# W.W. v. Orlando Health, Inc.

> District Court, M.D. Florida · March 6, 2025

URL: https://www.frixlaw.com/law-library/cases/10818465

## Case

- **Court:** District Court, M.D. Florida
- **Decided:** March 6, 2025
- **Opinion:** 100trialcourt
- **Cited by:** 0 later opinions in the Frix Law Library

## Citator (automated)

- No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases.
- Full citator and citing cases: https://www.frixlaw.com/law-library/cases/10818465

## How later opinions describe it (automated extraction)

- recognizing a cause of action for breach of fiduciary duty in the medical context when a healthcare provider has disclosed confidential information to a third party
- noting that “unjust enrichment” is one of several terms used to describe a contract implied in law

## Opinion text

UNITED STATES DISTRICT COURT
MIDDLE DISTRICT OF FLORIDA
ORLANDO DIVISION

W.W.,

Plaintiff,

v. Case No: 6:24-cv-1068-JSS-RMN

ORLANDO HEALTH, INC.,

Defendant.
___________________________________/
ORDER
Defendant moves to dismiss Plaintiff’s complaint for failure to state a claim.
(Dkt. 17.) Plaintiff opposes the motion. (Dkt. 20.) Upon consideration, for the
reasons outlined below, the motion is granted in part and denied in part.
BACKGROUND1
Defendant is a healthcare organization that operates over one hundred medical
facilities throughout Florida and maintains a website at www.orlandohealth.com,2
“which [Defendant] encourages patients to use for booking medical appointments,
locating specific physicians and treatment facilities, [and] communicating medical

1 The court accepts the well-pleaded factual allegations in the complaint as true and construes them in
the light most favorable to Plaintiff. See Harry v. Marchant, 291 F.3d 767, 769 (11th Cir. 2002) (en
banc).
2 It is unclear from Defendant’s motion whether it requests the court take judicial notice of its website.
(See Dkt. 17 at 4 n.2.) But Defendant does not cite or meet the standard for taking judicial notice. (See
id.) See Fed. R. Evid. 201(b)(2). As a result, the court does not judicially notice Defendant’s website.
See Lodge v. Kondaur Cap. Corp., 750 F.3d 1263, 1273 (11th Cir. 2014) (stating that “the taking of judicial
notice of facts is a highly limited process” because it “bypasses the safeguards which are involved with
the usual process of proving facts by competent evidence” (quotation omitted)).
symptoms, conditions, and treatments via the search bar and related webpages.” (Dkt.
1 at 2, 7–8.) Defendant’s patients can also use its website to access the MyChart
Patient Portal, through which they can schedule medical appointments, review their

medical records, pay bills, communicate with their providers, order prescription refills,
and complete forms. (Id. at 2.) Plaintiff is one of Defendant’s patients. (Id. at 34.)
Allegedly, without informing its patients, Defendant “installed tracking
technologies . . . onto its [w]ebsite.” (Id. at 2.) These technologies include tools
developed by Meta, Facebook’s parent company, Google, and other social media

companies. (Id. at 3.) Plaintiff alleges that the tools can be used to “gather, identify,
target, and market products and services to Defendant’s patients” and to “intercept,
record, and disseminate patients’ communications with Defendant.” (Id. at 3, 15.)
According to Plaintiff, Meta and Google offer these tracking tools “as software that

advertisers can integrate into their webpages, . . . thereby enabling the interception and
collection of user communications and activity on those platforms.” (Id. at 15.)
Essentially, in Plaintiff’s view, these tools intercept and transmit users’
“communications with the host webpage,” Defendant’s website, to a third party like
Meta or Google. (Id. at 16.) Plaintiff explains: “For example, the Facebook Pixel on

Defendant’s [w]ebsite causes the user’s web browser to instantaneously duplicate the
contents of the communication with the [w]ebsite and send the duplicate from the
user’s browser directly to Facebook’s server.” (Id.) Plaintiff describes this software as
hidden from users’ view and difficult to avoid, even for the “particularly tech-savvy
user.” (Id. at 13–14, 17; see id. at 17 (discussing the “Conversions Application
Programming Interface,” or CAPI, which “functions as a redundant measure to
circumvent any ad blockers or other denials of consent by the website user”).) Because
of these tracking tools, Plaintiff claims, Meta and Google gained access to information

regarding her status as a medical patient, her health conditions, her desired treatment,
and her preferred physician or specialist, as well as any information included in
phrases and search queries she entered into Defendant’s website. (Id. at 19.)
Moreover, because information was attached to her Facebook and Google identifiers,
those third parties were allegedly able to associate the specific information entered into

Defendant’s website with Plaintiff’s identity. (Id. at 19–20.) In exchange for providing
access to user information, hosts like Defendant obtain “enhanced advertising services
and more cost-efficient marketing” on social media platforms. (Id. at 47–48.)
Plaintiff brings this complaint on behalf of herself and others similarly situated.

