Mekhail v. North Memorial Health Care

Background

Jacqueline Mekhail sued North Memorial Health Care, doing business as North Memorial Health, individually and on behalf of a proposed class. She alleged that North placed Meta’s tracking software, called a “Pixel,” on two websites: its public-facing website and its password-protected patient portal. According to the First Amended Complaint, the Pixel tracked information such as page views, clicks, search terms, patient-portal activity, appointments, treatments, and other health-related information, then sent that information to Meta for collection and targeted advertising.

The complaint asserted claims under the federal Electronic Communications Privacy Act and the Minnesota Protection of Communications Act (Counts I and II), the Minnesota Consumer Fraud Act (Count III), the Minnesota Uniform Deceptive Trade Practices Act (Count IV), the Minnesota Health Records Act (Count V), invasion of privacy (Count VI), and unjust enrichment (Count VII). The opinion’s earlier description of the complaint refers to the common-law claims as Counts XI and XII, creating a numbering inconsistency in the text. North moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint states a legally sufficient claim.

Court’s analysis

Wiretap claims. The court held that Mekhail plausibly alleged that an interception occurred and that the intercepted information included the substance of electronic communications, not merely technical information. The court also assumed, without deciding, that North could invoke the statute’s “party exception,” which can protect a party to a communication from liability. The court nevertheless concluded that Mekhail adequately pleaded the exception for interceptions made for a criminal or tortious purpose, based on allegations that the Pixel was used to access and monetize private health information. The court denied the motion as to Counts I and II.

Minnesota Consumer Fraud Act. The court granted the motion as to Count III. It concluded that Mekhail had not adequately alleged the required connection between North’s alleged privacy-related misrepresentations and the sale of “merchandise” under the statute. Although medical services could qualify as merchandise, the court found that the alleged misrepresentations concerned data privacy rather than North’s provision of medical services.

Minnesota deceptive trade practices claim. The court denied the motion as to Count IV. It found that Mekhail adequately identified the alleged deceptive statements, who made them, when and where they were made, and how they were deceptive. The court also concluded that she sufficiently alleged a likelihood of future harm for purposes of standing to seek an injunction. The court emphasized that determining the effect of North’s privacy policy and whether North’s statements were actually deceptive required factual development and could not be resolved on a motion to dismiss.

Minnesota Health Records Act. The court denied the motion as to Count V. It concluded that the complaint plausibly alleged the release of health records without consent. The allegations included patient-portal login activity and information about appointments, procedures, providers, communications, insurance status, gender, and sexual orientation. The court rejected North’s argument that information from which health conditions or patient status could be inferred could never qualify as a health record.

Invasion of privacy. The court granted the motion as to Count VI. Mekhail abandoned her claim based on publicizing private facts because she lacked a factual basis to allege sufficiently public dissemination of her health data. The court also concluded that, after Mekhail clarified that Meta or the Pixel—not North—made the interception, she could not plausibly allege that North itself intruded upon her seclusion.

Unjust enrichment. The court denied the motion as to Count VII. It found that Mekhail plausibly alleged an implied agreement or expectation that North would protect her medical data and that North received a benefit by monetizing the data. The court declined to resolve at the pleading stage whether North’s privacy policy created an express contract or made retaining the alleged benefit equitable.

Disposition

The final order states: “Defendant’s Motion to Dismiss (ECF 29) is GRANTED in part and DENIED in part”; the motion is “GRANTED to the extent that Counts III and VI are DISMISSED WITHOUT PREJUDICE”; and the motion is “otherwise DENIED.” The court therefore allowed the remaining claims identified in the order to proceed at that stage. The order does not address class certification, which had not yet been sought.