to 28 U.S.C. § 1332(a)(1) because the parties are citizens of different states and the amount in controversy exceeds $75,000, exclusive of interest and costs. 23. The Court has personal jurisdiction over Aetna because Aetna has purposefully availed itself of the privilege of conducting business in California insofar as Aetna currently maintains systematic and continuous business contacts with this State and Aetna expressly agreed in the contract at issue that the contract would be construed in accordance with the laws of the State of California. Furthermore, the claims at issue in this case arose out of a contract offered, entered into, and to be performed (at least in part) in California, and Aetna engaged in sufficient contacts with California (including litigation and settlement of an earlier related putative class action in California and the direction of resulting mailings into California) to give rise to these claims in California in such a way as to establish specific jurisdiction and satisfy the Due Process Clause. 24. Venue is proper in this District pursuant to 28 U.S.C. § 1391(b)(1) and (2) because Aetna engaged in business in this District; has an office or agency in this District; committed tortious acts within this District; breached a contract in this District by failing to perform acts required by the contract to be performed in this District; litigated and settled a related putative class action in this District that led to this lawsuit; and/or is engaged in substantial and not isolated activity in this District. 27 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES -5- COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 6 of 29 Page ID #:6 1 FACTUAL BACKGROUND 2 Aetna’s Public Commitment to Protect the Privacy of Its Insureds 3 4 5 25. required to comply with the HIPAA federal standards that govern the privacy of individually identifiable health information, or PHI. 6 7 8 9 10 11 12 13 14 15 26. Indeed, on Aetna’s publicly accessible Web site, Aetna acknowledges, among other things, that HIPAA (in addition to other federal and state privacy laws) requires health care companies like Aetna to keep patient information confidential. See Privacy FAQs, Aetna, https://www.aetna.com/faqs-health- insurance/about-us-privacy-faqs.html (last visited January 29, 2018). According to Aetna’s Web site, confidential patient information would include “[a]nything your doctors, nurses, and others put in your medical record.” Id. The Web site claims that an Aetna member could “[d]ecide if you want to give your permission before your information can be used or shared for certain purposes,” as well as “[g]et a report on when and why your information was shared for certain purposes.” Id. 16 17 Aetna is a Covered Entity within the meaning of HIPAA and is thus 27. Acknowledging its responsibility to protect the privacy of its insureds, according to Aetna’s Web site, Aetna has the responsibility to: 18 • Put safeguards in place to protect your information; • Limit the use and disclosure of your information to the minimum needed to accomplish our goals; • Enter into agreements with our contractors and others to make sure they use and disclose your information properly and safeguard it appropriately; 24 • Have procedures in place to limit who can see your information; and 25 • Hold training programs for employees to learn how to protect your 26 information.1 19 20 21 22 23 27 1 28 See https://www.aetna.com/faqs-health-insurance/about-us-privacy-faqs.html (last visited January 29, 2018). VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES -6- COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 7 of 29 Page ID #:7 1 2 3 4 28. protections in place” to protect its members’ PHI and that it is “continually improving and updating as part of [Aetna’s] existing commitment to information privacy and compliance with legislation such as HIPAA and state privacy laws.”2 5 6 7 8 29. impermissible and unauthorized use and disclosure in accordance with federal and state law, the Company’s Code of Conduct, and industry standards.” Aetna’s History of Failing to Protect the Privacy of Its Insureds 10 12 13 30. 16 17 consistently fails to adequately safeguard the personal information and PHI of its insureds. 31. 20 21 22 23 Aetna reported that the personal information of approximately 2,300 individuals had been exposed because of a server breach. 32. 26 In approximately November 2014, Aetna announced a policy change that barred its health insurance enrollees diagnosed with HIV/AIDS or taking HIV/AIDS preventative medications from filling their prescriptions at their local brick and mortar pharmacy. Instead, these enrollees were required to obtain their medications by mail order. (The change in policy is referred to herein as “The Program.”) 24 25 In 2010, Aetna reported a data breach to the Office of Civil Rights for the U.S. Department of Health and Human Services, which enforces HIPAA. 18 19 Notwithstanding Aetna’s recognition of its obligation as a Covered Entity to comply with HIPAA and protect the privacy of its insureds, Aetna 14 15 Aetna’s own policy, “Use and Disclosure of Member Protected Health Information (‘PHI’),” claims that Aetna “will safeguard member PHI from 9 11 Aetna also claims that it has “extensive operational and technical 33. Mail order delivery of medications often required refrigerated containers to be delivered to a person’s home or office, thus potentially disclosing the enrollee’s medical condition to third parties. The Program raised serious 27 28 2 See Personal Health Record (PHR) FAQs, Aetna. https://www.aetna.com/faqs-healthinsurance/personal-health-record-faqs.html (last visited January 29, 2018). VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES -7- COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 8 of 29 Page ID #:8 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 privacy implications because of the social stigma that could be associated with the disease. 