Okash v. Essentia Health
U.S. District Court, District of Minnesota
Okash v. Essentia Health
Trial Court Opinion
UNITED STATES DISTRICT COURT
DISTRICT OF MINNESOTA
MICHAEL OKASH, individually, and on
behalf of those similarly situated,
Civil No. 23-482 (JRT/LIB)
Plaintiff,
v. MEMORANDUM OPINION AND ORDER
GRANTING IN PART AND DENYING IN
Essentia Health, PART DEFENDANT’S MOTION TO
DISMISS
Defendant.
Anne T. Regan and Nathan D. Prosser, HELLMUTH & JOHNSON PLLC, 8050
West 78th Street, Edina, MN 55439; Anthony Stauber, Daniel E. Gustafson,
David A. Goodwin, and Karla M. Gluek, GUSTAFSON GLUEK PLLC, 120 South
Sixth Street, Suite 2600, Minneapolis, MN 55402; Benjamin Cooper, Brian C.
Gudmundson, Jason P. Johnston, Michael J. Laird, and Rachel Kristine Tack,
ZIMMERMAN REED LLP, 1100 IDS Center, 80 South Eighth Street,
Minneapolis, MN 55402; and Hart L. Robinovitch, ZIMMERMAN REED LLP,
14648 North Scottsdale Road, Suite 130, Scottsdale, AZ 85254, for Plaintiff.
Anderson Tuggle, Andy Taylor, and Jeffrey P. Justman, FAEGRE DRINKLE
BIDDLE & REATH LLP, 2200 Wells Fargo Center, 90 South Seventh Street,
Minneapolis, MN 55402; Justin O’Neill Kay, FAEGRE DRINKER BIDDLE &
REATH LLP, 320 South Canal Street, Suite 3300, Chicago, IL 60606; and Zoe
K. Wilhelm, FAEGRE DRINKER BIDDLE & REATH LLP, 1800 Century Park East,
Suite 1500, Los Angeles, CA 90067, for Defendant.
Plaintiff Michael Okash contends that Defendant Essentia Health’s (“Essentia”)
deployment of Meta Pixel tracking software on essentiahealth.org violates a slew of
federal and state privacy and consumer protection laws. His complaint suffers from
significant pleading defects, many of which appear to be symptoms of Okash’s focus on
Meta Pixel litigation against other healthcare providers rather than the facts of this case.
The Court will dismiss without prejudice Okash’s claims under federal and state wiretap
laws, the Minnesota Health Records Act, and state tort law. At the same time, Okash
plausibly alleges violations of the Minnesota Consumer Fraud Act and Minnesota Uniform
Deceptive Trade Practices Act and states a viable claim for unjust enrichment.
BACKGROUND
I. FACTS
Plaintiff Michael Okash has received medical care from Essentia since 2000. (Am.
Compl. ¶¶ 18–19, May 15, 2023, Docket No. 15.) Okash brings this putative class action
on behalf of himself and others similarly situated, defined as “[a]ll persons whose
Sensitive Information was disclosed to a third party through Defendant’s Website without
authorization or consent.” (Id. ¶ 106.)
Essentia maintains a website, essentialhealth.org, which allows patients to find
medical facilities and services and conduct research on medical issues, conditions,
medications, and doctors. (Id. ¶ 2.) Okash recalls using the website to research doctors
and investigate various treatments and medical conditions. (Id. ¶ 21.) In addition to
essentiahealth.org, Essentia provides an online patient portal, MyChart, that allows
patients to communicate with their providers, schedule appointments, review medical
records, and pay bills. (Compl. ¶ 3, Feb. 28, 2023, Docket No. 1.)
Essentia employs Meta Platform, Inc.’s (“Meta”) tracking technology, Meta Pixel
(“Pixel”), on essentialhealth.org. (Am. Compl. ¶¶ 52–53, 60.) Pixel tracks a website user’s
activity and transmits data to Meta, including the pages and subpages visited by the
website user, and searches, clicks, and other submissions to the website. (Id. ¶ 5); see
also In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 784–86 (N.D. Cal. 2022)
(explaining the Pixel technology). For example, if a visitor to essentiahealth.org clicks on
the “Doctors & Providers” page, data documenting that navigation would be sent to
Meta. (Am. Compl. ¶ 57.) The data is often then associated with the user’s Facebook
account and used for advertising purposes. (Id. ¶¶ 54–55, 59.) Okash recalls receiving
targeted advertisements based on his research on essentiahealth.org. (Id. ¶ 26.)
Essentia’s website includes a privacy policy indicating it is “committed to
protecting the privacy of those who visit our website.” (See Decl. Jeffrey P. ¶ 4, Ex. A
(“Privacy Policy”) at 2, June 23, 2023, Docket No. 26.) In a section on tracking
technologies, the policy discloses “[w]e may also use Facebook Pixel that enables us to
understand how users interact with our website after seeing an ad on Facebook and then
clicking through to our website.” (Id. at 3.)
II. PROCEDURAL HISTORY
Okash’s initial complaint alleged privacy violations on his MyChart account as well
as essentiahealth.org. (See, e.g., Compl. ¶ 117.) He filed an amended complaint that
drops all references to MyChart because Essentia does not use the Pixel on MyChart. (See
generally Am. Compl.) Okash alleges Essentia violated federal wiretap laws as well as
state statutory and common law by transmitting data from essentialhealth.org to Meta
through the Pixel. (See generally id.) Essentia now moves to dismiss all counts. (Def.’s
Mot. Dismiss, June 23, 2023, Docket No. 23.)
DISCUSSION
I. STANDARD OF REVIEW
In reviewing a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), the
Court considers all facts alleged in the Complaint as true to determine if the Complaint
states a “claim to relief that is plausible on its face.” Braden v. Wal-Mart Stores, Inc., 588
F.3d 585, 594(8th Cir. 2009) (quoting Ashcroft v. Iqbal,556 U.S. 662, 678
(2009)). The Court construes the Complaint in the light most favorable to the plaintiff, drawing all reasonable inferences in the plaintiff’s favor. Ashley Cnty. v. Pfizer, Inc.,552 F.3d 659, 665
(8th Cir. 2009). Although the Court accepts the complaint’s factual allegations as true, it is “not bound to accept as true a legal conclusion couched as a factual allegation,” Bell Atl. Corp. v. Twombly,550 U.S. 544, 555
(2007), or mere “labels and conclusions or a formulaic recitation of the elements of a cause of action,” Iqbal,556 U.S. at 678
(quotation omitted). Instead, “[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”Id.
At the motion to dismiss stage, the Court may consider the allegations in the
Complaint as well as “those materials that are necessarily embraced by the pleadings.”
Schriener v. Quicken Loans, Inc., 774 F.3d 442, 444(8th Cir. 2014). The Court may also consider matters of public record and exhibits attached to the pleadings, as long as those documents do not conflict with the Complaint. Porous Media Corp. v. Pall Corp.,186 F.3d 1077, 1079
(8th Cir. 1999).
