Davidson v. Hewlett-Packard Company

• Court: District Court, N.D. California
• Decided: September 16, 2021
• Docket: 5:16-cv-01928
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 JONATHAN MARC DAVIDSON, et al., 8 Case No. 5:16-cv-01928-EJD Plaintiffs, 9 ORDER GRANTING DEFENDANTS’ v. MOTION FOR SUMMARY JUDGMENT 10 HEWLETT-PACKARD COMPANY, et al., Re: Dkt. No. 203 11 Defendants. 12 13 Pro se Plaintiffs Jonathan Marc Davidson and Corinna Davidson (collectively “Plaintiffs”) 14 brought this action against Defendants Hewlett-Packard Company n/k/a HP Inc., Hewlett Packard 15 Enterprise Company (“HPE”), United Healthcare Services, Inc., UnitedHealth Group Incorporated 16 (“United Healthcare” or “UHC”), Dr. Angelique Green, Dr. Peter Stangel, Dr. Edward Greenberg, 17 and Dr. Lauren Standig (collectively, “Defendants”) seeking damages relating to Defendants’ 18 decision to end Jonathan Davidson’s medical care at a rehabilitation center and transfer him to 19 custodial care at home. On August 15, 2019, the Court dismissed with prejudice all of the claims 20 alleged by Plaintiffs in their Third Amended Complaint (“TAC”), except for their invasion of 21 privacy claim.1 22 Now before the Court is Defendants’ Motion for Summary judgment as to Plaintiffs’ 23 invasion of privacy claim. (“Mot.”), Dkt. No. 203. Having read the papers filed by the parties and 24 carefully considered their arguments and the relevant legal authority, the Court hereby GRANTS 25 Defendants’ Motion for Summary Judgment.2 26 27 1 See Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss, Dkt. No. 178. 2 The Court took this motion under submission without oral argument pursuant to Civil Local Rule 1 I. BACKGROUND 2 As a part of her employment at HPE, Plaintiff Corinna Davidson (“Mrs. Davidson”) was 3 eligible to participate in the company’s medical benefits plans. See Mar. 24, 2017 Decl. of Elsa 4 Karr (“Karr I Decl.”), Dkt. No. 203-2 ¶ 3. Mrs. Davidson elected to participate in HPE’s medical 5 benefits plans offered by HPE, which also afforded her husband, Jonathan Davidson (“Mr. 6 Davidson”), the opportunity to become a beneficiary. Since 2009, Mr. Davidson has suffered 7 from amyotrophic lateral sclerosis (“ALS”), or Lou Gehrig’s disease. He is physically disabled 8 and requires continuous medical care, including feeding and breathing tubes. HPE has served as 9 the plan administrator of Plaintiffs’ medical benefits, first for the HP Inc. Comprehensive Welfare 10 Benefits Plan and then for the HPE Comprehensive Welfare Benefits Plan (collectively the 11 “Plan”). Id. ¶¶ 7-9. 12 In December 2014, Mr. Davidson was admitted into a skilled-care nursing facility. See 13 Apr. 9, 2015 Dr. Angelique Green Letter (“Dr. Green Letter”), Dkt. No. 203-13. In February 14 2015, however, UHC’s clinical staff determined Mr. Davidson’s continued stay in a skilled 15 nursing facility was not covered under Plaintiffs’ health plan and that he no longer needed skilled 16 care at the facility. Id. According to Plaintiffs, the clinical staff decided Mr. Davidson should 17 instead receive “custodial care” at his home. Apr. 8, 2020 Corinna Davidson’s Supp. 18 Interrogatory Answers (“Apr. 2020 C.D. Supp. Answers”), Dkt. No. 203-28 at 1-2. Plaintiffs 19 unsuccessfully challenged this decision in a series of administrative appeals, but UHC allowed Mr. 20 Davidson to remain in the skilled care facility on a week-by-week basis. Later in 2015, HPE 21 agreed to include a supplemental medical benefits program (the “Supplemental Program”) as part 22 of Mrs. Davidson’s medical coverage which covered custodial skilled nursing care for an 23 unlimited number of days. See Karr I Decl. ¶ 5. 24 Following HPE’s inclusion of the Supplemental Program, Plaintiffs’ medical coverage 25 consisted of two parts: (a) the active medical benefits program; and the (b) Supplemental Program. 26

27 7-1(b). 1 Id. During this time, UHC served as the claims administrator for Plaintiffs’ HPE benefits plan 2 while prescription drug and behavioral health coverage was offered through Optum. See, e.g. 3 Hewlett-Packard Company Active Medical Plans Summary Plan Description 2015 (“2015 SPD”), 4 Dkt. No. 203-5. The terms and conditions of the medical coverage offered to Plaintiffs were set 5 forth in the Summary Plan Descriptions (“SPDs”), which were provided to participants and their 6 beneficiaries on a yearly basis and upon request. Id. In addition to information about coverage 7 and claims procedures, the SPDs explained to participants and beneficiaries that HPE and UHC 8 “may use individually identifiable health information to