Cybersecurity Policy Report, N.D. Ill.: Patient portal log-in click formed plausible basis for ECPA claim tied to HIPAA violation, (Oct 10, 2025)

By Justin Marcus Smith, J.D.

The act of logging into a healthcare provider’s patient portal, when combined with individual identifiers such as an IP address or a Facebook ID, can reveal patient status IIH under HIPAA.

A patient plausibly alleged that a Chicagoland medical center used Meta Platforms, Inc. (Meta) website data collection tools to “intentionally intercept” her communications for the purpose of committing a criminal act in violation of the Health Insurance Portability and Accountability Act (HIPAA), held the federal district court in Chicago. The court explained how the use of third-party collection tools on a public website, which did not necessarily involve data collection inside a patient portal, could still potentially implicate individually identifiable health (IIH) information under HIPAA. Disclosure of plaintiff’s log-in button click might be enough to reveal patient status as HIPAA -protected IIH. The court accordingly declined to dismiss the patient’s Electronic Communications Privacy Act (ECPA) claim against the medical center. The court also held the medical center was not entitled to judgment as a matter of law because the dispute resolution provision in its website terms of service (TOS) did not pertain to the instant litigation because the patient initiated the litigation before she agreed to the TOS. However, a TOS class-action waiver was applicable, so the court struck the patient’s class allegations (Hartley v. University of Chicago Medical Center, No. 1:22-cv-05891 (N.D. Ill. Oct. 1, 2025)).

Background. In late 2022, a patient brought a putative class action against University of Chicago Medical Center (UCMC) alleging violation of the Electronic Communications Privacy Act (ECPA). UCMC is a non-profit. The patient said she had been using the UCMC website to schedule appointments, to request information on specific medical services, to research and find physicians, and to access the MyChart patient portal. The patient alleged UCMC intercepted individually identifiable healthcare information (IIH) to share it with third-party social media company, Meta, formerly known as Facebook, in violation of the Health Insurance Portability and Accountability Act (HIPAA).

After dismissal, the filing of a second amendment complaint (SAC) with over 90 paragraphs of new allegations, and limited discovery, UCMC moved for dismissal under Fed. R. Civ. P. 12(b)(6), summary judgment, or to strike the patient’s class claims.

Threshold discovery. Another court previously assigned ordered limited discovery on three threshold issues:

1. ownership and control of four web properties at issue in the second amended complaint;

2. installation and operation of Meta collection tools on the MyChart patient portal;

3. patient interactions with and use of the web properties, including review and consent to UCMC terms of use (TOS) on December 5, 2023.

Discovery revealed UCMC never installed Meta’s data collection tools on the UCMC MyChart patient portal, as distinguishable from the public website. The patient then deleted 32 paragraphs of allegations producing the third amended complaint (TAC) now at issue.

The TAC maintained that UCMS used Meta code to capture “characteristics” of individual patient communications with the UCMC website (i.e., IP address; Facebook ID; other identifiers; times and dates logged-in) and the “content” of those communications (i.e., URLs; pages clicked and viewed related to medical providers, conditions and treatments).

ECPA overview. The TAC asserted a single ECPA violation claim. ECPA imposes criminal and civil liability on persons who intentionally intercept communications. 18 U.S.C. § 2511(1)(a), (4); 18 U.S.C. § 2520. Parties to the communication are not liable, but there is a crime-fraud exception. 18 U.S.C. § 2511(2)(d).

The parties did not dispute that UCMC was a party to any communications it allegedly intercepted, so the TAC had to plausibly allege a crime-fraud exception to survive dismissal, for example, a violation of the Health Insurance Portability and Accountability Act (HIPAA).

ECPA analysis. The court found the patient plausibly alleged disclosure of UCMC patient status. UCMC contended the patient did not plausibly allege disclosure of health or treatment information specific to her. The court agreed with the UCMC assessment that the TAC lacked most of the allegations the earlier court cited in declining to dismiss the SAC. UCMC contended none of the remaining allegations described information about the patient’s medical symptoms, conditions, or treatments as ostensibly intercepted or disclosed to Meta.

The patient maintained that UCMC allegedly disclosed her IIH in three ways: (1) it disclosed her status as a UCMC patient; (2) it disclosed that she visited UCMC’s “find-a-physician” webpage when she used the UCMC public website to search for a primary care physician; and (3) it disclosed information about webpages she clicked and viewed about her medical providers, conditions, and treatments.

The court found the patient plausibly alleged disclosure of UCMC patient status. Her patient status was IIH. It related to her health care or payment for care. The court held it fell within the ambit of HIPAA. The allegations also supported a plausible inference that UCMC disclosed her status as a patient, IIH, to Meta.

UCMC disagreed because it said it did not install Meta collection tools on the UCMC MyChart patient portal. The court countered that the In re Meta Pixel Healthcare Litigation analysis did not depend, as UCMC said it did, on the existence of data collection tools within the patient portal; disclosure of plaintiff’s log-in button click was enough. See In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d at 784, 791-92.