II. PRELIMINARY FACTUAL DETERMINATIONS
There are two recurring factual disputes the Court will address upfront to aid
subsequent resolution of the legal issues. First, because this action is limited to Essentia’s
general website, the Court will address the type of information transmitted therein.
Second is the degree to which the privacy policy puts the public on notice of Essentia’s
use of Pixel.
A. Website Information
As Essentia observes, Okash has dropped all allegations related to MyChart
because Essentia never embedded the Pixel in MyChart. Rather, the Amended Complaint
pertains to Essentia’s public-facing website, essentiahealth.org and its sub-links.
Nonetheless, Okash continues to allege that certain sensitive information is collected that
appears possible only through a connection to MyChart. For example, Okash alleges that
Essentia shared information related to the “dates, times, and/or locations of scheduled
appointments,” the “type of appointment or procedure scheduled,” “communications
between patients and Essentia,” “information about whether patients have insurance,”
and more. (Am. Compl. ¶ 9.)
Simple browsing of Essentia’s website reveals that those personalized pieces of
information are the province of MyChart.1 Accordingly, some of Okash’s allegations fail
to meet the plausibility pleading standard. Broadly, the type of information allegedly
revealed to Meta fits two categories. First, which the Court will accept, are those pieces
of information that a patient generates through unilateral action on essentiahealth.org.
That includes, for example, the patient’s IP address, doctors and treatments researched,
search terms, and whether the patient tries to log in to a MyChart account (which would
be revealed by clicking the MyChart link on essentiahealth.org). The second bucket is
customized information that results from two-way communication between the patient
and Essentia, which would be embedded only in MyChart. That includes specific
appointment information, written communication from a patient to Essentia, medical
records, and like content. The Court will disregard as implausible the allegation that those
types of communications are included on Essentia’s general website. To the extent Okash
believes those personalized records are still intercepted by the Pixel and he chooses to
file a second amended complaint, he should more precisely specify where and how on
the general website such information may be found.
1 The Court may take judicial notice of the contents of Essentia’s website; after all, a
complaint necessarily embraces a website when a defendant’s conduct on that website is central
to the dispute. See WinRed, Inc v. Ellison, 581 F. Supp. 3d 1152, 1167 n.9 (D. Minn. 2022).
B. Privacy Policy
The Court may appropriately consider Essentia’s Privacy Policy, both as an aspect
of the disputed website and contractual material necessarily embraced by the pleadings.
See WinRed, 581 F.3d at 1167 n.9; Mattes v. ABC Plastics, Inc., 323 F.3d 695, 697 n.4 (8th Cir. 2003); (Am. Compl. ¶ 33 (referencing the Privacy Policy).) The Privacy Policy is a standard browsewrap agreement. See Foster v. Walmart, Inc.,15 F.4th 860, 863
(8th Cir. 2021). A user must follow hyperlinks on the website to read the Policy, and the Policy asserts that usage of the website manifests the user’s assent. (Privacy Policy at 5.) Courts determine the enforceability of a browsewrap agreement from the adequacy of notice, whether actual or inquiry. Foster, 15 F.4th at 863–84. The record is insufficient to determine such fact-bound questions, though. Seeid. at 864
. On a Rule 12(b)(6) standard
of review, there is no manifestation of mutual assent, and the Court will not assume the
Privacy Policy constitutes a valid contract.
As far as the adequacy of disclosure for various statutory purposes, the Court will
largely address such issues below while noting upfront one universal concern. The privacy
policy discloses that Essentia uses the Pixel to “understand how users interact with our
website after seeing an ad on Facebook and then clicking through to our website.”
(Privacy Policy at 3.) The complaint alleges, though, that the Pixel was in continuous use
on the website, whether a patient clicked through from a Facebook ad or navigated to
the page by any other means. Taking as true Okash’s allegations, the Court finds the
Policy does not disclose the full extent of Essentia’s Pixel usage.
III. ECPA
The Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2510et seq., prohibits the intentional interception of “any wire, oral, or electronic communication,” as well as the use or disclosure of any “content[s]” thereof. See18 U.S.C. § 2511
(1).2 Parties are exempt from interception liability, though, if they are a “party to the communication or where one of the parties to the communication has given prior consent to such interception.”18 U.S.C. § 2511
(2)(d). But that is only true if the party does not intercept the communication “for the purpose of committing any criminal or tortious act.”Id.
Okash alleges three independent bases for liability under § 2511(1), claiming
Essentia intercepted, divulged, and used communications in violation of ECPA.3 But the
party exception applies and Okash’s complaint does not allege sufficient facts for the
Court to apply the crime-tort carveout. Accordingly, Okash does not plead an unlawful
interception. And because the use and disclosure prohibitions require an underlying
unlawful interception, neither were those provisions violated.
2 Because the federal and state wiretapping statutes are coterminous, the parties agree
the Court should analyze them jointly. See Wagner v. Wagner, 64 F. Supp 2d 895, 899 (D. Minn.
1999); compare 18 U.S.C. § 2511, with Minn. Stat. § 626A.02. For simplicity, the Court will
reference only the federal statutes.
3 Okash abandoned his § 2511(3) claim, which would have been unmeritorious in any
event. Accordingly, the Court will dismiss Count III of Okash’s amended complaint with prejudice.
A. Party Exception
The party exception clarifies that a person does not violate ECPA by
“intercept[ing]” a communication “where such person is a party to the communication.”
18 U.S.C. § 2511(d). The exception applies even to an intended recipient that duplicates and forwards the communication to a third party. See, e.g., In re Group Health Plan Litig., No. 23-267,2023 WL 8850243
, at *7 (D. Minn. Dec. 21, 2023); Kurowski v. Rush Sys. for Health (Kurowski I),659 F. Supp. 3d 931
, 937–38 (N.D. Ill. 2023). Thus, Essentia did not
unlawfully intercept Okash’s communications because Essentia was a party to the
communication.
As Okash observes, the party exception only applies to interception; it does not
excuse unlawful use or disclosure of a communication, even by a party to the
communication. See 18 U.S.C. §§ 2511(1)(c)–(d). But Essentia neither used nor disclosed wire communications as prohibited by ECPA. Section 2511(1) prohibits the use or disclosure of communications a party knows to be “obtained through the interception” of communications “in violation of this subsection.”18 U.S.C. §§ 2511
(1)(c)–(d). As already discussed, Essentia’s alleged interception was not unlawful because it was a party to the communication. And any possible interception by Meta was not “in violation of this subsection” because Essentia consented to Meta’s interception.18 U.S.C. §§ 2511
(1)(c)–(d), (2)(d). Accordingly, Essentia’s use of Meta’s advertising services did
not violate ECPA.
Okash counters that Essentia was incapable of providing valid § 2511(1)(d)(2)
consent because disclosure violated the Health Insurance Portability and Accountability
Act (“HIPAA”). See 45 C.F.R. §§ 164.508(a)(3)(4), (c)(1). Even accepting Okash’s allegation
that HIPAA regulations required his authorization, lack of authorization does not change
the fact that Essentia, a party to the communication, consented to its interception.4
Accordingly, the party exception applies as a matter of law.
