Heidi Kaliher and Tracey Knight, individually, and on behalf of those similarly situated v. North Memorial Health Care, d/b/a North Memorial HealthHeidi Kaliher and Tracey Knight, individually, and on behalf of those similarly situated v. North Memorial Health Care, d/b/a North Memorial Health
Case Information
UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA Jаcqueline Mekhail, individually, and on No. 23-CV-00440 (KMM/TNL) behalf of those similarly situated,
Plaintiff,
ORDER v.
North Memorial Health Care, d/b/a North
Memorial Health,
Defendant.
This matter is before the Court on Defendant North Memorial Health Care’s (“North”) motion to dismiss (ECF 29 (“Motion”)) Plaintiff Jacqueline Mekhail’s (“Ms. Mekhail”) First Amended Complaint (ECF 22 (“FAC”)). For the reasons set forth below, the Motion is GRANTED IN PART and DENIED IN PART .
I. Background
This case sits at the intersection of internet and medical privacy. Ms. Mekhail alleges that North’s use of a piece of hidden software on its websites surreptitiously tracked, collected, and monetized various aspects of her [1] online activity, including sensitive medical information protected by law. Ms. Mekhail filed her complaint on February 22, 2023. ECF 1. After North moved to dismiss the complaint (ECF 15), Ms. Mekhail amended her complaint by right, and North’s motion was withdrawn. The FAC added new factual allegations and claims. Ms. Mekhail now asserts seven causes of action: violations of the federal and Minnesota wiretap statutes (Counts I and II), the Minnesota consumer fraud statute (Count III), the Minnesota deceptive trade practices statute (Count IV), and the Minnesota health reсords statute (Count V); as well as common law claims of invasion of privacy and unjust enrichment (Counts XI and XII). See ECF 22 at 45–64. North then filed the pending Motion (ECF 29), once again asking the Court to dismiss each of Ms. Mekhail’s claims, pursuant to Federal Rule 12(b)(6). ECF 31 (North’s Memorandum in Support of Motion to Dismiss) at 1. The parties submitted full briefing on the pending motion, and a hearing was held. Various supplemental filings were also submitted by the parties.
A. Alleged Facts
North is a Minnesota-based health care provider and Ms. Mekhail is a Minnesota resident and former North patient. The tracking software at issue is known as a “pixel” (hereinafter, the “Pixel”) and was developed by the technology company Meta, formerly known as Facebook. Meta is not a party to this lawsuit. Ms. Mekhail’s allegations concern two different websites (hereinafter, collectively, the “Websites”): first, North’s public- facing website, www.northmemorial.com, which publicly offers information about medical issues and the health care resources provided by North; second, North’s password- protected “patient portal,” which contains personal medical information, including patient records, appointment booking, and test results, at https://northmemorial.com/mychart- medical-records/. Ms. Mekhail alleges that North embedded the Pixel into the source code of both Websites. ECF 22 ¶ 5 (“Recently, Plaintiff became aware that Defendant incorporates Meta tracking technology, the Pixel, on the North Memorial Websites.”).
According to Ms. Mekhail’s allegation, the Websites were essential to her experience as a North patient. She states that North “encouraged and advised [her] to utilize Defendant’s online website and patient portal to make appointments, track and receive test results, receive medical treatment, communicate with medical professionals, including doctors, nurses, and other staff, and exchange private, personal, and in most cases confidential information regarding her treatment.” Id . ¶ 20. She further states that North provides policies (the “Privacy Policy”) that аssure Website users that their medical privacy and health data will be protected. See, e.g. , id . ¶¶ 107–108. In essence, each of Ms. Mekhail’s claims is rooted in the allegation that while she engaged with the Websites at North’s encouragement, the Pixel was surreptitiously tracking, collecting, and transmitting her online activity, including page views, clicks, search terms, and so forth. This information was then allegedly collated by Meta and eventually used to craft targeted advertising to Ms. Mekhail related to her web activity.
In short, because of the nature of the activity that was allegedly tracked and where it took place (i.e., on her health provider’s public- and private-facing Websites), Ms. Mekhail contends that the Pixel was able to access disclosed protected health information without her consent, in violation of several laws. North, in turn, argues that Ms. Mekhail’s allegations cannot legally support any of her claims and asks this Court to dismiss the FAC in its entirety. Having carefully considered the arguments and submissions of both parties, and for the reаsons stated below, the Court grants North’s motion as to Counts III and VI and denies it as to Counts I, II, IV, V, and VII.
II. Legal Standard
To survive a Rule 12(b)(6) motion to dismiss, a complaint must contain “enough
facts to state a claim to relief that is plausible on its face.”
