Rodriguez v. FastMed Urgent Care, P.C.

• Court: District Court, E.D. North Carolina
• Decided: July 24, 2024
• Docket: 5:23-cv-00403
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF NORTH CAROLINA WESTERN DIVISION No. 5:23-CV-403-D

JACKELYN RODRIGUEZ, ) Plaintiff, v. ORDER FASTMED URGENT CARE, P.C., Defendant. ©

On July 25, 2023, Jackelyn Rodriguez (“Rodriguez” or “plaintiff’), on behalf ofherselfand —

others, filed an action against FastMed Urgent Care, P.C. (“FastMed” or “defendant”) [D.E. 1] for (1) a violation of the Electronic Communications Privacy Act, Title II of the Omnibus Crime Control and Safe Streets Act of 1968, 18 U.S.C. §§ 2510 et seq., (2) negligence under North Carolina law, (3) invasion of privacy for intrusion upon seclusion under North Carolina law, and (4) a violation of the North Carolina Electronic Surveillance Act. See IDE. 1] 58-122. On September 22, 2023, FastMed moved to dismiss the action for lack of subject-matter jurisdiction and failure to state a claim [D.E. 16] and filed a memorandum in support [D.E. 17]. See Fed. R. Civ. P. 12(b)(1), (6). On October 13, 2023, Rodriguez responded in opposition [D.E. 18]. On October 27, 2023, FastMed replied [D.E. 19]. As explained below, Rodriguez has standing to seek damages for her federal claim. The court, however, grants FastMed’s motion to dismiss Rodriguez’s federal claim under Rule 12(b)(6), declines to exercise supplemental jurisdiction over Rodriguez’s state-law claims, and concludes that it does not have subject-matter jurisdiction over Rodriguez’s state-law claims under the Class Action Fairness Act of 2005.

L. Meta produces the Meta Pixel, a “snippet of code” that a business can attach to its website to collect its users’ data. Compl. [D.E. 1] ff] 10-11. The Meta Pixel collects information including website clicks, content accessed, time spent on a website page, and user inquiries. See id. at J 10. To use the Meta Pixel, a business determines what data to collect, provides this information to Meta, allows Meta to develop code to collect this data, and receives the Meta Pixel from Meta. See id. at {| 11. Once the business installs the Meta Pixel on its website, Meta begins collecting the data obtained for commercial purposes, such as developing user profiles and selling targeted advertisements. See id. at { 12. FastMed is an integrated healthcare provider/payer system in Raleigh, North Carolina, operating nearly 200 medical clinics in Arizona, Florida, North Carolina, and Texas. See id. at 75. FastMed installed Meta Pixels on its website and its MyChart portal. See id. at 5, 26. FastMed, however, did not seek consent from patients before sharing their individually-identifiable health information. See id. at J] 32-34, 36-37. Moreover, FastMed represents to its patients that it observes the Health Insurance and Portability and Accountability Act of 1996 (“HIPAA”), all federal and state regulations, and its own privacy policies before sharing its patients’ individually- identifiable health information. See id. at J] 16-30. Rodriguez is a FastMed patient. See id. at f] 4, 45. Since 2015, she has used FastMed’s website and FastMed’s MyChart portal to schedule appointments, locate FastMed providers and locations, find information on specific health conditions, treatments, and medications, message doctors, view doctors notes, schedule appointments, and review medications. See id. at J 45. Rodriguez alleges she provided individually-identifiable health information to FastMed through these mechanisms. See id. at J] 4, 45. In 2009, Rodriguez created a Facebook account and accepted

