IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF PENNSYLVANIA
MARTIN MURASKL, et al., ) Plaintiffs, VS. Civil Action No. 3:23-135 ) Judge Stephanie L. Haines PENN HIGHLANDS HEALTHCARE, INC., _ ) Defendant.
OPINION Plaintiffs Martin Muraski and Devin Young (“Plaintiffs”), on behalf of themselves and all others similarly situated, bring this civil action against Penn Highlands Healthcare, Inc. (“Defendant”) for violations of the Pennsylvania Wiretapping and Electronic Surveillance Control Act (““WESCA”), 18 Pa. Cons. Stat. § 5701, et seq. Defendant moves to dismiss. (ECF No. 25). For the reasons stated herein the Motion to Dismiss will be granted. I. Procedural and Factual Background On June 21, 2023, Plaintiffs filed a single-count Complaint, (ECF No. 1), alleging Defendant violated WESCA when it shared tens of thousands of its patients’ and website users’ private medical and other personally identifiable information without notifying them and without obtaining their consent. Jd. § 1. Plaintiffs allege this Court has subject matter jurisdiction pursuant □
to the Class Action Fairness Act (““CAFA”), 28 U.S.C. § 1332(d)(2). Jd. F§ 10, 11. On September 1, 2023, Defendant filed a Motion to Dismiss (“the Motion”), (ECF No. 25), □
with supporting Brief, (ECF No. 26), pursuant to Fed. R. Civ. P. 12(b)(1) and 12(b)(6), arguing the Court lacks subject matter jurisdiction under CAFA and further, that the WESCA claim is legally insufficient. On November 1, 2023, Plaintiffs filed a Response, (ECF. No. 36), to which
Defendant filed a Reply, (ECF No. 37). On February 15, 2024, the Court held oral argument on the Motion to Dismiss and took the matter under advisement. (ECF No. 40); see also Transcript (ECF No. 47-2). Thereafter, with leave of court, Plaintiff filed a post-hearing Brief in Opposition, (ECF No. 43), Defendant filed a Second Brief in Support of the Motion to Dismiss with Supplemental Authority (ECF No. 47), to which Plaintiff filed a Response. (ECF No. 48). The Motion is ripe for disposition. The allegations in the Complaint are as follows.’ Plaintiffs are residents and citizens of Pennsylvania, (ECF No. 1 { 7, 8), and Defendant is a corporation organized under the laws of Pennsylvania with its headquarters in DuBois, Pennsylvania. Jd. 9. Defendant is an integrated health system located in northwestern Pennsylvania with eight hospitals. Jd. Defendant’s website sends patients’ medical and other personal information to Google using Google Analytics, a web analytics service that allows website owners to track site visitors’ actions in order to target such visitors with personalized advertisements. Id. 914. Google Analytics collects the Internet Protocol (“IP”) addresses of individual Internet users in order to facilitate and track Internet communications. Jd. §16. Google can use the information that Defendant discloses in order to identify a specific website user’s actions on Defendant’s website. Jd. 416. Google Analytics offers website owners, like Defendant, an opt-in IP anonymization feature. Id. 417. According to Google, this feature is designed to help site owners comply with their own privacy policies and the recommendations of data protection authorities. Jd. 18. If the IP anonymization feature is enabled by the website owner, an additional parameter is added to the communication between website visitors’ computers and the Google Analytics server, defined as “aip: 1.” Id. J 19. Accordingly, when the “aip” parameter does not appear, the IP address is not
1 Unless otherwise noted, the facts included in this section are taken from the Complaint (ECF No. 1). These facts are uncontested unless otherwise noted.