Bell Atl. Corp. v. Twombly
, 550
U.S. 544, 570 (2007). This standard does not require the inclusion of detailed factual
allegations in a pleading, but the complaint must contain facts with enough specificity “to
raise a right to relief above the speculative level.”
Id.
at 555. “Threadbare recitals of the
elements of a cause of action, supported by mere conclusory statements,” are not sufficient.
Ashcroft v. Iqbal
,
III. Analysis
A. Wiretap Statutes (Counts I and II)
Ms. Mekhail brings claims under the federal Electronic Communications Privacy
Act (“ECPA”) and the Minnesota Protection of Communications Act (“MPCA”). These
statutes are “nearly identical” and, therefore, analyzed together by courts in this District.
Wilson v. McRae’s US Mail Serv. Inc.
, No. 20-01664,
The ECPA and the MPCA prohibit the unauthorized interception of electronic
communications.
generally
18 U.S.C. § 2511(1); Minn. Stat. § 626A.02. Both statutes
provide a civil remedy for those whose communications are unlawfully intercepted.
Id
. at
§ 2520; Minn.Stat. 626A.02, subd. 5. “A plaintiff pleads a prima facie case under [EPCA]
by showing that the defendant (1) intentionally (2) intercepted, endeavored to intercept or
procured another person to intercept or endeavor to intercept (3) the contents of (4) an
electronic communication, (5) using a device.
In re Google Inc. Cookie Placement
Consumer Priv. Litig.
,
North argues that Ms. Mekhail has failed to plead the interception of contents within the meaning of the statute. ECF 31 at 8–9. North also argues that the so-called “pаrty exception” applies to the conduct alleged in the FAC, and therefore, the ECPA claims must be dismissed. Id . at 7–10. The Court disagrees, but before explaining its decision, it must clarify how it interprets certain mechanics of Ms. Mekhail’s allegations.
In the FAC, Ms. Mekhail asserts that North is liable for making interceptions, the procurement of Meta to intercept, and the use of interceptions made by Meta. The factual bases for these contentions are somewhat in tension with each other. At times, Ms. Mekhail contends that North intercepted and then sent data to Meta. See, e.g. , ECF 22 ¶ 37 (“Every time Defendant sends patients’ data to Meta, the patients’ Sensitive Information is unlawfully disclosed.”) (emphasis added); id. ¶ 72 (“Defendant’s source code manipulates website visitor’s browsers by secretly instructing it to duplicate the Website Communications and sending those communications to Meta.”) (emphasis added). At other times, the FAC alleges that Meta, via the Pixel, did the interception. See, e.g. , id. ¶ 31 (describing a “privacy violation . . . in which Defendant intentionally granted access to third-party Meta to record and collect information on the company’s systems. . . .”) (emphasis added); id . ¶ 35 (“Because Defendant utilizes Meta’s Pixel, Meta’s code surreptitiously duplicates the communication from the user to Defendant and sends it to Meta’s own servers , along with additional information that includes the user’s identity.”) (emphasis added); id. ¶ 49 (“Through [the Pixel], Meta intercepts each page a user visits, what buttons they click, as well as specific information they input into the website and what they searched. Pixel sends each of these pieces of information to Meta . . . .”) (emphasis added).
An interceptor and the procurer/user of an interception are conceptually and legally
distinct.
See Reynolds v. Spears
,
Prima Facie Case
North contends that Ms. Mekhail has failed to plead the interception of contents within the meaning of the statute. ECF 31 at 8–9. The Court disagrees.
“Intercept” is defined under the Wiretap Act as “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” 18 U.S.C. § 2510(4). Here, Ms. Mekhail has alleged that North procured Meta to embed the Pixel within the source code of North’s Websites, and likewise has plausibly alleged that an interception occurred. For example, Ms. Mekhail alleges that “Defendant utilizes Meta’s Pixel, [and] Meta’s code surreptitiously duplicates the communication from the user to Defendant and sends it to Metа’s own servers, along with additional information that includes the user’s identity.” ECF 22 at 10–11. This is a straightforward allegation, plausible in light of the broader allegations of the FAC. Ms. Mekhail has sufficiently pleaded an interception.
“Contents” are defined as “any information concerning the substance, purport, or
meaning of [a] communication.” 18 U.S.C. § 2510(8). One of the central disagreements in
this case is whether search queries and other data that suggest, but do not outright state,
information about Ms. Mekhail’s health and patient status are substantive “contents” or
merely “record information” that is characteristic of the substantive communication.
See,
e.g.
, ECF 31 at 8. North relies upon a Ninth Circuit case to argue that “information such as
names, Facebook IDs, and webpage addresses [does] not constitute ‘contents’ under the
ECPA.”