Facebook’s (now Meta) terms and conditions. See id. at ff 4, 13-14. Rodriguez still uses this account. See id. at □ 4. Rodriguez alleges that FastMed shared her individually-identifiable health information with Meta for commercial gain without her consent and thereby violated HIPAA, federal regulations, state regulations, and FastMed’s privacy policies. See id. at FJ 4, 13-14, 38-50. Rodriguez brings this action on behalf of herself and others similarly situated. See id. at J] 51-57. Rodriguez seeks damages, injunctive relief, and declaratory relief. See id. at J] 82, 110, Prayer for Relief. I. A motion to dismiss under Rule 12(b)(1) tests subject-matter jurisdiction, which is the court’s “statutory or constitutional power to adjudicate the case.” Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 89 (1998) (emphasis omitted); see Fed. R. Civ. P. 12(b)(1). A federal court “must determine that it has subj ect-matter jurisdiction over la claim] before it can pass on the merits of that [claim].” Constantine v. Rectors & Visitors of George Mason Univ., 411 F.3d 474, 479-80 (4th Cir. 2005). When considering a Rule 12(b)(1) motion, the court “may consider evidence outside the pleadings without converting the proceeding to one for summary judgment.” White Tail Park, Inc. v. Stroube, 413 F.3d 451, 459 (4th Cir. 2005) (quotation omitted); see Evans v. B.F. Perkins Co., 166 - F.3d 642, 647 (4th Cir. 1999). A plaintiff must establish that this court has subject-matter

_ jurisdiction over her claims. See, e.g., Steel Co., 523 U.S. at 104; Evans, 166 F.3d at 647; Richmond, Fredericksburg & Potomac R.R. v. United States, 945 F.2d 765, 768 (4th Cir. 1991). However, “when a defendant asserts that the complaint fails to allege sufficient facts to support subject[-]matter jurisdiction, the . . . court must apply a standard patterned on Rule 12(b)(6) and assume the truthfulness of the facts alleged [in the complaint and any additional materials].” Kerns v. United States, 585 F.3d 187, 193 (4th Cir. 2009).

A defendant can mount either a facial or a factual attack upon subject-matter jurisdiction. See Hutton v. Nat’] Bd. of Exam’rs in Optometry, Inc., 892 F.3d 613, 620—21 (4th Cir. 2018); Kerns, 585 F.3d at 192; Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982). A facial attack asserts that complaint fails to allege facts upon which to base subject-matter jurisdiction. See Hutton, 892 F.3d at 621 n.7; Adams, 697 F.2d at 1219. The court takes the factual allegations of the complaint as true when a defendant makes a facial challenge to subject-matter jurisdiction. See Beck v. McDonald, 848 F.3d 262, 270 (4th Cir. 2017); Kerns, 585 F.3d at 192; Adams, 697 F.2d at 1219. FastMed argues that the harms Rodriguez alleges in her federal claim are not a concrete sufficient to support Article III standing. See [D.E. 17] 3-6. A plaintiff establishes standing by showing: (1) that the plaintiff has “suffered an injury in fact—an invasion of a legally-protected interest which is (a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical”; (2) “a causal connection between the injury and the conduct complained of—the injury has to be fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court”; and (3) that it is “likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision” from the court. Chambers Med. Techs. of S.C., Inc. v. Bryant, 52 F.3d 1252, 1265 (4th Cir. 1995) (cleaned up); see Food & Drug Admin. v. All. for Hippocratic Med., 602 U.S. 367, 380 (2024); Tyler v. Hennepin Cnty., 598 U.S. 631, 636 (2023); TransUnion LLC v. Ramirez, 594 U.S. 413, 423-30 (2021); Frank v. Gaos, 586 U.S. 485, 491 (2019); Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016); Lujan v. Defs. of Wildlife, 504 U.S. 555, 560-61 (1992); Laufer v. Naranda Hotels, LLC, 60 F.4th 156, 161 (4th Cir. 2023); Nanni v. Aberdeen Marketplace, Inc., 878 F.3d 447, 450 (4th Cir. 2017). A mere statutory violation is not synonymous with Article III standing. See TransUnion, 594 USS. at 423-30; Krakauer v. Dish Network, L.L.C., 925 F.3d 643, 652-53 (4th Cir. 2019); see also

