UNITED STATES DISTRICT COURT MIDDLE DISTRICT OF FLORIDA TAMPA DIVISION
LUIS ANGEL HEREDIA CRESPI, LYNETTE DAVIS, and MARTIN FORERO, individually and on behalf of all others similarly situated,
Plaintiff,
v. Case No. 8:25-cv-2245-WFJ-NHA
BAYCARE HEALTH SYSTEM, INC.,
Defendant. ___________________________________/
ORDER Before the Court is Defendant BayCare Health System, Inc.’s (“BayCare”) Motion to Dismiss. Dkt. 27. Plaintiffs Luis Angel Heredia Crespi, Lynette Davis, and Martin Forero (jointly, the “Plaintiffs”) responded in opposition, Dkt. 30, and BayCare replied. Dkt. 33. After careful consideration, the Court grants-in-part and denies-in-part BayCare’s Motion to Dismiss. BACKGROUND This dispute arises from Plaintiffs’ use of Defendant BayCare’s website. See generally Dkt. 26. BayCare is a “not-for-profit healthcare system across West Central Florida[.]” Id. ¶ 2. BayCare operates a website where it “allows visitors to search for physicians and various medical facilities, explore health services, pay for care, enter their patient portal, and register for support groups, courses, and other programs.” Id.
Plaintiffs claim that BayCare implemented two Google tracking technologies on its website—Google Analytics 4 Tracker (the “Analytics Tracker”) and DoubleClick Tracker—without the consent of visitors. Id. ¶ 3. The Analytics Tracker reportedly collects data points, called “events,” about user interactions with a
website, such as “page views, clicks, form submissions, video plays, file downloads, and custom events defined by the website owner.” Id. ¶ 26. The DoubleClick Tracker then reportedly “uses collected data for targeted advertising initiatives.” Id. ¶ 32.
Plaintiffs further claim that if a visitor is signed into their Google account when they access BayCare’s website, Google may collect certain data and associate it with their Google account information. Id. ¶ 28. Plaintiff Luis Angel Heredia Crespi allegedly used BayCare’s website on a
“semi-frequent basis for approximately three years[.]” Id. ¶ 81. Plaintiff Crespi used the website to find rheumatologists to treat arthritis and other conditions. Id. He claims to have seen advertisements for products or services related to certain medical
conditions shortly after using Defendant BayCare’s website. Id. Plaintiff Martin Forero reportedly used BayCare’s website “for years” to “seek out a general practitioner physician” and to receive “general medical treatment” and “for other ailments.” Id. ¶ 82. Plaintiff Forero used BayCare’s website most recently to search for “a general practitioner physician.” Id.
Plaintiff Lynette Davis is a BayCare patient reporting to have used BayCare’s website for “more than ten years,” to search for primary care physicians and to schedule appointments. Id. ¶ 83. While using Defendant’s website, Plaintiff Davis claims to have disclosed certain medical conditions and symptoms. Id.
The Plaintiffs were allegedly signed into their personal Google accounts in their browsers each time they accessed BayCare’s website. Id. ¶¶ 81–83. They claim that because Defendant BayCare “utilized tracking tools on its website, Google
intercepted and received” Plaintiffs’ “sensitive medical information and electronic communications without [their] knowledge or consent.” See id. ¶¶ 81–84. The Plaintiffs claim to have “reasonably expected that their online communications with [BayCare] were solely between themselves and [BayCare]” and not “transmitted to
or disclosed to Google.” Id. ¶ 84. All relevant acts allegedly occurred in Florida. Id. ¶ 14. Plaintiffs brought the present action on August 22, 2025. Dkt. 1. On February
4, 2026, this Court dismissed Plaintiffs’ Complaint without prejudice as an impermissible “shotgun pleading.” Dkt. 25 (citing Weiland v. Palm Beach Cnty. Sheriff’s Off., 792 F.3d 1313, 1320 (11th Cir. 2015)). Plaintiffs then filed the operative Amended Complaint on February 18, 2026, which alleged the following claims against Defendant BayCare: violation of the Florida Security of Communications Act (“FSCA”) (Count I); violation of the federal Wiretap Act (as
modified by the Electronic Communications Privacy Act (“ECPA”)) (Count II); breach of confidence (Count III); common law protections against invasion of privacy (Count IV); unjust enrichment (Count V); and breach of implied contract (Count VI). Dkt. 26. On February 27, 2026, Plaintiffs consented to the dismissal of
their claims of invasion of privacy (Count IV) and implied contract (Count VI). Dkt. 27 at 2 n.1. DISCUSSION
Defendant BayCare seeks the dismissal of the remaining claims under Rule 12(b)(1) for lack of Article III standing and under Rule 12(b)(6) for failure to state a claim upon which relief may be granted. Dkt. 27. The Court considers each in turn. I. Motion to Dismiss for Lack of Article III Standing
A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) challenges whether the plaintiff has standing and is principally an attack on the district court’s subject matter jurisdiction. See Steel Co. v. Citizens for a Better Env’t,
523 U.S. 83, 94–95 (1998); Doe v. Pryor, 344 F.3d 1282, 1284 (11th Cir. 2003). A defendant may challenge subject matter jurisdiction facially or factually. See Douglas v. United States, 814 F.3d 1268, 1274–75 (11th Cir. 2016). A facial attack requires the court to examine the complaint, taken as true, to determine whether the plaintiff has sufficiently alleged a jurisdictional basis. Id. at 1274. Here, BayCare brings a facial challenge to Plaintiffs’ standing.
