McManus v. Tufts Medical Center, Inc.

• Court: District Court, D. Massachusetts
• Decided: September 29, 2025
• Docket: 1:25-cv-10008
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

* KAREN MCMANUS, on behalf of herself * and all others similarly situated, * * Plaintiff, * * v. * Civil Action No. 25-cv-10008-ADB * * TUFTS MEDICAL CENTER, INC., * * Defendant. * *

MEMORANDUM AND ORDER

BURROUGHS, D.J.

Plaintiff Karen McManus (“Plaintiff”) brings this putative class action, on behalf of herself and all others similarly situated, against Defendant Tufts Medical Center, Inc. (“Defendant” or “Tufts Medical Center”) alleging violations of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. §§ 2510–2523, and the Massachusetts Right to Privacy Act, M.G.L. c. 214 § 1B, as well as a breach of fiduciary duty, negligence, breach of confidence, breach of contract, and unjust enrichment. [ECF No. 1-31 (“Amended Complaint” or “Am. Compl.”)]. Before the Court is Defendant’s motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim. [ECF No. 15]. For the reasons stated below, Defendant’s motion is GRANTED. I. BACKGROUND The following relevant facts are taken from the Amended Complaint, the factual allegations of which the Court assumes to be true when considering a motion to dismiss. Ruivo v. Wells Fargo Bank, N.A., 766 F.3d 87, 90 (1st Cir. 2014). As it may on a motion to dismiss,

the Court has also considered “documents incorporated by reference in [the complaint], matters of public record, and other matters susceptible to judicial notice.” Giragosian v. Ryan, 547 F.3d 59, 65 (1st Cir. 2008) (alteration in original) (quoting In re Colonial Mortg. Bankers Corp., 324 F.3d 12, 20 (1st Cir. 2003)). A. Factual Background Plaintiff is a Massachusetts resident and patient of Tufts Medical Center, a hospital and full-service medical center located in Boston, Massachusetts. [Am. Compl. ¶¶ 12, 17]. Tufts Medical Center maintains a website, https://tuftsmedicalcenter.org/, where health care consumers can search for information about its doctors and medical services across its various specialties. [Id. ¶¶ 17–18]. The website also provides access to the myTuftsMed Patient Portal, which

allows health care consumers, such as Plaintiff, to access their private medical information. [Id. ¶ 19]. During the purported class period, the website’s published privacy policy stated, All visitors use the Tufts Medical Center websites anonymously. We do not collect any identifiable information unless you specifically provide us with that information voluntarily through our forms such as request appointment forms, e- newsletter sign-ups, clinical trial enrollment, etc. . . . Tufts Medical Center does not and will never sell or rent any identifiable information to third party vendors. [Am. Compl. ¶ 26]. Plaintiff alleges that these statements were false, as website users did not access the website anonymously. [Id. ¶ 27]. Specifically, Plaintiff asserts that because Tufts Medical Center used tracking technologies on its website, third parties such as Facebook and 2 Google were able to intercept communications between website users and Tufts Medical Center. [Id. ¶ 27]. Those third parties, “in exchange” for those communications, provided services such as website analytics and targeted advertising, the latter of which was made possible by the fact that the tracking technologies allowed the third parties “to associate . . . intercepted

communications with the real-world identities of . . . individuals.” [Id. ¶¶ 27–28]. Because of Tufts Medical Center’s conduct, “Plaintiff and Class Members face ongoing unwanted targeted advertisements based upon the improperly intercepted and disclosed Private Information.” [Id. ¶ 143]. Plaintiff did not know about or consent to the interception of her information on Tufts Medical Center’s website. [Id. ¶¶ 14, 30, 103]. B. Procedural History Plaintiff initially filed this putative class action in Suffolk Superior Court on April 19, 2023. [ECF No. 1 at 2]. Defendant filed a notice of removal to the United States District Court on May 16, 2023. [ECF No. 1-7]. The case was remanded back to the state court on July 18, 2023. [ECF No. 1-16]. Thereafter, Plaintiff filed the Amended Complaint on December 12,

2024, which, as relevant here, included a new ECPA claim against Tufts Medical Center. [Am. Compl. ¶¶ 152–72]. Defendant again removed the case to federal court. [ECF No. 1]. On February 10, 2025, Defendant filed the instant motion to dismiss the Amended Complaint, [ECF No. 15], which Plaintiff opposed on March 7, 2025, [ECF No. 18]. Defendant filed a reply on March 28, 2025. [ECF No. 19]. II. LEGAL STANDARD On a motion to dismiss pursuant to Rule 12(b)(6), the Court must accept as true all well- pleaded facts, analyze them in the light most favorable to the plaintiff, and draw all reasonable inferences from those facts in favor of the plaintiff. United States ex rel. Hutcheson v.