Id
. at 8 (citing
In re Zynga Priv. Litig.
,
The Party Exception
The ECPA рrovides an exception to liability when the person intercepting a communication is also a “party to the communication.” 18 U.S.C. § 2511(2)(d). This is referred to as the “party exception.” North argues that the party exception applies to the alleged conduct in the FAC, and therefore, the ECPA claims must be dismissed. ECF 31 at 7–10.
As the FAC makes clear, the Pixel is alleged to have taken Ms. Mekhail’s data during the passing of digital information between Ms. Mekhail and North while Ms. Mekhail was using North’s Websites. As such, North is a party to the relevant communications. See In re Google Inc. Cookie Placement Consumer Priv. Litig. , 806 F.3d 125, 143 (3d Cir. 2015) (“[T]he intended recipient of a communication is necessarily one of its parties”).
Ms. Mekhail argues that only a direct interceptor can invoke the party exception,
and that no party exception applies in procurement and use scenarios. ECF 37 at 11, 26.
Indeed, the statute's plain language appears to support the interpretation that the party
exception was drafted with aсtive interceptors foremost in mind. § 2511(2)(d) (“It shall
not be unlawful under this chapter for a person not acting under color of law
to intercept
a
wire, oral, or electronic communication where such person is a party to the
communication.”) (emphasis added). However, whether this means the statute excludes
party procurers and users of others’ interceptions from the party exception is less clear.
Judge Blackwell, in a similar case to this one, recently noted that “[t]he Eighth Circuit has
not addressed the question of whether an intended recipient party to a communication [can
invoke the party defense] when there is simultaneous duplication and forwarding of
information
to
a third party.”
In re Grp. Health Plan Litig.
, No. 23-CV-267 (JWB/DJF),
Here, the Court will assume without deciding that the party exception presumptively applies to any alleged violation of ECPA, whether a party to a communication is accused of directly intercepting that communication or whether they are accused of procuring/using an interception of that communication. The Court’s assumption is informed by several factors. First, the assumption is generally consistent with persuasive ECPA case law concerning the “presumptive non-liability of parties.” See id. (citing In re Google Inc. Cookie Placement Consumer Priv. Litig. , 806 F.3d at 144). Second, although counsel represented at the hearing that North is no longer alleged to be an active interceptor, the operativе complaint stated otherwise. Therefore much of the briefing on this issue was directed toward the more straightforward legal question of whether North, as an alleged interceptor, can deploy the party exception and win dismissal of the FAC. Consequently, arguments specific to whether the party exception applies to a procurer/user of another’s interception are undeveloped. [2] Most importantly, the Court’s decision to apply the party exception in this Order does not change the outcome because the Court concludes that Ms. Mekhail has adequately pleaded a criminal or tortious act, sufficient to invoke the “crime- tort exception” to the party exception.
The crime-tort exception-to-the-exception applies if a party intercepts a
communication “for the purpose of committing any criminal or tortious act in violation of
the Constitution or laws of the United States or of any State.” 18 U.S.C. § 2511(2)(d). Its
contours are somewhat unclear. Several circuits have determined that, to plead the crime-
tort exception, the allegedly unlawful act must be independent of the allegedly unlawful
interception.
See, e.g.
,
Caro v. Weintraub
, 618 F.3d 94, 100 (2d Cir. 2010);
Sussman v.
American Broadcasting Cos.
,
Here, Ms. Mekhail alleges that the interceptions were made to access and monetize
[4]
her private and protected health data. As the Court explains below, the allegation that the
Pixel allowed Meta to access Ms. Mekhail’s private health data, with the purpose of
monetizing that data, is sufficient to plead a violation of Minnesota health records law and
state a claim for unjust enrichment. Further, Ms. Mekhail’s complaint also invokes, albeit
does not claim direct liability under, the federal Health Insurance Portability and
Accountability Act, commonly known as HIPAA, the alleged violation of which has
recently been found sufficient to invoke the crime-tort exception.
See Kurowski v. Rush
Sys. for Health
, No. 22 C 5380,
North’s motion is therefore denied as to Counts I and II.
B. Minnesota Consumer Fraud Act (Count III)
Thе MCFA prohibits the “act, use, or employment by any person of any fraud, false pretense, false promise, misrepresentation, misleading statement or deceptive practice, with the intent that others rely thereon in connection with the sale of any merchandise.” Minn. Stat. § 325.69, subd. 1. North moves to dismiss Ms. Mekhail’s MCFA claims for 1) a failure to plead fraud with particularity under Federal Rule of Civil Procedure 9(b); 2) a failure to plead intent; 3) a failure to plead a public benefit sufficient to invoke the MCFA’s private attorney general provision; 4) a failure to allege a misrepresentation in connection with “merchandise;” and 5) a lack of causal nexus between alleged wrongful conduct and alleged harms. The Court need not address all these arguments because it agrees that Ms. Mekhail has failed to allege a misrepresentation in connection with merchandise, as required by the statute.