34. In December 2014, a class action lawsuit was filed against Aetna alleging that The Program put patients’ health and privacy at risk. See DOE v. Aetna, Case No. 14-cv-02986 (S.D. Ca.) (the “Doe Litigation”). 35. In December 2015, another class action lawsuit was filed against one of Aetna’s subsidiaries, Coventry Health Care, Inc., also alleging that The Program put patients’ health and privacy at risk. See DOE v. Coventry Health Plans, No. 15cv-62685 (S.D. Fla.) (the “Coventry Litigation”). 36. On July 8, 2016, the U.S. District Court for the Southern District of California entered a Qualified Protective Order governing, among other things, the confidential treatment and protection of PHI exchanged by the parties in connection with the Doe Litigation. See Doe Litigation, D.E. 62. 37. On June 17, 2016, the U.S. District Court for the Southern District of Florida entered a Qualified Protective Order governing, among other things, the confidential treatment and protection of PHI exchanged by the parties in connection with the Coventry Litigation. See Coventry Litigation, D.E. 71. 38. Approximately two years later, the Doe Litigation and the Coventry Litigation were resolved. On or about February 27, 2017, the plaintiffs in the Doe Litigation and Coventry Litigation executed a settlement agreement with Aetna (the “Doe/Coventry Settlement Agreement”). 39. In the Doe/Coventry Settlement Agreement, Aetna agreed to, among other things: (1) send a notice to all affected consumers enrolled in Aetna plans advising them of their right to obtain HIV/AIDS medications from a community pharmacy of their choice, where privacy would be protected (the “Notice” or “Notices”); and (2) send a separate notice offering certain individuals the right to receive compensation for incurred out of pocket losses. 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES -8- COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 9 of 29 Page ID #:9 1 2 3 4 5 6 7 8 9 10 11 40. The Doe/Coventry Settlement Agreement specifically places the responsibility for sending the Notice on Aetna. 41. On March 3, 2017, the parties in the Coventry Litigation filed a Stipulation of Voluntary Dismissal, thereby terminating the Coventry Litigation and the Qualified Protective Order governing PHI disclosed in connection with the Coventry Litigation. 42. On March 3, 2017, the parties in the Doe Litigation filed a Stipulation of Voluntary Dismissal. On March 6, 2017, the U.S. District Court for the Southern District of California entered an Order dismissing the Doe Litigation and terminating the Qualified Protective Order governing PHI disclosed in connection with the Doe Litigation. 12 13 14 15 16 17 18 19 20 21 22 23 24 25 After Allowing the Qualified Protective Orders to Terminate, Aetna Engages KCC to Send the Notice to Aetna Insureds Taking HIV/AIDS Medications. 43. Under HIPAA, a “Business Associate” is a person or entity that performs functions or activities on behalf of, or provides services to, a Covered Entity that involve access by the Business Associate to PHI. The HIPAA rules require that Covered Entities (such as Aetna) enter into contracts with their Business Associates (such as Gibson) to ensure that the Business Associates will appropriately safeguard PHI. 44. Gibson was Aetna’s Business Associate for purposes of HIPAA and performed services on Aetna’s behalf. 45. One of Aetna’s primary lawyers in the Doe/Coventry litigation and settlement process, Heather Richardson, is a partner at Gibson’s Los Angeles office who specializes in health care, insurance, and class action matters and has a Masters of Public Health with a specialization in health services. 26 27 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES -9- COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 10 of 29 Page ID #:10 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 46. In April or May 2017, Aetna, through its counsel and Business Associate Gibson, engaged KCC to process and carry out the Notices contemplated by the Doe/Coventry Settlement Agreement. 47. On or about May 23, 2017, KCC issued a proposal in connection with Aetna’s request that KCC administer the mailing of the Notices (the “Proposal”) (A copy of the Proposal is attached hereto as Exhibit A.) 48. The Proposal provided that KCC would print and mail the Notices and the claims forms as set forth in the Doe/Coventry Settlement Agreement. (See generally Proposal.) 49. The Proposal was addressed to both Gibson and counsel for the plaintiffs in the Doe Litigation and Coventry Litigation, Whatley Kallas (“Whatley”). While the Proposal contained a signature line for Whatley, Whatley never signed the Proposal. But by proceeding with the engagement without contesting or negotiating any changes to the terms and conditions of that proposal, Aetna, Gibson and Whatley agreed to and accepted the Proposal. 50. In connection with the engagement, KCC communicated almost exclusively with Aetna’s counsel, Gibson, and Whatley. 51. The Proposal attached and referenced KCC’s standard Terms and Conditions (the “KCC Agreement”), which provided that KCC would provide services to “Client” as defined in the May 23, 2017 proposal. (A copy of the KCC Agreement is attached hereto as Exhibit B.) 52. The KCC Agreement provides, “KCC agrees to provide the services set forth in the Proposal attached hereto (the ‘Services’).” (KCC Agreement § 1.) The KCC Agreement also provides that “KCC will often take direction from Client’s representatives, employees, agents and/or professionals (collectively, the ‘Client Parties’) with respect to the Services. The parties agree that KCC may rely upon, and Client agrees to be bound by, any direction, advice or 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 10 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 11 of 29 Page ID #:11 1 2 information provided by the Client Parties to the same extent as if provided by the Client.” (Id.) (Emphasis added.) 