Health Law Daily Wrap Up, ELECTRONIC HEALTH RECORDS—D. Minn.: Back surgery patient’s claims about targeted internet advertising dismissed in part, survive in part, (Sep 14, 2026)

By Justin Marcus Smith, J.D.

The potential inference that someone who performed a provider search would be a patient of the provider was not enough to make the information a “health record” under Minnesota law.

A back surgery patient who complained about Meta Pixel or similar web tracking tool disclosure of a doctor query he performed on his health provider’s website could not proceed with his intrusion upon seclusion and Minnesota Health Records Act claims against the provider, held the federal district court in Minneapolis, Minnesota. However, three other claims survived the provider’s motion to dismiss for failure to state a claim. The court dismissed the intrusion upon seclusion claim because the patient voluntarily disclosed the disputed information. The Minnesota Health Records Act claim also failed because the patient’s website query did not meet the definition of a “health record.” Among the three claims that survived dismissal, the patient could proceed to discovery with his Electronic Communications Privacy Act claim because he alleged a violation of the Health Insurance Portability and Accountability Act (HIPAA) separate from the alleged interception of information. That supported the crime/tort exception to the party-participant rule. The patient’s state law unfair and deceptive trade practices claim survived dismissal because the patient satisfied the particularity requirements of Fed. R. Civ. P. 9(b) and facial causality. The patient’s state law consumer fraud claim also survived for essentially the same reasons (Hanson v. Sanford Health Corp., No. 25-CV-3129 (PJS/LIB) (D. Minn. Sept. 4, 2026)).

Background. A back surgery patient brought a putative class action against Sanford Health Corp., the largest rural health system in the United States, alleging misuse of his personal information. The patient alleged he began receiving targeted advertisements from third parties that related to back and spine issues after searching for information about his doctor on the “Doctors” page on the Sanford website.

The patient alleged the Meta Pixel code embedded on Sanford’s website tracked his website activities and sent his personal health information to Meta, Inc. to build profiles for targeted advertisements and marketing. The Pixel code can transmit a unique identifier to link the user’s website communications with the user’s Facebook profile, even if not logged into Facebook. The patient alleged Sanford used similar tracking tools from at least ten other third-party technology companies, including Snapchat and Google.

The patient asserted five claims: (1) intrusion upon seclusion; (2) violation of the Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511(1)(a); (3) violation of the Minnesota Uniform Deceptive Trade Practices Act (MUDTPA), Minn. Stat. § 325D.43 et seq.; (4) violation of the Minnesota Health Records Act (MHRA), Minn. Stat. 144.291; and (5) violation of the Minnesota Consumer Fraud Act (MCFA), Minn. Stat. § 325F.69. Sanford moved for dismissal of all five claims for failure to state a claim.

Intrusion claim. The court held the patient’s intrusion upon seclusion claim failed because the patient complained about a disclosure, not an intrusion. Specifically, the patient complained about Sanford’s disclosure, to third parties, of information he voluntarily provided to Sanford. He could not maintain an intrusion upon seclusion claim about information voluntarily provided or which was then disclosed to third parties.

The patient attempted to distinguish from precedent that he disclosed information to Sanford with the understanding Sanford would keep it private, but the court rejected this argument. The court explained that the intrusion upon seclusion tort requires proof that the intrusion be into some matter in which a person has a legitimate expectation of privacy. It also requires the affirmative act of an invasion to obtain information. The instant matter did not involve, for example, a situation where a medical provider altered a medical release to obtain information the patient had not agreed the medical provider could obtain. That fact pattern was certainly an intrusion, but intrusion was not at issue in the cited case. Instead, the issue in that case was whether the intrusion was highly offensive.

In short, the court granted Sanford’s motion to dismiss the intrusion upon seclusion claim because the instant patient voluntarily disclosed the disputed information to Sanford.

ECPA claim. The court held the patient adequately alleged an ECPA claim. Sanford argued for dismissal of this claim on the basis that it was a party to the communications and the crime/tort exception did not apply. Sanford contended it collected the information for the lawful purpose of making money, not to commit a crime or tort. However, the patient alleged the disclosure of his information to Meta and other third parties was a violation of the Health Insurance Portability and Accountability Act (HIPAA).