Frank, 586 U.S. at 493; Spokeo, 578 U.S. at 339. Rather, a plaintiff alleging that a defendant violated her statutory rights must have “a personal stake in the case,” which is “the traditional core of standing.” Krakauer, 925 F.3d at 653; see Murthy v. Missouri, 144 S. Ct. 1972, 1985-86 (2024). Moreover, injury-in-fact requires the plaintiff to demonstrate a “concrete and particularized” harm. Krakauer, 925 F.3d at 653; see Spokeo, 578 U.S. at 340. As for concreteness, the injury must be “teal, and not abstract,” even if the harm is intangible. Spokeo, 578 U.S. at 340 (quotations omitted); see Curtis v. Propel Prop. Tax Funding, L.L.C., 915 F3d 234, 240-41 (4th Cir. 2019). Furthermore, “in determining whether a given injury meets the constitutional threshold, [courts] look to both historic practice and the judgment of Congress.” Krakauer, 925 F.3d at 653; see TransUnion, 594 U.S. at 424-26; Spokeo, 578 U.S. at 340-41; Lujan, 504 U.S. at 560; Garey v. James S. Farrin, P.C., 35 F.4th 917, 921-22 (4th Cir. 2022). Tangible or intangible injuries can satisfy the requirement of concreteness. See Spokeo, 578 U.S. at 340-41. Nonthelesss, “sincere legal, moral, ideological, [or] policy objections” do not create standing. All. for Hippocratic Med., 602 U.S. at 396. “An Article II court is not a legislative assembly, a town square, or a faculty lounge.” Id. at 382. If a plaintiff does not have standing, the court does not have subject-matter jurisdiction to hear the plaintiffs claims. See, e.g., Lujan, 504 U.S. at 560-61; White Tail Park, 413 F.3d at 459; Davis v. Safe Streets USA LLC, 497 F. Supp. 3d 47, 51-55 (E.D.N.C. 2020); Chapman v. CKE Rests. Holdings, Inc., No. 5:19-CV-189, 2020 WL 1230130, at *3-6 (E.D.N.C. Mar. 12, 2020) (unpublished); Payne v. Sears, Roebuck &'Co., No. 5:11-CV-614, 2012 WL 1965389, at *2-3 (E.D.N.C. May 31, 2012) (unpublished). In evaluating a class action complaint, the court analyzes “standing based on” the named plaintiff's “allegations of personal injury.” Hutton, 892 F.3d at 620

(quotation omitted); see Beck, 848 F.3d at 269; Doe v. Obama, 631 F.3d 157, 160 (4th Cir. 2011). Thus, if Rodriguez lacks standing, this court lacks subject-matter jurisdiction. Rodriguez alleges that she suffered the following injuries: a. a loss in the value of [her] individually-identifiable health information; b. embarrassment, humiliation, emotional harm, and distress as a result of the unauthorized transmission and commercial use of [her] individually-identifiable health information; c. being deprived of the full value of healthcare services for which [she] paid, which included a duty to maintain the confidentiality of [her] patient information; d. being deprived of a proportional share of the value Meta paid [FastMed] to gain access to [her] individually-identifiable health information for its commercial use;

e. being deprived of a proportional share of the value [FastMed] gained by putting [her] individually-identifiable health information to its commercial use. Compl. ff 82, 110. Whether disclosing an individual’s private information is an injury is a nuanced inquiry. See TransUnion, 594 U.S. at 432-33 (holding that when a credit union provided third parties with alerts labeling class members as potential terrorists the class members met the injury requirement); Hutton, 892 F.3d at 622 (holding that parties who suffered identity theft and credit card fraud following a data breach met the injury requirement); In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 599-601 (9th Cir. 2020) (holding that when users were not provided with a meaningful opportunity to control or prevent the unauthorized exploration of their private lives, the users met the injury requirement); Mey v. Got Warranty, Inc., 193 F. Supp. 3d 641, 643-50 (N.D.W. Va. 2016) (holding that unwanted phone calls caused concrete harm by depleting a cell phone’s minutes and battery life, as well as the cost of electricity to recharge the phone, and could be recognized through an intrusion upon seclusion or an invasion of privacy claim). But see Clapper v. Amnesty Int'l USA, 568 U.S. 398, 411 (2013) (holding as speculative the contention that the