3 4 53. provision: 5 Client shall indemnify and hold KCC, its affiliates, members, directors, officers, employees, consultants, subcontractors and agents (collectively, the “Indemnified Parties”) harmless, to the fullest extent permitted by applicable law, from and against any and all losses, claims, damages, judgments and expenses (including reasonable counsel fees and expenses) (collectively, “Losses”) resulting from, arising out of or related to KCC’s performance of Services. Such indemnification shall exclude Losses resulting from KCC’s gross negligence or willful misconduct. Without limiting the generality of the foregoing, Losses include any liabilities resulting from claims by any third-parties against any Indemnified Party. 6 7 8 9 10 11 12 13 The KCC Agreement contains the following indemnification (KCC Agreement § 8.) 14 54. 15 Except as provided herein, KCC’s liability to Client or any person making a claim through or under Client or in connection with Services for any Losses of any kind, even if KCC has been advised of the possibility of such Losses, whether direct or indirect and unless due to gross negligence or willful misconduct of KCC, shall be limited to the total amount billed or billable for the portion of the particular work which gave rise to the alleged Loss. In no event shall KCC’s liability for any Losses, whether direct or indirect, arising out of the Services exceed the total amount billed to Client and actually paid to KCC for the Services. In no event shall KCC be liable for any indirect, special or consequential damages such as loss of anticipated profits or other economic loss in connection with or arising out of the Services. Except as expressly set forth herein, KCC makes no representations or warranties, express or implied, including but not limited to, any implied or express warranty of merchantability, fitness or inadequacy for a particular purpose or use, quality, productiveness or capacity. The provisions of this Section 8 shall survive termination of Services. 16 17 18 19 20 21 22 23 24 25 26 The KCC Agreement also provides: (Id.). 27 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 11 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 12 of 29 Page ID #:12 1 2 3 Aetna’s and Gibson’s Carelessness Results in the Disclosure of the Fact That Aetna Insureds Across the Country Were Taking HIV/AIDS Medications. 55. Notwithstanding that Aetna’s counsel Gibson touts itself as an expert 4 in the field of data privacy and Aetna’s own privacy policy claims that Aetna “will 5 safeguard member PHI from impermissible and unauthorized use and disclosure in 6 accordance with federal and state law,” Aetna and Gibson transferred Aetna’s 7 insureds’ PHI to KCC in a reckless, careless, and negligent fashion that resulted in 8 the public disclosure of the fact that thousands of Aetna insureds were taking 9 HIV/AIDS medications. 10 56. In late July 2017, thousands of Notices were sent on Aetna’s behalf to 11 Aetna insureds who had submitted claims for HIV/AIDS medications, in envelopes 12 with a glassine window that exposed the insureds’ HIV/AIDS status or the fact that 13 the insureds were taking HIV/AIDS preventative medications. 14 57. Aetna and Gibson knew that windowed envelopes were being used in 15 the mailings in question. KCC provided samples of the letters to Aetna and Gibson, 16 and those letters demonstrated that windowed envelopes would be used. Aetna and 17 Gibson approved the form and content of the letters before they were transmitted. 18 58. Aetna’s approval of the letters and the windowed envelopes is 19 consistent with the reckless, careless, and negligent conduct of Aetna and its 20 counsel throughout the engagement. 21 59. Aetna and Gibson failed to implement appropriate protective measures 22 to ensure the protection and confidentiality of the Aetna patient information at issue 23 in the Notices. Aetna and Gibson failed to inform KCC that Aetna and Gibson had 24 not implemented appropriate protective measures to ensure the protection and 25 confidentiality of the Aetna patient information that was the subject of the Notices. 26 27 60. Aetna and Gibson allowed the Qualified Protective Orders in the Doe Litigation and Coventry Litigation to terminate on March 3 and 6, 2017. 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 12 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 13 of 29 Page ID #:13 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 61. Aetna — as a party in the Doe Litigation and Coventry Litigation — knew that the Qualified Protective Orders in the Doe Litigation and Coventry Litigation had terminated upon dismissal of the cases. 62. Gibson — as counsel of record for Aetna in the Doe Litigation and Coventry Litigation — knew that the Qualified Protective Orders in the Doe Litigation and Coventry Litigation had terminated upon dismissal of the cases. 63. Notwithstanding this direct knowledge that no Qualified Protective Order was in place, Aetna and Gibson failed to inform KCC of this fact before providing insured PHI to KCC. And Aetna and Gibson failed to implement any protective measures similar to a Qualified Protective Order before providing the PHI to KCC. 64. In the absence of any such protective measures (a Qualified Protective Order or legally similar agreement to protect the PHI), Aetna and Gibson provided PHI to KCC without the consent of all insureds whose PHI was at issue, in violation of HIPAA. 65. On May 24, the day after KCC sent the Proposal to Aetna’s counsel, Gibson, Gibson partner Richardson emailed a data set of Aetna insured PHI to KCC. The information shared by Richardson with KCC included the following data types: MEMBER_ID, DISP_DT, NDC_CD, PRODUCT_NM, DISP_YRMO, CUST_SEGMENT_DESC, SCRIPTS, PAY_ALLOW_AMT, PAY_PAID_AMT, SRV_COPAY_AMT, MEMBER_COPAY, APP_TO_PER_DED_AMT, MEM_NM, ADDRESS1, ADDRESS2, CITY, STATE, and ZIP_CD. 66. In further violation of HIPAA, Aetna and Gibson sent KCC far more information than was minimally necessary to perform its job function, i.e., mail notices to a list of people. 