M.R. v. Salem Health Hospitals and Clinics

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF OREGON

EUGENE DIVISION

M.R.,1

Civ. No. 6:23-cv-01691-AA

Plaintiff, OPINION & ORDER

v.

SALEM HEALTH HOSPITALS AND

CLINICS,

Defendant.

_______________________________________

AIKEN, District Judge.

Plaintiff is a patient of Defendant Salem Health Hospitals and Clinics and

brings this putative class action arising out of Defendant’s alleged disclosure of

Plaintiff’s confidential personally identifiable information. Before the Court is

Defendant’s Motion to Dismiss (“MTD”), ECF No. 9. For the reasons below, the

Motion is GRANTED IN PART and COUNT FOUR of the Complaint is DISMISSED.

BACKGROUND

I. Factual and Procedural Background

Plaintiff is a former patient of Salem Health. Compl. at 1. Defendant is a

healthcare entity and is subject to applicable HIPAA and Oregon law regulations on

1 Plaintiff brings this lawsuit anonymously out of a desire to protect her personal

health information under the Health Insurance Portability and Accountability Act of

1996 and Oregon law. Compl. at 2.

disclosing personally identifiable protected health information. Compl. ¶ 10, 13.

Defendant owns and controls https://www.salemhealth.org (“Defendant’s Website” or

the “Website”), which it encourages patients to use for booking medical appointments,

locating physicians and treatment facilities, communicating medical symptoms,

searching medical conditions and treatment options, signing up for events and

classes, and more. Compl. ¶ 3.

Plaintiff alleges that Defendant used hidden tracking tools embedded on its

website, https://www.salemhealth.org, (the “Website”), Defendant Salem Health

Hospitals and Clinics (“Salem” or “Defendant”) intercepted Plaintiff’s and Class

Members’ communications and forced their web browsers to send confidential and

highly sensitive personally identifiable information (“PII”) and personal health

information (“PHI”) (collectively, “Private Information”) to undisclosed third parties

such as Meta Platforms, Inc. (“Facebook”) or Google, Inc. (“Google”) without Plaintiffs’

or Class Members’ knowledge or consent. Compl. ¶¶ 5-6, 14, 54-58.

According to Plaintiff, the information Defendant intercepted and

impermissibly disclosed to those third parties included booking of appointments,

searches for specific medical treatment, particular health conditions, and other

sensitive information. Id. Plaintiff asserts that Defendant used “Tracking Tools”—

technology including Facebook Tracking Pixel (“Pixel”), Google Analytics, or

Conversions API to boost its marketing efforts and profits by sharing Private

Information despite protections offered to its patients through state and federal law

and industry standards. Id. ¶¶ 44, 52-58. Plaintiff states that she used Defendant’s

web portal and their website, https://www.salemhealth.org (“Website”), to research

medical symptoms, search for doctors, make appointments, and check medical

records. Id. at ¶ 7. Plaintiff maintains that her unique IP address is also PII under

HIPPA. An IP address is a number that identifies the address of a device connected

to the Internet. Id. at 146.

Plaintiff asserts that Salem Health was compensated for this data and the data

was used by Facebook and Google to optimize advertisements targeted to their users.

Id. at 55-56, 164-167, 257.

In its motion to dismiss, Defendant asserts that Plaintiff consented to the

disclosure of information via the Website’s Terms of Service, and by creating

Facebook and Google accounts, which requires agreeing to Facebook and Google’s

Terms of Service. MTD at 11; see also ECF No. 10 (Defendant’s request for judicial

notice of Facebook and Google’s terms of service.)2 Plaintiff alleges that she had no

knowledge of Defendant's Tracking Tools and would not have consented to the

disclosure of their information to third parties. Compl. ¶ 15, 59-60, 226.

