Laura Nichols, individually and on behalf of all others similarly situated v. PeaceHealth Networks on Demand LLC, d/b/a Zoomcare

Opinion

UNITED STATES DISTRICT COURT AT SEATTLE LAURA NICHOLS, individually and on CASE NO. 2:25-cv-01831-JHC behalf of all others similarly situated, ORDER Plaintiffs, v. PEACEHEALTH NETWORKS ON DEMAND LLC, d/b/a Zoomcare,

Defendant.

I INTRODUCTION

This matter comes before the Court on Defendant’s Motion to Dismiss. Dkt. # 7. The Court has reviewed the materials filed in support of and in opposition to the motion, the record, and the governing law. Being fully advised, the Court GRANTS the Motion (Dkt. # 7) and DISMISSES Plaintiff’s Complaint (Dkt. # 1) without prejudice. II BACKGROUND

The Court takes as true the facts alleged in Plaintiff’s Complaint. See Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Defendant PeaceHealth Networks on Demand, doing business as “ZoomCare,” operates a national network of primary and urgent care medical facilities. Dkt. # 1 at 1. Defendant also owns and operates https://www.zoomcare.com/, a website that allows users to book medical appointments online (the Website). Id. Plaintiff Laura Nichols is a Washington resident and Gmail account holder who “has

accessed [the Website] to book medical appointments, including as recently as April 2025.” Id. at 2. The Complaint provides no other information about Plaintiff’s interactions with the Website, such as the number of medical appointments scheduled, the dates of use, or the types of conditions for which she sought treatment. See generally id. Instead, acknowledging the absence of such information, the Complaint states “[t]he specific medical appointments scheduled by Plaintiff have been omitted to protect her privacy.” Id. at 2 n.2. Plaintiff alleges that, unbeknownst to her and others, Defendant embedded Google Analytics—a tracking code that “immediately intercepts a user’s interaction with the webpage” and sends certain information to Google—onto the Website for targeted advertising purposes.

Id. at 2–3, 12. She contends that through this code, “Defendant intercepted its patients’ interactions on the Website and disclosed those interactions to Google, including those that contained their [personally identifiable information (PII)] and [personal health information (PHI)]” such as “Custom Events,” URLs that disclosed their scheduled medical appointments, and information related to their medical conditions. Id. at 13, 16. She argues that these disclosures violated her and other users’ reasonable expectations of privacy, as well as Defendant’s legal obligations under the Health Insurance Portability and Accountability Act (HIPAA). Id. at 22. Based on these allegations, Plaintiff brings a putative class action on behalf of herself and others who scheduled medical appointments via the Website during the class period. Id. at 17.

The Complaint asserts a single cause of action—violation of the Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511—and seeks statutory damages, injunctive relief, and reasonable attorney fees and costs. Id. at 19, 23. III DISCUSSION Defendant moves to dismiss Plaintiff’s Complaint under Rule 12(b)(6). Defendant argues that Plaintiff has failed to state a claim under ECPA because she has failed to plead two1 of the five elements of an ECPA claim. Dkt. # 7 at 10. Defendant further contends that dismissal should be with prejudice and without leave to amend, as Plaintiff’s “ECPA claim fails as a matter of law” and “amendment would be futile.” Id. at 6–7, 18. A. Rule 12(b)(6) Federal Rule of Civil Procedure 12(b)(6) governs a motion to dismiss for failure to state a claim. To survive a Rule 12(b)(6) motion, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)); see also Fed. R. Civ. P. 8(a) (a complaint must contain “a short and plain statement of the claim showing that the pleader is entitled to relief”). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 556). “When evaluating a Rule 12(b)(6) motion, the district court must accept all material allegations in the complaint as true, and construe them in the light most favorable to the non-

1 On page 10 of the Motion, Defendant states, “Plaintiff cannot satisfy at least the second, third, or fourth elements [of an ECPA claim.]” Dkt. # 7 at 10. But the body of the Motion advances just three arguments for dismissal, two of which relate to the second element and one of which relates to the third element. See generally id. As Defendant advances no arguments that relate to the fourth element, the Court assumes that this sentence is inaccurate and so limits its discussion to the second and third elements of Plaintiff’s ECPA claim. moving party.” Chubb Custom Ins. Co. v. Space Sys./Loral, Inc., 710 F.3d 946, 956 (9th Cir. 2013). But “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at