67. Moreover, some of the insured information was not encrypted, notwithstanding the fact that Aetna and Gibson have the technical expertise to 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 13 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 14 of 29 Page ID #:14 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 encrypt such information. Information specific to Coventry insureds was not password protected, nor was it sent via a secure file transfer protocol. Instead, Gibson simply emailed Coventry insured information in an unsecured fashion from Gibson to KCC. 68. Aetna, as a Covered Entity under HIPAA, knew or should have known that sending the Aetna insured data to KCC in an unsecure and reckless fashion compromised the privacy and confidentiality of Aetna’s insureds. 69. Aetna’s Business Associate, Gibson, knew or should have known better and had a duty under HIPAA to know that overdisclosing the PHI of Aetna insureds and sending the Coventry patient data to KCC in an unsecure and reckless fashion compromised the privacy and confidentiality of Aetna’s and Coventry’s insureds. 70. In fact, the legal journal Law360 recently named Gibson a “Privacy Practice Group of the Year.” See January 30, 2018 article, “Privacy Group of the Year: Gibson,” Law360, attached hereto as Exhibit C.) Given that plaudit, Gibson presumably had the knowledge base to understand that without a Qualified Protective Order, Gibson and Aetna should not have shared PHI with KCC. Moreover, they should have known that even if there had been a Qualified Protective Order, they should have shared only the data minimally necessary to perform the notice function and should have password-protected and encrypted every email transmission containing PHI. 71. Instead, Aetna and Gibson shared insured PHI without password protection or encryption, shared far more data than was necessary to perform the notice function, and never warned or notified KCC that the insured information Aetna and Gibson provided to KCC to effectuate the mailings was being provided by Aetna and Gibson in violation of their Covered Entity and Business Associate obligations under HIPAA. 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 14 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 15 of 29 Page ID #:15 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 72. Between May 23 and approximately July 20, 2017, KCC worked with Whatley and Aetna counsel Gibson to prepare the Notices and other mailings. Both Gibson and Whatley provided feedback and approval on the language in the Notices, but only Aetna and Gibson provided PHI and insureds’ contact information to KCC. 73. Additionally, when Whatley made suggestions to the “Frequently Asked Questions” to be included in the Notices, Aetna rejected the suggestions and Gibson provided the final versions that were ultimately mailed by KCC. 74. At no time before providing the PHI to KCC did Gibson or Aetna ask KCC whether it might be willing to sign a Business Associate Agreement relating to the treatment and/or protection of PHI. 75. In fact, only after this incident became public did Gibson ask KCC to sign a Qualified Protective Order (at which time it was too late because the Qualified Protective Orders had already expired in the two underlying class actions that had been settled privately without court approval) or to sign a Business Associate Agreement. 76. At no time before provision of the PHI to KCC did Gibson or Aetna request that KCC enact protective measures to safeguard the PHI of the Aetna/Coventry insureds. 20 21 22 23 24 25 Multiple Lawsuits and Governmental Investigations Result From Aetna’s Carelessness and Aetna Attempts to Settle. 77. been filed against Aetna based upon the disclosure of the HIV/AIDS status of the Aetna insureds, as follows:  Andrew Beckett v. Aetna, Inc. et al., Case No. 2:17-cv-03864 (E.D. Pa.) (the “Beckett Litigation”);  S.A. v. Aetna, Inc., Case No. BC674088 (Cal. Sup. Ct. L.A. Cty., Aug. 28, 2017), removed to U.S. District Court for the Central District of 26 27 28 From July 30, 3017 to the present, no fewer than ten lawsuits have VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 15 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 16 of 29 Page ID #:16 1 California, Case No. 17-cv-7264, transferred to U.S. District Court for the Eastern District of Pennsylvania, related to Case No. 2:17-cv03864 (“SA Litigation”)’ 2 3  R.H. v. Aetna Health, Inc., et al., Case No. 2:17-cv-04566-MMB (E.D. Pa.) (the “R.H. Litigation”);  Doe v. Aetna, Inc. et al., Case No. 3:17-cv-01947 (C.D. Cal.) (the “Doe 1 Litigation”);  Doe v. Aetna, Inc., Case No. 3:17-cv-5191 (N.D. Cal.) (the “Doe 2 Litigation”);  Doe v. Aetna, Inc. et al., Case No. 3:17-cv-1751 (D. Conn.) (the “Connecticut Litigation”); and  Doe v. Aetna, et al., Case No. 4:17-cv-929 (W.D. Missouri) (the “Missouri Litigation”); 13  D.L. v. Aetna, Inc. et al., Case No. 2:17-cv-8478 (C.D. Cal.); 14  Doe v. Aetna, et al., Case No. 17-cv-7167 (N.D. Cal.); and 15  Smith v. Aetna, Inc. et al., Case No. 2:17-cv-12668 (D. N.J.). 78. Moreover, the Office of Civil Rights of the Department of Health and 4 5 6 7 8 9 10 11 12 16 17 18 19 20 21 22 23 24 25 26 27 28 Human Services, which enforces HIPAA, has opened investigations related to the incident, and various state attorneys general have opened investigations of Aetna. 79. For instance, the New York Attorney General commenced an investigation pursuant to New York Executive Law Section 63(12) into “certain privacy breaches by Aetna, Inc. (‘Aetna’) through its mailing of material which improperly disclosed member Protected Health Information.” (The “NY AG Action.”) 80. In December 2017, Aetna reached a tentative settlement agreement in the Beckett Litigation and S.A. Litigation. Aetna agreed to resolve these lawsuits, as well as the Doe 1, Doe 2, R.H. and Connecticut Litigation, by paying a total of $17.16 million to the plaintiffs and providing certain non-monetary relief, including VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 16 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 17 of 29 Page ID #:17 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 implementing a “best practices” policy for use of PHI in litigation (the “Beckett Settlement”). See Beckett Settlement, attached as Exhibit D, at ¶¶ 4.1, 5.) 