anonymized, thus enabling Google to identify website users’ IP addresses and their online actions. Id. 22. By using the Google Analytics tool without the IP anonymization feature, Defendant is sharing with Google its patients’ online activity relating to their private medical treatment, along with patients’ IP addresses, even when patients have not shared, nor have consented to share, such information. /d. § 22. Upon entering Defendant’s homepage website, users can select the “Find a Provider” button located on the top bar of the website. Id. 423. Users are then directed to the “Find a Doctor” page, where they are able to search for a doctor by name, hospital, practice, specialty, location, type and gender, or choose a medical provider from the list provided. Jd. { 24. Upon clicking the “search” button, all the user’s submitted information is automatically sent directly to Google. Jd. { 26. Any information submitted by the patient through the search bar (e.g., doctor, specialty, type of treatment, etc.) located on the site’s homepage is shared with Google, along with the patient’s IP address. Jd. § 31. Defendant is a covered entity under the Health Insurance Portability and Accountability Act, 42 U.S.C. § 1302, et seg. (“HIPAA”), which sets minimum federal standards for privacy and security of protected health information (“PHI”). Jd. § 33. Under HIPAA, Plaintiffs and class members have a reasonable expectation of privacy in their data, including sensitive medical and other personal information, communicated to Defendant through its website. Jd. § 32. HIPAA defines “protected health information” as “individually identifiable health information” that is “transmitted by electronic media; maintained in electronic media; or transmitted or maintained in any other form or medium.” 45 C.F.R. § 160.103. 7d. § 34. HIPAA further prohibits a healthcare provider from disclosing PHI to third parties, such as Google, except where an individual has expressly consented in advance to the disclosure or under certain HIPAA-compliant contracts. 45
C.F.R. §§ 164.502, 164.508. Id. § 37. Plaintiffs and class members have no idea that Google collects and uses their sensitive PHI and other personal information at Defendant’s direction when they interact with Defendant’s website. Id. J 42. Plaintiff Muraski has accessed and used the Defendant’s scheduling page, including the “Find a Doctor” feature, on Defendant’s website numerous times, with the last time in 2023. Id. 970. He has also used the search bar on Defendant’s website, and he entered sensitive medical and other personal information when using it to find an appropriate medical provider, including his medical diagnosis, conditions and symptoms. When using the search bar, he was also sharing his IP address. Jd. $71. When Plaintiff Muraski visited Defendant’s website, Google collected his PHI and other personal information from Defendant, and had already collected some or all his personal information from other websites in its purported wiretap network. Jd. § 76. Likewise, Plaintiff Young used Defendant’s appointment scheduling page, including the “Find a Doctor” feature, and entered sensitive medical and other personal information when scheduling appointments for medical treatment, including the types of medical treatment he seeks through Defendant, the type of provider (i.e., physician, nurse practitioner, etc.), specialty and name of the providers with whom he seeks treatment with, the locations of the Defendant facilities he wishes to go to, and if he searches for Defendant providers by specific gender. When using the scheduling page, he was also sharing his IP address. /d. 481. Plaintiff Young has accessed and used the Defendant’s scheduling page, including the “Find a Doctor” feature, on Defendant’s website numerous times, with the last time in 2023. Id. § 82. Google utilized this access to surreptitiously gather Plaintiff Young’s sensitive PHI and other personal information, without his consent. Id. {| 86, 87. On information and belief, when Plaintiff Young visited Defendant’s website, Google collected his PHI and other personal information from Defendant and had already collected some
