IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA
NANCY MURPHY, et al.
Plaintiffs, v. CIVIL ACTION NO. 22-4674 THOMAS JEFFERSON UNIVERSITY HOSPITALS, INC. Defendant.
MEMORANDUM OPINION Rufe, J. September 30, 2024 Plaintiffs Nancy Murphy and Robert Stewart filed this proposed class action against Defendant Thomas Jefferson University Hospitals, Inc. (“Jefferson Health”) asserting various claims arising out of Defendant’s alleged use of Meta Platforms, Inc.’s (“Meta”) advertising technology on Jefferson Health’s website. Defendant has moved to dismiss these claims. For the reasons explained below, Jefferson Health’s motion will be denied. I. BACKGROUND A. Factual Background1 Jefferson Health is a multi-state non-profit health system based in Philadelphia, Pennsylvania.2 Plaintiffs Nancy Murphy and Robert Stewart have been Jefferson Health patients since before 2018.3 They have created online accounts with the MyJeffersonHealth online portal and the MyJeffersonHealth Mobile Application to communicate with their doctors and other
1 The facts alleged in the Second Amended Complaint are assumed true for purposes of ruling on the motion to dismiss. 2 Second Am. Compl. [Doc. No. 36] at ¶ 154. 3 Second Am. Compl. [Doc. No. 36] at ¶¶ 155, 163. healthcare professionals and departments about their health conditions.4 Plaintiffs allege that at the time they used MyJeffersonHealth, Jefferson Health utilized Meta’s “tracking and collection tools, including the Meta Pixel, Meta SDK, Meta Conversions API, customer list uploads, social plug-ins, the Meta Graph API, and server-to-server transmissions (collectively, the ‘Meta Collection Tools’).”5 Plaintiffs allege that Meta works with healthcare providers, known as
healthcare partners, to use these collection tools to sell targeted advertising based on patients’ online behavior.6 Plaintiffs allege that when a patient uses MyJeffersonHealth, the Meta Collection Tools contemporaneously transmit the following content of their communications to Meta including: (1) signing-up for a patient portal; (2) signing-in or -out of a patient portal; (3) taking actions inside a patient portal; (4) making, scheduling, or participating in appointments; (5) exchanging communications relating to doctors, treatments, payment information, health insurance information, prescription drugs, prescriptions, side effects, conditions, diagnoses, prognoses, or symptoms of health conditions; (6) conduct a search on Jefferson Health’s web properties; and (7) other information that qualifies as “personal health information” under federal and state laws.7
Plaintiffs allege that these tools allow Jefferson Health to intercept individually-identifiable health information (“IIHI”) and monetize this information for Jefferson Health’s financial gain.8 Plaintiffs allege that the information transmitted from Jefferson Health to Meta “always includes information sufficient to uniquely identify a patient under federal law,” including IP address information and device identifiers that Meta associates with a patient’s Meta account (such as Facebook), and may include:
4 Second Am. Compl. [Doc. No. 36] at ¶¶ 156, 164. 5 Second Am. Compl. [Doc. No. 36] at ¶ 1. 6 Second Am. Compl. [Doc. No. 36] at ¶ 3. 7 Second Am. Compl. [Doc. No. 36] at ¶ 5. 8 Second Am. Compl. [Doc. No. 36] at ¶ 1. demographic information, email address, phone number, computer ID address, or contact information entered as emergency contacts or for advanced care planning, along with information like appointment type and date, a selected physician, . . . and information about the substance, purport, and meaning of patient requests for information from Jefferson Health.9