555). If a complaint lacks a “cognizable legal theory” or “sufficient facts alleged to support a cognizable legal theory[,]” a court should dismiss the complaint for failure to state a claim. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). ECPA creates a private right of action for “any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of [the Act].” 18 U.S.C. § 2520(a). To state an ECPA claim, a plaintiff must show “that the defendant (1) intentionally (2) intercepted, endeavored to intercept or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication, (5) using a device.” In

re Facebook Internet Tracking Litig., 263 F. Supp. 3d 836, 844 (N.D. Cal. 2017), rev’d in part sub nom. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020) (quoting In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 135 (3d Cir. 2015)). Defendant contends that the Complaint does not state a plausible ECPA claim because: (1) Plaintiff fails to plead an “unlawful interception” (element two of an ECPA claim), as Defendant is a party to the communication and the crime-tort exception does not apply; (2) Plaintiff cannot bring an ECPA claim based on Defendant “procuring” an interception, as there is no civil liability under ECPA for such a theory; and (3) Plaintiff fails to plead “contents” (element three of an ECPA claim), as the Complaint does not allege “facts showing that the ‘contents’ of any communications were disclosed to Google or any other third party.” Dkt. # 7 at

10–18. The Court addresses each argument in turn below. 1. Unlawful Interception Defendant contends that the Court should dismiss the Complaint because Plaintiff fails to plead the second element of an ECPA claim—an unlawful “interception.” See Dkt. # 7 at 10.

ECPA prohibits the “interception” of electronic communications, with “intercept” defined as “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” 18 U.S.C. § 2510(4). But not all acquisitions of information are “interceptions” for ECPA purposes. As ECPA is a one-party consent statute, a party generally cannot “intercept” a communication “where such person is a party to the communication[.]” 18 U.S.C. § 2511(2)(d); see also Nienaber v. Overlake Hosp. Med. Ctr., 733 F. Supp. 3d 1072, 1095 (W.D. Wash. 2024) (collecting cases on one-party consent). ECPA does, however, provide an exception to this general rule—the crime-tort

exception. Under this exception, a party to a communication cannot escape liability if they have acquired the communication “for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” 18 U.S.C. § 2511(2)(d). As clarified by the Ninth Circuit, “the focus is not upon whether the interception itself violated another law; it is upon whether the purpose for the interception—its intended use—was criminal or tortious.” Sussman v. Am. Broad. Companies, Inc., 186 F.3d 1200, 1202 (9th Cir. 1999) (citation omitted). Thus, an “interception” of PHI for the purpose of financial gain is often not enough to trigger the crime-tort exception. See Zarif v. Hwareh.com, Inc., 789 F. Supp. 3d 880, 895 (S.D. Cal. 2025) (collecting cases). Whereas an “interception” of PHI for the purpose of injuring a plaintiff tortiously will trigger the exception, so long as the plaintiff

pleads that the defendant had a criminal or tortious purpose. See id. at 896 (collecting cases). Along with analyzing the defendant’s purpose, district courts are also instructed to consider whether the plaintiff has pleaded “sufficient facts to support an inference that the offender intercepted the communication for [an unlawful] act that is independent of the

intentional act of recording or interception itself.” Nienaber, 733 F. Supp. 3d at 1095 (quoting B.K. v. Eisenhower Med. Ctr. (B.K. I), 721 F. Supp. 3d 1056, 1065 (C.D. Cal. 2024)) (emphasis in original). In other words, a plaintiff must plead an unlawful act that is separate and secondary to the acquisition of the information, such as a tortious or criminal use of the intercepted materials, rather than solely pleading a disclosure. See id. at 1096. Here, Defendant argues that Plaintiff has failed to plead an unlawful interception because Defendant was a party to the communication and the crime-tort exception does not apply. In support of this argument, Defendant relies heavily on two cases—Nienaber and B.K. II—both of which conclude that the plaintiff failed to plead an “interception” based on similar facts as this

