PAGE 1 – OPINION AND ORDER

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF OREGON

IN RE: PREMERA BLUE CROSS 

CUSTOMER DATA SECURITY BREACH 

LITIGATION

This Document Relates to All Actions.

Case No. 3:15-md-2633-SI

OPINION AND ORDER

Kim D. Stephens, Christopher I. Brain, Chase C. Alvord, and Jason T. Dennett, TOUSLEY BRAIN 

STEPHENS PLLC, 1700 Seventh Avenue, Suite 2200, Seattle, WA 98101; Keith S. Dubanevich 

and Steve D. Larson, STOLL STOLL BERNE LOKTING & SHLACHTER PC, 209 SW Oak Street, 

Portland, OR 97204; Tina Wolfson, AHDOOT AND WOLFSON PC, 1016 Palm Avenue, West 

Hollywood, CA 90069; James Pizzirusso, HAUSFELD LLP, 1700 K Street NW, Suite 650, 

Washington, DC 20006; and Karen Hanson Riebel, LOCKRIDGE GRINDAL NAUEN PLLP, 100

Washington Avenue South, Suite 2200, Minneapolis, MN 55401. Of Attorneys for Plaintiffs.

Paul G. Karlsgodt, BAKERHOSTETLER LLP, 1801 California Street, Suite 4400, Denver, CO 

80202; James A. Sherer, BAKERHOSTETLER LLP, 45 Rockefeller Plaza, New York, NY 10111; 

Daniel R. Warren and David A. Carney, BAKERHOSTETLER LLP, 127 Public Square, Suite 2000, 

Cleveland, OH 44114; and Darin M. Sands, LANE POWELL PC, 601 SW Second Avenue, 

Suite 2100, Portland, OR 97204. Of Attorneys for Defendant Premera Blue Cross.

Michael H. Simon, District Judge.

Plaintiffs bring this putative class action against Defendant Premera Blue Cross

(“Premera”), a healthcare benefits servicer and provider. On March 17, 2015, Premera publicly 

disclosed that its computer network had been breached. Plaintiffs allege that this breach 

compromised the confidential information of approximately 11 million current and former 
PAGE 2 – OPINION AND ORDER

members, affiliated members, and employees of Premera. The compromised confidential 

information includes names, dates of birth, Social Security Numbers, member identification 

numbers, mailing addresses, telephone numbers, email addresses, medical claims information, 

financial information, and other protected health information (collectively, “Sensitive 

Information”). According to Plaintiffs, the breach began in May 2014 and went undetected for 

nearly a year. Plaintiffs allege that after discovering the breach, Premera unreasonably delayed in 

notifying all affected individuals. Based on these allegations, among others, Plaintiffs bring 

various state common law claims and state statutory claims.

Before the Court is Plaintiffs’ motion to compel. Plaintiffs request an order requiring 

Premera to produce certain documents, described by category, that Premera has withheld based 

on assertions of attorney-client privilege or protection under the attorney work-product doctrine. 

For the reasons discussed below, Plaintiffs’ motion is granted in part and denied in part.

STANDARDS

A. Applicable Law

Plaintiffs originally argued that Oregon law, as the law of the forum state, applies to the 

parties’ dispute regarding the scope of the attorney-client privilege. Premera responds that 

Washington law applies. In supplemental briefing, Plaintiffs concede that there is no material 

conflict between Oregon and Washington law on the specific issues of attorney-client privilege 

relevant to the pending motion. Thus, Plaintiffs do not oppose the application of Washington 

law. The parties also agree that federal law governs the work-product doctrine in federal court.

B. Attorney-Client Privilege

Washington law recognizes that “in our open civil justice system, parties may obtain 

discovery regarding any unprivileged matter that is relevant to the subject matter of the pending 

action” and that the attorney-client privilege is “an exception to the general duty to disclose.” 
PAGE 3 – OPINION AND ORDER

Newman v. Highland Sch. Dist. No. 203, 186 Wash.2d 769, 777 (2016). “A party claiming that 

otherwise discoverable information is exempt from discovery on grounds of the attorney-client 

privilege carries the burden of establishing entitlement to the privilege.” Id. In Newman, the 

Washington Supreme Court explained the attorney-client privilege as follows:

Washington’s attorney-client privilege provides that “[a]n attorney 

or counselor shall not, without the consent of his or her client, be 

examined as to any communication made by the client to him or 

her, or his or her advice given thereon in the course of professional 

employment.” RCW 5.60.060(2)(a). But the attorney-client 

privilege does not automatically shield any conversation with any 

attorney. To qualify for the privilege, communications must have 

been made in confidence and in the context of an attorney-client 

relationship. It is a narrow privilege and protects only 

communications and advice between attorney and client. The 

privilege extends to corporate clients and may encompass some 

communications with lower level employees, as both the United 

States Supreme Court and this court have recognized.

The attorney-client privilege does not shield facts from discovery, 

even if transmitted in communications between attorney and client. 

Rather, only privileged communications themselves are protected 

in order to encourage full and frank communication between 

attorneys and their clients and thereby promote broader public 

interests in the observance of law and administration of justice. 

The attorney-client privilege recognizes that sound legal advice or 

advocacy serves public ends and that such advice or advocacy 

depends upon the lawyer being fully informed by the client. 

However, because the privilege sometimes results in the exclusion 

of evidence which is otherwise relevant and material, contrary to 

the philosophy that justice can be achieved only with the fullest 

disclosure of the facts, the privilege cannot be treated as absolute; 

rather, it must be strictly limited to the purpose for which it exists.

Id. at 777-78 (quotation marks and citations omitted) (alteration in original).