government would monitor the parties’ communications under 50 U.S.C. § 1881a); Beck, 848 F.3d at 272 (holding that emotional upset and fear of identity theft resulting from a stolen laptop did not constitute injury); Chambliss v. Carefirst, Inc, 189 F. Supp. 3d 564, 570-71 (D. Md. 2016) (holding that a breach compromising names, birth dates, email addresses, and subscriber identification numbers but not social security numbers, credit card information, or other similarly sensitive data did not clearly show when and that future harm would arise). Rodriguez has plausibly alleged concrete injury in her federal claim to support Article I standing. See Compl. 3-4, 17, 20, 25-26, 31-32, 35, 49-50, 62, 82, 106, 110, 114; seee.g., Allen v. Novant Health, Inc., No. 1:22-CV-697, 2023 WL 5486240, at *1 (M.D.N.C. Aug. 24, 2023) (unpublished); Lamie v. LendingTree, LLC, No. 3:22-CV-307, 2023 WL 1868198, at *1-2 (W.D.N.C. Feb. 9, 2023) (unpublished). Rodriguez alleges that she “used FastMed’s website to schedule appointments, locate FastMed providers and locations, and find information on specific health conditions, treatments, and medications” and used “FastMed’s MyChart portal to message doctors, view doctor’s notes, schedule appointments, and review her medication.” Compl. 745. She also alleges that FastMed “sen[t] individually-identifiable health information about her past, present, or future health conditions to Meta” including “medical conditions, concerns, symptoms, . appointments, providers, treatments, medications, bills, and insurance” for “commercial use” using “Meta Pixels” without “notice” or “informed consent.” Id. at Tf 3, 26, 47-50; see, e.g., Facebook, □

956 F.3d at 599. Rodriguez plausibly alleges that her information includes medical information that is protected under HIPAA. See Compl. ff] 1-3. Such patient status is protected health information. See Cousin v. Sharp Healthcare, 681 F. Supp. 3d 1117, 1125-26 (S.D. Cal. 2023); In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 792 (N.D. Cal. 2022). Unlike in Hutton, Beck, and Chambliss, Rodriguez’s information was not stolen. Rather, FastMed allegedly shared the

information without her permission for commercial gain. See Compl. {J 3, 26, 47-50. FastMed’s disclosure need not have harmed Rodriguez financially. Disclosing Rodriguez’s private medical information without the meaningful opportunity to prevent the disclosure satisfies Article I]’s injury requirement. See, e.g., Facebook, 956 F.3d at 599; Allen, 2023 WL 5486240, at *1—2; Meta Pixel Healthcare, 647 F. Supp. 3d at 792-97. Furthermore, because Rodriguez has standing to seek damages for her federal claim, the unnamed class members do too. See Hutton, 892 F.3d at 620. When a plaintiff seeks declaratory or injunctive relief, the court must determine whether the injury is accompanied by “any continuing, present adverse effects.” Lujan, 504 U.S. at 564 (quotations omitted). Such an injury requires: (1) a past injury and (2) “a likelihood that [the plaintiff] will again suffer such injuries.” Nanni, 878 F.3d at 455; see Bryant v. Cheney, 924 F.2d 525, 528-29 (4th Cir. 1991). A plaintiff “satisfies the future injury requirement by plausibly alleging areal and immediate threat of repeated injury.” Nanni, 878 F.3d at 455 (quotation omitted). When a plaintiff alleges an injury by a third-party will result from the defendants’ conduct, “plaintiffs must show that the third-party . . . will likely react in predictable ways to the defendants’ conduct.” Murthy, 144 S. Ct. at 1986 (quotation omitted). Rodriguez requests declaratory and injunctive relief. Rodriguez, however, fails to plausibly allege “continuing, present adverse effects.” Lujan, 504 U.S. at 564 (quotations omitted); see Compl. ff 4, 82, 110, Prayer for Relief For example, Rodriguez does not allege continued data- sharing between FastMed and Meta. Thus, Rodriguez lacks standing for declaratory and injunctive relief concerning her federal claim. Il. A motion to dismiss under Rule 12(b)(6) tests the complaint’s legal and factual sufficiency. See Ashcroft v. Iqbal, 556 U.S. 662, 677-80 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544,

