Weiss v. Permanente Medical Group, Inc.

NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS JUL 24 2026

MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS

FOR THE NINTH CIRCUIT

MIMI WEISS, No. 24-6609

D.C. No.

Plaintiff - Appellant, 3:23-cv-03490-RS

v. MEMORANDUM* THE PERMANENTE MEDICAL GROUP, INC.,

Defendant - Appellee.

Appeal from the United States District Court for the Northern District of California

Richard G. Seeborg, District Judge, Presiding Argued and Submitted October 21, 2025 San Francisco, California

Before: PAEZ, BEA, and FORREST, Circuit Judges.

Dissent by Judge PAEZ.

The district court granted The Permanente Medical Group’s (TPMG) motion to dismiss Mimi Weiss’s privacy claim asserted under the California Constitution on the grounds that she could neither establish that TPMG had violated her privacy rights by implementing a COVID-19 vaccine mandate (Mandate) nor overcome TPMG’s countervailing interests in combatting the spread of COVID-19.1 To state a prima facie claim for invasion of privacy under the California Constitution, a plaintiff “must establish . . . (1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.” See Hill v. Nat’l Collegiate Athletic Ass’n, 865 P.2d 633, 657 (Cal. 1994). Whether the plaintiff has a legally protected privacy interest is a question of law. 2 Id. But generally, whether there is “a reasonable expectation of privacy in the circumstances and whether defendant’s conduct constitutes a serious invasion of privacy are mixed questions of law and fact.” Id. These issues “may be adjudicated as a matter of law” only where “the undisputed material facts show no reasonable expectation of privacy or an insubstantial impact on privacy interests.” Id.

“A defendant may prevail . . . by negating any of the three elements” or by establishing “that the invasion of privacy is justified because it substantively furthers one or more countervailing interests.” Id. The plaintiff can rebut any asserted countervailing interest “by showing there are feasible and effective alternatives to defendant’s conduct which have a lesser impact on privacy interests.” Id. “The existence of a sufficient countervailing interest or an alternative course of conduct present threshold questions of law for the court.” Id. But, unless the “material facts are undisputed,” “the relative strength of countervailing interests and the feasibility of alternatives present mixed questions of law and fact.” Id.

1. Prima Facie Case. California recognizes “that a competent adult has the right to refuse medical treatment.” In re Qawi, 81 P.3d 224, 230 (Cal. 2004) (quoting Conservatorship of Wendland, 28 P.3d 151, 158 (Cal. 2001)). The reasonableness of a privacy interest depends on the circumstances. Hill, 865 P.2d at 655. California has recognized that the factors influencing whether a privacy expectation is reasonable include “advance notice”; “customs, practices, . . . physical settings,” including the “particular employment setting”; “community norms”; and “opportunities to consent.” Id. at 655, 667.

TPMG disputes that Weiss had a reasonable expectation of bodily autonomy in not getting vaccinated because vaccine mandates have long been recognized as “reasonable restraint[s] on autonomy privacy rights,” particularly in the wake of a pandemic. But Weiss alleged that she was a fully remote employee who presented “no risk she would spread COVID-19 to patients or employees.” She also alleged that TPMG “failed and refused to consider the privacy rights of remote employees in establishing and implementing its vaccine mandate,” that TPMG’s Mandate did not account for the temporal limits on the effectiveness of the vaccine or natural immunity obtained following infection, and that TPMG promoted a vaccine mandate “contrary to what the known science would support.”

TPMG disputes these allegations, contending that its Mandate “follow[ed] contemporary conventional wisdom” and “was intended to protect the health and safety of [its] employees, patients . . . , and the larger community.” But beyond pointing to California’s historically deferential approach to mandatory vaccination, TPMG does not explain how its stated goal was served by requiring employees who had no contact with patients, the public, or other employees in performing their work functions to be vaccinated. On this record, we conclude that the facts and circumstances related to the reasonableness of Weiss’s privacy expectation in her medical decision-making are disputed and therefore are not properly resolved at this stage. See id. at 657.

Weiss further argues that she sufficiently pled that the Mandate was a serious invasion of her right to privacy because it “forced her to choose between accepting vaccination and losing her job.” To be actionable, a privacy invasion must be sufficiently serious as to “constitute an egregious breach of the social norms underlying the privacy right,” requiring some consideration of “the extent and gravity of the invasion.” Id. at 655. The California Supreme Court has clarified that this element is meant “to screen out intrusions of privacy that are de minimis or insignificant.” Loder v. City of Glendale, 927 P.2d 1200, 1231 n.22 (Cal. 1997).

