Cybersecurity Policy Report, N.D. Cal.: Federal court rules in favor of patient privacy in class action, (Oct 4, 2024)

By Elena Eyber, J.D.

The federal district court allowed claims under the California Information Privacy Act and Confidentiality of Medical Information Act to proceed.

The federal district court in California addressed a class action filed by a patient against Carbon Health Technologies, Inc. alleging unlawful sharing of patients' personal data through Facebook Pixel and Google Analytics on its website, which intercepted sensitive information during appointment bookings. The patient claimed these actions violated the California Information Privacy Act (CIPA), the California Confidentiality of Medical Information Act (CMIA), and the patient’s constitutional right to privacy. The court partially granted and partially denied Carbon Health’s motion to dismiss, concluding that while certain claims under CIPA related to Google Pixel lacked specificity, allegations regarding Facebook Pixel were sufficient to proceed, as the URLs transmitted medical information that met the CMIA's definition. Additionally, the court affirmed that the patient had a reasonable expectation of privacy regarding the patient’s medical information, rejecting Carbon Health's arguments to the contrary, and deemed the disclosure as "highly offensive." Ultimately, the court granted Carbon Health's motion to dismiss regarding certain claims but denied it concerning the CMIA and invasion of privacy claims, allowing the patient to amend her complaint within twenty-one days (St. Aubin v. Carbon Health Technologies, Inc., No. 24-cv-00667-JST (N.D. Cal. Oct. 1, 2024)).

Background. A patient filed a class action lawsuit alleging that Carbon Health unlawfully shared patients' personal data through Facebook Pixel and Google Analytics on its website. These tools allowed Facebook and Google to intercept sensitive information, such as the type of medical care sought and patients' identities, when users booked appointments. The patient, who used the website to schedule COVID-19 vaccinations, claimed she received targeted ads based on this data. The patient argued that Carbon Health's actions violated the California Information Privacy Act (CIPA), the California Confidentiality of Medical Information Act (CMIA), and her constitutional right to privacy. The court granted in part and denied in part Carbon Health’s motion to dismiss.

CIPA. Section 631(a) of CIPA provides four types of violations: unauthorized wiretapping, interception of communications while in transit, using obtained information without consent, and aiding others in committing these acts. In Javier v. Assurance IQ, LLC, the plaintiff accused Carbon Health of aiding third parties, such as Facebook and Google, in intercepting communications via embedded Pixels on its website, violating CIPA’s fourth clause. The court found that the first clause, addressing telephonic wiretapping, did not apply to internet communications. However, the second clause, which prohibits intercepting communication contents, did apply because URLs containing user search terms related to medical symptoms or appointments were deemed “content.” While allegations of simultaneous interception with Facebook’s Pixel code were sufficient, claims related to Google’s Pixel lacked specificity. The court dismissed part of the claims but allowed those related to Facebook Pixel to proceed, as Carbon Health’s intent to aid the interception was adequately alleged. The defense of user consent was also rejected due to insufficient disclosure to users.

CMIA. The CMIA prohibits healthcare providers from disclosing patients' medical information without authorization and allows for private legal action in case of violations. Carbon Health sought to dismiss a CMIA claim, arguing that the patient did not demonstrate the disclosure of medical information or that a third party viewed it. However, the court found that the URLs sent to Facebook and Google, containing details about medical appointments, could reveal patients’ medical conditions, meeting the CMIA's definition of "medical information." Carbon Health’s argument that third-party technologies did not access this information was rejected, and the court ruled that the patient sufficiently alleged the improper disclosure and viewing of medical information under the CMIA.

Invasion of privacy. To establish a constitutional invasion of privacy claim in California, a plaintiff must show a specific protected privacy interest, a reasonable expectation of privacy, and a sufficiently serious invasion of that privacy. Carbon Health contended that the patient did not adequately allege these elements. However, the court found that the patient had a legally recognized privacy interest in her medical information, which was plausibly disclosed to third parties, thereby satisfying the first element. Regarding the reasonable expectation of privacy, the court rejected Carbon Health's argument that the patient's communications were mere "standard internet transmissions," affirming that patients expect confidentiality in their medical communications. The court also deemed the disclosure "highly offensive," citing the violation of Carbon Health's own privacy policy and the sensitive nature of the medical information involved. Consequently, the court denied Carbon Health's motion to dismiss the invasion of privacy claim.

The case is No. 24-cv-00667-JST.

Judge: Tigar, J.

Attorneys: Ines Diaz Villafana (Bursor & Fisher, P.A.) for Adrienne St. Aubin. Russell L. Taylor (Shook, Hardy & Bacon L.L.P.) for Carbon Health Technologies, Inc.

Companies: Carbon Health Technologies, Inc.

Cases: CaseDecisions StateLegislation EHRNews HITNews CyberPrivacyFeed DataPrivacy GCNNews CaliforniaNews DataSecurity