Laura Nichols, individually and on behalf of all others similarly situated v. PeaceHealth Networks on Demand LLC, d/b/a Zoomcare

Opinion

1 2 3

4 5 UNITED STATES DISTRICT COURT 6 WESTERN DISTRICT OF WASHINGTON AT SEATTLE 7 LAURA NICHOLS, individually and on CASE NO. 2:25-cv-01831-JHC 8 behalf of all others similarly situated, ORDER 9 Plaintiffs, 10 v. 11 PEACEHEALTH NETWORKS ON DEMAND LLC, d/b/a Zoomcare, 12

Defendant. 13

14 I 15 INTRODUCTION

16 This matter comes before the Court on Defendant’s Motion to Dismiss. Dkt. # 7. The 17 Court has reviewed the materials filed in support of and in opposition to the motion, the record, 18 and the governing law. Being fully advised, the Court GRANTS the Motion (Dkt. # 7) and 19 DISMISSES Plaintiff’s Complaint (Dkt. # 1) without prejudice. 20 II BACKGROUND 21

The Court takes as true the facts alleged in Plaintiff’s Complaint. See Ashcroft v. Iqbal, 22 556 U.S. 662, 678 (2009). Defendant PeaceHealth Networks on Demand, doing business as 23 “ZoomCare,” operates a national network of primary and urgent care medical facilities. Dkt. # 1 24 1 at 1. Defendant also owns and operates https://www.zoomcare.com/, a website that allows users 2 to book medical appointments online (the Website). Id. 3 Plaintiff Laura Nichols is a Washington resident and Gmail account holder who “has

4 accessed [the Website] to book medical appointments, including as recently as April 2025.” Id. 5 at 2. The Complaint provides no other information about Plaintiff’s interactions with the 6 Website, such as the number of medical appointments scheduled, the dates of use, or the types of 7 conditions for which she sought treatment. See generally id. Instead, acknowledging the 8 absence of such information, the Complaint states “[t]he specific medical appointments 9 scheduled by Plaintiff have been omitted to protect her privacy.” Id. at 2 n.2. 10 Plaintiff alleges that, unbeknownst to her and others, Defendant embedded Google 11 Analytics—a tracking code that “immediately intercepts a user’s interaction with the webpage” 12 and sends certain information to Google—onto the Website for targeted advertising purposes.

13 Id. at 2–3, 12. She contends that through this code, “Defendant intercepted its patients’ 14 interactions on the Website and disclosed those interactions to Google, including those that 15 contained their [personally identifiable information (PII)] and [personal health information 16 (PHI)]” such as “Custom Events,” URLs that disclosed their scheduled medical appointments, 17 and information related to their medical conditions. Id. at 13, 16. She argues that these 18 disclosures violated her and other users’ reasonable expectations of privacy, as well as 19 Defendant’s legal obligations under the Health Insurance Portability and Accountability Act 20 (HIPAA). Id. at 22. 21 Based on these allegations, Plaintiff brings a putative class action on behalf of herself and 22 others who scheduled medical appointments via the Website during the class period. Id. at 17.

23 The Complaint asserts a single cause of action—violation of the Electronic Communications 24 1 Privacy Act (ECPA), 18 U.S.C. § 2511—and seeks statutory damages, injunctive relief, and 2 reasonable attorney fees and costs. Id. at 19, 23. 3 III DISCUSSION 4 Defendant moves to dismiss Plaintiff’s Complaint under Rule 12(b)(6). Defendant 5 argues that Plaintiff has failed to state a claim under ECPA because she has failed to plead two1 6 of the five elements of an ECPA claim. Dkt. # 7 at 10. Defendant further contends that 7 dismissal should be with prejudice and without leave to amend, as Plaintiff’s “ECPA claim fails 8 as a matter of law” and “amendment would be futile.” Id. at 6–7, 18. 9 A. Rule 12(b)(6) 10 Federal Rule of Civil Procedure 12(b)(6) governs a motion to dismiss for failure to state a 11 claim. To survive a Rule 12(b)(6) motion, “a complaint must contain sufficient factual matter, 12 accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 556 U.S. at 678 13 (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)); see also Fed. R. Civ. P. 8(a) (a 14 complaint must contain “a short and plain statement of the claim showing that the pleader is 15 entitled to relief”). “A claim has facial plausibility when the plaintiff pleads factual content that 16 allows the court to draw the reasonable inference that the defendant is liable for the misconduct 17 alleged.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 556). 18 “When evaluating a Rule 12(b)(6) motion, the district court must accept all material 19 allegations in the complaint as true, and construe them in the light most favorable to the non- 20 21

