Harris v. Gillette Children's Specialty Healthcare

• Court: District Court, D. Minnesota
• Decided: March 21, 2025
• Docket: 0:24-cv-01687
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA

Kayla Harris and Stephanie Braulick, Case No. 24-cv-1687 (KMM/JFD) individually, and on behalf of those similarly situated,

Plaintiffs, ORDER

v.

Gillette Children’s Specialty Healthcare, a Minnesota nonprofit corporation,

Defendant.

Pending before the Court is Defendant Gillette Children’s Specialty Healthcare’s (“Defendant”) Motion to Dismiss (ECF 20) the Complaint filed by Plaintiffs Kayla Harris and Stephanie Braulick (“Plaintiffs”), individually and on behalf of a putative nationwide class. For the reasons that follow, Defendant’s motion is GRANTED. I. Background This is a case at the intersection of health privacy and the ubiquitous online tracking tools employed by Silicon Valley technology firms for targeted advertising and marketing efforts.1 Defendant in this matter is a Minnesota nonprofit healthcare provider. See ECF 1

1 This Court has recently adjudicated a motion to dismiss in a similar case, involving similar online tracking technology and similar allegations. See Mekhail v. N. Mem'l Health Care, 726 F. Supp. 3d 916 (D. Minn. 2024). Counsel in the two lawsuits are substantially the same. For this reason, this Order provides a less fulsome background discussion of the technology and legal theories at issue than it might otherwise offer. For a more detailed discussion of web tracking software and health privacy, see id. (Sealed Compl.) ¶ 16. The Plaintiffs are the parents of children who are alleged to be patients of Defendant. See, e.g., id. ¶¶ 14-15.

Plaintiffs allege that they use Defendant’s website to help manage their children’s health care. See, e.g., id. ¶¶ 80, 95. Such use includes relatively generic activities, such as searching for doctors and researching medical conditions, as well as more specific activities, like scheduling their children’s appointments and completing health assessments for their children. See id. ¶¶ 2, 5, 60, 80. Plaintiffs allege that Defendant surreptitiously operates tracking software, developed by Meta and Google, on its website. The tracking

software is alleged to record all of Plaintiffs’ activities while using Defendant’s website, and then transmit that information to Meta and Google. See, e.g., id. ¶¶ 2, 4, 58. By tracking the activities that Plaintiffs carry out on Defendant’s website, Plaintiffs maintain that their children’s “highly sensitive” Personal Health Information (“PHI”) and Personally Identifiable Information (“PII”) is disclosed to Meta and Google. Id. ¶ 1. In

essence, Plaintiffs allege that Meta and Google have been provided with information from which they can glean things such as their children’s health conditions, patient status, and appointment records. Id. ¶ 4. Exactly how this occurs is not fully developed in the Complaint. Id. ¶ 81 (explaining that “[t]he full scope of Defendant’s interceptions and disclosures of Plaintiff’s communications to Meta and Google can only be determined

through formal discovery”). But for example, Plaintiffs assert that part of this process involves the synthesizing of routine, if not anonymous, web-tracking data with unique demographic information that Meta and Google possess from their access and/or control over Plaintiffs’ social media profiles. See id. ¶¶ 51, 52. As a result, according to Plaintiffs, their children’s protected health information is unlawfully accessed and monetized by Meta and Google. See, e.g., id. ¶ 61 (alleging that Defendant’s use of the software tracking

software on its website “allows Meta to learn, manipulate, and use for financial gain, the medical and private content Defendant’s Website visitors communicated, viewed, or otherwise interacted with on Defendant’s Website”). The technology companies can then offer Defendant targeted advertising opportunities, based on the unlawfully intercepted health data. Id. ¶ 73. In summary, Defendant, Meta, and Google all are alleged to profit and benefit from the unconsented interception and dissemination of Plaintiffs’ children’s health

information. Id. ¶ 74 (“Gillette, Meta, Google, and other third parties profit off of Plaintiffs’ and Class Members’ Personal Information without their knowledge, consent, or authorization.”). Plaintiffs filed their Complaint on May 9, 2024. ECF 1. They assert six causes of action, both statutory and at common law, brought on behalf of themselves and a putative

nationwide class. First, violations of the Electronic Communications Privacy Act (“ECPA”) codified at 18 U.S.C. § 2511(1) (hereafter, also referred to as the “wiretap claim”); second, invasion of privacy; third, negligence; fourth, breach of implied contract; fifth, unjust enrichment; and sixth, violations of the Minnesota Uniform Deceptive Trade Practices Act (“MUDTPA”), codified at Minn. Stat. § 325D.43-48. Id. ¶¶ 164–237.