The court cautioned Sanford here that alleged violation of HIPAA for pecuniary gain did not necessarily make the crime/tort exception inapplicable. The court also noted money is a common motive for criminal offenses.

The court also disagreed with Sanford’s argument that the crime/tort exception did not apply. Sanford said the patient failed to allege a crime or tort distinct from the alleged ECPA-violating interception. However, the patient alleged Sanford’s disclosure, not the original interception, was what violated HIPAA. That was enough to trigger the crime/tort exception to Sanford being a party to the communication. The court denied Sanford’s motion to dismiss the ECPA claim.

MUDTPA claim. The court found the patient adequately alleged a misleading statement for his MUDTPA claim. The patient alleged Sanford violated MUDTPA by failing to implement and maintain reasonable privacy measures, misrepresenting that it would protect confidential information, and failing to disclose that it did not protect confidential information. Sanford countered that the patient ran afoul of the heightened particularity requirements of Fed. R. Civ. P. 9(b), but the court disagreed and ruled instead that the patient adequately pleaded the time, place, and content of the alleged misrepresentations with respect to Sanford’s written privacy policies and disclosures on its website.

Although the complaint did not identify the exact date the patient used the website, the court cited various cases for its ruling that more precision was not required in a case involving “official corporate speech published on a company website.” The level of detail the patient provided was enough for Sanford to mount a defense. The court noted that both sides seemed to understand, at the motion hearing, that the patient had searched his doctor’s name. The court concluded that the patient adequately pleaded the time, place, and content of the alleged misrepresentations; Sanford as the speaker; and what Sanford obtained as a result, i.e., the information the patient disclosed to Sanford.

Sanford argued next that the patient did not have standing to seek injunctive relief, the only form of relief available under MUDTPA, because he failed to allege a likelihood of future harm. However, the court found it plausible that the patient faced possible ongoing harm from further misuse of his already-disclosed private information as well as potential further disclosures of it. This was not a case of a consumer making a one-time purchase.

Sanford argued next that the patient failed to allege causality because the patient did not plead that the targeted ads could not have come from another source. The court disagreed because it had to presume the allegations were true at this stage of the proceedings. The complaint laid out a chain of events: the patient said he looked up information about his doctor; Sanford transmitted the information generated thereby to unauthorized third parties; and the patient began receiving targeted back and spine advertising from third parties.

Last, Sanford argued its website was not deceptive because it provided notice of the tracking tools. That was true, but the court saw that the disclosure also stated that Sanford does not share personal information, albeit subject to certain legal or practical exceptions, a statement the patient pleaded was false. In light of all of the above, the court denied Sanford’s motion to dismiss the MUDTPA claim.

MCFA claim. The court rejected the same Sanford causality argument with respect to the MCFA claim. The court declined to dismiss the MCFA claim.

MHRA claim. Sanford moved to dismiss the MHRA claim on the basis that the patient’s search for a doctor on its website was not a “health record,” and here the court agreed. The patient contended his query was a “health record” because it disclosed his status as a Sanford patient and the identity of his doctor; however, the court said the information did not relate to the patient as a patient. There was no need to log in, and anyone in the world with an internet connection could search for the doctor on the Sanford website. That search would generate the same information even about website visitors who were not patients.

The patient did not meet the definition of “patient” under the MHRA. The potential inference that someone who performed such a search would be a patient of the provider was not enough to make the information an MHRA “health record.” The court footnoted that even if disclosed information could identify individual website users, that would still not be enough to qualify as a “health record.” The information allegedly disclosed about the patient could not have identified him as a patient. The key distinction was that a recipient would have to guess.

The case is No. 25-CV-3129 (PJS/LIB).

Judge: Schiltz, P.

Attorneys: Benjamin Cooper, Rachel K. Tack, Brian C. Gudmundson and Madison M. DeMaris (Zimmerman Reed LLP) for Robert Hanson. Shawn M. Raiter, Zane P. Aubert, Alex Baker Kroeger and Matthew B. Bolt (Larson King LLP) for Sanford Health Corp.

Companies: Sanford Health Corp.

Cases: CaseDecisions EHRNews GeneralNews HITNews HIPAANews MinnesotaNews