Lugo v. INOVA Health Care Services
1:24-cv-00700
E.D. Va.Mar 25, 2025Background
- Pedro Lugo filed a putative class action against INOVA Health Care Services alleging the misuse and unauthorized disclosure of patient personally identifiable information (PII) and protected health information (PHI) via tracking pixels on INOVA’s website and Patient Portal.
- The lawsuit challenges INOVA’s use of Google and Facebook tracking pixels, which allegedly transmitted patients’ confidential information to third parties without their knowledge or consent, in exchange for advertising and marketing benefits.
- Lugo brings claims for breach of implied-in-fact contract, unjust enrichment, and violation of the Electronic Communications Privacy Act (ECPA).
- INOVA moved to dismiss all claims for failure to state a claim under Rule 12(b)(6).
- The court accepted all factual allegations in Lugo’s complaint as true, as required at the motion to dismiss stage.
- After oral argument, the court granted INOVA’s motion as to the contract and unjust enrichment claims but denied dismissal of the ECPA claim.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Implied-in-fact contract | Lugo and INOVA had an implied contract to safeguard PII/PHI | No bargained-for consideration or mutual assent shown | Dismissed: insufficient consideration and mutual assent |
| Unjust enrichment | Lugo’s data conferred a benefit on INOVA, who received value | Benefit flowed from third parties, not from Lugo; no expectation to pay | Dismissed: no reasonable expectation of payment by INOVA |
| ECPA violation (party exception) | INOVA’s disclosure of communications violated ECPA crime-tort exception | INOVA only acted with a commercial purpose, not intent to violate law | Not dismissed: Plaintiff pled facts sufficient for crime-tort exception |
| HIPAA/VHRPA as crime/tort basis under ECPA | HIPAA/VHRPA violations support ECPA crime-tort exception | No private right of action; such laws can't be the basis | Not dismissed: violations can support ECPA's crime-tort exception |
Key Cases Cited
- Ashcroft v. Iqbal, 556 U.S. 662 (motion to dismiss standard: plausibility requirement)
- Bell Atl. Corp. v. Twombly, 550 U.S. 544 (motion to dismiss standard: factual plausibility)
- Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250 (4th Cir. 2009) (motion to dismiss review standards)
- Wells v. Weston, 326 S.E.2d 672 (Va. 1985) (mutual assent for contract formation)
- Price v. Taylor, 466 S.E.2d 87 (Va. 1996) (mutual promises as contract consideration)
- Rosetta Stone Ltd. v. Google, Inc., 676 F.3d 144 (4th Cir. 2012) (unjust enrichment, reasonable expectation to pay)
- Brown v. Waddell, 50 F.3d 285 (4th Cir. 1995) (scope of the ECPA)