It is well accepted that “[t]he attorney client privilege is limited to information related to 

obtaining [legal] advice.” Mechling v. City of Monroe, 152 Wash. App. 830, 853 (2009). The 

privilege “applies to any information generated by a request for legal advice, including 

documents created by clients with the intention of communicating with their attorneys.” Doehne 
PAGE 4 – OPINION AND ORDER

v. EmpRes Healthcare Mgmt., LLC, 190 Wash. App. 274, 281 (2015). It does not, however,

“protect documents that are prepared for some other purpose than communicating with an 

attorney.” Morgan v. City of Fed. Way, 166 Wash.2d 747, 755 (2009) (quotation marks omitted).

Thus, “a document prepared for a purpose other than or in addition to obtaining legal advice and 

intended to be seen by persons other than the attorney, does not become subject to the privilege 

merely by being shown to the attorney.” Mechling, 152 Wash. App. at 853 (emphasis added). 

Further, “if a portion of a document is not covered by the attorney-client privilege, under the 

civil rules of discovery it must be disclosed.” Id.

In evaluating assertions of the attorney-client privilege in a corporate setting, the 

Washington Supreme Court has adopted the U.S. Supreme Court’s “flexible” approach set forth 

in Upjohn Co. v. United States, 449 U.S. 383 (1981). See Newman, 186 Wash.2d at 779. This 

analysis allows non-managerial employees to qualify as the “client” for purposes of privilege 

protection, based on considerations including:

whether the communications at issue (1) were made at the 

direction of corporate superiors, (2) were made by corporate 

employees, (3) were made to corporate counsel acting as such, 

(4) concerned matters within the scope of the employee’s duties, 

(5) revealed factual information not available from upper-echelon 

management, (6) revealed factual information necessary to supply 

a basis for legal advice, and whether the communicating employee 

was sufficiently aware that (7) he was being interviewed for legal 

purposes, and (8) the information would be kept confidential.

Id. at 778-779 (quotation marks omitted). The corporate attorney-client privilege, however, does 

not extend to former employees. Id. at 779.

C. Work-Product Doctrine

The work-product doctrine “is not a privilege but a qualified immunity protecting from 

discovery documents and tangible things prepared by a party or his representative in anticipation 

of litigation.” Admiral Ins. Co. v. U.S. Dist. Court for the Dist. of Ariz., 881 F.2d 1486, 1494 (9th 
PAGE 5 – OPINION AND ORDER

Cir. 1989) (citing Fed. R. Civ. P. 26(b)(3)). Documents or the compilation of materials prepared 

by agents of the attorney in preparation for litigation may be covered by the work-product 

doctrine. U. S. v. Richey, 632 F.3d 559, 567 (9th Cir. 2011). To qualify for work-product 

protection, materials must: “(1) be prepared in anticipation of litigation or for trial and (2) be 

prepared by or for another party or by or for that other party’s representative.” Id. (quotation

marks omitted).

When materials are prepared for a “dual purpose,” meaning they are not prepared 

exclusively for litigation, then the “because of” test applies. Id. at 568. Under that test, “[d]ual 

purpose documents are deemed prepared because of litigation if ‘in light of the nature of the 

document and the factual situation in the particular case, the document can be fairly said to have 

been prepared or obtained because of the prospect of litigation.’” Id. Courts, however, must view 

“the totality of the circumstances and determine whether the document was created because of 

anticipated litigation, and would not have been created in substantially similar form but for the 

prospect of litigation.” Id. (quotation marks omitted).

The work-product doctrine also affords special or heightened protection to materials that 

reveal an attorney’s mental impressions and opinions, i.e., “opinion” or “core” work product. 

Admiral Ins. Co., 881 F.2d at 1494; Fed. R. Civ. P. 26(b)(3)(B). Work-product that does not rise 

to the level of opinion or core work product may be ordered produced to an opposing party upon 

a showing of substantial need for the information or that the information cannot be otherwise 

obtained without undue hardship. Admiral Ins. Co., 881 F.2d at 1494; Fed R. Civ. 

P. 26(b)(3)(A)(ii). To obtain the opinion or core work product, however, an opposing party must 

show that the mental impressions of counsel are at issue in the case and the need for the material

is compelling. Holmgren v. State Farm Mutual Auto. Ins. Co., 976 F.2d 573, 577 (9th Cir. 1992).
PAGE 6 – OPINION AND ORDER

The primary purpose of the work-product doctrine is to “prevent exploitation of a party’s 

efforts in preparing for litigation.” Admiral Ins. Co., 881 F.2d at 1494. Work-product protection, 

like the attorney-client privilege, is waivable. Richey, 632 F.3d at 567.

D. Common Interest Doctrine

“The ‘common interest’ doctrine provides that when multiple parties share confidential 

communications pertaining to their common claim or defense, the communications remain 

privileged as to those outside their group.” Sanders v. State, 169 Wash.2d 827, 853 (2010); see 

also C.J.C. v. Corp. of Catholic Bishop of Yakima, 138 Wash.2d 699, 716 (1999) (noting that 

under the common interest or joint defense rule, “communications exchanged between multiple 

parties engaged in a common defense remain privileged under the attorney-client privilege”).

“The common interest doctrine is an exception to the general rule that the voluntary disclosure of 

a privileged attorney client or work product communication to a third party waives the 

privilege.” Kittitas Cty. v. Allphin, 195 Wash. App. 355, 368 (2016), review granted in part, 187 

Wash.2d 1001 (2017).

