R. S. v. Prime Healthcare Services, Inc.

Opinion

O JS-5 United States District Court Central District of California

R.S., Case № 5:24-cv-00330-ODW (SPx)

Plaintiff, ORDER GRANTING PLAINTIFF’S

v. MOTION FOR RECONSIDERATION AND PRIME HEALTHCARE SERVICES, DENYING DEFENDANT’S MOTION INC., TO DISMISS [26] Defendant.

Plaintiff R.S. brought this putative class action against Defendant Prime Healthcare Services, Inc. (“Prime Healthcare”) alleging violation of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. § 2511(1). (Compl., ECF No. 1.) The Court granted Prime Healthcare’s Motion to Dismiss under Federal Rule of Civil Procedure (“Rule”) 12(b)(6) and dismissed this action with prejudice. (Order Granting Mot. Dismiss (“Order”), ECF No. 24.) R.S. now moves for reconsideration of the Order under Rule 59(e) and Local Rule 7-18. (Mot. Recons. (“Mot.” or “Motion”), ECF No. 26.) For the following reasons, the Court GRANTS R.S.’s Motion and, upon reconsideration, DENIES Prime Healthcare’s Motion to Dismiss.1

1 Having carefully considered the papers filed in connection with the Motion, the Court deemed the matter appropriate for decision without oral argument. Fed. R. Civ. P. 78; C.D. Cal. L.R. 7-15. II. BACKGROUND2 Prime Healthcare operates forty-four hospitals in fourteen states, including California, and more than 300 outpatient locations. (Compl. ¶ 1.) Prime Healthcare also owns, controls, and maintains websites and portals (collectively, “Web Properties”) that allow patients to communicate with their healthcare providers. (Id. ¶ 2.) These Web Properties allow patients to, among other things, access lab and test results, manage prescriptions, request refills, schedule and manage appointments, search for medical conditions and treatment options, and find doctors. (Id. ¶ 4.) R.S. alleges that, using tracking technologies, including Facebook pixels (“Pixels”), Prime Healthcare sent her—and other putative class members’—personally identifiable information and protected health information (“Private Information”) to Facebook and other third parties without patients’ knowledge or consent. (E.g., id. ¶¶ 8–14, 49–55, 122, 239.) A. Facebook Pixels Facebook encourages and promotes website owners, like Prime Healthcare, to use its “Business Tools” to market products and services to individuals. (Id. ¶ 97.) These Business Tools, including Pixels, are programming code advertisers can integrate into their webpages, mobile applications, and servers to collect user activity on those platforms. (Id. ¶ 98.) The Pixels send information from users’ browsers to third parties, including Facebook. (Id. ¶¶ 11, 99–100.) Pixels are customizable: the website owner—here, Prime Healthcare—controls which of its web pages contain the Pixels and which events are tracked and sent to Facebook. (Id. ¶ 101.) Facebook configures the Pixels to collect “Standard Events,” such as when a user visits a particular webpage, the webpage’s URL and metadata, and button clicks. (Id. ¶ 106.) Website owners can also build “custom events” to track other user actions. (Id. ¶ 107.) The Pixels prompt users’ web browsers to send 2All factual references derive from Plaintiff’s Complaint, unless otherwise noted, and well-pleaded factual allegations are accepted as true for purposes of this Motion. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). users’ communications with the host webpage to Facebook’s servers. (Id. ¶ 108.) This simultaneous transmission contains the electronic communications sent to the host website and the data that the host configures the Pixels to collect. (Id. ¶ 109.) When a Facebook user visits the website, the information the Pixels collect is associated with that user’s Facebook ID. (Id. ¶ 114.) The Facebook ID captures the user’s name and Facebook profile, which contains demographic and other information about the user, including pictures, personal interests, work history, and relationship status. (Id. ¶ 116.) The Pixels collect data even if the user does not have a Facebook account: Facebook keeps “shadow profiles” on users without Facebook accounts. (Id. ¶ 115.) After receiving these transmissions, Facebook processes, analyzes, and assimilates the data into datasets. (Id. ¶ 114.) Pixels allow website owners—like Prime Healthcare—to send targeted advertisements to a user based on that user’s Private Information. (Id. ¶ 19.) A website owner can also target ads to users who have shown interest in its business and measure the success of its marketing