SMART v. MAIN LINE HEALTH

Opinion

LIN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF PENNSYLVANIA

DAVID SMART, : Plaintiff, : Vv. . CIVIL NO. 22-5239 MAIN LINE HEALTH, . Defendant. : MEMORANDUM Scott, J. April 14, 2026 In his Second Amended Class Action Complaint (“SAC”), ECF No. 39, Plaintiff David Smart alleges that Defendant Main Line Health told patients that it would protect their health information and personally identifiable information (collectively, “private information”). Smart further alleges that Main Line Health backtracked on its privacy policy by commercializing the private information through installing Meta Pixel and Meta Conversions API, two pieces of software that allow a website owner to study website user behavior and to collect private information (collectively, the “Meta Collection Tools”). Smart asserts claims for (1) violation of the Electronic Communications Privacy Act, 18 U.S.C. § 2510 et seq. ““ECPA”), (2) negligence, and (3) invasion of privacy — intrusion upon seclusion. Presently before the Court is Main Line Health’s Motion to Dismiss the Second Amended Complaint. ECF No. 42. Smart filed a Response in Opposition. ECF No. 43. Main Line Health filed a Reply. ECF No. 45. Smart filed, without seeking permission from the Court, a Sur-Reply. ECF No. 46. Afterwards, Main Line Health submitted four Notices of Supplemental Authority. ECF Nos. 48, 49, 50, and 53. Smart likewise filed four Notices of Supplemental Authority. ECF Nos. 47, 51, 52, and 54.

For reasons explained below, the Court grants in part and denies in part Main Line Health’s Motion to Dismiss. I. BACKGROUND Smart brings this putative class action against Main Line Health, a nonprofit health system that operates a public-facing website where users can search for medial providers, research conditions and treatments, and schedule appointments. Sec. Am. Compl. § 4. Additionally, when a website user wishes to schedule an appointment online, the user is directed to a log-in page on Main Line Health’s MyChart portal. Jd. § 67. Throughout its website, Main Line Health installed Meta Pixels and the Meta Conversions API, technologies that collect information about users’ interactions with the website and transmit that information to Meta, who in turn, sells the information to marketers and advertisers. Jd. {§ 12—15, 21-22, 29. Smart alleges that Main Line’s Health use of the Meta Collection Tools captured information about Smart’s medical profile, including his research into “conditions and treatments,” “providers,” and scheduling of medical appointments. SAC § 184. Smart also alleges that Main Line Health captured certain URLs that contain “communications about Plaintiff's prospective healthcare” that were sent to Meta through Meta Pixels, including URLs that Smart visited on the Main Line Health website when making an appointment and logging-in to Main Line Health’s MyChart page. /d. § 184(g)-(h). Other information captured by these tools are website users’ “names, dates they sought treatments, computer IP addresses, device identifiers, [Facebook] IDs, ... web URLs [visited by users], services selected, patient statuses, medical conditions, treatments, provider information, and appointment information.” /d. § 82. According to the Complaint, Main Line Health informed patients that it was collecting their data in its privacy policy. SAC 4 2. But Main Line Health “never informed patients of its intention to disclose their private information to Meta, never received signed authorizations from patients

allowing it to disclose their Private Information to Meta, and never told patients it shared their Private Information with Meta.” /d. § 115. On Smart’s view, this failure to inform and to receive permission prior to installing the Meta Collection Tools means that Main Line Health violated its own privacy policy, which represented to patients that Main Line Health will only disclose personal health information with patients’ written permission and that Main Line Health would “seek [patients’] written permission prior to using or sharing [patient] information for marketing purposes or selling [patient] information.” /d. § 134. This failure also, on Smart’s telling, has led to a variety of HIPAA violations concerning requirements to safeguard patient health information. Id. 4 112-13. II. LEGAL STANDARD To survive a Rule 12(b)(6) motion, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “Plausibility means ‘more than a sheer possibility that a defendant has acted unlawfully.’” Tatis v. Allied Interstate, LLC, 882 F.3d 422, 426 (3d Cir. 2018) (quoting /gbal, 556 U.S. at 678). A claim is plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” /gbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 556). ‘““Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Jd. In considering a motion to dismiss under Rule 12(b)(6), all well-pleaded allegations in the complaint are accepted as true and interpreted in the light most favorable to the plaintiff, and all inferences are drawn in the plaintiff's favor. See McTernan v. City of York, 577 F.3d 521, 526 (3d Cir. 2009) (quoting Schrob v. Catterson, 948 F.2d 1402, 1408 (3d Cir. 1991)).

