JOHN R. TUNHEIM, UNITED STATES DISTRICT JUDGE

Anne T. Regan and Nathan D. Prosser, HELLMUTH & JOHNSON PLLC, Anthony Stauber, Daniel E. Gustafson, David A. Goodwin, and Karla M. Gluek, GUSTAFSON GLUEK PLLC, Benjamin Cooper, Brian C. Gudmundson, Jason P. Johnston, Michael J. Laird, and Rachel Kristine Tack, ZIMMERMAN REED LLP, and Hart L. Robinovitch, ZIMMERMAN REED LLP, for Plaintiff.

Anderson Tuggle, Andy Taylor, and Jeffrey P. Justman, FAEGRE DRINKLE BIDDLE & REATH LLP, Justin O'Neill Kay, FAEGRE DRINKER BIDDLE & REATH LLP, and Zoe K. Wilhelm, FAEGRE DRINKER BIDDLE & REATH LLP, for Defendant.

MEMORANDUM OPINION AND ORDER GRANTING IN PART AND DENYING IN PART DEFENDANT'S MOTION TO DISMISS

JOHN R. TUNHEIM, UNITED STATES DISTRICT JUDGE

Plaintiff Michael Okash contends that Defendant Essentia Health's (“Essentia”) deployment of Meta Pixel tracking software on essentiahealth.org violates a slew of federal and state privacy and consumer protection laws. His complaint suffers from significant pleading defects, many of which appear to be symptoms of Okash's focus on Meta Pixel litigation against other healthcare providers rather than the facts of this case. The Court will dismiss without prejudice Okash's claims under federal and state wiretap laws, the Minnesota Health Records Act, and state tort law. At the same time, Okash plausibly alleges violations of the Minnesota Consumer Fraud Act and Minnesota Uniform Deceptive Trade Practices Act and states a viable claim for unjust enrichment.

BACKGROUND

I. FACTS

Plaintiff Michael Okash has received medical care from Essentia since 2000. (Am. Compl. ¶¶ 18-19, May 15, 2023, Docket No. 15.) Okash brings this putative class action on behalf of himself and others similarly situated, defined as “[a]ll persons whose Sensitive Information was disclosed to a third party through Defendant's Website without authorization or consent.” (Id. ¶ 106.)

Essentia maintains a website, essentialhealth.org, which allows patients to find medical facilities and services and conduct research on medical issues, conditions, medications, and doctors. (Id. ¶ 2.) Okash recalls using the website to research doctors and investigate various treatments and medical conditions. (Id. ¶ 21.) In addition to essentiahealth.org, Essentia provides an online patient portal, MyChart, that allows patients to communicate with their providers, schedule appointments, review medical records, and pay bills. (Compl. ¶ 3, Feb. 28, 2023, Docket No. 1.)

Essentia employs Meta Platform, Inc.'s (“Meta”) tracking technology, Meta Pixel (“Pixel”), on essentialhealth.org. (Am. Compl. ¶¶ 52-53, 60.) Pixel tracks a website user's activity and transmits data to Meta, including the pages and subpages visited by the website user, and searches, clicks, and other submissions to the website. (Id. ¶ 5); see also In re Meta Pixel Healthcare Litig., 647 F.Supp.3d 778, 784-86 (N.D. Cal. 2022) (explaining the Pixel technology). For example, if a visitor to essentiahealth.org clicks on the “Doctors & Providers” page, data documenting that navigation would be sent to Meta. (Am. Compl. ¶ 57.) The data is often then associated with the user's Facebook account and used for advertising purposes. (Id. ¶¶ 54-55, 59.) Okash recalls receiving targeted advertisements based on his research on essentiahealth.org. (Id. ¶ 26.)

Essentia's website includes a privacy policy indicating it is “committed to protecting the privacy of those who visit our website.” (See Decl. Jeffrey P. ¶ 4, Ex. A (“Privacy Policy”) at 2, June 23, 2023, Docket No. 26.) In a section on tracking technologies, the policy discloses “[w]e may also use Facebook Pixel that enables us to understand how users interact with our website after seeing an ad on Facebook and then clicking through to our website.” (Id. at 3.)

II. PROCEDURAL HISTORY

Okash's initial complaint alleged privacy violations on his MyChart account as well as essentiahealth.org. (See, e.g., Compl. ¶ 117.) He filed an amended complaint that drops all references to MyChart because Essentia does not use the Pixel on MyChart. (See generally Am. Compl.) Okash alleges Essentia violated federal wiretap laws as well as state statutory and common law by transmitting data from essentialhealth.org to Meta through the Pixel. (See generally id.) Essentia now moves to dismiss all counts. (Def.'s Mot. Dismiss, June 23, 2023, Docket No. 23.)