(Id. at 51.) She has used Defendant’s website and its MyChart Patient Portal “to
communicate [p]rivate [i]nformation to Defendant on numerous occasions to receive
healthcare services from Defendant or [its] affiliates.” (Id. at 34.) Specifically, Plaintiff
used Defendant’s website to identify gastroenterologists and cardiologists for
treatment of her ileostomy, heart pains, fatty liver disease, and other ailments. (Id. at

35.) In seeking this treatment, Plaintiff used “Defendant’s [w]ebsite and/or MyChart
Patient Portal” to complete forms to book medical appointments, authorize
treatments, and request medical records and invoices, to communicate with providers,
and to conduct general research regarding her symptoms and possible treatment
options. (Id. at 34–35.) While Plaintiff “never consented to the use of her [p]rivate
[i]nformation by [u]nauthorized [p]arties or to Defendant enabling [u]nauthorized
[p]arties to access or interpret such information,” she reports that after using
Defendant’s website, she “observed advertisements on her Facebook account for

ileostomy bags, products or services related to strokes, aortic stenosis, and heart
failure, neuropathy doctors from Orlando Health, and spinal decompression.” (Id. at
37–38.) Citing the tracking tools and the advertisements she received for products and
services related to her medical conditions, Plaintiff alleges that Defendant unlawfully
shared her protected health information and private information with unauthorized

third parties. (Id.)3
Plaintiff alleges that Defendant shared her private information with Meta and
Google, among other companies, and that this data sharing constitutes a breach of her
privacy and violates state and federal law. (Id. at 38–39.) Accordingly, Plaintiff brings

six claims against Defendant: violation of the Florida Security of Communications Act
(FSCA), Fla. Stat. § 934.01 (Count I), violation of the Wiretap Act as amended by the
Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511(1) (Count II),
breach of confidence (Count III), invasion of privacy—intrusion upon seclusion
(Count IV), unjust enrichment (Count V), and breach of implied contract (Count VI).

3 In this context, “[p]rotected health information [generally] means individually identifiable health
information . . . that is . . . [t]ransmitted by electronic media . . . or . . . in any other . . . medium.” 45
C.F.R. § 160.103. “Individually identifiable health information,” in turn, includes “any information”
that is “received by a health[]care provider” and “[r]elates to the past, present, or future physical or
mental health or condition of an individual,” “the provision of health[]care to an individual,” “or the
past, present, or future payment for the provision of health[]care to an individual,” provided the
information “identifies the individual” or “there is a reasonable basis to believe the information can
be used to identify the individual.” Id.
(Dkt. 1 at 57–72.) As relief, Plaintiff seeks compensatory, statutory, punitive, and
nominal damages, legal fees, and an injunction to prevent Defendant from disclosing
its patients’ private information. (Id. at 72–73.)

APPLICABLE STANDARDS
Federal Rule of Civil Procedure 8 requires a complaint to include a “short and
plain statement of [a] claim showing that the [plaintiff] is entitled to relief.” Fed. R.
Civ. P. 8(a)(2). “[T]he pleading standard Rule 8 announces does not require ‘detailed

factual allegations,’ but it demands more than an unadorned, the-defendant-
unlawfully-harmed-me accusation.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)
(quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007)). “Rule 8 marks a notable
and generous departure from the hypertechnical, code-pleading regime of a prior era,
but it does not unlock the doors of discovery for a plaintiff armed with nothing more

than conclusions.” Id. at 678–79.
In deciding a motion to dismiss a complaint for failure to state a claim, a court
“accept[s] the allegations in the complaint as true and construe[s] them in the light
most favorable to the plaintiff.” Henley v. Payne, 945 F.3d 1320, 1326 (11th Cir. 2019).
“To survive a motion to dismiss, a complaint must contain sufficient factual matter,

accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 556 U.S.
at 678 (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when the
plaintiff pleads factual content that allows the court to draw the reasonable inference
that the defendant is liable for the misconduct alleged.” Id.
ANALYSIS
Defendant moves to dismiss each of Plaintiff’s claims. (Dkt. 17 at 8–25.) The

court addresses its arguments as to each claim in turn.
A. Violation of the FSCA
The FSCA prohibits “[i]ntentionally intercept[ing], endeavor[ing] to intercept,
or procur[ing] any other person to intercept or endeavor to intercept any . . . electronic
communication.” Fla. Stat. § 934.03(1)(a). It defines “intercept” as “the aural or other

acquisition of the contents of any . . . electronic . . . communication through the use
of any electronic, mechanical, or other device.” Fla. Stat. § 934.02(3). It further
defines “contents” as “any information concerning the substance, purport, or meaning
of that communication.” Fla. Stat. § 934.02(7). Because the FSCA was modeled after
the Wiretap Act, Florida courts construe the FSCA’s provisions in accord with the

meaning given to analogous provisions of the Wiretap Act. See Minotty v. Baudo, 42
So. 3d 824, 831 (Fla. Dist. Ct. App. 2010) (“[The FSCA] was modeled after the
[f]ederal Wiretap Act . . . . Florida follows federal courts as to the meaning of
provisions after which [the FSCA] was modeled.”). “The touchstone in many cases
arising under the FSCA . . . is th[e] definition of contents.” Goldstein v. Costco Wholesale

Corp., 559 F. Supp. 3d 1318, 1321 (S.D. Fla. 2021).
This case is no exception. Defendant argues that Plaintiff’s FSCA claim must
be dismissed because Plaintiff fails to allege that the “contents” of any of her
communications were intercepted. (See Dkt. 17 at 9–12.) Defendant relies principally
on a Florida state court case, Jacome v. Spirit Airlines, Inc., No. 2021-000947-CA-01,
2021 WL 3087860 (Fla. Cir. Ct. June 17, 2021). That court was considering
allegations that the defendant “utilized at least one session replay script”—software
that “tracks a website browser’s movements”—“to contemporaneously intercept the

substance of [the p]laintiff’s electronic communications with [the d]efendant’s website,
including mouse clicks and movements, keystrokes, search terms, information
inputted by [the p]laintiff, and pages and content viewed by [the p]laintiff.” Id. at *1.
The court found that the use of session replay software was not covered by the FSCA.
See id. at *2. The court also determined that the FSCA claim was due to be dismissed

as the information at issue was not “contents” as defined by the FSCA, because the
plaintiff’s “mouse clicks and movements, keystrokes, search terms, information
inputted . . . , and pages and content viewed” did “not convey the substance or meaning
of any message.” Id. at *4. Several federal district courts have since applied the

reasoning of Jacome in cases that also alleged a violation of the FSCA based on the use
of session replay technology on commercial websites. See, e.g., Cardoso v. Whirlpool
Corp., No. 21-CV-60784-WPD, 2021 WL 2820822 (S.D. Fla. July 6, 2021).
Here, Jacome supports denying Defendant’s motion to dismiss. It does so in
three ways. First, the Jacome court addressed a different technology, session replay,

employed in a generic commercial setting, when it dismissed the FSCA claim. See
Jacome, 2021 WL 3087860, at *1. The court determined that the FSCA’s definition of
“electronic communication,” which “exclude[s] ‘[a]ny communication from an
electronic or mechanical device which permits the tracking of the movement of a
person or an object,’” did not apply to session replay technology, “which tracks a
website browser’s movements.” Id. at *3 (quoting § 934.02(12)(c) (excluding from the
definition of “[e]lectronic communication” “[a]ny communication from an

electronic . . . device which permits the tracking of the movement of a person or an
object”)). Defendant’s argument that the difference in technology is of no moment,
(see Dkt. 17 at 10 n.5), is not persuasive because Plaintiff’s claims are predicated on the
tracking tools’ interception of her communications, (see, e.g., Dkt. 1 at 59), not on the

