Summary
dismissing a complaint dealing with a website, “MyChart,” that allowed patients to communicate with healthcare providers
Summary of this case from Murphy v. Thomas Jefferson Univ. Hosps.Opinion
1:22-CV-697
08-24-2023
KEITH DAVID ALLEN, et al., on behalf of themselves and all others similarly situated, Plaintiffs, v. NOVANT HEALTH, INC., Defendant.
MEMORANDUM OPINION AND ORDER
Catherine C. Eagles, Chief District Judge.
The plaintiffs bring this class action against their health care provider, Novant Health, Inc., alleging that Novant disclosed their confidential and private medical information to Meta Platforms, Inc., commonly known at relevant times as “Facebook,” without their consent, in breach of contract, and in violation of statutory and common law duties. For the reasons explained here, Novant's motion to dismiss the breach of implied contract claim and the breach of fiduciary duty claim will be denied and the plaintiffs' other claims will be dismissed for failure to state a claim.
I. Choice of Law
Four of the plaintiffs' claims-Counts Five through Eight-are brought under federal statutes. Federal law applies. For the plaintiffs' state tort and contract claims, North Carolina's choice of law rules govern. See Johnson-Howard v. AECOM Special Missions Servs., Inc., 434 F.Supp.3d 359, 370-71 (D. Md. 2020); Mathis v. Terra RenewalServs., Inc., 69 F.4th 236, 242 (4th Cir. 2023); Towers Watson & Co. v. Nat'l Union Fire Ins. Co. of Pittsburgh, 67 F.4th 648, 653 (4th Cir. 2023).
Because a choice-of-law inquiry can be fact-intensive, courts sometimes defer analysis until after discovery. See, e.g, Clean Earth of Maryland, Inc. v. Total Safety, Inc., No. 10-CV-l 19, 2011 WL 1627995, at *4 (N.D. W.Va. Apr. 28, 2011); N. Am. Tech. Servs., Inc. v. V.J. Techs., Inc., No. 10-CV-l384, 2011 WL 4538069, at *2 (D. Conn. Sept. 29, 2011). But courts may undertake a choice of law analysis at the motion to dismiss stage if “the factual record is sufficiently developed to facilitate the resolution of the issue.” In re Bldg. Materials Corp, of Am. Asphalt Roofing Shingle Prods. Liab. Litig, No. ll-CV-2784, 2013 WL 1316562, at *2 (D.S.C. Mar. 27, 2013); see also Taylor v. Walter Kidde Portable Equip., Inc., No. 21-CV-839, 2022 WL 4450271, at *5 (M.D. N.C. Sept. 23, 2022). “If the choice of law analysis requires the determination of purely legal issues or if the complaint provides the relevant factual information for the court's evaluation of the relevant factors, the court may properly make a choice of law determination.” In re Bldg. Materials Corp., 2013 WL 1316562, at *2; see Taylor, 2022 WL 4450271, at *5.
II. Failure to State a Claim
A. Invasion of Privacy
The lex loci doctrine applies in tort and “tort-like” actions, SciGrip, Inc. v. Osae, 373 N.C. 409, 420, 838 S.E.2d 334, 343 (2020). Under the rule of lex loci, the Court applies the law of the state where the injury occurred. Id. This is ordinarily “the state where the last event necessary to make the actor liable or the last event required to constitute the tort takes place.” Id. (cleaned up).
The plaintiffs bring a tort claim for invasion of privacy by intrusion upon seclusion. Federal courts in this circuit generally hold that for claims based upon alleged data breaches or unlawful disclosure of information to third parties, the injury occurs “when the data is stolen,” or in this case disclosed, and the applicable law is “the state in which the servers were located.” Lamie v. LendingTree, LLC, No. 22-CV-307, 2023 WL 1868198, at *3 (W.D. N.C. Feb. 9, 2023) (collecting cases). The “last event necessary” to make Novant liable for invasion of privacy is the disclosure of the plaintiffs' information to Facebook. As the plaintiffs point out, when the location where the data was stored cannot be determined, e.g., it was “cloud-stored,” courts may also apply the law of the defendant's headquarters and where its cybersecurity decisions were made. See Doc. 29 at 16 (citing In re Mednax Servs., Inc., Customer Data Sec. Breach Litig, 603 F.Supp.3d 1183, 1199 (S.D. Fla. 2022)).
