Robert Hanson, on behalf of himself and all others similarly situated v. Sanford Health Corp.

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA

ROBERT HANSON, on behalf of himself Case No. 25-CV-3129 (PJS/LIB) and all others similarly situated, Plaintiff, v. ORDER SANFORD HEALTH CORP., Defendant.

Benjamin Cooper, Rachel K. Tack, Brian C. Gudmundson, and Madison M. DeMaris, ZIMMERMAN REED LLP, for plaintiff. Shawn M. Raiter, Zane P. Aubert, Alex Baker Kroeger, and Matthew B. Bolt, LARSON KING LLP, for defendant. Plaintiff Robert Hanson brings this putative class action against defendant Sanford Health Corp. (“Sanford”), asserting various claims arising out of Sanford’s collection and dissemination of information that it acquired as a result of Hanson’s use

of its website. This matter is before the Court on Sanford’s motion to dismiss five of Hanson’s six claims. For the reasons that follow, the motion is granted as to Hanson’s claims for

intrusion upon seclusion and violation of the Minnesota Health Records Act and denied in all other respects. I. BACKGROUND Sanford, the largest rural health system in the United States, owns hospitals,

clinics, and senior-care communities. Compl. ¶ 2. Sanford maintains a website where current and prospective patients can search for doctors and Sanford locations, research the medical services that Sanford provides, and find access to care. Compl ¶ 3.

Sanford deploys various tracking tools on its website, including the Meta Pixel, a snippet of code that tracks user’s activities on Sanford’s website and sends information to Meta. Compl. ¶ 4. Meta uses that data to build profiles for targeted advertisements and marketing. Compl. ¶ 4. Meta is able to link Facebook profiles to the information

transmitted by Pixel. Compl. ¶¶ 61, 66. Even if a user is not logged in to a Facebook account, Pixel can transmit a unique identifier to link the user’s web communications with the user’s Facebook profile. Compl. ¶¶ 62, 71. Sanford deploys similar tracking

tools from at least ten other third-party technology companies, including Snapchat and Google. Compl. ¶ 72. Sanford’s website includes a “Privacy Statement” that states as follows: We do not share personal information with third parties unrelated to Sanford Health, except when required to for legal purposes or investigations. We may share your personal information with third parties who we have contracted with to help us provide services. We will ensure that these third parties have agreed not to use or disclose your personal information except to help us provide the services. -2- Compl. ¶ 36. Hanson is a current Sanford patient who, in the fall of 2024, needed back surgery.

Compl. ¶ 14–15. Before his surgery, Hanson visited the “Doctors” page on the Sanford website and searched for information about his doctor. Compl. ¶ 15. After interacting with Sanford’s website, Hanson started receiving targeted advertisements from third

parties that related to back and spine issues. Compl. ¶ 16. II. ANALYSIS A. Standard of Review In reviewing a motion to dismiss under Fed. R. Civ. P. 12(b)(6), a court must

accept as true all of the factual allegations in the complaint and draw all reasonable inferences in the plaintiff’s favor. York v. Wellmark, Inc., 965 F.3d 633, 638 (8th Cir. 2020). Although the factual allegations need not be detailed, they must be sufficient to “raise a

right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). The complaint must “state a claim to relief that is plausible on its face.” Id. at 570.

-3- B. Count I: Intrusion upon Seclusion1 Hanson brings a claim of intrusion upon seclusion based on his allegations that

Sanford used tracking tools to intercept information that Hanson provided to Sanford and relay that information to third parties (including Meta). “Intrusion upon seclusion occurs when one intentionally intrudes, physically or otherwise, upon the solitude or

seclusion of another or his private affairs or concerns if the intrusion would be highly offensive to a reasonable person.” Lake v. Wal-Mart Stores, Inc., 582 N.W.2d 231, 233 (Minn. 1998) (cleaned up). Accordingly, “[t]he tort has three elements: (a) an intrusion; (b) that is highly offensive; and (c) into some matter in which a person has a legitimate

expectation of privacy.” Swarthout v. Mut. Serv. Life Ins. Co., 632 N.W.2d 741, 744 (Minn. Ct. App. 2001). Hanson’s claim fails because he is not complaining about an intrusion; instead, he

is complaining about a disclosure—specifically, Sanford’s disclosure, to third parties, of information that Hanson voluntarily provided to Sanford. A plaintiff cannot maintain an intrusion-upon-seclusion claim when he voluntarily disclosed the relevant