campaigns. (Id. ¶¶ 125–31.) The Pixels thus enable “retargeting,” or online marketing that targets users with ads based on prior internet communications and interactions. (Id. ¶ 197.) Facebook also sells the collected information, including Private Information, to third-party marketers who target users’ Facebook accounts based on that information. (Id. ¶ 20.) B. Prime Healthcare’s Use of the Facebook Pixels R.S. alleges that Prime Healthcare installs Pixels on its Web Properties without patients’ knowledge. (Id. ¶ 8.) Using Pixels, Prime Healthcare intercepts patients’ Private Information and discloses this information to Facebook. (Id. ¶ 73.) For example, when a patient searches for a doctor on Prime Healthcare’s Web Properties, the Facebook Pixels send the search information—here, the doctor’s name—directly to Facebook. (Id. ¶¶ 76–77.) Prime Healthcare purchases Facebook’s targeted advertising services to display ads to Facebook users based on their health conditions. (Id. ¶¶ 117, 140.) At the same time, Facebook sells these marketing profiles to third-party marketers to support advertising efforts. (Id. ¶¶ 117, 195.) This financially benefits both Prime Healthcare and Facebook. (Id. ¶ 118.) As R.S. alleges, “Prime Healthcare chose to use the Pixel data for marketing purposes to bolster its revenue.” (Id. ¶ 24.) C. R.S.’s Claims R.S. has been a Prime Healthcare patient since approximately 2012. (Id. ¶ 231.) R.S. began receiving healthcare services from Prime Healthcare and, starting in 2018, accessed its Web Properties. (Id. ¶¶ 230–32.) She has had a Facebook account for at least ten years. (Id. ¶ 234.) Through the Web Properties, R.S. scheduled appointments, found doctors, researched medical treatments and conditions, and provided personal health-related information. (Id. ¶¶ 230–33.) R.S. alleges that Prime Healthcare disclosed her Private Information to Facebook without her knowledge, consent, or written authorization, and in violation of the Health Insurance Portability and Accountability Act (“HIPAA”). (Id. ¶¶ 8–9, 141–59.) On February 8, 2024, R.S. filed this putative class action against Prime Healthcare, asserting a single cause of action for violating the ECPA. (Compl. ¶¶ 223–254, 256.) On April 24, 2024, Prime Healthcare filed a Motion to Dismiss under Rule 12(b)(6), which Prime Healthcare opposed. (Mot. Dismiss, ECF No. 13; Opp’n Mot. Dismiss, ECF No. 16; Reply ISO Mot. Dismiss, ECF No. 17.) On August 7, 2024, the Court issued an Order granting Prime Healthcare’s Motion to Dismiss and dismissed the case. (Order 1.) On August 8, 2024, the Court issued a Judgment. (J., ECF No. 25.) On August 21, 2024, R.S. moved for reconsideration of the Order pursuant to Rule 59(e) and Local Rule 7-18. (Mot. 4–5.) The Motion is fully briefed. (Opp’n Mot. (“Opp’n”), ECF No. 29; Reply ISO Mot. (“Reply”), ECF No. 30.) “Although Rule 59(e) permits a district court to reconsider and amend a previous order, the rule offers an extraordinary remedy, to be used sparingly in the interests of finality and conservation of judicial resources.” Kona Enters., Inc. v. Est. of Bishop, 229 F.3d 877, 890 (9th Cir. 2000) (internal quotation marks omitted). “Motions for reconsideration are governed by the Local Rules of this district.” In re Countrywide Fin. Corp. Mortg.-Backed Sec. Litig., 966 F. Supp. 2d 1031, 1036 (C.D. Cal. 2013). A party may move for reconsideration under Local Rule 7-18 if there is: (a) “a material difference in fact or law from that presented to the [c]ourt that, in the exercise of reasonable diligence, could not have been known to the party moving for reconsideration at the time” the court entered the order, (b) “the emergence of new material facts or a change of law occurring after” the court entered the order, or (c) “a manifest showing of a failure to consider material facts presented to the” court before it entered the order. C.D. Cal. Civ. L.R. 7-18; In re Countrywide, 966 F. Supp. 2d at 1036. In seeking reconsideration, the movant may not “repeat any oral or written argument made in support of, or in opposition to, the original motion.” C.D. Cal. Civ. L.R. 7-18. “Consistent with Local Rule 7-18, a [Rule 59(e)] motion for reconsideration should not be granted, absent highly unusual circumstances, unless the district court is presented with newly discovered evidence, committed clear error, or if there is an intervening change in the controlling law.” Ketab Corp. v. Mesriani L. Grp., No. 2:14-cv-07241-RSWL (MRWx), 2015 WL 