To establish Article III standing, a plaintiff must allege that they “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). To allege a sufficient
injury-in-fact, a plaintiff must plead a “concrete and particularized” harm that is “real, and not abstract.” Id. at 339–40. The injury-in-fact can be “tangible,” such as “physical injury or financial loss,” or it may be “intangible,” such as a concrete harm
resulting from a statutory violation. Nelson v. Experian Info. Sols. Inc., 144 F.4th 1350, 1353, 1356 (11th Cir. 2025). BayCare argues that Plaintiffs lack Article III standing to bring this action because they have failed to prove that they suffered an injury-in-fact. Dkt. 27 at 5–
12. Among other injuries, Plaintiffs allege an injury of an “invasion of their privacy through the unauthorized interception of their electronic communications and healthcare-related activities.” Dkt. 26. ¶ 86. Plaintiff claims this harm alongside the
alleged violations of the FSCA and ECPA. Id. ¶ 95. In the present case, Plaintiffs’ alleged invasion of privacy is an intangible harm. See Trichell v. Midland Credit Mgmt., Inc., 964 F.3d 990, 997 (11th Cir. 2020). “Intangible injuries sometimes qualify as concrete, but not always.” Id. When considering whether an intangible injury is sufficient to confer Article III standing, a court looks to historical analogs at common law. Id. (establishing the relevant
analysis as whether an intangible injury bears a “close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” (quoting Spokeo, 578 U.S. at 341). The common law comparator is the tort of intrusion upon seclusion, which
“consists of an (i) intentional intrusion (ii) into another’s solitude or seclusion, (iii) which would be highly offensive to a reasonable person.” Drazen v. Pinto, 74 F.4th 1336, 1345 (11th Cir. 2023) (citation omitted). However, the Eleventh Circuit has
held that a plaintiff whose Article III standing is analogized to the common law tort of intrusion upon seclusion merely needs to establish that the intrusion is somewhat offensive to a reasonable person, because what matters for standing purposes is whether the harm alleged shares a “close relationship” to the historical tort “in kind,
not degree.” Id. at 1343–45 (citation omitted). The Eleventh Circuit has analyzed a comparable fact pattern in Perry v. Cable News Network, Inc., wherein an injury-in-fact was found where a smartphone user
brought a class action against a network, alleging a violation of a certain statute after smartphone users’ viewing activity on the network’s app was disclosed by the network to a third-party data analytics company. 854 F.3d 1336, 1338–39 (11th Cir. 2017). This alleged harm was determined to sufficiently match up with the common law tort of intrusion upon seclusion and thus conferred standing based on the wrongful disclosure of personal information. Id. at 1340-41. Indeed, Perry was
recently relied upon by a district court in this circuit that found a concrete injury-in- fact where the class plaintiffs alleged that the defendant website owner, “by knowingly installing third-party tracker software on its website, caused the disclosure to third parties of Plaintiffs’ confidential data transmitted via Defendant’s
website, such as Plaintiffs’ ‘form inputs,’ search queries, content-based URL’s, and button clicks.” Cobbs v. Petmed Express, Inc., 824 F. Supp. 3d 1257, 1267 (S.D. Fla. 2026).
