In re: Group Health Plan Litigation

Background

Current HealthPartners patients filed a consolidated proposed class action against Group Health Plan Inc., referred to in the opinion as HealthPartners. They alleged that HealthPartners used Facebook Pixel and a Conversions Application Programming Interface on its websites, including healthpartners.com and virtuwell.com, to track users’ interactions and send information to Facebook. The alleged information included page views, button clicks, typed text or phrases, health information, and identifying information connected to users’ Facebook identification numbers. The plaintiffs alleged that this occurred without their knowledge or consent.

The complaint asserted nine claims: violation of the Minnesota Health Records Act; invasion of privacy; breach of implied contract; unjust enrichment; breach of fiduciary duty; breach of confidence; negligence; violation of the Electronic Communications Privacy Act, also called the Wiretap Act; and violation of the Minnesota Uniform Deceptive Trade Practices Act.

HealthPartners moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which allows dismissal when a complaint does not allege a legally plausible claim. The court held a hearing on October 16, 2023.

Claims Allowed to Proceed

The court denied the motion as to seven claims.

For the Minnesota Health Records Act claim, the court held that the complaint plausibly alleged that information entered or obtained through the websites related to patients’ health, healthcare, or healthcare payments and therefore could qualify as protected health records under the statute.

For invasion of privacy, the court addressed the plaintiffs’ theory of intrusion upon seclusion. It held that the alleged deliberate use of tracking tools to intercept and share sensitive health communications could plausibly constitute an intentional intrusion that would be highly offensive to a reasonable person.

The court also allowed the implied-contract claim to proceed. The plaintiffs alleged that HealthPartners’ privacy policies promised to protect confidential information and that HealthPartners breached an implied agreement by sharing the information without consent. The court concluded that disputes about whether the parties had agreed to those terms and the value of the alleged loss were better addressed at summary judgment or trial.

The unjust-enrichment claim also survived. The plaintiffs alleged that HealthPartners obtained and used their private information for its own benefit without authorization or compensation. The court found that the complaint adequately alleged the elements of unjust enrichment and that no undisputed express contract barred the claim at this stage.

The court denied dismissal of the negligence claim. It found that the plaintiffs plausibly alleged a duty, a breach involving private communications and health data, foreseeable harm, and legally recognizable damages, including loss of privacy, mental anguish, and diminished value of private information.

The court also allowed the Electronic Communications Privacy Act claim to proceed. It held that the plaintiffs plausibly alleged that HealthPartners contemporaneously redirected or duplicated electronic communications and that the transferred information included statutory “content,” such as searches or communications about symptoms, medical conditions, physicians, treatment, medication, and scheduling. Although the court concluded that HealthPartners was the intended recipient and therefore could ordinarily invoke the statute’s party exception, it found that the complaint plausibly alleged the exception for interceptions made for the purpose of committing a crime or tort. Whether HealthPartners actually acted for that purpose required factual development.

Finally, the court denied dismissal of the Minnesota Uniform Deceptive Trade Practices Act claim. It found that the complaint described the alleged deceptive conduct with enough detail to satisfy the heightened pleading requirement for fraud or mistake, including who allegedly acted, what was allegedly promised or concealed, and examples of when the tracking occurred. The court also found that the complaint alleged continuing risks and therefore sufficiently alleged future harm.

Claims Dismissed

The court granted the motion as to breach of fiduciary duty. It held that Minnesota law did not recognize a fiduciary duty for physicians or hospital staff toward patients in the circumstances described, and that the court could not create such a duty for healthcare providers’ website handling of patient information when Minnesota precedent had not recognized it.

The court also granted the motion as to breach of confidence. It concluded that the Minnesota cases cited by the plaintiffs did not establish a general common-law cause of action for breach of confidence of the type alleged in this case.

Disposition

The order states that HealthPartners’ motion to dismiss was GRANTED IN PART and DENIED IN PART. Counts V, breach of fiduciary duty, and VI, breach of confidence, were DISMISSED WITH PREJUDICE. The motion was otherwise denied. Judge Jerry W. Blackwell signed the order on December 21, 2023.