B. Crime-Tort Carveout
There is a statutory carveout to the party exception. Even a consenting party may
not escape liability if the communication “is intercepted for the purpose of committing
any criminal or tortious act.” 18 U.S.C. § 2511(2)(d). Okash alleges that Essentia acted
for the purpose of criminally violating HIPAA and tortiously invading Okash’s privacy. But
because neither the alleged HIPAA nor privacy violations were independent of the
interception, the crime-tort exception does not apply.
“[I]t is well established that” the crime-tort exception “only applies where the
defendant allegedly committed a tortious or criminal act independent from the act of
recording itself.” Kurowski v. Rush Sys. for Health (Kurowski II), No 22-5380, 2023 WL
4707184, at *4 (N.D. Ill. July 24, 2023) (citing Caro v. Weintraub,618 F.3d 94, 99
(2d Cir.
4 Here, § 2511(2)(d)’s unmodified requirement for “consent” stands in contrast to
§ 2511(3)(b)(ii)’s requirement of “lawful consent.” Under the whole-text canon, the Court must
give effect to ECPA’s less demanding consent standard in § 2511(2)(d). See K Mart Corp. v.
Cartier, Inc., 486 U.S. 281, 291(1988). 2010)). In other words, the bad acts must be “secondary to the acquisition of the communication” and involve “tortious or criminal use of the interception’s fruits.” See In re Google Inc. Cookie Placement Consumer Priv. Litig.,806 F.3d 125, 145
(3d Cir. 2015); see also United States v. Jiau,734 F.3d 147, 152
(2d Cir. 2013) (confining the crime-tort
exception to “instances where the recording party intends to use the recording to harm
or injure a recorded party, such as to blackmail, threaten, or publicly embarrass the
recorded party”).
Neither Okash’s Amended Complaint nor his briefing alleges independent criminal
or tortious conduct. Okash’s allegations that Essentia violated HIPAA and privacy torts
encompass only the simultaneous interception and disclosure of information to Meta.
(See Am. Compl. ¶ 122.)
Okash argues that Essentia “improperly profited from its invasion of Plaintiff’s and
the Class members’ privacy in its use of their data for its economic value”—presumably,
for its use in targeted advertising. (Id. ¶ 123.) That subsequent advertising may be an
independent act from the underlying interception. But Okash does not allege the
advertising itself was tortious. Cf. In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d at
797 (“[T]he crime-tort exception to the Wiretap Act is inapplicable where the defendant’s
primary motivation was to make money, not to injure plaintiffs tortiously.”). Ultimately,
Okash’s citations to overcome the independence requirement either do not analyze that
requirement,5 or allege a more discrete subsequent tortious or illegal act.6
Because the complaint lacks sufficient alleged facts to suggest the interception was
undertaken to further an independent criminal or tortious act, Okash cannot overcome
the application of the party exception, and his ECPA claims against Essentia will be
dismissed.7 The Court will dismiss without prejudice, however, to allow Okash to plead
an independent connection to a tortious act, should one exist.
IV. MHRA
The Minnesota Health Records Act (“MHRA”) prohibits the release of patient
“health records” absent signed consent. See Minn. Stat. § 144.293. Essentia transmitted
information about Okash to Meta without signed consent, but the question remains
whether that information included “health records.” Okash has not pled sufficient
information for the Court to so find.
“Health record” is defined broadly to include
any information, whether oral or recorded in any form or
medium, that relates to the past, present, or future physical
5 See, e.g., Deteresa v. Am. Broad. Cos., Inc., 121 F.3d 460, 467 n.4 (9th Cir. 1997); Med. Lab. Mgmt. Cons. v. Am. Broad. Cos., Inc., No. 95-2494,1997 WL 405908
(D. Ariz. Mar. 27, 1997)
6 See, e.g., Brown v. Google, LLC, 525 F. Supp. 3d 1049, 1067 (N.D. Cal. 2021) (subsequently associating intercepted communications with user data in violation of state law); Planned Parenthood Fed’n of Am., Inc. v. Ctr. for Med. Progress,214 F. Supp. 3d 808, 828
(N.D. Cal. 2016)
(defendants used intercepted conversations in subsequent RICO acts and subsequent disclosures
that violated privacy torts).
7 Because the Court finds the party exception controls, it need not reach Essentia’s
argument that the communications did not contain any substantive content.
or mental health or condition of a patient; the provision of
health care to a patient; or the past, present, or future
payment for the provision of health care to a patient.
Id.§ 144.291 subd. 2(c) (emphasis added). “There is scant caselaw analyzing what constitutes a ‘health record.’” Furlow v. Madonna Summit of Byron, No. 19-987,2020 WL 413356
, at *2 (Minn. Ct. App. Jan. 27, 2020). Furlow, one of the few such cases, held that
a nurse’s aide who posted a photo with an unflattering caption of a wheelchair-bound
resident to social media did not violate the MHRA because the photo was not a health
record. See id., at *1. The court clarified that “[w]hile a viewer of the post may infer that
[the patient] was receiving care in a nursing home, there is nothing explicitly in the
photograph or caption that goes to the nature of the care or condition.” Id., at *3.
Furlow notwithstanding, a better-pled Complaint could likely survive a 12(b)(6)
motion. Unlike in Furlow, Okash alleges his website searches included “specific doctors
and specialists that had been referred to him” and “searching for and disclosing specific
medical diagnosis while on the website.” (Am. Compl. ¶ 21.) He further alleges that the
searches were paired with enough of a digital footprint for Meta to identify him. (See id.
¶¶ 5, 9, 104–05.) What is more, the statutory standard is undemanding. See Minn. Stat.
§ 144.293 subd. 2(c) (including “any information” that “relates to” medical conditions or
care).
At the same time, Okash does not provide specific examples of how he used the
website and what information was specifically disclosed. For example, while he says he
used the website to research doctors and conditions, he fails to include any details about
the doctors, conditions, or timeframe. Such information would help move the complaint
past a “formulaic recitation” that health records were disclosed and frame the case more
concretely moving forward. See Iqbal, 556 U.S. at 678.8 Accordingly, the Court will
dismiss Count VI without prejudice and allow Okash a chance to plead the particulars of
his MHRA claim.
V. MUDTPA
The Minnesota Uniform Deceptive Trade Practices Act (“MUDTPA”) forbids
businesses from, as relevant to this action, representing that goods or services have
characteristics they do not have or that “goods or services are of a particular standard,
quality, or grade . . . if they are of another.” Minn Stat. § 325D.44 subds. 1(5) & (7).
Essentia argues that Okash’s MUDTPA claim fails because it asks for prohibited relief and
does not meet the heightened Rule 9(b) pleading standard. Neither argument justifies
dismissal.
As to the first issue, the MUDTPA only allows injunctive relief. See Superior Edge,
Inc. v. Monsanto Co., 964 F. Supp. 2d 1017, 1041 (D. Minn. 2013). Although the complaint
alleges Okash suffered monetary damages because of Essentia’s deceptive trade
8 Compare Cousin v. Sharp Healthcare (“Cousin I”), No. 22-2040, 2023 WL 4484441, at *3 (S.D. Cal. July 12, 2023) (requiring plaintiffs to provide more detailed allegations of the information they provided via a hospital’s website to better evaluate whether the information included personal health information), with Cousin v. Sharp Healthcare (“Cousin II”), No. 22-2040,2023 WL 8007350
, at *2–3, 5 (finding the amended complaint plausibly pled disclosure of health
records once more details about the plaintiff’s website activities were provided).
practices, it ultimately asks only for permitted forms of relief, including an injunction. (See
Am. Compl. ¶¶ 165–66.)
