Health Law Daily Wrap Up, CONFIDENTIALITY—E.D. Cal.: Court dismissed invasion of privacy action brought by health information Website users, (Jun 17, 2025)

By Sara Cracau, J.D.

Court dismissed invasion of privacy class action brought by health information Website users for failure to state a claim as they failed to allege what information the users entered on the Website and what information was shared on social media.

A district court in California has granted the motion to dismiss of health care entities in an invasion of privacy action brought by users of health information websites finding that the disclosure of browsing history on a publicly available website that does not relate to past, present, or future physical or mental health or condition of an individual is not actionable. The court granted the health entities’ motion to dismiss the various invasion of privacy claims finding that the complaint was vague and did not allege facts describing medical data and, therefore, not sufficiently allege a reasonable expectation of privacy in their browsing activity on the website. Additionally, the court found that the website users did not allege that they were patients of the health entities when they used the website or at any time or that the health entities were their healthcare providers as required for a CMIA claim. Furthermore, the allegations were not sufficient to plead that the contents of the communications that were purportedly intercepted were "contents" within the meaning of the CIPA. In addition, the complaint did not allege facts sufficient to support the conclusion that the Website users provided their PHI to the health entities. The court denied the health entities’ motion to dismiss the website users’ claims as time-barred by the statutes of limitations with the exception of the claim of one user. Therefore, the website users may amend their complaint for those claims where leave to amend was granted (Beltran v. Doctors Medical Center of Modesto, No. 2:23-cv-01670-DC-CKD (E.D. Cal. Jun. 9, 2025)).

Website users brought a putative class action against a medical center and a health systems and services platform (collectively the “health entities”) for allegedly intercepting and transmitting their protected health information (PHI) and personally identifiable information (PII) to Meta (formerly Facebook) without their knowledge or consent via a hidden tracking tool installed on one of the party’s websites. They brought the following five causes of action against the health entities: invasion of privacy under California common law; invasion of privacy under the California Constitution; violation of the California Confidentiality of Medical Information Act; California Civil Code; violation of the California Invasion of Privacy Act, California Penal Code; and breach of implied contract. One of the health entities maintains a public-facing Website for current and prospective patients to search for information pertaining to health conditions, hospital locations and doctors. The health entities filed a motion to dismiss for failure to state a claim upon which relief can be granted.

California Invasion of Privacy Act (CIPA). The court granted the health entities’ motion to dismiss this claim with leave to amend finding that the allegations were not sufficient to plead that the contents of the communications that were purportedly intercepted were "contents" within the meaning of the CIPA.

Allegations regarding disclosure of protected health information. The court granted the health entities’ motion to dismiss this claim with leave to amend finding that the disclosure of browsing history on a publicly available website that does not relate to the past, present, or future physical or mental health or condition of an individual was not actionable. The website users did not allege sufficient facts to show that their browsing activity was related to the provision of healthcare rather than accessing general health information accessible to the public at large.

Invasion of privacy under common law and the California Constitution. The court granted the health entities’ motion to dismiss this claim finding that the website users did not sufficiently allege that their searches related to the provision of healthcare, patient status, or otherwise included in PHI. The complaint was vague and did not allege facts describing medical data. Therefore, it concluded that the website users did not sufficiently allege a reasonable expectation of privacy in their browsing activity on the website.

California Confidentiality of Medical Information Act (CMIA). The court granted the health entities’ motion to dismiss this claim finding that the website users did not allege that they were patients of the health entities when they used the website or at any time or that the health entities were their healthcare providers as required for a CMIA claim.

California Invasion of Privacy Act (CIPA). The court granted the health entities’ motion to dismiss this claim with leave to amend finding that the allegations were not sufficient to plead that the contents of the communications that were purportedly intercepted were "contents" within the meaning of the CIPA. The website users contended that their queries on the website constituted "contents " of communications interception of which is prohibited under CIPA. The court rejected this contention, however.

Breach of implied contract. The court granted the health entities’ motion to dismiss the breach of implied contract claim with leave to amend because the complaint did not allege facts sufficient to support the conclusion that the Website users provided their PHI to the health entities. Furthermore, the Website users did not allege that they had reviewed the health entities’ privacy policies prior to using the Website. Although privacy policies may form the terms of an implied contract, alone, they do not serve as an enforceable contract without a separate meeting of the minds between the parties. Additionally, the Website users alleged that supplying the heal entities with their user data in exchange for services was sufficient to establish an implied contract but the court rejected this contention, finding that it could not infer an implied contract from these allegations.

Statute of limitations. The court found that the complaint sufficiently alleged claims within the applicable statute of limitations periods with the exception of the claim of one website user. Each of the claims was subject to a statute of limitations ranging from one to three years. The website users alleged that they last visited the Website after August 10, 2022, within the applicable statute of limitations periods for all the claims. Although the complaint did not indicate the exact date that the website users first visited the Website, the complaint did not indicate on its face that the Website users ‘ interactions ceased before expiration of the statutes of limitations.

The case is No. 2:23-cv-01670-DC-CKD.

Judge: Coggins, D.

Attorneys: Todd M. Friedman (Law Offices of Todd M. Friedman) for Lori Beltran, Brittany Matus, Preston Meisner, Paul Blumberg and Mark Mehring. Gillian Hannah Clow (Alston & Bird LLP) for Doctors Medical Center of Modesto and Tenet Health.

Companies: Doctors Medical Center of Modesto; Tenet Health

Cases: CaseDecisions ConfidentialityNews CyberPrivacyFeed EHRNews HITNews HIPAANews DataPrivacy LitigationEnforcement CaliforniaNews