22 1 On page 10 of the Motion, Defendant states, “Plaintiff cannot satisfy at least the second, third, or fourth elements [of an ECPA claim.]” Dkt. # 7 at 10. But the body of the Motion advances just three arguments for dismissal, two of which relate to the second element and one of which relates to the third 23 element. See generally id. As Defendant advances no arguments that relate to the fourth element, the Court assumes that this sentence is inaccurate and so limits its discussion to the second and third elements 24 of Plaintiff’s ECPA claim. 1 moving party.” Chubb Custom Ins. Co. v. Space Sys./Loral, Inc., 710 F.3d 946, 956 (9th Cir. 2 2013). But “[t]hreadbare recitals of the elements of a cause of action, supported by mere 3 conclusory statements, do not suffice.” Iqbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at

4 555). If a complaint lacks a “cognizable legal theory” or “sufficient facts alleged to support a 5 cognizable legal theory[,]” a court should dismiss the complaint for failure to state a claim. 6 Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). 7 B. ECPA 8 ECPA creates a private right of action for “any person whose wire, oral, or electronic 9 communication is intercepted, disclosed, or intentionally used in violation of [the Act].” 18 10 U.S.C. § 2520(a). To state an ECPA claim, a plaintiff must show “that the defendant (1) 11 intentionally (2) intercepted, endeavored to intercept or procured another person to intercept or 12 endeavor to intercept (3) the contents of (4) an electronic communication, (5) using a device.” In

13 re Facebook Internet Tracking Litig., 263 F. Supp. 3d 836, 844 (N.D. Cal. 2017), rev’d in part 14 sub nom. In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020) (quoting In 15 re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 135 (3d Cir. 2015)). 16 Defendant contends that the Complaint does not state a plausible ECPA claim because: 17 (1) Plaintiff fails to plead an “unlawful interception” (element two of an ECPA claim), as 18 Defendant is a party to the communication and the crime-tort exception does not apply; (2) 19 Plaintiff cannot bring an ECPA claim based on Defendant “procuring” an interception, as there is 20 no civil liability under ECPA for such a theory; and (3) Plaintiff fails to plead “contents” 21 (element three of an ECPA claim), as the Complaint does not allege “facts showing that the 22 ‘contents’ of any communications were disclosed to Google or any other third party.” Dkt. # 7 at

23 10–18. The Court addresses each argument in turn below. 24 1 1. Unlawful Interception 2 Defendant contends that the Court should dismiss the Complaint because Plaintiff fails to 3 plead the second element of an ECPA claim—an unlawful “interception.” See Dkt. # 7 at 10.

4 ECPA prohibits the “interception” of electronic communications, with “intercept” 5 defined as “the aural or other acquisition of the contents of any wire, electronic, or oral 6 communication through the use of any electronic, mechanical, or other device.” 18 U.S.C. § 7 2510(4). But not all acquisitions of information are “interceptions” for ECPA purposes. As 8 ECPA is a one-party consent statute, a party generally cannot “intercept” a communication 9 “where such person is a party to the communication[.]” 18 U.S.C. § 2511(2)(d); see also 10 Nienaber v. Overlake Hosp. Med. Ctr., 733 F. Supp. 3d 1072, 1095 (W.D. Wash. 2024) 11 (collecting cases on one-party consent). 12 ECPA does, however, provide an exception to this general rule—the crime-tort

13 exception. Under this exception, a party to a communication cannot escape liability if they have 14 acquired the communication “for the purpose of committing any criminal or tortious act in 15 violation of the Constitution or laws of the United States or of any State.” 18 U.S.C. § 16 2511(2)(d). As clarified by the Ninth Circuit, “the focus is not upon whether the interception 17 itself violated another law; it is upon whether the purpose for the interception—its intended 18 use—was criminal or tortious.” Sussman v. Am. Broad. Companies, Inc., 186 F.3d 1200, 1202 19 (9th Cir. 1999) (citation omitted). Thus, an “interception” of PHI for the purpose of financial 20 gain is often not enough to trigger the crime-tort exception. See Zarif v. Hwareh.com, Inc., 789 21 F. Supp. 3d 880, 895 (S.D. Cal. 2025) (collecting cases). Whereas an “interception” of PHI for 22 the purpose of injuring a plaintiff tortiously will trigger the exception, so long as the plaintiff

23 pleads that the defendant had a criminal or tortious purpose. See id. at 896 (collecting cases). 24 1 Along with analyzing the defendant’s purpose, district courts are also instructed to 2 consider whether the plaintiff has pleaded “sufficient facts to support an inference that the 3 offender intercepted the communication for [an unlawful] act that is independent of the