81. KCC was not named as a party in the Beckett Litigation and did not participate in any of the settlement discussions giving rise to the Beckett Settlement. 82. On or about January 19, 2018, Aetna reached a settlement of the NY AG Action with the New York Attorney General (the “NY AG Settlement”). (A copy of the January 19, 2018 NY AG Settlement is attached hereto as Exhibit E.) In the NY AG Settlement, Aetna agreed to pay a penalty to the State of New York totaling $1.15 million. (Ex. E ¶ 31.) 83. Aetna also agreed to modify its “Standard Operating Procedures for Print/Mailing Quality-Prevention of PHI/unwanted disclosures” and “Use of Protected Health Information in Litigation — Best Practices Policy” (the “Standard Operating Procedures”). (Id. ¶ 22.) 84. Aetna also agreed to provide the New York Attorney General with copies of audit and compliance reports and submit to monitoring by an independent consultant for a period of two years. (Id. ¶¶ 29, 30.) 85. Aetna’s agreement to modify its Standard Operating Procedures and subject itself to audit and compliance reporting with respect to prevention of unwanted disclosures of PHI and use of PHI in litigation demonstrates that the procedures Aetna had in place that it used in directing KCC to mail the Notices were inadequate. 86. Additionally, had Aetna implemented the new procedures earlier, this incident almost certainly would have never occurred. 87. For instance, Aetna has agreed to implement production attestations, procedures for making sure information is not inadvertently disclosed through an envelope window, training on print mailing procedures, process and control audits, 27 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 17 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 18 of 29 Page ID #:18 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 and other new practices and procedures, any of which could have and should have been implemented before this incident occurred. (Id. at ¶ 22). Aetna’s Additional , Repeated Failures to Protect the Privacy of Its Insureds 88. The NY AG Settlement acknowledged additional failures by Aetna to adequately protect the privacy of its insureds. 89. In September 2017, Aetna identified 163 members residing in New York to receive educational materials based on their Atrial Fibrillation (“AFib”) diagnosis. On September 25, 2017, Aetna sent each of these members a mailing containing such educational materials. (NY AG Settlement ¶ 16.) 90. Displayed on each envelope was the logo “IMPACT-AFIB,” which could have been interpreted as indicating that the recipient member had an AFib diagnosis. Aetna reported this incident to the OCR. (Id. ¶ 17.) 91. KCC was not involved in the AFib mailing. 92. Within 24 months of both of these incidents, Aetna reported three other breaches of unsecured health information to the Department of Health & Human Services (“HHS”). In total, these incidents reported by Aetna affected over 25,000 individuals. (Id. ¶ 18.) 93. For example, in April 2017, Aetna reported a data breach that exposed the PHI, including names, identification numbers, member numbers, provider information, claim payment amounts, dates of service, procedure codes, and service codes of thousands of its insureds. (See “Aetna Error Sees PHI of 5,000 Individuals Exposed Online, HIPAA JOURNAL June 27, 2017, attached as Exhibit F.) 94. KCC was not involved in any of the additional three incidents reported to HHS. 95. In addition, in December 2016, Aetna Signature Administrators (“ASA”) reported another incident that exposed the Social Security numbers of over 18,000 insureds. In this incident, an ASA employee mailed a CD containing 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 18 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 19 of 29 Page ID #:19 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 sensitive health plan members’ information to another ASA employee and the CD was lost. (See “Lost CD Contained Social Security Numbers of 18,854 Health Plan Members,” HIPAA JOURNAL, December 8, 2016, attached as Exhibit G.) 96. The CD contained birth dates, Social Security numbers, and in some instances, names and addresses of Aetna insureds. (Id.) 97. KCC was not involved in the above incident, either. Aetna Demands Contribution and/or Indemnification From KCC. 98. Notwithstanding the New York Attorney General’s recognition that Aetna failed to maintain adequate measures to protect any of the PHI that Aetna and Gibson provided to KCC, Aetna has demanded contribution and/or indemnification from KCC. 99. On October 11, 2017, Aetna, through its counsel, sent KCC’s counsel a letter demanding KCC to indemnify Aetna from and against “Losses” caused by or relating in any way to the “Incident.” 100. On October 17, 2017, KCC’s counsel responded to Aetna’s October 11 letter stating that KCC is not at fault or responsible for any “Losses” defined in the October 11 letter. KCC’s counsel explained in detail why Aetna as a Covered Entity under HIPAA and Gibson as Aetna’s BAA — not KCC — repeatedly failed to carry out their responsibility to maintain the privacy and security of the PHI of Aetna insureds. 101. For example: 22 23 24 25 26 27  Aetna, through its counsel Gibson, provided Aetna insured PHI to KCC without ensuring that a Qualified Protective Order was in place to govern transfer and handing of the PHI. Unbeknownst to KCC, Aetna had allowed the two Qualified Protective Orders in the two underlying putative class actions to expire. Because the Qualified Protective Orders had expired, Aetna and Gibson should have never provided the PHI to KCC in the first place without additional protective measures (for which Aetna and Gibson were responsible). 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 19 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 20 of 29 Page ID #:20 1  In the absence of such protective measures, Aetna and Gibson provided PHI to KCC without the consent of all insureds whose PHI was at issue, in violation of HIPAA. 