Koegler v. Munson Healthcare

UNITED STATES DISTRICT COURT
WESTERN DISTRICT OF MICHIGAN
SOUTHERN DIVISION
JUDITH KOEGLER,
Plaintiff,
v.
MUNSON HEALTHCARE,
Defendant.
___________________________________/
Case No. 1:26-cv-803
Hon. Hala Y. Jarbou
OPINION
Before the Court are two putative class actions against Defendant Munson Healthcare
related to its handling of patients’ healthcare data. Plaintiff Terri Gerhart is the named plaintiff in
Gerhart v. Munson Healthcare, No. 1:26-cv-775 (W.D. Mich.) (“Gerhart”). 	Plaintiff Judith
Koegler is the named plaintiff in Koegler v. Munson Healthcare, No. 1:26-cv-803 (W.D. Mich.)
(“Koegler”). Both actions were originally filed in state court, but Munson removed here under 28
U.S.C. § 1441, claiming that the Court has jurisdiction under the Class Action Fairness Act
(CAFA), 28 U.S.C. § 1332(d). Munson then moved to transfer both actions to the Western District
of Missouri, which is where Munson’s electronic health records vendor, non-party Cerner
Corporation, is based. 	It is also where dozens of other putative class actions are pending in a
consolidated proceeding, which involves not only claims against Cerner but also against other
hospitals that used Cerner’s services.
In the two actions before the Court, Plaintiffs move to remand the actions to state court,
arguing that the home-state exception to CAFA jurisdiction applies. 	Plaintiffs also oppose
Munson’s motions to transfer venue. 	For the following reasons, the Court will deny Munson’s
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 1
of 11

2
motions to transfer venue and order Munson to show cause as to the composition of the class to
determine whether CAFA’s home-state exception applies.
I. BACKGROUND
Munson is a non-profit healthcare system with locations across northern Michigan. It is
incorporated in Michigan and has its principal place of business in Traverse City, Michigan. Like
Munson, Plaintiffs Gerhart and Koegler are citizens of Michigan. On January 12, 2026, Munson
sent letters to Plaintiffs explaining that their personal information may have been breached when
“an unauthorized third party gained access to and obtained data that was maintained by an
electronic health record (EHR) vendor, Cerner.” (Gerhart, Compl. ¶ 5, ECF No. 1-1; see Koegler,
Compl. ¶ 4, ECF No. 1-1.) On February 2 and 11, 2026, respectively, Gerhart and Koegler filed
complaints against Munson in Grand Traverse County Circuit Court. 	Both asserted claims for
negligence, negligence per se, breach of implied contract, and unjust enrichment. 	Koegler also
asserted claims for breach of fiduciary duty and negligent training, hiring, and supervision.
Both Gerhart and Koegler claim to represent a class of people affected by the data breach.
Gerhart defines her proposed class of plaintiffs as: “All individuals within the United States whose
[personally identifiable information (PII)] and/or [protected health information (PHI)] were
identified as compromised in the Data Breach.” (Gerhart, Compl. ¶ 80.) Gerhart uses the phrase
“Data Breach” to refer to the “recent data security incident and data breach that was perpetrated
against [Munson],” which held Plaintiffs’ PII and PHI in its possession. (Id. ¶ 2.)
Koegler defines her class along similar lines: “All individuals whose PII/PHI may have
been accessed and/or acquired in the Data Breach, including all those individuals who received
Notice of Data Breach letters.” (Koegler, Compl. ¶ 150.) Koegler defines “Data Breach” to mean
the data breach that resulted from “[Munson’s] negligent failure” to protect the class members’
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 2
of 11