Il. DISCUSSION A. Plaintiff Alleges Sufficient Facts to State an ECPA Claim To state a claim for relief under the ECPA, Smart must plead sufficient facts to make plausible that Main Line Health “‘(1) intentionally (2) intercepted, endeavored to intercept or procured another person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication, (5) using a device.’” Jn re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 135 (3d Cir. 2015) (quoting /n re Pharmatrak, Inc., 329 F.3d 9, 18 (1st Cir. 2003)). The “party exception” to the ECPA states that it is not “unlawful to intercept the communication when party to a communication.” § 18 U.S.C. 2511(2)(d). This exception, however, has its own exception, known as the “crime-tort exception:” a party to the communication cannot intercept communications “for the purpose of committing any criminal or tortious act.” Jd. To invoke the crime-tort exception at the motion-to-dismiss stage, a plaintiff must not only allege that a defendant intercepted the communications with a criminal and tortious purpose but also allege that the criminal or tortious conduct is something other than the interception itself or that there is a “tortious or criminal use” of the intercepted contents. /n re Google, Inc., 806 F.3d at 145 (emphasis in original). Smart alleges that Main Line Health intercepted sensitive communications—including attempts by users to schedule appointments and to log-in to a patient portal—by installing the Meta Collection Tools, and that Main Line Health put these intercepted communications to criminal use by effectively selling users’ private information to marketers. See, e.g., SAC ¥§ 110-17. Why is selling this information to marketers criminal? Smart’s answer is that it violates the Health Insurance Portability and Accountability Act (“HIPAA”), which imposes federal criminal liability when an entity discloses individually identifiable health information without prior authorization

and with the intent to use the information for commercial advantage. 42 U.S.C. § 1320(d)(6); see also SAC § 110. Main Line Health’s main argument is that the alleged criminal use is not an act distinct from the interception. Because the Meta Collection Tools both intercept the communications and send them to Meta in one fell swoop, there is no independent or secondary act, which is required to apply the crime-tort exception. ECF No. 42-1 at 17-18 (“Multiple of Plaintiff's listed alleged criminal or tortious purposes are merely the means by which Plaintiff alleges Main Line Health or Meta acquired the alleged communications.”); see also ECF No. 53 (discussing cases that refuse to apply the crime-tort exception to ECPA). Although some courts have accepted Plaintiff's arguments, several courts have also rejected this argument. See, e.g., Murphy v. Thomas Jefferson University Hospitals, Inc., 2024 WL 4350328, at *4 (E.D. Pa. Sept. 30, 2024) (“Defendant at minimum intended to violate HIPAA with the disclosure of Plaintiffs’ [private information] to Meta. Courts have found the intention to violate HIPAA sufficient to invoke the crime-tort exception to the ECPA.”); A.D. v. Aspen Dental Memt., Inc., 2024 WL 4119153, at *3 (N.D. Ill. Sept. 9, 2024) (“Plaintiffs plausibly alleged that Aspen intended to violate HIPAA when it transmitted Plaintiffs’ information to third parties, which is distinct from the improper interception at issue in the ECPA claim.”) (citation modified); Kurowski v. Rush System for Health, 2023 WL 8544084, at *3 (N.D. Ill. Dec. 11, 2023) (“Kurowski alleges that Rush knowingly transmits this data and that it does so for the purpose of financial gain. All of these allegations, taken together, are sufficient to invoke the HIPAA exception-to-the-party-exception.”) (citation modified).

Main Line Health attempts to distinguish this case from Murphy, arguing that in Murphy, “plaintiffs’ allegations were not limited to the public website . . . [but] tracking and collection technologies were being used on the hospitals’ secure patient portal and mobile application.” ECF No. 49 at 2. The Court accepts Smart’s well-pleaded allegations as true at this stage, and Smart has alleged that Main Line Health installed the Meta Collection Tools on,

Main Line’s Health argument fails because Smart has alleged an independent use of the intercepted communication, which meets the Third Circuit standard of a distinct “tortious or criminal use.” In re Google Inc., 806 F.3d at 145 (emphasis in original). After the Meta Collection Tools captured the contents of user communications, Main Line Health shared that information to allow marketers and advertisers to make targeted outreach to users. Just because those acts happen at nearly the same time does not mean the act is singular. Consider, for instance, a basketball player that attempts a free throw. At one descriptive level, her action is singular: she merely shoots the ball. At another descriptive level, her action is complex, comprising multiple acts in one fluid motion: she is moving her legs to provide the proper force behind the shot, moving her arms to guide the ball, moving her wrists to spin the ball appropriately, and so on. Main Line Health’s description is too general, reducing the many into one. The use of the intercepted communications is distinct from the capture of those communications. Smart has alleged that Main Line Health has intentionally intercepted the patient communications on its website and has done so for the purpose of selling the communications to marketers, which violates HIPPA. Because Smart has now sufficiently alleged what communications were intercepted, the Court finds that Smart has stated an ECPA claim.