1Hanson’s complaint labels this claim “Invasion of Privacy,” Compl. at 50, but “invasion of privacy” is a general term for a category of related torts. See Lake v. Wal- Mart Stores, Inc., 582 N.W.2d 231, 233 (Minn. 1998) (describing “the four causes of action that comprise the tort generally referred to as invasion of privacy,” including intrusion upon seclusion, appropriation, publication of private facts, and false-light publicity). Hanson’s briefing makes clear that he is bringing a claim of intrusion upon seclusion. See ECF No. 21 at 14 (when citing documents by ECF number, the Court cites to the electronically generated page numbers at the top of the page). -4- information to the defendant. See Lehman v. Zumbrota-Mazeppa Pub. Schs., No. A04-1226, 2005 WL 894756, at *4 (Minn. Ct. App. Apr. 19, 2005). Nor does the defendant’s later

unauthorized disclosure of that (voluntarily provided) information give rise to a claim of intrusion upon seclusion. Id. Hanson argues that this case is distinguishable from cases like Lehman because he

disclosed information to Sanford with the understanding that Sanford would keep his information private.2 But that does not distinguish this case from any other case in which a plaintiff is complaining about an unauthorized disclosure to third parties, as the tort requires a plaintiff to prove that the intrusion be “into some matter in which a

person has a legitimate expectation of privacy.” Swarthout, 632 N.W.2d at 744. Hanson also compares this case to Swarthout, in which the defendant insurance company altered the plaintiff’s medical-release form to obtain more information than

the plaintiff had authorized and then disclosed that information to other insurance companies. Swarthout, 632 N.W.2d at 745. Swarthout is distinguishable for two reasons. First, it is clear that the defendant did, in fact, engage in an unauthorized intrusion when it altered the plaintiff’s medical release and obtained information about the plaintiff that

2This argument appears to be an attempted end run around the elements of a related tort—publication of private facts—which requires that the private facts be “disseminat[ed] to the public at large.” Bodah v. Lakeville Motor Express, Inc., 663 N.W.2d 550, 557 (Minn. 2003). -5- he had not agreed it could obtain. Id. Second, the element of intrusion was not even at issue; instead, the issue was whether the intrusion was highly offensive. Id. & n.1.

In short, because Hanson voluntarily disclosed the information to Sanford, he fails to meet the element of an intrusion. See Lehman, 2005 WL 894756, at *4 (explaining than intrusion upon seclusion requires “an invasion, some type of affirmative act by the

defendant in obtaining the information”). The Court therefore grants Sanford’s motion to dismiss this claim. C. Count II: Electronic Communications Privacy Act The Electronic Communications Privacy Act (“ECPA”) prohibits intentionally

intercepting, or procuring another to intercept, “any wire, oral, or electronic communication.” 18 U.S.C. § 2511(1)(a). This prohibition does not apply to a person who is a party to the communication. Id. § 2511(2)(d). Under the “crime/tort”

exception, however, a party to the communication may nevertheless be liable if the party intercepted the communication “for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” Id.

Sanford argues that Hanson’s ECPA claim should be dismissed because Sanford was a party to the communications and the crime/tort exception does not apply. Specifically, Sanford contends that it did not intercept the communications for the

-6- purpose of committing a crime or a tort, but rather to make money. Hanson alleges, however, that the disclosure of his information to Meta and other third parties was a

violation of the Health Insurance Portability and Accountability Act (“HIPAA”). Compl. ¶¶ 4 & n.4, 123–31. Assuming that Sanford’s disclosure to third parties was a HIPAA violation—and Sanford does not argue, at least at this stage, that it was not—the

fact that Sanford violated HIPAA for pecuniary gain does not render the crime/tort exception inapplicable. To the contrary, money is a common motive for criminal offenses. Sanford also argues that the crime/tort exception does not apply because Hanson

failed to allege a crime or a tort that is distinct from the alleged ECPA-violating interception. The Court disagrees. Hanson alleges that the disclosure, not the original interception, violated HIPAA. Hanson has adequately alleged a separate violation

sufficient to trigger the crime/tort exception. Sanford’s motion to dismiss Hanson’s ECPA claim is therefore denied. D. Count III: Minnesota Uniform Deceptive Trade Practices Act Hanson next brings a claim under Minnesota’s Uniform Deceptive Trade

Practices Act (“MUDTPA”), Minn. Stat. § 325D.43 et seq. Under MUDTPA, it is unlawful to “represent[] that goods or services have sponsorship, approval, characteristics, ingredients, uses, benefits, or quantities that they do not have” or to

-7- “represent[] that goods or services are of a particular standard, quality, or grade, or that goods are of a particular style or model, if they are of another.” Minn. Stat. § 325D.44,

subd. 1(5), (7). Money damages are not available under MUDTPA, but “[a] person likely to be damaged by a deceptive trade practice of another” may obtain injunctive relief. Minn. Stat. § 325D.45, subd. 1.