2 3  In addition to failing to implement appropriate protective measures, Aetna and Gibson provided KCC far more PHI than was minimally necessary for KCC to perform its job function, further evidencing Aetna’s and Gibson’s insensitivity to HIPAA throughout the process. 4 5 6  Aetna and Gibson provided KCC PHI that was not encrypted in transmission, when the capabilities to encrypt were available to them, further demonstrating a lack of observation of the obligations to protect PHI under HIPAA. 7 8 9  10 Aetna and Gibson knew that windowed envelopes were being used for all the mailings in question. KCC provided samples of the letters to Aetna and Gibson, and those letters demonstrated that windowed envelopes would be used. Aetna and Gibson approved the form and content of the letters before they were transmitted 11 12 13  Neither Aetna nor Gibson ever expressed any concern to KCC about the privacy and security of the PHI in the letters or addressed special handling and mailing protocols. 14 15 16 102. In the October 17, 2017 letter, KCC declined Aetna’s demand for 17 18 19 20 21 22 23 24 25 26 27 28 contribution and/or indemnification of the “Losses” defined in the October 11, 2017 letter. 103. In the October 17, 2017 letter, KCC demanded pursuant to Section 8 of the KCC Agreement that Aetna hold harmless, defend, and indemnify KCC and any of its affiliates against any claims, fees, expenses, losses, damages, restitution, fines, penalties, injunctions, and/or any other relief, censure, or voluntary measures arising out of or related to this matter, any related regulatory proceedings, and/or any private litigation. 104. On January 8, 2018, the plaintiffs in the putative class action in the Missouri Litigation filed a motion for leave to file an Amended Complaint. In the proposed Amended Complaint, the plaintiffs specifically name KCC as a defendant. VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 20 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 21 of 29 Page ID #:21 1 2 In the proposed Amended Complaint, the plaintiffs seek liquidated damages, exemplary damages, attorneys’ fees and court costs against KCC. 3 4 105. On October 23, 2017, Aetna’s counsel rejected KCC’s indemnity demand. 5 6 106. Three months later, Aetna entered into the Beckett Settlement and the NY AG Settlement. 7 8 9 107. On January 19, 2018, Aetna, through its counsel, sent KCC’s counsel another letter requesting indemnification, reimbursement and/or contribution from KCC. 10 11 12 13 14 15 16 17 18 FIRST CAUSE OF ACTION (Breach of Contract and the Implied Covenant of Good Faith and Fair Dealing) 108. KCC incorporates Paragraphs 1 through 107 by reference as if fully set forth herein. 109. Aetna, through its agent and Business Associate Gibson, entered into a valid and legally enforceable Agreement with KCC. 110. The KCC Agreement and the indemnification provisions therein are valid and enforceable. 19 111. In exchange for its commitment to indemnify and hold KCC harmless 20 for any Losses (as defined in the KCC Agreement), Aetna received adequate and 21 sufficient consideration, including the Services provided by KCC in printing and 22 mailing the Notices and administering the settlement claims provided for in the 23 Doe/Coventry Settlement Agreement. 24 112. Aetna has breached the KCC Agreement by refusing to indemnify 25 KCC and by making a demand that KCC indemnify Aetna for losses relating to the 26 July and August 2017 mailings. 27 113. The foregoing breaches and continuing breaches have directly and 28 proximately caused and will continue to cause KCC damages, including, but not VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 21 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 22 of 29 Page ID #:22 1 2 3 4 5 limited to, KCC’s cost of defending the Missouri Litigation and defending against Aetna’s spurious demand for indemnification. Aetna has committed an egregious breach of the implied covenant of good faith and fair dealing attendant to any contract through Aetna’s attempt to improperly shift to KCC penalties imposed on Aetna. 6 SECOND CAUSE OF ACTION Negligence/Failure to Warn (in the alternative to the First Cause of Action) 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 114. KCC incorporates Paragraphs 1 through 107 by reference as if fully set forth herein. 115. Aetna, as a Covered Entity under HIPAA, owed a duty to provide KCC with PHI of the Aetna insureds who were to receive the Notices in a secure fashion with sufficient protective measures to maintain the security and privacy of the PHI of Aetna’s insureds. 116. Aetna owed a duty to KCC because harm was foreseeable to KCC resulting from Aetna’s and Gibson’s mishandling of the PHI and failure to properly monitor the mailing. 117. Aetna also owed a duty to KCC because it was certain KCC would suffer, and KCC did in fact suffer and will continue to suffer, monetary and reputational injury insofar as KCC was not compensated for its Services, Aetna has improperly shifted blame to KCC, KCC was named in the proposed Amended Complaint in the Missouri Litigation, and KCC’s name has appeared in negative media coverage about the Aetna mailing. 118. Aetna also owed a duty to KCC because there is a close connection between Aetna’s conduct and KCC’s injury insofar as KCC would not have been injured but for Aetna’s mishandling of the PHI and violations of HIPAA. 119. Additionally, Aetna owed a duty to KCC because the moral blame attached to Aetna’s malfeasance is high. 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 22 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 23 of 29 Page ID #:23 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 120. Aetna also owes a duty to KCC because there is a strong public policy in preventing Aetna from behaving in such a reckless, careless and negligent fashion and further preventing Aetna from shifting blame to others not responsible and offsetting penalties paid (including but not limited to the penalties paid pursuant to the NY AG Settlement). 