B. Plaintiff Alleges Sufficient Facts to State a Negligence Claim To state a negligence claim, Smart must plead four elements: “a duty to conform to a certain standard for the protection of others against unreasonable risks; the defendant’s failure to conform

among other things, a URL that can identify whether a website user is a patient. See SAC 184(h) □□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□ That allegation makes the instant Action more like Murphy and less like the cases that Main Line Health relies on, such as American Hosp. Assoc. v. Becerra, 2024 WL 3075865, at * 12 (N.D. Tex. Jun. 20, 2024), because it is plausible that collecting information about who attempts to log-in to Main Line Health’s MyChart provides information about patients, and not just researchers or hospital employees who may visit the public portion of the website for non-treatment reasons. Moreover, to whatever extent Main Line Health disputes the truth of Smart’s allegation, that would be a factual dispute that is not properly resolvable at this juncture.

to that standard; a causal connection between the conduct and the resulting injury; and actual loss or damage to the plaintiff.” Jones v. Plumer, 226 A.3d 1037, 1039 (Pa. Super. 2020) (citation modified). Main Line Health argues that Smart has failed in three ways: there are no sufficient allegations of a duty, no sufficient allegations of a breach of duty, and no sufficient allegations of actual loss or damages. ECF No. 42-1 at 22-25. Smart’s initial response is as ridiculous as it is wrong. Smart opines that his negligence claim survives because when “this Court’s [prior Memorandum and Order] did not accept any of {Main Line Health’s] arguments, [this Court] implicitly rejected them, meaning they should now be moot.” ECF No. 43-2 at 11. That view is presumptuous and false. This Court was under no obligation to explain to Smart every single way that his prior Complaint was deficient. Judicial economy, not tacit acceptance of Smart’s arguments, explains the Court’s prior silence. In response to Main Line Health’s timely arguments that Smart fails to state a negligence claim, Smart chooses to incorporate and reiterate his arguments from prior motion practice. See ECF No. 11-12. The frustrating result is that Smart’s current arguments are ill-fitting and not tailored to address Main Line’s points. Main Line’s publication of a privacy policy, which promised patients that their private information would not be used without written permission, suffices at this stage to establish that Main Line Health assumed a duty to keep private patients’ health information and other sensitive information. See SAC §§ 133-34; see also, Murphy, 2023 WL 7017734, at *4 (“Though the Amended Complaint plausible alleges that Jefferson Health’s publication of its privacy policy established a duty of care, the Court might resolve the question differently once there is a more fully developed factual record.”). Under Smart’s allegations, Main Line Health breached this duty by handing over patients’ private information to marketers and advertisers through the Meta

Collection Tools. /d. at *5; SAC § 137. Therefore, the Court takes Smart to have established the first two elements to state a negligence claim. The Court also takes Smart to have sufficiently alleged causation. Assuming that Smart properly pleads an appropriate negligence injury, it is plausible that Main Line’s health breach of its duty caused Smart’s injury. Had Main Line Health not mishandled Smart’s private information to marketers via the Meta Collection Tools, Smart would not have suffered his injury due to Main Line Health’s alleged negligence. See, e.g., SAC §§ 244-45. At this stage of the proceedings, those allegations suffice to state causation. Main Line Health’s strongest arguments are that Smart’s allegations of actual loss or damages are conclusory. ECF No. 42-1 at 24—25. Smart responds saying that he “pleads plausible damages under the reasoning in Opris v. Sincera Repro. Med., 2022 WL 1639417, [at] *8 (E.D. Pa. May 24, 2022) by describing how Defendant’s actions cause a loss in value to Users’ Private Information, see SAC at §§ 144-69, 244.” ECF No. 43-2 (citation modified). As Main Line Health notes, Opris is largely distinguishable even though both cases concern alleged diminution of the value of personal data. ECF No. 45 at 8. The Opris Court held that Plaintiffs had pled sufficient facts of actual loss or damage in response to an argument from Defendants that Plaintiffs’ alleged damages were not “physical injury or damage to tangible property,” as is typically required for negligence claims. 2022 WL 1639417, at *6. The Opris Court explained that such injuries were not necessary to plead damages for negligence in a data breach action against a healthcare provider where the injury involved mitigation damages, e.g., expenses incurred in purchasing identity-theft-monitoring services post-breach. Jd. at *6—7. Because the instant Action does not concern injuries related to identity theft resulting from a data

