On June 9, 2025, Judge Dena Coggins, of the Eastern District of California, grants in part and denies in part the defendants’ motion to dismiss in a class action lawsuit alleging that a major healthcare operator and its affiliates unlawfully disclosed patients’ protected health information (PHI) and personally identifiable information (PII) to third parties—including Meta (Facebook) and Google—through the use of tracking pixels and related technologies on their websites and patient portals.
Plaintiffs, patients of the healthcare system, claimed that when they used the defendants’ websites and patient portals to search for doctors, make appointments, or review medical records, tracking technologies intercepted and transmitted sensitive health and personal data to third parties for marketing and advertising purposes—without their knowledge or consent. Plaintiffs alleged that this conduct violated a range of California and federal privacy laws, as well as constitutional rights.
- California Invasion of Privacy Act (CIPA): Plaintiffs sufficiently alleged that their communications—including detailed search queries and medical information—were intercepted in real time and disclosed to third parties. The court found that the installation and use of tracking pixels could constitute aiding or agreeing with third parties to intercept communications, satisfying CIPA’s requirements. The motion to dismiss this claim was denied.
- California Confidentiality of Medical Information Act (CMIA): The court held that plaintiffs adequately alleged the disclosure of “medical information” as defined by the statute, including information about medical conditions, treatments, and identities, transmitted alongside PII. The motion to dismiss was denied for these claims.
- Invasion of Privacy (California Constitution): The court found that plaintiffs had a reasonable expectation of privacy in their sensitive health information and that the alleged disclosures to third parties for advertising purposes could be considered “highly offensive.” The claim survived dismissal.
- Unjust Enrichment: Plaintiffs plausibly alleged that they paid for medical services under the expectation of confidentiality, and that defendants unjustly retained benefits by disclosing patient data for marketing. The claim was allowed to proceed.
- Unfair Competition Law (UCL): The court found that plaintiffs had statutory standing under a “benefit of the bargain” theory, as they alleged economic injury from not receiving the confidentiality they expected when purchasing medical services.
- Electronic Communications Privacy Act (ECPA): Although defendants argued they were parties to the communications and thus exempt, the court held that the “crime-tort exception” could apply because plaintiffs plausibly alleged the interception was for the purpose of violating HIPAA. The claim was not dismissed.
- Comprehensive Computer Data Access and Fraud Act (CDAFA): The court dismissed this claim, finding that plaintiffs failed to allege any “damage” or “loss” to their computer systems as required by the statute. Leave to amend was granted.
- California Customer Records Act (CRA): The court dismissed this claim, holding that the statute addresses breaches of security (i.e., unauthorized access by outsiders), not a company’s own use of customer data. Leave to amend was granted.
- Trespass to Chattels: The court dismissed this claim, finding that the mere placement of cookies on users’ devices, without allegations of measurable impairment or loss of use, was insufficient to state a claim. Leave to amend was granted.
- First-to-File Rule: For certain plaintiffs and claims overlapping with an earlier-filed action in another district, the court dismissed those claims without prejudice to avoid duplicative litigation.
- Standing and Timeliness: The court found that plaintiffs had Article III standing and that, at the pleading stage, their claims were not time-barred, especially in light of the delayed discovery of the alleged conduct.
Doe v. Tenet Healthcare Corp., 789 F. Supp. 3d 814 (E.D. Cal. 2025).