The MCFA “does not apply to all allegations of fraud, but only to those where
there is a nexus between the alleged fraud and the sale of merchandise.”
Grady v.
Progressive Direct Ins. Co.
,
The problem for Ms. Mekhail is that the FAC does not actually point to the
exchange of data between Ms. Mekhаil and North as the relevant “merchandise.” What
the FAC alleges is that “[t]he medical services that Defendant markets, provides, offers,
and/or sells are considered merchandise” under the statutory definition. ECF 22 ¶
170. The statutory definition of “merchandise” includes “services,” and the Court
assumes that “medical services” would, therefore, qualify as services. But Ms. Mekhail
is not alleging that there was a misrepresentation made by North in connection with its
provision of any medical services. Ms. Mekhail alleges that when she visited the North
Websites, her private data was taken by the Pixel in violation of state or federal law and
in contradiction to North’s statements that it would protect her privacy. This alleges a
misrepresentation related to data privacy, but North is not in the business of providing
data privacy services. Therefore, the Court concludes that Ms. Mekhail has failed to
adequately allege a nexus between the stated misrepresentation by North and the “sale of
any merchandise” by North.
Moua
,
North’s motion is therefore granted as to Count III.
C. Minnesota Uniform Deceptive Trade Practices Act (Count IV) The Minnesota Unfair and Deceptive Trade Practices Act (“MUDTPA”) prohibits the use of “deceptive trade practices” in the course of business, vocation, or occupation. Minn. Stat. § 325D.44. Such deceptive practices include “caus[ing] likelihood of confusion or of misunderstanding as to . . . certification of goods or services,” “engag[ing] in (i) unfair methods of competition, or (ii) unfair or unconscionable acts or practices,” and “engag[ing] in any other conduct which similarly creates a likelihood of confusion or misunderstanding.” Id . at subd. 1(2), (13), (14).
North moves to dismiss Ms. Mekhail’s MUDPTA claims for three reasons: first, that she has failed to plead them with particularity as required by Rule 9(b); second, she has failed to plead facts establishing her еntitlement to the injunctive relief offered by the statute; and third, she lacks Article III standing to bring her claim for injunctive relief. The second and third bases involve essentially the same legal questions and will be analyzed together. For the following reasons, North’s motion is denied with respect to Count IV.
Particularity
Rule 9(b) requires that “[i]n alleging fraud or mistake, a party must state with
particularity the circumstances constituting fraud or mistake.” Fed. Rule. Civ. P. 9(b).
The Rule 9(b) standard applies to MUDPTA.
E-Shops Corp. v. U.S. Bank Nat. Ass’n
,
Here, Ms. Mekhail’s FAC alleges both misrepresentations and omissions relevant to its MUDPTA claim. See ECF 22 ¶ 179. However, North argues that in opposing the pending motion, Ms. Mekhail has effectively abandoned a misrepresentation theory and now advances only a fraudulent omission theory. ECF 39 at 16 (“Plaintiff appears to have abandoned any misrepresentation theory”). Admittedly, Ms. Mekhail’s briefing is somewhat scattered on whether North is alleged to have made active misrepresentations or misrepresentations by omission, but the operative complaint clearly alleges both (ECF 22 ¶ 179). Further, Ms. Mekhail’s briefing does ultimately address the full “who, what, when, where, and how” requirement under E-Shops (for misrepresentations) rather than merely the “how and when” required under In re Target Corp (for omissions). See ECF 37 at 50–51. Accordingly, the Court concludes that Ms. Mekhail intends to proceed under both theories and assesses the adequacy of the FAC as to all five particularity elements.