Furthermore, various courts have considered the disclosure of private medical information to third parties through the use of tracking technologies embedded in a healthcare provider’s website to be sufficient to establish a concrete injury for purposes of Article III standing. See, e.g., Brunecz v. Warren Gen. Hosp., No. 24-
203, 2026 WL 2043024, at *7 (W.D. Pa. July 15, 2026) (finding that the class plaintiffs’ allegations as to the “unauthorized dissemination of their private medical information to third parties sufficiently allege a concrete injury for purposes of
establishing Article III standing”); Rodriguez v. FastMed Urgent Care, P.C., 741 F. Supp. 3d 352, 360–61 (E.D.N.C. 2024) (finding that the plaintiff “plausibly alleged concrete injury in her federal claim to support Article III standing” where it was claimed that Meta Pixel—a tracking technology—used on the defendant's website disclosed the plaintiff’s HIPAA-protected medical information and patient status to third parties); Doe v. Shady Grove Reprod. Sci. Ctr., P.C., No. 24-cv-2368-ABA,
2025 WL 2781542 at *3 (D. Md. Sept. 30, 2025) (finding that the class plaintiffs sufficiently pleaded a cognizable injury-in-fact when it was alleged that the defendant website owner, “by installing the tracking software onto its website, effectively directed that Plaintiffs’ personally identifiable information be transmitted
to [Google, Meta, and Microsoft]”). Here, each Plaintiff alleges that Defendant BayCare “utilized tracking tools on its website, [and] Google intercepted and received” Plaintiffs’ “sensitive medical
information and electronic communications without [his or her] knowledge or consent.” Dkt. 26 ¶¶ 81–84; see id. ¶ 81 (describing the information about rheumatologists to treat arthritis that Plaintiff Crespi provided on BayCare’s website); id. ¶ 82 (describing the information about “seek[ing] out a general
practitioner physician” and receiv[ing] “general medical treatment” and “for other ailments” that Plaintiff Forero provided on BayCare’s website); id. ¶ 83 (describing the information about primary care physicians and appointments regarding certain
medical conditions and symptoms that Plaintiff Davis provided on BayCare’s website). This private medical information was reportedly personally identifiable because the Plaintiffs were signed into their personal Google accounts in their browsers each time they accessed BayCare’s website. Id. ¶¶ 81–83. The Plaintiffs further allege that they “reasonably expected that their online communications with [BayCare] were solely between themselves and [BayCare]” and not “transmitted to
or disclosed to Google.” Id. ¶ 84. The Court relies upon the aforementioned case law to find that Plaintiffs’ allegations of harm, accepted as true at this stage, are sufficiently analogous to the common law tort of intrusion upon seclusion to establish a concrete injury-in-fact
for all claims. Accordingly, the Court finds that BayCare’s motion to dismiss pursuant to Rule 12(b)(1) is due to be denied. II. Motion to Dismiss for Failure to State a Claim
Federal Rule of Civil Procedure 8(a)(2) requires a short and plain statement of the claim showing that the plaintiff is entitled to relief to give the defendant fair notice of the claims and grounds. See Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citation omitted). The plaintiff is required to allege “more than labels and
conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Id. (citation omitted). In considering a Rule 12(b)(6) motion to dismiss, the court must construe the
facts in the light most favorable to the plaintiff. Wiersum v. U.S. Bank, N.A., 785 F.3d 483, 485 (11th Cir. 2015). A complaint “must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face” to survive a motion to dismiss. Ashcroft v. Iqbal, 556 U.S. 662, 677–78 (2009) (citation modified). However, “[c]onclusory allegations, unwarranted deductions of facts or legal conclusions masquerading as facts will not prevent dismissal.” Jackson v.
BellSouth Telecomms., 372 F.3d 1250, 1262 (11th Cir. 2004) (citation omitted). BayCare argues that Plaintiffs have failed to state a claim upon which relief can be granted as to the remaining claims, which include: violation of the Florida Security of Communications Act (“FSCA”) (Count I); violation of the federal
Wiretap Act (Count II); breach of confidence (Count III); unjust enrichment (Count V). Dkt. 26; Dkt. 27 at 2 n.1. The Court considers each as follows. a. Count I—Violation of the Florida Security of Communications Act
The FSCA prohibits “[i]ntentionally intercept[ing], endeavor[ing] to intercept, or procur[ing] any other person to intercept or endeavor to intercept any wire, oral, or electronic communication.” Fla. Stat. § 934.03(1)(a); id. § 934.10(1) (creating private cause of action). Specifically, to state a claim under the FSCA, a
plaintiff must sufficiently plead “1) an oral, wire, or electronic communication was 2) intentionally intercepted, disclosed or used 3) in violation of the FSCA.” Cardoso v. Whirlpool Corp., No. 21-CV-60784-WPD, 2021 WL 2820822, at *2 (S.D. Fla.
July 6, 2021) (citing Fla. Stat. § 934.03). Because the FSCA was modeled after the Wiretap Act (as modified by the ECPA), Florida courts construe the FSCA’s provisions in accord with the meaning given to analogous provisions of the Wiretap Act. See Minotty v. Baudo, 42 So. 3d 824, 831 (Fla. 4th DCA 2010) (“[The FSCA] was modeled after the [f]ederal Wiretap Act . . . . Florida follows federal courts as to the meaning of provisions after which [the FSCA] was modeled.”).
