Health Law Daily Wrap Up, ELECTRONIC HEALTH RECORDS—E.D. Pa.: Two claims involving release of personal information by hospital network survive dismissal, (Aug 13, 2026)

By David Yucht, J.D.

Thomas Jefferson University Hospitals, Inc. purportedly shared consumer health care information via Meta Platforms, Inc.’s advertising technology without consent.

A federal district court in Pennsylvania dismissed several claims against Thomas Jefferson University Hospitals, Inc. which alleged the unlawful release of electronic communications brought by a health care consumer as a putative class action. The patient’s claims of negligence, invasion of privacy, and violation of the Electronic Communications Privacy Act (ECPA) were not filed timely and therefore were dismissed. However, the court found the patient’s causes of action for breach of contract and unjust enrichment were plausibly stated and timely filed. Therefore, these two claims survived scrutiny by the court (Thorpe v. Thomas Jefferson University Hospitals, Inc., No. 25-7167 (E.D. Pa. Aug. 3, 2026)).

Tracking tools. Jefferson Health is a multi-state non-profit health system based in Philadelphia, Pennsylvania. The plaintiff had been a Jefferson Health patient since before 2018. Before 2018, she created an account on Jefferson Health’s web properties as well as one on Facebook (now owned by Meta). The patient alleged Jefferson Health utilized Meta’s “tracking and collection tools” to sell targeted advertising based on patients’ online behavior. According to the patient, when a patient used the hospital’s web properties, the Meta Collection Tools transmitted the content of their communications to Meta, including, among other things, personal identification information, communications relating to doctors, treatments, payment information, health insurance information, prescription drugs, prescriptions, side effects, conditions, diagnoses, prognoses, or symptoms of health conditions. The patient asserted that she never authorized the release of this information and brought claims against the hospital involving the ECPA, breach of contract, negligence, intrusion upon seclusion – invasion of privacy, and unjust enrichment. The hospital filed a motion to dismiss.

Statute of limitations. The court found that three of the five claims asserted by the patient were not filed within the relevant (one or two year) statutes of limitations and accordingly had to be dismissed. Prior to the initiation of this putative class action, the patient’s lawyers had brought a similar case involving a different plaintiff named Murphy v. Thomas Jefferson University Hospitals, which was eventually dismissed for jurisdictional reasons. The court found that the filing of the older Murphy case in November 2022, in which claims of negligence, invasion of privacy and violation of the ECPA were alleged, placed the patient in the present case on notice that she had possible claims against the hospital under those three theories. Therefore, the time to file the three claims began to run in November of 2022. Unfortunately for the patient, the time for filing these three claims had all expired before she instituted the current suit.

In October 2023, the Murphy case was amended to include claims for breach of contract and unjust enrichment. The court reasoned that the patient in the present matter was put on notice of these two claims at the time the Murphy complaint was amended. Consequently, the patient had more time to file the breach of contract and unjust enrichment claims which were timely initiated.

Consent. The court did not accept the hospital’s argument for dismissing the remaining two claims. Consent is an affirmative defense to unlawful interception of information. The hospital argued that the patient consented to the share and use of her personal information, including sharing to Facebook, because the hospital’s website began providing a disclaimer included in its Privacy Policy starting in May 14, 2024, effective July 14, 2024. Although the hospital’s new disclaimer was legally binding, the court noted that the updated term was not in place until July 14, 2024, and the patient’s cause of action for her breach of contract and unjust enrichment claims accrued before the new Privacy Policy was implemented. Accordingly, the patient plausibly stated a claim of breach of contract and unjust enrichment for those alleged harms that occurred before July 14, 2024.

The case is No. 25-7167.

Judge: Rufe, C.

Attorneys: David J. Cohen (Stephan Zouras, LLP) for Cathryn Thorpe. Edward J. McAndrew (Baker & Hostetler LLP) for Thomas Jefferson University Hospitals, Inc. d/b/a Jefferson Health.

Companies: Thomas Jefferson University Hospitals, Inc. d/b/a Jefferson Health

Cases: CaseDecisions EHRNews GCNNews GeneralNews HITNews PennsylvaniaNews