Plaintiffs allege that Meta collects this information and uses cookies to “match it to Facebook users, allowing Jefferson Health to target advertisements on and off Facebook.”10 Jefferson Health’s Notice of Privacy Practices represents that “Jefferson Health understands that information about you and your health is very personal . . . [w]e are required by law to maintain the privacy of our patient’s protected health information.”11 The Notice also represents that should Jefferson Health disclose personal health information for marketing purposes or where remuneration or a sale occurs, Jefferson Health will obtain written authorization from the patient first.12 Plaintiffs allege that when a person visits Jefferson Health’s website, the Meta Collection Tools log which sites a person visits and uses that data to build its profile—for example, a person who visits a tab on Jefferson Health’s website regarding chemotherapy, will have the characteristics and content of this information added to that person’s Meta profile.13 Jefferson Health can then use this data and analysis for its own purpose, including “understanding how people use its website and determining what ads people see on its website.”14 Plaintiffs specifically allege that after interactions with Jefferson Health’s website they were served with advertisements for prescription drugs related to the specific conditions Plaintiffs were being
9 Second Am. Compl. [Doc. No. 36] at ¶ 7. 10 Second Am. Compl. [Doc. No. 36] at ¶ 9. 11 Second Am. Compl. [Doc. No. 36] at ¶ 67. 12 Second Am. Compl. [Doc. No. 36] at ¶¶ 68–69. 13 Second Am. Compl. [Doc. No. 36] at ¶¶ 73–75. 14 Second Am. Compl. [Doc. No. 36] at ¶ 76. treated for, as well as targeted advertisements related to their status as Jefferson Health patients.15 Plaintiffs allege Jefferson Health does not notify users of MyJeffersonHealth that IIHI is being contemporaneously sent to Meta, nor does Jefferson Health notify patients that Meta or Jefferson Health is using this information for commercial purposes.16
B. Procedural Background Plaintiffs initially named both Jefferson Health and Meta as Defendants.17 The case was assigned to the docket of the Honorable Berle M. Schiller.18 Judge Schiller severed the claims against Meta, which were transferred to the Northern District of California for consolidation with In re Meta Pixel Healthcare Litigation.19 Jefferson Health filed a Motion to Dismiss the Amended Complaint under Rule 12(b)(6).20 Judge Schiller granted Jefferson Health’s Motion to Dismiss for failure to state a claim and dismissed Plaintiffs’ Amended Complaint with leave to amend.21 In his opinion, Judge Schiller held that: (1) Plaintiffs did not allege sufficient facts to state an Electronic Communications Privacy Act (“ECPA”) claim; (2) Plaintiffs did not
adequately plead causation and damages to support their negligence claim; and (3) Plaintiffs did not sufficiently plead a claim for intrusion upon seclusion.22 Judge Schiller reviewed Plaintiffs’
15 See Second Am. Compl. [Doc. No. 36] at ¶¶ 158–161; 165–168. 16 Second Am. Compl. [Doc. No. 36] at ¶¶ 78–80. 17 Compl. [Doc. No. 1]. 18 The case was reassigned to the docket of this Court on December 7, 2023. See Order [Doc. No. 42]. 19 Civil Action No. 22-3580 (N.D. Cal. filed June 17, 2022). See Order of Feb. 27, 2023 [Doc. No. 26]. 20 Mot. Dismiss Am. Compl. [Doc. No. 23]. 21 Mem. Op. and Order Oct. 10, 2023 [Doc. Nos. 34 & 35]. 22 Mem. Op. and Order Oct. 10, 2023 [Doc. Nos. 34 & 35]. proposed Second Amended Complaint and determined that it would “not cure the Amended Complaint’s deficiencies,” but granted Plaintiffs further leave to amend their complaint “to the extent they can alleged sufficient facts to state their claims consistent with” the opinion.23 Plaintiffs then filed a Second Amended Complaint, which Defendant has moved to dismiss.24
II. LEGAL STANDARD To survive a motion to dismiss under Rule 12(b)(6), a plaintiff must plead “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”25 The Court must accept as true all factual allegations in the Second Amended Complaint and draw all reasonable inferences in favor of Plaintiffs.26 However, Plaintiffs must plead “more than labels and conclusions,” and “[f]actual allegations must be enough to raise the right to relief above the speculative level.”27 III. DISCUSSION A. Count One – Violation of the ECPA Count One of the Second Amended Complaint asserts a violation of the ECPA.28 The ECPA makes it illegal to intentionally intercept or attempt to intercept any wire, oral, or electronic communication; or to disclose or use the contents of an unlawfully intercepted communication.29 An ECPA claim requires that plaintiff shows that the defendant: “(1)