4 intentional act of recording or interception itself.” Nienaber, 733 F. Supp. 3d at 1095 (quoting 5 B.K. v. Eisenhower Med. Ctr. (B.K. I), 721 F. Supp. 3d 1056, 1065 (C.D. Cal. 2024)) (emphasis 6 in original). In other words, a plaintiff must plead an unlawful act that is separate and secondary 7 to the acquisition of the information, such as a tortious or criminal use of the intercepted 8 materials, rather than solely pleading a disclosure. See id. at 1096. 9 Here, Defendant argues that Plaintiff has failed to plead an unlawful interception because 10 Defendant was a party to the communication and the crime-tort exception does not apply. In 11 support of this argument, Defendant relies heavily on two cases—Nienaber and B.K. II—both of 12 which conclude that the plaintiff failed to plead an “interception” based on similar facts as this

13 case. See Nienaber, 733 F. Supp. 3d at 1094–96; B.K. v. Eisenhower Med. Ctr. (B.K. II), 2024 14 WL 2037404, at *3–4 (C.D. Cal. Apr. 11, 2024). Plaintiff responds that although Defendant was 15 a party to the communication, the Complaint successfully pleads an “interception” because 16 Defendant intentionally “intercepted and disclosed HIPAA-protected health information to 17 unauthorized third parties, including Google, through its use of Google Analytics,” which 18 constitutes a criminal or tortious act. Dkt. # 12 at 9. In support of this argument, Plaintiff relies 19 on two cases—Castillo and ChoicePoint—both of which conclude that the plaintiff successfully 20 pleaded an “interception” based on similar factual circumstances. See Castillo v. Costco 21 Wholesale Corp., 2024 WL 4785136, at *5–7 (W.D. Wash. Nov. 14, 2024); I.T. v. ChoicePoint 22 LLC, 2025 WL 2495079, at *8 (W.D. Wash. Aug. 29, 2025).

23 The parties seem to suggest that Castillo and ChoicePoint on the one hand, and Nienaber 24 and B.K. on the other, represent two divergent approaches to applying the crime-tort exception, 1 with the former indicating that the crime-tort exception always applies to website-based 2 disclosures of health-related information and the latter indicating that the crime-tort exception 3 never applies to such disclosures. See Dkt. ## 7 at 11–14; 12 at 9–11; 13 at 3–6. The Court,

4 however, understands these cases differently, concluding that the cases’ divergent outcomes are 5 based on differences in the parties’ actual pleadings, particularly with respect to whether the 6 complaint pleads a HIPAA violation, not based on the absolute applicability or inapplicability of 7 the crime-tort exception to website-based disclosures of health-related information.2 Thus, the 8 question before the Court is not whether ECPA’s crime-tort exception could ever apply to a 9