BayCare moves to dismiss Count I on multiple grounds, including failing to allege: a reasonable expectation of privacy, the interception of communications, and the contents of said communications. See Dkt. 27 at 12–17. The Court reviews each argument in turn.
i. Reasonable Expectation of Privacy BayCare argues that Plaintiffs failed to allege a reasonable expectation of privacy. Id. at 12–13. The requirement for a plaintiff to allege a reasonable
expectation of privacy for an FSCA claim is derived from the FSCA’s definition of an “oral communication” as: “any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation and does not mean . . . any electronic
communication.” Fla. Stat. § 934.02(2); see Woliner v. Summers, 796 F. App’x 649, 651 (11th Cir. 2019) (“The Florida Supreme Court has interpreted this language to mean that a statement is an ‘oral communication’ only if the speaker had ‘a
reasonable expectation of privacy,’ which includes ‘one’s actual subjective expectation of privacy as well as whether society is prepared to recognize this expectation as reasonable.’” (quoting McDonough v. Fernandez-Rundle, 862 F.3d 1314, 1320 (11th Cir. 2017))). This reference to such an “expectation” is not included in the FSCA’s definition of an “electronic communication,” which is defined as: “any transfer of signs, signals, writing, images, sounds, data, or
intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic, or photooptical system that affects intrastate, interstate, or foreign commerce, but does not include . . . [a]ny wire or oral communication[.]” Fla. Stat. § 934.02(12)(a).
BayCare cites to Jacome v. Spirit Airlines, Inc., wherein a Florida state trial court decided that the reasonable expectation of privacy extended beyond oral communications, and that a plaintiff “must plead that she had a reasonable
expectation of privacy when visiting the Website to state a claim for interception of electronic communications under the FSCA.” No. 2021-000947-CA-01, 2021 WL 3087860, at *6 (Fla. Cir. Ct. June 17, 2021). However, this Court disagrees and finds that any relevant precedent only applies such a requirement to oral communications.
Indeed, the Court notes that in reaching its decision, the Jacome court quoted the Florida Supreme Court’s opinion that applied the reasonable expectation of privacy only to oral communications. See State v. Inciarrano, 473 So. 2d 1272, 1275 (Fla.
1985) (“This expectation of privacy does not contemplate merely a subjective expectation on the part of the person making the uttered oral communication but rather contemplates a reasonable expectation of privacy.”). This is consistent with how other courts have analyzed the statutory definition of wire communications. See Brevard Extraditions, Inc. v. Fleetmatics, USA, LLC, No. 8:12-CV-2079-T-17MAP, 2013 WL 5437117, at *4 (M.D. Fla. Sept. 27, 2013) (“Wire communications are
generally protected regardless of whether the person making or receiving the communication has an expectation of privacy. Plaintiffs’ expectation of privacy is not relevant to statutory liability for the interception of wire communications.” (emphasis added) (citations omitted)); see also Langlois v. State, 392 So. 3d 599,
601 (Fla. 5th DCA 2024) (“Notably, the definition of ‘wire communication’ does not include the same qualifying ‘reasonable expectation of privacy’ language as the definition of oral communication.” (Kilbane, J., concurring) (quoting Weeks v. State,
292 So. 3d 1251, 1252 n.2 (Fla. 5th DCA 2020))). Plaintiffs’ provisions of private medical information were made with a reasonable expectation of privacy, which is inherent in these allegations. See Inciarrano, 473 So. 2d at 1275 (“A reasonable expectation of privacy under a given
set of circumstances depends upon one’s actual subjective expectation of privacy as well as whether society is prepared to recognize this expectation as reasonable.”); Dkt. 26 ¶¶ 40–49, 143 (“Plaintiffs and Class Members had a reasonable expectation
of privacy in their communications with BayCare regarding their healthcare needs, medical conditions, and treatment preferences.”); In re Meta Pixel Healthcare Litig., No. 22-cv-05380-WHO, 647 F. Supp. 3d 778 (N.D. Cal. Dec. 22, 2022) (finding that users of a website that collected healthcare information had an expectation of privacy as to those communications); see also Jacome, 2021 WL 3087860, at *2 (finding “Congress’s main concern in amending the Federal Wiretap Act to include electronic
communications (which prompted the Florida legislature to likewise amend the FSCA) was to protect private personal and business records (like medical records) from interception on computerized recordkeeping systems.” (emphasis added)). ii. Interception & Contents
BayCare next asserts that Plaintiffs failed to allege an “interception,” Dkt. 27 at 14–15, as to the “contents” of any communication. Id. at 15–17. Regarding the interception, to “intercept” is defined as “the aural or other acquisition of the
contents of any . . . electronic . . . communication through the use of any electronic, mechanical, or other device.” Fla. Stat. § 934.02(3). BayCare specifically argues that any communications must be both intercepted and transmitted contemporaneously; however, BayCare cites only case law that speaks to the federal Wiretap Act, not the
