Okash v. Essentia Health

• Court: District Court, D. Minnesota
• Decided: February 27, 2025
• Docket: 0:23-cv-00482
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA MICHAEL OKASH, individually, and on behalf of those similarly situated, Civil No. 23-482 (JRT/LIB)

Plaintiff,

v. MEMORANDUM OPINION AND ORDER GRANTING IN PART AND DENYING IN ESSENTIA HEALTH, PART DEFENDANT’S MOTION TO DISMISS Defendant.

Anne T. Regan and Nathan D. Prosser, HELLMUTH & JOHNSON PLLC, 8050 West 78th Street, Edina, MN 55439; Anthony Stauber, Daniel E. Gustafson, David A. Goodwin, and Karla M. Gluek, GUSTAFSON GLUEK PLLC, 120 South Sixth Street, Suite 2600, Minneapolis, MN 55402; Benjamin Cooper, Brian C. Gudmundson, Jason P. Johnston, Michael J. Laird, and Rachel Kristine Tack, ZIMMERMAN REED LLP, 1100 IDS Center, 80 South Eighth Street, Minneapolis, MN 55402; and Hart L. Robinovitch, ZIMMERMAN REED LLP, 14648 North Scottsdale Road, Suite 130, Scottsdale, AZ 85254, for Plaintiff.

Anderson Tuggle, Andy Taylor, and Jeffrey P. Justman, FAEGRE DRINKER BIDDLE & REATH LLP, 2200 Wells Fargo Center, 90 South Seventh Street, Minneapolis, MN 55402; Justin O’Neill Kay, FAEGRE DRINKER BIDDLE & REATH LLP, 320 South Canal Street, Suite 3300, Chicago, IL 60606; and Zoe K. Wilhelm, FAEGRE DRINKER BIDDLE & REATH LLP, 1800 Century Park East, Suite 1500, Los Angeles, CA 90067, for Defendant.

For years, Plaintiff Michael Okash browsed the website of Defendant Essentia Health (“Essentia”). Unbeknownst to him, Essentia was sharing Okash’s sensitive browsing data with Meta using Pixel technology. Okash now brings this action on behalf of himself and a proposed class of similarly situated individuals based on violations of various state and federal privacy statutes. In a prior order, the Court denied in part and granted in part Essentia’s first motion to dismiss, leaving in place two counts based on

Minnesota consumer protection statutes but dismissing without prejudice Okash’s Wiretap Act and Minnesota Health Records Act claims for lack of detail. Because the Second Amended Complaint partially cures those deficiencies, the Court will deny Essentia’s second Motion to Dismiss as to the consumer protection and the Minnesota

Health Records Act claims but will dismiss Okash’s Wiretap Act claims with prejudice. BACKGROUND I. FACTS Though Okash splits his time between Florida and Minnesota, he receives care

from Essentia at least once per year. (2nd Am. Compl. ¶¶ 18–19, Apr. 19, 2024, Docket No. 51.) Essentia maintains a website, essentiahealth.org (or essentia.org), which allows patients to find doctors and medical facilities; schedule appointments; search for services; research medical issues, conditions, and medications; and review options for paying

medical bills. (Id. ¶ 2.) Okash used the website to research doctors who were referred to him and to investigate various medical conditions and treatments. (Id. ¶¶ 21, 31.) Specifically, he researched Drs. Daniel Nikcevich and Nahi Kiblawi to review their credentials, areas of specialty, and whether they accepted his insurance. (Id. ¶¶ 21–22,

25–28.) Okash also researched his specific medical conditions, including sleep apnea, bladder cancer, and diabetes, and their treatments on Essentia’s website. (Id. ¶ 31.) While Okash browsed its website, Essentia employed Meta Platform, Inc.’s (“Meta”) tracking technology, Meta Pixel (“Pixel”), on essentiahealth.org. (Id. ¶ 58.) Pixel

tracks a website user’s activity and transmits that data to Meta, including the pages and subpages visited by the website user during a website session as well as searches, clicks, and other submissions to the website. (Id. ¶ 5); see also In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 784–86 (N.D. Cal. 2022) (explaining the Pixel technology). For

example, if a visitor to essentiahealth.org clicks on the “Doctors & Providers” page, data documenting that navigation would be sent to Meta. (2nd Am. Compl. ¶ 59.) The data is often then associated with the user’s Facebook account and used for advertising

purposes. (Id. ¶¶ 59–60, 73–74.) Okash recalls receiving targeted advertisements related to information he researched on essentiahealth.org. (Id. ¶ 40.) Essentia’s website includes a privacy policy indicating Essentia is “committed to protecting the privacy of those who visit our website.” (Decl. of Jeffrey P. Justman ¶ 4,

Ex. A (“Privacy Policy”) at 2, June 23, 2023, Docket No. 26.) In a section on tracking technologies, the Privacy Policy discloses, “[w]e may also use Facebook Pixel that enables us to understand how users interact with our website after seeing an ad on Facebook and then clicking through to our website.” (Id. at 3.)

