MEMORANDUM

ANITA B. BRODY, District Judge.

I. INTRODUCTION

On January 28, 2011, Plaintiff Avrum Baum, as the parent of C.B., ("Baum") originally filed this action in the Court of Common Pleas for Philadelphia County on behalf of himself and all other similarly situated individuals against Defendant Keystone Mercy Health Plan and its affiliate Defendant AmeriHealth Mercy Health Plan (collectively "Keystone"). On February 23, 2011, Defendants filed their Notice of Removal under federal question jurisdiction (Doc. #1). On March 11, 2011, Plaintiff filed a Motion to Remand to State Court (Doc. # 8).

II. BACKGROUND

Baum, a resident of Philadelphia, Pennsylvania, is the parent and guardian of Chaya Baum, who has a health insurance policy with Keystone. Keystone, an alleged Pennsylvania corporation headquartered in Philadelphia, serves more than 300,000 Medicaid recipients in the state. AmeriHealth, an affiliate of Keystone, is an alleged Pennsylvania corporation headquartered in Harrisburg and serves more than 100,000 Medicaid recipients in the state.1 According to the complaint, on September 20, 2010, a portable USB flash drive containing personal health information of Baum and more than 280,000 other children insured by Keystone "went missing" from Key Stone's corporate offices. The specific nature of that health information has not been identified, but Baum believes that it included names, addresses, phone numbers, policy identification numbers, full and partial social security numbers, customer financial information and health histories. Pl.'s Compl. ¶ 26; Defs.' Notice of Removal ¶ 8. On October 29, 2010, following a report by the Philadelphia Inquirer, Keystone informed Baum via letter: "The drive was lost within our office on September 20, 2010, and we have not been able to find it." Compl. ¶ 24. Keystone expressed "deep[] regret that [customer] information may have been shared" and explained that it was taking extra precaution and had: (1) investigated the matter; (2) implemented additional safety measures; and (3) retrained employees on the significance of customer privacy and information security. Compl. ¶ 24; Notice of Removal ¶ 7.

Baum alleges Keystone was negligent by permitting its employees to routinely transport the flash drive to community health fairs, not encrypting or otherwise protecting the health information on the flash drive, failing to restrict access to the data on the flash drive by person or scope, and generally failing to secure the contents of the flash drive. Compl. ¶¶ 27-28; Notice of Removal ¶ 8.

In so doing, Baum claims:

1) Keystone violated Pennsylvania's Unfair Trade Practices and Consumer Protection Law when it failed to adhere to its express privacy policy's guarantee that it will "set up ways to make sure that all personal health information is used correctly." Compl. ¶ 33.

2) Keystone was negligent when it failed to exercise reasonable care with its customers' personal health information and failed to give sufficient notice that its information was compromised.

3) Keystone was per se negligent when it failed to adhere to Pennsylvania law and federal regulations issued pursuant to the Health Insurance Portability and Accountability Act ("HIPAA") requiring health plans to have in place appropriate safeguards to protect personal information.

III. DISCUSSION

Removal of a state action to a federal district court is proper only when the action could have originally been filed in that court. 28 U.S.C. § 1441(a). Keystone alleges that federal question jurisdiction exists—and therefore this action could have originally been filed in this court—because Baum's claims necessarily involve the interpretation of HIPAA, a federal statute. Baum opposes removal arguing that its complaint asserts purely factual claims that "do not turn on a substantial question of federal law."2 Pl.'s Mot. Remand 5. When considering a motion to remand, a district court must look at the complaint at the time the petition for removal was filed. Abels v. State Farm Fire & Casualty Co., 770 F.2d 26, 29 (3d Cir. 1985). Removal jurisdiction can only "be determined by reference to the `well-pleaded complaint.'" Merrell Dow Pharmaceuticals Inc. v. Thompson, 478 U.S. 804, 808, 106 S.Ct. 3229, 92 L.Ed.2d 650 (1986). The defendant seeking removal to federal court, moreover, bears the burden of demonstrating the existence of federal jurisdiction, and "all doubts should be resolved in favor of remand" to state court. Id.