breach and because Smart’s claim is not for mitigation damages, Smart’s reliance on Opris is largely unhelpful. The allegations in SAC §§ 144-69 comprise a largely meandering set of statements that amount to the banal truths that health information has financial value to marketers and that there exist dark-web markets for stolen health information. From these banalities, Smart makes the inference that “[i]f a criminal can sell other Internet users’ stolen data, surely Internet users can sell their own data.” Jd. § 156. Smart attempts to strengthen this inference by stating that there also exist legal avenues for patients to sell their health information. /d. 165-67. The Court does not find these allegations to properly state actual loss for a negligence claim. To state damages in a negligence claim, Smart must overcome the economic loss doctrine, which bars a plaintiff from recovering in tort when the “loss of the benefit of a bargain is the plaintiff's sole loss.” King v. Hilton-Davis, 855 F.2d 1047, 1051 (3d Cir. 1988); see also Excavation Tech. Inc. v. Columbia Gas Co. of Pennsylvania, 985 A.2d 840, 841 (“[T]he economic loss doctrine generally precludes recovery in negligence actions for injuries which are solely economic.”). Plaintiffs allegations of loss in SAC § 144-69 are best construed as economic losses because Plaintiff's theory is that he has lost the benefit of the bargain of selling his private information since Main Line Health has devalued the private information by already giving it to marketers and advertisers. That type of loss is improper for a negligence claim because it is an economic loss that is barred by the economic loss doctrine. Where Opris does help Smart is in its general point, with which this Court agrees, that “several courts have recognized the property value of personal information” and that the “alleged loss of value to [a plaintiffs] PII and PHI” is properly understood as a negligence injury when the

loss of value stems from one’s property interest in PII, not one’s loss of the benefit of the bargain. Opris, 2022 WL 1639417, at *8 (also collecting cases). The question before the Court therefore becomes whether Smart has properly pled an injury to the property value of his personal information. By the thinnest of margins, Smart has sufficiently pled a negligence injury. To start, the Court disregards Smart’s allegations concerning his injury deriving from the loss of the benefit of the bargain, which is not a proper negligence injury, and the allegation concerning his injury from the putative “embarrassment, humiliation, emotional harm, and emotional distress,” SAC § 244(a), which is wholly conclusory. Smart does allege, in Count I concerning his ECPA claim, that he suffered damages in the form of “diminishing the value of Plaintiff's ... property rights in [his] individually-identifiable health information.” Jd. § 232(e).? Because the Court agrees with the Opris court that this type of injury is proper for a negligence claim, the Court will not dismiss Plaintiff's negligence claim.

C. Plaintiff Fails to State an Intrusion Upon Seclusion Claim To state an intrusion upon seclusion claim, Smart must allege facts sufficient to establish that “there was an intentional intrusion on the seclusion of [his] private concerns which was substantial and highly offensive to a reasonable person.” Pro Golf Mfg., Inc. v. Trib. Rev. Newspaper Co., 809 A.2d 243, 247 (Pa. 2002). Smart must also allege facts sufficient to establish “that the information disclosed would have caused mental suffering, shame or humiliation to a person of ordinary sensibilities.” Jd. The Parties are at loggerheads about two key issues. First, Main Line Health argues that Smart has not alleged any intrusion because Main Line Health obtained the private information

2 The Court construes this allegation of damages as part of his negligence claim because this first allegation in the negligence count “incorporates the foregoing allegations as if fully set forth herein.” SAC § 234. 10