FSCA. Dkt. 27 at 14 (citing Benessere Inv. Grp., LLC v. Swider, No. 24-CV-21104- RAR, 2024 WL 4652090, at *5 (S.D. Fla. Oct. 31, 2024)). It has been noted that only “[o]ne Florida court has suggested in dicta that Florida law follows federal court
interpretation on whether interception must be contemporaneous.” Schwartz v. ADP, Inc., No. 2:21-CV-283-SPC-KCD, 2022 WL 17992275, at *3 (M.D. Fla. Dec. 29, 2022) (citing O’Brien v. O’Brien, 899 So. 2d 1133, 1136-37 (Fla. 5th DCA 2005)). Assuming—without deciding—that the FSCA requires contemporaneous interception, the Court looks to the analogous case of W.W. v. Orlando Health, Inc.,
wherein a court in this district denied a motion to dismiss nearly identical FSCA claims arising from a healthcare provider’s alleged use of Google Analytics, Meta Pixel, and similar tracking technologies on its website. No. 6:24-cv-1068-JSS-RMN, 2025 WL 722892, at *3–6 (M.D. Fla. Mar. 6, 2025). There, the court concluded that
the plaintiff plausibly alleged that the tracking technologies intercepted the contents of her electronic communications by transmitting information to third parties concerning her medical conditions, searches for providers, and other healthcare-
related website activity. Id. at *5. The court distinguished other decisions that granted dismissal, wherein websites employed “session replay software” that centered on the tracking of website movements, rather than the disclosure of confidential healthcare communications. Id. at *3 (citing Jacome, 2021 WL
3087860, at *3). The Court is persuaded by the reasoning of Orlando Health and similar decisions cited in this case involving healthcare websites utilizing the same tracking
technologies. See, e.g., A.D. v. Aspen Dental Mgmt., Inc., No. 24 C 1404, 2024 WL 4119153, at *5–7 (N.D. Ill. Sept. 9, 2024) (finding allegations that URLs containing users’ searches regarding medical conditions plausibly alleged interception of protected “contents”); R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 902–03 (C.D. Cal. 2024) (holding that the disclosure of searches for sensitive healthcare products revealed a substantive message regarding plaintiffs’ health concerns and therefore
constituted “contents” under the Wiretap Act); In re Grp. Health Plan Litig., 709 F. Supp. 3d 707, 718–20 (D. Minn. 2023) (recognizing that URLs disclosing healthcare-related search terms may constitute protected communications). The Court thus finds that the underlying tracking technologies are sufficiently alleged to
have “intercepted” the relevant communications. Regarding the contents of the allegedly intercepted communications, “contents” is defined as “any information concerning the substance, purport, or
meaning of that communication.” Fla. Stat. § 934.02(7). Accepting Plaintiffs’ allegations as true, BayCare’s website—via the tracking technologies—allegedly intercepted private medical information, including Plaintiffs’ searches for physicians, healthcare providers, medical conditions, treatment-related inquiries,
appointment information, and other communications while Plaintiffs were logged into their identifying Google accounts. Dkt. 26 ¶¶ 81–84; see id. ¶ 81 (describing the information about rheumatologists to treat arthritis that Plaintiff Crespi provided on
BayCare’s website); id. ¶ 82 (describing the information about “seek[ing] out a general practitioner physician” and receiv[ing] “general medical treatment” and “for other ailments” that Plaintiff Forero provided on BayCare’s website); id. ¶ 83 (describing the information about primary care physicians and appointments regarding certain medical conditions and symptoms that Plaintiff Davis provided on BayCare’s website). These allegations plausibly describe the contents of Plaintiffs’
electronic communications, as they concern the substance and meaning of the information Plaintiffs sought to convey to BayCare regarding their current or intended medical care. At this stage, the Court declines to resolve the factual questions concerning
the precise operation of the tracking technologies, the timing and manner of any interception, and the ultimate scope of the information disclosed. Those issues are more appropriately addressed on a developed factual record. Plaintiffs have alleged
sufficient facts to plausibly state that BayCare intentionally intercepted the contents of Plaintiffs’ electronic communications via the implemented tracking technologies in violation of the FSCA. Accordingly, BayCare’s motion to dismiss Count I is due to be denied.
b. Count II—Violation of the Federal Wiretap Act Similar to the FSCA, the Wiretap Act (ECPA) creates a private cause of action against a person who “intentionally intercepts, endeavors to intercept, or procures
any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a); id. § 2520(a) (creating private cause of action). Specifically, to state a claim under the Wiretap Act, a plaintiff must sufficiently allege that the defendant “(1) intentionally (2) intercepted, endeavored to intercept[,] or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication (5) using a device.” Mohamad v. Cent.