administer the Plan and pay claims, to 9 identify procedures, products, or services that [Plaintiffs] may find valuable, and as otherwise 10 permitted or required by law.” 2015 SPD at 194.3 They also informed participants and 11 beneficiaries that “[b]y accepting [b]enefits under the Plan,” they authorized and directed “any 12 person or institution that has provided services to [participants and beneficiaries] to furnish [HPE 13 AND UHC] with all information or copies of records relating to the services provided.” Id. 14 Additionally, HPE and UHC had the “right to release any and all records concerning health care 15 services which [were] necessary to implement and administer the terms of the Plan, [or] for 16 appropriate medical review or quality assessment. . . .” Id. 17 Plaintiffs also received HPE’s Notice of Privacy Practices (the “Privacy Notice”), which 18 informed Plan participants that protected health information (“PHI”) may be disclosed without the 19 participant’s or beneficiary’s written authorization “to determine [their] eligibility for benefits 20 under the Plan, . . . [or] to determine if the claim for benefits [was] covered under the Plan.” 21 Privacy Notice, Dkt. No. 203-8 at 5. According to the Privacy Notice, PHI could also be used or 22 disclosed by the “Plan as part of the Plan’s healthcare operations,” including for activities such as 23 “case management and care coordination, quality assurance, conducting or arranging for medical 24 review, auditing, or legal services, . . . and customer service and resolution of internal grievances.” 25 Id. at 6. 26

27 3 The Court’s citations to documents are to the document’s ECF page number. 1 Plaintiffs’ invasion of privacy claim focuses on two separate forms of alleged intrusions 2 into their right to privacy. First, Plaintiffs assert that Defendants “communicated, disseminated, 3 published and publicly distributed” private medical information about Mr. Davidson to several 4 individuals, including his treating physicians (or their representatives), HPE and UHC employees 5 and the board of directors, representatives from Optum, and a case manager who worked at a 6 facility at which Mr. Davidson received care from December 2014 to December 2018. July 11, 7 2020 Corinna Davidson’s Supplemental Interrogatory Answers (“July 2020 C. D. Supp. 8 Answers”), Dkt. No. 203-9 at 4; Apr. 7, 2020 Jonathan Davidson’s Supplemental Interrogatory 9 Answers (“J.D. Supp. Answers”), Dkt. No. 203-10 at 3-4. Throughout this same period, Plaintiffs 10 also shared Mr. Davidson’s medical information including his health status and services received 11 with individuals at HPE, UHC, Optum, as well as members of the “National Media, Local Media, 12 and Independent [Media].” See J.D. Supp. Answers at 10-12. Mr. Davidson, along with a family 13 member, also created a publicly available blog on which Mr. Davidson’s diagnosis and other 14 personally identifying medical information was shared. See Dkt. No. 203-21; see also Sept. 21, 15 2020 Decl. of Sarah Bryan Fask (“Fask Decl.”), Dkt. No. 203-29. 16 Plaintiffs also believe that Defendants have utilized online communications and their use 17 of the UHC website and portal to “intrude in the laptop, computing or communication devices of 18 [Plaintiffs].” J.D. Supp. Answers at 4-5. Plaintiffs retained a certified public accounting and 19 business advisory firm to determine if their computers had been intruded upon. Dep. of Kaly 20 Richmond (“Richmond Dep.”), Dkt. No. 203-22 at 10:12-17. Specifically, Mrs. Davidson 21 informed the firm that she was “suspicious about flashing green screens and black box[es] 22 popping-up on her screen.” Id. at 88:6-9. After an analysis of Plaintiffs’ electronic devices, the 23 firm did not find any evidence that any representative, agent, or employee associated with 24 Defendants accessed Plaintiffs’ electronic devices. Id. at 93:14-94:1. 25 II. LEGAL STANDARDS 26 A. Summary Judgment 27 A court must grant summary judgment if the movant shows “that there is no genuine 1 dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. 2 Civ. P. 56(a). In order to satisfy this burden, “the moving party must either produce evidence 3 negating an essential element of the nonmoving party’s claim or defense or show that the 4 nonmoving party does not have enough evidence of an essential element to carry its ultimate 5 burden of persuasion at trial.” Nissan Fire & Marine Ins. Co. v. Fritz Companies, Inc., 210 F.3d 6 1099, 1102 (9th Cir. 2000). “In order to carry its ultimate burden of persuasion on the motion, the 7 moving party must persuade the court that there is no genuine issue of material fact.” Id. 8 If the moving party meets its burden of production, the nonmoving party must produce 9 evidence to support its claim or defense. Id. at 1103. If the nonmoving party fails to produce 10 enough evidence to create a genuine issue of material fact, Rule 56(c) mandates the moving party 11 win the motion for summary judgment. See id. 12 The court must draw all reasonable inferences in favor of the party against whom summary 13 judgment is sought. Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587 (1986). 14 However, “the mere suggestion that facts are in controversy, as well as conclusory or speculative 15 testimony in affidavits and moving papers, is not sufficient to defeat summary judgment.” Hamm 16 v. Mercedes-Benz USA, LLC, No. 5:16-CV-03370-EJD, 2019 WL 4751911, at *2 (N.D. Cal. Sept. 17 30, 2019); see also Matsushita Elec. Indus. Co., 475 U.S. at 587 (“When the moving party has 18 carried its burden under Rule 56(c), its opponent must do more than simply show that there is 19 some metaphysical doubt as to the material facts.”). Instead, the non-moving party must come 20 forward with admissible evidence to satisfy the burden. Fed. R. Civ. P. 56(c). 21 B. Pro Se Pleadings 22 Pleadings filed by pro se plaintiffs must be “construed liberally.” Resnick v. Hayes, 213 23 F.3d 443, 447 (9th Cir. 2000). In order to do so, the court “need not give a plaintiff the benefit of 24 every conceivable doubt,” but must “draw every reasonable or warranted factual inference in the 25 plaintiff’s favor.” McKinney v. De Bord, 507 F.2d 501, 504 (9th Cir. 1974). Courts must use 26 common sense when interpreting the often-unclear pleadings from pro se plaintiffs. Id. Although 27 pro se litigants are held to “less stringent standards,” they are not exempt from “complying with 1 the procedural and substantive rules of the court” and must “comply strictly with the summary 2 judgment rules.” Haines v. Kerner, 404 U.S. 519, 520 (1972); Thomas v. Ponder, 611 F.3d 1144, 3 1150 (9th Cir. 2010) (citing Bias v. Moynihan, 508 F.3d 1212, 1219 (9th Cir. 2007)). 4 III. DISPUTED FACTS AND EVIDENTIARY ISSUES 5 Plaintiffs dispute many of the facts on which Defendants’ Motion relies. See Dkt. No. 208. 6 Yet, they fail to cite to evidence that actually controverts any of Defendants’ proffered facts. 7 Plaintiffs instead make conclusory and speculatory statements or circular citations back to 8 documents which do not suggest a disputed fact. 9 The Court is not “required to comb through the record to find some reason to deny a 10 motion for summary judgment,” and therefore when it appears that Plaintiffs have not cited to any 11 specific evidence controverting a fact on which Defendants rely, the Court will deem the fact 12 undisputed for purposes of this motion. Forsberg v. Pac. Nw. Bell Tel. Co., 840 F.2d 1409, 1418 13 (9th Cir. 1988). 14 IV. DISCUSSION 15 Plaintiffs claim Defendants violated their right to privacy under Article I, Section 1 of the 16 California Constitution and California common law.4 TAC ¶¶ 121-22. The Court will address 17 both variants of Plaintiffs’ invasion of privacy claim separately. 18 A. Invasion of Privacy Under the California Constitution 19 The California Constitution creates a privacy right that protects individuals from the 20 invasion of their privacy by private parties. Am. Acad. of Pediatrics v. Lungren, 16 Cal. 4th 307 21 (1997); Leonel v. Am. Airlines, Inc., 400 F.3d 702, 711–12 (9th Cir. 2005), opinion amended on 22 denial of reh’g, 03–15890, 2005 WL 976985 (9th Cir. Apr. 28, 2005). To establish a claim under 23 24 4 Plaintiffs also claim Defendants’ “intrusion, privacy violations and communication, publication, 25 dissemination, and distribution of private information of Plaintiffs violates federal law and regulations including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). 26 TAC ¶ 121. However, HIPAA does not provide for a private right of action. See Poli v. Mt. Valleys Health Ctrs., Inc., No. 2:05-2015-GEB-KJM, 2006 WL 83378 (E.D. Cal. Jan. 11, 2006) 27 (rejecting plaintiff’s claim for violation of HIPAA because no express or implied private cause of action exists under the statute.) 1 the California Constitutional right to privacy, a plaintiff must first demonstrate three elements: (1) 2 a legally protected privacy interest; (2) a reasonable expectation of privacy under the 3 circumstances; and (3) conduct by the defendant that amounts to a serious invasion of the 4 protected privacy interest. Hill v. Nat’l Collegiate Athletic Assn, 7 Cal. 4th 1, 35–37 (1994). 