First, the Court finds that “who,” “when,” and “where” are sufficiently pleaded, as identified in Ms. Mekhail’s brief. id . (identifying “who” as North; “when” as October 2021 to the present day; and “where” as North’s Websites and the state of Minnesota). None of these elements appear to be in dispute and none require further elaboration or analysis. As for “what” the Court concludes the element is satisfied by the allegation that North made numerous statements that it protected patients’ medical privacy and health data. See, e.g. , ECF 22 ¶ 4 (alleging that “Defendant represents to patients that its online patient portal is both a secure platform, and the information provided therein will remain secure and confidential”); ¶ 28 (alleging that North states that “North Memorial Health is committed to ensuring that your privacy is protected”); ¶ 108 (alleging that North states that “[w]e protect health and medical information as required by federal and state privacy laws” and that “North Memorial is committed to ensuring that your privacy is protected”); ¶¶ 109–110 (alleging that North makes statements about its tracking сookies designed to create confidence about data security and privacy). Finally, as for “how” these statements are deceptive, this is satisfied by the numerous allegations that North did not, in fact, protect Ms. Mekhail’s and other patients’ medical privacy and health data, because it shared private health data with Meta without Ms. Mekhail’s consent or awareness. See, e.g. , id . ¶¶ 4, 9, 11, 22, 23, 38, 40, 47, 72, 74, 116.
To be sure, North strongly disputes that the statements alleged by Ms. Mekhail
actually constitute misrepresentations, in part because North thematically disputes that
anything shared with Meta was protected health data and also because some of allegedly
deceptive statements are linked to the Privacy Policy, which also (allegedly) states that
North “may disclose information to third parties who act for us or on our behalf.”
Id
. ¶
108. But North overestimates both the extent to which this Court can engage in fact
finding at the pleading stage and whether statements in the Privacy Policy can require
dismissal at this stage in the litigation. North is essentially asking the Court to make
factual determinations about the effect that the Privacy Policy had (or ought to have had)
on Ms. Mekhail, weighing their interpretation of its meaning and import against hers.
The Court’s role at this stage is not to predict whether Ms. Mekhail will ultimately
succeed at proving her claims of misrepresentations or actionable omissions. Instead, the
Court must accept all facts alleged by Ms. Mekhail and draw all reasonable inferences in
her favor. Consequently, the Court finds that the FAC complies with the particularity
requirements of Rule 9(b). Accord
In re Grp. Health Plan Litig.
,
Injunctive Relief
With respect to this portion of the FAC alone, Defendants’ arguments regarding
Article III standing present a challenge to the Court's subject matter jurisdiction pursuant
to Federal Rule of Civil Procedure 12(b)(1). Defendants raise a “facial” standing
challenge, which is directed only to the pleadings and essentially applies the Rule
12(b)(6) standard.
Osborn v. United States
,
For Ms. Mekhail
[5]
to meet the burden to allege Article III standing, she must show
(1) an injury in fact that (2) is fairly traceable to the defendant's alleged conduct and (3)
is likely to be redressed by a favorable court ruling.
Spokeo, Inc. v. Robins
,
A plaintiff “must demonstrate standing for each claim that they press and for each
form of relief that they seek.”
TransUnion LLC v. Ramirez
,
Here, Ms. Mekhail argues that her pleadings allege a likelihood of future harm in two ways: where new data is taken from her by the Pixel, and where the data already taken by the Pixel is used in newly harmful ways. ECF 37 at 39–40. The first scenario, in which Ms. Mekhail’s data is once again taken by the Pixel, is in obvious tension with the fact that Ms. Mekhail, by her own allegation, is a “former patient” of North. ECF 22 ¶ 19. Nevertheless, Ms. Mekhail argues that she may become a patient again, perhaps through an emergent scenario in which she cannot control the place of her treatment. ECF 37 at 40 (“It is unknown whether Plaintiff and the Class may be required to use North’s services, even if they may currently be former patients (for example, if taken to the emergency room and need follow up care.).”). In such a case, Ms. Mekhail argues that “she would be encouraged to use [North’s] Websites” once more. Id . This argument is essentially mirrored in the FAC at ¶¶ 187–88.
This first avenue of future harm is somewhat tenuous. By Ms. Mekhail’s
allegation,
if
she is forced to avail herself of North’s medical services, then she would be
encouraged
to use the Websites and thereupon may be harmed again. This contingent
scenario stretches the limits of a “real and immediate” threat required under
Lyons
and
has led to dismissal in other deceptive trade practices cases.
See Johnson v. Bobcat Co.
,
Ms. Mekhail’s second avenue for future harm is stronger. Here, her data, already collected by the Pixel, remains beyond her control and may be used in harmful ways. ECF 37 at 40 (“Sensitive Information North previously collected and gathered in the past still exposes Plaintiff and the Class Members to a material risk of future harm that is concrete and imminent.”). This gets at a more tangible and immediate threat, and is one to which North has essentially no response. Admittedly, the threat contemplated by this scenario is only tangentially and ambiguously pleaded. See, e.g. , ECF 22 ¶¶ 13, 186, 206 (allegations that Ms. Mekhail continues to suffer harm from past disclosures of her data). But taking all allegations as true and viewing all inferences in Ms. Mekhail’s favor, it is enough.