3
information. (Id. ¶ 1.) And “Notice of Data Breach letter” refers to the letter that Munson sent to
those potentially affected by the data breach. (Id. ¶ 33.)
Before Plaintiffs filed their complaints in state court, federal courts were already handling
putative class actions related to the data breach involving Cerner. Dozens of actions have been
filed in or transferred to the Western District of Missouri, where Cerner is based. One of those
actions, Thomas v. Cerner Corp., No. 1:26-cv-331 (W.D. Mich.), was filed in this Court against
both Cerner and Munson. The parties in that case all consented to transfer to the Western District
of Missouri, so the Court transferred the case there, where it is now pending as part of a
consolidated proceeding.
On March 10 and 12, 2026, respectively, Munson removed Gerhart and Koegler’s proposed
class actions to this Court. (Gerhart, Notice of Removal, ECF No. 1; Koegler, Notice of Removal,
ECF No. 1.) On March 17, 2026, Munson moved to transfer each case to the Western District of
Missouri. Unlike the plaintiff in Thomas, however, Gerhart and Koegler oppose transfer.
On March 31, 2026, Gerhart and Koegler moved to remand their cases to state court.
(Gerhart, Mot. to Remand, ECF No. 11; Koegler, Mot. to Remand, ECF No. 15.) Munson argues
that remand is not warranted. 	The parties’ briefings in both cases are nearly identical to one
another, so the Court addresses the motions in both cases together.
II. DISCUSSION
A. Order of the Motions
The Court has discretion to decide which of these motions (transfer or remand) to answer
first. 	See Lalewicz v. WarnerMedia Direct, LLC, 742 F. Supp. 3d 781, 787 (E.D. Tenn. 2024)
(“The Court is not required to decide the motion to remand before the motion to transfer, and courts
regularly transfer cases instead of deciding motions to remand when related cases are pending in
the transferee district.”) Although the parties agree that the Court has this discretion, they disagree
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 3
of 11

4
about how it should use it. 	Plaintiffs argue that the Court should decide remand first to avoid
transferring a case lacking subject-matter jurisdiction. Munson argues that the Court should decide
transfer first to avoid the risk of outcomes that are inconsistent with similar cases before the
Western District of Missouri and to preserve judicial economy.
The Sixth Circuit does not provide any guidance on which decision should come first, so
the Court instead relies on a test used in the Eastern District of Tennessee, which effectively
balances the parties’ concerns in these cases:
Deciding a motion to transfer venue before a motion to remand is particularly
appropriate where a related suit is already pending in the transferee district, the
remand motion will not suffer any prejudice as a result of the transfer, and transfer
at this juncture permits the court who would ultimately try the case to rule on the
remand motion.
Jabo’s Pharm., Inc. v. Cephalon, Inc., No. 2:09-CV-289, 2010 WL 3851966, at *1 (E.D. Tenn.
Sept. 27, 2010) (quoting Doubletree Partners, L.P. v. Land Am. Am. Title Co., No. 3-08-CV-1547-
O, 2008 WL 5119599, at *2 (N.D. Tex. Dec. 3, 2008)).
Here, a related suit, Thomas, is already pending before the transferee court. And if these
cases are transferred, it will be up to the Western District of Missouri to decide whether remand is
warranted. Plaintiffs have not argued that their remand motions would be prejudiced if decided in
the Western District of Missouri, so that factor is at most neutral. After all, there is no reason to
believe that the transferee court would decide the issue any differently from this Court.
Accordingly, based on these considerations, the Court will address Munson’s motions to transfer
first.
B. Motions to Transfer
“For the convenience of parties and witnesses, in the interest of justice, a district court may
transfer any civil action to any other district or division where it might have been brought or to
any district or division to which all parties have consented.” 28 U.S.C. § 1404(a). The moving
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 4
of 11

5
party bears the burden of proof to show why a court should transfer the action absent the consent
of all other parties. See Cincinnati Ins. Co. v. O’Leary Paint Co., Inc., 676 F. Supp. 2d 623, 630
(W.D. Mich. 2009). That burden includes proving that the transferee court is a court where the
action “might have been brought,” meaning that, at the time the action was filed, the proposed
transferee district would have been able to exercise personal jurisdiction over the defendant. See
Hoffman v. Blaski, 363 U.S. 335, 343–44 (1960); Bunting ex rel. Gray v. Gray, 2 F. App’x 443,
448 (6th Cir. 2001); see also 15 Wright & Miller’s Federal Practice and Procedure § 3845 (4th ed.
2019) (“[T]he transferee court must be a proper venue and must have personal jurisdiction over
the defendant.”); Manual on Complex Litigation (Fourth) § 10.123 (“Other courts can transfer
cases . . . to the consolidation court, but only if personal jurisdiction and venue lie in the transferee
forum.”). Notably, the power to transfer does not depend upon whether the defendant is willing
to accept personal jurisdiction in the transferee court. Hoffman, 363 U.S. at 343–44.
Personal jurisdiction may be general or specific. 	General personal jurisdiction over a
corporation exists in its state of incorporation, its principal place of business, and, in the
exceptional case, wherever a corporation’s contacts are “so substantial and of such a nature as to
render [it] at home.” BNSF Ry. Co. v. Tyrrell, 581 U.S. 402, 413 (2017) (quoting Daimler AG v.
Bauman, 571 U.S. 117, 139 n.19 (2014)). Here, Munson is neither incorporated in Missouri nor
does it have its principal place of business there, so general personal jurisdiction is not applicable.
Specific personal jurisdiction exists when a non-resident defendant satisfies two separate
prerequisites. First, the forum state’s long-arm statute must be satisfied. Viasystems, Inc. v. EBM–
Papst St. Georgen GmbH, 646 F.3d 589, 593 (8th Cir. 2011). Second, the court must determine
whether the defendant has sufficient contacts with the forum state to satisfy the due process
concerns of the Fourteenth Amendment. Miller v. Nippon Carbon Co., 528 F.3d 1087, 1090 (8th
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 5
of 11