case. See Nienaber, 733 F. Supp. 3d at 1094–96; B.K. v. Eisenhower Med. Ctr. (B.K. II), 2024 WL 2037404, at *3–4 (C.D. Cal. Apr. 11, 2024). Plaintiff responds that although Defendant was a party to the communication, the Complaint successfully pleads an “interception” because Defendant intentionally “intercepted and disclosed HIPAA-protected health information to unauthorized third parties, including Google, through its use of Google Analytics,” which constitutes a criminal or tortious act. Dkt. # 12 at 9. In support of this argument, Plaintiff relies on two cases—Castillo and ChoicePoint—both of which conclude that the plaintiff successfully pleaded an “interception” based on similar factual circumstances. See Castillo v. Costco Wholesale Corp., 2024 WL 4785136, at *5–7 (W.D. Wash. Nov. 14, 2024); I.T. v. ChoicePoint LLC, 2025 WL 2495079, at *8 (W.D. Wash. Aug. 29, 2025).

The parties seem to suggest that Castillo and ChoicePoint on the one hand, and Nienaber and B.K. on the other, represent two divergent approaches to applying the crime-tort exception, with the former indicating that the crime-tort exception always applies to website-based disclosures of health-related information and the latter indicating that the crime-tort exception never applies to such disclosures. See Dkt. ## 7 at 11–14; 12 at 9–11; 13 at 3–6. The Court,

however, understands these cases differently, concluding that the cases’ divergent outcomes are based on differences in the parties’ actual pleadings, particularly with respect to whether the complaint pleads a HIPAA violation, not based on the absolute applicability or inapplicability of the crime-tort exception to website-based disclosures of health-related information.2 Thus, the question before the Court is not whether ECPA’s crime-tort exception could ever apply to a

2 See, e.g., B.K. II, 2024 WL 2037404, at *4 (declining to apply the crime tort-exception based on the plaintiff’s “poorly pleaded allegations” but acknowledging that a HIPAA violation could trigger the crime-tort exception if the complaint contained a well-pleaded HIPAA claim); Nienaber, 733 F. Supp. 3d at 1085, 1096 (declining to apply the crime-tort exception after concluding earlier in the opinion that the complaint does not allege that the defendant shared the plaintiff’s protected health information); Castillo, 2024 WL 4785136, at *6–7 (applying the crime-tort exception because the plaintiffs “plausibly allege that [the defendant] intercepted data to violate HIPAA”); ChoicePoint, 2025 WL 2495079, at *8 (applying the crime-tort exception because the plaintiffs “sufficiently allege that [the defendant’s] intent to disclose their information in violation of HIPAA is a separate act from the interception of their data” and that the disclosed information was protected by HIPAA). Defendant’s other cited cases, including those involving acquisitions of non-health related information, also support this principle. See, e.g., Zarif, 789 F. Supp. 3d at 896 (declining to apply the crime-tort exception because the complaint does not address, let alone plead, a tortious or criminal purpose behind the interceptions); Goulart v. Cape Cod Healthcare, Inc., 2025 WL 1745732, at *4 (D. Mass. June 24, 2025) (declining to apply the crime-tort exception “[b]ecause there are no factual allegations in the Complaint from which the court could conclude that [the defendant] installed Meta Pixel and software-tracking technology with the ‘primary motivation’ of knowingly committing a violation of HIPAA or perpetrating a tort”); Doe v. Genesis Health Sys., 2025 WL 1000192, at *9 (C.D. Ill. Mar. 18, 2025) (declining to apply the crime-tort exception because, by the plaintiff’s “own account, the ‘trackers’ were ‘used by the [the defendant] to benefit [the defendant] and its marketing and advertising purposes,’ not for the purpose of knowingly committing a violation of the HIPAA”) (emphasis in original); Pena v. GameStop, Inc., 670 F. Supp. 3d 1112, 1120 (S.D. Cal. 2023) (declining to apply the crime-tort exception because the plaintiff failed to plead that the defendant intercepted the information for the purpose of committing an illegal act); Katz-Lacabe v. Oracle Am., Inc., 668 F. Supp. 3d 928, 945 (N.D. Cal. 2023) (same); McManus v. Tufts Med. Ctr., Inc., 2025 WL 2778025, at *3–4 (D. Mass. Sept. 29, 2025) (same); In re DoubleClick Inc. Priv. Litig., 154 F. Supp. 2d 497, 519 (S.D.N.Y. 2001) (same); In re Google, 806 F.3d at 145 (declining to apply the crime-tort exception because “the plaintiffs plead no tortious or criminal use of the acquired [information,]” and so fails to plead a criminal or tortious purpose) (emphasis in original); Sweat v. Houston Methodist Hosp., 2025 WL 2697111, at *8 (S.D. Tex. Sept. 22, 2025) (granting summary judgment on the inapplicability of the crime-tort exception because the plaintiffs “have not met their burden of showing that [the defendant] had a contemporaneous intent to commit a crime or a tort”). disclosure of PHI from Defendant’s Website to an unauthorized third party, it is whether the Complaint pleads sufficient facts to allow the Court to draw the reasonable inference that Defendant intercepted Plaintiff’s health-related information for the purpose of committing a