DISCUSSION

Plaintiffs move to compel production of four categories of documents. Plaintiffs seek: 

(1) documents that Premera asserts incorporate the advice of counsel, but were not prepared by 

or sent to counsel; (2) documents that Premera asserts were prepared at the request of counsel,

but were not prepared by or sent to counsel and appear to be business documents not prepared 

because of litigation; (3) documents that relate to third-party vendor work on the data breach 

investigation and remediation, including Mandiant’s work for Premera and other third-party 

vendors working on technical and public relations aspects of the investigation and analysis; and 

(4) documents that Premera is withholding, despite being sent to third-parties, based on what 

Plaintiffs contend is an improper assertion of the joint defense or common interest exception to 
PAGE 7 – OPINION AND ORDER

waiver of privilege. Premera responds that the first three categories involve documents prepared

by either Premera employees or third party vendors hired by outside counsel at the request of 

counsel or under the supervision of counsel. Thus, argues Premera, they are properly withheld as 

privileged or as protected under the work-product doctrine. Premera further responds that it 

properly entered into common interest agreements with other Blue Cross-related entities, and 

thus there was no waiver of privilege for documents sent to those entities.

Plaintiffs also argue that Premera is required to produce certain documents based on the 

fiduciary exception to the attorney-client privilege because Premera admits that some of the 

plans involved are governed by the Employee Retirement Income Security Act of 1974 

(“ERISA”). Premera responds that the Court’s earlier decisions on Premera’s motions to dismiss 

render this argument without merit, that Washington has not yet adopted the fiduciary exception, 

and that even if the exception applies in Washington it would not apply to the specific documents 

being withheld in this case.

A. Application of Attorney-Client Privilege and Work-Product Doctrine

1. Documents that Premera asserts incorporate advice of counsel, but were not 

prepared by or sent to counsel (Category 1)

The documents in Category 1 were drafted by persons who are not attorneys and were 

sent to and from persons who are not attorneys. Although these documents contain or reference 

business, technical, or public relations information, Premera argues that they are properly 

withheld as privileged because they are “drafts” that incorporate the advice of counsel. Some of 

these documents include edits or “redlines” from counsel. Others are drafts prepared by counsel 

that include edits or redlines by Premera personnel who are not attorneys. For some of these 

drafts, Premera has produced to Plaintiffs the final version, e.g., certain press releases and 

notices.
PAGE 8 – OPINION AND ORDER

Premera argues that Washington’s law on attorney-client privileged communications is 

broader than the law governing other jurisdictions. Premera asserts that under Washington law 

any communication made during the course of an attorney-client relationship, regardless of 

whether the communication pertains to business or legal advice, is protected. In support of this 

broad proposition, Premera primarily relies on a state trial court’s opinion in Sanders v. State, 

2007 WL 77774753, at *13 (Wash. Superior Ct., Thurston Cty., Jan. 12, 2007). The Court in the 

pending case, however, generally relies upon and follows the articulation of Washington law 

announced by the Washington Supreme Court or the Washington Court of Appeals, rather than 

by a state trial court in Washington.

The Washington Supreme Court recently reiterated, after quoting Washington’s privilege 

statute, that the attorney-client privilege is a “narrow privilege,” that it “does not shield facts 

from discovery, even if transmitted in communications between attorney and client,” and that it 

“must be strictly limited to the purpose for which it exists.” Newman, 186 Wash.2d at 777-78.

The Washington Supreme Court also has explained that the attorney-client privilege “does not 

protect documents that are prepared for some other purpose than communicating with an 

attorney.” Morgan, 166 Wash.2d at 755. Additionally, the Washington Court of Appeals has 

explained that the privilege is limited only “to information related to obtaining [legal] advice”

and that documents “prepared for a purpose other than or in addition to obtaining legal advice 

and intended to be seen by persons other than the attorney, does not become subject to the 

privilege merely by being shown to the attorney.” Mechling, 152 Wash. App. at 853 (emphasis 

added). Thus, the Court rejects Premera’s broad construction of Washington’s law of attorneyclient privilege.
PAGE 9 – OPINION AND ORDER

Considering the attorney-client privilege as explained by Washington’s appellate courts, 

it appears that many of the documents in Category 1 being withheld by Premera are not protected 

under the attorney-client privilege. Premera has withheld entire drafts of documents that it was 

required as a business to prepare in response to the data breach. Premera prepared press releases 

and notices to be sent to its customers. The fact that Premera planned eventually to have an 

attorney review those documents or that attorneys may have provided initial guidance as to how 

Premera should draft internal business documents does not make every internal draft and every

internal communication relating to those documents privileged and immune from discovery.

All of the withheld documents are not internal factual or investigatory reports prepared at 

the request of counsel to inform counsel of the underlying facts so that counsel can provide 

adequate legal advice or representation, such as was the case in Doehne, relied on by Premera. 

Instead, the Category 1 documents include business documents that the company would have 

prepared regardless of any concern about litigation. Placing them under the supervision of 

outside counsel and then labelling all communications relating to them as privileged does not 

properly establish an attorney-client privilege. The focus of the privilege must be the purpose for 

which a document was created. See Doehne, 190 Wash. App. at 282-83. The primary purpose of 

drafting press releases, notices to customers, and similar documents was not to communicate 

with counsel or prepare for litigation.

There may be some documents, however, that contain protected attorney-client 

communications, such as drafts that include edits or redlines by an attorney communicating legal 

advice. If underlying edited or redlined documents contain legal advice from counsel, those 

documents (or at least the edits or redlines) are entitled to protection. Although an attorney may 

wear “two hats” when reviewing a document for both a business and a legal purpose, some of the 
PAGE 10 – OPINION AND ORDER

documents described in Category 1 appear to have been created with anticipated litigation in 

mind. Therefore, when an edit or redline was not done solely for a business purpose and the edit 

or redline communication appears to constitute legal advice under Washington’s law of attorneyclient privilege, that edit or redline need not be disclosed. Additionally, if there are documents 

for which the primary purpose was to prepare for litigation, to advise counsel of underlying facts 

to help with counsel’s legal representation, or otherwise to communicate with counsel for the 

purpose of receiving legal advice or representation, those documents would be protected under 

the attorney-client privilege.