3 Blackstone Med., Inc., 647 F.3d 377, 383 (1st Cir. 2011). Additionally, “a court may not look beyond the facts alleged in the complaint, documents incorporated by reference therein and facts susceptible to judicial notice.” MIT Fed. Credit Union v. Cordisco, 470 F. Supp. 3d 81, 84 (D. Mass. 2020) (citing Haley v. City of Bos., 657 F.3d 39, 46 (1st Cir. 2011)). “[A] complaint must

provide ‘a short and plain statement of the claim showing that the pleader is entitled to relief,’” Cardigan Mt. Sch. v. N.H. Ins. Co., 787 F.3d 82, 84 (1st Cir. 2015) (quoting Fed. R. Civ. P. 8(a)(2)), and set forth “factual allegations, either direct or inferential, respecting each material element necessary to sustain recovery under some actionable legal theory,” Pitta v. Medeiros, 90 F.4th 11, 17 (1st Cir. 2024) (quoting Gagliardi v. Sullivan, 513 F.3d 301, 305 (1st Cir. 2008)). Although detailed factual allegations are not required, a complaint must set forth “more than labels and conclusions,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007), and “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice,” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Rather, a complaint “must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is

plausible on its face.’” Id. (quoting Twombly, 550 U.S. at 570). III. DISCUSSION The Court focuses its discussion on Count I of the Amended Complaint, which asserts a violation of the ECPA, as this Count is the basis for federal jurisdiction. The ECPA prohibits any person from intentionally intercepting, endeavoring to intercept, or procuring any other person to intercept or endeavor to intercept any wire, oral, or electronic communication. Id. § 2511(1). A party can generally avoid liability under the ECPA if they are “a party to the [intercepted] communication,” id. § 2511(2)(c)–(d), unless, under what is known as the crime-tort exception, the “communication is intercepted for the purpose of committing any

4 criminal or tortious act in violation of the Constitution or laws of the United States or of any State,” id. § 2511(2)(d). The parties’ dispute as concerns the ECPA turns on whether the crime-tort exception applies. Plaintiff argues that Tufts Medical Center is liable under the ECPA because the crime-

tort exception applies to its conduct implicating, most particularly, the Health Insurance Portability and Accountability Act (“HIPAA”). See [Am. Compl. ¶¶ 163–70]. Tufts Medical Center argues the opposite. [ECF No. 16 at 14–16]. The crime-tort exception’s “purpose” language requires Plaintiff to plausibly allege that Tufts Medical Center “inten[ded] to commit a criminal or tortious act” and that committing such a criminal or tortious act was its “primary motivation” or a “determinative factor” in its decision to intercept health care consumers’ communications. Goulart v. Cape Cod Healthcare, Inc., No. 25-cv-10445, 2025 WL 1745732, at *3 (D. Mass. June 24, 2025) (quoting United States v. McHugh, 57 F. Supp. 3d 95, 99–100 (D. Mass. 2014)); see also United States v. Vest, 639 F. Supp. 899, 904 (D. Mass. 1986), aff’d, 813 F.2d 477 (1st Cir. 1987) (discussing the crime-tort

exception in the context of a motion to suppress evidence and explaining that, “properly interpreted, § 2511(2)(d) forbids the recording of communications . . . when it is shown either (1) that the primary motivation, or (2) that a determinative factor in the actor’s motivation for intercepting the conversation was to commit a criminal, tortious, or other injurious act”). Here, the Amended Complaint does not assert facts sufficient to support the inference that Tufts Medical Center intended to commit a criminal or tortious act or that disclosing private medical information to third parties was the “primary motivation” or a “determinative factor” in Tufts Medical Center’s decision to record health care consumers’ communications using various

5 tracking technologies. See Iqbal, 556 U.S. at 678–79 (describing the “factual content” required by the plausibility standard). For example, Plaintiff’s allegations, including that “hidden code enabled Google, Facebook, and other third parties to eavesdrop on healthcare consumers’ communications with

Tufts Medical Center,” [Am. Compl. ¶ 2], that “after Tufts Medical Center intercepted communications, the intercepted information was, in turn, used by third parties,” [id. ¶ 160], and that Tufts Medical Center removed its privacy policies and some tracking technologies from its website shortly after the filing of Plaintiff’s initial complaint, [id. ¶¶ 4, 25–27, 29–30, 62–64, 76, 86], are not sufficient to support the inference that Defendant’s purpose was to engage in conduct made impermissible by relevant statutes such as HIPAA or the FTC Act, [id. ¶ 163]. Cf. Williams v. TMC Health, No. 23-cv-00434, at 6–7 (D. Ariz. Aug. 19, 2025) (“In addition to explaining more about how the technology served a separate criminal purpose, Plaintiffs allege Defendant was on notice regarding how data containing health information may be disclosed or used if tracking technologies were embedded on their website. Therefore, they have plausibly

alleged Defendant intercepted their information with the purpose of violating HIPAA.”) (internal citations omitted). Plaintiff’s assertions regarding Tufts Medical Center’s financial motives, namely that it “specifically used tracking technologies to intercept and disclose Plaintiff’s and Class Members’ Private Information for financial gain,” [Am. Compl. ¶ 168], sought to “increase revenue from existing patients and gain new patients,” [id. ¶ 170], and thus “chose to put its business interests