II. HPPA Standards

Under Federal Law, a healthcare provider may not disclose personally

identifiable, non-public medical information about a patient, a potential patient, or

household member of a patient for marketing purposes without the patients’ express

written authorization. See Health Insurance Portability and Accountability Act

2 Federal Rule of Evidence 201(b) allows the Court to “judicially notice a fact that is not subject to

reasonable dispute [if] it . . . can be accurately and readily determined from sources whose accuracy cannot

reasonably be questioned.” In addition, under the “incorporation by reference” doctrine, the Court may consider “the

existence and contents” of documents relied upon or referenced by plaintiffs in their complaint. Knievel v. ESPN,

393 F.3d 1068, 1076 (9th Cir. 2005); In re NVIDIA Corp. Sec. Litig., 768 F.3d 1046, 1058 n. 10 (9th Cir. 2014)

(“HIPPA”), 42 U.S.C. § 1320; 45 C.F.R. §§ 164.502; 164.508(a)(3), 164.514(b)(2)(i).

The HIPAA Privacy Rule, located at 45 CFR Part 160 and Subparts A and E of Part

164, “establishes national standards to protect individuals’ medical records and other

individually identifiable health information (collectively defined as ‘protected health

information’) and applies to health plans, health care clearinghouses, and those

health care providers that conduct certain health care transactions electronically.”

The Privacy Rule broadly defines “protected health information” (“PHI”) as

individually identifiable health information (“IIHI”) that is “transmitted by electronic

media; maintained in electronic media; or transmitted or maintained in any other

form or medium.” 45 C.F.R. § 160.103. 121. IIHI is defined as “a subset of health

information, including demographic information collected from an individual” that is:

(1) “created or received by a health care provider, health plan, employer, or health

care clearinghouse”; (2) “[r]elates to the past, present, or future physical or mental

health or condition of an individual; the provision of health care to an individual; or

the past, present, or future payment for the provision of health care to an individual”;

and (3) either (a) “identifies the individual” or (b) “[w]ith respect to which there is a

reasonable basis to believe the information can be used to identify the individual.” 45

C.F.R. § 160.103.

Under the HIPPA de-identification rule, “health information is not

individually identifiable only if”: (1) an expert “determines that the risk is very small

that the information could be used, alone or in combination with other reasonably

available information, by an anticipated recipient to identify an individual who is a

subject of the information” and “documents the methods and results of the analysis

that justify such determination’”; or (2) “the following identifiers of the individual or

of relatives, employers, or household members of the individual are removed[:]

a. Names;

* * *

H. Medical record numbers;

* * *

J. Account numbers;

* * *

M. Device identifiers and serial numbers;

N. Web Universal Resource Locators (URLs);

O. Internet Protocol (IP) address numbers; … and

R. Any other unique identifying number, characteristic, or code…”

* * *

“The covered entity must not “have actual knowledge that the

information could be used alone or in combination with other

information to identify an individual who is a subject of the

information.”

45 C.F.R. § 160.514.

An individual or corporation violates the HIPAA Privacy Rule if it

knowingly and in violation of 42 U.S.C. §§ 1320d-1320d-9 (“Part C”): “(1) uses

or causes to be used a unique health identifier; [or] (2) obtains individually

identifiable health information relating to an individual.” The statute states

that a “person … shall be considered to have obtained or disclosed individually

identifiable health information in violation of [Part C] if the information is

maintained by a covered entity … and the individual obtained or disclosed such

information without authorization.” 42 U.S.C. § 1320d-6.

III. Protected Health Information Under Oregon Law

Oregon law provides that “(1) It is the policy of the State of Oregon that

an individual has:(a) The right to have protected health information of the

individual safeguarded from unlawful use or disclosure.” ORS § 192.553.

Oregon law also provides in ORS § 192.558 that PHI may only be used or

disclosed consistent with prior authorization or without such authorization in

particular circumstances.

LEGAL STANDARD

To survive a motion to dismiss under the federal pleading standards, a

pleading must contain a short and plain statement of the claim and allege “sufficient

factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’”

Ashcroft v. Iqbal, 556 U.S. 662, 667 (2009) (quoting Bell Atl. Corp. v. Twombly, 550

U.S. 544, 570 (2007)). While a pleading does not require “detailed factual allegations,”

it needs more than “a formulaic recitation of the elements of a cause of action.” Iqbal,

556 U.S. at 677-78. “A claim has facial plausibility when the plaintiff pleads factual

content that allows the court to draw the reasonable inference that the defendant is

liable for the misconduct alleged. The plausibility standard . . . asks for more than a

sheer possibility that a defendant has acted unlawfully.” Id. at 678. Legal

conclusions without any supporting factual allegations do not need to be accepted as

true. Id.

