Cybersecurity Policy Report, Del. Super.: Patient Meta pixel tracking claims survive dismissal in national trend toward recognizing negligent disclosure, (Apr 11, 2025)

By Justin Marcus Smith, J.D.

The court generally assessed that Delaware should join the “growing trend” of recognizing privacy breach claims sounding in tort “given the realities of the 21st century” and the “harm that can be done” to individuals on breach of privacy.

Patients who alleged that a medical center disclosed their protected health information (PHI) survived a motion to dismiss most of their asserted claims, held the Delaware Superior Court in Wilmington, Delaware. Perhaps most importantly, the court found the duty of confidentiality satisfied, at least at the pleading stage, where the patients said they had an expectation that their medical provider would keep their sensitive health information protected. With respect to breach of confidentiality, if any, the court agreed with the patients that they did not need to prove disclosure. They only needed to show that the medical provider did not have reasonable procedures in place to guard against it. The Delaware court analysis drew from a Washington state opinion that created a spectrum for analyzing what might constitute PHI on the different varieties of medical provider web pages. The court dismissed the patients’ negligence per se claim, but it sustained all of their other claims for negligence, breach of implied contract, Delaware consumer fraud, and unjust enrichment (Doe v. Bayhealth Medical Center, Inc., No. N24C-09-002 FJJ (Del. Super. Apr. 4, 2025)).

Background. Three anonymous healthcare patients brought a putative class action against Bayhealth Medical Center for alleged unauthorized disclosure of their private health information. The patients accused Bayhealth of using Facebook’s Meta Pixel tracking code on the Bayhealth website to capture not only the patients’ web browsing device information, but also the URLs and domains they visited, the search terms they used used, their button clicks, and form submissions.

The patients said they used the Bayhealth website patient portal for various purposes related to their health care, including scheduling appointments. The patients alleged the Bayhealth web tracking allowed their private health information, including physician names, specialties, and patient zip codes, to be connected to their individual social media profiles. The patients alleged Bayhealth was also using other, similar forms of web user tracking technology, including the Facebook Conversions Application Programming Interface (CAPI); the Google Tag Manager (GTM); and, Microsoft Universal Events and Microsoft Clarity. The patients alleged such tracking and disclosure activity violated the Bayhealth website privacy policy.

The patients filed a first amended complaint (FAC) in December 2024. Bayhealth filed a renewed motion to dismiss in January 2025. The court mostly denied the Bayhealth motion to dismiss.

Standing. The court held the patients had standing. Bayhealth questioned whether the patients’ alleged injuries were concrete. It cited to case law dismissing claims of alleged disclosures for lack of injury to show standing. The patients emphasized that they received targeted ads based on their activities on the Bayhealth website, as in the opinions they cited about concrete injury in connection with disclosure of protected health information (PHI). The patients argued the alleged disclosures of their PHI bore a close resemblance to the common law theory of disclosure of private information.

The court distinguished that Bayhealth cited to off-point cases that were about data breaches and hypothetical harms. The patients presented a different scenario here. The court found the instant patients properly alleged that Bayhealth collected and disclosed their PHI and that they had lost the benefit of their Bayhealth privacy policy bargain to the extent that Bayhealth promised it would protect their PHI but did not do so. The court found the patients also sufficiently pleaded future harm inasmuch as their PHI was no longer in their control. The court deemed the patients’ pleading of alleged injuries was sufficiently concrete and particularized to support standing. The court accordingly denied the Bayhealth motion to dismiss for lack of standing.

PHI. The court held the information allegedly disclosed in this matter fell in the middle of the web page PHI spectrum established in Ninebar v. Overlake Hosp. Med. Ctr., 733 F.Supp.3d 1072, 1081-82 (W.D. Wash. 2024). The instant court explained that the disclosure of private patient portal PHI was at the most consequential end of the Ninebar spectrum, while disclosure of browsing activity on a publicly available website was at the least consequential end of that spectrum.

The court analyzed that the instant matter involved actionable disclosure of PHI from an unauthenticated public webpage (UPW), in other words, a web page that did not require login credentials or user verification. However, the information the patients said they disclosed showed their interactions plausibly related to the provision of healthcare or status with a particular healthcare provider. The patients said they used the Bayhealth UPW to access a patient portal and for “patient portal activities.” Per Ninebar, the court said the information Bayhealth allegedly disclosed to third parties pertained to protected patient status and could be coupled with other patient -identifying information, like IP address and Facebook IDs, to establish a patient status.

Bayhealth asked the court to find that the browsing information in the instant matter was not PHI per American Hospital Association v. Becerra, 738 F.Supp.3d. 780 (N.D. Tex. 2024). The court declined to apply Becerra for multiple reasons. First, the HHS guidance Becerra vacated had no bearing on the instant statutory and common law claims. The instant patients based their claims on alleged infringement of the Delaware Code § 1212(a); the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule; the Health Breach Notification Rule under the Federal Trade Commission (FTC) Act; and, Delaware causes of action. Second, Becerra involved different facts, two hospitals and a regional healthcare system suing covered entities under HIPAA about IP addresses, whereas the patients in the instant matter alleged their Facebook IDs were linked to their health information to establish their patient status. The court found other cases supported the patients’ position that disclosure of their health information in conjunction with identification of their Facebook IDs established their patient status as PHI.