554-63 (2007); Coleman v. Md. Ct. of Appeals, 626 F.3d 187, 190 (4th Cir. 2010), aff'd, 566 U.S. 30 (2012); Giarratano v. Johnson, 521 F.3d 298, 302 (4th Cir. 2008). To withstand a Rule 12(b)(6) motion, a pleading “must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Iqbal, 556 U.S. at 678 (quotation omitted); see Twombly, 550 U.S. at 570; Giarratano, 521 F.3d at 302. In considering the motion, the court must construe the facts and reasonable inferences “in the light most favorable to [the nonmoving party].” Massey v. Ojaniit, 759 F.3d 343, 352 (4th Cir. 2014) (quotation omitted); see Clatterbuck v. City of Charlottesville, 708 F.3d 549, 557 (4th Cir. 2013), abrogated on other grounds by Reed v. Town of Gilbert, 576 U.S. 155 (2015). A court need not accept as true a complaint’s legal conclusions, “unwarranted inferences, unreasonable conclusions, or arguments.” Giarratano, 521 F.3d at 302 (quotation omitted); see Iqbal, 556 U.S. at 678-79. Rather, a plaintiffs factual allegations must “nudge[] [her] claims,” Twombly, 550 U.S. at 570, beyond the realm of “mere possibility” into “plausibility.” Iqbal, 556 U.S. at 678-79. “Determining whether a complaint states a plausible claim for relief... . [is] acontext specific task that requires the reviewing court to draw on judicial experience and common sense.” Iqbal, □□□□ U.S. at 679. “[W]here the well-pleaded facts do not permit the court to infer more than the mere possibility of misconduct,” the complaint does not suffice. Id. When evaluating a motion to dismiss, a court considers the pleadings and any materials “attached or incorporated into the complaint.” E.I. du Pont de Nemours & Co. v. Kolon Indus., Inc., 637 F.3d, 435, 448 (4th Cir. 2011); see Fed. R. Civ. P. 10(c); Goines v. Valley Cmty. Servs. Bd., 822 F.3d 159, 165-66 (4th Cir. 2016); Thompson v. Greene, 427 F.3d 263, 268 (4th Cir. 2005). A court also may consider a document submitted by a moving party if it is “integral to the complaint and there is no dispute about the document’s authenticity” without converting the motion into one for 9 .

summary judgment. Goines, 822 F.3d at 166. “[I]n the event of conflict between the bare allegations of the complaint and any exhibit attached . . . , the exhibit prevails.” Id. (quotation omitted); see Fayetteville Invs. v. Com. Builders, Inc., 936 F.2d 1462, 1465 (4th Cir. 1991). Additionally, a court may take judicial notice of public records. See, e.g., Fed. R. Evid. 201; Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308, 322 (2007); Philips v. Pitt Cnty. Mem’] Hosp., 572 F.3d 176, 180 (4th Cir. 2009). □

A. Under the federal Wiretap Act as amended by the Electronic Communications Privacy Act of 1986, “any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used . . . may in a civil action recover from the person or entity ... which engaged in that violation” unless section 2511(2)(a)(ii) excludes the conduct. 18 U.S.C. § 2520(a). Nonetheless, “[i]t shall not be unlawful under this chapter for a person not acting under color of law to intercept a wire, oral, or electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” Id. § 2511(2)(d).

Intercept means “the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device.” Id. § 2510(4). “TE]lectronic, mechanical, or other device” means “any device or apparatus which can be used to intercept a wire, oral, or electronic communication.” Id. § 2510(5). In order to state a claim, Rodriguez must plausibly allege that FastMed “(1) intentionally (2) intercepted (3) the contents of (4) plaintiffs’ electronic communications (5) using a device.” Meta Pixel Healthcare, 647 F. Supp.

3d at 794-95; see In re Pharmatrak, Inc., 329 F.3d 9, 18 (1st Cir. 2003). With respect to FastMed, Rodriguez also must overcome 18 U.S.C. § 2511(2)(d). See 18 U.S.C. § 2511(2)(d); In re Pharmatrak, Inc., 329 F.3d at 18. Rodriguez alleges that FastMed worked with Meta “to design Meta Pixels that intercept the characteristics and content of electronic communications containing individually-identifiable health ©

information” to “transmit this information to Meta.” Compl. 62. Assuming without deciding that Rodriguez has plausibly alleged that the Meta Pixel is a device that intercepts and transmits electronic communications, Rodriguez has not plausibly alleged that FastMed, not Meta, intercepted her information in violation of the statute. See, e.g., Allen, 2023 WL 5486240, at *4. Rodriguez also alleges that she “used FastMed’s website to schedule appointments, locate FastMed providers and locations, and find information on specific health conditions, treatments, and medications” and used “FastMed’s MyChart portal to message doctors, view doctor’s notes, schedule appointments, and review her medication.” Compl. { 45. Because FastMed was a party to Rodriguez’s communication and FastMed “intercepted” Rodriguez’s individually-identifiable health information with her prior consent, FastMed did not violate 18 U.S.C. § 2520(a). See 18 U.S.C. § 2511(2)(d).