“North Carolina does not recognize a cause of action for the invasion of privacy by disclosure of private facts.” Burgess v. Busby, 142 N.C.App. 393, 405, 544 S.E.2d4, 11 (2001); see Hall v. Post, 323 N.C. 259, 270, 372 S.E.2d 711, 717 (1988). The plaintiffs have made no serious argument that they are asserting such a claim, and the Court construes the complaint only to assert an invasion of privacy by intrusion upon seclusion claim.
Under either test, application of North Carolina law is appropriate. According to the allegations in the complaint, the disclosure took place in North Carolina. See Doc. 20 at ¶ 35. The plaintiffs also allege that Novant is a North Carolina company with its principal place of business in Winston-Salem. Id. at ¶¶ 31-32.
The plaintiffs say that the choice of law determination is premature, but they have not identified any relevant facts missing from or underdeveloped in the amended complaint. They almost exclusively cite to North Carolina law in their briefing and have not otherwise persuasively contended that any other states' law might possibly apply or that this potentially applicable law is substantially different from the law in North Carolina. Should the facts in discovery show that application of another state's law is appropriate to this or other dismissed claims, the plaintiffs can seek reconsideration.
This invasion of privacy by intrusion tort “is defined as the intentional intrusion physically or otherwise, upon the solitude or seclusion of another or in his private affairs or concerns where the intrusion would be highly offensive to a reasonable person.” Tillet v. Onslow Mem'l Hosp., Inc., 215 N.C.App. 382, 384, 715 S.E.2d 538, 540 (2011) (cleaned up). “Generally, there must be a physical or sensory intrusion or an unauthorized prying into confidential personal records to support a claim for invasion of privacy by intrusion.” Broughton v. McClatchy Newspapers, Inc., 161 N.C.App. 20, 29, 588 S.E.2d 20, 27 (2003). Because the plaintiffs acknowledge in the complaint that they voluntarily provided their information directly to Novant, see, e.g, Doc. 20 at ¶¶ 6, 1314, 91, they have not alleged an intrusion or unauthorized prying and this claim is dismissed. See Sabrowski v. Albani-Bayeux, Inc., No. 2-CV-728, 2003 WL 23018827, at *12-13 (M.D. N.C. Dec. 19, 2003); Alexander v. City of Greensboro, 762 F.Supp.2d 764, 815-16 (M.D. N.C. 2011).
B. Unfair and Deceptive Trade Practices
The plaintiffs assert a claim under North Carolina's Unfair and Deceptive Trade Practices Act. The lex loci test governs the choice of law analysis for this claim. See Martinez v. Nat'l Union Fire Ins. Co., 911 F.Supp.2d 331, 338 (E.D. N.C. 2012); Guzman v. Diamond Candles, LLC, No. 15-CV-422, 2016 WL 5679451, at *2 (M.D. N.C. Sept. 30, 2016); United Dominion Indus., Inc. v. Overhead Door Corp., 762 F.Supp. 126, 128-29 (W.D. N.C. 1991); SensorRx, Inc. v. EliLilly & Co., No. 19-CV-643, 2022 WL 4480701, at *3 (W.D. N.C. Sept. 26, 2022). For this claim, the last event necessary to make Novant liable for unfair and deceptive trade practices was the disclosure of the plaintiffs' information to Facebook. As already discussed, the facts alleged show that this occurred in North Carolina and North Carolina law applies.
It would also make little sense to apply the law of any other state, since the claim is based on a North Carolina statute.
This claim will be dismissed because the statutory learned profession exception applies. By its terms, the statute does not apply to “professional services rendered by a member of a learned profession.” N.C. Gen. Stat. § 75-1.1(b). “[M] embers of health care professions fall within the learned profession exemption,” and the “exception for medical professionals has been broadly interpreted.” Sykes v. Health Network Sols., Inc., 372 N.C. 326, 334, 828 S.E.2d 467, 472 (2019) (collecting cases). The learned profession exception applies to Novant's conduct because its use of the pixel in promoting the MyChart patient portal was “a matter affecting the professional services,” specifically the practice of medicine, “rendered by members of a learned profession.” Id. (cleaned up). Novant's alleged conduct is “sufficiently tied to the provision of patient care to fall within the exemption's reach.” See McNew v. Fletcher Hosp., Inc., No. 22-CV-19, 2022 WL 4359246, at *7 (N.C. Bus. Ct. Sept. 20, 2022).