intentionally (2) intercepted, endeavored to intercept or procured another person to intercept or
23 Mem. Op. Oct. 10, 2023 [Doc. No. 34] at 14. 24 Mot. Dismiss. Second Am. Compl [Doc. No. 39]. 25 Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 556 (2007)). 26 Fed. R. Civ. P. 12(b)(6); Wilson v. USI Ins. Serv. LLC, 57 F.4th 131, 140 (3d Cir. 2023). 27 Twombly, 550 U.S. at 555 (citation omitted). 28 18 U.S.C. § 2510, et seq. 29 18 U.S.C. § 2511(1)(a)-(d). endeavor to intercept (3) the contents of (4) an electronic communication, (5) using a device.”30 The ECPA contains a “party exception” under § 2511(2)(d) which provides that it is not unlawful to intercept the communication when party to the communication.31 A party may not, however, intercept communications “for the purpose of committing any criminal or tortious act.”32 This is referred to as the “crime-tort exception.”33
Defendant argues that Plaintiffs fail to state a claim under the ECPA. First, Defendant argues that Plaintiffs fail to allege any unlawful interception. Second, Defendant argues that Plaintiffs fail to allege Jefferson Health’s purpose was to commit a criminal or tortious act. Third, Defendant argues that Plaintiffs fail to allege any plausible interception of “contents.”34 Because Defendant is a party to the communications with Plaintiffs, Plaintiffs must sufficiently plead that Defendant not only intercepted Plaintiffs’ communications, but that the interception was intentionally criminal or tortious. An interception under the ECPA is defined as “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.”35 “Contents” is defined under the ECPA as including “any
information concerning the substance, purport, or meaning of that communication.”36 “[S]ome queried URLs qualify as content” when the URL conveys “substantive information” regarding
30 Smart v. Main Line Health, No. 22-5239, 2024 WL 2943760, at *3 (E.D. Pa. June 10, 2024) (quoting In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 135 (3d Cir. 2015)). 31 18 U.S.C. § 2511(2)(d). 32 Id. 33 Smart, 2024 WL 2943760, at *3. 34 See Mem. Supp. Mot. Dismiss Second Am. Compl. [Doc. No. 39-1] at 10. 35 In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262, 274–75 (3d Cir. 2016) (citation omitted). 36 18 U.S.C. § 2510(8). web browsing activity.37 A claim that non-substantive contents or information was collected cannot give rise to a claim for interception under the ECPA.38 The Court will therefore address Defendant’s arguments concerning interception and contents together. Plaintiffs assert that the Meta Collection Tools deployed on Defendant’s online portal and
Mobile Application serve as the device to acquire Plaintiffs’ “communications,” namely, their alleged IIHI.39 Defendant argues that where the health care provider was the intended recipient of the communication it could not have intercepted it.40 However, the court in the case on which Defendant relies for this proposition later held that the plaintiffs had stated an ECPA claim when they alleged additional facts that the IIHI that was transmitted included content such as name and location of physician, physician’s specialty, and the plaintiffs’ particular health conditions.41 So too here. In addressing Plaintiffs’ original complaint, Judge Schiller determined that Plaintiffs pleaded insufficient details to support an inference that specific communications were intercepted.42 Plaintiffs now adduce additional facts to support their ECPA claim. Specifically, Plaintiffs allege that Defendant transmitted Plaintiffs’ communications relating to appointments
with medical providers, relating to specific healthcare providers, conditions, treatments, diagnoses, prognoses, prescription drugs, symptoms, insurance, and payment information, as well as messages exchanged in the patient portals.43 Plaintiffs additionally allege that these communications and data were used by Meta to serve Plaintiffs advertisements for prescription