DISCUSSION

I. STANDARD OF REVIEW

In reviewing a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), the Court considers all facts alleged in the Complaint as true to determine if the Complaint states a “claim to relief that is plausible on its face.” Braden v. Wal-Mart Stores, Inc., 588 F.3d 585, 594 (8^th Cir. 2009) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). The Court construes the Complaint in the light most favorable to the plaintiff, drawing all reasonable inferences in the plaintiff's favor. Ashley Cnty. v. Pfizer, Inc., 552 F.3d 659, 665 (8^th Cir. 2009). Although the Court accepts the complaint's factual allegations as true, it is “not bound to accept as true a legal conclusion couched as a factual allegation,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007), or mere “labels and conclusions or a formulaic recitation of the elements of a cause of action,” Iqbal, 556 U.S. at 678 (quotation omitted). Instead, “[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id.

At the motion to dismiss stage, the Court may consider the allegations in the Complaint as well as “those materials that are necessarily embraced by the pleadings.” Schriener v. Quicken Loans, Inc., 774 F.3d 442, 444 (8^th Cir. 2014). The Court may also consider matters of public record and exhibits attached to the pleadings, as long as those documents do not conflict with the Complaint. Porous Media Corp. v. Pall Corp., 186 F.3d 1077, 1079 (8^th Cir. 1999).

II. PRELIMINARY FACTUAL DETERMINATIONS

There are two recurring factual disputes the Court will address upfront to aid subsequent resolution of the legal issues. First, because this action is limited to Essentia's general website, the Court will address the type of information transmitted therein. Second is the degree to which the privacy policy puts the public on notice of Essentia's use of Pixel.

A. Website Information

As Essentia observes, Okash has dropped all allegations related to MyChart because Essentia never embedded the Pixel in MyChart. Rather, the Amended Complaint pertains to Essentia's public-facing website, essentiahealth.org and its sub-links. Nonetheless, Okash continues to allege that certain sensitive information is collected that appears possible only through a connection to MyChart. For example, Okash alleges that Essentia shared information related to the “dates, times, and/or locations of scheduled appointments,” the “type of appointment or procedure scheduled,” “communications between patients and Essentia,” “information about whether patients have insurance,” and more. (Am. Compl. ¶ 9.)

Simple browsing of Essentia's website reveals that those personalized pieces of information are the province of MyChart. Accordingly, some of Okash's allegations fail to meet the plausibility pleading standard. Broadly, the type of information allegedly revealed to Meta fits two categories. First, which the Court will accept, are those pieces of information that a patient generates through unilateral action on essentiahealth.org. That includes, for example, the patient's IP address, doctors and treatments researched, search terms, and whether the patient tries to log in to a MyChart account (which would be revealed by clicking the MyChart link on essentiahealth.org). The second bucket is customized information that results from two-way communication between the patient and Essentia, which would be embedded only in MyChart. That includes specific appointment information, written communication from a patient to Essentia, medical records, and like content. The Court will disregard as implausible the allegation that those types of communications are included on Essentia's general website. To the extent Okash believes those personalized records are still intercepted by the Pixel and he chooses to file a second amended complaint, he should more precisely specify where and how on the general website such information may be found.

B. Privacy Policy

The Court may appropriately consider Essentia's Privacy Policy, both as an aspect of the disputed website and contractual material necessarily embraced by the pleadings. See WinRed, 581 F.3d at 1167 n.9; Mattes v. ABC Plastics, Inc., 323 F.3d 695, 697 n.4 (8^thCir. 2003); (Am. Compl. ¶ 33 (referencing the Privacy Policy).) The Privacy Policy is a standard browsewrap agreement. See Foster v. Walmart, Inc., 15 F.4th 860, 863 (8^th Cir. 2021). A user must follow hyperlinks on the website to read the Policy, and the Policy asserts that usage of the website manifests the user's assent. (Privacy Policy at 5.) Courts determine the enforceability of a browsewrap agreement from the adequacy of notice, whether actual or inquiry. Foster, 15 F.4th at 863-84. The record is insufficient to determine such fact-bound questions, though. See id. at 864. On a Rule 12(b)(6) standard of review, there is no manifestation of mutual assent, and the Court will not assume the Privacy Policy constitutes a valid contract.