Of course, the fact that Ms. Mekhail alleges a sufficient likelihood of future harm
around the renewed collection and use of her data does not exactly mean that she is
alleging that she is
likely to be deceived
by North again. Indeed, it seems unlikely that
she would be. Courts grappling with this once bitten, twice shy conundrum in the
standing context sometimes note that the threat of future harm can be situated in an injury
other than a repeat case of deception.
Davidson v. Kimberly-Clark Corp.
, 889 F.3d
956, 969 (9th Cir. 2018) (holding that a “previously deceived consumer” had standing to
seek an injunction because of “the consumer's plausible allegations that she will be
unable to rely on the product's advertising or labeling in the future, and so will not
purchase the product although she would like to.”);
In re Gen. Mills Glyphosate Litig.
,
No. CV 16-2869 (MJD/BRT), 2017 WL 2983877, at *4 (D. Minn. July 12, 2017)
(plaintiffs already allegedly deceived by a product label, still faced a threat of future
injury because they wished to continue purchasing the product, but absent an injunction,
would “have no way of knowing in the future if the labels are accurate.”). And other
courts recognize, requiring an individual who has already been deceived by a business
practice to establish that they are likely to be deceived again by that practice defangs all
aspects of public interest embodied in the deceptive trade statutes to the point of futility.
Delgado v. Ocwen Loan Servicing
, LLC, 13-CV-4427,
The Court therefore concludes that Ms. Mekhail has pleaded an adequate likelihood of future harm to survive the pending motion. However, the Court observes that Ms. Mekhail will need to do more to actually obtain injunctive relief than she does to avoid dismissal on standing grounds. See Barclay v. ICON Health & Fitness, Inc. , No. 19-CV-2970 (ECT/DTS), 2020 WL 6083704 at *5 n.2 (D. Minn. Oct. 15, 2020) (concluding that the argument that there is no threat of future injury once a plaintiff becomes aware of an allegedly deceptive practice is better suited for determining whether the plaintiff is “entitled to injunctive relief on the merits, not whether they have standing”).
North’s motion is therefore denied as to Count IV.
D. Minnesota Health Records Act (Count V)
The MHRA prohibits healthcare providers from “release[ing] a patient’s health records to a person” without the patient’s consent or “specific authorization in law.” Minn. Stat. § 144.293, subd. 2. Under the MHRA, a “health record” includes “any information” that “relates to the past, present, or future physical or mental health or condition of a patient; the provision of health care to a patient; or the past, present, or future payment for the provision of health care to a patient.” Minn. Stat. § 144.291, subd. 2(c). The MHRA “imposes liability on a person who negligently or intentionally releases a health record in violation of [the statute’s] guidelines.” Rhoades v. Lourey , No. A18-1120, 2019 WL 1006804, at *2 (Minn. Ct. App. Mar. 4, 2019) (cleaned up) (citing Minn. Stat. §§ 144.293, subd. 1-2, .298, subd. 2(1)).
North argues that a “health record” under the MHRA does not extend to
documents or records from which a person’s health condition or patient status can be
“inferred” or “deduced.” ECF 31 at 26 (citing
Furlow v. Madonna Summit of Byron
, No.
A19-0987, 2020 WL 413356, at *2–3 (Minn. Ct. App. Jan. 27, 2020). Instead, North
argues that to qualify as a “health record,” a record must “expressly” state an individual’s
past, present, or future physical or mental health condition as a patient or the provision
of health care.
Id
. (citing
Furlow
,
Inferential Information
First, the Court disagrees that
Furlow
stands for such a bright-line proposition that
documents or records that allow medical information to be inferred can never be “health
records” within the meaning of the act.
Furlow
applied an earlier ruling,
Rhoades
, to
conclude that a health record does not exist in an item from which “someone could
merely deduce that someone is a patient of a facility.”
Furlow
,
Read appropriately,
Furlow
is inapt to the facts of this case. First, Ms. Mekhail
also alleges a specific oрeration of the Pixel, in which it would detect and disclose her
attempts to log in to the password-protected patient portal.
See
ECF 22 ¶ 6 (“[W]hen
[Ms. Mekhail] accessed the portal to sign in, the Pixel secretly deployed on the Websites
sent the fact that she was attempting to login to the patient portal to Meta.”). Such
operation of the Pixel implicates a disclosure of information that arguably reveals more
than an inference of her status as a North patient and gets closer to outright revealing that
she was a patient. This type of quasi-inferential, quasi-explicit disclosure is not addressed
by the
Furlow
decision. Second, some of the inferences implicated in this case, which
allegedly concern the provision of care and conditions, are broader than those in
Furlow
,
which only addresses inferences about patient status. Indeed, the
Furlow
court appears
to acknowledge this exact distinction by stating that the social media post was not a
medical record
because
there was nothing in it that “goes to the nature of the care or
condition” of the plaintiff.