10 2 See, e.g., B.K. II, 2024 WL 2037404, at *4 (declining to apply the crime tort-exception based on the plaintiff’s “poorly pleaded allegations” but acknowledging that a HIPAA violation could trigger the 11 crime-tort exception if the complaint contained a well-pleaded HIPAA claim); Nienaber, 733 F. Supp. 3d at 1085, 1096 (declining to apply the crime-tort exception after concluding earlier in the opinion that the complaint does not allege that the defendant shared the plaintiff’s protected health information); Castillo, 12 2024 WL 4785136, at *6–7 (applying the crime-tort exception because the plaintiffs “plausibly allege that [the defendant] intercepted data to violate HIPAA”); ChoicePoint, 2025 WL 2495079, at *8 (applying the 13 crime-tort exception because the plaintiffs “sufficiently allege that [the defendant’s] intent to disclose their information in violation of HIPAA is a separate act from the interception of their data” and that the 14 disclosed information was protected by HIPAA). Defendant’s other cited cases, including those involving acquisitions of non-health related 15 information, also support this principle. See, e.g., Zarif, 789 F. Supp. 3d at 896 (declining to apply the crime-tort exception because the complaint does not address, let alone plead, a tortious or criminal 16 purpose behind the interceptions); Goulart v. Cape Cod Healthcare, Inc., 2025 WL 1745732, at *4 (D. Mass. June 24, 2025) (declining to apply the crime-tort exception “[b]ecause there are no factual allegations in the Complaint from which the court could conclude that [the defendant] installed Meta 17 Pixel and software-tracking technology with the ‘primary motivation’ of knowingly committing a violation of HIPAA or perpetrating a tort”); Doe v. Genesis Health Sys., 2025 WL 1000192, at *9 (C.D. 18 Ill. Mar. 18, 2025) (declining to apply the crime-tort exception because, by the plaintiff’s “own account, the ‘trackers’ were ‘used by the [the defendant] to benefit [the defendant] and its marketing and 19 advertising purposes,’ not for the purpose of knowingly committing a violation of the HIPAA”) (emphasis in original); Pena v. GameStop, Inc., 670 F. Supp. 3d 1112, 1120 (S.D. Cal. 2023) (declining to 20 apply the crime-tort exception because the plaintiff failed to plead that the defendant intercepted the information for the purpose of committing an illegal act); Katz-Lacabe v. Oracle Am., Inc., 668 F. Supp. 21 3d 928, 945 (N.D. Cal. 2023) (same); McManus v. Tufts Med. Ctr., Inc., 2025 WL 2778025, at *3–4 (D. Mass. Sept. 29, 2025) (same); In re DoubleClick Inc. Priv. Litig., 154 F. Supp. 2d 497, 519 (S.D.N.Y. 22 2001) (same); In re Google, 806 F.3d at 145 (declining to apply the crime-tort exception because “the plaintiffs plead no tortious or criminal use of the acquired [information,]” and so fails to plead a criminal or tortious purpose) (emphasis in original); Sweat v. Houston Methodist Hosp., 2025 WL 2697111, at *8 23 (S.D. Tex. Sept. 22, 2025) (granting summary judgment on the inapplicability of the crime-tort exception because the plaintiffs “have not met their burden of showing that [the defendant] had a contemporaneous 24 intent to commit a crime or a tort”). 1 disclosure of PHI from Defendant’s Website to an unauthorized third party, it is whether the 2 Complaint pleads sufficient facts to allow the Court to draw the reasonable inference that 3 Defendant intercepted Plaintiff’s health-related information for the purpose of committing a

4 criminal or tortious act, where such act is separate from the act of disclosure. 5 The Complaint does not plead such facts. Although Plaintiff states that Defendant 6 “intended to violate” HIPAA and “disclosed HIPAA-protected health information to 7 unauthorized third parties,” see Dkt. # 12 at 9, the Complaint does not plead any facts to support 8 these conclusory statements. See generally Dkt. # 1. For example, the Complaint repeatedly 9 states that the information was intercepted for “targeted advertising purposes” and that the 10 disclosure itself was unlawful, but it never states that Defendant disclosed Plaintiff’s PHI for an 11 unlawful purpose. The Complaint also does not specify what HIPAA-protected information was 12 allegedly disclosed, nor whether such information was criminally and tortiously used, accessed,

13 or otherwise implicated after the initial disclosure. The Court thus does not find that the 14 Complaint pleads “‘sufficient facts to support an inference that the offender intercepted the 15 communication for the purpose of a tortious or criminal act that is independent of the intentional 16 act of recording or interception itself.’” Nienaber, 733 F. Supp. 3d at 1095 (emphasis added). 17 And so it declines to apply the crime-tort exception. 18 Because the crime-tort exception does not apply, and it is undisputed that Defendant is a 19 party to the communication, the Complaint fails to plead an “interception” under ECPA. See 18 20 U.S.C. § 2511(2)(d). The Court thus GRANTS Defendant’s request to dismiss Plaintiff ECPA 21 claim under Rule 12(b)(6). 22 2. Procuring an Interception

23 Defendant argues that Plaintiff’s ECPA claim must be dismissed because there is no civil 24 liability for “procuring” an interception under ECPA. See Dkt. # 7 at 14. Despite Plaintiff’s 1 Response, see Dkt. # 12 at 12–13, however, the Court does not find that the Complaint advances 2 an ECPA claim based on such a theory. See generally Dkt. # 1. It thus DENIES Defendant’s 3 request to dismiss Plaintiff’s ECPA claim on this basis.