Rodriguez alleges the legal conclusion that FastMed intercepted and transmitted her data to Meta “for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” Id. (emphasis added); see Compl. {J 64-65. Rodriguez, however, also alleges that “the purpose of [FastMed]’s criminal or tortious act” was “disclosing the [c]lass members’ individually-identifiable health information . . . for commercial use.” Compl. J 65.

. 11

The court need not accept Rodriguez’s legal conclusions in her complaint about FastMed’s alleged purposes for intercepting and disclosing her data to Meta. See Iqbal, 556 U.S. at 677-80; Twombly, 550 U.S. at 554-63. The “mere possibility,” Iqbal, 556 U.S. at 679, that FastMed intercepted and disclosed Rodriguez’s data to Meta “for the purpose of committing any criminal or tortious act” does not suffice. 18 U.S.C. § 2511(2)(d). Even viewing Rodriguez’s complaint in the light most favorable to Rodriguez, FastMed intercepted and disclosed ‘the class members’ information for commercial use or gain, not to commit a crime or tort. See, e.g., In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 145 (3d Cir. 2015); Caro v. Weintraub, 618 F.3d 94, 99-101 (2d Cir. 2010); Sussman v. Am. Broad. Cos., 186 F.3d 1200, 1202-03 (9th Cir. 1999); Kurowski v. Rush Sys. for Health, 659 F. Supp. 3d 93 1, 936-404 (N.D. Ill. 2023). Accordingly, Rodriguez’s federal claim fails. □

In opposition to this conclusion, Rodriguez cites Smith v. Loyola University Medical Center, No. 23 CV 15828, 2024 WL 3338941 (N.D. Ill. July 9, 2024) (unpublished), and argues that “Smith holds that [Rodriguez’s] allegation about [FastMed] disclosing ‘information regarding their personal □ health conditions and treatments to third parties . .. knowingly and for purposes of financial gain’ (as in [Rodriguez’s] [c]omplaint) . . . ‘are sufficient to invoke HIPPA for purposes of the ECPA’s crime tort exception.” [D.E. 20] 2 (quoting Smith, 2024 WL 3338941, at *7). Rodriguez, however, misreads the governing statutes and misreads Smith. As discussed in Smith, 42 U.S.C. § 1320d- 6(a)(3) provides that a “person who knowingly and in violation of this part discloses individually identifiable health information to another person shall be punished as provided in subsection (b).” 42 U.S.C. § 1320d-6(a)(3). Subsection 1320d-6(a) requires the person to have “obtained or disclosed [the] information without authorization.” Id. Moreover, 18 U.S.C. § 2520(a) provides an exception to civil liability “for a person not acting under color of law to intercept a wire, oral, or 12

electronic communication where such person is a party to the communication or where one of the parties to the communication has given prior consent to such interception unless such communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State.” 18 U.S.C. 2511(2)(d) (emphasis added). Furthermore, as discussed, merely alleging that FastMed intercepted and disclosed Rodriguez’s information to Meta for commercial use or gain, see Compl. J 65, does not equate to FastMed intercepting and disclosing Rodriguez’s information “for the purpose of committing any criminal or tortious act.” 18 U.S.C. § 2511(2)(d). Thus, Smith does not help Rodriguez, and Rodriguez fails to state a claim under 18 U.S.C. § 2520. B. This court has jurisdiction over count one under 28 U.S.C. § 1331 and supplemental jurisdiction under 28 U.S.C. § 1367 over the state-law claims in counts two, three, and four because they arose from the same nucleus of operative fact. See Compl. ff 6, 8. A court may decline to exercise supplemental jurisdiction over a state-law claim when (1) “the claim raises a novel or complex issue of State law;” (2) “the claim substantially predominates over” the federal claim or claims; (3) the court has “dismissed all claims over which it has original jurisdiction;” or (4) other “exceptional circumstances” present “compelling reasons for declining jurisdiction.” 28 U.S.C. § 1367(c)(1}{4). Additionally, a court may decline to exercise supplemental jurisdiction when “values of economy, convenience, fairness, and comity” make retaining jurisdiction inappropriate. Carnegie-Mellon Univ. v. Cohill, 484 U.S. 343, 351 (1988), superseded on other grounds by 28 U.S.C. § 1447(c); see Hinson v. Norwest Fin. S.C., Inc., 239 F.3d 611, 617 (4th Cir. 2001); Shanaghan v. Cahill, 58 F.3d 106, 109 (4th Cir. 1995).