2084469, at *2 (C.D. Cal. May 5, 2015) (internal quotation marks omitted) (quoting Carroll v. Nakatani, 342 F.3d 934, 945 (9th Cir. 2003)); Feltzs v. Cox Commc’ns Cal., LLC, 562 F. Supp. 3d 535, 539 (C.D. Cal. 2021) (“Courts in this district have interpreted Local Rule 7-18 to be coextensive with Rules 59(e) and 60(b).”). “The Court has discretion in determining whether to grant a motion for reconsideration.” Feltzs, 562 F. Supp at 539. The Court first turns to R.S.’s argument that it should reconsider its ruling dismissing this action in the Order. Next, having found that reconsideration is proper, the Court addresses Prime Healthcare’s Motion to Dismiss. A. Reconsideration R.S. moves for reconsideration of the Order under Rule 59(e) and Local Rule 7-18, arguing that the Court committed clear error by “fail[ing] to consider material facts presented to the Court before the Order was entered.” (Mot. 6 (quoting C.D. Cal. L.R. 7-18).) Specifically, R.S. argues that the Court’s failure to address the applicability of the crime-tort exception justifies reconsideration. (Id. at 6–8.) Prime Healthcare responds that the Court properly dismissed the Complaint and adequately addressed the crime-tort exception in its Order. (Opp’n 1.) The ECPA provides for a private right of action against “any person who . . . intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a). “Intercept” is defined as “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” Id. § 2510(4). The statute exempts from liability interceptions made by a person who “is a party to the communication” or when one of the parties to the communication consents to the interception. Id. § 2511(2)(d). This is often referred to as the “party exception” or “party exemption.” See, e.g., In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 607 (9th Cir. 2020). This exception is itself limited: it does not apply if the interception was “for the purpose of committing any criminal or tortious act,” known as the crime-tort exception. Sussman v. Am. Broad. Co., Inc., 186 F.3d 1200, 1202 (9th Cir. 1999) (quoting 18 U.S.C. § 2511(2)(d)). In its Motion to Dismiss, Prime Healthcare argued that it is not liable under the ECPA because R.S. consented to Prime Healthcare intercepting her communications, and thus the party exception applies. (Mot. Dismiss 1–2, 6–8.) R.S. countered that the party exception does not apply because Prime Healthcare intercepted R.S.’s communications with a criminal and tortious purpose, triggering the crime-tort exception and precluding reliance on the party exception. (Opp’n Mot. Dismiss 6–9, 11–20.) Prime Healthcare disagreed, arguing that the crime-tort exception does not apply here. (Mot. Dismiss 8–13; Reply ISO Mot. Dismiss 2–10.) In its Order, the Court acknowledged that “R.S. argu[ed] extensively why the ECPA’s crime-tort exception should in fact apply.” (Order 4.) But the Court did not address these arguments. (See id.) Instead, the Court considered only the party exception, concluding that Prime Healthcare was a party to the communication and R.S. had consented to the interception. (Id. at 4–5.) But both parties agreed that if the crime-tort exception applies, then the party exception cannot save Prime Healthcare from R.S.’s claims. (See Mot. Dismiss 1; Opp’n Mot. Dismiss 7–8; see also Mot. 4; Opp’n Mot. 7–9.) As the Court did not consider the applicability of the crime-tort exception, the Court finds it appropriate to GRANT R.S.’s Motion under Local Rule 7-18(c) and reconsider Prime Healthcare’s Motion to Dismiss. See Kiwijet, LLC v. Guangzhou Hayonex Int’l Logistics Co. Ltd, No. 2:21-cv-07515-FWS (JDEx), 2024 WL 3468811, at *2 (C.D. Cal. May 22, 2024) (finding reconsideration appropriate when the court determined that it failed to consider plaintiff’s opposition). B. Motion to Dismiss Having agreed to reconsider Prime Healthcare’s Motion to Dismiss, the Court turns to Prime Healthcare’s argument that R.S. fails to plausibly allege that the crime-tort exception applies, and thus that the party exception defeats R.S.’s claim. (See Mot. Dismiss 9.) As discussed, the crime-tort exception applies if a defendant intercepted a communication “for the purpose of committing any criminal or tortious act.” Sussman, 186 F.3d at 1202 (quoting 18 U.S.C. § 2511(2)(d)). R.S. alleges that, at the time it intercepted her communications, Prime Healthcare had the purpose to disclose private health information without her consent in violation of HIPAA. (See Compl. ¶ 191 (alleging