or all of his personal information from other websites in its purported wiretap network. Jd. { 88. Thus, Google was able to link Plaintiff Young’s previous browsing activity on other websites and his intercepted activity on Defendant’s website to his personally identifiable information, revealing an enormous amount of private information about him. Jd. J 89. Plaintiffs bring this action both on behalf of themselves and all others similarly situated (the “Class”) pursuant to Federal Rules of Civil Procedure 23(a), (b)(2) and (b)(3). Jd. § 91. The Class is defined as follows: All individuals who visited the [Defendant’s] website in the last two years and had their private medical and other personal information shared with Google without providing consent. Specifically excluded from this Class are Defendant, its officers, directors or employees, any entity in which Defendant has a controlling interest and any affiliate, legal representative, heir or assign of Defendant. Also excluded from this Class are any judicial officers presiding over this action, the members of the judicial officer’s immediate family and staff and any juror assigned to this action. 91. II. Standard of Review A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) challenges the “court's ‘very power to hear the case.’” Petruska v. Gannon Univ., 462 F.3d 294, 302 (3d Cir. 2006) (quoting Mortensen v. First Federal Savings and Loan Ass’n, 549 F.2d 884, 891 Gd Cir. 1977)). The party asserting the existence of federal jurisdiction bears the burden of proving that jurisdiction over the subject matter exists. Brown vy. Tucci, Civil Action No. 12-1769, 2013 WL 2190145 (W.D. Pa. May 20, 2013) (citing Development Finance Corp. v. Alpha Housing & Health Care, 54 F.3d 156, 158 (Gd Cir. 1995)). There are two types of Rule 12(b)(1) motions. A “facial” attack assumes that the allegations of the complaint are true, but contends that the pleadings fail to present an action within the court’s
jurisdiction. Mortensen v. First Fed. Sav. & Loan Ass’n, 549 F.2d 884, 891 (3d Cir. 1977). The United States Court of Appeals for the Third Circuit has explained: In reviewing a facial attack, “the court must only consider the allegations of the complaint and documents referenced therein and attached thereto, in the light most favorable to the plaintiff.” Jn re Schering Plough Corp., 678 F.3d at 243 (quoting Gould Elecs. Inc. v. United States, 220 F.3d 169, 176 (3d Cir. 2000)) (internal quotation marks omitted). Thus, a facial attack calls for a district court to apply the same standard of review it would use in considering a motion to dismiss under Rule 12(b)(6), i.e., construing the alleged facts in favor of the nonmoving party. Constitution Party of Pennsylvania v. Aichele, 757 F.3d 347, 358 (d Cir. 2014). A “factual” attack, on the other hand, argues that, while the pleadings themselves facially establish jurisdiction, one or more of the factual allegations is untrue, causing the case to fall outside the court's jurisdiction. Jd. In such a case, “no presumptive truthfulness attaches to plaintiff's allegations” and the court must evaluate the merits of the disputed allegations because “the trial court’s . . . very power to hear the case” is at issue. Jd. With a factual attack, the Court is free to consider evidence outside the pleadings and weigh that evidence. Petruska, 462 F.3d at 302 n.3; see also Gould Elecs., Inc. v. U.S., 220 F.3d 169, 176 (3d Cir. 2000). “[T]he existence of disputed material facts will not preclude the trial court from evaluating for itself the merits of jurisdictional claims.” Petruska, 462 F.3d at 302 n.3 (quoting Mortenson, 549 F.2d at 891). A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6) tests the legal sufficiency of the complaint. See Kost v. Kozakiewicz, 1 F.3d 176, 183 (3d Cir. 1993). In deciding a motion to dismiss, the Court is not opining on whether the plaintiff will likely prevail on the merits; the plaintiff must only present factual allegations sufficient “to raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citing 5 C. Wright & A. Miller, Federal Practice, and Procedure § 1216, pp. 235-236 (3d ed. 2004)); see also Ashcroft v. Igbal, 556 U.S. 662 (2009). A complaint should only be dismissed under Rule 12(b)(6) if it
fails to allege “enough facts to state a claim to relief that is plausible on its face.” Twombly, 550 U.S. at 570 (rejecting the traditional 12(b)(6) standard established in Conley v. Gibson, 355 U.S. 41 (1957)). In making this determination, the Court must accept as true all well-pled factual allegations in the complaint and views them in a light most favorable to the plaintiff. See U.S. Express Lines Ltd. v. Higgins, 281 F.3d 383, 388 (3d Cir. 2002). While a complaint does not need detailed factual allegations to survive a motion to dismiss, a complaint must provide more than labels and conclusions. See Twombly, 550 U.S. at 555. A “formulaic recitation of the elements of a cause of action will not do.” Jd. (citing Papasan v. Allain, 478 U.S. 265, 286 (1986)). Moreover, a court need not accept inferences drawn by a plaintiff if they are unsupported by the facts as stated in the complaint. See California Pub. Emp. Ret. Sys. v. The Chubb Corp., 394 F.3d 126, 143 (3d Cir. 2004) (citing Morse v. Lower Merion Sch. Dist., 132 F.3d 902, 906 (3d Cir. 1997)). Nor must the Court accept legal conclusions disguised as factual allegations. See Twombly, 550 US. at 555. See also McTernan y. City of York, Pennsylvania, 577 F.3d 521, 531 (3d Cir. 2009) (“The tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions.”). Expounding on the Twombly/Iqbal line of cases, the Third Circuit has articulated the following three-step approach: First, the court must ‘tak[e] note of the elements a plaintiff must plead to state a claim.’ Second, the court should identify allegations that, ‘because they are no more than conclusions, are not entitled to the assumption of truth.’ Finally, ‘where there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement for relief.’ Burtch v. Milberg Factors, Inc., 662 F.3d 212, 221 d Cir. 2011) (quoting Santiago v. Warminster Twp., 629 F.3d 121, 130 (3d Cir. 2010)). This determination is “a context-specific task that
requires the reviewing court to draw on its judicial experience and common sense.” Jgbal, 556 USS. at 679. When ruling on a motion to dismiss under Rule 12(b)(6), the court must generally consider only the allegations in the complaint, exhibits attached to the complaint, matters of public record, and documents that form the basis of a claim. See In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (3d Cir. 1997)). Il. Discussion A. CAFA Jurisdiction Defendant’s motion challenges the threshold question of subject-matter jurisdiction, which the court must resolve before addressing the Rule 12(b)(6) motion to dismiss. Papurello v. State Farm Fire & Cas. Co., 144 F. Supp. 3d 746, 751 (W.D. Pa. 2015). CAFA grants federal courts jurisdiction over actions that meet three requirements: (1) the parties are minimally diverse, (2) the class consists of at least 100 members, and (3) the amount in controversy exceeds $5 million. Judon v. Travelers Property Cas. Co. of Am., 773 F.3d 495, 500 (3d Cir. 2014) (citing 28 U.S.C. § 1332(d)(2), (5)(B), (6)). In these respects, it differs from the usual, non-class-action jurisdictional requirements of complete diversity of citizenship and an amount in controversy exceeding $75,000. See 28 U.S.C. § 1332(a); Smith v. HSN, Inc., No. CV2012869KMESK, 2020 WL 7022640, at *2 (D.N.J. Nov. 30, 2020). Defendant does not dispute that this case meets the requirements that the proposed class of more than 100 persons and an amount in controversy exceeding $5,000,000 “as Plaintiffs have not provided evidence of either.” Defendant “focuses its briefing on the complete lack of diversity required for this Court to proceed.” (ECF No. 37 at 3). Regardless, out of an abundance of caution, the Court will address each of the three requirements.
8 .
First, the amount in controversy exceeds $5,000,000. “To ‘determine whether [CAFA’s] matter in controversy’ exceeds [the] sum [or value of $5,000,000, exclusive of interest and costs], ‘the claims of the individual class members shall be aggregated.’” Standard Fire Ins. Co. v. Knowles, 568 U.S. 588, 592 (2013) (quoting 28 U.S.C. § 1332(d)(6)). “[T]hose ‘class members’ include ‘persons (named or unnamed) who fall within the definition of the proposed or certified class.’” Id. (quoting 28 U.S.C. § 1332(d)(1)(D)). Plaintiffs allege there are tens of thousands of class members, (ECF No. 1 § 94), and that they are entitled to statutory damages of $100 per violation and $1,000 per day, punitive damages, as well as reasonable attorney’s fees under WESCA. (/d. 7103). The first requirement is clearly met here. Second, facially, CAFA’s minimal diversity requirement is satisfied. 28 U.S.C. § 1332(d)(2)(A). Under CAFA, “a federal court may exercise jurisdiction over a class action if ‘any member of a class of plaintiffs is a citizen of a State different from any defendant.’” Mississippi ex rel. Hood v. AU Optronics Corp., 571 U.S. 161, 165 (2014) (quoting 18 U.S.C. § 1332(d)(2)(A)). The court looks to the “[c]itizenship of the members of the proposed plaintiff class[] . . . as of the date of filing of the complaint.” 18 U.S.C. § 1332(d)(7). Here, the Complaint pleads that named Plaintiffs are residents of Pennsylvania, (ECF No. 1 {{f 7, 8), but also states that members of the proposed class “reside in Pennsylvania, Ohio, West Virginia, and New York while [Defendant] is incorporated in and has its principal place of business in Pennsylvania” Jd. §11. Thus, the Court concludes that at least one member of the putative class is diverse from Defendant. Third, the Complaint alleges that there are “tens of thousands” of class members. (ECF No. 1 4 94). Therefore, the requirement that the class be composed of at least 100 members is satisfied. Accordingly, Plaintiffs have alleged sufficient facts to meet the initial jurisdictional requirements under CAFA.