The court continued that other courts have held that button-click data on public websites, even exclusive of password-protected patient portals, can reveal patient status. Another case UCMC pointed to did not change the analysis because it pertained only to HHS guidance, not to specific individual use of specific websites, and it did not categorically hold that information from public websites can never be IIH. The court found UCMC’s other cases unavailing.

The court also noted that the instant patient said she used the public website to access the MyChart patient portal login, and that would have captured information connecting her to UCMC, and again, the allegation involved patient status IIH protected under HIPAA. The court distinguished some of the other cases UCMC cited in that the instant patient made factual allegations about how she accessed the MyChart patient portal, what information UCMC allegedly intercepted thereby, origin and destination URLs, and how that amounted to patient status IIH. The court held the allegations were not conclusory. They were enough to infer disclosure of status as a UCMC patient.

However, the court agreed with UCMC that use of the “find-a-physician” webpage, and other alleged disclosures about webpages clicked and viewed about medical providers, conditions, and treatments, did not plausibly amount to disclosures of IIH. The court held such mere “browsing” did not convey IIH. See Smith v. Facebook, Inc., 745 Fed. App’x 8 (9th Cir. 2018). In a footnote, the court cautioned that Smith, while helpful in delineating the boundary between HIPAA -protected and -unprotected information, did not stand for UCMC’s proposition that information collected from a public website can never be IIH. What matters under Smith is whether the information provides a window into an individual’s personal medical history. In the instant matter, the TAC, unlike the SAC, did not allege UCMC disclosed that she accessed information about specific specialist doctors. The deficiency the court saw in the TAC was that it lacked the factual support to infer that the information related to health, condition, or care received.

Nonetheless, as already discussed, the patient plausibly alleged UCMC disclosed IIH in connection with MyChart use. UCMC made arguments the court already rejected that it did not intercept for a criminal or tortious purpose. The TAC remained viable here. The court did not find significant differences in the legal landscape since the prior ruling by the court previously assigned. The prior court’s reasoning was persuasive, and the instant court said it would adopt it even if not required to do so. New UCMC arguments, for example, that the patient failed to allege a criminal or tortious purpose independent of the interception, or that HIPAA required a culpable state of mind beyond mere knowledge of the facts of the offense, were unavailing.

Summary judgment. The court held UCMC was not entitled to summary judgment for patient breach of the TOS. UCMC argued the TOS was an offer which the patient accepted by clicking “I accept” and by using the medical center’s digital services in exchange for agreeing to the TOS. UCMC further alleged the ECPA claim was a “dispute” under the TOS class-action waiver and dispute resolution provisions, even though the ECPA claim accrued before the patient accepted the TOS. UCMC said the SAC and TAC filings breached the TOS because the patient could only follow the written notice procedure and bring claims after that on an individual basis only.

The court held it had no choice but to accept UCMC’s assertions of a valid and enforceable contract, requiring mandatory dispute resolution and class-action waiver, even retroactively, because the patient did not dispute them. The patient waived argument, leaving only the disputed issue of breach, which turned on how to construe the terms of the TOS under Illinois law.

UCMC contended the patient breached both the dispute resolution provision and the class-action waiver. The patient said none of the promises she may have made about filing a future class action precluded her from pursuing claims she was already pursuing in October 2022 in the SAC, before she agreed to the TOS in December 2023. UCMC interpreted the TAC filed after December 2023 as a new claim or cause of action requiring written notice and dispute resolution.

The court found the patient already waived any argument that her ECPA claim was not a “dispute” under the TOS definition, but even if she had not waived, the plain language clearly encompassed the TAC ECPA claim. But even so, the court found the dispute resolution provision did not apply to the facts of the case. The terms had an explicit effective date of August 31, 2023, and the patient had already commenced a “formal proceeding” when she filed her initial complaint on in October 2022. The earlier dismissal of the ECPA and breach of confidentiality claims by the previously assigned court was without prejudice. The SAC and TAC had no intervening bearing as “commence[ment]” of a new “formal proceeding.”

The TAC ECPA claim was also not a “new” claim because it did not matter that it was confined to alleging installation of Meta collection tools on the public website, rather than, as previously alleged, also on the MyChart patient portal. Every iteration of the complaint contained an ECPA claim based on alleged UCMC use of Meta collection tools on one or more of its web properties. Only the details varied. The TAC was not a new formal proceeding.

However, the patient did breach the terms of the class-action waiver. The court gave the word “pursue” its ordinary meaning of “prosecute or sue.” The waiver applied not only to new claims, but also to the ongoing litigation.

The case is No. 1:22-cv-05891.

Judge: Alexakis, G.

Attorneys: Catherine Mitchell Duffy (Stephan Zouras, LLP) for Sophia Hartley. Chad Allen Schiefelbein (Vedder Price P.C.) for University of Chicago Medical Center. Lauren R. Goldman (Gibson, Dunn & Crutcher LLP) for Meta Platforms, Inc.

Companies: University of Chicago Medical Center; Meta Platforms, Inc.

MainStory: TopStory CaseDecisions ConfidentialityNews CyberPrivacyFeed EHRNews HIPAANews DataPrivacy LitigationEnforcement IllinoisNews DataSecurity