that Prime Healthcare embedded the Pixels on its Web Properties “with the purpose of disclosing” users’ “communications to Facebook and other third party data brokers”); ¶¶ 141–59 (alleging Prime Healthcare intended to and did violate HIPAA).) According to R.S., “Prime Healthcare intentionally configured Pixels installed on its Web Properties to capture both the characteristics of individual patients’ communications” and the “content of these communications.” (Id. ¶¶ 71–73 (internal quotation marks omitted).) Prime Healthcare argues that R.S. fails to allege sufficient facts to invoke the crime-tort exception on three grounds: (1) there was no HIPAA violation, (2) disclosure was not independent from interception, and (3) it held no improper purpose. (See Mot. Dismiss 8–13.) 1. HIPAA Violation Prime Healthcare first argues that R.S. does not plausibly allege that it violated HIPAA. (Mot. Dismiss 10–12.) Prime Healthcare asserts that R.S. fails to allege that it actually “disclosed” her confidential information to any third party. (Id. at 11.) However, “the focus is not upon whether the interception itself violated another law; it is upon whether the purpose for the interception—its intended use—was criminal or tortious.” Sussman, 186 F.3d at 1202. So the question here is not whether Prime Healthcare actually violated HIPAA, but whether it intended to do so. R.S. plausibly alleges that Prime Healthcare intercepted her Private Information with the purpose of violating HIPAA. HIPAA prohibits a “covered entity,” including healthcare providers like Prime Healthcare, from knowingly “disclos[ing] individually identifiable health information to another person.” 42 U.S.C. § 1320d-6(a)(3). R.S. alleges that Prime Healthcare—through the Pixels—intended to collect her Private Information, including her medical conditions, treatment details, appointment information, and the physician she selected, and to disclose this Private Information to third parties, including Facebook. (Id. ¶¶ 9, 11, 50, 69, 141–59, 240.) The Private Information falls under HIPAA’s definition of “individually identifiable” information, which includes data “created or received by a health care provider” that “[r]elates to the past, present, or future physical or mental health or condition of an individual” or to the “provision of health care to an individual.” 45 C.F.R. § 160.103. Thus, Prime Healthcare’s argument that R.S. does not plausibly allege an intent to “disclose” in violation of HIPAA fails. (See Compl. ¶¶ 141–59 (alleging disclosure); K.L. v. Legacy Health, No. 3:23-cv-1886-SI, 2024 WL 4794657, at *6 (D. Or. Nov. 14, 2024) (finding intent to disclose private health information is a “criminal act for purposes of the carve-out to ECPA’s party exception”); Cooper v. Mount Sinai Health Sys., Inc., No. 23 Civ. 9485 (PAE), 2024 WL 3586357, at *6 (S.D.N.Y. July 30, 2024) (holding that a plaintiff raising similar allegations sufficiently alleged intent to disclose in violation of HIPAA). 2. Independence Next, Prime Healthcare contends that the crime-tort exception is inapplicable because “the interception did not precede the disclosure; it was the disclosure.” (Reply ISO Mot. Dismiss 10.) The crime-tort exception has two relevant components. First, there is a “temporal” component whereby the intercepting party must “have the independent criminal or tortious purpose at the time the [interception] was made.” Planned Parenthood Fed’n of Am., Inc. v. Newman, 51 F.4th 1125, 1136 (9th Cir. 2022) (emphasis added) (first citing Sussman, 186 F.3d at 1203; and then citing Caro v. Weintraub, 618 F.3d 94, 99 (2d Cir. 2010)). This “temporal thread . . . runs through the fabric of the statute and the case law.” Caro, 618 F.3d at 99. If “at the time of the recording, the offender plans to use the recording to harm the other party to the conversation, a civil cause of action exists” under the ECPA. Id. at 100. Second, there is a “separate and independent” component whereby the crime or tort intended must be “beyond the act of [intercepting] itself.” Id. at 98, 101 (“The language and history of the Wiretap Act indicate that Congress authored the exception to the one-party consent rule to prevent abuses stemming from use of the recording not the mere act of recording.”). In other words, “the criminal or tortious acts contemplated by § 2511(2)(d) are acts secondary to the acquisition of the communication involving tortious or criminal use of the interception’s fruits.” Pena