Opinion
22 C 5891
04-30-2024
SOPHIA HARTLEY, individually and on behalf of all others similarly situated, Plaintiff, v. UNIVERSITY OF CHICAGO MEDICAL CENTER and META PLATFORMS, INC., Defendants.
MEMORANDUM OPINION AND ORDER
I. BACKGROUND
This is a putative class action brought by Sophia Hartley (“Hartley”) against the University of Chicago Medical Center (“UCMC”) seeking damages for unauthorized disclosure of her individually Identifiable Health Information (“IIHI”). The case is before the Court on Defendant's Motion to Dismiss the Plaintiff's Second Amended Complaint (“SAC”). The Court has previously granted a Motion to Dismiss the First Amended Complaint resulting in dismissal of Count 1 - Violation of the Electronic Communications Privacy Act ("ECPA”) 18 U.S.C. § 2510 etseq.; Count IV - Breach of Implied Duty of Confidentiality; and Count V - Invasion of Privacy by Intrusion upon Seclusion. Hartley v. Univ. of Chicago Med. Ctr., et. al., 2023 WL 7386060 (N.D. Ill. Nov. 8, 2023). The Court granted the Motion to Dismiss Counts I and IV without prejudice and dismissed Count V with prejudice. The Plaintiff has now filed the SAC, repleading the ECPA and the Breach of Confidentiality counts.
Before reaching the issues raised by Defendant's Motion, the Court will consider a procedural request by Plaintiff concerning a minute entry that stated that the case was “terminated,” and for leave to file the second amended complaint. The Defendant objects and argues that the Plaintiff needs leave of the Court to file the SAC pursuant to FRCP 15 before filing an amended pleading. Plaintiff is correct, the Court did not intend to terminate the case, and if requested, would have allowed the filing of the SAC. The Motion is fully briefed, and Defendant has not demonstrated any prejudice in continuing to proceed on the SAC, so its objection is overruled.
II. DISCUSSION
A. Count I - Violation of the Electronic Communications Privacy Act
This Act, commonly known as the “Wire Tap Act,” makes it illegal intentionally to intercept, or attempt to intercept any wire, oral, or electronic communication (Section 2511(1)(a)); and to disclose or use the contents of an unlawfully intercepted communication (Section 2511(1)(c) and (d)). A disclosure by a party to the communication is not a violation of the act unless the disclosure itself constitutes a tort or a criminal act.
The SAC, as did the FAC, alleges that Defendant maintains a non-profit hospital network and a website for the purpose of communicating with its patients. The patients are encouraged to use the site to schedule appointments, request test results, and obtain similar types of information. According to the SAC, UCMC, without the patient's knowledge or consent, “sells” the information disclosed at the patient's portal to Meta Platforms, Inc., which in turn, using a code called meta pixel, accesses Plaintiff's IIHI to use in advertising products or services that Plaintiff might be interested in or might find useful.
This piece of computer code is defined by Facebook as:
The Meta Pixel is a piece of code on your website that can help you better understand the effectiveness of your advertising and the actions people take on your site, like visiting a page or adding an item to their cart.
You'll also be able to see when customers take an action after seeing your ad on Facebook and Instagram which can help you with retargeting.
And when you use the conversion API alongside the pixel, it creates a more reliable connection that helps the delivery system decrease your costs.(http://www.Facebook.com/business/tools/meta-pixel/). Last viewed March 30, 2024).
According to Plaintiff, the disclosure of her IIHI to Meta Platforms, Inc., constitutes a crime because the disclosure of such information without her permission violates HIPAA, 42 U.S.C. § 1320(d)(6). HIPAA makes it a federal crime knowingly to disclose IIHI to third parties. HIPAA defines IIHI as:
[A]ny information, including demographic information collected from an individual, that - (A) is created or received by a health care provider . . . and (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and - (i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.
When the Court considered the Motion to Dismiss the FAC, the Court felt, as did Judge Kennelly in a similar case, that the Plaintiff had not plausibly alleged any IIHI information specific to herself that was communicated to Meta Platforms. See Kurowski v. Rush Systems, 2023 WL 4707184 at *3 (N.D. Ill. Jul. 24, 2023)
Plaintiff's SAC has now added over ninety (90) new paragraphs which she alleges constitute violations of HIPAA. Defendant points out that most of these paragraphs have been taken in haec verba from the Complaint filed in Re Meta Pixel Healthcare Litigation, 3:22-cv-03580 (N.D. Cal.), a case in which Plaintiff herself was a plaintiff prior to its transfer to California. UCMC claims that these allegations are irrelevant, because the ECPA makes it illegal to “intercept,” i.e., to acquire the communications for tortious or criminal reasons. Plaintiff's Complaint is based on alleged illegal disclosure of legally acquired information, i.e., and thus it was acquired through Plaintiff's own action accessing the website. Plaintiff's Complaint therefore is based on her objection to the disclosures of the IIHI, not in its acquisition. In essence, Defendant's position is that it acquired information legally from Plaintiff; and that her complaint in the SAC is that, at most, Defendant disclosed information to Meta that it had legally acquired. Defendant asks Court to distinguish the verbs “to acquire” and “to disclose,” the former a requirement for an ECPA violation, but not the latter. However, the allegations in the SAC include charges that UCMC utilized Meta's “tools” in order to “acquire” the information that was allegedly disclosed to Meta. See, e.g., SAC, ¶¶ 51, 54 and 56, which allege that the only way Plaintiff's IIHI could be disclosed to Meta is by utilizing Meta's tools. Therefore, it is plausible that Defendant could be responsible for acquiring Plaintiff's IIHI with the purpose of disclosing it to Meta for their mutual financial benefits.
The Court at the time of the first motion to dismiss was concerned with the failure of Plaintiff to make plausible allegations of IIHI that were acquired by Defendant and then disclosed to Meta. She has now plausibly done so. Paragraph 256 alleges that UCMC disclosed that she was seeking specific medical specialists, ¶ 158 alleges that she sought to obtain prescriptions of various medications, ¶ 160 alleges that she was seeking information about sexually transmitted diseases, and ¶ 167 alleges that Meta sold this information to entities that sent her advertisements for medications that were relevant to specific conditions for which she was being treated. Accordingly, Plaintiff has now added allegations that are specific to herself, the lack of which was the reason for the dismissal of the FAC (“an absolute dearth of information specific to Plaintiff”).
The Court finds that Plaintiff has adequately alleged sufficient information that was disclosed to Meta to beat the Motion to Dismiss.
B. Count II - Implied Duty of Confidentiality
Count II of the SAC alleges a violation of an implied duty of confidentiality. UCMC has filed a Motion to Dismiss this Count. Plaintiff has failed to respond to UCMC's arguments for dismissal and therefore waives this claim. Rosen v. Mystery Method Inc., 2008 WL 723331 (N. D. Ill. Mar. 14, 2008).
III. CONCLUSION
For the reasons stated herein, the Defendant's Motion to Dismiss Count I of the SAC is denied. Count II is dismissed with prejudice.
IT IS SO ORDERED.