DISCUSSION

Plaintiff brings claims for (1) breach of confidence; (2) unauthorized

interception, use and disclosure in violation of the Electronic Communications

Privacy Act (“ECPA”); (3) intrusion upon seclusion; (4) breach of implied contract; (5)

unjust enrichment; and (6) negligence.

Defendant argues that the second claim under the ECPA should be dismissed

because Plaintiff has not pled an unauthorized interception and, regardless, as a

party, Defendant could consent to any interception. Defendant contends that the

third claim for intrusion upon seclusion should be dismissed because no intentional

intrusion occurred, and no intrusion occurred that would be highly offensive to a

reasonable person. Defendant argues the fourth claim for breach of implied contract

should be dismissed because Plaintiff cannot show the existence of mutual assent or

consideration. Defendant argues the fifth claim for unjust enrichment fails because

it is not a cause of action in Oregon and Plaintiff has another remedy available.

Defendant argues that the sixth claim for negligence is barred by the economic loss

rule and Plaintiff did not properly allege damages.

I. Count One: Breach of Confidence

Defendant moves to dismiss Plaintiff’s claim for breach of confidence on the

basis that the disclosed information was not protected medical information, and that

Plaintiff consented to the disclosure. MTD at 18.

To state a claim for beach of confidence, a plaintiff must allege an

“unauthorized and unprivileged disclosure of confidential information obtained in a

confidential relationship.” Humphers v. First Interstate Bank of Or., 298 Or. 706, 717

(1985). The basis for this confidential relationship must be “determined by a legal

source external to the tort claim itself.” A. B. v. Or. Clinic, 321 Or. App. 60, 70 (2022)

(quoting Humphers, 298 Or. at 718). The burden is on the plaintiff to identify this

source and show that it creates a duty to keep the information at issue confidential.

Id.

Here, Plaintiff claims that HIPAA, ORS §§ 192.553 to 192.581 (governing

protected health information (“PHI”), and the “implied covenant of trust and

confidence” inherent in a physician-patient relationship creates a duty of to keep

protected health information confidential. Compl. ¶¶ 186–87.

Defendant contends that the information disclosed could not plausibly fit the

statutory definition of protected health information. HIPAA (45 CFR § 160.103) and

ORS § 192.556 define PHI similarly as information “created or received by a health

care provider . . . and [r]elates to the past, present, or future physical or mental health

or condition of an individual; the provision of health care to an individual; or the past,

present, or future payment for the provision of health care.” 45 CFR § 160.103.

Plaintiff alleges that Defendant’s Tracking Tools sent the following

information to third parties:

(1) status as medical patients; (2) health conditions; (3) desired medical

treatment or therapies; (4) desired locations or facilities where

treatment was sought; (5) phrases and search queries (such as searches

for symptoms, treatment options, or types of providers); and (6) searched

and selected physicians and their specialties conducted via the general

search bar.

Compl ¶ 61.

Plaintiff has plausibly pled violations of HIPAA privacy requirements. See,

e.g. Compl. ¶¶ 88-90 (image showing that tracking tools on Defendant’s Website

reveal name of financial assistance form to Google, thereby revealing the user’s status

as a patient and that the patient is seeking financial assistance). As noted in the

Complaint, HHS has expressly stated that entities like Defendant that implement

the Facebook Pixel and Google Analytics and disclose patient information have

violated HIPAA Rules unless those entities obtain a HIPAA-complaint authorization.

Compl. ¶ 29. No such authorization was obtained. Thus, Plaintiff’s claim that

Defendant has violated HIPAA’s confidentiality requirements is at least plausible at

this stage of litigation. Defendant’s motion to dismiss is denied as to this issue.