Explicit Information
More critical than the adequacy of the inferences to be made from the public- facing website is the explicit health information gained from Pixel’s alleged presence on the private, patient-portal website. The Court finds that Ms. Mekhail alleges far more than the kind of inferential data-collection that North prefers to address in the pending motion. As discussed above, Ms. Mekhail alleges that the Pixel operates on both Websites identified in the FAC. See, e.g. , ECF 22 at ¶ 5 (“Recently, Plaintiff became aware that Defendant incorporates Meta tracking technology, the Pixel, on the North Memorial Websites.”).
Here, Ms. Mekhail alleges that the patient portal allows patients to schedule appointments, attend remote e-visits with providers, communicate with providеrs, review medical test results, pay bills, arrange prescription refills, and more. ECF 22 at ¶ 3. Ms. Mekhail further alleges that the use of the Pixel on both Websites resulted in the alleged unauthorized disclosure of, among other things, appointments, including their type and procedures scheduled; information about patients’ providers; patient communications; patient insurance status; and patient gender and sexual orientation. Id. at ¶ 9. These allegations are sufficient to plead that health records within the meaning of the MHRA were released without Ms. Mekhail’s consent. In re Grp. Health Plan Litig. , 2023 WL 8850243, at *2 (finding that similar MHRA allegations were “sufficient to plausibly plead that health records were released . . . considering the broad definition of health records in the statute”).
North’s motion is therefore denied as to Count V.
E. Invasion of Privacy Claims (Count VI)
The FAC asserts two distinct invasion of privacy torts in Count VI: publication of private facts and intrusion upon seclusion. ECF 22 at 61. A tortious publication of private facts occurs when someone “gives publicity to a matter concerning the private life of another if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.” Bodah v. Lakeville Motor Express, Inc. , 663 N.W.2d 550, 553 (Minn. 2003) (cleaned up). Intrusion upon seclusion occurs when someone “intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be highly offensive to a reasonable person.” Lake v. Wal-Mart Stores, Inc. , 582 N.W.2d 231, 233 (Minn. 1998). North seeks to dismiss both. The Court agrees for the following reasons.
Publication of Private Facts
Ms. Mekhail’s opposition brief to the pending motion did not respond to North’s
arguments in favor of dismissal of the publication claim, and counsel for Ms. Mekhail
confirmed at the hearing that she would abandon the claim due to a lack of factual basis to
allege a sufficiently public dissemination of her health data.
Bodah
,
Intrusion Upon Seclusion
Ms. Mekhail does contest North’s arguments in favor of dismissing the intrusion
claim.
See
ECF 37 at 46–49. However, counsel for Ms. Mekhail’s clarification at the
hearing that she was not alleging North to be an interceptor under the wiretap statute
changes the landscape for the intrusion claim, as well. Courts have held that the act of
intrusion is inseparable from the act of interception.
Caro
,
North’s motion as to Count VI is therefore granted.
F. Unjust Enrichment (Count VII)
To state a claim for unjust enrichment, a plaintiff must allege facts showing “(1) a benefit conferrеd; (2) the defendant’s appreciation and knowing acceptance of the benefit; and (3) the defendant’s acceptance and retention of the benefit under such circumstances that it would be inequitable for him to retain it without paying for it.” Christensen L. Off., PLLC v. Ngouambe , No. A17-1917, 2018 WL 2293423, at *6 (Minn. App. May 21, 2018). North argues that Ms. Mekhail’s unjust enrichment claim should be dismissed because she has failed to plead an implied contract between the parties and because Ms. Mekhail has not alleged any inequitable benefit received by North. The Court disagrees.
Implied Contract
Minnesota courts “limit[] the application of unjust enrichment to claims
premised on an implied or quasi-contract between the claimant and the party alleged to
be unjustly enriched.”
Caldas v. Affordable Granite & Stone, Inc.
,
Ms. Mekhail alleges a reciprocal expectation that North would protect her medical
data, implicitly pursuant to the requirements of state and federal law, such as HIPPA.
See, e.g.
, ECF 22 at 9, 33–37, 62. North, on the other hand, posits that this expectation
was in fact created by the Privacy Policy, which functioned as an express, rather than
implied contract governing medical privacy.
See
ECF 31 at 35 n.13. And because Ms.
Mekhail invokes this same policy in the FAC to substantiate certain of her other
allegations (
see, e.g.