1. Exceptions to Jurisdiction Once the jurisdiction requirements are established by the party asserting federal jurisdiction — Plaintiff, in this case — the burden shifts to the opponent—Defendant in this case—to prove an exception to jurisdiction. Kaufman v. Allstate N.J. Ins. Co., 561 F.3d 144, 154 Gd Cir. 2009). Defendant invokes two exceptions to CAFA jurisdiction. (ECF No. 26 at 16, ECF No. 37 at 2). One is the home-state exception, requiring courts to decline to exercise jurisdiction when “the citizenship of the members of two-thirds or more of the putative class is the state in which the action was originally filed” and a non-diverse defendant is the primary defendant. Vodenichar v. Halcon Energy Props., Inc., 733 F.3d 497, 503-04 (3d Cir. 2013) (citing 28 U.S.C. § 1332(d)(4)(B)). A primary defendant is the one which the plaintiff seeks to hold directly liable and which would sustain the greatest loss if found liable—in other words, the “real target” of the suit. Id. at 505. Another exception is the local-controversy exception. A party seeking to invoke the local controversy exception must show that: (1) greater than two-thirds of the putative class are citizens of the state in which the action was originally filed; (2) at least one defendant is a citizen of the state in which the action was originally filed (the “local defendant”); (3) the local defendant’s conduct forms a significant basis for the claims asserted; (4) plaintiffs are seeking significant relief from the local defendant; (5) the principal injuries occurred in the state in which the action was originally filed; and (6) no other class action asserting the same or similar allegations against any of the defendants had been filed in the preceding three years. Id. at 506-07. “These elements ensure that the exception is invoked when the class is primarily local, the lawsuit is against ‘at least one real in-state defendant whose alleged conduct is central to the class claims and from whom the class seeks significant relief,’ the injuries the defendant allegedly caused occurred within the forum, and no other similar class actions have been filed against any of the defendants.” Id. at 507 (quoting 151 Cong. Rec. 8999-02, 2005 WL 283380
(daily ed. Feb. 7, 2005) (statement of Sen. Specter)). The court “may consider pleadings as well as evidence that the parties submit to determine whether subject matter jurisdiction exists or an exception thereto applies.” Jd. at 503 n.1. Failure to show any one of the several elements of the local controversy exception precludes its applicability. See Vodenichar, 733 F.3d at 506-07. 2. Analysis In its opening brief, Defendant argues that minimal diversity between the parties is lacking, based on the Plaintiff's disclosure statement, which represents that the named Plaintiffs are citizens of Pennsylvania, but the remaining unidentified class members are from “Various States.” (ECF No. 26 at 12, citing ECF No. 6 at 2). Defendant argues that practicality and reasonable presumption lead to the conclusion that the probable citizenship of the proposed class is from Pennsylvania, the Defendant’s location and small size. (ECF No. 26 at 14-15). It argues that the Court should decline to exercise jurisdiction of Plaintiffs purported class action because both the “home state” and “local controversy” exceptions, to jurisdiction under CAFA apply.” (ECF No. 26 at 16, ECF NO. 37 at 2). In Response, Plaintiffs argue that Defendant has not met its burden to prove that either the home state exception or the local controversy exception applies, arguing that “Defendant has not submitted any evidence to support that contention.” (ECF No. 36 at 10-13) (citing, inter alia, Ellis v. Montgomery Cnty., 267 F. Supp.3d 510, 516 (E.D. Pa. 2017). Inits Reply, Defendant addresses this evidentiary concern. “Courts may consider pleadings as well as evidence that the parties submit to determine whether subject matter jurisdiction exists, or an exception thereto applies.” Whitaker v. Herr Foods, Inc., 198 F. Supp. 3d 476, 482 (E.D. Pa.