4 Nevertheless, to the extent that the Complaint does advance a claim of “interception” 5 based on a pure procurement theory of violation, such a claim must be dismissed. Although 6 some courts have endorsed the procurement theory of interception,3 the majority have rejected 7 the notion that a defendant may be held liable for “aiding and abetting” or “procuring” an 8 interception.4 The Ninth Circuit has also explicitly rejected the concept of secondary liability 9 under ECPA.5 Based on this authority, then, Plaintiff cannot sustain an ECPA claim under a 10 procurement theory of interception and so any claim in the Complaint that is rooted in this theory 11 must be dismissed. 12 3. Contents 13 Defendant contends that the Court should dismiss Plaintiff’s ECPA claim because the 14 Complaint fails to plead the third element of an ECPA claim, i.e., facts showing that Defendant 15 disclosed the “contents” of a communication to a third party. See Dkt. # 7 at 16. Because the 16 Complaint fails to plead an “interception,” see part III.B(1) above, the Court declines to address 17 18 3 See, e.g., Lonegan v. Hasty, 436 F. Supp. 2d 419, 428 (E.D.N.Y. 2006) (endorsing the 19 procurement theory of interception); In re Trilegiant Corp., Inc., 11 F. Supp. 3d 132, 148 n.2 (D. Conn. 2014) (rejecting “aiding and abetting” liability but distinguishing “procurers” from “aiders and abettors” 20 under ECPA). 4 See, e.g., Kirch v. Embarq Mgmt. Co., 702 F.3d 1245, 1247 (10th Cir. 2012) (collecting cases 21 and rejecting “aiding and abetting” and “procurement” theories of liability); Peavy v. WFAA-TV, Inc., 221 F.3d 158, 168–69 (5th Cir. 2000) (discussing the amended version of § 2520’s private right of action and 22 rejecting the procurement theory of interception); Herzer v. Redstone, 2018 WL 5094933, at *7 (C.D. Cal. July 10, 2018) (rejecting civil liability for “procurement violations”). 5 See Freeman v. DirecTV, Inc., 457 F.3d 1001, 1006 (9th Cir. 2006) (concluding that there is “no 23 support for the argument that secondary liability should be imposed” under ECPA); see also In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1089–90 (N.D. Cal. 2015) (collecting cases and rejecting secondary 24 liability under ECPA). 1 the parties’ arguments as to “contents.” But the Court encourages Plaintiff, in amending her 2 complaint, to consider Defendant’s arguments regarding “contents.” 3 C. Leave to Amend

4 Defendant urges the Court to dismiss Plaintiff’s claims with prejudice and without leave 5 to amend, as Plaintiff’s claims “fail as a matter of law” and “amendment would be futile.” See 6 Dkt. ## 7 at 18; 13 at 10. Plaintiff responds that “if [Defendant’s] motion is granted in any 7 respect, Plaintiff should be given leave to amend.” Dkt. # 12 at 16. 8 The Court agrees with Plaintiff. As instructed by Federal Rule of Civil Procedure 15(a), 9 leave to amend should be “freely” given “when justice so requires.” Although “[a] district court 10 does not err in denying leave to amend where the amendment would be futile[,]” Gardner v. 11 Martino, 563 F.3d 981, 990 (9th Cir. 2009), this is not such a case: because Plaintiff’s ECPA 12 claim fails as a matter of alleged facts, Plaintiff should be given an opportunity to cure the

13 factual deficiencies identified in this Order before her claims are dismissed with prejudice. Such 14 an outcome also tracks the decisions of other courts in similar cases, including those cited 15 favorably in Defendant’s Motion to Dismiss.6 16 The Court thus DENIES Defendant’s request for dismissal with prejudice and GRANTS 17 Plaintiff leave to amend. 18 19 20 6 See, e.g., B.K. II, 2024 WL 2037404, at *4 (“[T]he Court finds that amendment may not be 21 futile, and affords [the plaintiffs] an opportunity to cure their pleadings as to [their ECPA claims.]”); Zarif, 789 F. Supp. 3d at 896, 902 (dismissing ECPA claim without prejudice and granting the plaintiff 22 leave to amend); Doe, 2025 WL 1000192, at *9, *11(same); Pena, 670 F. Supp. 3d at 1121 (same); Katz- Lacabe, 668 F. Supp. 3d at 945, 950 (same). The Court also notes that Defendant incorrectly (and repeatedly) states that Nienaber dismissed 23 the plaintiff’s ECPA claim with prejudice. See Dkt. ## 7 at 6, 11, 14; 13 at 4. It did not: in Nienaber, the plaintiff’s ECPA claim was dismissed without prejudice and with leave to amend. See Nienaber, 733 F. 24 Supp. 3d at 1096, 1098. 1 IV CONCLUSION For the foregoing reasons, the Court GRANTS Defendant’s Motion to Dismiss (Dkt. # 7), DISMISSES Plaintiff's Complaint (Dkt. # 1) without prejudice, and GRANTS Plaintiff leave to amend. Any amended pleading must be filed on or before March 25, 2026. If Plaintiff has ° privacy concerns, she may seek to file the amended pleading under seal. Dated this 4th day of March, 2026. Sata M. Chun ° John H. Chun 9 United States District Judge 10 1] 12 13 14 15 16 17 18 19 20 21 22 23 24