II. Electronic Communications Privacy Act (“ECPA”)

Defendant argues that the second claim under the ECPA should be dismissed

because Plaintiff has not pled an unauthorized interception and, regardless, as a

party, Defendant could consent to any interception. MTD at 16-19.

In 1986, Congress passed a law called the Electronic Communications Privacy

Act (“ECPA”) to protect the privacy of electronic communications. Pub.L. No. 99–508,

100 Stat. 1848. Title I of the ECPA amended the Wiretap Act to expand its coverage

beyond wire and oral communication and “address[ ] the interception of . . . electronic

communications.” S.Rep. No. 99–541, at 3 (1986), reprinted in 1986 U.S.C.C.A.N.

3555, 3557. Title II of the ECPA created the Stored Communications Act, which was

created to “address[ ] access to stored wire and electronic communications and

transactional records.” Id.

The ECPA “provides a private right of action against any person who

‘intentionally intercepts, endeavors to intercept, or procures any other person to

intercept or endeavor to intercept, any wire, oral, or electronic communication.’”

Rodriguez v. Google LLC, No. 20-cv04688-RS, 2021 WL 2026726, at *6 (N.D. Cal.

2021). In Campbell v. Facebook Inc., the Court explained:

As the statutory text indicates, the focus of this provision is on the

interception of the communication itself. While another provision of the

Wiretap Act prohibits the use of the contents of a communication, that

prohibition applies only if the interception itself is unlawful under

section 2511(1)(a). Specifically, section 2511(1)(d) applies to any person

who “intentionally uses, or endeavors to use, the contents of any wire,

oral, or electronic communication,” but only if that person knows or has

reason to know “that the information was obtained through the

interception of a wire, oral, or electronic communication in violation of

this subsection.” See 18 U.S.C. § 2511(1)(d) (emphasis added). In other

words, if there is no unlawful interception, there can be no unlawful use.

77 F. Supp. 3d 836, 840 (N.D. Cal. 2014) (emphasis added).

The statute defines “intercept” as “the aural or other acquisition of the contents

of any wire, electronic, or oral communication through the use of any electronic,

mechanical, or other device.” 18 U.S.C. § 2510(4). The 9th Circuit has provided

additional guidance on how to interpret this term. “To be ‘intercepted’ in violation of

the Wiretap Act, [a communication] must be acquired during transmission, not while

it is in electronic storage.” Konop v. Hawaiian Airlines, Inc., 302 F.3d 878, (9th Cir.

2002).

Defendant maintains that an “interception” within the meaning of the statute

did not occur because the Tracking Tools do not contemporaneously capture and

transfer patient data to Meta and Google, but instead copy the patient’s data and

transmit it over in a separate second transmission. MTD at 17. Some California

courts have found that the function of similar tools does meet the definition of

“interception” under the ECPA because an interception does not occur while the data

is in transit. See e.g. Barbour v. John Muir Health, No. C22-01693, 2023 WL 2618967,

at *5 (Cal. Super. Ct. 2023). However, at this stage, the Court reviews allegations in

Plaintiff’s complaint and does not weigh the evidence about the disputed method by

which the Tracking Tools function.

In the Complaint, Plaintiff states that “Defendant has effectively used its

source code to commandeer and ‘bug’ or ‘tap’ its patients’ computing devices, allowing

Facebook, Google, and other third parties to listen in on all of their communications

with Defendant and thereby intercept those communications.” Compl. ¶ 55. Further,

that the Tracking Tools “manipulate[] the patient’s browser by secretly instructing it

to duplicate the patient’s communications (HTTP Requests) with Defendant and to

send those communications to Facebook and Google. These transmissions occur

contemporaneously.” Id. ¶ 56. Accepting as true allegations that Tracking Tools

function as Plaintiff asserts, this would plausibly meet the definition of an

“interception” under the statute.

Defendant argues that Plaintiff’s consent to the disclosure of any information

bars the Plaintiff’s claim under the ECPA. The ECPA states that “[i]t shall not be

unlawful” to intercept a communication “where one of the parties to the

communication has given prior consent to such interception.” 18 U.S.C. §2511(2)(d).