As far as the adequacy of disclosure for various statutory purposes, the Court will largely address such issues below while noting upfront one universal concern. The privacy policy discloses that Essentia uses the Pixel to “understand how users interact with our website after seeing an ad on Facebook and then clicking through to our website.” (Privacy Policy at 3.) The complaint alleges, though, that the Pixel was in continuous use on the website, whether a patient clicked through from a Facebook ad or navigated to the page by any other means. Taking as true Okash's allegations, the Court finds the Policy does not disclose the full extent of Essentia's Pixel usage.

III. ECPA

The Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2510 et seq., prohibits the intentional interception of “any wire, oral, or electronic communication,” as well as the use or disclosure of any “content[s]” thereof. See 18 U.S.C. § 2511(1). Parties are exempt from interception liability, though, if they are a “party to the communication or where one of the parties to the communication has given prior consent to such interception.” 18 U.S.C. § 2511(2)(d). But that is only true if the party does not intercept the communication “for the purpose of committing any criminal or tortious act.” Id.

Okash alleges three independent bases for liability under § 2511(1), claiming Essentia intercepted, divulged, and used communications in violation of ECPA. But the party exception applies and Okash's complaint does not allege sufficient facts for the Court to apply the crime-tort carveout. Accordingly, Okash does not plead an unlawful interception. And because the use and disclosure prohibitions require an underlying unlawful interception, neither were those provisions violated.

A. Party Exception

The party exception clarifies that a person does not violate ECPA by “intercept[ing]” a communication “where such person is a party to the communication.” 18 U.S.C. § 2511(d). The exception applies even to an intended recipient that duplicates and forwards the communication to a third party. See, e.g., In re Group Health Plan Litig., No. 23-267, 2023 WL 8850243, at *7 (D. Minn. Dec. 21, 2023); Kurowski v. Rush Sys. for Health (Kurowski I), 659 F.Supp.3d 931, 937-38 (N.D. Ill. 2023). Thus, Essentia did not unlawfully intercept Okash's communications because Essentia was a party to the communication.

As Okash observes, the party exception only applies to interception; it does not excuse unlawful use or disclosure of a communication, even by a party to the communication. See 18 U.S.C. §§ 2511(1)(c)-(d). But Essentia neither used nor disclosed wire communications as prohibited by ECPA. Section 2511(1) prohibits the use or disclosure of communications a party knows to be “obtained through the interception” of communications “in violation of this subsection.” 18 U.S.C. §§ 2511(1)(c)-(d). As already discussed, Essentia's alleged interception was not unlawful because it was a party to the communication. And any possible interception by Meta was not “in violation of this subsection” because Essentia consented to Meta's interception. 18 U.S.C. §§ 2511(1)(c)-(d), (2)(d). Accordingly, Essentia's use of Meta's advertising services did not violate ECPA.

Okash counters that Essentia was incapable of providing valid § 2511(1)(d)(2) consent because disclosure violated the Health Insurance Portability and Accountability Act (“HIPAA”). See 45 C.F.R. §§ 164.508(a)(3)(4), (c)(1). Even accepting Okash's allegation that HIPAA regulations required his authorization, lack of authorization does not change the fact that Essentia, a party to the communication, consented to its interception.Accordingly, the party exception applies as a matter of law.

B. Crime-Tort Carveout

There is a statutory carveout to the party exception. Even a consenting party may not escape liability if the communication “is intercepted for the purpose of committing any criminal or tortious act.” 18 U.S.C. § 2511(2)(d). Okash alleges that Essentia acted for the purpose of criminally violating HIPAA and tortiously invading Okash's privacy. But because neither the alleged HIPAA nor privacy violations were independent of the interception, the crime-tort exception does not apply.

“[I]t is well established that” the crime-tort exception “only applies where the defendant allegedly committed a tortious or criminal act independent from the act of recording itself.” Kurowski v. Rush Sys. for Health (Kurowski II), No 22-5380, 2023 WL 4707184, at *4 (N.D. Ill. July 24, 2023) (citing Caro v. Weintraub, 618 F.3d 94, 99 (2d Cir. 2010)). In other words, the bad acts must be “secondary to the acquisition of the communication” and involve “tortious or criminal use of the interception's fruits.” See In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 145 (3d Cir. 2015); see also United States v. Jiau, 734 F.3d 147, 152 (2d Cir. 2013) (confining the crime-tort exception to “instances where the recording party intends to use the recording to harm or injure a recorded party, such as to blackmail, threaten, or publicly embarrass the recorded party”).

Neither Okash's Amended Complaint nor his briefing alleges independent criminal or tortious conduct. Okash's allegations that Essentia violated HIPAA and privacy torts encompass only the simultaneous interception and disclosure of information to Meta. (See Am. Compl. ¶ 122.)