Fl. Tax and Acct., Inc., No. 6:24-cv-2354-JSS-LHP, 2025 WL 2695116, at *5 (M.D. Fla. Sept. 22, 2025) (quoting Hamilton Grp. Funding, Inc. v. Basel, 311 F. Supp. 3d 1307, 1314 (S.D. Fla. 2018)). Because FSCA claims are analyzed “in the same manner as claims brought
under the Wiretap Act,” Orlando Health, 2025 WL 722892, at *6, BayCare reasserts the arguments it made as to Plaintiff’s FSCA claim. Dkt. 27 at 18. For the reasons already discussed, those arguments do not prevail at this stage. The only independent
argument raised by BayCare for the dismissal of the Wiretap Act claim is that BayCare cannot have unlawfully intercepted communications when it was a party to such communications, and thus the Wiretap Act claim is barred. Id.; see 18 U.S.C. § 2511(2)(d) (“It shall not be unlawful under this chapter for a person not acting
under color of law to intercept a[n] . . . electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception[.]”); see also Ramos v. Delphi Behav.
Health Grp., LLC, No. 21-11218, 2022 WL 1415856, at *1 (11th Cir. May 4, 2022) (“[I]t is lawful for an individual to intercept a communication if he is a party to it.”). Plaintiffs do not dispute that BayCare was a party to the alleged intercepted communications at issue, and instead argue that the Wiretap Act’s crime-tort exception applies. Dkt. 30 at 21–23. Under that exception, a party to the intercepted communication may be liable if the “communication is intercepted for the purpose
of committing any criminal or tortious act[.]” 18 U.S.C. § 2511(2)(d). Plaintiffs allege that “[t]hrough its conduct, BayCare intended to share and monetize its patients’ [identifiable health information], violating HIPAA and its common law duties.” Dkt. 26 ¶ 45. Regarding HIPAA, Plaintiffs specifically claim that BayCare’s
conduct violated the HIPAA subsection that imposes “penalties for knowingly disclosing individually identifiable health information . . . to third parties.” Id. ¶ 44 (citing 42 U.S.C. § 1320d-6(a)(3)).
BayCare argues that the crime-tort exception does not apply because the requisite criminal or tortious purpose must be independent of the interception itself. Dkt. 27 at 19–21; Dkt. 33 at 7–8. Although Defendant cites to considerable persuasive—but not binding—authority adopting that requirement, see id., the Court
notes that the statutory text contains no express requirement for an independent criminal or tortious purpose. See 18 U.S.C. § 2511(2)(d) (“. . . unless such communication is intercepted for the purpose of committing any criminal or tortious
act[.]”). Moreover, at least one court in this district has recognized that authority on this question is divided. See Orlando Health, 2025 WL 722892, at *7 (“[G]iven the lack of binding authority and the split in persuasive authority on this issue, the court will not dismiss Plaintiff’s allegations while her case is in its infancy.”). At this stage, the Court does not decide whether the Wiretap Act’s crime-tort exception requires a criminal or tortious purpose independent of the interception itself.1 Accepting Plaintiffs’ allegations as true, they have sufficiently alleged that
BayCare intercepted their communications for the purpose of violating HIPAA and its common-law duties. See id. (“Plaintiff alleges that Defendant intercepted the contents of her communications for the purposes of violating the FSCA and HIPAA.
. . The court finds no basis in the text of the Wiretap Act’s crime-tort exception to conclude that these allegations are insufficient.”). On the present pleadings, the Court declines to conclude that Plaintiffs’ Wiretap Act claim fails as a matter of law.
As the court observed in Orlando Health, “[a]pplication of the crime-tort exception appears more fit for resolution at summary judgment or trial than at the motion to dismiss stage.” Id. (citations omitted). Accordingly, BayCare’s motion to dismiss Count II is due to be denied.
c. Count III—Breach of Confidence A common law breach of confidence claim requires a plaintiff to allege an “unconsented, unprivileged disclosure to a third party of nonpublic information that
1 However, even if the Court were to adopt this requirement, Plaintiffs’ allegations are likely sufficient to establish an independent purpose. BayCare’s interception of the communications via the tracking technologies and the subsequent disclosure of this information to Google are two separate acts. See Dkt. 30 at 22. As alleged, BayCare’s purpose for the first act was to receive “detailed analytics about [BayCare’s website] usage that inform its business and marketing decisions[,]” Dkt. 26 ¶ 76, while BayCare’s purpose for the second act was to “share and monetize its patients’ [identifiable health information], violating HIPAA and its common law duties.” Id. ¶ 45. the defendant has learned within a confidential relationship.” Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 932 (11th Cir. 2020) (en banc) (citation omitted).
BayCare moves to dismiss Count III on two grounds: the lack of a confidential relationship between BayCare and Plaintiffs Crespi and Forero; and the failure to sufficiently allege a disclosure of confidential information. See Dkt. 27 at 21–22. The Court reviews each argument as follows.