II. PROCEDURAL HISTORY Okash’s initial complaint alleged privacy violations on his MyChart account, as well as on essentiahealth.org. (See, e.g., Compl. ¶ 117, Feb. 28, 2023, Docket No. 1.) He then filed an amended complaint that dropped most allegations about his use of the MyChart portion of Essentia’s website, apparently because Essentia did not use Pixel on MyChart. (See generally Am. Compl., May 15, 2023, Docket No. 15.)1 In the Amended Complaint,

Okash alleged that Essentia violated federal wiretap laws, as well as state statutory and common law, by transmitting data from essentiahealth.org to Meta through the Pixel technology. (See generally id.) Essentia moved to dismiss all counts. (Def.’s Mot. Dismiss, June 23, 2023, Docket No. 23.)

The Court granted in part and denied in part Essentia’s first motion to dismiss. Okash v. Essentia Health, No. 23-482, 2024 WL 1285779, at *7 (D. Minn. Mar. 26, 2024). The Court declined to assume that the Privacy Policy was a valid contract and found that

the Privacy Policy’s disclosure that Essentia uses Pixel to “understand how users interact with our website after seeing an ad on Facebook and then clicking through to our website” does not disclose the full extent of Essentia’s Pixel usage. Id. at *3. The Court dismissed Okash’s invasion of privacy claim without prejudice. Id. at *7. On the federal

and state wiretap claims, even though the Court decided that the party exception applied as a matter of law, Okash had not plausibly alleged facts to suggest that the interception of data was in furtherance of an independent criminal or tortious act. Id. at *3–5.

1 Though the Amended Complaint and Second Amended Complaint still contain a few nominal references to MyChart, Okash has dropped most allegations about that portion of the website, and the Court understands from oral argument that Okash has conceded Pixel was never tracking users’ MyChart activity. Accordingly, the Court dismissed those counts without prejudice.2 Id. at *5. The Court similarly dismissed the Minnesota Health Records Act claim without prejudice to allow

Okash a chance to plead the particulars of that claim. Id. at *5. Finally, the Court allowed the Minnesota Uniform Deceptive Trade Practices Act, Minnesota Consumer Fraud Act, and unjust enrichment claims to continue. Id. at *6–7. In response to the Court’s invitation to add more detail to his Amended Complaint,

Okash filed a Second Amended Complaint on April 19, 2024. (2nd Am. Compl.) Okash brings this class action on behalf of himself and others similarly situated, defined as “[a]ll persons whose Sensitive Information was disclosed to a third party through Defendant’s

Website without authorization or consent.” (Id. ¶ 128.) On May 23, 2024, Essentia moved to dismiss all claims except for the unjust enrichment claim. (2nd Mot. Dismiss, Docket No. 54.) DISCUSSION I. STANDARD OF REVIEW

In reviewing a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), the Court considers all facts alleged in the complaint as true to determine if the complaint states a “claim to relief that is plausible on its face.” Braden v. Wal-Mart Stores, Inc., 588

2 Okash originally brought a Wiretap Act claim under 18 U.S.C. § 2511(1) and § 2511(3). However, he later abandoned his § 2511(3) claim, which the Court found would have been unmeritorious in any event. The Court therefore dismissed that part of Okash’s Amended Complaint with prejudice. See Okash, 2024 WL 1285779, at *3 n.3. F.3d 585, 594 (8th Cir. 2009) (quoting Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)). The Court construes the complaint in the light most favorable to the plaintiff, drawing all

reasonable inferences in the plaintiff’s favor. Ashley Cnty. v. Pfizer, Inc., 552 F.3d 659, 665 (8th Cir. 2009). Although the Court accepts the complaint’s factual allegations as true, it is “not bound to accept as true a legal conclusion couched as a factual allegation,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007), or mere “labels and conclusions or a

formulaic recitation of the elements of a cause of action,” Iqbal, 556 U.S. at 678 (quotation omitted). Instead, “[a] claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is

liable for the misconduct alleged.” Id. At the motion to dismiss stage, the Court may consider the allegations in the complaint as well as “those materials that are necessarily embraced by the pleadings.” Schriener v. Quicken Loans, Inc., 774 F.3d 442, 444 (8th Cir. 2014). The Court may also

consider matters of public record and exhibits attached to the pleadings, as long as those documents do not conflict with the complaint. Porous Media Corp. v. Pall Corp., 186 F.3d 1077, 1079 (8th Cir. 1999). II. ANALYSIS