2 There is no allegation or dispute that there have been no other class actions filed against Defendant on this issue in the preceding three years, and further, that Defendant is a citizen of Pennsylvania. 11
2016) (quoting Vodenichar, 733 F.3d 497, 503 n. 1)). This is a “factual” attack, because while the
pleadings themselves may facially establish jurisdiction, Defendant argues that one or more of the factual allegations is untrue, causing the case to fall outside the court’s jurisdiction. Constitution Party of Pennsylvania, 757 F.3d at 358. Defendant argues that data supports the reasonable presumption that more than two-thirds of the proposed class are Pennsylvania citizens, (ECF No. 37 at 5-6), and attaches two affidavits, sworn pursuant to 28 U.S.C. 1746: (1) affidavit of David Trudell, Director of Marketing, Communication and Sales for Defendant, (ECF No. 37-1), and (2) affidavit of Marcy Little, System Director, Corporate Analytics for Defendant. (ECF No. 37-2). Trudell states that Defendant at all times relevant hereto, was a healthcare delivery system comprised of eight hospitals and providers operating in twenty-six counties in central and western Pennsylvania, and further, does not have any medical facilities located outside of Pennsylvania. (ECF No. 37-1 {§ 4- 5). In addition, Trudell states that during the at-issue period, Defendant utilized analytical tools that could identify the states from which a website user’s IP address originated from and performed a lookback to identify the percentage of users by state that visited the Find a Doctor page on phhealthcare.org. Id. J] 6-7. The data reflects 78.8% of all IP addresses for Find a Doctor webpage visitors originated in Pennsylvania, with the combination of website visitors from New York, Ohio, and West Virginia only at 6.55% of all total users. Jd. J 8-10. As to those users who actually used the Find a Doctor interface, the originating state for IP addresses for those users were 81.24% in Pennsylvania and the combination for New York, Ohio, and West Virginia being only 5.22% of all total users. Jd. JJ 11-13. These analytics show that more than two-thirds of all IP addresses originated in Pennsylvania. Jd. 414. Next, Little states that Defendant performed analytics on the demographic makeup of actual patient encounters at its facilities. During the two-year period at
issue, Defendant tracked the percentage of patients by state that sought medical care at one of Defendant’s hospitals. The data reflects that 99.1% of all patient encounters are from Pennsylvania residents and only .9% of all patient encounters are from non-Pennsylvania residents. (ECF No. 37-2 ¥{ 9-10). While initially compelling, the Court is persuaded by Plaintiffs’ argument that these analytics and statements do not accurately reflect the class definition here. Plaintiffs filed this □ lawsuit on behalf of “fa]ll individuals who visited the [Defendant’s] website in the last two years and had their private medical and other personal information shared with Google without providing consent.” (ECF No. 1 at 24) (emphasis added). As Plaintiffs’ aptly note, Little reported data on the Defendant’s patients, rather than its website users. (ECF No. 43 at 4) (citing ECF No. 37-2 at 6). Presumably, not all patients used the website, and some non-Pennsylvania website users were never patients. As for Trudell’s statement, he limited his data to those who used the Find a Doctor function and those who used Find a Doctor plus a search feature. (ECF No. 37-1 at ff 7, 11). Plaintiffs’ complaint, however, alleges that website users who used the search bar feature on Defendant’s homepage had their private medical and personal information shared with Google. (ECF No. 37 at {§ 31, 71, 73, 83, 85). Understandably, Defendant limited its data as it did because, broadly speaking, the Complaint emphasizes the use of the Find the Doctor function, (see, e.g., ECF No. 1 at 20-31), however, the Plaintiffs are correct that their allegations are broader. Accordingly, the Court finds that, at this juncture in the proceedings, without a more fulsome record on the critical question of jurisdiction, Defendant has not met its burden with respect to the applicability of either the home state exception or the local controversy exception, each of which require a showing that greater than two-thirds of the putative class are citizens of the state in which the action was originally filed. The Motion to Dismiss is denied in this regard.
