Health Law Daily Wrap Up, ELECTRONIC HEALTH RECORDS—S.D.N.Y.: Privacy violation claim alleging unauthorized disclosure of private health information may proceed, (Sep 20, 2024)

By Sara Cracau, J.D.

Consumers’ Electronic Communications Privacy Act (ECPA) claim alleging unauthorized disclosure of individually identifiable health information may proceed.

A district court in New York has granted in part the motion to dismiss of a provider of health care services finding that the consumers sufficiently stated a claim under the ECPA 18 U.S.C. § 2511(1) as it found that the consumers alleged that the disclosures of individually identifiable health information were made without authorization for marketing purposes. The court found that the consumers successfully stated a breach of fiduciary duty/confidentiality claim because the consumers alleged that health care provider acquired sensitive information pertaining to the consumers, disclosed it to third parties without the consumers’ knowledge or consent, and derived a benefit from such disclosure. However, the court found that the consumers’ negligence claim was duplicative of their breach of fiduciary/confidentiality claim and, therefore, it dismissed this claim without prejudice. The court dismissed the state law privacy claim with prejudice as the consumers withdrew this claim. The court dismissed this claim without prejudice because mutual assent is required for a contract to be formed and, here, the consumers could not have assented to assurances in the health care provider’s notice of privacy practices if they did not view these at the time of contract formation. The court also dismissed the unjust enrichment claim without prejudice as it duplicates the consumers’ breach of fiduciary duty/breach of confidentiality tort claim. In addition, the court found that the consumers sufficiently alleged a breach of the New York Consumer Law as the health care provider materially misrepresented its services offered under the New York Consumer Law General Business Law Section 349, and that, as a result, they suffered injury (Gay v. Garnet Health, No. 23-cv-06950 (NSR) (S.D.N.Y. Sept. 16, 2024)).

Consumers initiated an action asserting violations of the ECPA, 18 U.S.C. § 2511(1), New York Civil Rights Law, Sections 50 and 51, New York Consumer Law General Business Law Section 349 and common law claims of breach of fiduciary duty/confidentiality, breach of implied contract, unjust enrichment and negligence against a provider of health care services based on allegations that the provider disclosed individually identifiable information pertaining to the consumers to third parties without their consent from which the provider derived a benefit. The consumers alleged that the health care provider owns and operates a website together with my chart patient account which is accessible from the provider’s website and that they installed a Facebook tracking pixel on its website which enables transmission of consumer personally identifiable information and protected health information (together "Private Information"). The specific technical configuration allows the information which consumers submit through use of the provider’s website to be unlawfully disclosed to Facebook together with the consumers’ unique and persistent Facebook ID (FID). The Pixel communicates directly to Facebook from the provider’s website. The consumers’ activity on the website is tracked and then transmitted directly to Facebook and then Facebook sells the consumers’ Private Information to third parties.

Electronic Communications Privacy Act (ECPA) claim. The court found that the consumers sufficiently stated a claim under the ECPA 18 U.S.C. § 2511(1) as it found that the consumers alleged that the disclosures of individually identifiable health information were made without authorization for marketing purposes. Although further discovery was required to determine whether the health care provider had a criminal or tortious intent but at the motion to dismiss stage, consumers have met their burden for the ECPA claim to survive.

Breach of fiduciary duty/confidentiality and negligence claim. The court found that the consumers successfully stated a breach of fiduciary duty/confidentiality claim because the consumers alleged that health care provider acquired sensitive information pertaining to the consumers, disclosed it to third parties without the consumers’ knowledge or consent, and derived a benefit from such disclosure. However, the court found that the consumers’ negligence claim was duplicative of their breach of fiduciary/confidentiality claim and, therefore, it dismissed this claim without prejudice.

Invasion of privacy, New York Civil Rights Law claim. The court dismissed this claim with prejudice as the consumers withdrew this claim.

Breach of implied contract claim. The court dismissed this claim without prejudice because mutual assent is required for a contract to be formed and, here, the consumers could not have assented to assurances in the health care provider’s notice of privacy practices if they did not view these at the time of contract formation.

Unjust enrichment claim. The court dismissed this claim without prejudice as it duplicates the consumers’ breach of fiduciary duty/breach of confidentiality tort claim.

New York Consumer Law General Business Law claim. The court found that the consumers sufficiently alleged that the health care provider materially misrepresented its services offered under the Ney York Consumer Law General Business Law Section 349, and that, as a result, they suffered injury.

The case is No.: 23-cv-06950.

Judge: Roman, N.

Attorneys: Dylan J. Gould (Markovits Stock & DeMarco, LLC) for Dolores Gay and Corinne Jacob. Robyn Mara Feldstein (Baker & Hostetler, LLP) for Garnet Health.

Companies: Garnet Health

Cases: CaseDecisions StateLegislation CyberPrivacyFeed EHRNews GCNNews GeneralNews DataPrivacy NewYorkNews