2. Documents that Premera asserts were prepared at the request of counsel, but 

were not prepared by or sent to counsel and appear to be business documents 

not prepared because of litigation (Category 2)

The documents in Category 2 include those prepared by Premera employees and thirdparty vendors who are not attorneys. According to Premera, these documents contain information

requested by counsel, including information relating to technical aspects of the breach and its 

mitigation, company policies, public relations and media matters, and remediation activities. The 

third-party vendors were retained by Premera’s outside counsel. Premera argues that the 

documents are properly withheld as both privileged and protected under the work-product 

doctrine. Premera asserts that these are documents that were prepared primarily in anticipation of 

litigation and for the purpose of facilitating legal advice.

a. Attorney-client privilege

As with the Category 1 documents, the Court finds that the primary purpose of many of 

the documents in Category 2 was not to communicate with counsel or obtain legal advice, 

Morgan, 166 Wash.2d at 755, but instead to perform a business function. For example, one of 

the third-party vendors is Edelman, a public relations firm. As discussed above, drafting press 

releases relating to a security breach is a business function that Premera would have engaged in,
PAGE 11 – OPINION AND ORDER

regardless of actual or potential litigation. Having outside counsel hire a public relations firm is 

insufficient to cloak that business function with the attorney-client privilege. See Brawner v. 

Allstate Indem. Co., 2007 WL 3229169, at *4 (E.D. Ark. Oct. 29, 2007) (“Defendant may not 

generally assert a blanket privilege as to those facts that were generated by its investigation 

merely because those facts were subsequently incorporated into a communication to counsel, or 

because they elected to delegate their ordinary business obligations to legal counsel.” (quotation 

marks omitted)); Lumber v. PPG Indus., Inc., 168 F.R.D. 641, 646 (D. Minn. 1996) (noting that 

the plaintiffs could not “shield their investigation . . . merely because they elected to delegate 

their ordinary business obligations to legal counsel”); SCM Corp v. Xerox Corp., 70 F.R.D. 508, 

515 (D. Conn. 1976) (“Legal departments are not citadels in which public, business or technical 

information may be placed to defeat discovery and thereby ensure confidentiality.”); cf. Simon v.

G.D. Searle & Co., 816 F.2d 397, 403 (8th Cir. 1987) (noting that the “attorney-client privilege 

does not protect client communications that relate only [to] business or technical data”); United 

States v. Heine, 2016 WL 6138245, *1-2 (D. Or. Oct. 21, 2016) (noting the “vexing legal 

challenge” of corporate entities “exaggerat[ing] attorney-client privilege claims” by including 

attorneys on email communications and making “blanket, sweeping invocations of the privilege” 

that “ignore the principle that communications received by an attorney are protected by the 

privilege only if the primary purpose of the communications (or segregable portions of them) 

was to obtain legal advice or assistance” and not when “the communication’s primary purpose is 

business, not legal”); Becker v. Willamette Cmty. Bank, 2014 WL 2949334, at *3 (D. Or. June 

30, 2014) (“While a corporation is certainly free to seek business advice from counsel, business 

advice does not become legal advice simply because it is rendered by counsel.”); Kaufman & 

Broad Monterey Bay v. Travelers Prop. Cas. Co. of Am., 2011 WL 2181692, at *6, n.3 (N.D. 
PAGE 12 – OPINION AND ORDER

Cal. June 2, 2011) (noting that an insurer cannot delegate a coverage investigation to an attorney, 

which is part of the insurer’s business and then claim “work product privilege”). The fact that 

litigation may have been reasonably anticipated to occur at some point in the future does not 

convert these business functions into legal functions or make all communications relating to 

these functions privileged or subject to work product protection. See Piatkowski v. Abdon Callais 

Offshore, L.L.C., 2000 WL 1145825, at *2 (E.D. La. Aug. 11, 2000) (“[C]ourts have routinely 

recognized that the investigation and evaluation of claims is part of the regular, ordinary, and 

principal business of insurance companies. Thus, even though litigation is pending or may 

eventually ensue does not cloak such routinely generated documents with work product 

protection.”).

Premera relies primarily on In re Copper Market Antitrust Litig., 200 F.R.D. 213 

(S.D.N.Y. 2001), to support its argument that press releases and media relations, when 

supervised by attorneys, are legal advice and privileged. Copper Market, however, involved 

different facts and different types of communications. In Copper Market, the public relations 

firm was hired by the corporation, not the attorneys. Id. at 215. The court found that the public 

relations firm was the “functional equivalent of an in-house public relations department,” id.

at 216, and “was, essentially, incorporated into [the corporation’s] staff to perform a corporate 

function.” Id. at 219. Because the public relations firm was an agent of the corporation, it could 

step into the shoes of the corporation for purposes of asserting the corporation’s attorney-client 

privilege. Id. at 219. Thus, the court found that confidential communications between the public 

relations firm and the corporation, inside counsel, or outside counsel “that were made for the 

purpose of facilitating the rendition of legal services to [the corporation] can be protected from 

disclosure by the attorney-client privilege.” Id. The Cooper Market case, thus, does not support 
PAGE 13 – OPINION AND ORDER

Premera’s contention that its outside counsel can hire a public relations firm and then exclude 

from discovery under the attorney-client privilege all communications relating to public 

relations.