v. GameStop, Inc., 670 F. Supp. 3d 1112, 1120 (S.D. Cal. 2023) (quoting In re Google Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 145 (3d Cir. 2015)). Thus, “at the time of the” interception, a defendant must have “had an independent prohibited purpose” beyond the act of interception itself for the crime-tort exception to apply. Weston v. Lefiti, No. 23-cv-0896-L-DDL, 2023 WL 8458249, at *4 (S.D. Cal. Dec. 5, 2023) (citing Sussman, 186 F.3d at 1202), aff’d, No. 24-541, 2024 WL 4579237 (9th Cir. Oct. 25, 2024). R.S. alleges facts to satisfy both requirements. First, R.S. alleges that, at the time Prime Healthcare intercepted R.S.’s Private Information, it had the intent to disclose that information in violation of HIPAA. (See, e.g., Compl. ¶ 61 (alleging that Prime Healthcare installed the Pixels and “programed or permitted those webpages to surreptitiously share patients’ private and protected communications” with third parties); ¶ 71 (alleging that “Prime Healthcare intentionally configured Pixels installed on its Web Properties to capture” Private Information).) Second, R.S. alleges that Prime Healthcare intended to violate HIPAA by disclosing Private Information to third parties. (See e.g., id. ¶ 141 (alleging Prime Healthcare’s “disclosure” violated HIPAA); ¶ 157 (describing unlawful “disclos[ure]”; see also Opp’n Mot. Dismiss 13.) Prime Healthcare cites Weston to support its argument that the crime-tort exception cannot apply here because its alleged HIPAA violation cannot be “based on the interception.” (Reply ISO Mot. Dismiss 9 (citing Weston, 2023 WL 8458249, at *4).) But that case supports R.S.’s position. In Weston, the plaintiff alleged that the defendant’s recording of a phone call violated the plaintiff’s right to privacy and caused emotional distress, extortion, and intentional interference with business relationships. Weston, 2023 WL 8458249, at *4. The district court held that the plaintiff failed to adequately allege “independent criminal or tortious purposes separate from the act of recording” because the alleged harm, such as emotional distress and invasion of privacy, directly arose from the act of recording itself. Id. In other words, the plaintiff alleged his emotional distress resulted from defendant making the recording itself, not from sharing the recording with others. Id. As the Ninth Circuit explained in affirmance, emotional distress that “stem[s] from the mere act of recording” does not support an allegation that an interception was done “for the purpose of facilitating some further impropriety, such as blackmail.” Weston, 2024 WL 4579237, at *2. Unlike the plaintiff in Weston, R.S. does not allege that Prime Healthcare’s interception itself violated HIPAA. (See Compl.) Instead, R.S. asserts that the violation stems from Prime Healthcare’s intentional disclosure of the collected Private Information, which constitutes a “further impropriety” independent and separate from Prime Healthcare’s interception. Weston, 2024 WL 4579237, at *2; (see Compl. ¶ 157; Opp’n Mot. Dismiss 13.) This distinction places R.S.’s allegations squarely within the crime-tort exception, as the intent to disclose private information predates and is distinct from the interception itself. Compare Caro, 618 F.3d at 101 (holding that invasion of privacy does not qualify for crime-tort exception because the “tort . . . occurs through the act of interception itself” and “[n]othing more is required after the interception is made for liability to attach based on this tort.”). It is irrelevant that Prime Healthcare allegedly disclosed the Private Information at the same time as its interception. (See Mot. Dismiss 9–10.) In so arguing, Prime Healthcare conflates the crime-tort exception’s “separate and independent” component with its “temporal” component. As discussed, the “temporal thread” focuses on when the intent to disclose was formed. See Caro, 618 F.3d at 99 (“At the time of the recording the offender must intend to use the recording to commit a criminal or tortious act.”). Whether the disclosure occurs simultaneously with or shortly after the interception, Prime Healthcare’s purpose remained the same at the time of the interception: to disclose private information to third parties in violation of HIPAA. So long as Prime Healthcare intended to disclose the information to a third party at the time of interception, which R.S. plausibly alleges, Prime Healthcare’s argument fails. 