Cybersecurity Policy Report, C.D. Ill.: Court allows class action to proceed against hospital, whose website allegedly intercepted, disclosed patient data to third parties without authorization, (Aug 5, 2026)

By K. C. Salcedo, J.D.

The hospital’s motion to stay was denied despite its argument that a pending appeal in a separate matter could preclude the patient’s claims regarding the hospital’s disclosure of patient data to third parties for moneymaking purposes.

A federal court dismissed a regional hospital’s motion to stay the proceedings in a class action alleging that the hospital violated the Electronic Communications Privacy Act (ECPA) when its website intercepted and disclosed a patient and other patients’ electronic communications to third parties without patients’ authorization. Though an interlocutory appeal in a separate pending matter might be dispositive on the patient’s class action suit, one issue being whether web-collected communications for marketing or moneymaking purposes precluded ECPA liability, the court noted the numerous uncertainties of that separate case’s holding and found no justification to delay the proceedings further (Hannant v. Culbertson Memorial Hospital Foundation, 4:24-cv-04164-SLD-RLH (C.D. Ill. July 27, 2026)).

Crime-tort exception to one-party consent protection. The court noted that the ECPA is a one-party consent statute and could arguably permit the hospital’s alleged disclosures given that the hospital was a party to such communication, unless the communication were “intercepted or disclosed for the purpose of committing any criminal or tortious act.” The patient asserted that her claims satisfied the foregoing crime-tort exception in light of the hospital’s unauthorized disclosure of her and other patients’ health information in violation of the Health Insurance Portability and Accountability Act (HIPAA). According to the patient, the criminal HIPAA violation prevented the hospital from seeking protection under the ECPA’s one-party consent provision.

Moneymaking, criminal purpose. The hospital in a prior proceeding argued its purpose was to “make money—not to violate HIPAA,” thus lacking the requisite criminal or tortious intent for the crime-tort exception. The court however held that both purposes can exist at the same time. The intent to make money did not necessarily preclude the intent to commit a criminal or tortious act.

Interlocutory appeal. The court acknowledged uncertainty on the crime-tort exception, noting another case on interlocutory appeal before the U.S. Court of Appeals for the Seventh Circuit regarding the ECPA’s crime-tort exception, specifically “whether a defendant is absolved of ECPA liability when it intercepts communications for a marketing or moneymaking purpose,” one of the arguments being that the ECPA required litigants to prove deliberate intent to commit a crime or tort.

The hospital argued that the outcome of that separate matter might be dispositive of the patient’s federal claim, possibly resulting in the dismissal of her state-law claims due to lack of jurisdiction; therefore, proceeding at this time might incur unnecessary time and expenses to conduct discovery that may later be moot. The court disagreed, however, noting that numerous conditions would need to be met to result in a complete dismissal of the patient’s suit, and the Seventh Circuit’s holding could be said to have such a decisive effect on the current proceedings.

As to discovery time and expenses, the court found that the state-law claims relied on the same allegations of data tracking and disclosure. Therefore, even if the patient’s federal claim were dismissed, the state law claims would incur similar amounts of time and expense for discovery and thus not prove wasteful, contrary to the hospital’s assertions otherwise.

The case is No. 4:24-cv-04164-SLD-RLH.

Judge: Hanna, R.

Attorneys: Andrew E. Mize (Stranch, Jennings & Garvey, PLLC) for Alana Hannant. Christopher Wiech (Baker & Hostetler LLP) for Culbertson Memorial Hospital Foundation.

Companies: Culbertson Memorial Hospital Foundation

Cases: CaseDecisions FederalLegislation EHRNews GeneralNews HITNews HIPAANews CyberPrivacyFeed DataPrivacy IllinoisNews DataSecurity