The same is true of the other business functions that Premera delegated to its outside 

counsel for supervision. Premera has not met its burden of demonstrating that all of these

documents are privileged. Accordingly, drafts of documents prepared by Premera employees and 

third-party vendors relating to the business functions that Premera had to perform regardless of 

litigation, including preparing press releases, media interactions, and notices, are not privileged. 

Communications relating to those drafts similarly are not automatically privileged. If, however, 

communications were sent to or from counsel seeking or providing actual legal advice, such as 

about possible legal consequences of proposed text or an action being contemplated by Premera, 

then such communications would be privileged. See Dawson v. New York Life Ins. Co., 901 F. 

Supp. 1362, 1367 (N.D. Ill. 1995) (noting that there is a difference between providing “legal 

information” and “legal advice,” that privilege only attaches to the latter, that the latter would

include consultation “concerning the legal consequences of what they might say in their speeches 

or . . . advice on the legal consequences of what was included” in a document, but finding that 

because such information was not sought “the attorneys were acting more as courier[s] of factual 

information, rather than legal advisers” and the communications were not privileged (alterations 

in original) (quotation marks omitted)).

b. Work-product protection

Assuming without deciding that the Category 2 draft documents and communications had 

a dual purpose—both business and legal, the Court must consider whether the communications 

and documents were prepared “because of” the prospect of litigation. Richey, 632 F.3d at 568. 

Looking at the totality of the circumstances, the Category 2 documents generally are not 
PAGE 14 – OPINION AND ORDER

protected by the work-product doctrine. Premera has not shown that the documents were created 

because of litigation rather than for business reasons, or that the documents “would not have 

been created in substantially similar form but for the prospect of litigation.” Id. (quotation marks 

omitted). Moreover, as discussed above, delegating business functions to counsel to oversee does 

not provide work-product protection to the materials created for those business functions. See

Kaufman, 2011 WL 2181692, at *6, n.3; Brawner, 2007 WL 3229169, at *4; Piatkowski, 2000 

WL 1145825, at *2; Lumber, 168 F.R.D. at 646. If Premera can show that a particular document 

was prepared specifically in anticipation of litigation, contains the mental impressions of 

counsel, and would not have been prepared in substantially the same form but for the prospect of 

litigation, then Premera may assert work-product protection for that specific document.

3. Documents that relate to Mandiant’s work for Premera, including the Mandiant 

Remediation Report, and other third-party vendors’ technical and public 

relations aspects of the investigation and analysis (Category 3)

a. Mandiant 

The facts surrounding the Mandiant report(s) are not particularly clear to the Court. 

Plaintiffs move to have Premera produce the Mandiant “Remediation Report.” Premera states 

that it already has produced the Mandiant “Intrusion Report,” subject to an agreement that such 

production does not constitute a waiver of privilege, but adds that drafts and other documents 

relating to that report are privileged and protected by the work-product doctrine. It is not clear to 

the Court whether the “Intrusion Report” and “Remediation Report” are two different 

documents.

Mandiant was hired by Premera in October 2014 to review Premera’s data management 

system. On January 29, 2015, Mandiant discovered the existence of malware in Premera’s 

system. On February 20, 2015, Premera hired outside counsel in anticipation of litigation as a 

result of the recently discovered data breach. On February 21, 2015, Premera and Mandiant 
PAGE 15 – OPINION AND ORDER

entered into an amended statement of work that shifted supervision of Mandiant’s work to 

outside counsel. The amended statement of work, however, did not otherwise change the scope 

of Mandiant’s work from what was described in the Master Services Agreement between 

Mandiant and Premera entered into on October 10, 2014. Several weeks after the February 21st 

agreement, Mandiant issued a report.

Premera argues that Mandiant is the equivalent of a private investigator or other 

investigative resource hired by an attorney to conduct an investigation on behalf of an attorney, 

and thus that Mandiant’s work is privileged and protected as work-product. The flaw in 

Premera’s argument, however, is that Mandiant was hired in 2014 to perform a scope of work for 

Premera, not outside counsel. That scope of work did not change after outside counsel was 

retained. The only thing that changed was that Mandiant was now directed to report directly to 

outside counsel and to label all of Mandiant’s communications as “privileged,” “work-product,”

or “at the request of counsel.” Premera argues that, with respect to Mandiant, after the breach 

was discovered and outside counsel was hired it became an entirely different situation. The 

amended statement of work, however, does not support that assertion. The only thing that 

appears to have changed involving Mandiant was the identity of its direct supervisor, from

Premera to outside counsel. The amended statement of work confirms that the scope of the work 

remained the same. Thus, Premera’s argument that Mandiant’s focus shifted in February 25, 

2015, and that Mandiant then became more like an investigator working on behalf of outside 

counsel instead of performing its original role on behalf of Premera, is not supported by the 

amended statement of work.

This situation is unlike the Target data breach case relied upon by Premera. In Target, the 

company performed its own independent data breach investigation that was produced in 
PAGE 16 – OPINION AND ORDER

discovery and the attorneys performed a separate investigation through a retained expert 

company that was privileged and protected from discovery. In re Target Corp. Customer Data 

Sec. Breach Litig., 2015 WL 6777384, at *2 (D. Minn Oct. 23, 2015). With Premera, however, 

there was only one investigation, performed by Mandiant, which began at Premera’s request. 

When the supervisory responsibility later shifted to outside counsel, the scope of the work 

performed did not change. Thus, the change of supervision, by itself, is not sufficient to render 

all of the later communications and underlying documents privileged or immune from discovery 

as work product.

