Harris v. Gillette Children's Specialty Healthcare

Background

Kayla Harris and Stephanie Braulick sued Gillette Children’s Specialty Healthcare individually and on behalf of a proposed nationwide class. The plaintiffs are parents of children alleged to be patients of Gillette. They alleged that tracking software developed by Meta and Google operated on Gillette’s website and recorded their website activities, including activities related to researching medical conditions, finding doctors, scheduling appointments, and completing health assessments.

The plaintiffs alleged that this activity caused their children’s personal health and identifying information to be disclosed to Meta and Google. They claimed that the technology companies could use information from the website together with information from social-media profiles to infer the children’s health conditions, patient status, and appointment records. The plaintiffs asserted six claims: violations of the Electronic Communications Privacy Act, invasion of privacy, negligence, breach of implied contract, unjust enrichment, and violations of the Minnesota Uniform Deceptive Trade Practices Act.

Gillette moved to dismiss the complaint. Its first argument was that the parents lacked standing—the legal requirement that a plaintiff show a personal injury that can be addressed by the court—because the complaint alleged that the children, not the parents, suffered the health-privacy injury.

Standing and the HIPAA Argument

The court applied the standards for a facial challenge to standing, which examines whether the complaint adequately alleges the facts needed for federal jurisdiction. The court concluded that the plaintiffs failed to allege a concrete injury to themselves. The complaint identified the children as Gillette’s patients and alleged that the children’s health information was intercepted, but it did not explain how the parents themselves were harmed.

The plaintiffs relied on regulations under the Health Insurance Portability and Accountability Act, commonly known as HIPAA. They argued that those regulations require health-care providers to treat parents of unemancipated minor patients as if the parents were the patients when disclosing health information. The court rejected this argument. It explained that HIPAA does not provide a private right of action and that the cited regulations create an exception allowing disclosure of a minor’s health information to a parent; they do not give the parent a right to enforce the child’s health privacy in federal court.

The court also declined to decide whether the children could bring any of the claims, whether the parents could allege an injury to themselves, or whether the wiretap claim could otherwise proceed. The opinion was limited to the standing issue.

Disposition

The court found that the plaintiffs lacked standing and therefore that it lacked subject-matter jurisdiction, meaning the federal court lacked authority to hear the case. Judge Katherine Menendez granted Gillette’s motion to dismiss. The action was dismissed without prejudice for lack of subject-matter jurisdiction. The plaintiffs could file a motion to amend the complaint within 30 days of the order. If they did not do so, the court stated that the Clerk of Court would be directed to enter judgment consistent with the order.