In the event Plaintiff seeks leave to amend, and this matter proceeds further, record evidence may support a different conclusion, and the Court can revisit the jurisdictional issue, if appropriate. B. Motion to Dismiss for Failure to State a Claim Under 12(b)(6) Next the Court addresses Defendant’s Motion to Dismiss on the grounds Plaintiffs have failed to plead a claim under WESCA. To establish a violation of WESCA, a plaintiff must show: (1) that [the claimant] engaged in a communication; (2) that he possessed an expectation that the communication would not be intercepted; (3) that his expectation was justifiable under the circumstances; and (4) that the defendant attempted to, or successfully intercepted the communication, or encouraged another to do so. Emmett v. Delta Air Lines, Inc., No. 2:22-1568, 2024 WL 2816502, at *7 (W.D. Pa. June 3, 2024) (citing Kelly v. Carlisle, 622 F.3d 248, 257 (3d Cir. 2010) and quoting Agnew v. Dupler, 553 Pa. 33, 717 A.2d 519, 522 (Pa. 1998)). Defendant argues that Plaintiffs have failed to allege’ that Plaintiffs had an expectation of privacy/non-interception in their communication under the circumstances, and further, that any private information was intercepted or disclosed. (ECF No. 26 at 20-23. Defendant does not dispute that Google Analytics was embedded on its website, or that it was used to collect and transmit the information of the website user. As to the second and third element, Defendant argues that the voluntary transmission of an IP address is not a private communication and thus is not a violation of WESCA, citing, inter alia, Commonwealth v. Kurtz, 294 A.3d 509, 521 (Pa. Super. 2023). Defendant then argues that no private medical or personal information was intercepted or disclosed, citing, inter alia, Santoro v. Tower Health, No. CV 22-4580, 2024 WL 1773371, at *1 (E.D. Pa. Apr. 24, 2024). Plaintiffs allege that Defendant intercepted their communications that contained private
3 Plaintiffs have sufficiently alleged element one. (ECF No. | at §¥ 68-72, 80-84). Defendant does not contest this. ECF No. 26 at 13-14). 14
medical information as follows. Defendant intercepted “information submitted by [Plaintiffs] through the search bar (e.g., doctor, specialty, type of treatment, etc.” (ECF No. 1 at §31). Plaintiffs allege the interception of “sensitive medical and other personal information” when using the search bar on Defendant’s website, “including [Plaintiffs’] medical diagnosis, conditions and symptoms” (id. at J§ 71, 83), as well as Plaintiffs’ “IP addresses.” (/d. at J] 22, 31, 69, 71, 81, 83). Plaintiffs further allege that their sensitive medical and other personal information, “including the types of medical treatment [sought] through [Defendant], the type of provider (i.e., physician, nurse practitioner, etc.), specialty and name of the providers with whom [they sought] treatment with, the locations of the [Defendant] facilities [they chose] to go to and if [they searched] for [Defendant] providers by specific gender,” was intercepted through the website’s “Find a Doctor” feature. (/d. at Ff 69, 81). Plaintiffs allege that Defendant also unlawfully intercepts and shares all Uniform Resource Locators (“URLs”) from Plaintiffs’ interactions and communications on its website, which allows Google to intercept information on each and every webpage viewed by Plaintiffs and every other individual website user of Defendant. (/d. at 4] 27-28, 30-31). WESCA prohibits the interception of any wire, electronic or oral communication and the intentional disclosure of the “contents” of the communication. 18 Pa. Cons. Stat. § 5725. “Contents” is defined as “any information concerning the substance, purport, or meaning of that communication.” 18 Pa. Cons. Stat. § 5702; (ECF No. 1 4 105). Accordingly, Plaintiffs allege that “Plaintiffs’ and Class members’ intercepted PHI and other personal information constitute the ‘contents’ of ‘electronic communication[s]’ within the meaning of WESCA.” (d.)., The HIPAA regulation define individually identifiable health information as “information that is a subset of health information, including demographic information collected from an individual, and: (1) [] created or received by a health care provider ... and (2) [rJelates to the past,