This situation also is unlike the Experian case relied on by Premera. In re Experian Data 

Breach Litig., Case No. 8:15-cv-01592-AG-DFM (C.D. Cal.). In that case, outside counsel was 

hired by the compnay and outside counsel then hired Mandiant. Id. ECF 239 at 3. Here, Premera 

had already hired Mandiant, which was performing an ongoing investigation under Premera’s 

supervision before outside counsel became involved. Premera has the burden of showing that 

Mandiant changed the nature of its investigation at the instruction of outside counsel and that 

Mandiant’s scope of work and purpose became different in anticipation of litigation versus the 

business purpose Mandiant was performing when it was engaged by Premera before the 

involvement of outside counsel. Premera has not made that showing.

Considering work-product protection, the Court looks at the “dual-purpose” test. Looking 

at the totality of the circumstances, particularly the fact that the amended statement of work did 

not change the scope of work and there is no evidence that Mandiant changed its scope or 

purpose at the direction of outside counsel, the Court concludes that Premera has not shown that 

all of the underlying documents relating to the Mandiant reports were created because of 

anticipated litigation and “would not have been created in substantially similar form but for the 
PAGE 17 – OPINION AND ORDER

prospect of litigation.” Richey, 632 F.3d at 568. Premera, however, has expressed concern, which 

the Court shares, that given Mandiant’s role in working with outside counsel, there may be some 

privileged communications or work-product protected information in the withheld documents. 

Thus, if there are specific documents or portions of documents that Premera contends contain 

privileged information (in the sense that they were prepared for the purpose of communicating 

with an attorney for the provision of legal advice) or work-product information (in the sense that 

they contain the mental impressions of counsel prepared in anticipation of litigation, 

communications to counsel to provide factual information so that counsel can prepare for 

litigation, or involve a factual investigation done solely at the behest of counsel for purposes of 

litigation and no longer under the scope of work as originally agreed upon with Premera), then 

they may properly be withheld.

b. Third-party vendors

The analysis for these Category 3 documents is the same as for the documents in 

Categories 1 and 2. These are the documents created by the third-party vendors hired by outside 

counsel. Many of these documents appear to be related to business functions delegated to 

counsel. There appear to be some documents, however, that are or may be related to legal 

functions and are thus properly protected by the attorney-client privilege or work-product 

doctrine. The documents relating to Epiq appear to be legal in nature and thus not a business 

function; they may be withheld. There also appear to be several electronic discovery vendors for 

whom it is unclear whether the work performed is of a legal or business nature. Premera 

provided the Court with the written agreement between Altep, Inc. and Premera, which 

references a statement of work, but Premera did not provide a copy of the statement of work. 

Without reviewing the statement of work, it is not clear whether Altep was performing litigation 

discovery services for counsel or computer technical assistance services for Premera. If it was 
PAGE 18 – OPINION AND ORDER

the former, then Altep would not be performing a business function and the information would 

be privileged or protected by the work-product doctrine. Similarly, e-Discovery, iDiscover, LLC, 

and Navigant are vendors that appear to be providing services relating to electronic discovery or

discovery-related computer forensic assistance. If those services are being performed for counsel 

as litigation-support for discovery, they would not constitute non-legal business functions and 

would be privileged or protected by the work-product doctrine. If, however, they are services

being performed for the benefit of Premera as part of the investigation or remediation of the 

breach, they likely would be a business function and thus discoverable. The other third-party 

vendors appear to be performing business functions and thus their documents and 

communications would not be protected by privilege or work-product.

Premera argues that under Upjohn and Washington law attorneys are entitled to obtain

factual information from third parties in order to be able to provide legal advice. First, the Court 

notes that the Washington Supreme Court, although noting that Washington has adopted Upjohn, 

also expressly noted that “[t]he attorney-client privilege does not shield facts from discovery, 

even if transmitted in communications between attorney and client.” Newman, 186 Wash.2d 

at 778. Second, the Court notes that it appears that Premera has withheld as privileged all 

communications relating to press releases, notifications, remediation, and the like, and not just 

communications to counsel that constitute “the giving of information to the lawyer to enable him 

to give sound and informed advice.” Upjohn, 449 U.S. at 390. As discussed above, Premera’s 

attempt to label all communications on these subjects as necessary investigative steps required to 

give information to Premera’s counsel in connection with legal advice is not persuasive.
PAGE 19 – OPINION AND ORDER

4. Documents that Premera is withholding, despite being sent to third-parties, 

based on what Plaintiffs contend is an improper assertion of the joint defense (or 

common interest) exception (Category 4)

The documents described in Category 4 involve Premera’s assertion of a common interest 

or joint defense exception to waiver of privilege for other entities, such as Blue Cross Blue 

Shield, CareFirst,1and Anthem entities, all of which have suffered data breaches and are facing 

similar litigation. The purported common interest is that defendants are defending different cases

and government investigations throughout the country with common issues. These cases and 

investigations include, among others, In Re Anthem, Inc. Data Breach Litigation, MDL 2617, 

Case No. 15-md-02617-LHK (N.D. Cal.); Ross v. Blue Cross Blue Shield Association, et al., 

Case No. 1:15-cv-2006 (N.D. Ill); and Ames, et al. v. Anthem, Inc., Case No. 1:15-cv-465-SEBTAB (S.D. Ind.). Premera and these entities have entered into common interest agreements that 

purport to allow them to share confidential and privileged information without waiving attorneyclient privilege. Plaintiffs argue that because Premera and these entities are not defendants in the 

same litigation, they cannot assert the common interest or joint defense exception to waiver of 

privilege, and thus any documents that have been provided to these third parties have had the 

privilege waived for those communications, and all other communications on the same subject 

matter.

Generally, joint defense or common interest parties are parties within the same litigation. 