A federal district court has original jurisdiction over an action "arising under the Constitution, laws, or treaties of the United States." 28 U.S.C. § 1331. Although a complaint clearly creates federal-question jurisdiction when it pleads a federal cause of action, this "arising under" provision is also implicated when "a state-law claim necessarily raise[s] a stated federal issue, actually disputed and substantial. . . ." Grable & Sons Metal Products, Inc. v. Darue Engineering & Mfg., 545 U.S. 308, 314, 125 S.Ct. 2363, 162 L.Ed.2d 257 (2005); see also Franchise Tax Bd. of Cal. v. Construction Laborers Vacation Trust for Southern Cal., 463 U.S. 1, 27-28, 103 S.Ct. 2841, 77 L.Ed.2d 420 (1983) ("[A] well-pleaded complaint establishes either that federal law creates the cause of action or that the plaintiff's right to relief necessarily depends on resolution of a substantial question of federal law."). Yet as compared to the broader Constitutional definition of "arising under," the Supreme Court has "long construed the statutory grant of federal-question jurisdiction as conferring a more limited power." Merrell Dow, 478 U.S. at 807, 106 S.Ct. 3229.

Thus in very rare cases, a federal court may find federal question jurisdiction in "the absence of a federal private right of action." Id. at 318, 106 S.Ct. 3229. But such instances are limited to a small sliver of cases. See Grable, 545 U.S. 308, 125 S.Ct. 2363, 162 L.Ed.2d 257. In Grable & Sons, the Internal Revenue Service (IRS) seized a company's real property in Michigan due to the company's asserted tax delinquency, and a second company purchased the real property at a federal tax sale. The first company then initiated a suit in state court in which it brought a quiet-title action and challenged the validity of the purchaser's title due to an alleged lack of adequate notice from the IRS. See id. Grable, therefore, combined the "rare state [quiet] title action" and matters of federal tax law. In such limited instances, the Government "has a direct interest in the availability of a federal forum to vindicate its own administrative actions, and buyers (as well as tax delinquents) may find it valuable to come before judges used to federal tax matters." Grable, 545 U.S. at 315, 125 S.Ct. 2363.

There is no federal private right of action under HIPPA. See Dodd v. Jones, 623 F.3d 563, 569 (8th Cir.2010); Webb v. Smart Document Solutions, LLC, 499 F.3d 1078, 1082 (9th Cir.2007); Acara v. Banks, 470 F.3d 569 (5th Cir.2006); Compliance and Enforcement, 65 Fed.Reg. 82,600, 82,601 (Dec. 28, 2000) ("Under HIPAA, individuals do not have a right to court action."). Yet the lack of a federal private right of action under HIPPA is not the reason for denying removal. Removal is improper because this case does not fall into the exceptional category of cases described in Grable where the real question is whether "a state-law claim necessarily raise[s] a stated federal issue, actually disputed and substantial, which a federal forum may entertain without disturbing any congressionally approved balance of federal and state judicial responsibilities." Grable, 545 U.S. at 314, 125 S.Ct. 2363.

In this case, the complaint alleges 1) Violation of the Pennsylvania Unfair Trade Practices and Consumer Protection Law; 2) Negligence; 3) Negligence Per Se. HIPPA is implicated because the federal statute requires Defendants to "reasonably safeguard protected health information," such as the information on the misplaced USB drive, "from any intentional or unintentional use or disclosure...." 45 C.F.R. 164.530(c)(2)(i).3 In spite of the fact that the personal data at the heart of this case is protected by HIPPA, this is a fairly straightforward state-law tort case. Even Count III (Negligence Per Se) can and should be decided by a state court under Pennsylvania's more stringent information security statute, which requires Keystone to "implement a comprehensive written information security program." 31 Pa.Code 146c.3 (emphasis added). Thus, as Judge James A. Teilborg on the United States District Court for the District of Arizona found in Med 4 Home, Inc. v. Geriatric Servs. of Am., Inc., I do not find here "a substantial federal claim, nor a substantial federal interest in resolving these claims." 2008 U.S. Dist. LEXIS 95211, at *10. If I were to find jurisdiction and allow this case to proceed in federal court, I would federalize an entire category of state tort claims when Congress has not indicated any intent to do so. Such a finding would greatly disturb the balance between federal and state judicial responsibilities "because almost any litigation within the medical industry would have the potential for the disclosure of information protected by HIPPA." Id.4

ORDER

AND NOW, this 4th day of October 2011, it is ORDERED that Plaintiff's Motion to Remand (Doc. # 8) to State Court is GRANTED. This action is REMANDED to the Court of Common Pleas for Philadelphia County.

In view of this jurisdictional ruling, it is ORDERED that Defendants' Motion to Dismiss (Doc. #4) is DENIED as moot.