criminal or tortious act, where such act is separate from the act of disclosure. The Complaint does not plead such facts. Although Plaintiff states that Defendant “intended to violate” HIPAA and “disclosed HIPAA-protected health information to unauthorized third parties,” see Dkt. # 12 at 9, the Complaint does not plead any facts to support these conclusory statements. See generally Dkt. # 1. For example, the Complaint repeatedly states that the information was intercepted for “targeted advertising purposes” and that the disclosure itself was unlawful, but it never states that Defendant disclosed Plaintiff’s PHI for an unlawful purpose. The Complaint also does not specify what HIPAA-protected information was allegedly disclosed, nor whether such information was criminally and tortiously used, accessed,

or otherwise implicated after the initial disclosure. The Court thus does not find that the Complaint pleads “‘sufficient facts to support an inference that the offender intercepted the communication for the purpose of a tortious or criminal act that is independent of the intentional act of recording or interception itself.’” Nienaber, 733 F. Supp. 3d at 1095 (emphasis added). And so it declines to apply the crime-tort exception. Because the crime-tort exception does not apply, and it is undisputed that Defendant is a party to the communication, the Complaint fails to plead an “interception” under ECPA. See 18 U.S.C. § 2511(2)(d). The Court thus GRANTS Defendant’s request to dismiss Plaintiff ECPA claim under Rule 12(b)(6). 2. Procuring an Interception

Defendant argues that Plaintiff’s ECPA claim must be dismissed because there is no civil liability for “procuring” an interception under ECPA. See Dkt. # 7 at 14. Despite Plaintiff’s Response, see Dkt. # 12 at 12–13, however, the Court does not find that the Complaint advances an ECPA claim based on such a theory. See generally Dkt. # 1. It thus DENIES Defendant’s request to dismiss Plaintiff’s ECPA claim on this basis.