However, § 2511(2)(d) describes a crime/tort exception, which clarifies that a “party

to the communication” may be liable where a “communication is intercepted for the

purpose of committing any criminal or tortious act.” Id.

The Court finds that Plaintiff has plausibly pled the crime/tort exception and,

thus, Defendant cannot defeat Plaintiff’s claim by consenting to the interception of

the PHI. At this stage in the litigation, Plaintiff’s claim sufficiently alleges a violation

under the ECPA.

III. Intrusion Upon Seclusion

To state a claim for invasion of privacy, a Plaintiff must show “(1) an

intentional intrusion, physical or otherwise, (2) upon the plaintiff’s solitude or

seclusion or private affairs or concerns, (3) which would be highly offensive.” Reed v.

Toyota Motor Credit Corp., 301 Or App 825, 830-31, 459 P3d 253, 257 (2020), citing

Mauri v. Smith, 324 Or. 476, 482, 929 P.2d 307 (1996). Defendant contends that

Plaintiff has failed to allege an intentional intrusion and any alleged intrusion was

not highly offensive.

Defendant argues that no intentional intrusion occurred because patients, like

Plaintiff, voluntarily disclosed their information to Salem Health. Generally, if a

party is aware of an observer’s presence and still voluntarily chooses to disclose

information, no intentional intrusion occurs. See Snipes v. Wilkie, No. 18-cv-03259-

TSH, 2019 WL 1283936, at *7 (N.D. Cal. 2019).

Here, Plaintiff alleges that she was unaware that her information was being

sent to third parties and that she could not make an informed choice to disclose

information to unknown parties. Plaintiff alleges that she voluntarily disclosed PHI

to Defendant as a part of the patient-physician relationship, but never intended

Google and Facebook to receive it. Therefore, Plaintiff has plausibly alleged an

intentional intrusion.

Defendant argues that any alleged intrusion that occurred was not highly

offensive because Plaintiff had no reasonable expectation of privacy and Salem

Health did not have improper motives for the alleged disclosures. Defendant is

correct that there is not a reasonable expectation of privacy in some standard internet

activity, such as web searches. See e.g. United States v. Heckenkamp, 482 F.3d 1142,

1146 (9th Cir. 2007); People v. Nakai, 183 Cal. App. 4th 499, 518 (2010).

Congress and courts have consistently noted that personal medical information

is among the most sensitive information that could be collected about a person, and

the existence of many statutes like HIPAA and ORS § 192.553 regulating its

disclosure supports this idea. See Perez-Denison v. Kaiser Found. Health Plan of the

Nw., 868 F. Supp. 2d 1065, 1090 (D. Or. 2012) (“HIPAA suggests Congress has

determined reasonable people want their medical records private and strongly object

to those records being inappropriately accessed). It is likely that disclosure of such

personal and sensitive information would be highly offensive to a reasonable person.

Therefore, Plaintiff has pled a valid claim for intrusion upon seclusion.

IV. Breach of Implied Contract

Plaintiff asserts a claim for breach of an implied contract between the parties.

“An implied-in-fact contract, like any other contract, must be founded upon the

mutual agreement and intention of the parties.” Moyer v. Columbia State Bank, 315

Or. App. 728, 737 (2021) (internal quotation marks omitted). “A contract does not

arise because one party desires it; there must be mutual assent. As we said in Ken

Hood Construction, ‘Contract formation requires “a bargain in which there is a

manifestation of mutual assent to the exchange and a consideration.” Restatement

(Second) of Contracts § 17(1) (1981).’” Moyer v. Columbia State Bank, 315 Or. App.

728, 737, 503 P.3d 472, 477 (2021) (quoting Ken Hood Construction v. Pacific Coast

Construction, 201 Or. App. 568, 577, 120 P.3d 6 (2005)). “Unlike an express contract

where an agreement is formed based on words, in an implied contract, the parties’

agreement is inferred, in whole or in part, from their conduct.” Id. at 737–38; see also

Gadalean v. SAIF, 364 Or. 707, 717 n.3 (2019) (“This court has explained that a

contract implied in fact arises where the natural and just interpretation of the acts

of the parties warrants such [a] conclusion.”).