5 These elements do not constitute a categorical test, but rather serve as threshold components of a 6 valid claim to be used to “weed out claims that involve so insignificant or de minimis an intrusion 7 on a constitutionally protected privacy interest as not even to require an explanation or 8 justification by the defendant.” Loder v. City of Glendale, 14 Cal. 4th 846, 893 (1997). 9 “Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or 10 potential impact to constitute an egregious breach of the social norms underlying the privacy 11 right.” Hill, 7 Cal. 4th at 37. Thus, if the allegations “show no reasonable expectation of privacy 12 or an insubstantial impact on privacy interests, the question of invasion may be adjudicated as a 13 matter of law.” Pioneer Elecs. (USA), Inc. v. Superior Ct., 40 Cal. 4th 360, 370 (2007) (citing 14 Hill, 7 Cal. 4th at 40). 15 The California Constitution sets a high bar for an invasion of privacy claim. Even 16 disclosure of personal information, such as social security numbers, does not constitute an 17 “egregious breach of the social norms” to establish an invasion of privacy claim. See, e.g., In re 18 iPhone Application Litig., 844 F. Supp. 2d 1040, 1063 (N.D. Cal. 2012) (holding that the 19 disclosure to third parties of unique device identifier numbers, personal data, and geolocation 20 information did not constitute an egregious breach of privacy); Folgelstrom v. Lamps Plus, Inc., 21 195 Cal. App. 4th 986, 992 (2011) (“Here, the supposed invasion of privacy essentially consisted 22 of [Defendant] obtaining plaintiff’s address without his knowledge or permission, and using it to 23 mail him coupons and other advertisements. This conduct is not an egregious breach of social 24 norms, but routine commercial behavior.”). 25 i. The Sharing and Use of Mr. Davidson’s Medical Information 26 a. Legally Protected Privacy Interest 27 Plaintiffs’ claim relates directly to what they contend was the improper sharing of Mr. 1 Davidson’s medical information “across UHC platforms” after they appealed UHC’s coverage 2 determination. Opp’n at 11-12. Courts have previously recognized that individuals possess a 3 legally cognizable privacy interest “in precluding the dissemination or misuse of sensitive and 4 confidential information.” Hill, 7 Cal. 4th at 5. Moreover, an individual’s medical information is 5 considered confidential information. See e.g., Heldt v. Guardian Life Ins. Co. of Am., 16-CV-885- 6 BAS-NLS, 2019 WL 651503, at *4 (S.D. Cal. Feb. 15, 2019) (recognizing a legally protected 7 privacy interest in medical information held by an insurer). Because Plaintiffs’ claim deals with 8 the exchange and alleged misuse of confidential information, the Court finds Mr. Davidson holds 9 a legally protected privacy interest in his medical information. 10 The same, however, cannot be said about Mrs. Davidson. Mrs. Davidson does not allege 11 that Defendants improperly shared her own personal medical information. Id. (citing C.D. Supp. 12 Answers at 4.). Instead, Plaintiffs argue that Mrs. Davidson has a legally protected interest in Mr. 13 Davidson’s medical information because Mr. Davidson gave her power of attorney. See Pls.’ 14 Separate Statement of Facts, Dkt. No. 208 at 1. But a power of attorney does not confer standing 15 to assert another party’s constitutional claims. See Johns v. Cty. of San Diego, 114 F.3d 874, 876 16 (9th Cir. 1997); see also Moreno v. Hanford Sentinel, Inc., 172 Cal. App. 4th 1125, 1131 (2009) 17 (holding that plaintiffs did not have standing to bring an invasion of privacy claim for something 18 that happened to their family member). Thus, Mrs. Davidson’s power of attorney does not afford 19 her the right to assert Plaintiffs’ invasion of privacy claim relating to Mr. Davidson’s medical 20 information. 21 b. Reasonable Expectation of Privacy 22 Although Defendants do not dispute that Mr. Davidson possesses a legally protected 23 interest in his medical information, they argue neither he nor Mrs. Davidson had a reasonable 24 expectation of privacy related to the medical information. Whether a plaintiff has a reasonable 25 expectation of privacy in the circumstances is a mixed question of law and fact. Hill, 7 Cal. 4th at 26 40. “A ‘reasonable’ expectation of privacy is an objective entitlement founded on broadly based 27 and widely accepted community norms.” Id. at 37. “Even when a legally cognizable privacy 1 interest is present, other factors may affect a person’s reasonable expectation of privacy. For 2 example, advance notice of an impending action may serve to ‘limit [an] intrusion upon