through legitimate means. ECF No. 42-1 at 26. Smart does not respond to this point directly but simply repeats the general allegations that Main Line Health encouraged patients to use its website, installed the Meta Collection Tools to capture private information, and transmitted that information to Meta. ECF No. 43-2 at 13. An intrusion upon seclusion requires allegations that Main Line Health illegitimately obtained Smart’s private information. See, e.g., O'Donnell v. U.S., 891 F.2d 1079 (3d Cir. 1989) (“[A]n ‘intrusion upon seclusion’ claim usually involves a defendant who does not believe that he has either the necessary personal permission or legal authority to do the intrusive act.””); Steinberg v. CVS Caremark Corp., 899 F. Supp. 2d 331, 342-43 (E.D. Pa. 2012) (“In Pennsylvania, liability for intrusion upon seclusion cannot exist where a defendant legitimately obtains information from a plaintiff.”) (citing Burger v. Blair Med. Assocs., Inc., 964 A.2d 374, 378 (Pa. 2009)). The Third Circuit has held that website operators may commit the tort of intrusion upon seclusion when plaintiffs allege that “they tracked their online behavior without their permission to do so.” Jn re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 294 (3d Cir. 2016). Other courts in this District have applied this principle to hold that healthcare providers meet this standard when they install the Meta Collection Tools to track online behavior. See Murphy, 2024 WL 4350328, at *6. In the case at hand, however, the Nickelodeon principle does not apply because Main Line Health effectively had Smart’s permission to collect his private information, as Smart alleges throughout the Complaint when discussing Main Line Health’s privacy policy. See, e.g., SAC § 2 (observing that, per the privacy policy, Main Line Health “keep[s] its patient’s protected health information private” but must “seek written permission prior to using or sharing” such information); see also SAC ¥ 92—93, 133-34. According to Smart’s own allegations, Main Line Health told its patients that it was collecting their private information, and there are no credible

1]

allegations to otherwise construe Smart’s Complaint as containing facts to support the inference that Main Line Health lacked such permission. Smart’s gripe is not with Main Line Health obtaining the information but rather with Main Line Health disclosing that information to Meta via the Meta Collection Tools after it obtained it. See, e.g., ECF No. 43-2 at 12-13. Because Main Line Health legitimately obtained the private information, there is no intrusion upon seclusion under Pennsylvania law. Burger, 964 A.2d at 378 (“[I]ntrusion upon seclusion is not implicated where, as here, the defendant had legitimately obtained the information.”). Smart’s response in his briefing fails to persuade. Main Line Health’s obtaining of the private information does not become illegitimate even if Main Line Health violated its own privacy policy by later disclosing that private information. Because Smart collapses the distinction between obtaining and disclosing—a distinction that is central to stating a proper claim for intrusion upon seclusion—the Court rejects Smart’s argument. Second, Main Line Health argues that Smart’s claim fails because Smart does not plead facts showing he was harmed by Main Line Health’s conduct. ECF No. 42-1 at 31. Smart responds by arguing that he “need only claim ‘mental suffering, shame or humiliation’ flowing from the required allegations of ‘highly-offensive’ conduct.” ECF No. 43-2 at 15 (citing Amerex Envil. Techs., Inc. v. Foster, 2012 WL 6552828, at *6 (W.D. Pa. Dec. 14, 2012)). Smart also cites to Opris, 2022 WL 1639417, at *5 and In re Wawa, Inc. Data Sec. Litig., 2021 WL 1818494, at *5 (E.D. Pa. May 6, 2021) as additional support for the adequacy of his claims. None of these cases help Smart’s cause. Neither Opris nor Wawa contain an intrusion upon seclusion claim, so nothing in those cases provides information about whether Smart’s allegations of harm in his intrusion upon seclusion claim are sufficient. Amerex does contain an intrusion upon seclusion claim, but the Amerex Court held that the plaintiffs were entitled to summary

judgment on the defendant’s invasion of privacy claim for reasons wholly distinct from the adequacy of showing damages. See Amerex, 2012 WL 6552828, at *6. On a motion to dismiss, “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” /gbal, 556 U.S. at 678 (citing Twombly, 550 U.S. at 555). Smart states that he suffered, as a result of the putative intrusion upon seclusion, “embarrassment, humiliation, emotional harm, and emotional distress.” SAC § 266(a). But Smart pleads no facts that make plausible any of these harms. Smart also claims a litany of economic damages that lack a causal relation to his intrusion upon seclusion claim. SAC 4 266(b)-(c). Not one of these alleged damages contains factual allegations sufficient to make these claims cross the threshold from possible to plausible. Smart fails to plead an intrusion under Pennsylvania law. Smart’s alleged damages are conclusory and lack factual support. Each failure is an independent basis upon which the Court dismisses the intrusion upon seclusion claim. IV. CONCLUSION . For the foregoing reasons, the Court grants in part and denies in part Defendant Main Line Health’s Motion to Dismiss (ECF No. 42). Because this is Plaintiff David Smart’s Second Amended Complaint, the Court dismisses the intrusion upon seclusion claim with prejudice. An appropriate order will be entered separately.