3. Purpose Finally, Prime Healthcare argues that it was motivated to use the Pixels to increase profit and advance marketing, not to commit a crime or tort. (Mot. Dismiss 12–13.) Prime Healthcare correctly raises that “[n]umerous courts have held that increasing revenue and decreasing costs are not criminal or tortious endeavors.” (Id. (collecting cases).) Courts are divided as to whether a primary financial motivation shields an intercepting party from liability under the ECPA. Some courts have found that the “crime-tort exception is inapplicable where a defendant’s primary motivation is to make money rather than to injure plaintiffs tortiously or criminally.” Roe v. Amgen Inc., No. 2:23-cv-07448-MCS (SSCx), 2024 WL 2873482, at *6 (C.D. Cal. June 5, 2024); see, e.g., In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 797 (N.D. Cal. 2022) (“Multiple courts . . . have found that the crime-tort exception . . . is inapplicable where the defendant’s primary motivation was to make money, not to injure plaintiffs tortiously.”). Other courts have held that the “presence of a primary financial motive” does not “inoculate[] a defendant from liability under the ECPA.” Cooper, 2024 WL 3586357, at *9; see, e.g., R.C. v. Walgreen Co., 733 F. Supp. 3d 876, 901 (C.D. Cal. 2024) (“[E]ven where a defendant is arguably motivated by monetary gain, the crime-tort exception may nonetheless apply if plaintiffs have adequately alleged that the defendant's conduct violated state law, including state law privacy claims”). The Court joins those courts that have held a monetary purpose does not insulate a party from liability under the ECPA, at least at the motion to dismiss stage. Here, R.S. alleges that Prime Healthcare was aware that disclosing intercepted Private Information violates HIPAA but chose to do so for “marketing and analytics purposes,” to generate profit. (Compl. ¶¶ 7, 19, 25, 69, 157.) Prime Healthcare’s financial gain was contingent on disclosing HIPAA-protected information to third parties. Legitimate objectives, like increasing revenue, do not shield a party from liability for crimes or torts committed in the process. See, e.g., Mekhail v. N. Mem’l Health Care, No. 23-CV-00440 (KMM/TNL), 2024 WL 1332260, at *5 n.4 (D. Minn. Mar. 28, 2024) (“[T]he [c]ourt has serious doubts that a pecuniary purpose and an injurious purpose can always be so clearly distinguished. And it defies common sense that a clearly harmful act could escape liability as long as it was done for profit.”). Take blackmail, which the Ninth Circuit gave as an example of an ECPA violation. See Sussman, 186 F.3d at 1202 (“Where the [interception] is legal, but is done for the purpose of facilitating some further impropriety, such as blackmail,” the statute applies). Under Prime Healthcare’s reading, the ECPA would not prohibit a person from intercepting a communication with the intent to use that communication to blackmail so long as the ultimate reason for the blackmail was to make money. There, the interceptor’s primary purpose would be to make money. And blackmail would merely be a means by which to make money. Of course, this is often the end goal for blackmail. Cf. Blackmail, BLACK’S LAW DICTIONARY (12th ed. 2024) (providing historical definition as a “tax consisting of money, cattle, crops, or other consideration” and providing as an example “threaten[ing] to expose a criminal act unless I am paid money”). Under Prime Healthcare’s reading, blackmail would rarely, if ever, violate the ECPA. This cannot be the case. Cf. Sussman, 186 F.3d at 1202. So too with HIPAA violations. While Prime Healthcare’s goal in violating HIPAA may have been to make money, as alleged, its purpose of intercepting R.S.’s Private Information, as alleged, was to disclose it to third parties. Prime Healthcare’s financial motivation for disclosing R.S.’s Private Information does not immunize it from liability under the ECPA. At this stage, by alleging these facts, R.S. has plausibly raised that Prime Healthcare intercepted her Private Information with the purpose of violating HIPAA, sufficient to satisfy the crime-tort exception. Vv. CONCLUSION For the reasons discussed above, the Court GRANTS R.S.’s Motion to Reconsideration, (ECF No. 26), and DENIES Prime Healthcare’s Motion to Dismiss (ECF No. 13). Accordingly, the Court directs the Clerk to reopen the case. Prime Healthcare shall file an answer to the Complaint within twenty-one (21) days of this Order. January 13, 2025 =“ Fat , fe □□ uai- OTIS D: DISTRI II UNITED STATES DISTRICT JUDGE