Okash argues that Essentia “improperly profited from its invasion of Plaintiff's and the Class members' privacy in its use of their data for its economic value”-presumably, for its use in targeted advertising. (Id. ¶ 123.) That subsequent advertising may be an independent act from the underlying interception. But Okash does not allege the advertising itself was tortious. Cf. In re Meta Pixel Healthcare Litig., 647 F.Supp.3d at 797 (“[T]he crime-tort exception to the Wiretap Act is inapplicable where the defendant's primary motivation was to make money, not to injure plaintiffs tortiously.”). Ultimately, Okash's citations to overcome the independence requirement either do not analyze that requirement, or allege a more discrete subsequent tortious or illegal act.

Because the complaint lacks sufficient alleged facts to suggest the interception was undertaken to further an independent criminal or tortious act, Okash cannot overcome the application of the party exception, and his ECPA claims against Essentia will be dismissed. The Court will dismiss without prejudice, however, to allow Okash to plead an independent connection to a tortious act, should one exist.

IV. MHRA

The Minnesota Health Records Act (“MHRA”) prohibits the release of patient “health records” absent signed consent. See Minn. Stat. § 144.293. Essentia transmitted information about Okash to Meta without signed consent, but the question remains whether that information included “health records.” Okash has not pled sufficient information for the Court to so find.

“Health record” is defined broadly to include

any information, whether oral or recorded in any form or medium, that relates to the past, present, or future physical

or mental health or condition of a patient; the provision of health care to a patient; or the past, present, or future payment for the provision of health care to a patient.

Furlow notwithstanding, a better-pled Complaint could likely survive a 12(b)(6) motion. Unlike in Furlow, Okash alleges his website searches included “specific doctors and specialists that had been referred to him” and “searching for and disclosing specific medical diagnosis while on the website.” (Am. Compl. ¶ 21.) He further alleges that the searches were paired with enough of a digital footprint for Meta to identify him. (See Id. ¶¶ 5, 9, 104-05.) What is more, the statutory standard is undemanding. See Minn. Stat. § 144.293 subd. 2(c) (including “any information” that “relates to” medical conditions or care).

At the same time, Okash does not provide specific examples of how he used the website and what information was specifically disclosed. For example, while he says he used the website to research doctors and conditions, he fails to include any details about the doctors, conditions, or timeframe. Such information would help move the complaint past a “formulaic recitation” that health records were disclosed and frame the case more concretely moving forward. See Iqbal, 556 U.S. at 678. Accordingly, the Court will dismiss Count VI without prejudice and allow Okash a chance to plead the particulars of his MHRA claim.

V. MUDTPA

The Minnesota Uniform Deceptive Trade Practices Act (“MUDTPA”) forbids businesses from, as relevant to this action, representing that goods or services have characteristics they do not have or that “goods or services are of a particular standard, quality, or grade . . . if they are of another.” Minn Stat. § 325D.44 subds. 1(5) & (7). Essentia argues that Okash's MUDTPA claim fails because it asks for prohibited relief and does not meet the heightened Rule 9(b) pleading standard. Neither argument justifies dismissal.

As to the first issue, the MUDTPA only allows injunctive relief. See Superior Edge, Inc. v. Monsanto Co., 964 F.Supp.2d 1017, 1041 (D. Minn. 2013). Although the complaint alleges Okash suffered monetary damages because of Essentia's deceptive trade practices, it ultimately asks only for permitted forms of relief, including an injunction. (See Am. Compl. ¶¶ 165-66.)

Essentia also ventures that Okash has not alleged a sufficient risk of future damage to be entitled to an injunction. In particular, it notes that a party on notice of a deceptive practice “can no longer say that he will again be deceived by the practice.” Jaskulske v. State Farm Mut. Auto. Ins. Co., No. 14-869, 2014 WL 5530758, at *6 (D. Minn. Nov. 3, 2014). Kurowski I rejected that argument under these same circumstances. 659 F.Supp.3d at 943. Where a plaintiff remains a patient and has little choice but to continue to use the website to receive complete medical care, a deceptive trade practices claim may proceed. Id. Injunctive relief may also help remedy ongoing harms from the already-collected data. See In re Group Health Plan, 2023 WL 8850243, at *10. Accordingly, the Court finds Okash has alleged a sufficient risk of future harm to allow his demand for injunctive relief to proceed.