Plaintiff claims there was an implied contract between patients and Salem

Health that was breached by Salem Health when they disclosed patient information

to third parties. The Court finds Plaintiff’s allegations insufficient to state a claim.

Plaintiff has not pled facts tending to show that a meeting of the minds existed

between this parties. When patients come to Salem Health Hospital seeking

treatment, they enter a contract in which patients agree to pay for medical services

and Defendant agrees to provide them. Patients understand that they are entering

into a physician-patient relationship and can expect that Defendant will act in

accordance with laws like HIPAA. However, Plaintiff has not pled facts that show

Defendant’s prospective patients would understand that they were entering into a

contract to keep their information confidential. Entering into an implied contract

requires “mutual agreement and intent” of both parties. A patient’s choice to use

Defendant as a medical service provider does not indicate an intention to enter into

an implied contract for the security of information entered on Defendant’s website.

Although the parties undoubtedly agreed to enter into a contract for medical services,

Plaintiff has failed to show that patients could plausibly believe that an implied

contract existed to keep information entered on Defendant’s website confidential.

Defendant’s motion is granted as to this claim.

IV. Unjust Enrichment

The plaintiff asserts a claim for unjust enrichment on that basis that Plaintiff

and class members provided Defendant with their confidential information and

Defendant unjustly retained the benefit from the sale of this information. Defendant

first argues in their motion to dismiss that unjust enrichment is not an independent

cause of action in Oregon.

The Oregon Supreme Court recently discussed unjust enrichment claims under

Oregon law in Larisa's Home Care, LLC v. Nichols-Shields, 362 Or. 115, 404 P.3d 912

(2017). The court explained that “Oregon courts should examine the established legal

categories of unjust enrichment as reflected in Oregon case law and other authorities

to determine whether any particular enrichment is unjust.” Id. at 132. When

applying this doctrine, Oregon courts must determine whether the alleged

enrichment is unjust by examining whether the allegations match already recognized

forms of unjust enrichment by Oregon case law and treatises.

In this case, Plaintiff clarified in their Response that they intended to plead a

quasi-contractual claim of unjust enrichment. Resp. at 29. Oregon courts have

recognized this type of unjust enrichment claim. See e.g. Farmer v. Groves, 276 Or.

563, 568, 555 P.2d 1252 (1976); Wilson v. Gutierrez, 261 Or. App. 410, 414–15, 323

P.3d 974, 978 (2014). The elements for this claim are “(1) a benefit conferred, (2)

awareness by the recipient that she has received the benefit, and (3) it would be

unjust to allow the recipient to retain the benefit without requiring her to pay for it.”

Cron v. Zimmer, 255 Or. App. 114, 130, 296 P.3d 567 (2013). The Complaint alleges

that the benefit conferred was medical information of patients; that Defendant took

affirmative steps to collect it; and that it would be unjust for Defendant to retain the

benefit from selling this information to advertisers. This amounts to a plausible claim

for unjust enrichment.

Defendant also contends that since Plaintiff has an adequate remedy at law

the unjust enrichment claim must be dismissed. At this stage of the proceedings, it

would not be appropriate to dismiss this claim for that reason. See Martell v. Gen.

Motors LLC, 492 F. Supp. 3d 1131, 1148 (D. Or. 2020) (denying motion to dismiss

unjust enrichment claim and stating, “[a]t this stage of the litigation, it is unknown

whether the remedy at law meets this standard.”). Defendant’s motion is denied on

this issue.

V. Negligence

To prove a negligence claim, one “must allege facts from which a factfinder

could determine (1) that defendant’s conduct caused a foreseeable risk of harm, (2)

that the risk is to an interest of the kind that the law protects against [], (3) that [the]

defendant’s conduct was unreasonable in light of the risk, (4) that the conduct was a

cause of plaintiff’s harm, and (5) that [the] plaintiff was within the class of persons

and plaintiff’s injury was within the general type of potential incidents and injuries

that made defendant’s conduct negligent.” Tomlinson v. Metro. Pediatrics, LLC, 275

Or. App. 658, 676 (2015), aff’d, 362 Or. 431 (2018).