6 over the privacy of its patients,” [id. ¶¶ 2–6, 28, 208], are similarly insufficient to satisfy the crime-tort exception.1 In sum, because the Amended Complaint fails to plausibly allege that Tufts Medical Center’s “intent to commit a criminal or tortious act” was its “primary motivation” or a

1 The Court recognizes that other courts have found that similar allegations about a party’s financial motives were sufficient to negate the application of the crime-tort exception. See Goulart, 2025 WL 1745732, at *3–4 (dismissing ECPA claim because the complaint “fail[ed] to plausibly allege that [Defendant Cape Cod Healthcare, Inc.’s] ‘primary motivation’ or ‘determinative factor’ in disclosing plaintiffs’ personal health information . . . to Facebook and Google was for the purpose of committing a criminal violation or tort, as opposed to commercial gain or convenience” and explaining that “commercial purposes or advantages are not the stuff of which a crime-tort is made”); In re DoubleClick Inc. Priv. Litig., 154 F. Supp. 2d 497, 518–19 (S.D.N.Y. 2001) (dismissing ECPA claim upon finding that defendant’s “purpose has plainly not been to perpetuate torts on millions of Internet users, but to make money by providing a valued service to commercial Web sites”); Roe v. Amgen Inc., No. 2:23-CV-07448, 2024 WL 2873482, at *6 (C.D. Cal. June 5, 2024), reconsideration denied sub nom., Doe v. Amgen, Inc., No. 2:23- CV-07448, 2024 WL 3811251 (C.D. Cal. Jan. 29, 2024) (“[T]he crime-tort exception is inapplicable where a defendant’s primary motivation is to make money rather than to injure plaintiffs tortiously or criminally.”). This Court does not believe that the issue is so clear-cut, as “[t]he existence of a financial motivation (on the one hand) and a criminal or tortious motivation (on the other hand) are not mutually exclusive. After all, lots of crimes and torts are money- makers.” Stein v. Edward-Elmhurst Health, No. 23-CV-14515, 2025 WL 580556, at *6 (N.D. Ill. Feb. 21, 2025). The Court notes that the decision that first set forth the “primary motivation or determinative factor” requirement rejected “an absolutist interpretation of the phrase ‘the purpose’ to mean either ‘in any degree’ or ‘the sole’ purpose.” Vest, 639 F. Supp. at 901–08 (explaining that a self-protective purpose does not necessarily negate “a purpose to commit a criminal, tortious, or other injurious act within the meaning of § 2511(2)(d)”), aff’d, 813 F.2d 477 (1st Cir. 1987); see also Stein, 2025 WL 580556, at *6 (“The text [of § 2511(2)(d)] points to the ‘purpose of committing any criminal or tortious act.’ Separating the adjectives from the noun might shed a little light. The purpose must be to commit an act, and that act must be criminal or tortious. If the purpose is to do X, and if X is a crime or a tort, then the crime-tort exception to the one-party consent rule applies. A desire to commit a crime qua crime, or a tort qua tort, isn’t necessary.”) (citation modified). Accordingly, the defendant’s alleged financial motivation does not necessarily defeat the application of the crime-tort exception, if it had the criminal and tortious purpose required by § 2511(2)(d).

7 “determinative factor” in its decision to record health care consumers’ communications, Goulart, 2025 WL 1745732, at *3, Plaintiff’s ECPA claim fails, and Count I is DISMISSED. In light of the dismissal of the ECPA claim, the Court declines to exercise supplemental jurisdiction over the remaining claims, all of which arise under state law. See 28 U.S.C. §

1367(c) (stating that “district courts may decline to exercise supplemental jurisdiction” when “the district court has dismissed all claims over which it has original jurisdiction”); United Mine Workers of Am. v. Gibbs, 383 U.S. 715, 726 (1966) (“It has consistently been recognized that pendent jurisdiction is a doctrine of discretion, not of plaintiff’s right. . . . Needless decisions of state law should be avoided both as a matter of comity and to promote justice between the parties, by procuring for them a surer-footed reading of applicable law. Certainly, if the federal claims are dismissed before trial . . . the state claims should be dismissed as well.”). IV. CONCLUSION For the reasons stated above, Defendant’s motion to dismiss the ECPA claim is GRANTED without prejudice and with leave to amend within 21 days.

SO ORDERED.

September 29, 2025 /s/ Allison D. Burroughs ALLISON D. BURROUGHS U.S. DISTRICT JUDGE