37 Nickelodeon, 927 F.3d at 275 (citation omitted). 38 See id. 39 Second Am. Compl. [Doc. No. 36] at ¶ 192. 40 Mem. Supp. Mot. Dismiss Second Am. Compl. [Doc. No. 39-1] at 6 (citing Kurowski v. Rush Sys. for Health, No. 22-5380, 2023 WL 2349606, at *4 (N.D. Ill. Mar. 3, 2023)). 41 Kurowski v. Rush Sys. for Health, No. 22-5380, 2023 WL 8544084, at *3 (N.D. Ill. Dec. 11, 2023). 42 Mem. Op. Mem. Op. Oct. 10, 2023 [Doc. No. 34] at 6. 43 Second Am. Compl. [Doc. No. 36] at ¶ 190. drugs related to their health conditions in addition to advertisements focused on their status as patients of Jefferson Health.44 By alleging that Defendant was able to collect and transmit this information using the Meta Collection Tools on Defendant’s online portal and Mobile Application, Plaintiffs have sufficiently pleaded that Defendant intercepted contents of Plaintiffs’
communications under the meaning of the ECPA. Finally, Defendant argues that Plaintiffs fail to allege Jefferson Health’s purpose was to commit a criminal or tortious act.45 The Health Insurance Portability and Accountability Act (“HIPAA”) makes it a federal crime to knowingly disclose IIHI to third parties.46 IIHI is defined under HIPAA as: information that is a subset of health information, including demographic information collected from an individual, and: (1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.47
Defendant argues that Plaintiffs have not sufficiently alleged that the intended use of the intercepted content was for a criminal or tortious purpose.48 The Third Circuit has held that in order to invoke the crime-tort exception of the ECPA a plaintiff must plead an intended tortious or criminal use of the acquired information.49 Plaintiffs allege that Defendant intercepted
44 Second Am. Compl. [Doc. No. 36] at ¶ 161, 168. 45 See Mem. Supp. Mot. Dismiss. Second Am. Compl [Doc. No. 39-1] at 7–10. 46 See 42 U.S.C. § 1320d-6. 47 45 CFR § 160.103. 48 Mem. Supp. Mot. Dismiss. Second Am. Compl [Doc. No. 39-1] at 8. 49 In re Google, 806 F.3d at 145. Plaintiffs’ IIHI for the intended use of disclosing the information to Meta, which is a HIPAA violation and therefore prohibited by federal law.50 If Plaintiffs’ allegations are to be taken as true, which the Court must do at the motion to dismiss stage, Defendant at minimum intended to violate HIPAA with the disclosure of Plaintiffs’ IIHI to Meta. Courts have found the intention to violate HIPAA sufficient to invoke the crime-tort exception to the ECPA.51
Defendant additionally argues that financial motives are not sufficient to prove an intent to tortiously injure Plaintiffs.52 But Plaintiffs need not plead financial motive to invoke the crime-tort exception as they have already sufficiently pleaded Defendant’s intention to violate HIPAA. Plaintiffs’ ECPA claim will proceed. B. Count Two – Breach of Contract Count Two of the Second Amended Complaint alleges a claim of breach of contract, which was not asserted in the First Amended Complaint. Defendant first argues that no new claims were permitted under Judge Schiller’s order, and that Plaintiffs’ claim for breach of contract is “not authorized.”53 Defendant does not cite any case law to support this argument. Federal Rule of Civil Procedure 15(c)(1)(B) permits an
amendment to a pleading when “the amendment asserts a claim or defense that arose out of the conduct, transaction, or occurrence set out—or attempted to be set out—in the original
50 See Second Am. Compl. [Doc. No. 36] at ¶ 199; 42 U.S.C. § 1320d-6. 51 See A.D. v. Aspen Dental Management, Inc., No. 24-1404, 2024 WL 4119153, at *3 (N.D. Ill. Sept. 9, 2024); see also Kurowski, 2023 WL 8544084 at *2. 52 Mem. Supp. Mot. Dismiss. Second Am. Compl [Doc. No. 39-1] at 10. 53 Mem. Supp. Mot. Dismiss. Second Am. Compl [Doc. No. 39-1] at 2. pleading.”54 Relation back is proper when “there is a ‘common core of operative facts in the two pleadings,’”55 and there is a “clear preference” in Rule 15 for merits-based decision making.56 Plaintiffs’ breach of contract claim is based on the assertion that Jefferson Health requires patients who use its website to agree to the “Terms and Conditions” to access the site, which incorporates Jefferson Health’s privacy practices.57 They allege that Jefferson Health’s Terms