personal 3 dignity and security’ that would otherwise be regarded as serious.” Id. (citing Ingersoll v. Palmer, 4 43 Cal. 3d 1321, 1346 (1987)). “[T]he presence or absence of opportunities to consent voluntarily 5 to activities impacting privacy interests obviously affects the expectations of the participant.” Id. 6 To establish a reasonable expectation of privacy, the plaintiff must have conducted himself 7 or herself in a manner consistent with an actual expectation of privacy. See Heldt, 2019 WL 8 65103, at *4. This means he “must not have manifested by his or her conduct a voluntary consent 9 to the invasive actions of defendant. If voluntary consent is present, a defendant’s conduct will 10 rarely be deemed ‘highly offensive to a reasonable person’ so as to justify tort liability.” Id. 11 (citing Hill, 7 Cal. 4th at 3). 12 Here, Defendants contend Plaintiffs did not conduct themselves in a manner suggesting an 13 actual expectation of privacy and point to Plaintiffs’ own public disclosures about Mr. Davidson’s 14 condition as a reason why. Moreover, Defendants argue Plaintiffs expressly consented to the 15 sharing and use of Mr. Davidson’s medical information amongst Defendants in order to assess 16 their appeals. The Court considers each argument in turn. 17 1. Plaintiffs’ Consent 18 Defendants maintain Plaintiffs “consented to Defendants’ sharing of Mr. Davidson’s 19 medical information for purposes of administering his benefit claims” and as permitted under 20 Plaintiffs’ Plan. Mot. at 15. Defendants add that because no evidence suggests they shared Mr. 21 Davidson’s medical information for any purpose other than for the administration of Plaintiffs’ 22 claims for benefits under the Plan, Plaintiffs cannot show a reasonable expectation of privacy. Id. 23 at 16 (citing Heldt, 2019 WL 651503 at * 4-*6). 24 In Heldt, the court considered a similar case in which the plaintiff initiated a claim for 25 long-term disability benefits and, in doing so, provided confidential medical information to his 26 insurance company Guardian life Insurance Company of America (“Guardian Life”). Heldt, 2019 27 WL 651503 at *1. The plaintiff alleged that Guardian Life invaded his privacy by disclosing PHI 1 to three entities which had been tasked with performing a functional vocational assessment, 2 background check, and surveillance on plaintiff to determine his eligibility for benefits. Id. at *2. 3 Guardian Life in turn argued that the long-term disability policy under which plaintiff sought 4 benefits permitted the release of medical information required to assess the claims for benefits. 5 The court found that the plaintiff had “voluntarily and clearly consented” to Guardian Life 6 releasing his personal information for the purpose of determining his eligibility for benefits by 7 signing authorization forms. Id. at *6. After concluding that the entities did not share the 8 information beyond what was necessary to fulfill that purpose, the court found that the plaintiff 9 could not demonstrate he had a reasonable expectation of privacy. Id. 10 Here, Plaintiffs were forced to participate in their Plan’s appeals process after UHC’s 11 determination that the Plan no longer covered Mr. Davidson’s care at a skilled nursing facility. 12 The Plan’s SPDs set forth an appeals process for denied claims, which authorized certain uses and 13 sharing of identifiable health information. See generally 2015 SPD at 174-176. The appeals 14 process, for example, provided for “review[] by an appropriate individual(s) who did not make the 15 initial benefit determination; and a health care professional with appropriate expertise who was not 16 consulted during the initial benefit determination process.” Id. at 175. In the case of Plaintiffs, 17 Mr. Davidson’s medical information was disclosed to representatives at UHC, HPE, and Optum in 18 order to resolve his claims. See July 2020 C. D. Supp. Answers at 4; J.D. Supp. Answers at 4; 19 Apr. 2020 C.D. Supp. Answers at 9-11. But Plaintiffs contend that during the appeals process, 20 they did not consent to have HPE access their protected medical information, Defendants releasing 21 Mr. Davidson’s medical information and records to Optum, or to information being shared across 22 the platform of UHC departments to Hewlett-Packard, Inc./HPE and their Executive team and 23 Board of Directors. See J.D. Supp. Answers at 10-12. 