Deborah Caine, individually and on behalf of all others similarly situated v. Sturdy Memorial Hospital, Inc.

• Court: District Court, D. Massachusetts
• Decided: March 10, 2026
• Docket: 1:25-cv-10261
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

* DEBORAH CAINE, individually and on * behalf of all others similarly situated, * * Plaintiff, * * v. * Civil Action No. 25-cv-10261-ADB * STURDY MEMORIAL HOSPITAL, INC., * * Defendant. * * *

MEMORANDUM AND ORDER

BURROUGHS, D.J.

Before the Court are a motion to dismiss by Defendant Sturdy Memorial Hospital, Inc. (“Sturdy Memorial” or “Defendant”), [ECF No. 8], and a motion to amend by Plaintiff Deborah Caine (“Caine” or “Plaintiff”), [ECF No. 14]. For the following reasons, Sturdy Memorial’s motion to dismiss is GRANTED, and Caine’s motion to amend is DENIED as moot in light of this Order. I. BACKGROUND The following relevant facts are taken from Caine’s Amended Class Action Complaint (“Amended Complaint”), [ECF No. 1-14 (“Am. Compl.”)], the factual allegations of which the Court assumes to be true when considering a motion to dismiss. Ruivo v. Wells Fargo Bank, N.A., 766 F.3d 87, 90 (1st Cir. 2014). As it may on a motion to dismiss, the Court has also considered “documents incorporated by reference in [the complaint], matters of public record, and other matters susceptible to judicial notice.” Giragosian v. Ryan, 547 F.3d 59, 65 (1st Cir. 2008) (alteration in original) (quoting In re Colonial Mortg. Bankers Corp., 324 F.3d 12, 20 (1st Cir. 2003)). A. Factual Background

Sturdy Memorial is an integrated health system that offers emergency and urgent care, hospital-based care, and primary and specialty practices across thirty-two facilities in Massachusetts. [Am. Compl. ¶ 13]. On Sturdy Memorial’s website, www.sturdyhealth.org (“the website”), users can research medical conditions, treatment options, and doctors. [Id. ¶¶ 40–43]. Patients can also log in to Sturdy Memorial’s patient portal through the website to book appointments, communicate with providers, access medical records and lab results, and pay bills. [Id. ¶¶ 44, 66]. Caine was a Sturdy Memorial patient from the 1990s through July 2023. [Am. Compl. ¶ 22]. During that time, Caine “used Sturdy’s website frequently” to research medical conditions and book appointments, [id. ¶¶ 22, 24], and “specifically to locate doctors at Sturdy’s North

Attleboro Medical Center facility and [to search] for other information concerning women’s health that was pertinent to her,” including “information on several significant health issues, the specifics of which are highly sensitive,” [id. ¶ 23].1 Caine alleges that patients’ communications with the website, including her own, are “communications between Sturdy and its patients,” and that Sturdy Memorial “allows Google to intercept those communications by embedding Google Analytics,” a user-tracking technology,

1 Caine’s motion to amend, [ECF No. 14]; see also [ECF No. 15 (supporting memorandum)], seeks to add these specifics under seal. [ECF No. 15 at 5].

2 on its website. [Am. Compl. ¶¶ 71, 100–01]. In particular, Caine alleges that Sturdy Memorial intercepted patients’ protected health information (“PHI”) and individually identifiable health information (“IIHI”), and disclosed that PHI/IIHI to Google through at least July 2024. [Id. ¶¶ 2, 46]. Because the embedded Google Analytics source code is “invisible” to users, these

disclosures occurred without Caine’s or other patients’ consent or knowledge. [Id. ¶¶ 46–48]; see also [id. ¶¶ 71–72, 80–92 (explaining how the technology transmits information between website users, website servers, and third parties like Google)]. Using Google Analytics, Sturdy Memorial tracked and disclosed health information including: specific types of medical treatments sought out by its patients; the name, gender, specialty, and address of providers from whom patients sought treatment; events and locations of clinics sought out by patients; dates and times patients logged in to the patient portal or clicked a number to call a doctor’s office; and the precise text of patients’ search queries about specific treatments, conditions, and providers. [Id. ¶¶ 46, 55–69, 76, 140]. Further, in addition to health information, Sturdy Memorial disclosed patients’ personally identifiable data including their Internet Protocol (“IP”) addresses, which are

unique, numerical device identifiers that “enable[d] Google to identify the person whose sensitive health data and information Sturdy [was] transmitting to Google via Google Analytics.” [Id. ¶¶ 47–49, 64, 70, 140]. Despite its availability, Sturdy Memorial “affirmatively ch[ose]” not to opt in to a Google Analytics feature designed to anonymize IP address data in order to support web developers’ compliance with various privacy policies. [Id. ¶¶ 50–53, 75]; see also [id. ¶¶ 73–75, 92 (describing Google’s policy prohibiting the use of health information for advertising purposes)]. “[A]dvertising companies like Google use such private information to determine that specific patients were seeking specific types of . . . medical treatment . . . such as [for] cancer or

3 pregnancy, and allows Google to target advertisements accordingly.” [Am. Compl. ¶ 79]. In return for providing Google with information that advances its advertising business, Sturdy Memorial, like other Google Analytics users, received “marketing and analytics benefits from Google.” [Id. ¶ 54]; see also [id. ¶¶ 102–04 (elaborating on Google’s advertising services)]; [id.