and Conditions created an express contract, which Jefferson Health breached by disclosing the patient communications containing IIHI.58 Plaintiffs’ claim is based entirely on the same core facts previously alleged in their complaints—namely, the alleged violation of Defendant’s privacy policies and disclosure of Plaintiffs’ communications with Defendant to Meta. Judge Schiller did not bar Plaintiffs from asserting additional bases for relief. The Court will consider this claim on the merits. Under Pennsylvania law, to state a claim for breach of contract, plaintiff must plead: “(1) the existence of a contract, including its essential terms, (2) a breach of the contract; and, (3) resultant damages.”59 Defendant argues that Plaintiffs fail to allege a breach of contract because Plaintiffs do not allege mutual assent to the Terms and Conditions and Privacy Policy.60
Plaintiffs have pleaded that agreement to the Terms and Conditions is a required condition to use
54 Fed. R. Civ. Pro. 15(c)(1)(B). 55 T Mobile Ne. LLC v. City of Wilmington, 913 F.3d 311, 328 (3d Cir. 2019). 56 Id. 57 Second Am. Compl. [Doc. No. 36] at ¶ 211. 58 Second Am. Compl. [Doc. No. 36] at ¶¶ 212–16. 59 DelphX Corp. v. Fondren, 600 F. Supp. 3d 540, 547–48 (E.D. Pa. 2022) (quoting Meyer, Darragh, Buckler, Bebenek & Eck, P.L.L.C. v. L. Firm of Malone Middleman, P.C., 137 A.3d 1247, 1258 (Pa. 2016)). 60 Memo. Supp. Mot. Dismiss. Second Am. Compl [Doc. No. 39-1] at 13. MyJeffersonHealth.61 Under these circumstances, Plaintiffs have plausibly pleaded mutual assent. 62 Defendant further argues that Plaintiffs do not sufficiently allege recoverable damages.63 Plaintiffs allege that they have suffered damages for several reasons, including in particular damages occurring from the loss of value of Plaintiffs’ IIHI.64 “[S]everal courts have recognized
the property value of personal information.”65 The actual value of the damages is not for the Court to determine at a motion to dismiss stage. The Court will deny Defendant’s motion to dismiss Count Two of the Second Amended Complaint. C. Count Three – Negligence Count Three of the Second Amended Complaint alleges a claim for negligence, which requires Plaintiffs to plead: “(1) the existence of a duty or obligation recognized by law; (2) a failure on the part of the defendant to conform to that duty, or a breach thereof; (3) a causal connection between the defendant’s breach and the resulting injury; and (4) an actual loss or damage suffered by the [plaintiff].”66 Defendant’s first argument, relegated to a footnote, is that Plaintiffs have “failed to
sufficiently allege that publication of its privacy policy established a duty of care.”67 Judge Schiller previously held that Plaintiffs had plausibly alleged the existence of a duty of care.68
61 Second Am. Compl. [Doc. No. 36] at ¶ 211. 62 Hutt v. Xpressbet, LLC, No. 20-494, 2020 WL 2793920, at *5 (E.D. Pa. May 29, 2020). 63 Memo. Supp. Mot. Dismiss. Second Am. Compl [Doc. No. 39-1] at 13. 64 Second Am. Compl. [Doc. No. 36] at ¶ 218. 65 Opris v. Sincera Reprod. Med., No. 21-3072, 2022 WL 1639417, at *8 (E.D. Pa. May 24, 2022) (collecting cases). 66 Sullivan v. Truist Bank, No. 23-3363, 2024 WL 422667, at *2 (E.D. Pa. Feb. 5, 2024) (citing Orner v. Mallick, 527 A.2d 521, 523 (Pa. 1987)). 67 Memo. Supp. Mot. Dismiss. Second Am. Compl. [Doc. No. 39-1] at 14 n.3. 68 Mem. Op. Oct. 10, 2023 [Doc. No. 34] at 8. (“[T]he Amended Complaint does plausibly allege Jefferson Health owed Plaintiffs a duty of care via the publication of its privacy policies.”). Defendant provides no new argument or support to justify relitigating this claim, and so the Court sees no reason to revisit it as the allegations of the Second Amended Complaint are as strong, if not stronger on this point. Further, an argument made in a footnote will not be entertained. Plaintiffs have established a duty of care at the motion to dismiss stage.
