Health Law Daily Wrap Up, GENERAL HEALTH CARE NEWS—D. Or.: Fertility services provider obtains dismissal of consumer claims about website PHI collection and disclosure, (Nov 17, 2025)

By Justin Marcus Smith, J.D.

The court took care to establish that financial motivation will not insulate the health care provider from liability under ECPA if the consumer manages to cure her pleading deficiencies on amendment.

Although a Health Insurance Portability and Accountability Act (HIPAA) violation can constitute an independent criminal act under the Electronic Communications Privacy Act (ECPA) crime-tort exception, that exception did not apply where a consumer failed to allege transmission of protected health information (PHI) to a third-party, held the federal district court in Portland, Oregon. ECPA could not apply without a PHI disclosure. The consumer’s complaint also did not exclude the possibility that some other health care provider or data collector might have transmitted data to LinkedIn causing the alleged targeted advertisements. The court dismissed the consumer’s complaint with leave to amend. The consumer did not name LinkedIn or any other third party as a party to this action (B.N. v. Oregon Reproductive Medicine, LLC, No. 3:25-cv-00202 (D. Or. Nov. 12, 2025)).

Background. An Oregon consumer brought a putative class action against a fertility services provider. The consumer alleged the provider’s website used the LinkedIn Insight Tag (Tag), a piece of embedded code, to intercept visiting consumers’ protected health information (PHI) and then disclose that PHI to LinkedIn and other third parties. The consumer said the provider engaged in the alleged PHI collection and disclosure without the knowledge or consent of its website visitors and thereby violated various provisions of the Health Insurance Portability and Accountability Act (HIPAA).

The consumer asserted four claims: (1) violation of ECPA, 18 U.S.C. § 2511(1); (2) negligence; (3) breach of confidence; and (4) unjust enrichment. The consumer pleaded a nationwide class defined as all persons in the U.S. who had a LinkedIn account and booked a consultation with the provider during the class period. She also pleaded a subclass of all such persons in Oregon.

The provider moved to dismiss all four claims for failure to state a claim under Fed. R. Civ. P. 12(b)(6). The consumer opposed, the provider replied, and the court held a hearing on the motion.

ECPA claim. The court held the consumer’s ECPA claim failed because the complaint did not supply facts to connect the provider’s website with any disclosure of PHI to LinkedIn. The provider argued the consumer failed to state an ECPA claim because she failed to allege the first and third elements of an ECPA claim: unlawful interception of electronic communication “contents.”

The court initially noted that ECPA has a “party exception” for interception. However, that is subject to a further crime-tort exception if the alleged interception is done to commit any criminal or tortious act. See § 18 U.S.C. 2511(2)(d). The consumer acknowledged the provider was a party to the communication. However, she argued the provider’s conduct fell within the crime-tort exception because the provider intended to violate HIPAA’s criminal prohibition against unauthorized PHI disclosure. The provider countered that even if the consumer’s allegations were true, the purpose of the Tag data collection, if any, would have been commercial gain, not commission of a crime or tort.

The court analyzed how the Ninth Circuit has instructed that the existence of a lawful interception purpose, and more specifically here, one that would involve a financial motivation, does not necessarily mean the interception cannot also be done for a tortious or unlawful purpose. Accordingly, the instant court rejected the provider’s contention that financial motivation for intentional disclosure of PHI violating HIPAA would necessarily immunize it from ECPA liability.

However, the court continued that although a HIPAA violation can constitute an independent criminal act under the ECPA crime-tort exception as a matter of law, that did not apply here because the consumer did not adequately allege transmission of PHI to LinkedIn. The court cited how other Ninth Circuit courts have held PHI does not stretch so far to include a user’s browsing activity on a public-facing website that generates only general search queries.

The court rejected the consumer’s suggestion that the existence of the Tag on the provider’s website was enough, by itself, to show the provider transmitted her PHI to LinkedIn. Screenshots of two webpages the consumer provided were clearly public-facing portions of the provider’s website. Consumer or patient queries performed on those two web pages were generic search queries, they were not PHI. The court cited Legacy Health to distinguish a meaningful difference between searches performed on an open website without credentialed access control, and private, password -protected patient portals. See K.L. v. Legacy Health, No. 3:23-cv-1886-SI, 2024 WL 479657, at *4 (D. Or. Nov. 14, 2024) (generic search queries are not PHI).

The court continued to analyze that a third page, which appeared to be a general interest form for submitting information to the provider, did not include any detail about IVF services. The court concluded the consumer did not plead any facts to suggest the Tag collected her PHI. The consumer’s theory of alleged HIPAA violation was that the Tag allowed LinkedIn to intercept and record “click” events that “detail information” about what web pages the consumer viewed and which selections she made. While the complaint alleged the Tag intercepted confidential information about fertility-related medical appointments, it did not supply enough facts to support that conclusion. The court, distinguishing other cases that have survived dismissal, said the instant complaint did not plead that the provider’s webpage tracked what physician or other provider she scheduled an appointment with or any treatment details. Those things would be PHI, but the complaint did describe such or that any other activity on the provider’s website could be PHI.

Likewise, the consumer’s allegations about LinkedIn advertising did not show that the provider specifically disclosed anything to LinkedIn. The consumer did not provide any detail about the advertisements, nor did the complaint specify how the advertisements matched information the consumer allegedly disclosed to the provider. The complaint stated the consumer received “targeted” advertisements “relating to fertility services.”

The complaint also stated the consumer and class members face ongoing harassment and embarrassment in the form of unwanted targeted advertisements; however, this did not, in the court’s view, establish that LinkedIn found out the consumer was seeking IVF treatment through the provider rather than any other source. The court observed Google searches would have probably caused the same advertising, whereas the consumer in Legacy Health alleged she received advertising specific to her medical condition that she previously disclosed at only one website.

The instant consumer also failed to allege temporal proximity. She said she received advertisements 8 months after disclosing information to the provider. The time lag did not support an inference that the provider disclosed the consumer’s PHI to LinkedIn. More to the point, the complaint did not plead facts to support an inference it was this provider who would have been responsible for disclosing PHI to LinkedIn.

Turning to the contents of the alleged interception, the court found the consumer failed to allege any facts showing content disclosure to LinkedIn or any third party. ECPA defines “contents” as any information about the substance, purport, or meaning of a communication. The court did not reject the provider’s argument that the consumer failed to allege any actual message content, and metadata did not fit within the statutory definition. Instead, the court said it declined to consider the provider’s content arguments because the court had already found the consumer did not adequately plead PHI disclosure.

State law claims. Having dismissed the federal ECPA claim, the court declined to exercise supplemental jurisdiction over the consumer’s state law claims.

Amendment. The court granted the consumer leave to amend. The court explained it could not exclude the possibility of curative amendment and reiterated its holding that a violation of HIPAA for financial gain can fall under the ECPA crime-tort exception.

The case is No 3:25-cv-00202.

Judge: Immergut, K.

Attorneys: Cody B. Hoesly (Barg Singer Hoesly PC) for B.N. Clifford S. Davidson (Snell & Wilmer LLP) for Oregon Reproductive Medicine, LLC d/b/a ORM Fertility.

Companies: Oregon Reproductive Medicine, LLC d/b/a ORM Fertility

Cases: CaseDecisions FederalLegislation CMSNews CyberPrivacyFeed EHRNews HIPAANews GCNNews ProviderNews DataPrivacy OregonNews