Essentia moves to dismiss every count in the Second Amended Complaint except for the unjust enrichment claim. The Court will examine the challenged counts in turn. A. Wiretapping Statutes Essentia first moves to dismiss Okash’s claims under federal and state wiretapping

statutes. On Essentia’s first motion to dismiss, the Court found that Okash had not plausibly alleged facts to suggest the interception of data was in furtherance of an independent criminal or tortious act, so the Court dismissed the wiretapping claims without prejudice. Okash, 2024 WL 1285779, at *3–5. The question is now whether those

deficiencies have been cured. The Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq., prohibits the intentional interception of “any wire, oral, or electronic communication,” as well as the use or disclosure of any “content[s]” thereof. See id. § 2511(1).3 A party is exempted

from interception liability, though, if it is a “party to the communication or . . . one of the parties to the communication has given prior consent to such interception.” Id. § 2511(2)(d). That is only true, however, if the party does not intercept the

communication “for the purpose of committing any criminal or tortious act.” Id. The crime-tort carveout is a narrow one that requires that the recording party intercept the plaintiff’s communications “for the purpose of committing a tortious or criminal act,” id., meaning the Court must look to Okash’s allegations about Essentia’s “intended use of the

3 Because the federal and state wiretapping statutes are coterminous, the parties agree the Court should analyze them jointly. See Wagner v. Wagner, 64 F. Supp. 2d 895, 899 (D. Minn. 1999); compare 18 U.S.C. § 2511, with Minn. Stat. § 626A.02. For consistency, the Court will reference only the federal statutes. recordings” to determine the purpose of the recording, United States v. Jiau, 734 F.3d 147, 152 (2d Cir. 2013) (quoting In re High Fructose Corn Syrup Antitrust Litig., 216 F.3d

621, 626 (7th Cir. 2000)). Many courts have held that the crime-tort exception “only applies where the defendant allegedly committed a tortious or criminal act independent from the act of recording itself.” Kurowski v. Rush Sys. for Health (Kurowski II), No. 22-5380, 2023 WL

4707184, at *4 (N.D. Ill. July 24, 2023) (citing Caro v. Weintraub, 618 F.3d 94, 99 (2d Cir. 2010)). Following that approach, the Court previously held that Okash’s allegations that Essentia violated HIPAA and privacy torts encompass only the simultaneous interception

and disclosure of information to Meta, which is not an independent crime or tort. Okash, 2024 WL 1285779, at *4. To cure this deficiency, Okash newly alleges that Essentia violated several more state privacy statutes in sharing his data with Meta. But these additional allegations do not fix the core problem the Court previously identified: Okash

alleges these statutes are violated with the initial interception itself, not that the data is independently used in a crime or tort. He thus has still not stated a claim under the wiretapping statutes. Presumably because he could not adequately plead an independent crime or tort,

Okash instead urges the Court to simply reconsider its prior Order based on a new wave of findings by other courts that simultaneous interception of private healthcare data may fall within the crime-tort exception. But even if the Court were tempted to reconsider its position, it would not be swayed by the cases Okash cites. In almost every instance, those courts have typically only found liability under the wiretapping statutes when the data is

also collected from the much more sensitive patient portal part of a healthcare company’s website. See, e.g., Mekhail v. N. Mem’l Health Care, 726 F. Supp. 3d 916, 928 (D. Minn. 2024) (denying motion to dismiss wiretapping claims when Pixel allowed Meta to access data on both public-facing and patient portal parts of the website); Kurowski v. Rush Sys.

for Health (Kurowski III), No. 22-5380, 2024 WL 3455020, at *4 (N.D. Ill. July 18, 2024) (same); Cooper v. Mount Sinai Health Sys., Inc., No. 23-9485, 2024 WL 3586357, at *7 (S.D.N.Y. July 30, 2024) (same).