24 Nevertheless, as participants in HPE’s medical benefits Plan, Plaintiffs were aware that 25 UHC and HPE could share Mr. Davidson’s medical information within and between their 26 organizations, and with Mr. Davidson’s health care providers, for purposes of administering his 27 claims for medical benefits. Notably, HPE’s Privacy Notice, informed them that PHI could be 1 disclosed without the participant’s or beneficiary’s written authorization “to determine eligibility 2 for benefits under the Plan, . . . [or] to determine if the claim for benefits [was] covered under the 3 Plan.” Privacy Notice at HPE’s Notice of Privacy Practices at 5. Additionally, beneficiaries 4 agreed to have HPE and UHC use their PHI to determine the payment of claims. See 2015 SPD at 5 194. By accepting benefits under the Plan, beneficiaries also authorized and directed any person 6 or institution who had provided services to furnish HPE and UHC with all information or copies 7 of records related to the services provided. Id. Finally, the SPDs gave HPE and UHC the right to 8 release any and all records concerning health care services which were necessary to implement 9 and administer the terms of the plan. Id. 10 Under these circumstance, the record suggests that Plaintiffs as participants in the HPE 11 Plan, consented to HPE and UHC sharing information within and amongst their organizations, and 12 with Mr. Davidson’s health care providers, for purposes of administering their claims and appeals. 13 Still, Plaintiffs object to not only the sharing of Mr. Davidson’s information amongst the different 14 entities but also to how the doctors used the information to negatively impact Mr. Davidson. 15 Opp’n at 15-16. The exhibits they cite in support of this argument, however, do not demonstrate 16 that Defendants were using the information to purposefully harm Mr. Davidson. See e.g., Opp’n, 17 Exs. 4-10; Dr. Green Letter at 1-2. Instead, the letters and correspondence provide an explanation 18 of how Defendants used Mr. Davidson’s medical information to determine whether or not he was 19 eligible for certain benefits under the Plan. Thus, Plaintiffs have offered no evidence rebutting 20 Defendants’ argument that they did not share Mr. Davidson’s medical information for any purpose 21 other than for the administration of Plaintiffs’ claims for benefits under the Plan. There is no 22 genuine dispute that, in administering Mr. Davidson’s claim, his information was released and 23 shared amongst Defendants as contemplated in the SPDs and Privacy Notice. Further, no 24 evidence suggests Defendants shared Mr. Davidson’s information beyond what was necessary to 25 determine whether he was eligible for certain benefits under the Plan.5 26

27 5 With regard to any use or sharing of medical information by HPE, Plaintiffs do not offer any actual or admissible evidence to show that HPE’s communications and disclosures by individuals 1 Accordingly, the Court finds that the consent given by Plaintiffs precludes a finding that 2 there was a reasonable expectation of privacy in Mr. Davidson’s medical information. 3 2. Plaintiffs’ Own Disclosures of Mr. Davidson’s Medical Information 4 In order to have maintained a reasonable expectation of privacy, Plaintiffs must have also 5 “conducted [themselves] in a manner consistent with an actual expectation of privacy.” Hill, 7 6 Cal. 4th at 26; see also Ortiz v. Los Angeles Police Relief Ass’n, 98 Cal. App. 4th 1288, 1306 7 (2002) (finding the plaintiff conducted herself consistent with an expectation of privacy when she 8 told only one person about the private fact). As detailed above, Plaintiffs publicly disclosed 9 information concerning Mr. Davidson’s medical condition repeatedly. For example, Plaintiffs and 10 a family member created a publicly accessible blog on which they wrote about Mr. Davidson’s 11 medical condition. See Dkt. No. 203-21 (blog entries mentioning details about Mr. Davidson’s 12 ALS condition). Plaintiffs also voluntarily shared such information with the media knowing there 13 was a possibility that it could be shared with others. See Apr. 2020 C.D. Supp. Answers at 10; see 14 also generally Smith v. Maryland, 442 U.S. 735, 743–44 (1979) (holding that there is no 15 expectation of privacy in the telephone numbers one dials and explaining that “a person has no 16 legitimate expectation of privacy in information he voluntarily turns over to third parties”). 17 Although the Court recognizes Plaintiffs may have felt compelled to disclose this information to 18 the public, the voluntary sharing of Mr. Davidson’s information to several different individuals 19 and platforms demonstrates Plaintiffs did not have a reasonable expectation of privacy in that 20 information. 21 In sum, “[i]f the undisputed material facts show no reasonable expectation of privacy . . . 22 the question of invasion may be adjudicated as a matter of law.” Hill, 7 Cal. 4th at 40 (citations 23 omitted); see also Pioneer Electronics (USA), Inc., 40 Cal. 4th 360. Here, Plaintiffs’ express 24