, ECF 22 ¶¶ 20, 28, 30, 107–18, 179), the document is fair game for
consideration by the Court in deciding the pending motion.
See Porous Media Corp. v.
Pall Corp.
,
Here, Ms. Mekhail has alleged that her еxpectation that North would protect her
privacy flowed implicitly from well-known laws governing health privacy, rather than
from the Privacy Policy. To the extent that North believes that any expectation was
actually created by an explicit contract in the form of the Privacy Policy, such arguments
are more appropriately considered with the benefit of a factual record, developed through
discovery, and are not amenable to a legal determination at the pleading stage.
Mjolsness
,
Benefit to North
North characterizes the FAC as “provid[ing] only a vague and conclusory allegation that Plaintiff conferred a benefit on North . . . without providing any details, including who allegedly provided the monetary compensation.” ECF 31 аt 33. Ms. Mekhail states that North “knowingly and unlawfully received a benefit from its use of Plaintiff’s and the Class members’ Sensitive Information, including monetary compensation,” and that it would be “inequitable and unjust for Defendant to retain any of the profit or other financial benefits derived from the secret, unfair, and deceptive data tracking methods Defendant employes [sic].” ECF 22 ¶¶ 211, 213. Elsewhere, the FAC lays out assertions about the value of Ms. Mekhail’s data that was allegedly collected by the Pixel (ECF 22 at 26–30), as well as allegations about the ways that data was deployed to North’s benefit through its alleged use of the data in targeted advertisements ( see e.g. , id . at 7, 15). Taken together, these sections of the FAC sufficiently allege that a benefit was conferred on North by monetizing Ms. Mekhail’s data.
North also argues that the FAC fails to adequately allege that the benefit to North was inequitable in light of the previously discussed privacy policy. ECF 31 at 33 (arguing that “Plaintiff’s use of the website cannot plausibly be inequitable” because she agreed to the terms of the privаcy policy); id . at 35 (“It is not plausibly ‘unjust’ for North to act consistently with [the privacy policy].”). But Ms. Mekhail does expressly plead that the collection was inequitable because it was uncompensated. And the Court again declines to explore the contours of the privacy policy at this stage. North may present its arguments concerning the equities of that policy with the benefit of a factual record developed in discovery.
North’s motion as to Count VII is therefore denied.
IV. Order
For the foregoing reasons, IT IS HEREBY ORDERED that: 1. Defendant’s Motion to Dismiss (ECF 29) is GRANTED in part and DENIED in part ;
2. The Motion is GRANTED to the extent that Counts III and VI are DISMISSED WITHOUT PREJUDICE ; and
3. The Motion is otherwise DENIED . Date: March 28, 2024 s / Katherine M. Menendez Katherine M. Menendez United States District Judge .
Notes
[1] This lawsuit is also brought on behalf of a putative class, and the operative complaint includes class allegations relevant to individuals other than Ms. Mekhail. ECF 22 at 41–45. The pending motion does not address these class allegations and class certification has not yet been sought.
[2] The Court’s assumption is not a ruling, and nothing prevents Ms. Mekhail from renewing her arguments around limitations to the party exception later in this litigation, should the facts necessitate. And given Ms. Mekhail’s clarification regarding her theory that North did not act as an interceptor, the Court would expect more focused and germane briefing on the issue if it is raised again.
[3] The “primary motivation” or “determinative factor” test does not appear in the
statute, which inquires only about a criminal or tortious “purpose” behind an interception.
See
18 U.S.C. § 2511(2)(d). Nor does the test appear in any authority binding on this Court.
Instead, it seems that the test originated in a 1986 case from the District of Massachusetts,
which extrapolates from Eighth Circuit dicta and other sources to conclude that §
2511(2)(d) requires more than its plain language says it does.
United States v. Vest
, 639
F. Supp. 899 (D. Mass. 1986) (citing,
inter alia
,
United States v. Phillips
,
[4] North cites case law from different districts for the proposition that the crime-tort
exception is inapplicable where a defendant’s motivation is pecuniary. ECF 31 at 9–
10. The Court is aware that the Northern District of California appears to have adopted this
approach.
See, e.g.
,
In re Meta Pixel Healthcare Litig.
,
[5] As the named plaintiff in a putative class action, Ms. Mekhail must allege facts
establishing the elements of her own standing, and may not rely on the injuries of
unidentified class members.
Spokeo
,
[6] The Court also notes that because Ms. Mekhail was once a patient of North and she alleges that North has records of past treatment and appointments, she may have to use the patient portal even if she does not return as a patient. If she needs to obtain or review her own medical records from North using the portal (surely the quickest and least burdensome way) she would once again be exposed to harm from the allegedly deceptive practices.