6
Cir. 2008). Part of the Constitutional analysis includes an assessment of whether the defendant
purposefully availed itself of the transferee court’s forum state:
The purposeful availment requirement ensures that a defendant will not be haled
into a jurisdiction solely as the result of random, fortuitous, or attenuated contacts
or of the unilateral activity of another party or a third person. For a State to exercise
jurisdiction consistent with due process, the defendant’s suit-related conduct must
create a substantial connection with the forum State.
Mitchell v. Eli Lilly and Co., 159 F. Supp. 3d 967, 974 (E.D. Mo. 2016) (citations omitted).
In its motion, Munson fails to argue that a Missouri court would have had specific personal
jurisdiction over it. This failure aside, Munson highlights two facts that could support personal
jurisdiction in Missouri: (1) the breached data was stored by Cerner, a Missouri-based company,
and (2) an action against Munson is now pending in the Missouri-based consolidated proceedings.
Even assuming that the facts alleged here satisfy Missouri’s long-arm statute, neither fact is
sufficient to show that Munson purposefully availed itself of Missouri so as to create a substantial
connection with the state.
It is true that Cerner is a Missouri-based company, but “a defendant’s relationship with
a . . . third party, standing alone, is an insufficient basis for jurisdiction.” Walden v. Fiore, 571
U.S. 277, 286 (2014). What matters is the relationship between the defendant and the forum state.
Bristol-Myers Squibb Co. v. Super. Ct. of Cal., 582 U.S. 255, 268 (2017). It is not alleged that
Munson engaged in relevant acts together with Cerner in Missouri. Nor is it alleged that Munson
is derivatively liable for Cerner’s conduct in Missouri. 	See id. (analyzing relationship between
defendant and third party). 	Moreover, a “contract with an out-of-state party alone” does not
establish sufficient minimum contacts with the other state. Burger King Corp. v. Rudzewicz, 471
U.S. 462, 478 (1985).
It is also true that there is an action similar to these cases pending against Munson in the
Western District of Missouri because Munson agreed to have the case transferred to that district.
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 6
of 11

7
But consent to be sued in one action in the transferee forum does not create personal jurisdiction
in another later action. See Simpson v. Wright Med. Grp., Inc., No. 5:17-CV-00062-KGB, 2018
WL 1570795, at *6 (E.D. Ark. Mar. 30, 2018) (“Consent to a forum’s personal jurisdiction in a
prior case does not, by itself, constitute indefinite consent to be haled into court in that
jurisdiction.”) (collecting cases). And even if it did, that consent must exist at the time the action
is filed, not after. See Hoffman, 363 U.S. at 342–43. Here, Plaintiffs filed their cases before the
parties in Thomas agreed to transfer that case to Missouri. The presence of that case in Missouri
then fails to support any potential argument in favor of transferring the cases before this Court.
In short, Munson has not met its burden of showing that transfer is warranted. Accordingly,
its motions to transfer will be denied.
C. Motions to Remand
Munson argues that the Court has subject-matter jurisdiction over these cases under CAFA.
That statute permits the Court to exercise jurisdiction when: (1) a case has minimal diversity of
citizenship; (2) the proposed class has at least 100 putative members; and (3) the aggregate amount
in controversy exceeds $5 million dollars. 	See 28 U.S.C. § 1332(d); Dart Cherokee Basin
Operating Co., LLC v. Owens, 574 U.S. 81, 84–85 (2014). 	The removing party must establish
each element by a preponderance of the evidence to show that federal jurisdiction is proper. Smith
v. Nationwide Prop. & Cas. Ins. Co., 505 F.3d 401, 404 (6th Cir. 2007).
In these cases, the parties agree that the second and third elements are met, but they dispute
the first element, minimal diversity. 	Parties are minimally diverse from each other when “any
member of a class of plaintiffs is a citizen of a State different from any defendant.” 	28 U.S.C.
§ 1332(d)(2)(B). 	In affidavits attached to its responses, Munson’s Chief Security Officer states
that Munson sent data-breach notices to thousands of citizens from states outside of Michigan.
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 7
of 11