Essentia also ventures that Okash has not alleged a sufficient risk of future damage
to be entitled to an injunction. In particular, it notes that a party on notice of a deceptive
practice “can no longer say that he will again be deceived by the practice.” Jaskulske v.
State Farm Mut. Auto. Ins. Co., No. 14-869, 2014 WL 5530758, at *6 (D. Minn. Nov. 3, 2014). Kurowski I rejected that argument under these same circumstances. 659 F. Supp. 3d at 943. Where a plaintiff remains a patient and has little choice but to continue to use the website to receive complete medical care, a deceptive trade practices claim may proceed. Id. Injunctive relief may also help remedy ongoing harms from the already- collected data. See In re Group Health Plan,2023 WL 8850243
, at *10. Accordingly, the
Court finds Okash has alleged a sufficient risk of future harm to allow his demand for
injunctive relief to proceed.
Claims under the MUDTPA are subject to the heightened Rule 9(b) pleading
standard. See E-Shops Corp. v. U.S. Bank Nat’l Ass’n, 678 F.3d 659, 665 (8th Cir. 2012).
Okash’s Amended Complaint meets the heightened standard. First, he identifies specific
misrepresentations in various Essentia policies, including the Privacy Policy. Essentia
claims the Privacy Policy cannot be deceptive because it discloses Essentia’s use of the
Pixel. But as already discussed, Okash plausibly alleges that Essentia exceeds the
disclosed use of the Pixel by failing to limit the Pixel to only those web visitors who click
through from a Facebook advertisement. Okash also alleges a deceptive omission by
Essentia’s failure to comply with HIPAA and protect his sensitive health information.
Essentia argues plaintiffs may only plead an omission when the defendant owes a duty to
disclose. But the Court would be hard-pressed to find that a hospital does not owe a
patient a duty to disclose before transmitting HIPAA-protected information to third
parties.
Accordingly, the Court will deny Essentia’s Motion to Dismiss Count IV.
VI. MCFA
Essentia primarily contends that Okash’s claim fails to “demonstrate that their
cause of action benefits the public,” as required by the Minnesota Consumer Fraud Act
(“MCFA”). See Ly v. Nystrom, 615 N.W.2d 302, 314(Minn. 2000). When a plaintiff “seek[s] only damages, courts typically find no public benefit.” Select Comfort Corp. v. Tempur Sealy Int’l, Inc.,11 F. Supp. 3d 933, 937
(D. Minn. 2014). Nonetheless, the Court finds a plausible public benefit here. A class action alleging broad misrepresentations to the public serves a public benefit for its compensatory and deterrent effects, even where the action only seeks monetary damages. See Johnson v. Bobcat Co.,175 F. Supp. 3d 1130
, 1142–43 (D. Minn. 2016).
Essentia also contends Okash has not met the Rule 9(b) standard for an MCFA
claim. But those arguments largely overlap with the rejected MUDTPA pleading issues.
Accordingly, the Court will deny Essentia’s Motion to Dismiss Count VII.
VII. SECLUSION
To state a claim for intrusion upon seclusion, a plaintiff must allege that the
defendant intentionally engaged in a highly offensive intrusion into another person’s
private affairs. See Lake v. Wal-Mart Stores, Inc., 582 N.W.2d 231, 233 (Minn. 1998).
Because there was no intrusion, the Court will dismiss Count I without reaching Essentia’s
argument that the alleged intrusion was not highly offensive.
Courts generally agree that when a plaintiff voluntarily browses a healthcare
website, there is no intrusion when the Pixel transmits the information to Meta.9
Intrusion requires an “affirmative act by the defendant in obtaining the information”
which cannot exist when the information is provided by the plaintiff, even if a defendant
later shares the information. Lehman v. Zumbrota-Mazeppa Pub. Schs., No. 04-1226,
2005 WL 894756, at *4 (Minn. Ct. App. Apr. 19, 2005). Because Okash voluntarily
provided his data to Essentia, Essentia did not intrude upon his seclusion and the Court
will dismiss Count I.
9 See Kurowski I, 659 F. Supp. 3d at 943; Allen v. Novant Health, Inc., No. 22-697, 2023 WL
5486240, at *2 (M.D.N.C. Aug. 24, 2023); Hartley v. Univ. of Chi. Med. Ctr., No. 22-5891,2023 WL 7386060
, at *3 (N.D. Ill. Nov. 8, 2023); cf. C.L.D. v. Wal-Mart Stores, Inc.,79 F. Supp. 2d 1080
,
1083 n.1 (D. Minn. 1999) (holding intrusion upon seclusion inapplicable where “plaintiff
voluntarily disclosed her medical circumstances to [defendant] and cannot claim that he obtained
the information by intrusive means.”).
VIII. UNJUST ENRICHMENT
Finally, Essentia argues that Okash’s claim for unjust enrichment should be
dismissed because (1) the Privacy Policy is a governing contract, and (2) Okash has not
alleged he provided an uncompensated benefit. As already discussed, it would be
premature to hold the Privacy Policy is a governing contract. See also In re Group Health
Plan, 2023 WL 8850243, at *4.
As to uncompensated benefit, Okash alleges that Essentia receives benefits from
its use of his personal information, “including monetary compensation.” (Am. Compl.
¶ 203.) Essentia complains the pleading is not specific enough to prove an
uncompensated benefit. See Hall v. Centerspace, LP, No. 22-2028, 2023 WL 3435100, at *6 (D. Minn. May 12, 2023). But Hall did not allege the defendant received monetary compensation in exchange for the plaintiff’s data.Id.
Here, the Court must take as true
Okash’s allegation that Essentia received monetary compensation for his data, even if the
allegation lacks other specifics. Accordingly, the Court will allow Count VIII to proceed.
CONCLUSION
In sum, Okash’s claims for MUDTPA and MCFA violations and complaint of unjust
enrichment survive this motion to dismiss. The Court will dismiss Okash’s other claims
without prejudice.
ORDER
Based on the foregoing, and all the files, records, and proceedings herein, IT IS
HEREBY ORDERED that Defendant’s Motion to Dismiss [Docket No. 23] is GRANTED in
part and DENIED in part, Counts | (Invasion of Privacy), Il (18 U.S.C. § 2511(1)), V (Minn. Stat. § 626A.02), and VI (Minn. Stat. §§ 144.291
& 144.293) of Plaintiff's Amended Complaint are DISMISSED without prejudice, and Count Ill (18 U.S.C. § 2511
(3)) of
Plaintiff's Amended Complaint is DISMISSED with prejudice.