Cf. C.J.C., 138 Wash.2d at 716 (noting that the joint defense or common interest rule applies 

where “multiple parties [are] engaged in a common defense” (emphasis added)); Kittitas 

Cty., 195 Wash. App. at 368 (noting that the communications must be “made by separate parties 

 

1 Although Premera referred to “CareFirst” at oral argument, that entity does not appear 

to be a party to any of the common interest agreements. If the Court’s conclusion is incorrect, 

Premera has leave to provide additional documentary support.
PAGE 20 – OPINION AND ORDER

in the course of a matter of common interest or joint defense” (emphasis added) (quoting 

Avocent Edmond Corp. v. Rose Elecs., Inc., 516 F. Supp. 2d 1199, 1203 (W.D. Wash. 2007))). 

Some of the entities with whom Premera has asserted a common interest are not only not part of 

this litigation, but they are not subject to potential liability from the same data breach. The 

lawsuits that they face may involve similar legal theories, claims, and defenses, but they arise 

from different facts and, most importantly, different data breaches. Premera relies primarily upon 

Broyles v. Thurston County, 147 Wash. App. 409 (2008), to argue that defendants in different 

lawsuits involving different underlying facts but similar claims can rely on the common interest 

doctrine. Premera, however, reads too much into Broyles.

Broyles involved a situation where a group of four employees visited two attorneys to

discuss a situation at work and decide whether to bring claims of sexual harassment and hostile 

work environment. Id. at 417, 441. Three of the group pursued the case with those two attorneys 

and the fourth decided not to pursue the case and later attempted to testify about the original 

meeting. Id. at 442. The trial court found that because all four people went “as a group with a 

common problem, statements of all are protected” under the common interest doctrine. Id. at 

443. The Washington Court of Appeals found no error in that conclusion. Id.

Broyles, however, does not support Premera’s contention that defendants in separate 

lawsuits based on separate data breaches occurring on separate occasions nevertheless can 

invoke the common interest doctrine when they discuss related legal issues and concepts. Broyles

supports the traditional interpretation of “common” interest—that the parties share either a claim 

or potential liability in “common,” which depends on a common nucleus of operative facts. 

Generally, this means that the common interest parties are in the same lawsuit, or at the 

minimum may share a common or related liability or claim. See also Mockovak v. King Cty., 197 
PAGE 21 – OPINION AND ORDER

Wash. App. 1013, 2016 WL 7470087, at *11 (Dec. 19, 2016) (unpub.) (finding common interest 

doctrine applied when federal and state agencies shared privileged investigative and prosecuting 

information, even though only the state agency ended up prosecuting), rev. denied, 188 Wash.2d 

1009, 394 P.3d 1015 (2017), and cert. denied, 2017 WL 3386658 (U.S. Oct. 10, 2017).2

Premera stretches the definition of “common interest” beyond reasonable bounds. Under 

Premera’s interpretation, different people or entities around the country that have a similar 

alleged product defect, or allegedly engaged in similar fraudulent schemes, or have been accused 

of similar forms of misconduct generally can claim a common interest and enter into common 

interest agreements. Under Premera’s argument, as long as the claims asserted against those 

parties are the same or reflect the same the theory of liability, then they would have a “common” 

defense. That is not, however, how the common interest or joint defense doctrine works.

The common interest agreement between Premera and the Anthem entities fails under the 

proper definition of a “common” interest because that agreement involves different underlying 

data breaches. The common interest agreement between Premera and the Blue Cross and Blue 

Shield Association, however, states that its underlying matters “involve claimed liability for and 

as a result of a recent criminal intrusion into Premera’s computer systems” (emphasis added).

This appears to indicate that the potential shared liability is specific to the intrusion that is the 

subject matter of this pending litigation. To the extent that there are other matters arising out of 

the very same intrusion at issue in this case, and thus involving the same nucleus of operative 

facts that are part of this case, they would be part of the common liability and subject to the 

 

2

The Court does not imply that there are no circumstances under which the common 

interest doctrine could apply to separate lawsuits. There may, for example, be circumstances in 

which parties share a common liability based on the same underlying set of facts but because of 

diversity issues some defendants are sued in state court and others are sued in federal court. The 

Court is not making any ruling about such a circumstance.
PAGE 22 – OPINION AND ORDER

protections of the common interest doctrine. The agreement continues, however, to state that it 

includes litigation and investigations “involving other conduct alleged to be similar to or 

connected with” the intrusion (emphasis added). Data breaches that merely are “similar to” the 

underlying data breach or otherwise somehow “connected with” it are not a common liability, 

properly understood, with this case and thus are not properly subject to the common interest 

doctrine. From the Court’s review of the matters identified or described in Schedule A that was 

attached to the purported common interest agreement, they are all cases that are included in the

multi-district litigation before this Court concerning the data breach at Premera. Thus, those 

parties are properly part of a common interest agreement. To the extent, however, that any 

documents were shared with any third party whose purported common interest is not based on 

the same underlying data breach as is the subject matter in this case, there is no common interest 

doctrine protection for those disclosures.

As discussed above, communications between Premera and entities with data breaches 

other than the data breach that is the subject of this case, even if the data breach is “similar” or 

“connected to,” are not protected by the common interest doctrine. Thus, those communications 

are not privileged, and otherwise privileged information contained in such communications has 

had the privilege waived. Regarding the scope of this waiver, “[t]he widely applied standard for 

determining the scope of a waiver of attorney-client privilege is that the waiver applies to all 

other communications relating to the same subject matter.” Fort James Corp. v. Solo Cup 

Co., 412 F.3d 1340, 1349 (Fed. Cir. 2005). The party asserting privilege bears the “burden to 

show that fairness does not require waiver of the privilege over documents relating to the same 

subject matter as the documents disclosed.” Theranos, Inc. v. Fuisz Techs., Ltd., 2013 

WL 2153276, at *3 (N.D. Cal. May 16, 2013). The Court finds that because Premera believed in 
PAGE 23 – OPINION AND ORDER

good faith that it and these entities were subject to the common interest exception to waiver, 

under the unique circumstances of this case, fairness requires that the waiver of privilege extend 

only to the communications actually shared among the entities and not to all documents relating 

to the same subject matter that was addressed in the communications that were shared.