¶ 106 (“The monetization of the data being disclosed by Sturdy, both by it and Google, demonstrates the inherent value of the information being collected.”)]. Caine now alleges that Sturdy Memorial violated the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. §§ 2510–2522; violated Massachusetts privacy statutes, Mass. Gen. Laws ch. 214, § 1B and ch. 111, § 70E; breached its fiduciary duty; breached implied contracts; and acted with negligence. [Id. ¶¶ 138–94]. B. Procedural History Caine initially filed a complaint in Suffolk Superior Court on July 24, 2024. [ECF No. 1- 2]. On January 24, 2025, Caine filed the operative Amended Complaint on behalf of a putative class, [ECF No. 1-14], in which, as relevant here, she alleged that she used Sturdy Memorial’s

website to search for “information on several significant health issues, the specifics of which are highly sensitive but which [she] would disclose under a confidentiality agreement,” [id. ¶ 23]. Additionally, the Amended Complaint included a new ECPA claim against Sturdy Memorial, [id. ¶¶ 138–55], that allowed Sturdy Memorial to remove the case to this Court based on federal jurisdiction under 28 U.S.C. § 1441(c) and 28 U.S.C. § 1331. [ECF No. 1]. On March 14, 2025, Sturdy Memorial filed the instant motion to dismiss the Amended Complaint for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6), [ECF No. 8]; see also [ECF No. 9 (“Def.’s Mem.”)], which Caine opposed on April 25, 2025, [ECF No. 18 (“Pl.’s Opp’n”)]. Sturdy Memorial replied on May 16, 2025, [ECF No. 20 (“Def.’s

4 Reply”)], and then filed a notice of supplemental authority in support of its motion to dismiss on June 26, 2025, [ECF No. 21], to which Caine responded on June 27, 2025, [ECF No. 22]. Caine filed another notice of supplemental authority on August 11, 2025, [ECF No. 23], and Sturdy Memorial responded on August 19, 2025, [ECF No. 24].

On April 22, 2025, while the parties’ motion-to-dismiss briefing was in progress, Caine filed the instant motion to amend. [ECF No. 14]; see also [ECF No. 15 (supporting memorandum)]. Caine requests leave to add “the private health information Sturdy shared with Google,” which Caine had previously offered to disclose in a confidentiality agreement, and to “redact[] that information so only Sturdy and the Court may view it.” [ECF No. 15 at 5]. Caine makes her request on the basis that “[t]he crux of Sturdy’s motion is that [her] failure to specify exactly what aspects of her private health information [she] shared with Google renders her claims invalid.” [Id.]. Sturdy Memorial opposed the motion to amend on May 5, 2025. [ECF No. 19]. II. LEGAL STANDARD

On a motion to dismiss pursuant to Rule 12(b)(6), the Court must accept as true all well- pleaded facts, analyze them in the light most favorable to the plaintiff, and draw all reasonable inferences from those facts in favor of the plaintiff. United States ex rel. Hutcheson v. Blackstone Med., Inc., 647 F.3d 377, 383 (1st Cir. 2011). In addition to “the facts alleged in the complaint,” the Court may also consider “documents incorporated by reference therein and facts susceptible to judicial notice.” MIT Fed. Credit Union v. Cordisco, 470 F. Supp. 3d 81, 84 (D. Mass. 2020) (citing Haley v. City of Bos., 657 F.3d 39, 46 (1st Cir. 2011)). “[A] complaint must provide ‘a short and plain statement of the claim showing that the pleader is entitled to relief,’” Cardigan Mountain Sch. v. N.H. Ins. Co., 787 F.3d 82, 84 (1st Cir. 2015) (quoting Fed. R. Civ.