Defendant next argues that Plaintiffs have failed to allege that Defendant’s alleged disclosures caused them damage or that they incurred any actual loss or injury.69 Plaintiffs have sufficiently pleaded that the disclosure of Plaintiffs’ IIHI to Meta to allow Defendant and Meta to tailor advertisements on their respective web properties impaired Plaintiffs’ control over their IIHI, and would not have occurred without Defendant’s installation of Meta’s Collection Tools MyJeffersonHealth.70 As discussed above, Plaintiffs have sufficiently alleged damages.71 The Court will deny Defendant’s motion to dismiss Count Three of the Second Amended Complaint. D. Count Four – Invasion of Privacy, Intrusion Upon Seclusion Count Four of the Second Amended Complaint alleges intrusion upon seclusion. This is a state law privacy tort that requires plaintiff to show: (1) an intentional intrusion; (2) upon the seclusion of another that is (3) highly offensive to a reasonable person.72
First, Defendant argues that Plaintiffs have not properly pleaded an intrusion upon seclusion claim “because the alleged intrusion, if any, is carried out by a third party, Meta—not
69 Memo. Supp. Mot. Dismiss. Second Am. Compl. [Doc. No. 39-1] at 15. 70 Pls.’ Mem. Opp’n Mot. Dismiss [Doc. No. 43] at 21–22. 71 Supra Section III.B.2. 72 Doe v. Hosp. of Univ. of Pa., 546 F. Supp. 3d 336, 351 (E.D. Pa. 2021); see also Harris by Harris v. Easton Pub. Co., 483 A.2d 1377, 1383 (Pa. 1984) (citing Restatement (Second) of Torts § 652B). by Jefferson Health.”73 Second, Defendant argues that Plaintiffs “fail to plead facts showing that Jefferson Health engaged in ‘highly offensive’ conduct.”74 The Third Circuit has held a website operator commits an intentional intrusion where the website operator tracks plaintiffs’ online behavior “without their permission to do so.”75 The
allegations concerning Defendant’s deployment of the Meta Collection Tools meet this standard.76 Plaintiffs also have alleged that Defendant’s status as their healthcare provider created a reasonable expectation of privacy.77 Defendant argues that courts have held data collection and disclosure to third parties is “routine commercial behavior” that does not constitute highly offensive conduct.78 But the cases Defendant cite to support this proposition appear to be related to collection by LinkedIn and Google, not healthcare providers, and the information alleged to be disclosed was browsing history, not IIHI. Conduct can be considered “highly offensive” when the website stated that it would not collect personal information, therefore creating an expectation of privacy. Plaintiffs have plausibly alleged that Defendant’s status as a healthcare
provider, coupled with the Privacy Policies, created an expectation of privacy that would be “highly offensive” to breach.79 Defendant acknowledges that “the unauthorized disclosure of actual private medical information . . . may certainly constitute ‘highly offensive’ conduct,”80
73 Memo. Supp. Mot. Dismiss. Second Am. Compl. [Doc. No. 39-1] at 16. 74 Memo. Supp. Mot. Dismiss. Second Am. Compl. [Doc. No. 39-1] at 16. 75 In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 293–94 (3d Cir. 2016). 76 Second Am. Compl. [Doc. No. 36] at ¶ 233. 77 Second Am. Compl. [Doc. No. 36] at ¶ 235. 78 Memo. Supp. Mot. Dismiss. Second Am. Compl. [Doc. No. 39-1] at 19–20 (quoting Hammerling v. Google, LLC, 615 F. Supp. 3d 1069, 1090 (N.D. Cal. 2022)). 79 Second Am. Compl. [Doc. No. 36] at ¶ 235. See Nickelodeon at 295. 80 Memo. Supp. Mot. Dismiss. Second Am. Compl [Doc. No. 39-1] at 20 n.5. and that is what Plaintiffs allege here. The Court will deny the motion to dismiss Count Four of the Second Amended Complaint. E. Count Five – Unjust Enrichment Count Five of the Second Amended Complaint alleges unjust enrichment, which was not asserted in the First Amended Complaint.