25 within the company, including Robin Young and Kristin Major, were not done to administer the Plan or contrary to the express terms included in the SPDs and the Privacy Notice. See generally 26 Dep. of Robin Young (“Young Dep.”), Dkt. No. 203-11; Dep. of Kristin Major (“Major Dep.”). Additionally, any request for an additional HIPAA release, like the one Plaintiffs allege was made 27 by Robin Young, would not have affected the consent Plaintiffs had already given as members of the Plan and by engaging in its appeals process. See 2015 SPD at 194. 1 actions demonstrate there is no disputed fact as to whether there was a reasonable expectation of 2 privacy in Mr. Davidson’s medical information. As such, Plaintiffs cannot succeed on their 3 invasion of privacy claim based on Defendants’ sharing and use of Mr. Davidson’s medical 4 information. 5 c. Sufficiently Serious Intrusions 6 Even if Plaintiffs were able to establish that they had a reasonable expectation of privacy, 7 the undisputed facts show that the exchanging and use of Mr. Davidson’s medical information was 8 not sufficiently serious to constitute a violation of his privacy rights. In analyzing a claim of 9 invasion of privacy, the Court must consider the extent and gravity of the disclosure. Hill, 7 Cal. 10 4th at 37. “Actionable invasions of privacy must be sufficiently serious in their nature, scope, and 11 actual or potential impact to constitute an egregious breach of the social norms underlying the 12 privacy right.” Id. 13 Although Defendants exchanged documents and information concerning Mr. Davidson’s 14 medical condition, the record reflects that this information was only shared with the individuals 15 necessary to process Plaintiffs’ appeals and to determine the benefits Mr. Davidson was entitled to 16 under the Plan. “If the undisputed material facts show . . . an insubstantial impact on privacy 17 interests, the question of invasion may be adjudicated as a matter of law.” Hill, 7 Cal. 4th at 40 18 (citations omitted). The Court finds as a matter of law that the disclosure of Mr. Davidson’s 19 medical information was not sufficiently serious to constitute an egregious breach of the social 20 norms. The information shared by Defendants was minimal and resulted following Plaintiffs’ 21 consent. 22 Thus, Plaintiffs cannot establish an invasion of privacy claim based on the exchange and 23 sharing of Mr. Davidson’s medical information between Defendants. 24 ii. Allegations of Hacking and Intrusions 25 Alternatively, Plaintiffs premise their constitutional claim for invasion of privacy on 26 Defendants’ alleged intrusions, or hacking, into their computer devices. The Court finds, 27 however, that Plaintiffs have failed to support any of the required elements for their claim with 1 record evidence suggesting intrusions occurred or that Defendants are responsible for the alleged 2 intrusions. Indeed, Plaintiffs made clear that “they cannot affirmatively state that it was 3 Defendants or their agents who authorized intrusions” into their electronic devices or electronic 4 data nor can they “specifically identify whether named Defendants engaged in surveillance 5 activities.” Apr. 2020 C.D. Supp. Answers at 5-6; J.D. Supp. Answers at 5. Still, Plaintiffs assert 6 Defendants must be responsible for the intrusions because the alleged computer events they 7 experienced coincided with “key decision points in [this] litigation” and with the “court calendar, 8 filing dates, phone calls from Defendants’ attorney, [and] during depositions . . . .” Opp’n at 14; 9 see also J.D. Supp. Answers at 5. But while these facts are concerning, it is pure speculation to 10 infer from them that Defendants are responsible for the alleged intrusions. 11 The Court cannot find a factual dispute on mere speculation. See Loomis v. Cornish, 836 12 F.3d 991, 997 (9th Cir. 2016) (“[m]ere allegation and speculation do not create a factual dispute 13 for purposes of summary judgment.”); Cafasso, U.S. ex. rel. v. Gen. Dynamics C4 Sys., Inc., 637 14 F.3d 1047, 1061 (9th Cir. 2011) (“To survive summary judgment, a plaintiff must set forth non- 15 speculative evidence of specific facts, not sweeping conclusory allegations.”) Further, what 16 evidence there is in the record strongly supports the inference that Defendants played no role in 17 any potential intrusions or hacking of Plaintiffs’ electronic devices. Plaintiffs’ own computer 18 forensic analyst stated there was no evidence any of the Defendants were responsible for the issues 19 reported by Plaintiffs. See Richmond Dep. at 93:14-94:1. Moreover, the analyst offered 20 alternative explanations for the alleged intrusions experienced by Plaintiffs that do not involve 21 Defendants—namely that outdated drivers and/or user error may have contributed to the issues 22 experienced. See id. at 40:7-11, 117:25-118:, 141: 2-19. 