5 P. 8(a)(2)), and set forth “factual allegations, either direct or inferential, respecting each material element necessary to sustain recovery under some actionable legal theory,” Pitta v. Medeiros, 90 F.4th 11, 17 (1st Cir. 2024) (quoting Gagliardi v. Sullivan, 513 F.3d 301, 305 (1st Cir. 2008)). Although detailed factual allegations are not required, a complaint must set forth “more than

labels and conclusions,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007), and “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice,” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Rather, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Id. (quoting Twombly, 550 U.S. at 570). “[A]ssessing plausibility is ‘a context- specific task that requires the reviewing court to draw on its judicial experience and common sense.’” Frith v. Whole Foods Mkt., Inc., 38 F.4th 263, 270 (1st Cir. 2022) (quoting Rodríguez- Reyes v. Molina-Rodríguez, 711 F.3d 49, 53 (1st Cir. 2013)). III. DISCUSSION Count I of Caine’s Amended Complaint, which asserts a violation of the ECPA, provides

the sole basis for federal jurisdiction. [Am. Compl. ¶¶ 138–55]. The ECPA prohibits any person from intentionally intercepting, endeavoring to intercept, or procuring any other person to intercept or endeavor to intercept any wire, oral, or electronic communication; intentionally disclosing or endeavoring to disclose to any other person the contents of any electronic communication, knowing or having reason to know that the information was obtained through the interception of an electronic communication in violation of 18 U.S.C. § 2511(1); or intentionally using or endeavoring to use the contents of any electronic communication, knowing or having reason to know that the information was obtained through the interception of an electronic communication in violation of 18 U.S.C. § 2511(1). 18 U.S.C. § 2511(1)(a), (c)–(d).

6 Under § 2511(2)(d), a party can generally avoid liability if they are “a party to the communication” that they intercept or if “one of the parties to the communication has given prior consent to such interception,” unless they trigger the crime-tort exception. Id. § 2511(2)(d). Under the crime-tort exception, as relevant here, a party can be liable under the ECPA only if

they “intercepted [the communication] for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” Id. Here, the parties’ dispute turns on the applicability of the crime-tort exception. Caine, leaning on cases in which courts have interpreted the exception broadly, argues that it applies because Sturdy Memorial “captured and redirected Plaintiff’s information to third parties without consent,” thus violating the Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 1320d-6, and intruding upon Caine’s seclusion. See [Pl.’s Opp’n at 13–16 (enumerating cases interpreting § 2511(2)(d))]; see, e.g., In re Grp. Health Plan Litig., 709 F. Supp. 3d 707, 719 (D. Minn. 2023) (“The existence of a lawful purpose does not sanitize an interception that was also made for an illegitimate purpose.” (quoting In re Meta Pixel

Healthcare Litig., 647 F. Supp. 3d 778, 797 (N.D. Cal. 2022))); [Am. Compl. ¶¶ 150–53 (premising the § 2511(2)(d) allegations on a violation of HIPAA and “[a] knowing intrusion upon Plaintiff’s and Class members’ seclusion”)]. Sturdy Memorial, in contrast, emphasizes cases that construe the exception narrowly. See [Def.’s Mem. at 13–16]; [Def.’s Reply at 8–16]. In particular, Sturdy Memorial urges an interpretation that requires a specific intent to commit a crime or tort, as well as intent to harm, for the exception to apply. See, e.g., [Def.’s Reply at 9– 10 (citing Thomas v. Pearl, 998 F.2d 447, 451 (7th Cir. 1993) (holding that the crime-tort exception required plaintiff to “show that [defendant] either intended to break the law or commit a tort against him in order to prove a violation of” the statute))]; [id. at 10 (“[I]t seems apparent

7 from the context in which the statute was enacted that the sort of conduct contemplated was an interception by a party to a conversation with an intent to use that interception against the non- consenting party in some harmful way and in a manner in which the offending party had no right to proceed.” (quoting Meredith v. Gavin, 446 F.2d 794, 799 (8th Cir. 1971)))]; [id. at 13 (“For

the crime-tort exception to apply, Plaintiff must—but does not—plausibly allege that Sturdy Memorial . . . installed Google technologies on its public website for the distinct purpose of violating HIPAA or perpetrating a tort, like invasion of privacy or breach of confidentiality—i.e., that Sturdy Memorial deployed these technologies because it ‘intended to harm’ its patients and other visitors to its website.” (quoting United States v. McHugh, 57 F. Supp. 3d 95, 100 (D. Mass. 2014)))]. This Court does not read “for the purpose of committing any criminal or tortious act,” 18 U.S.C. § 2511(2)(d), to require the specific intent to commit a crime or tort, nor the intent to harm. Stein v. Edward-Elmhurst Health, No. 23-cv-14515, 2025 WL 580556, at *6 (N.D. Ill. Feb. 21, 2025) (“A desire to commit a crime qua crime, or a tort qua tort, isn’t necessary.”), cert.