Defendant filed the pending motion to dismiss on July 18, 2024. ECF 20. A hearing was held on October 24, 2024, and the matter was taken under advisement. ECF 33. II. Discussion Defendant raises a number of grounds for complete dismissal of this lawsuit. The

first of these relates to whether the Plaintiffs, parents of minor children who are alleged to be patients of Defendant, have standing to pursue their claims. In short, Defendant argues that they do not because “Plaintiffs allege that their children are patients and their information was shared, but the children are not parties to this lawsuit—Plaintiffs filed the Complaint in their names—not their children’s.” ECF 21 (Def.’s Mem. in Supp. of Mot. to Dismiss) at 15. Because the Court agrees that the Plaintiffs lack standing to raise, in their

own names, any of the six pleaded claims premised on harm alleged to have been suffered by their children, Defendant’s motion is granted. The Court declines to reach the remainder of Defendant’s arguments. “[S]tanding is an essential and unchanging part of the case-or-controversy requirement of Article III” of the Constitution. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560

(1992). “The [standing] doctrine limits the category of litigants empowered to maintain a lawsuit in federal court to seek redress for a legal wrong.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). The “irreducible constitutional minimum of standing contains three elements,” the first of which is that “the plaintiff must have suffered an injury in fact—an invasion of a legally protected interest which is (a) concrete and particularized, . . . and (b)

actual or imminent, not conjectural or hypothetical[.]” Lujan, 504 U.S. at 560 (internal citations and quotation marks omitted); see also Raines v. Byrd, 521 U.S. 811, 818–19 (1997) (“[A] plaintiff must allege personal injury fairly traceable to the defendant's allegedly unlawful conduct and likely to be redressed by the requested relief.”) (quoting Allen v. Wright, 468 U.S. 737, 751 (1984)). “The plaintiff, as the party invoking federal jurisdiction, bears the burden of establishing” all elements of Article III standing. Spokeo,

578 U.S. at 338. Here, Defendants raise a “facial” standing challenge, which is directed to the pleadings and essentially applies the Rule 12(b)(6) standard. See Osborn v. United States, 918 F.2d 724, 729 n.6 (8th Cir. 1990). When considering a facial attack on jurisdiction, courts presume the facts alleged in the complaint to be true. Titus v. Sullivan, 4 F.3d 590, 593 (8th Cir. 1993). Here, Plaintiffs fail on the first requirement to establish standing—of pleading a

concrete injury in fact to themselves.2 The parent-Plaintiffs are not alleged to be Defendant’s patients; instead, their children are. And it is the Plaintiffs’ children who are said to have suffered the invasion of a legally protected interest, which comes in the form of the alleged interception of their private health data through the operation of the tracking software on Defendant’s website. The Complaint neither explains nor suggests how the

Plaintiffs themselves have suffered any harm via this activity. This omission puts standing squarely at issue. See Raines, 521 U.S. at 818–19 (emphasizing that the injury alleged must be a “personal injury”); see also Burrow By & Through Burrow v. Postville Cmty. Sch. Dist., 929 F. Supp. 1193, 1208 (N.D. Iowa 1996) (concluding that parent-plaintiffs “lack[ed] standing to bring individual claims under § 1983 based upon a deprivation of

[their child’s] constitutional rights” where the parents “have not asserted that the