simple fact that her movements on Defendant’s website were tracked. See Jacome, 2021
WL 3087860, at *3 (“Here, [the p]laintiff seeks to hold [the defendant] liable for its use
of session replay software which tracks a website browser’s movements.”).
Other district courts considering factually closer cases—involving the same
tracking tools at issue here utilized on healthcare providers’ websites—have reached

the opposite conclusion as the Jacome court. The Northern District of Illinois, for
example, in a case involving the same tracking tools as those used by Defendant,
denied a motion to dismiss the plaintiffs’ FSCA claim. See A.D. v. Aspen Dental Mgmt.,
Inc., No. 24 C 1404, 2024 WL 4119153, at *5–7 (N.D. Ill. Sept. 9, 2024) (finding
allegations that URLs “included [the p]laintiffs’ search terms about medical conditions

and types of treatments” “sufficient to plausibly allege that covered ‘content’ was
intercepted”). Similarly, the Central District of California in R.C. v. Walgreen Co.
denied a motion to dismiss claims brought under the Wiretap Act and California’s
analogous state statute, the California Invasion of Privacy Act (CIPA),4 based on
allegations that the defendant had permitted tracking technologies, including the Meta
Pixel, to be used on its website. 733 F. Supp. 3d 876, 885, 903 (C.D. Cal. 2024). These

technologies shared with Meta and Google the contents of the website users’
communications, which included names of “sensitive healthcare products” that the
users were searching on the defendant’s website. Id. at 885–86. This data sharing
resulted in those users, much like Plaintiff here, “receiving targeted ads on their
Facebook accounts related to the medical conditions and treatments they disclosed to

[the d]efendant.” Id. at 886. Because the information provided to Meta and Google
“reveal[ed] a substantive message about [the p]laintiffs’ health concerns,” the court
determined that the information constituted “contents” under the Wiretap Act and the
CIPA. Id. at 902; accord In re Grp. Health Plan Litig., 709 F. Supp. 3d 707, 712, 718,

720 (D. Minn. 2023) (determining that the defendant’s use of technology to
“surreptitiously track[] users’ interactions on the [defendant’s w]ebsites and transmit[]
those interactions to [Meta]” was actionable under the Wiretap Act and that “a URL
that discloses a search term or similar communication made by the user can be
considered a communication under the statute” (quotation omitted)); Doe v. Microsoft

Corp., No. C23-0718-JCC, 2023 WL 8780879, at *9 (W.D. Wash. Dec. 19, 2023)
(“[The p]laintiff alleges [the defendant] collects URLs containing search queries that
could divulge a user’s medical conditions, allergies, and immunizations. Accordingly,

4 As with the FSCA, “[t]he analysis for a violation of [the] CIPA is the same as that under the federal
Wiretap Act.” Brodsky v. Apple Inc., 445 F. Supp. 3d 110, 127 (N.D. Cal. 2020) (quotation omitted).
[the p]laintiff has adequately pled that [the defendant] intercepted the contents of her
communication with [a healthcare provider] for purposes of [the] CIPA.” (citation
omitted)).

Second, Jacome supports denying Defendant’s motion to dismiss the FSCA
claim because in concluding that the plaintiff had not adequately alleged that the
“contents” of an electronic communication had been intercepted, the Jacome court
relied primarily on In re Zynga Privacy Litigation, 750 F.3d 1098 (9th Cir. 2014), which

the court found “instructive.” Jacome, 2021 WL 3087860, at *3. The In re Zynga court
concluded that the “refer[r]er header information at issue,” which “include[d] only
basic identification and address information,” did not qualify as “contents” under the
Wiretap Act. 750 F.3d at 1109. However, in reaching that conclusion, the Ninth
Circuit stated that circumstances such as those alleged by Plaintiff here could constitute

a violation of the Wiretap Act. Id. at 1108–09 (“Under some circumstances, a user’s
request to a search engine for specific information could constitute a communication
such that divulging a URL containing that search term to a third party could amount
to disclosure of the contents of a communication.”). Accordingly, courts considering
allegations such as Plaintiff’s generally find that In re Zynga supports the claims. See,

e.g., Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064, 1076 (N.D. Cal. 2023) (“And
while a URL that includes ‘basic identification and address information’ is not
‘content,’ a URL disclosing a ‘search term or similar communication made by the user’
‘could constitute a communication’ under the [Wiretap Act].” (quoting In re Zynga,
750 F.3d at 1108–09)).
Third, in determining that the FSCA did not apply to session replay technology,
the Jacome court looked to the intent of the Florida and federal legislatures in passing
the FSCA and the Wiretap Act. 2021 WL 3087860, at *3. That court concluded that

these bodies did not intend either act to “extend to the use of commonplace analytics
software to improve a website browser[’s] experience.” Id. However, in reaching that
conclusion, the Jacome court specifically noted that the FSCA was designed to protect
precisely the information at issue in this case—private medical information. See id. at

