Cybersecurity Policy Report, E.D.N.C.: Court dismisses patient’s federal claims, declines jurisdiction over state claims, (Jul 29, 2024)

By Elena Eyber, J.D.

In a case centered around Electronic Communications Privacy Act and other privacy-related state laws, the court granted medical clinic operator’s motion to dismiss patient’s federal claims and chose not to exercise supplemental jurisdiction over state-law claims.

The federal court in North Carolina held that a patient had standing to seek damages for her federal claim but dismissed the federal claim for failure to state a claim, declined to exercise supplemental jurisdiction over the state-law claims, and found no subject-matter jurisdiction over the state-law claims under the Class Action Fairness Act. The patient sued FastMed, an operator of over 200 medical clinics, alleging violations of the Electronic Communications Privacy Act, negligence, invasion of privacy, and violations of the North Carolina Electronic Surveillance Act, related to FastMed's use of Meta Pixels to share patient health information with Meta without consent. The court found Rodriguez plausibly alleged a concrete injury to support standing for damages but lacked standing for declaratory and injunctive relief due to the absence of ongoing adverse effects (Rodriguez v. FastMed Urgent Care, P.C., No. 5:23-CV-403-D (E.D.N.C. July 24, 2024)).

A patient filed a lawsuit against FastMed, alleging multiple violations including a breach of the Electronic Communications Privacy Act, negligence, invasion of privacy, and the North Carolina Electronic Surveillance Act. The patient claimed that FastMed shared her individually identifiable health information with Meta (formerly Facebook) through the use of Meta Pixel without her consent, violating both federal and state laws, as well as FastMed's privacy policies. The patient sought damages, injunctive relief, and declaratory relief for herself and others similarly situated.

The court found that the patient had standing to seek damages for her federal claim, acknowledging that the unauthorized sharing of her private health information constituted a concrete injury. However, the court granted FastMed's motion to dismiss the federal claim under Rule 12(b)(6) for failure to state a claim. The court also declined to exercise supplemental jurisdiction over the state-law claims, concluding that it did not have subject-matter jurisdiction over them under the Class Action Fairness Act. Consequently, the court dismissed the patient's state-law claims without prejudice.

The case is No. 5:23-CV-403-D.

Judge: Dever III, J.

Attorneys: Philip J. Gibbons , Jr. (Gibbons Law Group, PLLC) for Jackelyn Rodriguez. Candace Scott Friel (Nelson Mullins Riley & Scarborough LLP) for FastMed Urgent Care, P.C.

Companies: FastMed Urgent Care, P.C.

Cases: CaseDecisions CMSNews CyberPrivacyFeed LegislativeRegulatoryActivity EHRNews GeneralNews HITNews NorthCarolinaNews DataPrivacy DataSecurity