Deborah Caine, individually and on behalf of all others similarly situated v....

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS * DEBORAH CAINE, individually and on * behalf of all others similarly situated, * * Plaintiff, * * v. * Civil Action No. 25-cv-10261-ADB * STURDY MEMORIAL HOSPITAL, INC., * * Defendant. * * *

MEMORANDUM AND ORDER

BURROUGHS, D.J.

Before the Court are a motion to dismiss by Defendant Sturdy Memorial Hospital, Inc. (“Sturdy Memorial” or “Defendant”), [ECF No. 8], and a motion to amend by Plaintiff Deborah Caine (“Caine” or “Plaintiff”), [ECF No. 14]. For the following reasons, Sturdy Memorial’s motion to dismiss is GRANTED, and Caine’s motion to amend is DENIED as moot in light of this Order.

I. BACKGROUND The following relevant facts are taken from Caine’s Amended Class Action Complaint (“Amended Complaint”), [ECF No. 1-14 (“Am. Compl.”)], the factual allegations of which the Court assumes to be true when considering a motion to dismiss. Ruivo v. Wells Fargo Bank, N.A., 766 F.3d 87, 90 (1st Cir. 2014). As it may on a motion to dismiss, the Court has also considered “documents incorporated by reference in [the complaint], matters of public record, and other matters susceptible to judicial notice.” Giragosian v. Ryan, 547 F.3d 59, 65 (1st Cir. 2008) (alteration in original) (quoting In re Colonial Mortg. Bankers Corp., 324 F.3d 12, 20 (1st Cir. 2003)).

A. Factual Background Sturdy Memorial is an integrated health system that offers emergency and urgent care, hospital-based care, and primary and specialty practices across thirty-two facilities in Massachusetts. [Am. Compl. ¶ 13]. On Sturdy Memorial’s website, www.sturdyhealth.org (“the website”), users can research medical conditions, treatment options, and doctors. [Id. ¶¶ 40–43].

Patients can also log in to Sturdy Memorial’s patient portal through the website to book appointments, communicate with providers, access medical records and lab results, and pay bills. [Id. ¶¶ 44, 66].

Caine was a Sturdy Memorial patient from the 1990s through July 2023. [Am. Compl. ¶ 22]. During that time, Caine “used Sturdy’s website frequently” to research medical conditions and book appointments, [id. ¶¶ 22, 24], and “specifically to locate doctors at Sturdy’s North Attleboro Medical Center facility and [to search] for other information concerning women’s health that was pertinent to her,” including “information on several significant health issues, the specifics of which are highly sensitive,” [id. ¶ 23].1 Caine alleges that patients’ communications with the website, including her own, are “communications between Sturdy and its patients,” and that Sturdy Memorial “allows Google to intercept those communications by embedding Google Analytics,” a user-tracking technology,

B. Procedural History Caine initially filed a complaint in Suffolk Superior Court on July 24, 2024. [ECF No. 1- 2]. On January 24, 2025, Caine filed the operative Amended Complaint on behalf of a putative class, [ECF No. 1-14], in which, as relevant here, she alleged that she used Sturdy Memorial’s website to search for “information on several significant health issues, the specifics of which are highly sensitive but which [she] would disclose under a confidentiality agreement,” [id. ¶ 23].

Additionally, the Amended Complaint included a new ECPA claim against Sturdy Memorial, [id. ¶¶ 138–55], that allowed Sturdy Memorial to remove the case to this Court based on federal jurisdiction under 28 U.S.C. § 1441(c) and 28 U.S.C. § 1331. [ECF No. 1].

On March 14, 2025, Sturdy Memorial filed the instant motion to dismiss the Amended Complaint for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6), [ECF No. 8]; see also [ECF No. 9 (“Def.’s Mem.”)], which Caine opposed on April 25, 2025, [ECF No. 18 (“Pl.’s Opp’n”)]. Sturdy Memorial replied on May 16, 2025, [ECF No. 20 (“Def.’s Reply”)], and then filed a notice of supplemental authority in support of its motion to dismiss on June 26, 2025, [ECF No. 21], to which Caine responded on June 27, 2025, [ECF No. 22]. Caine filed another notice of supplemental authority on August 11, 2025, [ECF No. 23], and Sturdy Memorial responded on August 19, 2025, [ECF No. 24].

On April 22, 2025, while the parties’ motion-to-dismiss briefing was in progress, Caine filed the instant motion to amend. [ECF No. 14]; see also [ECF No. 15 (supporting memorandum)]. Caine requests leave to add “the private health information Sturdy shared with Google,” which Caine had previously offered to disclose in a confidentiality agreement, and to “redact[] that information so only Sturdy and the Court may view it.” [ECF No. 15 at 5]. Caine makes her request on the basis that “[t]he crux of Sturdy’s motion is that [her] failure to specify exactly what aspects of her private health information [she] shared with Google renders her claims invalid.” [Id.]. Sturdy Memorial opposed the motion to amend on May 5, 2025. [ECF No. 19].