The plaintiffs acknowledge that “as a medical provider, Novant functions, at times, as a member of a learned profession,” but contend that Novant's secret recording and disclosure of their information for advertising purposes had “nothing to do with rendering medical services.” Doc. 29 at 26. This view is inconsistent with the broad interpretation courts apply to the learned profession exception. See Sykes, 828 S.E.2d at 472. The argument is also inconsistent with the statutory definition of the “practice of medicine” in another context, which includes “[a]dvertising ... that the individual is authorized to practice medicine in this state.” See N.C. Gen. Stat. § 90-1.1(5); see RCDI Constr., Inc. v. Spaceplan/Architecture, Planning & Interiors, P.A., 148 F.Supp.2d 607, 619 (W.D. N.C. 2001).
C. Unjust Enrichment
The lex loci doctrine applies to claims of unjust enrichment. See SensorRx, 2022 WL 4480701, at *4; TForce Worldwide, Inc. v. ESC Brands, LLC, No. 21-CV-722, 2022 WL 18491730, at *5 (M.D. N.C. Dec. 12, 2022). Again, the last act necessary to make Novant liable for unjust enrichment is the disclosure of the plaintiffs' information to Facebook, and North Carolina law applies.
A claim of unjust enrichment requires that “(1) a measurable benefit was conferred on the defendant, (2) the defendant consciously accepted that benefit, and (3) the benefit was not conferred officiously or gratuitously.” Jessey Sports, LLC v. Intercollegiate Men's Lacrosse Coaches Ass'n, 888 S.E.2d 677, 681 (N.C. App. 2023) (cleaned up). “[T]he mere fact that one party was enriched, even at the expense of the other, does not bring the doctrine of unjust enrichment into play.” Butler v. Butler, 239 N.C.App. 1, 7, 768 S.E.2d 332, 336 (2015) (cleaned up). North Carolina caselaw “typically contemplates unjust enrichment as an appropriate remedy only in situations where the complaining party intentionally and deliberately undertook an action with an expectation of compensation or other benefit in return.” Id. at 339.
Here, the plaintiffs contend that they “expected that in exchange for providing certain information” to Novant, they would receive medical care. Doc. 29 at 30. There is no allegation the plaintiffs did not receive the medical care they expected in return, and they have not made out a claim of unjust enrichment. To the extent the plaintiffs argue that they were tricked and misled by Novant into providing their information, this is not a claim for unjust enrichment.
D. Breach of Implied Contract
North Carolina courts apply “the law of the place where the contract was made” to contract claims. Tanglewood Land Co., Inc. v. Byrd, 299 N.C. 260, 262, 261 S.E.2d 665, 656 (1980); Lamie, 2023 WL 1868198, at *3. “[T]he place at which the last act was done by either of the parties essential to a meeting of the minds determines the place where the contract was made.” Nytco Leasing, Inc. v. Dan-Cleve Corp., 31 N.C.App. 634, 640, 230 S.E.2d 559, 562-63 (1976) (citing Fast v. Gulley, 271 N.C. 208, 155 S.E.2d 507 (1967)). This “last act” occurred when the plaintiffs “accepted” Novant's “offers” and provided their private information to Novant in exchange for services. See Doc. 20 at ¶¶ 289-290; see also Lamie, 2023 WL 1868198, at *2, 4. This would be the plaintiffs' home states of North Carolina (eight plaintiffs), Doc. 20 at¶¶ 21-24, 26, 28-30, Texas (one plaintiff), id. at ¶ 25, and South Carolina (one plaintiff). Id. at ¶ 27. The Court will apply the law of the plaintiffs' home states.
In North Carolina, a breach of implied contract claim requires an offer, acceptance, consideration, and breach. See Lannan v. Bd. of Governors of Univ, of N.C., 285 N.C.App. 574, 596, 879 S.E.2d 290, 307 (2022). The plaintiffs contend that Novant's privacy policies were an “offer,” that they accepted this offer when they used Novant's online services, that the agreement was supported by consideration, and that Novant breached this agreement. See Doc. 29 at 31; see also Doc. 20 at ¶¶ 289-92. A privacy policy may give rise to an implied in fact contract if it contains an exchange of promises and consideration above and beyond the offeror's existing legal duties. See J.R. v. Walgreens Boots All., Inc., No. 20-1767, 2021 WL 4859603, at *6 (4th Cir. 2021) (per curiam) (unpublished). Novant's privacy policies are not in the record. Drawing all inferences in favor of the plaintiffs, the plaintiffs have sufficiently pled a valid implied contract and breach of the same to the extent required at this stage. See Rudolph v. Hudson's Bay Co., No. 18-CV-8472, 2019 WL 2023713, at *11 (S.D.N.Y. May 7, 2019).