Hanson alleges that Sanford violated MUDTPA by failing to implement and maintain reasonable privacy measures, misrepresenting that it would protect confidential information, and failing to disclose that it did not protect confidential information. In response, Sanford first argues that Hanson has failed to satisfy the

particularity requirements of Fed. R. Civ. P. 9(b). See E-Shops Corp. v. U.S. Bank Nat’l Ass’n, 678 F.3d 659, 665 (8th Cir. 2012) (the heightened pleading requirements of Rule 9(b) apply to MUDTPA claims). To satisfy Rule 9(b), a plaintiff must plead “the

time, place, and content of the defendant’s false representations, as well as the details of the defendant’s fraudulent acts, including when the acts occurred, who engaged in them, and what was obtained as a result.” U.S. ex rel. Raynor v. Nat’l Rural Utils. Coop. Fin., Corp., 690 F.3d 951, 955 (8th Cir. 2012) (citation omitted). “The level of particularity

required depends on the nature of a case.” E-Shops Corp., 678 F.3d at 663. Under the circumstances of this case, Hanson’s complaint satisfies Rule 9(b). The complaint identifies the content and place of the alleged misrepresentations—namely,

-8- Sanford’s written privacy policies and disclosures published on Sanford’s website. Although the complaint does not identify the exact date on which Hanson used

Sanford’s website, such precision is not required in a case involving official corporate speech published on a company website. See McGregor v. Uponor, Inc., No. 09-CV-1136 ADM/JJK, 2010 WL 55985, at *4 (D. Minn. Jan. 4, 2010) (allegations of corporate

misrepresentations on the defendants’ website were sufficient even though the plaintiffs did not always specify a date or month); cf. Solvay Pharms., Inc. v. Glob. Pharms., 298 F. Supp. 2d 880, 885–86 (D. Minn. 2004) (allegations that the defendants, on an ongoing basis, falsely advertised a generic drug as equivalent to a name-brand version were

sufficiently particularized to satisfy Rule 9(b)). Finally, although the complaint’s description of Hanson’s website query is imprecise, the complaint alleges that, in anticipation of upcoming back surgery, Hanson

visited Sanford’s “Doctors” page to search for information about his doctor. Compl. ¶ 15. This level of detail is sufficient for Sanford to craft a defense, particularly as at the hearing on Sanford’s motion to dismiss it appeared that both sides understood that Hanson had searched his doctor’s name. See Com. Prop. Invs., Inc. v. Quality Inns Int’l,

Inc., 61 F.3d 639, 644 (8th Cir. 1995) (“one of the main purposes of [Rule 9(b)] is to facilitate a defendant’s ability to respond and to prepare a defense to charges of fraud”). Hanson has therefore adequately pleaded the time, place, and content of the alleged

-9- misrepresentations, the identity of the speaker (Sanford), and what Sanford obtained as a result of the misrepresentations (the information that Hanson disclosed to Sanford).

Sanford next argues that Hanson lacks standing to seek injunctive relief—the only type of relief available under MUDTPA—because he failed to allege a likelihood of future harm. See Minn. Stat. § 325D.45, subd. 1 (authorizing an award of injunctive

relief to “[a] person likely to be damaged by a deceptive trade practice of another”). In this case, however, Hanson alleges that Sanford unlawfully disclosed his private information to third parties. It is therefore plausible that Hanson faces ongoing harm from further misuse of his already-disclosed private information as well as potential

further disclosures of that information. See Mekhail v. N. Mem’l Health Care, 726 F. Supp. 3d 916, 933–34 (D. Minn. 2024) (finding that a plaintiff had standing under MUDTPA because, among other things, she alleged the likelihood that her data would continue to

be misused). This case is thus distinguishable from a case in which, for example, a consumer relied on a misleading statement in making a one-time purchase. Sanford next argues that Hanson failed to allege a causal nexus between Sanford’s alleged disclosures and his harm because he failed to allege that the targeted

ads to which he was subjected did not or could not have come from another source unrelated to Sanford.3 The Court disagrees. Again, Hanson alleged that, in anticipation

3At oral argument, Sanford contended that Hanson cannot show reliance because (continued...) -10- of back surgery, he looked up information about his doctor on Sanford’s website, that Sanford transmitted information generated by the query to unauthorized third parties

for marketing and advertising purposes, and that, after using Sanford’s website, Hanson started receiving targeted advertising from third parties relating to back and spine issues. Compl. ¶¶ 8, 16. These allegations are presumed true at this stage and are

sufficient to render Hanson’s claim plausible.4 Finally, Sanford argues that its website is not deceptive because the website provided notice of the use of the tracking tools on which Hanson’s claims are based. While this is true, the disclosure also states that Sanford does not share personal

information with third parties except when required by law and to help third-party contractors provide services—a statement that Hanson alleges to be false. Compl. ¶¶ 36, 192(d), (e). Hanson has adequately alleged a misleading statement. The Court

therefore denies Sanford’s motion to dismiss Hanson’s MUDTPA claim.

