Gay v. Garnet Health

Background

Dolores Gay and Corrine Jacob sued Garnet Health for themselves and other similarly situated patients. The complaint alleged that Garnet operated a healthcare website and patient portal containing personal identifying information and protected health information. According to the complaint, Garnet installed Facebook’s Tracking Pixel and Conversions Application Programming Interface on the website. The plaintiffs alleged that these tools sent information about their website activity—including medical conditions, treatment information, appointment activity, and other communications—to Facebook and other third parties without their consent. They also alleged that they later received targeted advertisements related to their medical conditions and treatment.

The complaint asserted claims under the Electronic Communications Privacy Act, New York Civil Rights Law §§ 50 and 51, New York General Business Law § 349, and common law theories of breach of fiduciary duty or confidentiality, breach of implied contract, unjust enrichment, and negligence.

Legal standard

Garnet moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint alleges enough facts to make a claim legally plausible. At this stage, the court treated well-supported factual allegations as true and viewed reasonable inferences in the plaintiffs’ favor, but did not accept bare legal conclusions.

Claims that survived dismissal

The court denied the motion to dismiss the Electronic Communications Privacy Act claim. Although the Act generally permits an interception when one participant consents, an exception may apply when the interception was made for an independent criminal or tortious purpose. The court concluded that the plaintiffs plausibly alleged that Garnet intentionally transmitted identifiable health information for commercial or financial purposes and that the alleged conduct could violate other laws. The court emphasized that discovery might later show that Garnet lacked the required criminal or tortious intent, but held that the claim could proceed at the pleading stage.

The court also denied dismissal of the breach-of-fiduciary-duty or confidentiality claim. It found that the plaintiffs plausibly alleged a patient-provider relationship, that Garnet obtained information about their treatment or diagnoses, that the information was disclosed to an outside party in an identifiable form, that the plaintiffs did not consent, and that they suffered harm.

The court denied dismissal of the claim under New York General Business Law § 349. It found that the plaintiffs plausibly alleged consumer-oriented conduct that was materially misleading because Garnet’s stated privacy practices allegedly differed from its transmission of patient information to Facebook. The court also found that the plaintiffs plausibly alleged injury by claiming they would not have used Garnet’s services had they known the true facts and that they did not receive the full value of those services.

Claims dismissed

The court granted dismissal without prejudice of the negligence claim. It concluded that the negligence allegations duplicated the breach-of-fiduciary-duty or confidentiality claim and did not identify an independent legal duty or distinct harm. The plaintiffs were permitted to amend by alleging an independent duty and different harm.

The court granted dismissal without prejudice of the breach-of-implied-contract claim. Although the plaintiffs alleged that Garnet promised to protect their information, the complaint did not allege that they had seen Garnet’s privacy notice when deciding to use Garnet’s services. The court stated that the plaintiffs could amend to allege facts showing awareness of and agreement to those provisions when the alleged contract was formed.

The court granted dismissal without prejudice of the unjust-enrichment claim. It found that the claim duplicated the breach-of-fiduciary-duty or confidentiality claim because it relied on the same alleged use of private information and the same alleged damages. The plaintiffs could amend to allege distinct facts and damages.

The plaintiffs withdrew their New York Civil Rights Law §§ 50 and 51 invasion-of-privacy claim. The court dismissed that claim with prejudice.

Disposition

The court granted Garnet’s motion to dismiss the breach-of-implied-contract, unjust-enrichment, and negligence claims without prejudice. It dismissed the New York Civil Rights Law privacy claim with prejudice. It denied the motion as to the breach-of-fiduciary-duty or confidentiality, Electronic Communications Privacy Act, and New York General Business Law § 349 claims.

The plaintiffs were granted leave to file an amended complaint by October 21, 2024. If they did not timely amend, the claims dismissed without prejudice would be deemed dismissed with prejudice. If they amended, Garnet was directed to answer or otherwise respond by November 12, 2024. Judge Nelson S. Roman also directed the Clerk of Court to terminate the motion.