Here, though he initially alleged Pixel was providing information from Essentia patients’ MyChart portals to Meta, Okash has since dropped that claim, hanging his hat solely on the public-facing portion of Essentia’s website. Therefore, nothing in the rapidly developing caselaw in this area has changed the Court’s mind that there was no obvious

crime or tort sufficiently independent from the initial interception of data to trigger Wiretap Act liability. The Court will therefore grant Essentia’s motion to dismiss these claims. Because Okash has failed to amend his pleadings with more detail about an independent crime or tort, the Court will dismiss Counts I and III this time with prejudice.4

4 Compare Washington v. Craane, No. 18-1464, 2019 WL 2147062, at *5 (D. Minn. Apr. 18, 2019) (noting a dismissal without prejudice may be warranted when claims “might conceivably be repleaded with success”), with Miles v. Simmons Univ., 514 F. Supp. 3d 1070, 1080 (D. Minn. 2021) (“A dismissal with prejudice is typically appropriate when a plaintiff has shown persistent pleading failures despite one or more opportunities to amend, or when the record B. MUDTPA & MCFA Essentia next argues that Okash’s claims under two different Minnesota consumer

protection statutes fail. The Court previously denied Essentia’s first attempt to dismiss the consumer protection claims because it found that Essentia owed a duty to Okash and Okash had sufficiently alleged a deceptive omission by Essentia’s failure to comply with HIPAA or protect his sensitive health information. Okash, 2024 WL 1285779, at *6–7.

Still, Essentia takes another swing at dismissing these state claims on four grounds, none of which are enough to change the Court’s mind. The Minnesota Uniform Deceptive Trade Practices Act (“MUDTPA”), as relevant to this action, forbids businesses from representing that goods or services have

characteristics they do not have or that “goods or services are of a particular standard, quality, or grade . . . if they are of another.” Minn. Stat. § 325D.44, subds. 1(5), (7). The Minnesota Consumer Fraud Act (“MCFA”) forbids a person from using “fraud,

unfair or unconscionable practice, false pretense, false promise, misrepresentation, misleading statement or deceptive practice, with the intent that others rely thereon in connection with the sale of any merchandise, whether or not any person has in fact been misled, deceived, or damaged thereby.” Minn. Stat. § 325F.69, subd. 1. A plaintiff must

makes clear that any amendment would be futile.”) (internal quotation marks and citations omitted). “demonstrate that their cause of action benefits the public.” Ly v. Nystrom, 615 N.W.2d 302, 314 (Minn. 2000).

First, Essentia argues that Okash now admits he never read the Privacy Policy and that he therefore could not have been misled by it. Minnesota does not require that consumer protection plaintiffs plead or prove traditional common law reliance. Grp. Health Plan, Inc. v. Philip Morris Inc., 621 N.W.2d

2, 12–13 (Minn. 2001). However, plaintiffs must establish that a causal nexus exists between the conduct alleged to have violated the consumer protection statutes and the damages that are claimed “because a fraudulent or misleading statement cannot by its

nature cause harm unless the statement ‘had some impact on’ inducing the individual plaintiff’s actions.” State v. Minn. Sch. of Bus., Inc., 935 N.W.2d 124, 134 (Minn. 2019) (quoting Grp. Health, 621 N.W.2d at 14). Okash has never admitted to not reading the Privacy Policy in his pleadings. And

regardless, the fraud claims are for both affirmative misrepresentation and for deceptive omissions. Though this could change after discovery, for now there is enough alleged regarding Essentia’s misconduct and its causal nexus to Okash’s harm to uphold the Court’s original order and move beyond a motion to dismiss.

Second, without much detail, Essentia complains that the Second Amended Complaint does not adopt the Court’s framing of the misrepresentation in the Privacy Policy. In its Order, the Court refused to dismiss the misrepresentation claims because, at the very least, a Privacy Policy that describes using Pixel to “understand how users interact with our website after seeing an ad on Facebook and then clicking through to our

website” does not fully disclose the extent to which Essentia used Pixel. Essentia now argues that the Second Amended Complaint goes far beyond that narrow theory of misrepresentation and therefore must be dismissed. But Essentia far over-reads the Court’s Order, which simply for demonstrative purposes showed how some users may

have been misled by what few details Essentia disclosed about its data usage on its website. There is no need to dismiss the claims based on these grounds. Third, for the MCFA claim only, Essentia argues Okash did not allege Essentia’s

misrepresentations were made “in connection with the sale of any merchandise.” Minn. Stat. § 325F.69, subd. 1. Principally, Essentia points to the decision in Mekhail, in which the court dismissed a similar MCFA claim because North Memorial “is not in the business of providing data privacy services,” only medical services. 726 F. Supp. 3d at 929.