3(...continued) he failed to allege that he read the disclosures on Sanford’s website. Sanford did not clearly make this argument in its briefing, however, and the Court therefore does not address it. 4Sanford makes this same causal-nexus argument in seeking dismissal of Hanson’s claim under the Minnesota Consumer Fraud Act (“MCFA”), Minn. Stat. § 325F.69 (Count V). For the same reasons set forth above, the Court rejects this argument and denies Sanford’s motion to dismiss the MCFA claim. -11- E. Count IV: Minnesota Health Records Act The Minnesota Health Records Act (“MHRA”), Minn. Stat. § 144.291 et seq.,

imposes liability on anyone who negligently or intentionally releases a patient’s “health record” in violation of the MHRA. Minn. Stat. § 144.298, subd. 2(1). Sanford moves to dismiss, arguing that information concerning Hanson’s search for a doctor on its

website is not a “health record.” Under the MHRA, a “health record” is “any information, whether oral or recorded in any form or medium, that relates to [1] the past, present, or future physical or mental health or condition of a patient; [2] the provision of health care to a patient; or

[3] the past, present, or future payment for the provision of health care to a patient.” Minn. Stat. § 144.291, subd. 2(c). A “patient,” in turn, is defined, in relevant part, as “a natural person who has received health care services from a provider for treatment

or examination of a medical, psychiatric, or mental condition.” Minn. Stat. § 144.291, subd. 2(g). Hanson contends that his website query constitutes a “health record” because it discloses his status as a patient of Sanford and the identity of his doctor. The Court

disagrees. As noted, to qualify as a “health record,” information must relate to a “patient.” Hanson searched for information about a doctor on Sanford’s public website, which Hanson does not dispute is available to anyone in the world with an Internet

-12- connection—without the need to log in or otherwise identify oneself as a Sanford patient.5 Consequently, the information generated by Hanson’s website query could

not disclose that Hanson is a “patient”—that is, “a natural person who has received health care services from a provider for treatment or examination of a medical, psychiatric, or mental condition.” Minn. Stat. § 144.291, subd. 2(g).

Of course, one may infer that a person who searches a provider’s name on a public healthcare website might already be a patient of that provider. Under the MHRA, however, information from which one may infer patient status is insufficient to render that information a “health record.” See Rhoades v. Lourey, No. A18-1120, 2019 WL

1006804, at *2 (Minn. Ct. App. Mar. 4, 2019) (“information from which a person’s status as a patient could be inferred” does not by itself constitute a “health record”); see also Furlow v. Madonna Summit of Byron, No. A19-0987, 2020 WL 413356, at *3 (Minn. Ct.

App. Jan. 27, 2020) (photograph of plaintiff next to woman wearing scrubs was not a “health record”); cf. Holtzbauer v. Allina Health Sys., 23 N.W.3d 608, 619 (Minn. Ct. App. 2025) (distinguishing Furlow on the basis that “Allina disclosed that Holtzbauer was a patient who was hospitalized” and therefore “[t]here was no inference required to

5The parties dispute whether it is possible for the information that Sanford discloses to third parties to individually identify website users. Even if Hanson were individually identifiable, however, the information generated by Hanson’s query would still fail to qualify as a “health record,” for the reasons discussed below. -13- discern [Holtzbauer’s] status as a current patient receiving care”), review granted (Aug. 12, 2025).

Here, the information at issue is much more comparable to the information in Furlow than it is to the information in Holtzbauer. Like in Furlow—and unlike in Holtzbauer—the information disclosed about Hanson could not have identified him as a

patient; the recipient of the information could only guess about whether Hanson was or was not a patient. Consequently, that information does not constitute a “health record” under the MHRA. Sanford’s motion to dismiss Hanson’s MHRA claim is granted. F. Class Allegations

Finally, Sanford asks the Court to strike Hanson’s “fail-safe” class definition. This argument would be better addressed at the class-certification stage, with the benefit of discovery and full briefing. The Court therefore declines Sanford’s request

without prejudice. ORDER Based on the foregoing, and on all of the files, records, and proceedings herein, IT IS HEREBY ORDERED THAT:

1. Defendant’s motion to dismiss [ECF No. 12] is GRANTED IN PART and DENIED IN PART.

-14- 2. The motion is GRANTED as to Count I (Invasion of Privacy) and Count IV (Minnesota Health Records Act), and those claims are DISMISSED WITH

PREJUDICE AND ON THE MERITS. 3. The motion is DENIED in all other respects.

Dated: September 4, 2026 /s/ Patrick J. Schiltz Patrick J. Schiltz United States District Judge

-15-