*2 (“[T]he [c]ourt agrees with [the defendant] that Congress’s main concern in
amending the [f]ederal Wiretap Act to include electronic communications (which
prompted the Florida legislature to likewise amend the FSCA) was to protect private
personal and business records (like medical records) from interception on
computerized recordkeeping systems.” (footnote omitted)).

For these reasons, Defendant’s reliance on Jacome is misplaced, and Plaintiff
has adequately alleged that the electronic communications she claims were intercepted
were “contents” as defined by the FSCA. See R.C., 733 F. Supp. 3d at 902–03
(concluding that because “[the p]laintiffs allege[d] that the data collected by [the
d]efendant and transmitted to third parties include[d] personal health information”

and that “such information reveal[ed] a substantive message about [the p]laintiffs’
health concerns,” the “[p]laintiffs ha[d] adequately alleged contents”). Indeed, this
conclusion is supported by the definition of “contents.” The FSCA’s current definition
of “contents” has been substantively unchanged since its passage in 1969. Compare
Fla. Stat. § 934.02(7) (2024) (“‘Contents,’ when used with respect to any wire, oral, or
electronic communication, includes any information concerning the substance,
purport, or meaning of that communication.”), with Fla. Stat. § 934.02(7) (1969)
(“‘Contents,’ when used with respect to any wire or oral communication, includes any

information concerning the identity of the parties to such communication or the
existence, substance, purport, or meaning of that communication.”). This language is
identical to the definition of “contents” originally included in the Wiretap Act. See 82
Stat. 213 (1968). The key words here are “substance,” “purport,” and “meaning.” “A
fundamental canon of statutory construction is that, unless otherwise defined, words

will be interpreted as taking their ordinary, contemporary, common meaning.” Perrin
v. United States, 444 U.S. 37, 42 (1979). “When examining the plain and ordinary
meaning of a statute, one of the ways to figure out that meaning is by looking at
dictionaries in existence around the time of enactment.” United States v. Chinchilla, 987

F.3d 1303, 1308 (11th Cir. 2021) (quotation omitted).
A dictionary from the relevant period defines “substance” to mean “[e]ssence;
the material or essential part of a thing,” “purport” to refer to “[m]eaning; import;
substantial meaning; substance,” and “meaning” to refer to “[t]hat which is, or is
intended to be, signified or denoted by act or language.” Substance, Purport, Meaning,

Black’s Law Dictionary (4th ed. 1968); see In re Zynga, 750 F.3d at 1106 (looking to the
analogous provision of the Wiretap Act and determining that “substance” means “the
characteristic and essential part,” “purport” means the “meaning conveyed, professed
or implied,” and “meaning” refers to “the thing one intends to convey . . . by
language” (quoting Webster’s Third New International Dictionary 2279 (1981)). The
information at issue here is the message Plaintiff sought to convey to Defendant
through its website—information related to her medical conditions and providers—
and thus constitutes the substance, purport, or meaning of her communications. (See

Dkt. 1 at 59.)
In addition to discussing Jacome and its progeny, Defendant argues that Plaintiff
“fails to allege facts showing that the substantive contents of any of her
communications on [Defendant’s w]ebsite were unlawfully intercepted by
[Defendant].” (Dkt. 17 at 11 (citation and emphasis omitted).) Specifically,

