JARRETT v. UPPERLINE HEALTH, INC. d/b/a UPPERLINE HEALTH INDIANA
1:23-cv-01261
S.D. Ind.
Sep 24, 2024
Check Treatment
Docket

JANE DOE, individually and on behalf of all others similarly situated, Plaintiff, v. UPPERLINE HEALTH, INC., d/b/a UPPERLINE HEALTH INDIANA, Defendant.

No. 1:23-cv-01261-RLY-CSW

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF INDIANA INDIANAPOLIS DIVISION

September 24, 2024

RICHARD L. YOUNG, JUDGE

ENTRY ON DEFENDANT‘S MOTION TO DISMISS

Plaintiff Jane Doe filed an Amended Class Action Complaint against Upperline Health, Inc. d/b/a Upperline Health Indiana on behalf of a putative class of similarly situated persons. She alleges that Upperline non-consensually and deceptively embedded third-party source code on its publicly available website. Plaintiff alleges this third-party source code, which is not visible to user‘s of the website, causes transmissions of her personally identifying, private health information to third parties, including Facebook. Plaintiff filed this suit in federal court under the Class Action Fairness Act, 28 U.S.C. 1332(d). She asserts claims for negligence, negligence per se, invasion of privacy, implied breach of contract, unjust enrichment, breach of fiduciary duty, and violation of the Indiana Deceptive Consumer Sales Act.

Upperline now moves to dismiss under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be granted. For the reasons discussed below, the court GRANTS Upperline‘s motion.

I. Background

Upperline is a for-profit healthcare provider specializing in podiatry. (Filing No. 23, Am. Compl. ¶ 5). Upperline is organized in Delaware with a principal place of business in Nashville, Tennessee. (Id. ¶ 31). It operates over a dozen clinics in Indiana and maintains a public website at https://www.upperlinehealthindiana.com1 (the “Website“). (Id. ¶¶ 6, 31). Through this Website, users are able to access a patient portal, pay bills, complete new patient paperwork, view Upperline‘s medical services, and find doctors and clinic locations. (Id. ¶ 6).

According to the Amended Complaint, Upperline embedded trackers into its Website, like Meta Pixel, which was created by Facebook. (Id. ¶¶ 8–9). “Facebook describes the Meta Pixel as a snippet of code embedded into a website that tracks information about its visitors and their website interactions.” (Id. ¶ 9). Specifically, it tracks a website user‘s ““events’ (i.e., user interactions with the site), such as pages viewed, buttons clicked, and information submitted.” (Id.). It then “transmits the event information back to the website server and to third parties, where it can be combined with other data and used for marketing.” (Id.). Further, the Meta Pixel can link a user‘s website interactions with the user‘s Facebook ID, “allowing a user‘s health information to be linked with their Facebook profile.” (Id. ¶ 10).

Plaintiff resides in Kokomo, Indiana, and was a patient of Upperline from April to October 2022. (Id. ¶¶ 30, 81). During that time, she alleges she accessed the Website “somewhere between five and ten times” to schedule appointments and to access the patient portal. (Id. ¶ 82). Through Upperline‘s use of Meta Pixel and other tracking technologies, Plaintiff alleges Upperline unlawfully disclosed or facilitated the interception of her protected health information (“PHI“) 2 and/or her personally identifiable information (collectively “Private Information“) to Facebook without her knowledge or consent. (Id. ¶¶ 12, 86). Plaintiff alleges that since using Upperline‘s Website, she has “noticed a proliferation of health-related online advertisements in her Facebook feed” and has received unsolicited foot and ankle braces in the mail. (Id. ¶ 88).

Plaintiff reasonably expected that her online communications with Upperline were solely between herself and Upperline, expected that Upperline would safeguard her information according to its privacy policies, and did not consent to the use of her private information by third parties. (Id. ¶¶ 84, 85, 87).

II. Legal Standard

Pursuant to Federal Rule of Civil Procedure 12(b)(6), a party may move to dismiss a pleading for failure to state a claim upon which relief can be granted. To survive a motion to dismiss, the claim “must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” ; see also (“The complaint ‘must actually suggest that the plaintiff has a right to relief, by providing allegations that raise a right to relief above the speculative level.‘“) (quoting ). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” . In applying this standard, the court accepts all well-pleaded facts as true and draws all reasonable inferences in favor of the non-moving party. .