DATED: March 26, 2024 dO ag WY redatin—
at Minneapolis, Minnesota. JOHN R. TUNHEIM
United States District Judge
-19- Trial Court Opinion
UNITED STATES DISTRICT COURT
DISTRICT OF MINNESOTA
MICHAEL OKASH, individually, and on
behalf of those similarly situated,
Civil No. 23-482 (JRT/LIB)
Plaintiff,
v. MEMORANDUM OPINION AND ORDER
GRANTING IN PART AND DENYING IN
Essentia Health, PART DEFENDANT’S MOTION TO
DISMISS
Defendant.
Anne T. Regan and Nathan D. Prosser, HELLMUTH & JOHNSON PLLC, 8050
West 78th Street, Edina, MN 55439; Anthony Stauber, Daniel E. Gustafson,
David A. Goodwin, and Karla M. Gluek, GUSTAFSON GLUEK PLLC, 120 South
Sixth Street, Suite 2600, Minneapolis, MN 55402; Benjamin Cooper, Brian C.
Gudmundson, Jason P. Johnston, Michael J. Laird, and Rachel Kristine Tack,
ZIMMERMAN REED LLP, 1100 IDS Center, 80 South Eighth Street,
Minneapolis, MN 55402; and Hart L. Robinovitch, ZIMMERMAN REED LLP,
14648 North Scottsdale Road, Suite 130, Scottsdale, AZ 85254, for Plaintiff.
Anderson Tuggle, Andy Taylor, and Jeffrey P. Justman, FAEGRE DRINKLE
BIDDLE & REATH LLP, 2200 Wells Fargo Center, 90 South Seventh Street,
Minneapolis, MN 55402; Justin O’Neill Kay, FAEGRE DRINKER BIDDLE &
REATH LLP, 320 South Canal Street, Suite 3300, Chicago, IL 60606; and Zoe
K. Wilhelm, FAEGRE DRINKER BIDDLE & REATH LLP, 1800 Century Park East,
Suite 1500, Los Angeles, CA 90067, for Defendant.
Plaintiff Michael Okash contends that Defendant Essentia Health’s (“Essentia”)
deployment of Meta Pixel tracking software on essentiahealth.org violates a slew of
federal and state privacy and consumer protection laws. His complaint suffers from
significant pleading defects, many of which appear to be symptoms of Okash’s focus on
Meta Pixel litigation against other healthcare providers rather than the facts of this case.
The Court will dismiss without prejudice Okash’s claims under federal and state wiretap
laws, the Minnesota Health Records Act, and state tort law. At the same time, Okash
plausibly alleges violations of the Minnesota Consumer Fraud Act and Minnesota Uniform
Deceptive Trade Practices Act and states a viable claim for unjust enrichment.
BACKGROUND
I. FACTS
Plaintiff Michael Okash has received medical care from Essentia since 2000. (Am.
Compl. ¶¶ 18–19, May 15, 2023, Docket No. 15.) Okash brings this putative class action
on behalf of himself and others similarly situated, defined as “[a]ll persons whose
Sensitive Information was disclosed to a third party through Defendant’s Website without
authorization or consent.” (Id. ¶ 106.)
Essentia maintains a website, essentialhealth.org, which allows patients to find
medical facilities and services and conduct research on medical issues, conditions,
medications, and doctors. (Id. ¶ 2.) Okash recalls using the website to research doctors
and investigate various treatments and medical conditions. (Id. ¶ 21.) In addition to
essentiahealth.org, Essentia provides an online patient portal, MyChart, that allows
patients to communicate with their providers, schedule appointments, review medical
records, and pay bills. (Compl. ¶ 3, Feb. 28, 2023, Docket No. 1.)
Essentia employs Meta Platform, Inc.’s (“Meta”) tracking technology, Meta Pixel
(“Pixel”), on essentialhealth.org. (Am. Compl. ¶¶ 52–53, 60.) Pixel tracks a website user’s
activity and transmits data to Meta, including the pages and subpages visited by the
website user, and searches, clicks, and other submissions to the website. (Id. ¶ 5); see
also In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 784–86 (N.D. Cal. 2022)
(explaining the Pixel technology). For example, if a visitor to essentiahealth.org clicks on
the “Doctors & Providers” page, data documenting that navigation would be sent to
Meta. (Am. Compl. ¶ 57.) The data is often then associated with the user’s Facebook
account and used for advertising purposes. (Id. ¶¶ 54–55, 59.) Okash recalls receiving
targeted advertisements based on his research on essentiahealth.org. (Id. ¶ 26.)
Essentia’s website includes a privacy policy indicating it is “committed to
protecting the privacy of those who visit our website.” (See Decl. Jeffrey P. ¶ 4, Ex. A
(“Privacy Policy”) at 2, June 23, 2023, Docket No. 26.) In a section on tracking
technologies, the policy discloses “[w]e may also use Facebook Pixel that enables us to
understand how users interact with our website after seeing an ad on Facebook and then
clicking through to our website.” (Id. at 3.)
II. PROCEDURAL HISTORY
Okash’s initial complaint alleged privacy violations on his MyChart account as well
as essentiahealth.org. (See, e.g., Compl. ¶ 117.) He filed an amended complaint that
drops all references to MyChart because Essentia does not use the Pixel on MyChart. (See
generally Am. Compl.) Okash alleges Essentia violated federal wiretap laws as well as
state statutory and common law by transmitting data from essentialhealth.org to Meta
through the Pixel. (See generally id.) Essentia now moves to dismiss all counts. (Def.’s
Mot. Dismiss, June 23, 2023, Docket No. 23.)
DISCUSSION
I. STANDARD OF REVIEW
In reviewing a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), the
Court considers all facts alleged in the Complaint as true to determine if the Complaint
states a “claim to relief that is plausible on its face.” Braden v. Wal-Mart Stores, Inc., 588
F.3d 585, 594(8th Cir. 2009) (quoting Ashcroft v. Iqbal,556 U.S. 662, 678
(2009)). The Court construes the Complaint in the light most favorable to the plaintiff, drawing all reasonable inferences in the plaintiff’s favor. Ashley Cnty. v. Pfizer, Inc.,552 F.3d 659, 665
(8th Cir. 2009). Although the Court accepts the complaint’s factual allegations as true, it is “not bound to accept as true a legal conclusion couched as a factual allegation,” Bell Atl. Corp. v. Twombly,550 U.S. 544, 555
(2007), or mere “labels and conclusions or a formulaic recitation of the elements of a cause of action,” Iqbal,556 U.S. at 678
(quotation omitted). Instead, “[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”Id.
At the motion to dismiss stage, the Court may consider the allegations in the
Complaint as well as “those materials that are necessarily embraced by the pleadings.”
Schriener v. Quicken Loans, Inc., 774 F.3d 442, 444(8th Cir. 2014). The Court may also consider matters of public record and exhibits attached to the pleadings, as long as those documents do not conflict with the Complaint. Porous Media Corp. v. Pall Corp.,186 F.3d 1077, 1079
(8th Cir. 1999).
II. PRELIMINARY FACTUAL DETERMINATIONS
There are two recurring factual disputes the Court will address upfront to aid
subsequent resolution of the legal issues. First, because this action is limited to Essentia’s
general website, the Court will address the type of information transmitted therein.
