Cybersecurity Policy Report, M.D. Tenn.: Case against health system over tracking technologies remanded to state court, (Oct 29, 2026)

By Brian Craig, J.D.

A resolution of the federal questions would leave substantial portions of the case unresolved.

In a proposed class-action lawsuit brought by patients alleging disclosure of patients’ private health information through online tracking technologies used by HCA Healthcare, Inc., which owns and operates health facilities, the federal district court in Nashville has remanded the case to the Tennessee state court. In the case asserting claims under Tennessee law, the court held that the health system failed to meet its burden of establishing that the disputed federal issues are sufficiently substantial to confer jurisdiction. The court concluded that resolution of the federal questions with the negligence per se and wiretap claims would leave substantial portions of the case unresolved (Doe v. HCA Healthcare, Inc., No. 3:26-cv-00993 (M.D. Tenn. Oct. 27, 2026)).

Patients filed a putative class-action lawsuit in Tennessee state court against HCA Healthcare, Inc. and Urgent Care Enterprise, LLC, doing business as CareNow. HCA Healthcare owns 189 hospitals and approximately 2,600 ambulatory sites of care in 19 states, including Tennessee. CareNow, which owns and operates urgent care centers, is a subsidiary of HCA Healthcare. The complaint alleges claims under Tennessee law for alleged disclosure of patients’ private health information through online tracking technologies used by the health system operators. The complaint alleges that the health system disclosed the patients’ personally identifiable information and protected health information to Google and other third parties without the knowledge or consent of the patients. The patients allege seven claims under Tennessee law: negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy, breach of fiduciary duty, and violation of Tennessee’s wiretap statute. The health system removed the case to the federal district court in Tennessee arguing that extensive reliance by the patients on the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations raises substantial questions of federal law. The patients moved to remand the case to the Tennessee state court.

Federal issues. The court first found that federal issues are raised by the negligence per se and Tennessee wiretap claims. These claims raise disputed federal issues concerning whether appointment-scheduling data and patient-portal browsing information constitute individually identifiable health information or protected health information under a federal regulation and whether use of Google Analytics constitutes an unauthorized disclosure under the HIPAA Privacy Rule. Those issues also bear on the Tennessee wiretap claim, which additionally raises the issue whether conduct by the health system constitutes a knowing’ violation subject to criminal penalties under HIPAA.

Substantiality. Next, the court examined whether the disputed federal issues raised by the negligence per se claim and Tennessee wiretap claim are substantial enough to confer federal-question jurisdiction. The court analyzed four factors on substantiality: (1) whether the case includes a federal agency, and particularly, whether that agency’s compliance with the federal statute is in dispute; (2) whether the federal question is important; (3) whether a decision on the federal question will resolve the case; and (4) whether a decision as to the federal question will control numerous other cases.

The first factor—whether the case includes a federal agency whose compliance with a federal statute is in dispute—weighs against jurisdiction. In this case, the health systems are private companies. As to the second factor, the court found that the federal issues raised in the negligence per se claim and Tennessee wiretap claim have limited importance. The third factor weighs against jurisdiction. Unlike other cases in federal court, even resolving negligence per se and Tennessee wiretap claims would not resolve this case. The patients also assert claims for ordinary negligence, breach of implied contract, unjust enrichment, intrusion upon seclusion, and breach of fiduciary duty. Those claims rest on independent sources of duty under Tennessee law and require proof of alleged conduct regardless of how the disputed federal issues are resolved.

Thus, the court granted the motion to remand the case to the Tennessee state court. The court also denied the patients’ request for attorney fees.

The case isNo.3:26-cv-00993.

Judge: Crenshaw, W.

Attorneys: Grayson Wells (Stranch, Jennings & Garvey, PLLC) for Jane Doe. Kathryn Hannen Walker (Bass, Berry & Sims PLC) for HCA Healthcare, Inc.

Companies: HCA Healthcare, Inc.

MainStory: TopStory CaseDecisions FederalLegislation EHRNews GeneralNews CyberPrivacyFeed DataPrivacy Covid19 TennesseeNews DataSecurity