1 2 3 4 5 6 7 UNITED STATES DISTRICT COURT 8 NORTHERN DISTRICT OF CALIFORNIA 9

10 Case No. 23-cv-01033-RS IN RE BETTERHELP, INC. DATA

11 DISCLOSURE CASES ORDER GRANTING IN PART AND 12 DENYING IN PART MOTION TO DISMISS FIRST AMENDED 13 CONSOLIDATED COMPLAINT 14

15 16 A motion to dismiss the initial consolidated complaint in these putative class actions was 17 denied in part and granted in part. Plaintiffs then filed a First Amended Consolidated Complaint 18 (“FACC”) that abandons some of the dismissed claims, amends other, and adds one new claim. 19 Plaintiffs also articulate additional grounds in support of their requests for injunctive and 20 declaratory relief made under several of the counts. Defendant BetterHelp, Inc. now moves to 21 dismiss the amended claims, the new claim, and the requests for injunctive and declaratory relief. 22 Pursuant to Civil Local Rule 7-1(b), the motion is suitable for disposition without oral argument, 23 and the hearing set for October 17, 2024, has been vacated. The motion will be granted in part, and 24 denied in part. 25 26 1. Confidentiality of Medical Information Act 27 California’s Confidentiality of Medical Information Act (“CMIA”) prohibits the 1 provider of healthcare.

. This claim was previously dismissed because 2 BetterHelp had shown it does not meet any applicable statutory definition of “provider of health 3 care.” Plaintiffs were given leave to amend to allege any facts that place BetterHelp within the 4 statutory definitions. 5 The FACC presents no additional facts on this issue. Instead, plaintiffs present a new legal 6 contention, arguing that at least one provision of the CMIA governs all “corporations,” without 7 regard to whether those entities otherwise would meet the definition of healthcare provider. 8 Plaintiffs rely on a 2001 amendment to

(d) that added the underscored 9 language in the following quote:

10 Except to the extent expressly authorized by the patient or enrollee or subscriber or as provided by subdivisions (b) and (c), no provider 11 of health care, health care service plan contractor, or corporation and 12 its subsidiaries and affiliates shall intentionally share, sell, or otherwise use any medical information for any purpose not 13 necessary to provide health care services to the patient. 14 The statutory language may not be a model of drafting clarity. Plaintiffs correctly observe that, as 15 a matter of grammar, there is no link between “corporation” and “health care” or any other 16 modifier inarguably restricting the kinds of corporations to which the code section applies. The 17 language must nevertheless be read in context and with an application of commonsense. Plaintiffs’ 18 argument that the CMIA should be understood as applying to all corporations by virtue of the 19 2001 amendment is creative, but not persuasive. 20 Plaintiffs rely heavily on J.M. v. Illuminate Educ., Inc.,

(2024), in 21 which a California court of appeal expressly found that the “reach” of the CMIA “extends beyond 22 medical providers.”

. The Illuminate plaintiff alleged the defendant had been negligent 23 in maintaining a student health database, leading to a data breach. Notably, § 56.10(d) was not 24 implicated in that case, as there was no claim the defendant had intentionally shared, sold, or 25 otherwise used medical information for a purpose other than providing medical care. The court 26 concluded the defendant was subject to the CMIA under § 56.06, which expressly lists types of 27 businesses that will be deemed to be “provider[s] of health care.” 1 Indeed, as noted in the prior order, § 56.06(d) now includes businesses offering “mental 2 health digital services” among those expressly subject to the CMIA. That subsection, however, did 3 not become effective until January 1, 2023, well after the complained-of conduct occurred, and 4 plaintiffs do not contend it can be given retroactive effect. The addition of § 56.06(d) in 2023, 5 which plainly was designed to bring BetterHelp and similar services within the definition of 6 “provider of health care,” however, further undermines any argument that BetterHelp was already 7 subject to the prohibitions of § 56.10(d) merely because it was a “corporation.” 8 The CMIA claim is therefore dismissed. No further leave to amend is warranted. 9 10 2. UCL and CLRA standing 11 Plaintiffs’ UCL and CLRA claims were previously dismissed for failure to plead the 12 requisite economic injury-in-fact. See, Reid v. Johnson & Johnson,

(9th Cir. 13 2015). Plaintiffs had focused on the claimed economic value of their allegedly misappropriated 14 personal information, which the order found would not establish compensable damages. See Katz- 15 Lacabe v. Oracle Am., Inc.,

