Doe v. Regents of the University of California

Background

The Regents of the University of California, doing business as UCSF Medical Center, moved to dismiss Jane Doe’s express breach-of-contract claim from her amended complaint. In an earlier order, the court dismissed that claim but allowed Doe to amend because she had not adequately alleged that she received or agreed to UCSF’s health-privacy notice or website privacy statement. The court stated that Doe had now supplied additional allegations. Her claims for invasion of privacy and violations of specified provisions of California’s Confidentiality of Medical Information Act were not dismissed in the earlier order and remained pending.

Contract Allegations

Doe identified three sources for the alleged contract: the terms and conditions for UCSF’s MyChart patient portal, UCSF’s website terms of use incorporating its privacy statement, and UCSF’s notice of privacy practices provided to each patient. She alleged that the MyChart login page required users either to agree to the terms or refrain from using the portal. Those terms promised to provide medical information stored in MyChart the same confidentiality given to information stored by UCSF in other forms. She also identified privacy and data-sharing promises in the website materials and notice of privacy practices.

Court’s Analysis

UCSF argued that Doe had not adequately alleged the source of the contractual duties, consideration and mutual agreement, promises beyond duties imposed by other laws, or legally available damages. The court rejected each argument at the pleading stage.

The court held that Doe identified the alleged contractual duties and explained how UCSF communicated them. It also found sufficient her allegation that she entered into the contracts to receive treatment and services from UCSF, including by using the patient portal and website. The court noted that the alleged agreement was not based merely on browsing the website; the complaint focused on using the portal by entering patient information. The court described the alleged arrangement as more like a click-to-agree or sign-in agreement than a mere browsewrap agreement.

The court further explained that the contract claim could fail if Doe sought only to enforce duties imposed by federal or California medical-privacy laws. But Doe alleged additional promises, including limits on disclosures for marketing and requirements for written authorization for certain uses and disclosures. The court concluded that these allegations described promises extending beyond UCSF’s duties under those laws. Finally, it found that Doe sufficiently alleged damages, including possible compensation or nominal damages for the asserted privacy invasion under California law.

Disposition

The court denied UCSF’s motion to dismiss. Judge William H. Orrick did not dismiss Doe’s express breach-of-contract claim in this order.