Eliminating all federal claims before trial generally suffices for a federal court to decline supplemental jurisdiction over pendent state-law claims. “[I]n the usual case in which all federal-law claims are eliminated before trial, the balance of factors to be considered under the pendent jurisdiction doctrine—judicial economy, convenience, fairness, and comity—will point toward declining to exercise jurisdiction over the remaining state-law claims.” Carnegie-Mellon, 484 U.S. at 350 n.7; see Shanaghan, 58 F.3d at 110; see also Walsh v. Mitchell, 427 F. App’x 282, 283 (4th Cir. 2011) (per curiam) (unpublished); Root v. Cnty. of Fairfax, 371 F. App’x 432, 435 (4th Cir. 2010) (per curiam) (unpublished). Thus, the court declines to exercise jurisdiction over Rodriguez’s state-law claims. See, e.g., Carnegie-Mellon, 484 U.S. at 350 n.7. Rodriguez also alleges that this court has subject-matter jurisdiction over her state-law claims under the Class Action Fairness Act of 2005, 28 U.S.C. §§ 1332(d), 1453, and 1711-1715 (“CAFA”). See Compl. 7. CAFA provides, inter alia, that “district courts shall have original jurisdiction of any civil action in which the matter in controversy exceeds the sum or value of $5,000,000, exclusive of interest and costs, and is a class action in which . . . any member of aclass of plaintiffs is a citizen of a State different from any defendant.” 28 U.S.C. § 1332(d)(2). Although the court reads CAFA’s provisions broadly, “the plaintiff still must plausibly allege jurisdiction.” Skipper v. CareFirst BlueChoice, Inc., Civ. No. 21-1022, 2023 WL 2410858, at *3 (D. Md. Mar. 8, 2023) (unpublished); see Dart Cherokee Basin Operating Co., LLC v. Owens, 574 U.S. 81, 89 (2014) (holding that a defendant who removes an action under CAFA must “include a plausible allegation that the amount in controversy exceeds the jurisdictional threshold”); Scott v. Cricket Comme’ns, LLC, 865 F.3d 189, 194 (4th Cir. 2017). Rodriguez’s putative class encompasses “[a]ll people who used FastMed’s web properties and had individually-identifiable health information about their past, present, or future health 14

conditions shared with Meta without notice or consent.” Compl. 7 51. Rodriguez plausibly alleges that her putative class includes “thousands” of members who reside in “Florida, Texas, and Arizona,” while FastMed resides in North Carolina. Id. at 5. Rodriguez’s allegations satisfy CAFA’s minimal diversity requirement. See 28 U.S.C. § 1332(d)(2)(A). Rodriguez, however, fails to plausibly allege the amount in controversy in this action. For example, Rodriguez fails to allege a dollar amount by which FastMed reduced “the value of [the class members’] individually- identifiable health information” or the “value of healthcare services for which [the class members] paid.” Compl. 82. Accordingly, the court does not have original jurisdiction over Rodriguez’s state-law claims under CAFA. See, e.g., Denson v. Capital Jazz Inc., Civ. No. 22-2526, 2023 WL 3027434, at *3-4 (D. Md. Apr. 20, 2023) (unpublished); Skipper, 2023 WL 2410858, at *3—-4. IV. In sum, the court DENIES defendant’s motion to dismiss for lack of subject-matter jurisdiction [D.E. 16], GRANTS IN PART and DENIES IN PART defendant’s motion to dismiss for failure to state a claim [D.E. 16], DISMISSES WITHOUT PREJUDICE plaintiff s federal claim in count one, and DECLINES TO EXERCISE JURISDICTION over plaintiffs state-law claims in counts two, three, and four. Thus, the court DISMISSES WITHOUT PREJUDICE plaintiff's state- law claims. SO ORDERED. This 24 day of July, 2024.

A IN J S C. DEVER Il United States District Judge