8
(Gerhart, Olmsted Aff. ¶ 5, ECF No. 15-1; Koegler, Olmsted Aff. ¶ 5, ECF No. 16-1.) Therefore,
CAFA’s minimal-diversity requirement is satisfied.
That said, Plaintiffs argue that the Court must decline subject-matter jurisdiction under
CAFA’s home-state exception. 	Plaintiffs bear the burden of demonstrating that this exception
applies. 	See Brown v. Paducah & Louisville Ry., Inc., No. 3:12–CV–00818–CRS, 2013 WL
5273773 (W.D. Ky. Sep. 17, 2023) (collecting cases). Under the exception, a district court “shall
decline to exercise jurisdiction” when “two-thirds or more of the members of all proposed plaintiff
classes in the aggregate, and the primary defendants, are citizens of the State in which the action
was originally filed.” 28 U.S.C. § 1332(d)(4)(B). The Sixth Circuit interprets the term “citizen”
in CAFA exceptions “as being equivalent to ‘domicile.’” 	Mason v. Lockwood, Andrews &
Newnam, P.C., 842 F.3d 383, 390 (6th Cir. 2016). 	There is a rebuttable presumption that a
person’s residence is their domicile. Id.
Plaintiffs argue that the facts here support an inference that more than two-thirds of the
class members are Michigan citizens:
Munson operates a system of eight community hospitals located exclusively in
northern 	Michigan 	and 	provides 	northern 	Michigan 	residents 	access 	to
sophisticated diagnostic treatment services that require continuity of care. 	The
proposed 	class 	is 	comprised 	of 	Munson’s 	patients, 	who 	provided 	Private
Information to Munson in order to receive those services. In other words, Munson
is a regional health care provider serving an inherently local population.
(Gerhart, Mot. to Remand 8–9 (internal citations omitted); Koegler, Mot. to Remand 8–9 (same).)
Plaintiffs have a point. Patients are likely to seek medical care at a location that is close to
where they live. 	Also, many health insurance plans operate with a network of providers; those
networks are more likely to include local medical providers than providers in other states. That
said, the state where one receives medical care is not as strong an indicator of domicile as
residence. 	It is not unusual for patients to travel out of state to receive care (though it may be
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 8
of 11

9
unusual to travel from out of state to northern Michigan for care). Also, it is possible that Munson
maintains patient information for individuals who left the state after receiving services at its
facilities. Indeed, Munson itself asserts that it sent its data breach notices to all 50 states. Thus, it
is possible that less than two-thirds of the proposed class members are Michigan citizens.
In these circumstances, some additional discovery is warranted to determine whether the
home-state exception applies. 	For instance, Plaintiffs request discovery of the addresses where
Munson sent its data-breach notices.1 If Munson sent a notice to a Michigan address for a patient
who received services from Munson, that address would be enough to infer Michigan citizenship
for the recipient. Courts routinely use this type of information to infer citizenship for the sake of
CAFA. See, e.g., Christensen v. St. Elizabeth Med. Ctr., Inc., No. 219-CV-0043-WOBCJS, 2020
WL 3491371, at *7 (E.D. Ky. June 26, 2020) (inferring citizenship of the proposed class using
addresses where defendant sent data-breach notices); Bey v. SolarWorld Industries Am., Inc., 904
F. Supp. 2d 1103, 1105 (D. Or. 2012) (inferring citizenship of the proposed class from employees’
addresses at the time they worked for defendant); Singh v. IQ Data, No. C22-418RSM, 2022 WL
5133744, at *2–3 (W.D. Wash. Oct. 5, 2022) (inferring citizenship of the proposed class from a
list of plaintiffs’ last-known addresses).
Still, Munson argues that Plaintiffs’ proposed discovery would be unworkable because the
proposed classes include members that have no relationship with Munson. Munson believes that
Plaintiffs intend to certify classes that include everyone affected by the underlying data breach
involving Cerner. Munson argues that it cannot provide information about all those individuals.
1 Plaintiffs claim they have already requested this information from Munson, but Munson has refused to provide it.
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page 9
of 11