In its original briefing, Novant made no argument that the plaintiffs' claims should be dismissed under South Carolina or Texas law. See Doc. 26. It seems unlikely that South Carolina or Texas law is much different. Absent briefing on the matter, the Court will allow the South Carolina and Texas plaintiffs' claims to also move forward.
Novant does make a passing reference to South Carolina and Texas law in a footnote in its reply brief. See Doc. 34 at 19 n.lO. Parties are not permitted to raise new arguments in a reply brief. See Tyndall v. Maynor, 288 F.R.D. 103, 108 (M.D. N.C. 2013) (“[R]eply briefs may not inject new grounds and ... an argument that was not contained in the main brief is not before the Court.” (cleaned up)). Additionally, the Court need not “consider arguments only raised in a footnote.” See Marietta Area Healthcare, Inc. v. King, No. 21-CV-25, 2022 WL 1073335, at *7 (N.D. W.Va. Apr. 8, 2022) (collecting cases).
E. Unauthorized Interception, Use, and Disclosure
The plaintiffs assert a cause of action based on a violation of 18 U.S.C. § 2511(1), also known as the Wiretap Act. As relevant here, this section prohibits the interception of wire or electronic communications or the disclosure or use of such intercepted communications. See 18 U.S.C. § 2511(1)(a), (c), (d); see also 18 U.S.C. § 2520(a) (providing a private cause of action). Congress has defined “intercept” as “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” 18 U.S.C. § 2510(4). Courts interpreting this statute have held that mere receipt of a communication does not constitute a violation of § 2511(1). See Crowley v. CyberSource Corp., 166 F.Supp.2d 1263, 1269 (N.D. Cal. 2001); Expert Bus. Sys., LLC v. BI4CE, Inc., 233 Fed.Appx. 251, 253-54 (4th Cir. 2007) (per curiam) (unpublished) (affirming the district court's grant of summary judgment when the evidence showed the defendant properly received the at-issue communications); see also In re Google Inc. Cookie Placement Consumer Priv. Litig, 806 F.3d 125, 142-43 (3d Cir. 2015). Here, the plaintiffs allege that Novant received the communication, sent to them directly and specifically by the plaintiffs, and that it was Facebook that intercepted the communication via the pixel. See, e.g, Doc. 20 at ¶¶ 13, 67-68, 70, 299. The plaintiffs have not stated a claim against Novant under § 2511(1), and this count will be dismissed.
F. Unauthorized divulgence
The plaintiffs bring another Wiretap Act claim under 18 U.S.C. § 251 l(3)(a), which provides in relevant part that “a person or entity providing an electronic communication service to the public shall not intentionally divulge the contents of any communication.” This claim will be dismissed because Novant is not an entity “providing an electronic communication service to the public.”
“A company that merely utilizes electronic communications in the conduct of its own business is .. . not the provider of the service to the public.” Garner v. Amazon.com, Inc., 603 F.Supp.3d 985, 1003-04 (W.D. Wash. 2022) (collecting cases); see also Pica v. Delta Air Lines, Inc., No. 18-CV-2876, 2019 WL 1598761, at *7 (C.D. Cal. Feb. 14, 2019). The plaintiffs have alleged that they communicated with their healthcare providers through MyChart, Doc. 20 at ¶ 16, and that Novant's website and MyChart allowed them “to send or receive electronic communications.” Id. at ¶ 317. But “[m]ere operation of' a website that allows “the company to communicate with its customers” “does not transform” Novant “into a provider” of electronic communication services to the public. See In re Jetblue Airways Corp. Priv. Litig., 379 F.Supp.2d 299, 307 (E.D.N.Y. 2005). “[A] company . .. does not become an ‘electronic communication service' provider simply because it maintains a website that allows for the transmission of electronic communications between itself and its customers.” Id.