But this Court does not read the MCFA so narrowly. Essentia is in the business of marketing medical services. To facilitate its marketing and to turn a separate profit, it allegedly secretly tracked its patients’ and potential patients’ online activity and sold that information to third parties so that it may aid in advertising campaigns. The alleged deceit

was in connection with Essentia’s multi-layered lines of business. Finally, for the MUDTPA claim only, Essentia argues that Okash has not adequately alleged future harm because Pixel is no longer on Essentia’s website. That is, Essentia argues this claim is now moot. But “[a] defendant’s voluntary cessation of allegedly unlawful conduct ordinarily does not suffice to moot a case.” Friends of the Earth, Inc. v.

Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 174 (2000). Only when “subsequent events ma[k]e it absolutely clear that the allegedly wrongful behavior could not reasonably be expected to recur” will a court allow a voluntary cessation defense to carry the day. Id. at 189 (quoting United States v. Concentrated Phosphate Export Ass’n, 393 U.S. 199, 203

(1968)); see also City of Erie v. Pap’s A.M., 529 U.S. 277, 287 (2000) (holding that case against operation of now-closed strip club was not moot because the defendant could at any time reopen the establishment). Because Essentia maintains its ability to use Pixel

and could easily turn it back on at any point, the MUDTPA claim is not moot. Overall, no new developments affect Okash’s MUDTPA and MCFA claims, so the Court will deny Essentia’s motion to dismiss Counts II and V. C. MHRA

Essentia also moves to dismiss Okash’s claim under the Minnesota Health Records Act (“MHRA”). The primary question is whether Okash’s searches, alone or in their aggregate, could reasonably constitute health records under the MHRA. The MHRA prohibits the release of patient “health records” absent signed consent.

Minn. Stat. § 144.293, subd. 2. The MHRA broadly defines a “health record” as any information, whether oral or recorded in any form or medium, that relates to the past, present, or future physical or mental health or condition of a patient; the provision of health care to a patient; or the past, present, or future payment for the provision of health care to a patient. Minn. Stat. § 144.291, subd. 2(c). Still, “[t]here is scant caselaw analyzing what constitutes a ‘health record.’” Furlow v. Madonna Summit of Byron, No. 19-987, 2020 WL 413356, at *2 (Minn. Ct. App. Jan. 27, 2020).

The Court previously dismissed without prejudice Okash’s MHRA claim for failing to provide specific examples of how Okash used the website and what information was specifically disclosed. Okash, 2024 WL 1285779, at *5. In response, Okash has bolstered the Second Amended Complaint with several new allegations. Specifically, the new

complaint alleges that Okash researched Dr. Nikcevich and Dr. Kiblawi on Essentia’s website and reviewed their credentials, areas of specialty, and whether they accepted his insurance. Okash also researched his specific medical conditions, including sleep apnea, bladder cancer, and diabetes. From this, Okash alleges, Meta would have learned from

which doctors he was seeking care, for which conditions he needed care, and what type of insurance he had. As the Court previously made clear in its first Order, Meta could theoretically pair

enough information obtained through internet searches with enough of Okash’s digital footprint to create a health record. The Court simply wanted specific examples of how he used the website and what information was specifically disclosed. Id. Because Okash has now provided that information with allegations about searches for specific doctors

and medical conditions, he has now alleged enough for Count IV to survive a motion to dismiss. The Court notes, however, that the text of the MHRA appears to be limited to “patients.” Though Okash has adequately pled that he is a patient of Essentia’s, the

proposed class, as currently conceived, is far broader than Essentia patients. Nonetheless, because the Court only has before it a motion to dismiss, not a motion for class certification, it will wait to address any potential narrowing of the class on this claim at that stage of the proceedings.

CONCLUSION The Court’s prior Order identified two deficiencies in Okash’s Amended Complaint: the Wiretap Act claims did not adequately allege an independent crime or tort, and the MHRA failed to provide specific examples of Okash’s browsing history. The Second

Amended Complaint only cures the deficiencies identified in the MHRA claim. Accordingly, the Court will deny Essentia’s motion to dismiss as to the MUDPTA, MHRA, and MCFA claims (Counts II, IV, V) but will grant the motion as to the Wiretap Act claims

(Counts I, III) and dismiss those counts with prejudice. ORDER Based on the foregoing, and all the files, records, and proceedings herein, IT IS HEREBY ORDERED that Defendant’s Motion to Dismiss [Docket No. 54] is GRANTED in

part and DENIED in part, and Counts | and Ill are DISMISSED with prejudice.

DATED: February 27, 2025 bag HY ebtiin at Minneapolis, Minnesota. JOHN R. TUNHEIM United States District Judge

-16-