10
Munson’s concern is unfounded. Plaintiffs here sued Munson alone based on the actions
it took (or did not take) with respect to the storage and security of its own patients’ information.2
True, Plaintiffs’ classes are not limited to residents of a single state. 	But they are necessarily
limited to current and former patients of Munson. Plaintiffs sue Munson because the data breach
involved private health information in Munson’s possession (Gerhart, Compl. ¶ 2), that Plaintiffs
allegedly provided to Munson (Koegler, Compl. ¶ 10).3 Plaintiffs claim that Munson had a duty
to safeguard this information, which only makes sense for information that Munson received and
maintained for its own patients.
Finally, Munson argues that, even if Plaintiffs’ claims are limited to its patients, the Court
should “pierce the pleadings” and interpret the complaint in a way where the class encompasses
all those affected by the underlying breach against Cerner. 	Munson explains that “piercing the
pleadings” here would be consistent with CAFA’s primary purposes: to prevent plaintiffs’ attempts
to defeat federal jurisdiction, to consolidate “copycat” lawsuits before a single court, and to place
“the determination of more interstate class action lawsuits in the proper forum—the federal
courts.” Freeman v. Blue Ridge Paper Prods., Inc., 551 F.3d 405, 408 (6th Cir. 2008) (quoting S.
Rep. No. 109-14) (citation modified).
But CAFA does not give courts carte blanche to exercise federal jurisdiction whenever
there are multiple, overlapping lawsuits. The Court must follow the text of the statute, including
the home-state exception. Also, it is not clear that these cases are copycat lawsuits or are among
the interstate class actions that Congress intended to give to federal courts when it drafted CAFA.
2 None of the parties argue that joining Cerner or some other third party is necessary for the just adjudication of these
cases. Glancy v. Taubman Centers, Inc., 373 F.3d 656, 665–77 (6th Cir. 2004) (explaining how joinder under Rule
19 of the Federal Rules of Civil Procedure impacts parties’ attempts to manipulate federal jurisdiction).
3 Koegler’s proposed class definition also includes those who received “Notice of Data Breach letters,” a phrase that
refers to the letters sent by Munson. (Koegler, Compl. ¶¶ 33, 150.)
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page
10 of 11

11
Plaintiffs—Michigan residents—have sued a single defendant that is also located in Michigan,
based on their theory that Munson bears responsibility for the data breach. By contrast, most of
the cases in Missouri concern Cerner’s conduct. Yet Plaintiffs here elected not to sue Cerner. As
the “masters of their complaint,” Plaintiffs “can choose whom they want to sue” even after CAFA.
Roberts v. Mars Petcare US, Inc., 874 F.3d 953, 958 (6th Cir. 2017); see also Royal Canin U.S.A.,
Inc. v. Wullschleger, 604 U.S. 22, 35 (2025) (“[Plaintiff] gets to determine which substantive
claims to bring against which defendants. And in so doing, [Plaintiffs] can establish—or not—the
basis for a federal court’s subject matter jurisdiction.”). Given that choice, the Court must evaluate
whether the home-state exception applies and, accordingly, whether remand is appropriate.
III. CONCLUSION
For the reasons above, the Court will deny Munson’s motions to transfer venue. The Court
will also order Munson to show cause no later than June 14, 2026, as to whether this action should
be remanded to state court pursuant to 28 U.S.C. § 1332(d)(4)(B). To show cause, Munson will
be directed to disclose to the Court by affidavit the total number of individuals to whom it sent a
data breach notice, as well as the total number of those individuals who were sent a notice at a
Michigan address.
An order will enter consistent with this Opinion.
Dated: June 3, 2026 	/s/ Hala Y. Jarbou
HALA Y. JARBOU
CHIEF UNITED STATES DISTRICT JUDGE
Case 1:26-cv-00803-HYJ-RSK ECF No. 21, PageID.<pageID> Filed 06/03/26 Page
11 of 11