Health Law Daily Wrap Up, ELECTRONIC HEALTH RECORDS—S.D. Cal.: Patient’s wiretap claims against LASIK website operator allowed to proceed, (Feb 4, 2026)

By Patricia K. Ruiz, J.D.

The patient alleged a website transmitted his medical communications and personally identifiable information to Facebook without his knowledge or consent.

The U.S. District Court for the Southern District of California partially denied a motion to dismiss in a proposed class action alleging unlawful interception and disclosure of medical communications through website tracking technology. The court held that the complaint adequately alleged standing and plausible claims under federal and California wiretapping statutes but that the patient lacked standing to pursue a claim for invasion of privacy under the California Constitution (Ramirez v. LasikMD USA, Inc., No. 24-cv-2221-CAB-DDL (S.D. Cal. Jan. 26, 2026)).

Background. A patient filed suit individually and on behalf of a proposed class against VGC Group LP, the operator of the website us.lasikmd.com. The patient alleged he used the website to schedule laser vision correction consultations and appointments and disclosed confidential, protected, and individually identifiable medical information in those communications. According to the amended complaint, the website was embedded with the Facebook Tracking Pixel, which transmitted the patient’s medical communications and personally identifiable information, including his Facebook ID, to Facebook without his knowledge or consent. The patient alleged Facebook used the information to deliver targeted advertising to him.

The patient asserted claims under the Electronic Communications Privacy Act (ECPA), the California Invasion of Privacy Act (CIPA), and the privacy provision of the California Constitution. VGC moved to dismiss all three claims for lack of Article III standing and failure to state a claim.

Standing for ECPA and CIPA claims. The court rejected VGC’s argument that the patient failed to allege an injury in fact sufficient to establish Article III standing for his wiretapping claims. The court held that the alleged unauthorized disclosure of personally identifiable and confidential medical information constituted a concrete and particularized injury. The court stated that harms involving disclosure of private information and intrusion upon seclusion are traditionally recognized bases for lawsuits and therefore satisfied standing requirements at the pleading stage.

Failure to state a claim arguments. The court also rejected VGC’s contention that the patient failed to state claims under ECPA and CIPA. VGC argued that it was exempt from liability because it was a party to the communications exchanged through its website. The court held that the patient adequately alleged facts supporting application of the crime or tort exception to the party exemption. The amended complaint alleged VGC intentionally transmitted confidential, personally identifiable health information to Facebook without the patient’s knowledge or consent, supporting claims of invasion of privacy and violations of health information protections. The court found consent disputes were factual issues not suitable for resolution on a motion to dismiss.

California constitutional privacy claim. The court reached a different conclusion regarding the patient’s claim for invasion of privacy under the California Constitution. Although the court found the alleged disclosure of private medical communications to a third party sufficiently serious in nature, it held the patient lacked standing to seek prospective injunctive relief. The court concluded the patient failed to allege a real and immediate threat of future injury attributable to VGC. It noted the patient did not allege he intended to revisit the website or that VGC continued to make unauthorized disclosures, and Facebook was not a defendant in the case.

The court denied VGC’s motion to dismiss the ECPA and CIPA claims and granted the motion to dismiss the California constitutional privacy claim for lack of standing.

The case is No. 24-cv-2221-CAB-DDL.

Judge: Bencivengo, C.

Attorneys: Sarah N. Westcot (Bursor & Fisher P.A.) for Juan Ramirez. Daniel D. Barnowski (Katten Muchin Rosenman LLP) for LasikMD USA, Inc. d/b/a Lasik MD Vision and VGC Group LP.

Companies: LasikMD USA, Inc. d/b/a Lasik MD Vision; VGC Group LP

Cases: CaseDecisions EHRNews HITNews CaliforniaNews