2 Because the Court concludes that Plaintiffs fail to establish injury in fact, it does not consider the remaining two elements of standing—traceability and redressability. See Spokeo, 578 U.S. at 338 Defendants deprived them of any of their own constitutional rights”); Ellinghaus v. Educ. Testing Serv., No. 15CV3442SJFAKT, 2016 WL 8711439, at *4 (E.D.N.Y. Sept. 30, 2016)

(“While a parent may sue on behalf of her minor child, she may not assert claims in her individual capacity where her complaint suggests that only her child’s rights were violated.”). Plaintiffs’ response to the pending motion confirms that they do not view the harm as accruing to the parents but rather that the parents should be allowed to sue in place of their children. Specifically, they rely on the regulatory regime undergirding the Health

Insurance Portability and Accountability Act, commonly known as HIPAA. According to this argument, “a parent has standing to assert claims based on [the] unlawful disclosure” of their child’s health data because “[f]ederal law recognizes that when it comes to a child’s personal health information, healthcare providers must treat the child’s parents as if they were the patients themselves.” ECF 29 (Pl.’s Opp. to Mot. to Dismiss) at 14. Plaintiffs point

to language in federal regulations that, for the purposes of disseminating HIPAA-protected information, requires health providers to treat the parents of a patient who is an unemancipated minor as if the parents were, themselves, the patient. See id. (citing 45 C.F.R. § 164.502(g)(3)(i) and 45 C.F.R. § 164.502(g)(1)). This makes sense: it would be the height of absurdity if, for example, a pediatrician refused to give a parent free access

to their toddler’s health records based on the toddler’s HIPAA privacy rights. But in terms of federal standing to pursue the claims raised in the Complaint by the parents instead of their children, Plaintiffs’ arguments and the regulatory authority underpinning them, are unavailing. First, the parent-Plaintiffs in this case are not suing for an “unlawful disclosure” of their child’s health data pursuant to HIPAA. Indeed, HIPAA undisputably does not provide for a private right of action to anyone involved here, parent

or child. See, e.g., Dodd v. Jones, 623 F.3d 563, 569 (8th Cir. 2010) (“HIPAA does not create a private right of action.”). So the use of HIPAA regulations to buttress Article III standing for non-HIPAA claims is shaky to begin with. More specifically, the cited HIPAA regulations do not actually do the work that Plaintiffs say they do. The cited regulations reflect the principle that a minor’s otherwise-private health data should be freely disclosed to the minor’s parent. This exception is necessary because HIPAA essentially sets forth a

rule of exclusion, dictating strict procedures over the handling of personal health information and providing for only enumerated exceptions. See 45 C.F.R. § 164.502(a) (“A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart . . . .”) (emphasis added). The regulation subparts cited by Plaintiffs articulate such an exception, but do not give rise to a right of

legal enforcement by the parent of their child’s health privacy. To be sure, statutory regimes have been found to confer standing upon parents in the manner sought by Plaintiffs. See Winkelman ex rel. Winkelman v. Parma City Sch. Dist., 550 U.S. 516, 523 (2007) (finding that parents have Article III standing to assert their own claims under the Individuals with Disabilities Education Act (“IDEA”) to enforce their

child’s educational rights due to the statute’s numerous “provisions for expansive review and extensive parental involvement”). But such instances are the exception rather than the rule, and they are highly contingent upon clear and unequivocal statutory language. See id. at 526–31 (reasoning that because “the [IDEA] sets forth procedures for resolving disputes in a manner that, in the Act’s express terms, contemplates parents will be the parties bringing the administrative complaints” and “empowers parents to bring [administrative]

challenges based on a broad range of issues,” that “it would be inconsistent with the statutory scheme to bar them from continuing to assert these rights in federal court”); see also Hooker v. Dallas Indep. Sch. Dist., No. 3:09-CV-0676-G-BH, 2010 WL 4025776 (N.D. Tex. Sept. 13, 2010), report and recommendation adopted, No. 3:09-CV-0676-G BH, 2010 WL 4024896 (N.D. Tex. Oct. 13, 2010) (declining to extend Winkelman to a parent’s standing to sit as plaintiff on behalf of their child pursuant to the Americans with