present, or future physical or mental health or condition of an individual; the provision of health care to an individual ... and (i) [t]hat identifies the individual; or (ii) [w]ith respect to which there is a reasonable basis to believe the information can be used to identify the individual.” 42 U.S.C. § 1320d-6(a)(3). Defendant’s reliance on Santoro is compelling. In Santoro, 2024 WL 1773371, at *4, the Court dismissed Plaintiff's claim for violation of the Federal Wiretap Act, 18 U.S.C. § 2510, in which plaintiff alleged Defendant shared HIPAA protected information to a third-party. In that case, Plaintiffs maintained that defendant regional healthcare provider, Tower Health, installed Meta Pixel software on its public website, which is a small piece of code that records information about visitors’ activity on a particular webpage. Jd. at *1. Plaintiffs maintained that the information included content specific to the user such as IP addresses and Facebook IDs, and tracked what visitors did on that webpage, including how much time the users spent there or what links they clicked. Id. The Meta Pixel would then transmit the recorded information to Meta, which was analyzed for its own commercial purposes, including building a comprehensive profile of the individual user to better target advertisements. /d. The court reasoned: As best as we can tell from the allegations and undisputed representations, whether individually identifiable health information is intercepted could depend upon how the particular user interacts with the website, including how long they spend on a page, what links are clicked on, and what search terms they input—as well as the nature of the user's health condition and treatment plan. We need not define what constitutes HIP[A]A-protected information or otherwise flesh out plaintiffs’ speculation. It is plaintiffs’ responsibility to make factual allegations that plausibly state a claim for relief, and they have not done so here . . . For that reason, we conclude that plaintiffs fail to state a claim for a violation of the Wiretap Act. Id. at *5. This case is persuasive, despite Plaintiffs’ objection that the Federal Wiretap Statute was the purported cause of action. (ECF No. 48 at 2-3). WESCA is Pennsylvania's state law equivalent
to the Federal Wiretap Act. See Popa v. Harriet Carter Gifts, Inc., 52 F Ath 121, 125 (3d Cir. 2022) (explaining WESCA “operates in conjunction with and as a supplement to the Federal Wiretap Act, 18 U.S.C. § 2510, which provides uniform minimum protections for wire, electronic, or oral communications”). “Because the relevant provisions and statutory definitions (e.g., “intercept” and “contents”) from [WESCA] are identical to those in the [Federal Wiretap Act, 18 U.S.C. § 5725(a)], the Court can look to decisions applying those provisions and definitions for guidance.” Cook v GameStop Inc., 689 F. Supp. 3d 58, 68 n. 6. Plaintiff argues that the Courts should adopt the reasoning in Emmett v. Delta Airlines, Inc., No. 2:22-1568, 2024 WL 2816502 (W.D. Pa. June 3, 2024) (Colville, J.) That case, however, addressed the data collected by Session Replay Code, which identified all website visitor actions; under those circumstance, Plaintiff had a justifiable expectation that his keystroke and mouse movant activity on Defendant’s website was not being recorded. Jd. at *9. Here, the interception of Plaintiff's individually identifiable health information depends on how the particular user interacts with the website. Like the Plaintiff in Santoro, here Plaintiffs have failed to allege with any particularity that there was a HIPAA violation. Plaintiffs do not allege what information was searched, what PHI was disclosed, what confidential diagnoses were revealed, or that a particular medical condition was scheduled through the application, or how their inputted information relates to Plaintiffs’ own medical care and diagnoses. “The specifics are essential to convert a case like this from a law-school hypothetical to an actionable dispute.” Santoro, 2024 WL 1773371, at * 1.
IV. Conclusion For the reasons stated above, Defendant’s Motion to Dismiss (ECF No. 25) will be granted without prejudice. An appropriate Order will be entered. A ~~ A Ney . hk feo. Cf OS ge 1a SORE Lae □□□ Dated: February 9, 2026 uf df fied PHN Lie Steplianie L. Haines United States District Judge
cc/ecf: All counsel of record