M.G. v. Therapymatch, Inc.

Opinion

M.G., Case No. 23-cv-04422-AMO

Plaintiff, ORDER DENYING MOTION TO v. DISMISS

THERAPYMATCH, INC., Re: Dkt. No. 57 Defendant.

This is a data privacy lawsuit alleging unauthorized interception and collection of information provided via an online platform for individuals to search for and connect with mental health providers. Before the Court is Defendant’s motion to dismiss Plaintiff’s third amended complaint (“TAC”). ECF 57. The motion is fully briefed, and because it is suitable for decision without oral argument, the hearing set for May 22, 2025 is hereby VACATED. See Civ. L.R. 7-6. This Order assumes familiarity with the facts and procedural history of this case. Having read the papers filed by the parties and carefully considered the arguments therein, as well as the relevant legal authority, the Court hereby DENIES the motion for the following reasons. On November 6, 2024, Plaintiff M.G. filed the operative TAC. ECF 54. On December 6, 2024, Defendant Therapymatch, Inc. d/b/a Headway (“Headway”) moved to dismiss the TAC for failure to state a claim. ECF 57. Under Rule 12(b)(6) of the Federal Rules of Civil Procedure, a complaint may be dismissed for failure to state a claim for which relief may be granted. Fed. R. Civ. P. 12(b)(6). Rule 12(b)(6) requires dismissal when a complaint lacks either a “cognizable legal theory” or “sufficient facts alleged” under such a theory. Godecke v. Kinetic Concepts, Inc., factual allegations depends on whether it pleads enough facts to “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 678. When evaluating a motion to dismiss, the court “accept[s] factual allegations in the complaint as true and construe[s] the pleadings in the light most favorable to the nonmoving party.” Manzarek, 519 F.3d 1025, 1031 (9th Cir. 2008). However, “allegations in a complaint . . . may not simply recite the elements of a cause of action [and] must contain sufficient allegations of underlying facts to give fair notice and to enable the opposing party to defend itself effectively.” Levitt v. Yelp! Inc., 765 F.3d 1123, 1135 (9th Cir. 2014) (citations omitted). The Court may dismiss a claim “where there is either a lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal claim.” Hinds Invs., L.P. v. Angioli, 654 F.3d 846, 850 (9th Cir. 2011). Headway moves to dismiss M.G.’s claims alleging violations of the Confidentiality of Medical Information Act (“CMIA”) and the California Consumer Privacy Act (“CCPA”).1 Each is discussed below. A. Confidentiality of Medical Information Act M.G. alleges that Headway violated California Civil Code §§ 56.10, 56.06, and 56.101. Section 56.101 states that “[a]ny provider of health care . . . who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information shall be subject to the remedies and penalties” provided under Section 56.36(b)-(c). Cal. Civ. Code § 56.101. Section 56.10 prohibits “provider[s] of health care” from “disclos[ing] medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization.” Section 56.06 defines “provider of health care,” while