G. Stored Communications Act
Section 2702 of the Stored Communications Act provides that “a person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service.” 18 U.S.C. § 2702(a)(1). This claim is subject to dismissal for two reasons. First, Novant is not an entity providing an electronic communication service to the public, as explained supra. Second, according to the complaint, the contents of the plaintiffs' communications were not “in electronic storage” by Novant when they were sent to Facebook; the disclosure to Facebook via the pixel happened simultaneously with the disclosure to Novant. See Doc. 20 at ¶¶ 54 (explaining the mechanics of source code and stating that “a website developer like Defendant can use its source code to commandeer the user's computing device, causing the device to contemporaneously and invisibly re-direct the users personally identifiable non-public medical information to third parties”), 255 (“Defendant facilitated Facebook's simultaneous eavesdropping and wiretapping of confidential communications”), 319 (Novant's “divulgence of the contents of' the plaintiffs' “communications was contemporaneous with their exchange with Defendant's website and/or MyChart portal”). This claim will be dismissed.
H. Computer Fraud and Abuse Act
The plaintiffs contend that Novant exceeded authorized access to the plaintiffs' computers in violation of § 1030(a)(2) of the Computer Fraud and Abuse Act. See Doc. 20 at ¶ 349. The statute defines the term “exceeds authorized access” to mean “to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” 18 U.S.C. § 1030(e)(6). The Supreme Court has held that § 1030(a)(2) does “not cover those who ... have improper motives for obtaining information that is otherwise available to them.” Van Buren v. United States, 141 S.Ct. 1648, 1652 (2021). The plaintiffs do not allege that Novant accessed “information located in particular areas” of the plaintiffs' computers “that [were] off limits.” Id. at 1662. Instead, the plaintiffs allege that they voluntarily sent information to Novant and that Novant had improper motives for obtaining this information. Because the facts alleged do not show or allow an inference that Novant exceeded authorized access to the plaintiffs' computers, this count will be dismissed.
I. Breach of Fiduciary Duty
The plaintiffs have entitled their final claim as one for “breach of confidence,” which the Court construes as a claim for breach of fiduciary duty. See 5 Charles Alan Wright & Arthur R. Miller, Federal Practice & Procedure § 1286 (4th ed. 2023) (“A pleading will be judged by the quality of its substance rather than according to its form or label”); see Doc. 29 at 43-46 (plaintiffs' briefing on this claim). This is also a tort claim, and the lex loci test applies. See Movement Mortg. LLC v. Intercont'l Cap. Grp., Inc., No. 22-CV-147, 2023 WL 2428255, at *2-3 (W.D. N.C. Mar. 9, 2023). The last event necessary to constitute this tort is Novant's disclosure of the plaintiffs' information to Facebook, and, as already explained, the current record indicates this occurred in North Carolina, and North Carolina law applies.
North Carolina law does not explicitly recognize a claim of “breach of confidence.” See Watts v. Cumberland Cnty. Hosp. Sys., Inc., 75 N.C.App. 1, 9, 330 S.E.2d 242, 248-49 (1985), reversed in part on other grounds, 345 S.E.2d 201 (1986); Campbell Sales Grp., Inc. v. Niroflex by Jiufeng Furniture, LLC, No. 19-CV-865, 2022 WL 17413381, at *10 (N.C. Bus. Ct. Dec. 5, 2022). The plaintiffs' factual allegations and briefing suggest their claim is for breach of fiduciary duty, and that is how the Court construes the claim.
“A successful claim for breach of fiduciary duty requires proof that (1) the defendants owed the plaintiff a fiduciary duty; (2) the defendant breached that fiduciary duty; and (3) the breach of fiduciary duty was a proximate cause of injury to the plaintiff.” Chisum v. Campagna, 376 N.C. 680, 706, 855 S.E.2d 173, 192 (2021). A confidential and fiduciary duty may arise when a patient trusts the defendant with their confidential health information. See King v. Bryant, 369 N.C. 451, 464-66, 795 S.E.2d 340, 349-50 (2017). The plaintiffs have adequately alleged that Novant owed them a fiduciary duty, that Novant breached this duty by disclosing their confidential information to Facebook, and that they were injured by the breach. Novant's motion to dismiss this claim will be denied.
III. Conclusion
The plaintiffs may proceed on their claims for breach of implied contract and breach of fiduciary duty. All other claims will be dismissed.
It is ORDERED that the defendant's motion to dismiss the consolidated class action complaint, Doc. 25, is GRANTED in part and DENIED in part, as follows:
1. The motion to dismiss Count Four, breach of implied contract, and Count Nine, breach of fiduciary duty, is DENIED.
2. The motion to dismiss all other claims is GRANTED, and those counts are DISMISSED.