23 In the face of this evidence, Plaintiffs’ speculative allegations are insufficient to avoid 24 summary judgment on their constitutional invasion of privacy claim premised on electronic 25 intrusions. 26 B. Invasion of Privacy Under California Common Law 27 i. The Sharing and Use of Mr. Davidson’s Medical Information 1 Plaintiffs’ claim for common law invasion of privacy must meet similarly high standards 2 for the type of invasion that is actionable. Under a claim for common law invasion of privacy 3 based on allegations involving a public disclosure of private facts, Plaintiff must allege: “(1) 4 public disclosure (2) of a private fact (3) which would be offensive and objectionable to the 5 reasonable person and (4) which is not of legitimate public concern.” Shulman v. Grp. W Prods., 6 Inc., 18 Cal. 4th 200, 214 (1998). The absence of any one of these elements is a complete bar to 7 liability. Id. at 214-15. Plaintiffs’ common law invasion of privacy claim is similarly premised on 8 the belief that Defendants’ exchange and use of Mr. Davidson’s medical information and the 9 alleged electronic intrusions interfered with their right to privacy. 10 Here, Plaintiffs’ claim fails because the undisputed record reflects that Defendants did not 11 publicly disclose any information, let alone any private facts, regarding Mr. Davidson’s medical 12 information. Rather, disclosures were limited to individuals within HPE, UHC, Optum, and Mr. 13 Davidson’s treating physicians or their representatives as dictated by the Plan’s SPDs and Privacy 14 Notice. See J.D. Supp. Answers at 2-4. Given their confined nature, the disclosures were not, as a 15 matter of law, a communication serving as a public disclosure. See Benson v. Life Inc. Co. of N. 16 Am., 725 F. App’x 579 (9th Cir. 2018) (affirming dismissal of a claim for public disclosure of 17 private facts because “alleged disclosure was not ‘widely published’ but rather was ‘confined to a 18 few persons or limited circumstances’”) (citation omitted). 19 Furthermore, Plaintiffs cannot show as a matter of law, that Mr. Davidson’s medical 20 information was “private.” “A matter that is already public or that previously became part of the 21 public domain is not private.” Moreno v. Hanford Sentinel, Inc., 172 Cal. App. 4th 1125, 1130 22 (2009) (citing Sipple v. Chron. Publ’g Co., 154 Cal. App. 3d 1040, 1047 (1984)). Plaintiffs do not 23 dispute that they disclosed detailed information about Mr. Davidson’s medical condition and his 24 treatment on a publicly available blog. See Public Blog, Dkt. No. 203-21. They also do not 25 dispute discussing Mr. Davidson’s medical condition with members of the media and public. 26 Under these circumstances, no reasonable person would have had an expectation of privacy 27 regarding the information shared and published by Plaintiffs. 1 ii. Allegations of Hacking and Intrusions 2 The Court also finds that Plaintiffs cannot prove their common law invasion of privacy 3 || claim through allegations of intrusions or hacking. As outlined in the Court’s discussion of 4 || Plaintiffs’ invasion of privacy claim under the California Constitution, there is no record evidence 5 || that Defendants intruded or hacked Plaintiffs’ electronic devises. Plaintiffs’ mere speculation is 6 || not sufficient to show a genuine issue of material fact. Cafasso, U.S. ex rel., 637 F.3d at 1061. 7 Thus, Plaintiffs are unable to defeat summary judgment as they cannot establish an 8 || invasion of privacy claim under California common law. 9 V. CONCLUSION 10 For the foregoing reasons, Defendants’ Motion for Summary Judgment is GRANTED and 11 Plaintiffs’ invasion of privacy claim under both the California Constitution and California 12 || common law is DISMISSED with prejudice. The Clerk of the Court shall close the file and a 13 || judgment in favor of Defendants shall follow. IT IS SO ORDERED. 3 15 Dated: September 16, 2021 16 Z ( ( EDWARD J. DAVILA 17 United States District Judge 18 19 20 21 22 23 24 25 26 27 28 || Case No.: 5:16-cv-01928-EJD ORDER GRANTING DEFENDANTS’ MOTION FOR SUMMARY JUDGMENT