granted, No. 23-cv-14515, 2026 WL 594752 (N.D. Ill. Mar. 3, 2026); Doe v. Lawrence Gen. Hosp., No. 25-cv-10081, 2025 WL 2808055, at *20 (D. Mass. Aug. 29, 2025) (“ECPA . . . says nothing about harm or injury. . . . Given that the word ‘injurious’ did not make it into the final version as enacted, it seems anomalous to read the statute as if it had.”), report and recommendation accepted in relevant part, No. 25-cv-10081, 2025 WL 2807673 (D. Mass. Sept. 30, 2025). Further, the Court agrees with Caine that Sturdy Memorial’s lawful purposes—like marketing—do not preclude the possibility that its conduct might trigger § 2511(2)(d). The statutory language is not so narrow. At the same time, “‘purpose’ is an essential element of ECPA.” Doe, 2025 WL 2808055, at *12. Accordingly, to state a claim under the ECPA’s

8 crime-tort exception, Caine must plead facts showing that Sturdy Memorial purposefully—not merely knowingly or negligently—committed criminal or tortious acts. Stein, 2025 WL 580556, at *6 (“The purpose must be to commit an act, and that act must be criminal or tortious. If the purpose is to do X, and if X is a crime or a tort, then the crime-tort exception . . . applies.”).

The Amended Complaint falls short of that standard. Caine essentially proposes two acts to which she argues the crime-tort exception applies: Sturdy Memorial’s (1) acquisition of IIHI without authorization;2 and (2) knowing intrusion upon seclusion. See [Am. Compl. ¶¶ 150–53]. To rely on § 2511(2)(d), then, Caine must—but fails to—plausibly allege that Sturdy Memorial purposefully acquired IIHI without authorization or purposefully intruded upon her seclusion. With respect to IIHI, although Caine emphasizes that Sturdy Memorial chose not to opt in to Google Analytics’ IP anonymization feature, [id. ¶¶ 50–53], the facts are too thin to support the inference that Sturdy Memorial installed the tracking tools for the purpose of acquiring IIHI without authorization. Likewise, even though Caine suggests that Sturdy Memorial may have been on notice regarding privacy risks surrounding the collection of health data, [id. ¶¶ 73–75,

92], the Court cannot, based on the Amended Complaint, draw the inference that the health care system purposefully intruded on its patients’ seclusion or privacy.

2 Caine alleges that Sturdy Memorial violated HIPAA because “[a]n individual or corporation violates [HIPAA] if it knowingly: ‘(1) uses or causes to be used a unique health identifier; [or] (2) obtains individually identifiable health information relating to an individual,’” and also alleges that Sturdy Memorial is subject to criminal penalties under HIPAA because it acquired IIHI “‘with intent to sell, transfer, or use’ [the IIHI] ‘for commercial advantage [or] personal gain.’” [Am. Compl. ¶¶ 118–120, 150 (quoting 42 U.S.C. § 1320d-6)]. Further, Caine contends that Sturdy Memorial’s unauthorized acquisition of IIHI is “tortious in and of itself.” [Id. ¶ 150]. For the purposes of this Order, which deals with the limited question of whether Sturdy Memorial’s acts satisfy the ECPA’s crime-tort exception, the Court treats these allegations as boiling down to one act: the acquisition of IIHI without authorization.

9 Because the Amended Complaint does not plausibly allege that Sturdy Memorial intercepted communications “for the purpose of committing [a] criminal or tortious act,” 18 U.S.C. § 2511(2)(d), the ECPA claim fails, and Count I is DISMISSED. The Court declines to exercise supplemental jurisdiction over the remaining claims, all of

which arise under state law. See 28 U.S.C. § 1367(c) (stating that “district courts may decline to exercise supplemental jurisdiction” when “the district court has dismissed all claims over which it has original jurisdiction”); United Mine Workers of Am. v. Gibbs, 383 U.S. 715, 726 (1966) (“It has consistently been recognized that pendent jurisdiction is a doctrine of discretion, not of plaintiff’s right. . . . Needless decisions of state law should be avoided both as a matter of comity and to promote justice between the parties, by procuring for them a surer-footed reading of applicable law. Certainly, if the federal claims are dismissed before trial . . . the state claims should be dismissed as well.”). IV. CONCLUSION For the reasons stated above, Sturdy Memorial’s motion to dismiss the Amended

Complaint is GRANTED without prejudice and with leave to amend within 21 days. Further, because this Order grants leave to amend, Caine’s motion to amend is DENIED as moot.3 SO ORDERED.

March 10, 2026 /s/ Allison D. Burroughs ALLISON D. BURROUGHS U.S. DISTRICT JUDGE

3 The Court notes that the specifics Caine sought to add in her motion to amend would not have cured the deficiencies discussed in this Order. That is not to say, however, that those specifics may not be included in any future amendment.