Many healthcare technology developers deliver their products as “cloud-based Software as a Service (‘SAAS’).” This is software that is generally accessed online through a browser. Many SaaS providers use a multi-tenant architecture for all their customers, or have several multi-tenant architecture for different types of customers. In this environment, all customers are basically using the same software – the SaaS application – and hardware – the developer’s servers. If your company uses this model, you should include a version of the following language (or an arbitration clause) in every single one of your contracts:
“THE PARTIES AGREE THAT ANY CLAIMS WILL BE ADJUDICATED ON AN INDIVIDUAL BASIS, AND EACH WAIVES THE RIGHT TO PARTICIPATE IN A CLASS, COLLECTIVE, OR OTHER JOINT ACTION WITH RESPECT TO THE CLAIMS.”
That is the end of the scope of my representation regarding class actions: don’t expose yourself to them. If you do, you will end up hiring a very different (and expensive) team of attorneys. Call me cynical, but I believe that the longer any company or product goes, the likelihood of a product defect eventually reaches 100%. The nature of a SaaS application means every glitch, bug, and defect will be experienced by customers who are in the same multi-tenant environment. Refusing to protect yourself against this is, in my view, the same as signing up for a class action litigation one day. And it is very easy to fall into one even when you are a small company.
The Federal Rules of Civil Procedure[1] provide that you can be sued in a class action if four prongs are met:
- The class is so numerous that joinder of all members is impracticable;
- There are questions of law or fact common to the class;
- The claims or defenses of the representative parties are typical of the claims or defenses of the class; and,
- The representative parties will fairly and adequately protect the interests of the class.
Let’s say a developer offers a health IT software – it could be any type – as SaaS. All customers share the same multitenant environment and the exchange suffers a total outage, which impacts all customers the same regardless of user or client configurations.
Let’s start with the first prong: numerosity. Developers with a surprisingly small number of customers are exposed to a class action. Under federal law, there’s no number: the plaintiffs’ lawyers just need to demonstrate that “joinder” is impracticable – not impossible. Cases have been certified with members ranging as low as 25-200. The proper order of magnitude for thinking about class exposure is this: does this issue affect dozens of customers? If yes, you are in class action territory. So if this developer has 25 or more customers, it should worry about a class action in the event of such an outage. That’s how small vendors can end up with very big problems.
The second prong is commonality. Each customer has the same factual issue: did an outage occur (yes) and was it the developer’s fault (unknown in this fact pattern). This is where the SaaS design brings you square within the crosshairs of class action litigation, even if you exclusively sell to large enterprise organizations. The thrust of a class action is not whether there’s been some poor consumers that were taken advantage of. It does not limit plaintiffs to consumers. It is about the commonality of questions of fact and law. Most SaaS developers have product issues that are common across their customer bases because their customers have multitenant environments (questions of fact). They also tend to have fairly uniform contracts (questions of law). That is what triggers class action exposure.
There are ways to fight these things and traps layered within them, but none of them will stop you from getting sued in the first place. A version of the following language or an arbitration clause will:
“THE PARTIES AGREE THAT ANY CLAIMS WILL BE ADJUDICATED ON AN INDIVIDUAL BASIS, AND EACH WAIVES THE RIGHT TO PARTICIPATE IN A CLASS, COLLECTIVE, OR OTHER JOINT ACTION WITH RESPECT TO THE CLAIMS.”
Please put that language in your contracts.
[1] You can also be sued in a state class action.
eHealth Law Blog 