, 943. (N.D. Cal. 2023). Plaintiffs now stress that 16 they paid BetterHelp for its services on a monthly basis, relying on its assurances that personal 17 information would be kept confidential. 18 BetterHelp argues plaintiffs cannot rely on a theory that they did not receive the benefit of 19 their bargain because they are no longer pursuing an express false advertising claim and/or 20 because they have not shown they were paying specifically for data security measures that 21 BetterHelp failed to implement. BetterHelp’s argument, however, presupposes it breached no 22 enforceable promises to keep plaintiffs’ personal information confidential. Plaintiffs have 23 adequately alleged they relied on BetterHelp’s assurances of confidentiality when they paid 24 BetterHelp for its services. See In re Anthem, Inc. Data Breach Litig.,

, 985 25 (N.D. Cal. 2016)(finding alleged benefit of the bargain losses to constitute cognizable economic 26 injury). The motion to dismiss the UCL and CLRA claims is denied. 27 1 3. Breach of implied contract 2 The prior order observed that plaintiffs were alleging, in essence, that they entered into 3 contractual relationships with BetterHelp, and that BetterHelp’s various promises of 4 confidentiality were part of the terms of those contracts. Without concluding the original 5 consolidated complaint necessarily failed to state a contractual claim, the order directed plaintiffs 6 to provide greater specificity in alleging how the contracts were formed, the alleged contractual 7 terms, and the facts plaintiffs contend establish breach. Plaintiffs have now more clearly identified 8 the particular promises they contend BetterHelp made and breached. There is no basis to dismiss 9 the claim for breach of implied contract. See Castillo v. Seagate Tech., LLC,

, at 10 *9 (N.D. Cal. Sept. 14, 2016) (“The upshot of the averments in the plaintiffs’ complaint, however, 11 is quite clear: The employees provided their personal information . . . with the understanding that 12 Seagate, while it held the information, would take adequate measures to protect it.”) 13 14 4. Stored Communications Act 15 Plaintiffs bring claims in the FACC under two different parts of Electronic 16 Communications Privacy Act (“ECPA”): the Wiretap Act (Count IV) and the Stored 17 Communications Act (Count V) (“SCA”). Plaintiffs’ claim under the Wiretap Act survived 18 BetterHelp’s earlier motion to dismiss and is unchanged. Plaintiffs have added a new claim, 19 however, under the SCA. 20 The SCA provides that, with certain exceptions, a person or entity providing either an 21 electronic communication service or remote computing service to the public shall not “knowingly 22 divulge to any person or entity the contents of a communication while in electronic storage by that 23 service [.]”

(a)(1). BetterHelp insists the SCA does not apply because it is not 24 “in the business of providing electronic communications services,” in the manner of ordinary 25 email and internet service providers. The FACC alleges, however, that BetterHelp customers 26 communicate with their therapists through the conduit of BetterHelp’s websites. BetterHelp has 27 not shown the statute should be construed so narrowly as to apply only to internet service 1 providers.1 BetterHelp’s further argument that it did not divulge information “while in electronic 2 storage” presents factual issues not appropriately resolved at the pleading stage. The motion to 3 dismiss the SCA claim is denied. 4 5 5. Injunctive and Declaratory Relief 6 The claims for injunctive and declaratory relief in the original consolidated complaint were 7 dismissed because plaintiffs had not pleaded facts showing “a sufficient likelihood that [they] will 8 again be wronged in a similar way” by BetterHelp absent injunctive relief. See Williams v. Apple, 9 Inc.,

, 906 (N.D. Cal. 2020) (quotation omitted). Plaintiffs were given leave to 10 amend to show: (1) some right or duty on BetterHelp’s part to control the conduct of third parties, 11 and (2) a sufficient factual basis to show the requisite ongoing or future harm exists 12 notwithstanding the existence of the injunctive relief obtained by the FTC. The FACC fails to do 13 either. Plaintiffs’ allegations that BetterHelp has not complied with all of its obligations under the 14 FTC’s injunction, even if accurate, do not provide a basis for this court to enter a second 15 injunction requiring similar action. The requests for injunctive and declaratory relief are 16 dismissed, without leave to amend. 17 18 The motion to dismiss the FACC is granted to the extent specified above, and is otherwise 19 denied. Defendant shall file an answer within 20 days of the date of this order. 20 21 22 IT IS SO ORDERED. 23

24 1 BetterHelp relies on Crowley v. CyberSource Corp.,

(N.D. Cal. 2001), in which online retailer Amazon was found not to be an electronic communication service, 25 despite an argument that it receives electronic communications from its customers through its platform. The distinction is that BetterHelp does not merely receive its own customers’ 26 communications electronically, it allegedly facilitates two-way electronic communications 27 between its customers and third-party therapists. 1 2 Dated: October 15, 2024 RICHARD SEEBORG 4 Chief United States District Judge 5 6 7 8 9 10 11 gq 12

© 15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28 CASE No. 23-cv-01033-RS