By Gerald L. Maatman, Jr., George J. Schaller, and Denis Yavorskiy
Duane Morris Takeaways: On May 26, 2026, in Berven v. Sturgis Hosp., Inc., 25-CV-1142 (W.D. Mich. May 26, 2026), Judge Robert J. Jonker of the U.S. District Court for the Western District of Michigan dismissed two related data breach class actions for lack of subject matter jurisdiction, finding that the Class Action Fairness Act’s (“CAFA”) home-state exception prevented the Court from exercising jurisdiction over the cases.
The Court found that the defendant, Sturgis Hospital, Inc., carried its burden of proving that the CAFA’s home-state exception applied by demonstrating that it is more likely than not that over two-thirds of the class members are Michigan citizens. Sturgis Hospital’s records suggested that roughly 90% of its employees and former patients, the two populations impacted by the alleged data breach, reside in Michigan. Companies facing data breach and other class actions should consider similar ways to challenge jurisdiction by invoking the home-state exception.
Case Background
Plaintiffs Lavonna Berven and Paul Minor filed two related class actions against Sturgis Hospital asserting multiple “state law claims — negligence, negligence per se, breach of implied contract, unjust enrichment, and violations of the Michigan Consumer’s Protection Act” arising from an alleged data breach. Id. at *3. Plaintiffs alleged that they had “subject-matter jurisdiction under 28 U.S.C. 1332(d)(2), the CAFA provisions of the diversity jurisdiction statute.” Id.
Sturgis Hospital is a nonprofit hospital with its principal place of business in Sturgis, Michigan, near the Indiana border, and primarily employs and serves Michigan residents. Id. at *2. Sturgis Hospital collects “a home address” from every employee and patient that uses its services. Id. at *2, n 1. According to its records, “[r]oughly 90% of Sturgis’ employees reside in Michigan” and “since 2010, at least 90% of all patient visits to Sturgis were from individuals with a Michigan home address.” Id. at *2.
In September 2025, after detecting unauthorized activity in its computer network, the hospital sent “approximately 21,379 notice letters” to former patients and employees with “known addresses that were affected by the data breach.” Id. Of those notice letters “19,412—or 90.80%—were sent to individuals with Michigan addresses.” Id. Plaintiffs alleged a breach resulting in “an unauthorized third party” acquiring “Personal Identifying Information (PII) and Private Health Information (PHI)” of approximately 77,771 employees and former patients and sought to represent a purported class of those impacted. Id. Sturgis Hospital moved to dismiss both cases under the CAFA’s home-state exception.
The Court’s Decision
Judge Jonker dismissed both complaints, determining that Sturgis Hospital demonstrated “by a preponderance of evidence that the home-state exception applies[.]” Generally, under the “CAFA, federal courts have jurisdiction over class actions where: (1) any member of the class of Plaintiffs is a citizen of a different state than any defendant; (2) the class includes more than 100 putative class members; and (3) the aggregate amount in controversy exceeds $5,000,000.” Id. at *3-4 (emphasis in original). However, under the CAFA’s home-state exception, federal courts must “decline jurisdiction if ‘two-thirds or more of the members of all proposed plaintiff classes in the aggregate,’ and the primary defendants, ‘are citizens of the State in which the action was originally filed.’” Id. at *4 (quoting 28 U.S.C. § 1332(d)(4)(B)).
Judge Jonker noted that Sturgis Hospital did not need to prove the “actual citizenship of the class members” and instead had to show domicile, which turns on proof of residence and an intent to remain. Id. at *4. Sturgis Hospital produced a declaration from its CFO and COO to demonstrate, along with “over ten thousand pages of hospital records” that suggested that “roughly 90% of its employees and former patients — the only two populations affected by the data breach—reside in Michigan.” Id. These records, along with testimony, showed that between 2010 to 2025, the percent of Sturgis employees and former patients that resided in Michigan ranged from 89.55% to 92.15%., and from 93.96% to 95.80%, respectively. Id. at *5-6.
Judge Jonker found that this evidence “strongly suggest[ed]” that the “two populations affected by the data breach — resided, and were therefore presumptively domiciled, in Michigan.” Id. at *6. Further, Sturgis Hospital’s notice letter process was “even more persuasive[]” support, as testimony showed that the hospital mailed “approximately 21,379 notice letters to potential class members[,]” 90.8% of which “were sent to individuals with Michigan home-addresses.” Id. Considering this evidence, it was “easy for the Court to find Sturgis has shown that it is more likely than not that over two-thirds of the proposed class members are residents, and therefore citizens, of Michigan.” Id. at *6-7.
Plaintiffs attempted to “poke holes” in the records, claiming they are “are unreliable indicators of residence and citizenship” and that “the addresses of former patients may be faulty.” Id. at *7. Plaintiffs also argued that “the patient-visit data . . . does not fairly represent the class because it includes ‘repeat patients’ that may have sought care . . . multiple times and other individuals that may have not been affected by the breach.” Id. Judge Jonker was unpersuaded by Plaintiffs’ “speculations[.]” Sturgis Hospital “required their employees to provide a home address” and “asked patients to provide a home address at every visit,” and for those patients with multiple visits, it used “the most recent address provided.” Id. at *8. Additionally, before sending notice letters, the hospital “used a third-party vendor to check for address changes for everyone that had been identified as involved in the data breach.” Id. (emphasis in original). Judge Jonker found that these procedures in verifying address residence data “ensure[d] that residence data [was] reasonably accurate.” Id.
Judge Jonker also found that potential “double counting had a negligible impact” since “the percentage of patient visits from individuals with a Michigan address” and “the percentage of notice letters that were sent to actual individuals” were both consistent at “roughly 90%.” Id. at *8-9. Further, Sturgis Hospital’s physical location nearing the Indiana border did not “rebut the presumption of domicile.” Id. at *9. Rather, the fact that Sturgis Hospital “is located ‘exclusively’ in Sturgis, Michigan, and markets itself as a ‘hometown’ medical service’” weighed in favor of applying the home-state exception. Id.
The Court concluded that “the consistency of the data suggests that Sturgis’ information easily meets the preponderance standard” and found “the home-state exception to [the] CAFA applies.” Id. at *10. Accordingly, the Court dismissed for lack of jurisdiction. Id.
Implications For Businesses
Berven illustrates that the CAFA is not an unbounded vehicle for litigating class actions in federal court, and when an exception applies, here the home-state exception, this defeats federal court jurisdiction and requires dismissal. Sturgis Hospital presented hospital records and notice letter statistics showing that the home-state exception applied because over two-thirds of the proposed class members are citizens of Michigan.
Jurisdictional challenges are strategic decisions that should be carefully considered when defending against class actions. Corporate counsel should weigh the pros and cons of proceeding in federal versus state court before asserting a jurisdictional exception to the CAFA. Corporate counsel should also consider the strength of the support and whether it proves by a preponderance of the evidence that an exception applies.