II. LEGAL STANDARD On a motion to dismiss pursuant to Rule 12(b)(6), the Court must accept as true all well- pleaded facts, analyze them in the light most favorable to the plaintiff, and draw all reasonable inferences from those facts in favor of the plaintiff. United States ex rel. Hutcheson v. Blackstone Med., Inc., 647 F.3d 377, 383 (1st Cir. 2011). In addition to “the facts alleged in the complaint,” the Court may also consider “documents incorporated by reference therein and facts susceptible to judicial notice.” MIT Fed. Credit Union v. Cordisco, 470 F. Supp. 3d 81, 84 (D.

Mass. 2020) (citing Haley v. City of Bos., 657 F.3d 39, 46 (1st Cir. 2011)). “[A] complaint must provide ‘a short and plain statement of the claim showing that the pleader is entitled to relief,’” Cardigan Mountain Sch. v. N.H. Ins. Co., 787 F.3d 82, 84 (1st Cir. 2015) (quoting Fed. R. Civ. 5 P. 8(a)(2)), and set forth “factual allegations, either direct or inferential, respecting each material element necessary to sustain recovery under some actionable legal theory,” Pitta v. Medeiros, 90 F.4th 11, 17 (1st Cir. 2024) (quoting Gagliardi v. Sullivan, 513 F.3d 301, 305 (1st Cir. 2008)).

Although detailed factual allegations are not required, a complaint must set forth “more than labels and conclusions,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007), and “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice,” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Rather, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Id. (quoting Twombly, 550 U.S. at 570). “[A]ssessing plausibility is ‘a context- specific task that requires the reviewing court to draw on its judicial experience and common sense.’” Frith v. Whole Foods Mkt., Inc., 38 F.4th 263, 270 (1st Cir. 2022) (quoting Rodríguez- Reyes v. Molina-Rodríguez, 711 F.3d 49, 53 (1st Cir. 2013)).

III. DISCUSSION Count I of Caine’s Amended Complaint, which asserts a violation of the ECPA, provides the sole basis for federal jurisdiction. [Am. Compl. ¶¶ 138–55]. The ECPA prohibits any person from intentionally intercepting, endeavoring to intercept, or procuring any other person to intercept or endeavor to intercept any wire, oral, or electronic communication; intentionally disclosing or endeavoring to disclose to any other person the contents of any electronic communication, knowing or having reason to know that the information was obtained through the interception of an electronic communication in violation of 18 U.S.C. § 2511(1); or intentionally using or endeavoring to use the contents of any electronic communication, knowing or having reason to know that the information was obtained through the interception of an electronic communication in violation of 18 U.S.C. § 2511(1). 18 U.S.C. § 2511(1)(a), (c)–(d).

Under § 2511(2)(d), a party can generally avoid liability if they are “a party to the communication” that they intercept or if “one of the parties to the communication has given prior consent to such interception,” unless they trigger the crime-tort exception. Id. § 2511(2)(d).

Under the crime-tort exception, as relevant here, a party can be liable under the ECPA only if they “intercepted [the communication] for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” Id. Here, the parties’ dispute turns on the applicability of the crime-tort exception. Caine, leaning on cases in which courts have interpreted the exception broadly, argues that it applies because Sturdy Memorial “captured and redirected Plaintiff’s information to third parties without consent,” thus violating the Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 1320d-6, and intruding upon Caine’s seclusion. See [Pl.’s Opp’n at 13–16 (enumerating cases interpreting § 2511(2)(d))]; see, e.g., In re Grp. Health Plan Litig., 709 F.

Supp. 3d 707, 719 (D. Minn. 2023) (“The existence of a lawful purpose does not sanitize an interception that was also made for an illegitimate purpose.” (quoting In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 797 (N.D. Cal. 2022))); [Am. Compl. ¶¶ 150–53 (premising the § 2511(2)(d) allegations on a violation of HIPAA and “[a] knowing intrusion upon Plaintiff’s and Class members’ seclusion”)]. Sturdy Memorial, in contrast, emphasizes cases that construe the exception narrowly. See [Def.’s Mem. at 13–16]; [Def.’s Reply at 8–16].

In particular, Sturdy Memorial urges an interpretation that requires a specific intent to commit a crime or tort, as well as intent to harm, for the exception to apply. See, e.g., [Def.’s Reply at 9– (citing Thomas v. Pearl, 998 F.2d 447, 451 (7th Cir. 1993) (holding that the crime-tort exception required plaintiff to “show that [defendant] either intended to break the law or commit a tort against him in order to prove a violation of” the statute))]; [id. at 10 (“[I]t seems apparent from the context in which the statute was enacted that the sort of conduct contemplated was an interception by a party to a conversation with an intent to use that interception against the non- consenting party in some harmful way and in a manner in which the offending party had no right to proceed.” (quoting Meredith v. Gavin, 446 F.2d 794, 799 (8th Cir. 1971)))]; [id. at 13 (“For the crime-tort exception to apply, Plaintiff must—but does not—plausibly allege that Sturdy Memorial . . . installed Google technologies on its public website for the distinct purpose of violating HIPAA or perpetrating a tort, like invasion of privacy or breach of confidentiality—i.e., that Sturdy Memorial deployed these technologies because it ‘intended to harm’ its patients and other visitors to its website.” (quoting United States v. McHugh, 57 F. Supp. 3d 95, 100 (D.