Weiss has alleged a sufficiently significant intrusion into her privacy interests by stating that her employment was conditioned on taking a vaccine that she objected to, that TPMG asked intrusive questions about her religious and medical history, and that TPMG did not seriously consider her religious objections. Again, TPMG disputes these allegations and asserts that, as made evident by the contemporaneous state and federal COVID-19 vaccine mandates, mandatory vaccination policies are not an actionable privacy intrusion.3 It also again points to California’s permissive approach to vaccine mandates and the lack of consensus as to whether such a policy constitutes a serious invasion of privacy. Regardless of whether the Mandate is ultimately a permissible intrusion into an employee’s personal autonomy, Weiss has plausibly alleged an intrusion that is more than “de minimis or insignificant.” Loder, 927 P.2d at 1231 n.22. And “the extent and gravity” of the intrusion is a mixed question of law and fact that is not properly resolved at the pleading stage. Hill, 865 P.2d at 655.

For these reasons, we conclude that Weiss has alleged sufficient facts to state a prima facie invasion-of-privacy claim.

2. Countervailing-Interests Defense. TPMG asserts that its interests in protecting the health of its workforce, its patients, and the public generally justified its Mandate and outweighed Weiss’s individual privacy interests. TPMG is correct that “[p]rivacy concerns are not absolute; they must be balanced against other important interests.” Id. The “relative importance” of an asserted countervailing interest is its “proximity to the central functions of a particular public or private enterprise.” Id. at 656. But “feasible and effective alternatives” can undermine a claim of countervailing interests. Id. at 657. When considering alternatives, “the court does not decide whether every measure is necessary, merely whether the policy is reasonable.” Sheehan v. San Francisco 49ers, Ltd., 201 P.3d 472, 480 (2009). The existence of countervailing interests is a question of law, but their relative strength is a mixed question of law and fact. Hill, 865 P.2d at 657.

Weiss is correct that it is improper to weigh the relative importance of the parties’ interests at this stage. Weiss’s status as a remote employee prevents finding—as a matter of law—that TPMG’s asserted health interests, which are undoubtedly central to being a healthcare provider, outweigh Weiss’s legally protected interest in managing her own medical decisions. See id. The possibility of a feasible and effective alternative is also raised by Weiss’s allegation that TPMG granted religious exemptions to more than 10,000 workers, including many who provided in-person medical services. We express no opinion on the ultimate balancing of the parties’ interests. We conclude only that TPMG is not entitled to prevail on its affirmative defense to Weiss’s invasion-of-privacy claim as a matter of law on a motion to dismiss. Id.

REVERSED and REMANDED.

Weiss v. The Permanente Medical Group, Inc., No. 24-6609 FILED PAEZ, Circuit Judge, dissenting: JUL 24 2026

MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS

I respectfully dissent.

The majority concludes that material disputed facts prevent dismissal of Weiss’s state law privacy claim at the motion to dismiss stage. However, in my view, the relevant facts are either undisputed or immaterial to an antecedent legal question: Whether a private health care provider’s policy requiring employees to either obtain a COVID-19 vaccination or qualify for a religious or medical exemption constitutes a “serious invasion of privacy” under the California Constitution. Hill v. Nat’l Collegiate Athletic Ass’n, 865 P.2d 633, 657 (Cal. 1994). This issue lacks “controlling precedent” under California law and “could determine the outcome” of this case. Cal. R. Ct. 8.548(a). As a matter of “[c]omity and federalism,” I would certify this issue to the California Supreme Court. Munson v. Del Taco, Inc., 522 F.3d 997, 999 (9th Cir. 2008). Instead, the majority holds that Weiss’s complaint plausibly alleges that TPMG’s vaccine policy constitutes an “egregious breach of the social norms underlying the privacy right.” Hill, 865 P.2d at 655. I am doubtful the California Supreme Court would agree.

*

To state a claim for invasion of privacy under the California Constitution, Cal. Const., art. I, § 1, a complaint must plausibly allege “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy.” Hill, 865 P.2d at 657. A defendant may prevail by negating one of these elements or by justifying the invasion of privacy as serving countervailing interests. Id. Where “the undisputed material facts” do not amount to a reasonable expectation or a serious invasion of privacy, the complaint may be dismissed as a matter of law. Id.

“Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right.”1 Id. at 655. Applying the reasoning of prior California Supreme Court and Courts of Appeal decisions, I predict the California Supreme Court would hold that TMPG’s COVID-19 vaccination policy does not constitute a serious invasion of privacy under the California Constitution.