Disabilities Act or the Rehabilitation Act because neither “involve[s] a statutory scheme that contemplates coterminous rights” in the same manner as the IDEA); cf Gonzalez ex rel. Gonzalez v. Reno, 86 F. Supp. 2d 1167, 1180 (S.D. Fla. 2000) (examining a parent’s right to litigate immigration issues in their own name on behalf of a child, and explaining that the “capacity to initiate proceedings before an administrative agency is distinct from

standing and related concepts in the context of a claim brought in federal court”), aff’d sub nom. Gonzalez v. Reno, 212 F.3d 1338 (11th Cir. 2000). Here, Plaintiffs do not adequately explain why the regulatory provisions underlying HIPAA—a statute that does not allow for private enforcement—should inform, let alone take precedence over, the independent standing analysis that this Court must conduct under federal law.

Perhaps anticipating this outcome, Plaintiffs attempt to stave off dismissal on basic fairness grounds, arguing that Defendant’s standing argument will create a catch-22 where the parents lack standing to raise the claims, but the children may be unable to raise one of the claims set forth in the Complaint. Specifically, the Plaintiffs say a cause of action under ECPA may be unavailable because the parents’ communications were allegedly intercepted, not the children’s. See ECF 29 at 15. This may be true, but the Court disagrees

with Plaintiffs’ assertion that this creates an inequitable “heads I win, tails you lose” scenario.3 See id. In all cases, it is the plaintiff who sets the table for litigation by filing a complaint. Here, Plaintiffs are attempting to redress alleged violations of their children’s health privacy via a private right of action located in a completely different federal statute—one governing wiretap surveillance. This creative path to a cause of action involves a degree of complicated pleading. Despite that challenge, other plaintiffs have

found at least initial success at the pleading stage alleging wiretap claims related to tracking software on healthcare websites, including in this Court. See, e.g., Mekhail, 726 F. Supp. 3d 916 (denying dismissal of tracking-related health privacy claims); see also In re Grp. Health Plan Litig., 709 F. Supp. 3d 707 (D. Minn. Dec. 21, 2023) (same). But the fact that certain factual circumstances can allow some plaintiffs to plead a particular claim does not

make it unfair that others cannot. Here, it may simply be true that, due to the unique facts of this case interacting with the novelty of the cause of action asserted, neither parents nor

3 To be sure, the Court’s determination that the parents lack standing affects all of the causes of action asserted by Plaintiffs because each cause of action is downstream of the same injury—a violation of health privacy—that is alleged to have occurred to the children and not the parents. By noting the Plaintiffs’ observations about the workability of making the children the plaintiffs for the purposes of pleading a wiretap claim, the Court offers no opinion whatsoever about such a path forward. Nor should anything about this Order be construed as exploring other ways this litigation might proceed, including whether the children could sustain claims under the causes of action asserted or whether the parents could plead injury to themselves arising from the same set of facts already alleged. The Court’s opinion is limited to the standing issue alone. children may be able to bring wiretap claims. If that is the case, then fairness is not the issue—instead, it merely signals that these Plaintiffs must seek out a different road to relief.

Accordingly, the Court finds that Plaintiffs lack standing, and therefore that the Court lacks subject matter jurisdiction. See Residential Funding Co., LLC v. Acad. Mortg. Corp., 59 F. Supp. 3d 935, 942 (D. Minn. 2014) (“[I]f a plaintiff lacks standing, a court is without subject matter jurisdiction.”) (quoting S.D. Farm Bureau, Inc. v. Hazeltine, 340 F.3d 583, 591 (8th Cir.2003)). Plaintiffs’ complaint is dismissed without prejudice. Within 30 days of the date of this Order, Plaintiffs may file a motion to amend the complaint. If no

such motion is filed within that 30-day deadline, the Court will direct the Clerk of Court to enter judgment consistent with this Order. III. Order Consistent with the foregoing discussion, this action is DISMISSED without prejudice for lack of subject matter jurisdiction.

Date: March 21, 2025 s/ Katherine Menendez Katherine Menendez United States District Judge