Regarding BayCare’s argument as to the alleged relationship between BayCare and Plaintiffs Crespi and Forero, the Court notes that a breach of confidence claim “is rooted in the concept that the law should recognize some
relationships as confidential to encourage uninhibited discussions between the parties involved.” Muransky, 979 F.3d at 932 (quoting Young v. U.S. Dept. of J., 882 F.2d 633, 640 (2d Cir. 1989)). The Eleventh Circuit has recognized that this claim “traditionally arise[s] in the context of close professional relationships,” such as
medical doctors. Id. (citation omitted). The Florida Supreme Court has found that a confidential relationship exists where “confidence is reposed by one party and a trust accepted by the other, or where confidence has been acquired and abused.” Doe v.
Evans, 814 So. 2d 370, 374 (Fla. 2002) (citation omitted). BayCare argues that Plaintiffs Crespi and Forero have not sufficiently alleged a confidential relationship with BayCare because Plaintiffs do not allege that they were patients of BayCare. Dkt. 27 at 21. However, courts in this Circuit have consistently held that “the question of whether a . . . confidential relationship exists is typically a question of fact.” Drewes v. Cetera Fin. Grp., Inc., No. 9:19-cv-80531-
WM, 2020 WL 13880994, at *4 (S.D. Fla. Dec. 21, 2020) (citing Swerhun v. Gen. Motors Corp., 812 F. Supp. 1218 (M.D. Fla. 1993)); see Bishop v. Shorter Univ., No. 4:15-CV-0033-HLM, 2015 WL 13753710, at *7 (N.D. Ga. June 4, 2015) (holding that “[t]he existence of a confidential or fiduciary relationship is a question
for the jury[.]” (citation omitted)); Hayes v. Automation Pers. Servs., Inc., No. 2:21- cv-859-AMM, 2022 WL 22913918, at *13 (N.D. Ala. Sept. 27, 2022) (“Whether a confidential relationship existed may be a question of fact applicable to some kind
of claims[.]”). Here, although Plaintiffs do not allege that they were patients of BayCare, the Court finds that their allegations nevertheless identify a relationship that extended beyond a mere interaction with a public-facing website. Plaintiff Crespi allegedly
utilized BayCare’s website on a “semi-frequent basis for approximately three years” to find rheumatologists to treat arthritis and other conditions, Dkt. 26 ¶ 81, while Plaintiff Forero allegedly used BayCare’s website “for years” to “seek out a general
practitioner physician” and to receive “general medical treatment” and “for other ailments.” Id. ¶ 82. Plaintiffs’ allegations emphasize that Plaintiffs Crespi and Forero repeatedly relied on BayCare’s website in connection with obtaining information and seeking access to healthcare providers related to specific conditions. Id. ¶¶ 81– 82. At the present stage, these allegations are sufficient to plausibly suggest that Plaintiffs Crespi and Forero reposed confidence in BayCare and that BayCare
accepted that trust in a manner consistent with the confidential relationship. See Evans, 814 So. 2d at 374. Whether such circumstances ultimately establish the type of confidential relationship necessary to sustain a breach of confidence claim is a fact-intensive inquiry that is not appropriately resolved on a motion to dismiss.
Regarding BayCare’s argument as to Plaintiffs’ claim of a disclosure of confidential information, BayCare asserts that Plaintiffs alleged interactions with BayCare’s website “do not reveal private medical information, do not reflect
confidential communications, and do not transform publicly available website activity into nonpublic information for purposes of a breach of confidence claim.” Dkt. 27 at 21–22. The Court finds that Plaintiffs’ allegations reflect otherwise. Specifically,
Plaintiffs claim that private health information was gathered via the tracking technologies and disclosed to Google, including information concerning their searches for physicians, healthcare providers, medical conditions, treatment-related
inquiries, appointment information, and other communications while logged into their identifiable Google accounts. See Dkt. 26 ¶¶ 81–84. Plaintiffs include specific detail as to how the tracking technologies take the allegedly intercepted health information and disclose it to Google. Dkt. 26 ¶¶ 23–39, 50–71. Plaintiffs have thus sufficiently alleged the disclosure of nonpublic information to a third party. See Muransky, 979 F.3d at 932; Orlando Health, 2025 WL 722892, at *8 (finding that
allegations that tracking technologies gathered and transmitted the plaintiff’s protected health information—including searches for physicians, medical conditions, and treatment-related information—to Meta and Google were sufficient to state a claim for breach of confidence). Accordingly, BayCare’s motion to dismiss