Plaintiffs also move to compel production of the common interest agreements 

themselves, relying on federal case authority. Although there is no Washington case on point, the 

Washington Court of Appeals has cited with approval federal cases discussing the common 

interest doctrine. See Kittitas Cty., 195 Wash. App. at 368; Sharbono v. Univ. Underwriters Ins. 

Co., 162 Wash. App. 1050, 2011 WL 2848801, at *8-9 (2011) (unpub.). Premera does not 

specifically respond to this argument or legal authority, other than to state that it has described 

the agreements and that it has produced a “sample” agreement. This response is neither 

persuasive nor sufficient. Moreover, in light of the fact that the Court finds most of the claim of 

common interest not to be valid and that the Court has reviewed the agreements and finds them 

not to contain privileged information, the Court directs that the agreements themselves be 

produced.

B. Redactions

Plaintiffs argue that Premera may redact documents that contain some privileged and 

some nonprivileged information and must then produce the nonredacted portions. The Court 

agrees. When an email chain contains an email that is privileged or contains privileged 

information and the remaining emails in that chain do not contain privileged information, the 

privileged material may be redacted but the remaining material must be produced.

The Court notes that Premera represents that some email chains contain no more than 

“FYI” or the like for the nonprivileged portion and that it would be burdensome to redact the 

entire privileged portion to only produce a document containing “FYI.” The Court agrees. But 
PAGE 24 – OPINION AND ORDER

that was done before this Court issued this Opinion and Order, in which many of Premera’s 

privilege assertions have been rejected. Going forward, if there is an email string and the only 

nonprivileged portion is something without substance such as “FYI,” Premera need only identify 

it as such on the privilege log and need not redact and produce the meaningless nonprivileged 

portion.

C. Fiduciary Exception to the Attorney-Client Privilege

Plaintiffs argue that, for purposes of the attorney-client privilege in the ERISA context, 

the “real client” on matters of plan administration is not the trustee but the plan beneficiaries, 

citing to United States v. Mett, 178 F.3d 1058, 1063 (9th Cir. 1999). Thus, argue Plaintiffs, the 

holder of the attorney-client privilege is not Premera and, therefore, Premera may not withhold 

documents from plan beneficiaries on matters of plan administration on the basis of privilege. 

Premera responds that the Court has already found that no fiduciary relationship exists in this 

case, that Washington law has not recognized the fiduciary exception and the Court should not 

expand the law of privilege in Washington, and that even if the exception were recognized in 

Washington the privilege is not being asserted on matters of plan administration.

The Court previously ruled that Plaintiffs failed to state a claim under state law for breach 

of fiduciary duty. In re Premera Blue Cross Customer Data Sec. Breach Litig., 198 F. Supp. 3d 

1183, 1203 (D. Or. 2016). The Court did not, however, find that Premera did not owe any duties 

as an ERISA fiduciary. That issue was not before the Court. Similarly, when the Court decided 

that ERISA did not preempt Plaintiffs’ state law claims, the Court did not find that Premera was 

not an ERISA fiduciary. In fact, the Court found that ERISA applied and that some of Plaintiffs’ 

claims could have been brought under ERISA, but that Plaintiffs’ claims were not preempted 

because Plaintiffs alleged an independent duty based on state law. In re: Premera Blue Cross 

Customer Data Sec. Breach Litig., 2017 WL 539578, at *20-22 (D. Or. Feb. 9, 2017).
PAGE 25 – OPINION AND ORDER

Regarding whether the so-called fiduciary exception to attorney-client privilege applies in 

Washington, Plaintiffs argue that it is not an exception at all. Plaintiffs quote Mett, in which the 

Ninth Circuit explained that “the fiduciary exception is not an ‘exception’ to the attorney-client 

privilege at all. Rather, it merely reflects the fact that, at least as to advice regarding plan 

administration, a trustee is not ‘the real client’ and thus never enjoyed the privilege in the first 

place.” Mett, 178 F.3d at 1063.

The Court need not reach the issue of the scope of Premera’s fiduciary obligations under 

ERISA or whether the so-called fiduciary exception applies in Washington. Even assuming that 

Premera has fiduciary obligations and that the so-called fiduciary exception applies in 

Washington, the types of documents that the Court has allowed Premera to maintain as 

privileged, as more fully described above, are all documents that are “defensive on the trustees’ 

part and aimed at advising the trustees how far they were in peril.” Mett, 178 F.3d at 1064

(quotation marks omitted). Thus, “the attorney-client privilege remains intact” because the “plan 

fiduciary [had] retain[ed] counsel in order to defend herself against the plan beneficiaries.” Id.

As discussed earlier in this decision, the Court has already ordered to be produced documents 

that could be considered related to benefitting plan members (where the “client” could be 

ERISA-covered Plaintiffs) and not as constituting legal advice for the trustees.

CONCLUSION

Plaintiffs’ Motion to Compel (ECF 110) is GRANTED IN PART AND DENIED IN 

PART as described in this Opinion and Order.

IT IS SO ORDERED.

DATED this 27th day of October, 2017.

/s/ Michael H. Simon

Michael H. Simon

United States District Judge