Health Net 2013 Annual Report Download - page 57

55
We are a defendant in three related litigation matters pending in California state and federal courts relating to
information security issues. On January 21, 2011, International Business Machines Corp. ("IBM"), which handles our
data center operations, notified us that it could not locate several hard disk drives that had been used in our data center
located in Rancho Cordova, California. We have since determined that personal information of approximately two
million former and current Health Net members, employees and health care providers is on the drives. Commencing on
March 14, 2011, we provided written notification to the individuals whose information is on the drives. To help protect
the personal information of affected individuals, we offered them two years of free credit monitoring services, in
addition to identity theft insurance and fraud resolution and restoration of credit files services, if needed.
On March 18, 2011, a putative class action relating to this incident was filed against us in the U.S. District Court
for the Central District of California (the "Central District of California"), and similar actions were later filed against us
in other federal and state courts in California. A number of those actions were transferred to and consolidated in the
U.S. District Court for the Eastern District of California (the "Eastern District of California"), and the two remaining
actions are currently pending in the Superior Court of California, County of San Francisco ("San Francisco County
Superior Court") and the Superior Court of California, County of Sacramento ("Sacramento County Superior Court").
The consolidated amended complaint in the federal action pending in the Eastern District of California was filed on
behalf of a putative class of over 800,000 of our current or former members who received the written notification, and
also named IBM as a defendant. It sought to state claims for violation of the California Confidentiality of Medical
Information Act and the California Customer Records Act, and sought statutory damages of up to $1,000 for each class
member, as well as injunctive and declaratory relief, attorneys’ fees and other relief. On August 29, 2011, we filed a
motion to dismiss the consolidated complaint. On January 20, 2012, the district court issued an order dismissing the
consolidated complaint on the grounds that the plaintiffs lacked standing to bring their action in federal court. On
April 20, 2012, an amended complaint with a new plaintiff was filed against us, but no longer asserted claims against
IBM. The amended complaint asserted the same causes of action and sought the same relief as the earlier complaint. On
June 18, 2012, we filed a motion to dismiss the amended complaint, which is currently pending.
The San Francisco County Superior Court proceeding was instituted on March 28, 2011 and is brought on behalf
of a putative class of California residents who received the written notification, and seeks to state similar claims against
us, as well as claims for violation of California's Unfair Competition Law, and seeks similar relief. We moved to compel
arbitration of the two named plaintiffs’ claims. The court granted our motion as to one of the named plaintiffs and
denied it as to the other. We have appealed the latter ruling, but subsequently dismissed the appeal. Thereafter, the
plaintiff as to whom our motion to compel arbitration was granted filed a petition for a writ of mandate with the
California Court of Appeal seeking review of that ruling. On July 9, 2012, the Court of Appeal issued a peremptory writ
of mandate directing the Superior Court to vacate its order granting the motion to compel arbitration and to enter an
order denying the motion to compel.
The Sacramento County Superior Court proceeding was instituted on April 3, 2012 and is brought on behalf of a
putative class of California members whose information was contained on the unaccounted for drives. The action
contains the same claims and seeks the same relief as the case pending in the Eastern District of California. On June 18,
2012, we filed a demurrer seeking dismissal of this complaint, which is currently pending.
In July 2013, we entered into a settlement agreement (the “Settlement Agreement”) with the plaintiffs in the three
putative class actions described above. On October 23, 2013, counsel for the named plaintiffs filed a motion for
preliminary approval of the Settlement Agreement with the Sacramento County Superior Court. The Court granted that
motion on November 21, 2013, and has scheduled the final approval hearing for June 4, 2014. On January 21, 2014,
notices were sent to class members advising them of the Settlement Agreement and providing them with information
regarding the benefits available to them, as well as their rights to object or opt out of the Settlement Agreement. In the
event the Settlement Agreement receives final approval, each of the three putative class actions described above will be
dismissed with prejudice, and all class members who do not opt out will release all claims they may have related to or
arising from the unaccounted-for server drives. Under the terms of the Settlement Agreement, which would cover all
individuals whose personal information was identified as being on the unaccounted-for server drives, class members
who did not previously accept our offer of the credit monitoring and related services described above would be eligible
to receive such credit monitoring and related services for a period of two years at no cost to them. Class members who
previously accepted our original offer would be eligible to receive one additional year of such services. In addition,
under the Settlement Agreement, class members would be eligible to receive reimbursement for certain unreimbursed
losses arising from identity theft during a specified time period, up to a cap of $50,000 per class member, and $2
million in the aggregate. The Settlement Agreement also provides that we will continue our ongoing activities to
enhance our information security measures, including the encryption of data at rest on our servers and storage area
networks. We will also be responsible for the payment of the award by the Sacramento County Superior Court of
approximately $2.3 million in fees and expenses to plaintiffs' counsel for the three class actions described above.