1 The Court granted Headway’s motion to dismiss M.G.’s CMIA claims in the first amended Section 56.10 dictates, in pertinent part, that a provider of health care “shall not disclose medical information regarding a patient . . . without first obtaining an authorization . . . .” Section 56.36 provides statutory damages of up to $1,000 for violations of the CMIA. Cal. Civ. Code § 56.36(b)(1). Headway argues the TAC fails to allege any medical information or records were transmitted to Google or that anyone viewed any medical information. Mot. at 12-17. The CMIA defines “medical information” as “individually identifiable information . . . regarding a patient’s medical history, mental health application information, mental or physical condition, or treatment.” Cal. Civ. Code § 56.05(i); see Eisenhower Med. Ctr. v. Superior Ct., 226 Cal. App. 4th 430, 434 (2014) (“ ‘[M]edical information’ as defined under the CMIA is substantive information regarding a patient’s medical condition or history that is combined with individually identifiable information.”). “Mental health application information” means information “related to a consumer’s inferred or diagnosed mental health or substance abuse disorder . . . .” Cal. Civ. Code § 56.05(j). “This definition does not encompass demographic or numeric information that does not reveal medical history, diagnosis, or care,” and “the mere fact that a person may have been a patient at the hospital at some time is not sufficient” without “substantive information regarding that person’s medical condition, history, or treatment.” Eisenhower, 226 Cal. App. 4th at 435. The use of a patient portal to “schedule appointments, refill prescriptions, and to view [] test results and appointment notes,” however, constitutes “medical history, diagnosis, or care.” B.K. et al, v. Desert Care Network, Desert Regional Medical Center, Inc. et al, No. 223-CV-05021-SPGPDX, 2024 WL 1343305, at *5 (C.D. Cal. Feb. 1, 2024); see also Tamraz v. Bakotic Pathology Assocs., LLC, No. 22-CV-0725-BASWVG, 2022 WL 16985001, at *5 (S.D. Cal. Nov. 16, 2022). The Court previously dismissed M.G.’s CMIA claim because the FAC failed to allege “substantive information” regarding M.G.’s “medical condition, history, or treatment.” Order at 5. M.G. has cured that deficiency in the TAC.2 Therein, M.G. alleges he provided Headway with 2 M.G. filed a second amended complaint on October 16, 2024, asserting new factual allegations. ECF 49. On October 29, 2024, the parties filed a stipulation requesting that M.G. be allowed to information about the symptoms he was experiencing, the mental health issues for which he sought treatment, the type of therapy he sought, his preferred type of therapy, and his preferred qualities for a therapist. TAC ¶¶ 11-12. He avers that when prompted, he disclosed that “he was suffering from stress, trauma, and past abuse,” and “described his symptoms and indicated he was experiencing depression, anxiety, stress, and lack of sleep.” TAC ¶ 11. M.G. further disclosed that “his reasons for seeking mental health services and treatment were related to his stress at work and marital issues with his spouse.” Id. He also selected options indicating his preference for general therapy with a female therapist of color located in his area who offered online therapy sessions. TAC ¶ 12. These allegations constitute “substantive information” regarding M.G.’s “medical history, diagnosis, or care” as the CMIA requires. See R.C. v. Sussex Publishers, LLC, No. 24-CV-02609-JSC, 2025 WL 948060, at *5 (N.D. Cal. Mar. 28, 2025) (finding information constituted “medical history, diagnosis, or care” where plaintiffs searched for therapists on website by selecting filters that reflected their symptoms, the type of therapy they sought, and their preferred gender, race, and faith for their therapist). And because M.G. alleges he concurrently inputted individually identifiable information, including his name, address, cell phone number, age, marital status, ethnicity, religion, occupation, employer, income range, and insurance information, TAC ¶¶ 9-10, he has sufficiently alleged that he provided “medical information” as defined by the CMIA. See St. Aubin v. Carbon Health Techs., Inc., No. 24-CV-00667-JST, 2024 WL 4369675, at *9 (N.D. Cal. Oct. 1, 2024) (finding disclosure of the reason patients booked a medical appointment and their identifiable information constituted disclosure of “medical information” under the CMIA). M.G. has also sufficiently alleged that his medical information was improperly viewed. Under the CMIA, a plaintiff must allege “the information was ‘improperly viewed or otherwise accessed.’ ” Stasi v. Inmediata Health Group Corp., 501 F. Supp. 3d 898, 922 (S.D. Cal. 2020) (citing Regents of University of California v. Superior Court, 220 Cal. App. 4th 549, 553-54 (2013)). That is, a plaintiff must “show[] that an unauthorized party viewed the confidential information.” Vigil v. Muir Med. Grp. IPA, Inc., 84 Cal. App. 5th 197, 231 (2022). The TAC alleges that Google accessed M.G.’s information and that of the putative class members, then “used [it] for its own purposes, including improving Google’s advertising and analytics services offerings and revenue,” TAC ¶ 123, by “measur[ing] the effectiveness of advertising and personaliz[ing] content and ads that one sees on Google’s and its partners’ sites and applications,” TAC ¶ 31; see also TAC ¶¶ 15, 42. Accepting M.G.’s allegations as true and viewing them in the light most favorable to him, the Court finds M.G. has alleged that Google “viewed or otherwise accessed” his information in violation of CMIA. Stasi, 501 F. Supp. 3d at 922; see also R.C., 2025 WL 948060, at *5 (finding plaintiffs sufficiently alleged unlawful viewing where they alleged Google collected information and used it for its marketing and analytics services); Cousin v. Sharp Healthcare, 702 F. Supp. 3d 967, 975 (S.D. Cal. 2023) (denying motion to dismiss CMIA claim and finding it was “sufficiently plausible” that plaintiffs’ information was “viewed or otherwise accessed” as defined by the CMIA where plaintiffs alleged upon information and belief that “Meta regularly viewed” the information and that Meta’s business model involves using the information for targeted advertising). Because the TAC plausibly alleges that Google viewed or accessed M.G.’s medical information, Headway’s motion to dismiss M.G.’s CMIA claim is DENIED. B. California Consumer Privacy Act Headway also moves to dismiss M.G.’s second cause of action for violation of the CCPA. Mot. at 17. However, the Court already denied a motion by Headway to dismiss this claim, see Order at 14, and Headway cannot now raise an objection that was available to it previously, Fed. R. Civ. P. 12(g)(2) (“Except as provided in Rule 12(h)(2) or (3), a party that makes a motion or objection under this rule must not make another motion under this rule raising a defense or objection that was available to the party but omitted from its earlier motion.”); see also Niantic, Inc. v. Global++, No. 19-CV-03425-JST, 2020 WL 8620002, at *3 (N.D. Cal. Sept. 2, 2020) (noting a defendant “cannot bring a second motion to dismiss challenging a claim that is ‘based on substantially the same allegations in the amended complaint and the original complaint’ ”) (citing 1 (S.D. Cal. Aug. 15, 2019)).? Although some courts have exercised their discretion to consider 2 motions barred by Rule 12(g)(2) on the merits where it would serve the interests of judicial 3 economy, see LLE One, LLC v. Facebook Inc., No. 16-CV-06232-JSW, 2019 WL 13201973, at *4 4 (N.D. Cal. Apr. 25, 2019), Headway has not shown why such an exercise of discretion is 5 warranted here. Thus, Headway may not again challenge M.G.’s CCPA claim and its motion to 6 dismiss that cause of action from the TAC is DENIED. 7 IL CONCLUSION 8 For the foregoing reasons, Headway’s motion to dismiss is DENIED. As Headway’s 9 request for judicial notice corresponds to its motion to dismiss M.G.’s CCPA claim, it is thus 10 DENIED as moot. The Court SETS an initial case management conference for July 10, 2025. 11 The parties SHALL file a case management statement by noon on July 2, 2025. 12

IT IS SO ORDERED.

14 Dated: May 19, 2025 Wed 15 coh: 2 ARACELI MARTINEZ-OLGUIN a 16 United States District Judge

= 17

Z 18 19 20 21 22 23 24 25 3 Although M.G. did not list § 1798.150 in the heading of the cause of action in the FAC, he did 26 discuss it in the body of the FAC, which was enough to put both Headway and the Court on notice of his claim under that section. See Mot. to Dismiss the FAC (ECF 20) at 13 (noting “Plaintiff 07 asserts .. . violations of §1798.150(a) of the CCPA . . .”); Order at 14 (“Although M.G. lists only CCPA subsections 1798.100(e) and 1798.81.5(b) in the heading of the cause of action, he includes section 1798.150 in the body of the FAC. .. . Thus, the Court addresses whether M.G. has stated a 28 . Section 1798.150 claim.”).