121. Aetna further owes a duty to KCC because the burden on Aetna is minimal and the consequences in the community are positive as a result of imposing a duty on Aetna under these circumstances. Indeed, HIPAA already imposes a duty on Aetna to institute appropriate protective measures to maintain the safety and security of PHI. 122. Aetna also owes a duty to KCC because, upon information and belief, there is insurance available for this risk. Aetna, which reported revenues in excess of $63 billion in 2017 and recently announced its sale to CVS for $69 billion, can afford any damages awarded by the trier of fact. 123. Aetna, as a Covered Entity under HIPAA, knew or reasonably should have known that sending Aetna insureds’ PHI to KCC without consent from the Aetna insureds and without instituting appropriate protective measures were violations of HIPAA. 124. Aetna and Gibson knew that all of the recipients of the Notices had been diagnosed with HIV and/or AIDS or were taking medicine to help prevent HIV and/or AIDS. 125. Gibson and Aetna approved the form of the notices that KCC prepared at Gibson’s and Aetna’s direction, including the use of the windowed envelopes that exposed the HIV/AIDS drug information of the Aetna insureds. 126. Aetna knew or reasonably should have known that transmitting the PHI of the Aetna insureds — including their HIV/AIDS medication consumption — would cause harm to KCC if the PHI was disclosed publicly. 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 23 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 24 of 29 Page ID #:24 1 2 3 4 5 6 7 127. Through the NY AG Settlement, by agreeing to modify its “Standard Operating Procedures for Print/Mailing Quality-Prevention of PHI/unwanted disclosures” and “Use of Protected Health Information in Litigation — Best Practices Policy,” Aetna recognizes that Aetna’s procedures for printing and mailing PHI and using PHI in litigation were deficient and substandard. 128. Indeed, Aetna and Gibson failed to warn KCC of at least the following: 8 9 10  That the Qualified Protective Orders in the Doe Litigation and Coventry Litigation had expired on March 3 and March 6, 2017;  12 That Aetna and Gibson had failed to enact appropriate protective measures to ensure that the safety and security of the PHI that was the subject of the mailings would be maintained; 13  11 14 15 16 17 18 19 20 21 22 23 24 25 26 27 That in the absence of such protective measures, Aetna and Gibson provided PHI to KCC without the consent of all of the insureds whose PHI was at issue;  That Aetna and Gibson had provided KCC far more PHI than was minimally necessary for KCC to perform its job function;  That KCC should independently take any protective measures to ensure that the safety and security of the PHI of the insureds at issue would be maintained. 129. Aetna’s misconduct is an instance of misfeasance because Aetna created the risk by, inter alia, allowing the Qualified Protective Orders in the Doe Litigation and Coventry Litigation to expire, failing to enact appropriate protective measures in place of the Qualified Protective Orders, and failing to warn KCC that appropriate protective measures were not in place. 130. Aetna’s breaches of its duty to warn and duty of due care directly and proximately caused and will continue to cause KCC damages in an amount to be proven at trial and, including, but not limited, KCC’s cost of defending the 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 24 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 25 of 29 Page ID #:25 1 2 3 4 5 6 7 Missouri Litigation, responding to governmental investigations and inquiries, and defending against Aetna’s demand for indemnification. 131. Aetna’s conduct, in disregard of the rights of KCC, is part of an overall scheme and conspiracy, has been deliberate, willful, oppressive and malicious, is a clear effort by Aetna to avoid or offset any financial penalties or repercussions arising out of Aetna’s and Gibson’s violations of HIPAA and entitles KCC to exemplary damages pursuant to Section 3294(a) of the California Civil Code. 8 THIRD CAUSE OF ACTION (Quantum Meruit/Goods and Services Rendered) (In the Alternative to Count I) 9 10 11 12 13 14 15 16 17 18 19 20 21 132. KCC incorporates Paragraphs 1 through 107 by reference as if fully set forth herein. 133. Aetna and its agent, Gibson, requested that KCC provide services for the benefit of Aetna relating to the Notices. 134. Aetna agreed to pay KCC for the above services. 135. KCC provided the services to Aetna as requested by Aetna. 136. Aetna has failed to compensate KCC for the services it provided in connection with formatting and mailing the Notices. FOURTH CAUSE OF ACTION (Declaratory Judgment pursuant to 28 U.S.C. § 2201(a)) 137. KCC incorporates Paragraphs 1 through 107 by reference as if fully set forth herein. 22 138. KCC has a tangible legal interest in the prompt resolution of this 23 matter because it has incurred and continues to incur significant fees relating to its 24 defense of Aetna’s demand for indemnification, defense in the Missouri Litigation, 25 and other claims and investigations. 26 139. The indemnification provision in the KCC Agreement is a valid and 27 enforceable contract that requires Aetna to indemnify and hold KCC harmless for 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 25 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 26 of 29 Page ID #:26 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 any Losses (as defined in the KCC Agreement) relating to the July and August 2017 mailing that resulted in exposing the HIV/AIDS status of the Aetna insureds. 140. Aetna, through its agent Gibson, is a party to the KCC Agreement, and KCC took direction from and relied upon Gibson as a Client Party. 141. Aetna has rejected KCC’s request for indemnity pursuant to the KCC Agreement and has demanded that KCC indemnify and/or contribute to Aetna’s “Losses” as specified in the October 11, 2017 letter. 