Defendant alleges that (1) Plaintiff’s negligence claim is barred by the

economic loss doctrine, and (2) Plaintiff fails to allege recoverable damages. MTD at

26.

As damages, Plaintiff has pled a loss of privacy. Compl. ¶ 229-e. Courts have

recognized loss of privacy constitutes damages for a negligence claim. See, e.g.,

Mehta v. Robinhood Fin. LLC, No. 21-CV-01013-SVK, 2021 WL 6882377, at *6 (N.D.

Cal. May 6, 2021) (“As to damages, Plaintiffs adequately allege damages, including

‘the loss of control over the use of their identity, harm to their constitutional right to

privacy, … and privacy injuries associated with having their sensitive personal and

financial information disclosed.”’) (citation omitted); Flores-Mendez v. Zoosk, Inc., No.

C 20- 04929 WHA, 2021 WL 308543, at *4 (N.D. Cal. Jan. 30, 2021) (“[P]laintiffs

adequately allege damages in the form of … loss of privacy with respect to highly

sensitive information … and risk of embarrassment.”). This is particularly true in the

pixel context. See, e.g., In re Grp. Health Plan Litig., 2023 WL 8850243, at *6

(“Plaintiffs have alleged loss of privacy, mental anguish, diminished value of private

information, and other forms of harm. The forms of damages sought by Plaintiffs are

cognizable.”) (internal citation omitted). Plaintiff has satisfied the damages element

for a common law claim of negligence, and her claim is not precluded by the economic

loss doctrine.

Plaintiff has also alleged as damages the diminished value of their private

information. Compl. ¶ 196-h. Courts in the Ninth Circuit and around the country

have accordingly held that the diminished value of sensitive health or personal

information supports a negligence claim. See, e.g., Brown v. Google, LLC, 2021 WL

6064009, at *17 (N.D. Cal. Dec. 22, 2021) (“Brown I”) (plaintiffs lost money when

Google took “valuable data” and “received no money in return”); Calhoun v. Google

LLC, 526 F.Supp.3d 605, 635 (N.D. Cal. 2021); Feins v. Goldwater Bank NA, 2022

WL 17552440, at *8 (D. Ariz. Dec. 9, 2022) (recognizing diminished value of PII); In

re Marriott Int’l, Inc., Cust. Data Sec. Breach Litig., 440 F. Supp. 3d 447, 461 (D. Md.

2020) (“[T]he growing trend across courts that have considered this issue is to

recognize the lost property value of this information.”).

At this stage of litigation, Plaintiff has plausibly alleged damages under their

negligence claim. Defendant’s motion is denied as to this claim.

B. Economic Loss Doctrine.

Alternatively, Defendant argues that Plaintiff’s negligence claim is barred by

the Economic Loss Doctrine. Plaintiff alleges that Defendant had a duty to keep its

patients’ Private Information confidential under ORS § 192.553. Defendant contends

that the economic loss rule prohibits Plaintiff from raising a negligence claim on the

basis that Plaintiff’s loss is purely economic. MTD. at 26, citing Harris v. Suniga,

344 Or. 301, 305 (2008). However, the economic loss doctrine only “bars a party that

has suffered a purely economic loss from bringing a negligence action,” and

regardless, does not apply if “there is a special relationship between the parties.”

Harris v. Suniga, 344 Or. 301 at 305 (emphasis added). “Examples of special

relationships include lawyer-client relationships, physician-patient relationships and

trustee-beneficiary relationships.” Doe v. Wright, No. 2:23-CV-00332-HL, 2023 WL

6810734, at *17 (D. Or. Oct. 16, 2023). Defendant’s motion to dismiss is denied as to

this issue.

CONCLUSION

For the reasons set forth above, Defendants’ Motion to Dismiss, ECF No. 9, is

DENIED IN PART and GRANTED IN PART. Count IV of the Complaint is

DISMISSED.

It is so ORDERED and DATED this 28th day of August 2024.

/s/Ann Aiken

ANN AIKEN

United States District Judge