III. Discussion

The principal theory of Plaintiff‘s case, underlying all claims, is that Upperline transmits the Private Information that patients input into Upperline‘s Website to third parties without patients’ consent. Consequently, the first issue the court must address is whether Plaintiff has sufficiently alleged that the information she submitted on Upperline‘s Website constitutes Private Information.

Upperline argues that Plaintiff alleges only that she searched and viewed publicly available information on a public website, which is insufficient to allege a disclosure of sensitive Private Information. See (“Information available on publicly accessible websites stands in stark contrast to the personally identifiable patient records and medical histories protected by [HIPAA]—information that unequivocally provides a window into an individual‘s personal medical history.“); (holding plaintiffs’ allegations “that they used www.sharp.com, a public website, to research doctors, look for providers, and search for medical specialists” did not involve PHI because the information did not relate specifically to plaintiffs’ health and was, instead, general health information) (cleaned up); (holding searches on publicly available healthcare websites do not relate to one‘s past, present or future physical or mental health); (holding plaintiff‘s allegations relating to what defendant communicated to Facebook, including URLs and tabs clicked on defendant‘s website, were far too vague to support a claim under HIPAA).

Plaintiff alleges she used the Website “to schedule appointments[,] [to] find a podiatrist,” and to access the patient portal. (Am. Compl. ¶ 82). She further alleges her Upperline physician told her to communicate through the Website rather than the patient portal. (Id. ¶ 83). She “complied with her doctor‘s request and used the [W]ebsite to communicate confidential information about herself and her health conditions and treatment.” (Id.).

Plaintiff fails to identify how she communicated her confidential medical information with her doctor on Upperline‘s public website rather than the patient portal. A review of the Website3 establishes no method for Plaintiff—or any user—to communicate confidential information about her individual health conditions or treatment outside of the patient portal.

Her other allegations relating to the Website are factually insufficient. She does not explain how she scheduled her appointments—whether she clicked the “Schedule an Appointment” button on the Website itself or whether she did so in the patient portal—or what information she submitted that plausibly conveyed her Private Information, which was then subsequently shared. Plaintiff‘s allegation that she used the Website to search for a podiatrist is similarly unavailing. There is nothing about that browsing activity that relates specifically to her health or relationship with Upperline. (holding this type of activity is not PHI because “nothing about [the] information relates specifically to Plaintiff‘s health” and the information is “general health information that is accessible to the public at large“). Finally, Plaintiff does not explain how clicking on “patient portal” in the navigation bar involves the use of Private Information. Patient portals typically have their own URLs4 and require the user to input a username and password. Given the “dearth of information specific to Plaintiff as to what was specifically disclosed to Facebook that would plausibly be in violation of HIPAA,” , the court must dismiss Plaintiff‘s Amended Complaint.

IV. Conclusion

For the reasons set forth above, the court GRANTS Upperline‘s Motion to Dismiss (Filing No. 26) and DISMISSES Plaintiff‘s Amended Complaint with leave to amend. If Plaintiff wishes to file a Second Amended Complaint to cure the deficiencies, she must do so by October 18, 2024.

SO ORDERED this 24th day of September 2024.

RICHARD L. YOUNG, JUDGE

United States District Court

Southern District of Indiana

Distributed Electronically to Registered Counsel of Record.

Notes

1
The URL, http://www.upperlinehealthindiana.com now, redirects to http://www.upperlinehealth.com.
2
Pursuant to the Health Insurance Portability and Accountability Act, 42 U.S.C. § 1320d et seq., and its implementing regulations (“HIPAA“), “protected health information,” or “PHI,” is defined as “individually identifiable” information that is “created or received by a health care provider” and that “[r]elates to the past, present, or future physical or mental health or condition of an individual” or the “provision of health care to an individual.” 45 C.F.R. § 160.103.
3
Upperline argues the content of its Website is referenced in the Amended Complaint and central to Plaintiff‘s claims. The court agrees with Upperline and will consider the Website—the archived version which was in place when Plaintiff was a patient of Upperline (https://web.archive.org/web/20230403185108/https://www.upperlinehealthindiana.com/)—for purposes of this motion. (considering website on motion to dismiss because it was “referenced in the complaint and central to plaintiff‘s claims“).
4
The URL for the patient portal does not appear to have been archived. See https://web.archive.org/web/20230403185108/https://www.upperlinehealthindiana.com/patient-portal.
Read the detailed case summary