Cybersecurity Policy Report, D. Mass.: Suit alleging medical center used tracking technology with patient information dismissed, (Oct 10, 2025)

By Brian Craig, J.D.

The Electronic Communications Privacy Act (ECPA) claim fails because the crime-tort exception does not apply.

The federal district court in Boston has dismissed a lawsuit brought by a patient alleging Tufts Medical Center violated the federal Electronic Communications Privacy Act (ECPA) by using tracking technology with patient information for financial gain through the medical center’s website and patient portal. The court held that the complaint fails to plausibly allege the medical center’s intent to commit a criminal or tortious act was its primary motivation or a determinative factor in its decision to record health care consumers’ communications and send unwarranted and targeted advertisements through Facebook and Google (McManus v. Tuft Medica Center, Inc., No. 25-cv-10008-ADB (D. Mass. Sept. 29, 2025)).

A patient filed a proposed class-action lawsuit against Tufts Medical Center, a hospital and medical center located in Boston, alleging the medical center’s website improperly used tracking technology with patient information for financial gain. The patient alleges that because the medical center used tracking technologies on its website, third parties, such as Facebook and Google, were able to intercept communications between website users and the medical center. Those third parties then provided targeted advertising based upon the improperly intercepted and disclosed private information, according to the complaint. The case was originally filed in Massachusetts state court alleging violations of Massachusetts state law. The patient amended the complaint to assert a violation of the ECPA. After the case was removed to the federal district court, the medical center moved to dismiss the complaint.

Crime-tort exception. The court examined whether the ECPA’s crime-tort exception applies.

The ECPA prohibits any person from intentionally intercepting, endeavoring to intercept, or procuring any other person to intercept or endeavor to intercept any wire, oral, or electronic communication. A party can generally avoid liability under the ECPA if they are a party to the intercepted communication, unless the crime-tort exception applies. The crime-tort exception requires the plaintiff to plausibly allege that the defendant intended to commit a criminal or tortious act and that committing such a criminal or tortious act was its “primary motivation” or a “determinative factor” in its decision to intercept health care consumers’ communications. The court recognized that other courts have found similar allegations about a party’s financial motives were sufficient to negate the application of the crime-tort exception.

Here, the court found that the allegations in the complaint fail to plausibly allege that the medical center intended to commit a criminal or tortious act and that committing such a criminal or tortious act was the medical’s primary motivation or a determinative factor. The court rejected the patient’s argument that the crime-tort exception applies because the medical center’s conduct implicates the Health Insurance Portability and Accountability Act (HIPAA). The complaint in this case asserts that the medical center’s financial motives by using tracking technologies to intercept and disclose patient health information for financial gain and sought to increase revenue from existing patients and gain new patients. The court found that these allegations are insufficient for the tort-crime exception to apply. Because the complaint fails to plausibly allege that the medical center’s intent to commit a criminal or tortious act was its primary motivation or a determinative factor in its decision to record health care consumers’ communications, the court dismissed the ECPA claim.

State law claims. Because the court dismissed the federal ECPA claim, the court declined to exercise supplemental jurisdiction over the remaining claims, all of which arise under state law.

The court granted the patient leave to amend the complaint within 21 days of dismissal.

Accordingly, the court granted the medical center’s motion to dismiss the complaint.

The case is Civil Action No. 25-cv-10008-ADB.

Judge: Burroughs, A.

Attorneys: Edward F. Haber (Shapiro Haber & Urmy LLP) for Karen McManus. James H. Rollinson (Baker & Hostetler LLP) for Tufts Medical Center, Inc.

Companies: Tufts Medical Center, Inc.

Cases: CaseDecisions ConfidentialityNews CyberPrivacyFeed EHRNews HIPAANews DataPrivacy LitigationEnforcement MassachusettsNews DataSecurity