Nevertheless, to the extent that the Complaint does advance a claim of “interception” based on a pure procurement theory of violation, such a claim must be dismissed. Although some courts have endorsed the procurement theory of interception,3 the majority have rejected the notion that a defendant may be held liable for “aiding and abetting” or “procuring” an interception.4 The Ninth Circuit has also explicitly rejected the concept of secondary liability under ECPA.5 Based on this authority, then, Plaintiff cannot sustain an ECPA claim under a procurement theory of interception and so any claim in the Complaint that is rooted in this theory must be dismissed. 3. Contents Defendant contends that the Court should dismiss Plaintiff’s ECPA claim because the Complaint fails to plead the third element of an ECPA claim, i.e., facts showing that Defendant disclosed the “contents” of a communication to a third party. See Dkt. # 7 at 16. Because the Complaint fails to plead an “interception,” see part III.B(1) above, the Court declines to address 3 See, e.g., Lonegan v. Hasty, 436 F. Supp. 2d 419, 428 (E.D.N.Y. 2006) (endorsing the procurement theory of interception); In re Trilegiant Corp., Inc., 11 F. Supp. 3d 132, 148 n.2 (D. Conn. 2014) (rejecting “aiding and abetting” liability but distinguishing “procurers” from “aiders and abettors” under ECPA). 4 See, e.g., Kirch v. Embarq Mgmt. Co., 702 F.3d 1245, 1247 (10th Cir. 2012) (collecting cases and rejecting “aiding and abetting” and “procurement” theories of liability); Peavy v. WFAA-TV, Inc., 221 F.3d 158, 168–69 (5th Cir. 2000) (discussing the amended version of § 2520’s private right of action and rejecting the procurement theory of interception); Herzer v. Redstone, 2018 WL 5094933, at *7 (C.D. Cal. July 10, 2018) (rejecting civil liability for “procurement violations”). 5 See Freeman v. DirecTV, Inc., 457 F.3d 1001, 1006 (9th Cir. 2006) (concluding that there is “no support for the argument that secondary liability should be imposed” under ECPA); see also In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1089–90 (N.D. Cal. 2015) (collecting cases and rejecting secondary liability under ECPA). the parties’ arguments as to “contents.” But the Court encourages Plaintiff, in amending her complaint, to consider Defendant’s arguments regarding “contents.” C. Leave to Amend

Defendant urges the Court to dismiss Plaintiff’s claims with prejudice and without leave to amend, as Plaintiff’s claims “fail as a matter of law” and “amendment would be futile.” See Dkt. ## 7 at 18; 13 at 10. Plaintiff responds that “if [Defendant’s] motion is granted in any respect, Plaintiff should be given leave to amend.” Dkt. # 12 at 16. The Court agrees with Plaintiff. As instructed by Federal Rule of Civil Procedure 15(a), leave to amend should be “freely” given “when justice so requires.” Although “[a] district court does not err in denying leave to amend where the amendment would be futile[,]” Gardner v. Martino, 563 F.3d 981, 990 (9th Cir. 2009), this is not such a case: because Plaintiff’s ECPA claim fails as a matter of alleged facts, Plaintiff should be given an opportunity to cure the

factual deficiencies identified in this Order before her claims are dismissed with prejudice. Such an outcome also tracks the decisions of other courts in similar cases, including those cited favorably in Defendant’s Motion to Dismiss.6 The Court thus DENIES Defendant’s request for dismissal with prejudice and GRANTS Plaintiff leave to amend. 6 See, e.g., B.K. II, 2024 WL 2037404, at *4 (“[T]he Court finds that amendment may not be futile, and affords [the plaintiffs] an opportunity to cure their pleadings as to [their ECPA claims.]”); Zarif, 789 F. Supp. 3d at 896, 902 (dismissing ECPA claim without prejudice and granting the plaintiff leave to amend); Doe, 2025 WL 1000192, at *9, *11(same); Pena, 670 F. Supp. 3d at 1121 (same); Katz- Lacabe, 668 F. Supp. 3d at 945, 950 (same). The Court also notes that Defendant incorrectly (and repeatedly) states that Nienaber dismissed the plaintiff’s ECPA claim with prejudice. See Dkt. ## 7 at 6, 11, 14; 13 at 4. It did not: in Nienaber, the plaintiff’s ECPA claim was dismissed without prejudice and with leave to amend. See Nienaber, 733 F. Supp. 3d at 1096, 1098. IV CONCLUSION For the foregoing reasons, the Court GRANTS Defendant’s Motion to Dismiss (Dkt. # 7), DISMISSES Plaintiff's Complaint (Dkt. # 1) without prejudice, and GRANTS Plaintiff leave to amend. Any amended pleading must be filed on or before March 25, 2026. If Plaintiff has ° privacy concerns, she may seek to file the amended pleading under seal. Dated this 4th day of March, 2026. Sata M. Chun ° John H. Chun United States District Judge 1]