Second is the degree to which the privacy policy puts the public on notice of Essentia’s
use of Pixel.
A. Website Information
As Essentia observes, Okash has dropped all allegations related to MyChart
because Essentia never embedded the Pixel in MyChart. Rather, the Amended Complaint
pertains to Essentia’s public-facing website, essentiahealth.org and its sub-links.
Nonetheless, Okash continues to allege that certain sensitive information is collected that
appears possible only through a connection to MyChart. For example, Okash alleges that
Essentia shared information related to the “dates, times, and/or locations of scheduled
appointments,” the “type of appointment or procedure scheduled,” “communications
between patients and Essentia,” “information about whether patients have insurance,”
and more. (Am. Compl. ¶ 9.)
Simple browsing of Essentia’s website reveals that those personalized pieces of
information are the province of MyChart.1 Accordingly, some of Okash’s allegations fail
to meet the plausibility pleading standard. Broadly, the type of information allegedly
revealed to Meta fits two categories. First, which the Court will accept, are those pieces
of information that a patient generates through unilateral action on essentiahealth.org.
That includes, for example, the patient’s IP address, doctors and treatments researched,
search terms, and whether the patient tries to log in to a MyChart account (which would
be revealed by clicking the MyChart link on essentiahealth.org). The second bucket is
customized information that results from two-way communication between the patient
and Essentia, which would be embedded only in MyChart. That includes specific
appointment information, written communication from a patient to Essentia, medical
records, and like content. The Court will disregard as implausible the allegation that those
types of communications are included on Essentia’s general website. To the extent Okash
believes those personalized records are still intercepted by the Pixel and he chooses to
file a second amended complaint, he should more precisely specify where and how on
the general website such information may be found.
1 The Court may take judicial notice of the contents of Essentia’s website; after all, a
complaint necessarily embraces a website when a defendant’s conduct on that website is central
to the dispute. See WinRed, Inc v. Ellison, 581 F. Supp. 3d 1152, 1167 n.9 (D. Minn. 2022).
B. Privacy Policy
The Court may appropriately consider Essentia’s Privacy Policy, both as an aspect
of the disputed website and contractual material necessarily embraced by the pleadings.
See WinRed, 581 F.3d at 1167 n.9; Mattes v. ABC Plastics, Inc., 323 F.3d 695, 697 n.4 (8th Cir. 2003); (Am. Compl. ¶ 33 (referencing the Privacy Policy).) The Privacy Policy is a standard browsewrap agreement. See Foster v. Walmart, Inc.,15 F.4th 860, 863
(8th Cir. 2021). A user must follow hyperlinks on the website to read the Policy, and the Policy asserts that usage of the website manifests the user’s assent. (Privacy Policy at 5.) Courts determine the enforceability of a browsewrap agreement from the adequacy of notice, whether actual or inquiry. Foster, 15 F.4th at 863–84. The record is insufficient to determine such fact-bound questions, though. Seeid. at 864
. On a Rule 12(b)(6) standard
of review, there is no manifestation of mutual assent, and the Court will not assume the
Privacy Policy constitutes a valid contract.
As far as the adequacy of disclosure for various statutory purposes, the Court will
largely address such issues below while noting upfront one universal concern. The privacy
policy discloses that Essentia uses the Pixel to “understand how users interact with our
website after seeing an ad on Facebook and then clicking through to our website.”
(Privacy Policy at 3.) The complaint alleges, though, that the Pixel was in continuous use
on the website, whether a patient clicked through from a Facebook ad or navigated to
the page by any other means. Taking as true Okash’s allegations, the Court finds the
Policy does not disclose the full extent of Essentia’s Pixel usage.
III. ECPA
The Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2510et seq., prohibits the intentional interception of “any wire, oral, or electronic communication,” as well as the use or disclosure of any “content[s]” thereof. See18 U.S.C. § 2511
(1).2 Parties are exempt from interception liability, though, if they are a “party to the communication or where one of the parties to the communication has given prior consent to such interception.”18 U.S.C. § 2511
(2)(d). But that is only true if the party does not intercept the communication “for the purpose of committing any criminal or tortious act.”Id.
Okash alleges three independent bases for liability under § 2511(1), claiming
Essentia intercepted, divulged, and used communications in violation of ECPA.3 But the
party exception applies and Okash’s complaint does not allege sufficient facts for the
Court to apply the crime-tort carveout. Accordingly, Okash does not plead an unlawful
interception. And because the use and disclosure prohibitions require an underlying
unlawful interception, neither were those provisions violated.
2 Because the federal and state wiretapping statutes are coterminous, the parties agree
the Court should analyze them jointly. See Wagner v. Wagner, 64 F. Supp 2d 895, 899 (D. Minn.
1999); compare 18 U.S.C. § 2511, with Minn. Stat. § 626A.02. For simplicity, the Court will
reference only the federal statutes.
3 Okash abandoned his § 2511(3) claim, which would have been unmeritorious in any
event. Accordingly, the Court will dismiss Count III of Okash’s amended complaint with prejudice.
A. Party Exception
The party exception clarifies that a person does not violate ECPA by
“intercept[ing]” a communication “where such person is a party to the communication.”
18 U.S.C. § 2511(d). The exception applies even to an intended recipient that duplicates and forwards the communication to a third party. See, e.g., In re Group Health Plan Litig., No. 23-267,2023 WL 8850243
, at *7 (D. Minn. Dec. 21, 2023); Kurowski v. Rush Sys. for Health (Kurowski I),659 F. Supp. 3d 931
, 937–38 (N.D. Ill. 2023). Thus, Essentia did not
unlawfully intercept Okash’s communications because Essentia was a party to the
communication.
As Okash observes, the party exception only applies to interception; it does not
excuse unlawful use or disclosure of a communication, even by a party to the
communication. See 18 U.S.C. §§ 2511(1)(c)–(d). But Essentia neither used nor disclosed wire communications as prohibited by ECPA. Section 2511(1) prohibits the use or disclosure of communications a party knows to be “obtained through the interception” of communications “in violation of this subsection.”18 U.S.C. §§ 2511
(1)(c)–(d). As already discussed, Essentia’s alleged interception was not unlawful because it was a party to the communication. And any possible interception by Meta was not “in violation of this subsection” because Essentia consented to Meta’s interception.18 U.S.C. §§ 2511
(1)(c)–(d), (2)(d). Accordingly, Essentia’s use of Meta’s advertising services did
not violate ECPA.
Okash counters that Essentia was incapable of providing valid § 2511(1)(d)(2)
consent because disclosure violated the Health Insurance Portability and Accountability
Act (“HIPAA”). See 45 C.F.R. §§ 164.508(a)(3)(4), (c)(1). Even accepting Okash’s allegation
that HIPAA regulations required his authorization, lack of authorization does not change
the fact that Essentia, a party to the communication, consented to its interception.4
Accordingly, the party exception applies as a matter of law.