Claims under the MUDTPA are subject to the heightened Rule 9(b) pleading standard. See E-Shops Corp. v. U.S. Bank Nat'l Ass'n, 678 F.3d 659, 665 (8^th Cir. 2012). Okash's Amended Complaint meets the heightened standard. First, he identifies specific misrepresentations in various Essentia policies, including the Privacy Policy. Essentia claims the Privacy Policy cannot be deceptive because it discloses Essentia's use of the Pixel. But as already discussed, Okash plausibly alleges that Essentia exceeds the disclosed use of the Pixel by failing to limit the Pixel to only those web visitors who click through from a Facebook advertisement. Okash also alleges a deceptive omission by Essentia's failure to comply with HIPAA and protect his sensitive health information. Essentia argues plaintiffs may only plead an omission when the defendant owes a duty to disclose. But the Court would be hard-pressed to find that a hospital does not owe a patient a duty to disclose before transmitting HIPAA-protected information to third parties.

Accordingly, the Court will deny Essentia's Motion to Dismiss Count IV.

VI. MCFA

Essentia primarily contends that Okash's claim fails to “demonstrate that their cause of action benefits the public,” as required by the Minnesota Consumer Fraud Act (“MCFA”). See Ly v. Nystrom, 615 N.W.2d 302, 314 (Minn. 2000). When a plaintiff “seek[s] only damages, courts typically find no public benefit.” Select Comfort Corp. v. Tempur Sealy Int'l, Inc., 11 F.Supp.3d 933, 937 (D. Minn. 2014). Nonetheless, the Court finds a plausible public benefit here. A class action alleging broad misrepresentations to the public serves a public benefit for its compensatory and deterrent effects, even where the action only seeks monetary damages. See Johnson v. Bobcat Co., 175 F.Supp.3d 1130, 1142-43 (D. Minn. 2016).

Essentia also contends Okash has not met the Rule 9(b) standard for an MCFA claim. But those arguments largely overlap with the rejected MUDTPA pleading issues. Accordingly, the Court will deny Essentia's Motion to Dismiss Count VII.

VII. SECLUSION

To state a claim for intrusion upon seclusion, a plaintiff must allege that the defendant intentionally engaged in a highly offensive intrusion into another person's private affairs. See Lake v. Wal-Mart Stores, Inc., 582 N.W.2d 231, 233 (Minn. 1998). Because there was no intrusion, the Court will dismiss Count I without reaching Essentia's argument that the alleged intrusion was not highly offensive.

Courts generally agree that when a plaintiff voluntarily browses a healthcare website, there is no intrusion when the Pixel transmits the information to Meta.Intrusion requires an “affirmative act by the defendant in obtaining the information” which cannot exist when the information is provided by the plaintiff, even if a defendant later shares the information. Lehman v. Zumbrota-Mazeppa Pub. Schs., No. 04-1226, 2005 WL 894756, at *4 (Minn.Ct.App. Apr. 19, 2005). Because Okash voluntarily provided his data to Essentia, Essentia did not intrude upon his seclusion and the Court will dismiss Count I.

VIII. UNJUST ENRICHMENT

Finally, Essentia argues that Okash's claim for unjust enrichment should be dismissed because (1) the Privacy Policy is a governing contract, and (2) Okash has not alleged he provided an uncompensated benefit. As already discussed, it would be premature to hold the Privacy Policy is a governing contract. See also In re Group Health Plan, 2023 WL 8850243, at *4.

As to uncompensated benefit, Okash alleges that Essentia receives benefits from its use of his personal information, “including monetary compensation.” (Am. Compl. ¶ 203.) Essentia complains the pleading is not specific enough to prove an uncompensated benefit. See Hall v. Centerspace, LP, No. 22-2028, 2023 WL 3435100, at *6 (D. Minn. May 12, 2023). But Hall did not allege the defendant received monetary compensation in exchange for the plaintiff's data. Id. Here, the Court must take as true Okash's allegation that Essentia received monetary compensation for his data, even if the allegation lacks other specifics. Accordingly, the Court will allow Count VIII to proceed.

CONCLUSION

In sum, Okash's claims for MUDTPA and MCFA violations and complaint of unjust enrichment survive this motion to dismiss. The Court will dismiss Okash's other claims without prejudice.

ORDER

Based on the foregoing, and all the files, records, and proceedings herein, IT IS HEREBY ORDERED that Defendant's Motion to Dismiss [Docket No. 23] is GRANTED in part and DENIED in part, Counts I (Invasion of Privacy), II (18 U.S.C. § 2511(1)), V (Minn. Stat. § 626A.02), and VI (Minn. Stat. §§ 144.291 & 144.293) of Plaintiff's Amended Complaint are DISMISSED without prejudice, and Count III (18 U.S.C. § 2511(3)) of Plaintiff's Amended Complaint is DISMISSED with prejudice.