Defendant again argues that no new claims were permitted under Judge Schiller’s order, and that Plaintiffs’ claim for unjust enrichment is “not authorized.”81 Like their claim for breach of contract, Plaintiffs’ argument for unjust enrichment centers around the allegation that Plaintiffs’ IIHI conferred an economic benefit on Defendant, and the transmission of Plaintiffs’ IIHI was wrongfully and unlawfully transmitted.82 These facts have been central to Plaintiffs’ claims since the original complaint, and therefore relation back is appropriate and Judge Schiller did not foreclose Plaintiffs from asserting the claim.83 To plead unjust enrichment, a plaintiff must show that: “(1) the plaintiff conferred benefits on the defendant, (2) the defendant appreciated such benefits, and (3) the benefits were accepted and retained under such circumstances that it would be inequitable for the defendant to
retain the benefit without the payment of value.”84 Defendant argues that, because Plaintiffs plead the unjust enrichment claim by realleging and incorporating allegations, instead of pleading the unjust enrichment claim in the alternative, “Plaintiffs’ unjust enrichment claim is therefore predicated on the previous allegations of a binding contract and must be dismissed.”85
81 Memo. Supp. Mot. Dismiss. Second Am. Compl. [Doc. No. 39-1] at 2. 82 Second Am. Compl. [Doc. No. 36] at ¶¶ 250–54. 83 See supra Section III.B.1. 84 Berardi v. USAA Gen. Indem. Co., 606 F. Supp. 3d 158, 163 (E.D. Pa. 2022). 85 Memo. Supp. Mot. Dismiss. Second Am. Compl. [Doc. No. 39-1] at 20–21. “It is well-settled in Pennsylvania that the existence of a contract prevents a party from bringing a claim for unjust enrichment.”86 Nevertheless, Rule 8(d)(2) “permits a plaintiff to plead unjust enrichment in the alternative in certain circumstances,” including where “the existence of a contract is uncertain or its validity is disputed by the parties.”87 Because Defendant disputes the
validity of the contract, the alternative claim for unjust enrichment is not barred. Defendant further argues that there was no benefit conferred on it to retain.88 This argument is similarly unpersuasive. Plaintiffs have plausibly pleaded that Defendant was enriched through the collection of Plaintiffs’ IIHI. At minimum, Plaintiffs have plausibly alleged that by receiving Plaintiffs’ data and disclosing it to Meta to tailor advertisements related to Plaintiffs’ medical needs or status as a patient of Defendant, Defendant may have received the benefit of this targeted advertisement. Defendant further argues that Plaintiffs do not plead that they had any reasonable expectations of compensation for their IIHI. But the cases Defendant cites to support this specific claim are inapplicable here. The only case addressing the sale of personally identifiable medical
information under a Pennsylvania state law unjust enrichment claim dealt with information that was de-identified under HIPAA prior to transmission to a third party and was therefore no longer IIHI.89 The Court will deny the motion to dismiss Count Five.
86 Vantage Learning (USA), LLC v. Edgenuity, Inc., 246 F. Supp. 3d 1097, 1100 (E.D. Pa. 2017). 87 Id. 88 Memo. Supp. Mot. Dismiss. Second Am. Compl [Doc. No. 39-1] at 21–22. 89 Steinberg v. CVS Caremark Corp., 899 F. Supp. 2d 331, 336 (E.D. Pa. 2012). IV. CONCLUSION For the foregoing reasons, Jefferson Health’s Motion to Dismiss the Second Amended Complaint will be dismissed, and Plaintiffs’ claims will proceed to discovery. An order will be entered.