B. Crime-Tort Carveout
There is a statutory carveout to the party exception. Even a consenting party may
not escape liability if the communication “is intercepted for the purpose of committing
any criminal or tortious act.” 18 U.S.C. § 2511(2)(d). Okash alleges that Essentia acted
for the purpose of criminally violating HIPAA and tortiously invading Okash’s privacy. But
because neither the alleged HIPAA nor privacy violations were independent of the
interception, the crime-tort exception does not apply.
“[I]t is well established that” the crime-tort exception “only applies where the
defendant allegedly committed a tortious or criminal act independent from the act of
recording itself.” Kurowski v. Rush Sys. for Health (Kurowski II), No 22-5380, 2023 WL
4707184, at *4 (N.D. Ill. July 24, 2023) (citing Caro v. Weintraub,618 F.3d 94, 99
(2d Cir.
4 Here, § 2511(2)(d)’s unmodified requirement for “consent” stands in contrast to
§ 2511(3)(b)(ii)’s requirement of “lawful consent.” Under the whole-text canon, the Court must
give effect to ECPA’s less demanding consent standard in § 2511(2)(d). See K Mart Corp. v.
Cartier, Inc., 486 U.S. 281, 291(1988). 2010)). In other words, the bad acts must be “secondary to the acquisition of the communication” and involve “tortious or criminal use of the interception’s fruits.” See In re Google Inc. Cookie Placement Consumer Priv. Litig.,806 F.3d 125, 145
(3d Cir. 2015); see also United States v. Jiau,734 F.3d 147, 152
(2d Cir. 2013) (confining the crime-tort
exception to “instances where the recording party intends to use the recording to harm
or injure a recorded party, such as to blackmail, threaten, or publicly embarrass the
recorded party”).
Neither Okash’s Amended Complaint nor his briefing alleges independent criminal
or tortious conduct. Okash’s allegations that Essentia violated HIPAA and privacy torts
encompass only the simultaneous interception and disclosure of information to Meta.
(See Am. Compl. ¶ 122.)
Okash argues that Essentia “improperly profited from its invasion of Plaintiff’s and
the Class members’ privacy in its use of their data for its economic value”—presumably,
for its use in targeted advertising. (Id. ¶ 123.) That subsequent advertising may be an
independent act from the underlying interception. But Okash does not allege the
advertising itself was tortious. Cf. In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d at
797 (“[T]he crime-tort exception to the Wiretap Act is inapplicable where the defendant’s
primary motivation was to make money, not to injure plaintiffs tortiously.”). Ultimately,
Okash’s citations to overcome the independence requirement either do not analyze that
requirement,5 or allege a more discrete subsequent tortious or illegal act.6
Because the complaint lacks sufficient alleged facts to suggest the interception was
undertaken to further an independent criminal or tortious act, Okash cannot overcome
the application of the party exception, and his ECPA claims against Essentia will be
dismissed.7 The Court will dismiss without prejudice, however, to allow Okash to plead
an independent connection to a tortious act, should one exist.
IV. MHRA
The Minnesota Health Records Act (“MHRA”) prohibits the release of patient
“health records” absent signed consent. See Minn. Stat. § 144.293. Essentia transmitted
information about Okash to Meta without signed consent, but the question remains
whether that information included “health records.” Okash has not pled sufficient
information for the Court to so find.
“Health record” is defined broadly to include
any information, whether oral or recorded in any form or
medium, that relates to the past, present, or future physical
5 See, e.g., Deteresa v. Am. Broad. Cos., Inc., 121 F.3d 460, 467 n.4 (9th Cir. 1997); Med. Lab. Mgmt. Cons. v. Am. Broad. Cos., Inc., No. 95-2494,1997 WL 405908
(D. Ariz. Mar. 27, 1997)
6 See, e.g., Brown v. Google, LLC, 525 F. Supp. 3d 1049, 1067 (N.D. Cal. 2021) (subsequently associating intercepted communications with user data in violation of state law); Planned Parenthood Fed’n of Am., Inc. v. Ctr. for Med. Progress,214 F. Supp. 3d 808, 828
(N.D. Cal. 2016)
(defendants used intercepted conversations in subsequent RICO acts and subsequent disclosures
that violated privacy torts).
7 Because the Court finds the party exception controls, it need not reach Essentia’s
argument that the communications did not contain any substantive content.
or mental health or condition of a patient; the provision of
health care to a patient; or the past, present, or future
payment for the provision of health care to a patient.
Id.§ 144.291 subd. 2(c) (emphasis added). “There is scant caselaw analyzing what constitutes a ‘health record.’” Furlow v. Madonna Summit of Byron, No. 19-987,2020 WL 413356
, at *2 (Minn. Ct. App. Jan. 27, 2020). Furlow, one of the few such cases, held that
a nurse’s aide who posted a photo with an unflattering caption of a wheelchair-bound
resident to social media did not violate the MHRA because the photo was not a health
record. See id., at *1. The court clarified that “[w]hile a viewer of the post may infer that
[the patient] was receiving care in a nursing home, there is nothing explicitly in the
photograph or caption that goes to the nature of the care or condition.” Id., at *3.
Furlow notwithstanding, a better-pled Complaint could likely survive a 12(b)(6)
motion. Unlike in Furlow, Okash alleges his website searches included “specific doctors
and specialists that had been referred to him” and “searching for and disclosing specific
medical diagnosis while on the website.” (Am. Compl. ¶ 21.) He further alleges that the
searches were paired with enough of a digital footprint for Meta to identify him. (See id.
¶¶ 5, 9, 104–05.) What is more, the statutory standard is undemanding. See Minn. Stat.
§ 144.293 subd. 2(c) (including “any information” that “relates to” medical conditions or
care).
At the same time, Okash does not provide specific examples of how he used the
website and what information was specifically disclosed. For example, while he says he
used the website to research doctors and conditions, he fails to include any details about
the doctors, conditions, or timeframe. Such information would help move the complaint
past a “formulaic recitation” that health records were disclosed and frame the case more
concretely moving forward. See Iqbal, 556 U.S. at 678.8 Accordingly, the Court will
dismiss Count VI without prejudice and allow Okash a chance to plead the particulars of
his MHRA claim.
V. MUDTPA
The Minnesota Uniform Deceptive Trade Practices Act (“MUDTPA”) forbids
businesses from, as relevant to this action, representing that goods or services have
characteristics they do not have or that “goods or services are of a particular standard,
quality, or grade . . . if they are of another.” Minn Stat. § 325D.44 subds. 1(5) & (7).
Essentia argues that Okash’s MUDTPA claim fails because it asks for prohibited relief and
does not meet the heightened Rule 9(b) pleading standard. Neither argument justifies
dismissal.
As to the first issue, the MUDTPA only allows injunctive relief. See Superior Edge,
Inc. v. Monsanto Co., 964 F. Supp. 2d 1017, 1041 (D. Minn. 2013). Although the complaint
alleges Okash suffered monetary damages because of Essentia’s deceptive trade
8 Compare Cousin v. Sharp Healthcare (“Cousin I”), No. 22-2040, 2023 WL 4484441, at *3 (S.D. Cal. July 12, 2023) (requiring plaintiffs to provide more detailed allegations of the information they provided via a hospital’s website to better evaluate whether the information included personal health information), with Cousin v. Sharp Healthcare (“Cousin II”), No. 22-2040,2023 WL 8007350
, at *2–3, 5 (finding the amended complaint plausibly pled disclosure of health
records once more details about the plaintiff’s website activities were provided).
practices, it ultimately asks only for permitted forms of relief, including an injunction. (See
Am. Compl. ¶¶ 165–66.)