Count III is due to be denied. d. Count V—Unjust Enrichment To state a claim for unjust enrichment, a plaintiff must allege that “(1) the
plaintiff has conferred a benefit on the defendant; (2) the defendant has knowledge of the benefit; (3) the defendant has accepted or retained the benefit conferred; and (4) the circumstances are such that it would be inequitable for the defendant to retain the benefit without paying fair value for it.” Resnick v. AvMed, Inc., 693 F.3d 1317,
1328 (11th Cir. 2012) (quoting Della Ratta v. Della Ratta, 927 So. 2d 1055, 1059 (Fla. 4th DCA 2006)). BayCare moves to dismiss Count V due to Plaintiffs’ claim of unjust
enrichment being predicated on wrongful conduct. See Dkt. 27 at 23. Indeed, “[a] number of courts hold that a claim of unjust enrichment may not be predicated on a wrong committed by a defendant.” State Farm Mut. Auto. Ins. Co. v. Lewin, 535 F. Supp. 3d 1247, 1266 (M.D. Fla. 2021) (quoting AIM Recycling Fla., LLC v. Metals USA, Inc., No. 18-60292-CIV-ZLOCH, 2019 WL 1991946, at *1 (S.D. Fla. Mar. 4, 2019)); see Guy. Tel. & Tel. Co., Ltd. v. Melb. Int’l Commc’ns, Ltd., 329 F.3d 1241,
1245 n.3 (11th Cir. 2003) (“As soon as a claimant relies on a wrong to supply the unjust factor, the right on which he relies arises from that wrong, not from unjust enrichment.” (citation modified)); Electrostim Med. Servs., Inc. v. Lindsey, No. 8:11- cv-2467-VMC-TBM, 2012 WL 1560647, at *4 (M.D. Fla. May 2, 2012) (“Where a
plaintiff predicates their unjust enrichment claim on wrongful conduct of a defendant, then the plaintiff’s right of recovery, if any, arises from the wrong of the alleged tort rather than unjust enrichment.” (citation omitted)).
Here, Plaintiffs’ unjust enrichment claim provides that it is based on BayCare’s interception and retention of Plaintiffs’ electronic communications via its implementation of the tracking technologies. Dkt. 26 ¶¶ 149–54. Plaintiffs do not plead this in the alternative to any other claim. See id. After reviewing the
allegations, the Court cannot differentiate this wrong from Plaintiffs’ breach of confidence claim, especially given that both claims incorporate the same set of paragraphs from the body of the complaint. Dkt. 26 ¶¶ 135, 149 (incorporating
paragraphs 1–11, 16–94, and 96–107). Because Plaintiff’s claim of unjust enrichment is not premised on independent wrongful conduct and is not pleaded in the alternative, the Court finds that this claim must be dismissed. See Lewin, 535 F. Supp. 3d at 1267 (finding that an unjust enrichment claim was subject to dismissal where the plaintiff based the claim on alleged wrongful conduct underlying other tort claims and failed to plead unjust
enrichment as an alternative theory of recovery); FreeStyle Slides, Inc. v. Super Sweet Air, Inc., No. 6:17-cv-169-CEM-GJK, 2018 WL 3819073, at *5 (M.D. Fla. July 9, 2018) (“Because Plaintiff’s unjust enrichment claim is premised on wrongful conduct allegedly committed by [Defendant], among others, Plaintiff’s claim fails
as a matter of law, and [Defendant]’s request for dismissal must be granted.”); Florida v. Tenet Healthcare Corp., 420 F. Supp. 2d 1288, 1309 (S.D. Fla. 2005) (“Because ‘the law of unjust enrichment is concerned solely with enrichments that
are unjust independently of [alleged] wrongs,’ Plaintiffs’ unjust enrichment claims must be dismissed.” (quoting Flint v. ABB, Inc., 337 F.3d 1326, 1330 n.2 (11th Cir. 2003))). Accordingly, BayCare’s motion to dismiss Count V is due to be granted. CONCLUSION
Accordingly, it is hereby ORDERED and ADJUDGED that: 1. Plaintiffs’ Count IV (invasion of privacy) and Count VI (implied contract) are DISMISSED, as consented to by Plaintiffs. See Dkt. 27 at 2 n.1.
2. Defendant BayCare Health System, Inc.’s Motion to Dismiss, Dkt. 27, is GRANTED-IN-PART and DENIED-IN-PART. a. Defendant BayCare Health System, Inc.’s Motion to Dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) is DENIED. b. Defendant BayCare Health System, Inc.’s Motion to Dismiss Count I (FSCA), Count II (Wiretap Act), and Count III (breach of confidence)
pursuant to Federal Rule of Civil Procedure 12(b)(6) is DENIED. c. Defendant BayCare Health System, Inc.’s Motion to Dismiss Count V (unjust enrichment) is GRANTED, and Count V is DISMISSED. 3. Defendant BayCare Health System, Inc. shall file its Answer to the Amended
Complaint as to Counts I, II, and III within fourteen (14) days of the date of this Order. 4. The parties are directed to confer and submit the joint Uniform Case
Management Report within ten (10) days of the date of this Order. See Dkt. 36. DONE AND ORDERED at Tampa, Florida, on August 11, 2026. /s/ William F. Jung WILLIAM F. JUNG UNITED STATES DISTRICT JUDGE COPIES FURNISHED TO: Counsel of Record