Doe v. Children's Hospital Corporation

2

Facebook to intercept communications between patients and the hospital and disclosed these intercepted communications to Google and Facebook, all without the patients' knowledge or consent. The intercepted communications included clicks on public pages regarding specific types of medical care, the contents of keyword searches on the website, the contents of searches and any filtering done on the website's "Find a Doctor" page, and appointment requests through the same page and a separate form. Importantly, the tracking technologies also intercepted clicks within the hospital's online patient portal, including on the log-in page, the "Diagnostic Tests" page,²a "Billing Summary" page, and a page for renewing medications. Google, Facebook, and Boston Children's then used the intercepted communications for commercial and marketing purposes, specifically to serve targeted advertisements. Plaintiff argues that these disclosures violated the federal Health Insurance Portability and Accountability Act and Massachusetts' statutory right to privacy, see Mass. Gen. Laws ch. 214, § 1B, as well as promises Boston Children's made to patients on its website. Both Google and Facebook warned that consent should be obtained, but none was.

Boston Children's now moves to dismiss the second amended

3

complaint on multiple grounds pursuant to Federal Rule of Civil Procedure 12(b)(6). See Better Way Ford, LLC v. Ford Motor Co.,

142 F.4th 67, 77 (1st Cir. 2025) (describing Rule 12(b)(6) standard). After hearing, the Court denies the motion to dismiss. The ECPA "provides a private right of action against" any person "who 'intentionally intercepts . . . any wire, oral, or electronic communication.'" In re Pharmatrak, Inc., 329 F.3d 9, 18 (1st Cir. 2003) (quoting 18 U.S.C. § 2511(1)(a)). To succeed on an ECPA claim, the plaintiff must show that the "defendant

(1) intentionally (2) intercepted . . . (3) the contents of (4) an electronic communication (5) using a device." Id. Under the ECPA's consent exception, it is not unlawful to intercept an electronic communication where the interceptor "is a party to the communication or where one of the parties to the communication has given prior consent to such interception." 18 U.S.C. § 2511(2)(d). The consent exception does not apply, however, if the

"communication is intercepted for the purpose of committing any criminal or tortious act in violation of the Constitution or laws of the United States or of any State." Id. This is known as the

"crime-tort exception."

The threshold issue is whether Plaintiff has stated a plausible claim under the ECPA. Numerous courts in this district have written extensive decisions on whether similar activity by other hospitals falls within the crime-tort exception and have

4

reached different results for varying reasons. Compare Goulart v. Cape Cod Healthcare, Inc., No. 25-cv-10445, 2025 WL 1745732, at *3-4 (D. Mass. June 24, 2025) (Stearns, J.) (finding the crime- tort exception inapplicable and dismissing ECPA claim), appeal filed, No. 25-1672 (1st Cir. July 23, 2025), Doe v. Lawrence Gen. Hosp., No. 25-cv-10081, 2025 WL 2808055, at *7 (D. Mass. Aug. 29, 2025) (Levenson, J.) (same), report and recommendation adopted in relevant part by, 2025 WL 2807673 (D. Mass. Sep. 30, 2025), and Progin v. UMass Mem'l Health Care, Inc., No. 25-cv-40003, 2026 WL 632770, at *4-5 (D. Mass. Mar. 6, 2026) (Burroughs, J.) (same), with Doe v. Baystate Health Sys., Inc., __ F. Supp. 3d __, __ (D. Mass. 2026) [2026 WL 776861, at *4-5] (Kobick, J.) (holding that the crime-tort exception applies). No circuit has ruled on this issue so far.

After a review of this case law, the Court concludes that Plaintiff has stated a plausible claim under the ECPA for the reasons given in Baystate. There, the plaintiff alleged that a hospital, without patient knowledge or consent, disclosed to Meta and Google its patients' searches regarding medical conditions, physicians, requests to schedule appointments, and log-ins to the patient portal. See Baystate, __ F. Supp. 3d at __ [2026 WL 776861, at *5]. The Baystate court held that these allegations plausibly stated a claim that the hospital's interception and disclosure were independent actions taken with the purpose of committing a

5

tortious act, i.e., a violation of Massachusetts' statutory right to privacy. See id. at __ [2026 WL 776861, at *4] (explaining that

"[w]hether [the hospital] was primarily or determinatively motivated to intercept and share [the plaintiff]'s communications with Meta and Google for a lawful purpose (marketing, analytics, and financial gain), an unlawful purpose (violating [the statutory right to privacy]), or both is a question of fact not fit for resolution at the pleading stage"); see also Caro v. Weintraub,

618 F.3d 94, 100 (2nd Cir. 2010) ("§ 2511(2)(d) requires that the interceptor intend to commit a crime or tort independent of the act of recording itself."). This Court reaches the same conclusion in this case.

Plaintiff's state law claims also survive the motion to dismiss largely for the reasons explained in Doe v. Tenet Healthcare Corp., 731 F. Supp. 3d 142, 148-52 (D. Mass. 2024). Accordingly, the motion to dismiss filed by Boston Children's (Dkt. 63) is DENIED.

SO ORDERED.

/s/ PATTI B. SARIS Hon. Patti B. Saris United States District Judge