Economic loss. The court held Bayhealth was correct that certain courts dismissed negligence claims based on the economic loss doctrine; however, the court construed that neither of the decisions Bayhealth cited directly addressed whether or not a complaint that alleges injury to person or property, based on diminished value of a person’s private information or loss of privacy, states a valid cause of action.

The court said there was no Delaware case law on-point, but the trend across the country is that claims about diminished personal information value may sound in tort. The court decided to allow the instant claim for non-economic injury, based in negligence, to proceed to discovery with a later determination in this matter of whether Delaware should follow the current trend.

Negligence. The court again declined to apply Becerra in connection with Bayhealth contentions that the patients pleaded only conclusory and speculative negligence claims in their complaint and that Bayhealth had no duty to protect the patients’ information.

The court found the patients adequately pleaded that the information Bayhealth allegedly disclosed was protected PHI. The court also held that the patients sufficiently pleaded that Bayhealth had a duty to exercise reasonable care in handling and using that PHI, including implementation of industry-standard privacy procedures reasonably sufficient to protect it from disclosure and unauthorized transmittal. The court found the patients described the alleged breach of their PHI extensively such that they pleaded the elements of negligence with particularity.

However, the court held the patients failed to state a claim for negligence per se, based on violations of HIPAA and Section 5 of the FTC Act, because those statutes did not provide a private right of action. The patients said they were not bringing a private cause of action but were instead depending on the statutes to establish the duty owed to them. The court said the patients could only use the duty standards of the statutes as “guideposts.” The court dismissed the patients’ negligence per se claim.

Implied contract. The court held that the patients adequately pleaded the existence of an implied contract at this stage of the litigation. Bayhealth argued the patients could not rely on the Bayhealth privacy policies as a source of contractual duty. The patients alleged that they paid Bayhealth for treatment with the included understanding that some of what they paid was for adequate data security. The patients cited the privacy policies as the source of contractual terms for this implied agreement. The court agreed with the patients’ reasoning, at least for pleading purposes, to the extent that use of the Bayhealth website was an integral part of being a Bayhealth patient. The patients said they would not have used the website had they known Bayhealth would not follow its privacy policies and would disclose their information to third parties. The patients also alleged actual damages, including unauthorized access of their PHI by third parties, improper disclosure, inappropriate advertisements, increased risk of future harm, embarrassment, humiliation, frustration, and emotional distress. The court accordingly denied Bayhealth’s motion to dismiss the breach of implied covenant claim.

Unjust enrichment. The court held the patients’ allegation that Bayhealth increased its profits and enhanced its marketing by disclosing their PHI to third parties was sufficient at this time to satisfy a benefit conferred that unjustly enriched Bayhealth. The court denied dismissal of the patients’ unjust enrichment claim.

Consumer fraud. The court held the patients adequately pleaded violation of the Delaware Consumer Fraud Act (DCFA). Among other things, the parties disagreed over whether the particularity requirement of Fed. R. Civ. P. 9(a) applied to the DCFA. Bayhealth said its privacy policies could not be construed as “advertisements” because they were HIPAA requirements and did not prompt a commercial transaction. The court disagreed, holding instead that the broad DCFA definition of advertisement encompassed the published privacy policies. The court also found the DCFA Delaware geographical requirement satisfied; the patients were complaining about pre-sale representations; and, the patients pleaded both DCFA and breach of implied contract claims based on distinct conduct and damages. The court said it would not dismiss the plaintiffs’ DCFA claim at this stage.

Confidentiality duty. Last, but perhaps most importantly, the court found the duty of confidentiality satisfied at the pleading stage inasmuch as the patients said they had an expectation that Bayhealth, as their medical provider, would keep their sensitive health information protected. The court found Delaware case law on-point that patients have an expectation that medical provider entities will control PHI with discretion in the same way that a physician would. The patients also sufficiently alleged breach of that duty of confidentiality. The court agreed with the patients that they did not need to prove disclosure, only that the medical provider did not have reasonable procedures in place to guard against it. The court added that it could infer, here, that third parties likely viewed the PHI. The court denied dismissal of the breach of confidentiality claim.

The case is No. N24C-09-002 FJJ.

Judge: Jones, F.

Attorneys: Dean R. Roland (Cooch and Taylor P.A.) for Jane Doe, John Doe and Jack Doe. Patrick M. Brannigan (Eckert Seamans Cherin & Mellott, LLC) for Bayhealth Medical Center, Inc.

Companies: Bayhealth Medical Center, Inc.

Cases: CaseDecisions ConfidentialityNews CyberPrivacyFeed HIPAANews DataPrivacy LitigationEnforcement DelawareNews DataSecurity