142. These circumstances present an actual and justiciable controversy between the parties that is not advisory, moot or premature. An immediate and definitive determination of the application and enforceability of the indemnification provision in the KCC Agreement is necessary to resolve the controversy and, thereby, clarify and settle the legal relations between the parties and afford relief from the uncertainty that has arisen from the controversy. WHEREFORE, KCC respectfully requests the Court to enter judgment in its favor on Count IV pursuant to Federal Rule of Civil Procedure 57, 28 U.S.C. § 2201(a), and award the following relief: (i) a declaratory judgment that the indemnification provision in the KCC Agreement is valid and enforceable; (ii) a declaratory judgment that Aetna is a party to the KCC Agreement; (iii) a declaratory judgment that KCC performed its obligations under the KCC Agreement; (iv) a declaratory judgment that Aetna is obligated to indemnify and hold KCC, its affiliates, members, directors, officers, employees, consultants, subcontractors and agents harmless from and against any and all losses, claims, damages, judgments and expenses (including reasonable counsel fees and expenses) resulting from, arising out of or related to KCC’s performance of Services relating to the mailing of the Notices pursuant to the Doe/Coventry Settlement Agreement. 18 19 20 21 22 23 24 25 26 27 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 26 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 27 of 29 Page ID #:27 1 (v) costs and expenses incurred in pursuing this action, including reasonable attorneys’ fees to the extent permitted by law; and (vi) such other relief as the Court deems just and proper. 2 3 4 5 6 7 FIFTH CAUSE OF ACTION (Declaratory Judgment Pursuant to 28 U.S.C. § 2201(a)) 143. KCC incorporates Paragraphs 1 through 107 by reference as if fully set forth herein. 8 144. KCC has a tangible legal interest in the prompt resolution of this 9 matter because it has incurred and continues to incur significant fees relating to its 10 defense of Aetna’s demand for indemnification, defense in the Missouri Litigation, 11 and other claims and investigations. 12 145. The indemnification provision in the KCC Agreement is a valid and 13 enforceable contract that requires Aetna to indemnify and hold KCC harmless for 14 any Losses (as defined in the KCC Agreement) relating to the July and August 15 2017 mailing that resulted in exposing the HIV/AIDS status of the Aetna insureds. 16 17 146. Aetna, through its agent Gibson, is a party to the KCC Agreement, and KCC took direction from and relied upon Aetna as a Client Party. 18 147. Aetna has rejected KCC’s request for indemnity pursuant to the KCC 19 Agreement and has demanded that KCC indemnify and/or contribute to Aetna’s 20 “Losses” as specified in the October 11, 2017 letter. 21 148. Instead, Aetna demanded that KCC indemnify, reimburse and/or 22 contribute to Aetna relating to, among other things, the $17.16 million payment 23 Aetna is obligated to make in connection with the Beckett Settlement, the 24 $1,150,000 penalty Aetna is obligated to make in connection with the NY AG 25 Settlement, and potential damages, penalties and fees relating to the remaining 26 putative class actions and “open investigations” Aetna’s counsel referred to in the 27 January 19, 2018 letter. 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 27 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 28 of 29 Page ID #:28 1 2 3 4 5 6 7 8 9 149. These circumstances present an actual and justiciable controversy between the parties that is not advisory, moot or premature. An immediate and definitive determination of the application and enforceability of the indemnification provision in the KCC Agreement is necessary to resolve the controversy and, thereby, clarify and settle the legal relations between the parties and afford relief from the uncertainty that has arisen from the controversy. WHEREFORE, KCC respectfully requests the Court to enter judgment in its favor on Count V pursuant to Federal Rule of Civil Procedure 57, 28 U.S.C. § 2201(a), and award the following relief: 10 11 (vii) a declaratory judgment that KCC has no obligation to provide indemnity, contribution and/or reimbursement to Aetna under any circumstances; 12 13 (viii) costs and expenses incurred in pursuing this action, including reasonable attorneys’ fees to the extent permitted by law; and 14 15 (ix) 16 such other relief as the Court deems just and proper. 17 PRAYER FOR RELIEF 18 (All Claims) 19 20 21 WHEREFORE, KCC respectfully requests the Court to enter judgment in its favor on all Causes of Action and award KCC the following relief: A. Compensatory, consequential, incidental, punitive and/or special 22 damages, in an amount to be determined at trial and in an amount 23 sufficient to have a deterrent effect on Aetna; 24 B. 25 Exemplary damages pursuant to Section 3294(a) of the California Civil Code; 26 C. Pre-judgment and post-judgment interest; 27 D. Costs of suit incurred herein, including reasonable attorneys’ fees and 28 expenses; VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 28 - COMPLAINT Case 2:18-cv-01018 Document 1 Filed 02/06/18 Page 29 of 29 Page ID #:29 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 E. Declaratory judgments as set forth above; and F. Such other and further relief as the Court deems just and proper. KCC hereby demands a trial by jury. Dated: February 6, 2018 KCC CLASS ACTION SERVICES, LLC By:/s/ Christopher R. Ramos Christopher R. Ramos VEDDER PRICE (CA), LLP Christopher R. Ramos (SBN 301556) cramos@vedderprice.com 125 Century Park East, Suite 1900 Los Angeles, California 90067 T: +1 424-204-7700 F: +1 424 204-7702 VEDDER PRICE P.C. Blaine C. Kimrey (to seek admission pro hac vice) bkimrey@vedderprice.com Jeanah Park (to seek admission pro hac vice) jpark@vedderprice.com 222 N. LaSalle Street Chicago, Illinois 60601 T: +1 312-609-7500 F: +1 312-609-5001 18 19 20 21 22 23 24 25 26 27 28 VEDDER PRICE (CA), LLP ATTORNEYS AT LAW LOS ANGELES - 29 - COMPLAINT