Mass. 2014)))].

This Court does not read “for the purpose of committing any criminal or tortious act,” 18 U.S.C. § 2511(2)(d), to require the specific intent to commit a crime or tort, nor the intent to harm. Stein v. Edward-Elmhurst Health, No. 23-cv-14515, 2025 WL 580556, at *6 (N.D. Ill. Feb. 21, 2025) (“A desire to commit a crime qua crime, or a tort qua tort, isn’t necessary.”), cert. granted, No. 23-cv-14515, 2026 WL 594752 (N.D. Ill. Mar. 3, 2026); Doe v. Lawrence Gen. Hosp., No. 25-cv-10081, 2025 WL 2808055, at *20 (D. Mass. Aug. 29, 2025) (“ECPA . . . says nothing about harm or injury. . . . Given that the word ‘injurious’ did not make it into the final version as enacted, it seems anomalous to read the statute as if it had.”), report and recommendation accepted in relevant part, No. 25-cv-10081, 2025 WL 2807673 (D. Mass. Sept.

30, 2025). Further, the Court agrees with Caine that Sturdy Memorial’s lawful purposes—like marketing—do not preclude the possibility that its conduct might trigger § 2511(2)(d). The statutory language is not so narrow. At the same time, “‘purpose’ is an essential element of ECPA.” Doe, 2025 WL 2808055, at *12. Accordingly, to state a claim under the ECPA’s crime-tort exception, Caine must plead facts showing that Sturdy Memorial purposefully—not merely knowingly or negligently—committed criminal or tortious acts. Stein, 2025 WL 580556, at *6 (“The purpose must be to commit an act, and that act must be criminal or tortious. If the purpose is to do X, and if X is a crime or a tort, then the crime-tort exception . . . applies.”).

The Amended Complaint falls short of that standard. Caine essentially proposes two acts to which she argues the crime-tort exception applies: Sturdy Memorial’s (1) acquisition of IIHI without authorization;2 and (2) knowing intrusion upon seclusion. See [Am. Compl. ¶¶ 150–53].

To rely on § 2511(2)(d), then, Caine must—but fails to—plausibly allege that Sturdy Memorial purposefully acquired IIHI without authorization or purposefully intruded upon her seclusion.

With respect to IIHI, although Caine emphasizes that Sturdy Memorial chose not to opt in to Google Analytics’ IP anonymization feature, [id. ¶¶ 50–53], the facts are too thin to support the inference that Sturdy Memorial installed the tracking tools for the purpose of acquiring IIHI without authorization. Likewise, even though Caine suggests that Sturdy Memorial may have been on notice regarding privacy risks surrounding the collection of health data, [id. ¶¶ 73–75, 92], the Court cannot, based on the Amended Complaint, draw the inference that the health care system purposefully intruded on its patients’ seclusion or privacy.

For the purposes of this Order, which deals with the limited question of whether Sturdy Memorial’s acts satisfy the ECPA’s crime-tort exception, the Court treats these allegations as boiling down to one act: the acquisition of IIHI without authorization.

Because the Amended Complaint does not plausibly allege that Sturdy Memorial intercepted communications “for the purpose of committing [a] criminal or tortious act,” 18 U.S.C. § 2511(2)(d), the ECPA claim fails, and Count I is DISMISSED.

The Court declines to exercise supplemental jurisdiction over the remaining claims, all of which arise under state law. See 28 U.S.C. § 1367(c) (stating that “district courts may decline to exercise supplemental jurisdiction” when “the district court has dismissed all claims over which it has original jurisdiction”); United Mine Workers of Am. v. Gibbs, 383 U.S. 715, 726 (1966) (“It has consistently been recognized that pendent jurisdiction is a doctrine of discretion, not of plaintiff’s right. . . . Needless decisions of state law should be avoided both as a matter of comity and to promote justice between the parties, by procuring for them a surer-footed reading of applicable law. Certainly, if the federal claims are dismissed before trial . . . the state claims should be dismissed as well.”).

IV. CONCLUSION For the reasons stated above, Sturdy Memorial’s motion to dismiss the Amended Complaint is GRANTED without prejudice and with leave to amend within 21 days. Further, because this Order grants leave to amend, Caine’s motion to amend is DENIED as moot.3 SO ORDERED.

March 10, 2026 /s/ Allison D. Burroughs ALLISON D. BURROUGHS U.S. DISTRICT JUDGE