Cybersecurity Policy Report, E.D. Mich.: Health care providers must face electronic privacy, unjust enrichment claims over website tracking, (Sep 21, 2026)

By Ravindra Kumar Singh, B.L.

Allegations that identifiable health information was intentionally transmitted to third parties for commercial purposes plausibly brought the patients’ communications within the ECPA’s crime-tort exception.

A putative class action alleging that health care providers secretly transmitted patients’ health-related website activity to technology companies survived dismissal in part, with claims under the Electronic Communications Privacy Act (ECPA) and for unjust enrichment proceeding to discovery. A federal district court in Michigan found allegations that the providers intentionally transmitted protected health information (PHI) for commercial purposes sufficient at the pleading stage to invoke the ECPA’s crime-tort exception. However, the court dismissed breach of fiduciary duty, intrusion upon seclusion, implied contract, and negligence claims (Wehrle v. McLaren Health Care Corporation, No. 25-cv-11420 (E.D. Mich. Sept. 15, 2026)).

Website tracking. The three Michigan residents were patients of McLaren Health Care Corporation and/or its wholly owned cancer care provider, Barbara Ann Karmanos Cancer Institute. They alleged that the providers embedded tracking technologies, including Meta Pixel, Google Analytics, Google Tag Manager, and LinkedIn Insight Tag, in publicly accessible websites.

According to the complaint, those technologies could collect IP addresses, browser and device information, page views, and detailed interactions. The patients alleged that they used the websites to schedule medical appointments and research medical conditions and physicians. One used the health system’s website to book mammograms, while another used the health system and cancer institute websites to arrange health care and cancer-care appointments.

The tracking tools allegedly transmitted information to Google, Meta, and LinkedIn without patients’ knowledge or consent. The information allegedly included health conditions, desired treatments, treatment locations, searches for symptoms and providers, physician selections, and appointment-scheduling activity. The patients maintained that the providers benefited through improved advertising, analytics, and marketing efficiencies, as well as monetary compensation.

Their amended complaint asserted breach of fiduciary duty, an ECPA violation, intrusion upon seclusion, breach of implied contract, unjust enrichment, and negligence. The patients voluntarily agreed to dismissal of the implied-contract claim.

Electronic communications claim. The ECPA claim survived. The statute generally prohibits intentional interception of electronic communications but contains a one-party-consent exception when the interceptor is itself a party to the communication. The patients acknowledged that the health care providers were parties to their website communications because the patients voluntarily used the websites.

But that exception itself has an exception when a party intercepts a communication for the purpose of committing a criminal or tortious act. Courts have divided over whether this “crime-tort” exception applies to health care website-tracking allegations.

The court found persuasive the majority approach allowing such claims to proceed at the pleading stage. In Cooper v. Mount Sinai Health System, Inc., 742 F. Supp. 3d 369 (S.D.N.Y. 2024), a court explained that HIPAA can impose criminal liability when a covered entity knowingly discloses individually identifiable health information without authorization with intent to sell, transfer, or use the information for commercial advantage, personal gain, or malicious harm. A purposeful disclosure violating that prohibition can therefore satisfy the ECPA crime-tort exception.

Here, the patients plausibly alleged that the providers knowingly and intentionally transmitted HIPAA-protected information to third parties without consent. The complaint also sufficiently alleged a purpose independent from interception itself: at the time the information was intercepted, the providers allegedly intended to disseminate it to third parties for commercial purposes.

The court also relied on Doe v. Wellstar Health System, Inc., 799 F. Supp. 3d 1268 (N.D. Ga. 2025), which allowed a comparable ECPA theory to proceed where patients alleged that tracking tools captured and transmitted PII and PHI to third parties without consent. Questions concerning the providers’ actual intent were more appropriately addressed after discovery.

Still, the opinion emphasized that the law remains unsettled. Courts have reached conflicting conclusions, and appellate courts may address the issue. The court therefore indicated that it would revisit the ECPA question at summary judgment in light of the factual record and any intervening authority.

Unjust enrichment. The patients also adequately pleaded unjust enrichment under Michigan law. They alleged that the providers obtained direct benefits from their information, including detailed website analytics used for business and marketing decisions and substantial monetary compensation.

Those allegations plausibly established both receipt of a benefit and inequity in retaining that benefit. The court noted that other federal courts confronting similar health care tracking allegations have permitted unjust enrichment claims to proceed where providers allegedly disclosed patient information without authorization to improve advertising or generate revenue. As with the ECPA issue, however, courts have not uniformly agreed on the viability of such claims.

State tort claims dismissed. The remaining contested claims fared differently. The breach of fiduciary duty claim failed because the patients did not plausibly allege a present, cognizable injury under Michigan law.

Their contention that disclosure diminished the economic value of their personal information was conclusory because they did not explain how the disclosures impaired their ability to sell that information or otherwise reduced its market value. The possibility that their health information could later be processed with other data or disclosed further amounted only to a risk of future harm.

Targeted advertising also did not supply the missing injury. The patients did not allege facts showing that targeted advertisements were more harmful or harassing than advertising ordinarily encountered on Google, Meta, or LinkedIn, or that the disclosures caused them to receive more advertisements.

Relying on Henry v. Dow Chemical Co., 701 N.W.2d 684 (Mich. 2005), the court stressed that Michigan tort law requires an actual, present injury rather than speculative future harm. Nor could the patients rely simply on invasion of privacy because Michigan law does not presume damages from an alleged privacy invasion.

The intrusion-upon-seclusion claim likewise failed. That tort focuses on an objectionable method of obtaining private information rather than its subsequent publication. Here, the patients voluntarily provided information while using the providers’ websites. Their objection centered on the later transmission of that information to technology companies, not on how the providers initially obtained it. Michigan precedent therefore did not support an intrusion claim.

Finally, negligence required more than the speculative injuries alleged. Under Henry, and as recognized by the Sixth Circuit, Michigan negligence law requires a present physical injury to person or property. No such injury was alleged.

Accordingly, the court dismissed the fiduciary duty, intrusion upon seclusion, implied contract, and negligence claims, while allowing the ECPA and unjust enrichment claims to proceed to discovery. It also declined at this stage to dismiss claims against the cancer institute brought by two patients whose connection to its website was disputed, leaving that issue for development in discovery and possible reconsideration at summary judgment.

The case is No. 25-cv-11420.

Judge: Leitman, M.

Attorneys: Ellyn Gendler (Coulson PC) for Joyce Wehrle. Christopher G. Dean (McDonald Hopkins LLC) for McLaren Health Care Corp.

Companies: McLaren Health Care Corp.

Cases: CaseDecisions FederalLegislation CyberPrivacyFeed EHRNews HIPAANews DataPrivacy MichiganNews DataSecurity