Essentia also ventures that Okash has not alleged a sufficient risk of future damage
to be entitled to an injunction. In particular, it notes that a party on notice of a deceptive
practice “can no longer say that he will again be deceived by the practice.” Jaskulske v.
State Farm Mut. Auto. Ins. Co., No. 14-869, 2014 WL 5530758, at *6 (D. Minn. Nov. 3, 2014). Kurowski I rejected that argument under these same circumstances. 659 F. Supp. 3d at 943. Where a plaintiff remains a patient and has little choice but to continue to use the website to receive complete medical care, a deceptive trade practices claim may proceed. Id. Injunctive relief may also help remedy ongoing harms from the already- collected data. See In re Group Health Plan,2023 WL 8850243
, at *10. Accordingly, the
Court finds Okash has alleged a sufficient risk of future harm to allow his demand for
injunctive relief to proceed.
Claims under the MUDTPA are subject to the heightened Rule 9(b) pleading
standard. See E-Shops Corp. v. U.S. Bank Nat’l Ass’n, 678 F.3d 659, 665 (8th Cir. 2012).
Okash’s Amended Complaint meets the heightened standard. First, he identifies specific
misrepresentations in various Essentia policies, including the Privacy Policy. Essentia
claims the Privacy Policy cannot be deceptive because it discloses Essentia’s use of the
Pixel. But as already discussed, Okash plausibly alleges that Essentia exceeds the
disclosed use of the Pixel by failing to limit the Pixel to only those web visitors who click
through from a Facebook advertisement. Okash also alleges a deceptive omission by
Essentia’s failure to comply with HIPAA and protect his sensitive health information.
Essentia argues plaintiffs may only plead an omission when the defendant owes a duty to
disclose. But the Court would be hard-pressed to find that a hospital does not owe a
patient a duty to disclose before transmitting HIPAA-protected information to third
parties.
Accordingly, the Court will deny Essentia’s Motion to Dismiss Count IV.
VI. MCFA
Essentia primarily contends that Okash’s claim fails to “demonstrate that their
cause of action benefits the public,” as required by the Minnesota Consumer Fraud Act
(“MCFA”). See Ly v. Nystrom, 615 N.W.2d 302, 314(Minn. 2000). When a plaintiff “seek[s] only damages, courts typically find no public benefit.” Select Comfort Corp. v. Tempur Sealy Int’l, Inc.,11 F. Supp. 3d 933, 937
(D. Minn. 2014). Nonetheless, the Court finds a plausible public benefit here. A class action alleging broad misrepresentations to the public serves a public benefit for its compensatory and deterrent effects, even where the action only seeks monetary damages. See Johnson v. Bobcat Co.,175 F. Supp. 3d 1130
, 1142–43 (D. Minn. 2016).
Essentia also contends Okash has not met the Rule 9(b) standard for an MCFA
claim. But those arguments largely overlap with the rejected MUDTPA pleading issues.
Accordingly, the Court will deny Essentia’s Motion to Dismiss Count VII.
VII. SECLUSION
To state a claim for intrusion upon seclusion, a plaintiff must allege that the
defendant intentionally engaged in a highly offensive intrusion into another person’s
private affairs. See Lake v. Wal-Mart Stores, Inc., 582 N.W.2d 231, 233 (Minn. 1998).
Because there was no intrusion, the Court will dismiss Count I without reaching Essentia’s
argument that the alleged intrusion was not highly offensive.
Courts generally agree that when a plaintiff voluntarily browses a healthcare
website, there is no intrusion when the Pixel transmits the information to Meta.9
Intrusion requires an “affirmative act by the defendant in obtaining the information”
which cannot exist when the information is provided by the plaintiff, even if a defendant
later shares the information. Lehman v. Zumbrota-Mazeppa Pub. Schs., No. 04-1226,
2005 WL 894756, at *4 (Minn. Ct. App. Apr. 19, 2005). Because Okash voluntarily
provided his data to Essentia, Essentia did not intrude upon his seclusion and the Court
will dismiss Count I.
9 See Kurowski I, 659 F. Supp. 3d at 943; Allen v. Novant Health, Inc., No. 22-697, 2023 WL
5486240, at *2 (M.D.N.C. Aug. 24, 2023); Hartley v. Univ. of Chi. Med. Ctr., No. 22-5891,2023 WL 7386060
, at *3 (N.D. Ill. Nov. 8, 2023); cf. C.L.D. v. Wal-Mart Stores, Inc.,79 F. Supp. 2d 1080
,
1083 n.1 (D. Minn. 1999) (holding intrusion upon seclusion inapplicable where “plaintiff
voluntarily disclosed her medical circumstances to [defendant] and cannot claim that he obtained
the information by intrusive means.”).
VIII. UNJUST ENRICHMENT
Finally, Essentia argues that Okash’s claim for unjust enrichment should be
dismissed because (1) the Privacy Policy is a governing contract, and (2) Okash has not
alleged he provided an uncompensated benefit. As already discussed, it would be
premature to hold the Privacy Policy is a governing contract. See also In re Group Health
Plan, 2023 WL 8850243, at *4.
As to uncompensated benefit, Okash alleges that Essentia receives benefits from
its use of his personal information, “including monetary compensation.” (Am. Compl.
¶ 203.) Essentia complains the pleading is not specific enough to prove an
uncompensated benefit. See Hall v. Centerspace, LP, No. 22-2028, 2023 WL 3435100, at *6 (D. Minn. May 12, 2023). But Hall did not allege the defendant received monetary compensation in exchange for the plaintiff’s data.Id.
Here, the Court must take as true
Okash’s allegation that Essentia received monetary compensation for his data, even if the
allegation lacks other specifics. Accordingly, the Court will allow Count VIII to proceed.
CONCLUSION
In sum, Okash’s claims for MUDTPA and MCFA violations and complaint of unjust
enrichment survive this motion to dismiss. The Court will dismiss Okash’s other claims
without prejudice.
ORDER
Based on the foregoing, and all the files, records, and proceedings herein, IT IS
HEREBY ORDERED that Defendant’s Motion to Dismiss [Docket No. 23] is GRANTED in
part and DENIED in part, Counts | (Invasion of Privacy), Il (18 U.S.C. § 2511(1)), V (Minn. Stat. § 626A.02), and VI (Minn. Stat. §§ 144.291
& 144.293) of Plaintiff's Amended Complaint are DISMISSED without prejudice, and Count Ill (18 U.S.C. § 2511
(3)) of
Plaintiff's Amended Complaint is DISMISSED with prejudice.
DATED: March 26, 2024 dO ag WY redatin—
at Minneapolis, Minnesota. JOHN R. TUNHEIM
United States District Judge
-19- Reference
- Status
- Unknown