The Complaint fails to plausibly allege an “egregious breach of the social norms underlying the privacy right.” Id. Hill recognized that “[c]omplete privacy does not exist in this world except in a desert, and anyone who is not a hermit must expect and endure the ordinary incidents of the community life of which he is a part.” Id. (quoting Rest. 2d Torts, § 652D, com. C). California precedent treats vaccination requirements as one such permissible “incident[] of the community life.” Id. “[T]he right to be free from nonconsensual invasions of bodily integrity is not absolute,” and the California Supreme Court has recognized that a “simple vaccination [requirement is] permissible to protect public health,” consistent with Jacobson v. Massachusetts, 197 U.S. 11 (1905). See Thor v. Superior Court, 855 P.2d 375, 383–84 (Cal. 1993). Likewise, reasoning that “compulsory immunization has long been recognized as the gold standard for preventing the spread of contagious diseases,” California Courts of Appeal have held that in “the area of health and health care legislation, there is a presumption” that a vaccination requirement is “no violation of privacy” under the California Constitution. Love v. State Dep’t of Educ., 240 Cal. Rptr. 3d 861, 871 (Cal. Ct. App. 2018) (quoting Coshow v. City of Escondido, 34 Cal. Rptr. 3d 19, 33 (Cal. Ct. App. 2005) and Brown v. Smith, 235 Cal. Rptr. 3d 218, 226 (Cal. Ct. App. 2018)). 2

The California Supreme Court would, in my view, recognize the constitutional law principle undergirding these decisions: “[W]hile the [California] Constitution protects against invasions of individual rights, it is not a suicide pact.” Kennedy v. Mendoza-Martinez, 372 U.S. 144, 160 (1963). Tellingly, “no case hold[s] mandatory vaccination statutes violate a person’s right to bodily autonomy.” Love, 240 Cal. Rptr. 3d at 869.

That the prior cases were largely litigated in the context of mandatory vaccine laws arguably aids TMPG’s position. The California Supreme Court in Hill “recogniz[ed] that involvement of a governmental entity,” as opposed to a private entity, “affect[s] the degree of the intrusion imposed.” Loder, 927 P.2d at 1231 n.21. “[T]he pervasive presence of coercive government power in basic areas of human life typically poses greater dangers to the freedoms of the citizenry than actions by private persons.” Hill, 865 P.2d at 656. Conversely, “an individual generally has greater choice and alternatives in dealing with private actors” like employers, “than when dealing with the government.” Id. That is, a private employer’s vaccination policy is less “egregious” than a governmental vaccine mandate, which is itself entitled to the “presumption” that “no violation of privacy has occurred.” Love, 240 Cal. Rptr. 3d at 871. Thus, a private health care provider’s vaccine policy containing religious and medical exemptions, issued contemporaneous to state and federal vaccine mandates, likely does not reflect an egregious breach under the California Constitution.

**

The majority holds that material disputed facts prevent dismissal as a matter of law. I respectfully disagree. The majority identifies no disputed facts material to this analysis. Rather, the material facts are undisputed. TPMG does not contest that Weiss’s employment was conditioned on her vaccination or qualification for an exemption, or that Weiss was asked questions about her religious and medical history. Those facts that are disputed are not material.3 The majority notes that the Complaint alleges TPMG asked unduly intrusive questions and insufficiently considered Weiss’s objections. While these facts may be relevant to an informational privacy claim (which the majority does not address) or to the reasonableness of Weiss’s expectation of privacy “under the circumstances,” they do not bear on whether a vaccine requirement constitutes a serious invasion of bodily autonomy. Hill, 865 P.2d at 664.

***

I will end where I started: certification. The “spirit of comity and federalism” and our “deference to the state court” on significant and unsettled questions of state law counsel in favor of certification. Murray v. BEJ Minerals, LLC, 924 F.3d 1070, 1072 (9th Cir. 2019) (en banc) (internal quotation marks omitted); Kremen v. Cohen, 325 F.3d 1035, 1037 (9th Cir. 2003). Whether a health care provider’s requirement that employees obtain either a COVID-19 vaccination or an exemption constitutes a serious invasion of privacy under the California Constitution is a question with “important public policy ramifications” and is “new, substantial, and of broad application.” Murray, 924 F.3d at 1072 (internal quotation marks omitted). Given the importance of this issue and that “no clear controlling California precedent exists,” I would certify the issue to the California Supreme Court. Munson, 522 F.3d at 1000.

For these reasons, I respectfully dissent.