Defendant asserts that Plaintiff “crafts her allegations in a way to suggest that her
information inputted on [Defendant’s w]ebsite may have been intercepted, but falls
short of alleging whether there was an interception and, more importantly, what
precisely was plausibly ‘intercepted.’” (Id. (emphasis omitted).) In her complaint,

however, Plaintiff alleges that Defendant permitted unauthorized parties to intercept
her “internet communications while accessing [Defendant’s website], including the
contents thereof,” which encompassed “the URL visited, the medical conditions and
types of doctors searched,” and other medical information related to her. (Dkt. 1 at
59.) This allegation is in addition to the myriad of factual details Plaintiff provides

that are specific to Defendant’s website regarding how these communications are
intercepted and what information is intercepted, (id. at 21–34), as well as her
allegations that after inputting information regarding her illnesses onto Defendant’s
website, she received advertisements from Meta related to those same illnesses, (id. at
34–39). Accepting these allegations as true and construing them in the light most
favorable to Plaintiff, the court finds that they are sufficient to state a plausible claim
for relief. See Henley, 945 F.3d at 1326.
The court is also persuaded by the analysis of the Northern District of Florida,

which was considering a case essentially on all fours with this one. That court
provided the following summary of its case:
[The defendant] is a healthcare system that operates
Tallahassee Memorial Hospital [(TMH)]. In addition to the
physical hospital, TMH owns and operates the website
https://www.tmh.org. [The p]laintiff is a TMH patient
who . . . used TMH’s website to communicate information
about her health on the condition that it would be kept
confidential and not disclosed to any unauthorized third
parties. However, [the p]laintiff alleges that unbeknownst
to her, TMH installed software on its public website that
tracked her movements and searches. [The p]laintiff further
alleges that through this software, TMH disclosed [the
p]laintiff’s private information to third parties—specifically,
Google and Meta.

D.S. v. Tallahassee Mem’l HealthCare, No. 4:23cv540-MW/MAF, 2024 WL 2318621, at
*1 (N.D. Fla. May 22, 2024) (quotation omitted). The court determined that the
plaintiff’s allegations were sufficient to overcome the defendant’s motion to dismiss
the plaintiff’s claims, which included FSCA and Wiretap Act claims in addition to
claims of breach of confidence, invasion of privacy, unjust enrichment, and breach of
implied contract. Id. “[R]esolution of these claims,” that court reasoned, “involves
answering highly technical questions[, including] . . . whether and to what extent the
contents of [the p]laintiff’s activities can be considered ‘communications’ for purposes
of the FSCA . . . . This [c]ourt declines to make dispositive merits determinations on
a motion to dismiss, where the Rule 8 bar is low.” Id. See also Cyr v. Orlando Health,
Inc., No. 8:23-cv-588-WFJ-CPT (M.D. Fla. July 5, 2023), Dkt. 37 (denying motion to
dismiss highly similar complaint against Defendant after a hearing, finding that “[t]he

assertions set forth by [the p]laintiff are plausible, thus entitling them at this stage to
being considered true as alleged” and noting that “[t]he [c]ourt f[ound] little utility in
a pleadings repartee at the beginning of a case” so “complicated and well-lawyered”).5
Because Plaintiff has plausibly alleged a claim under the FSCA, Defendant’s
motion to dismiss that claim is denied.

B. Violation of the Wiretap Act
The Wiretap Act generally prohibits the unauthorized interception of electronic
communications and the intentional disclosure or use of the contents of an intercepted
communication. 18 U.S.C. § 2511(1)(a), (c), (d). Because FSCA claims are analyzed

in the same manner as claims brought under the Wiretap Act, Defendant reasserts the
arguments it made as to Plaintiff’s FSCA claim, (Dkt. 17 at 12), and the court finds
those arguments unavailing for the reasons discussed above. The only independent
argument raised by Defendant for the dismissal of the Wiretap Act claim is that as a
party to the communications at issue, Defendant cannot have unlawfully intercepted

those communications. See 18 U.S.C. § 2511(2)(d) (“It shall not be unlawful under
this chapter for a person not acting under color of law to intercept a[n] . . . electronic

5 The parties note that the instant case is related to Cyr. (See Dkt. 17 at 3 & n.1; Dkt. 20 at 2.) After
surviving Defendant’s motion to dismiss her complaint, the plaintiff in Cyr sought leave to amend her
complaint to add Plaintiff as a party, which request was denied as untimely. Cyr, No. 8:23-cv-588-
WFJ-CPT (M.D. Fla. Feb. 13, 2024), Dkt. 53.
communication where such person is a party to the communication or where one of
the parties to the communication has given prior consent to such interception . . . .”);
Ramos v. Delphi Behav. Health Grp., LLC, No. 21-11218, 2022 WL 1415856, at *1 (11th

Cir. May 4, 2022) (“[I]t is lawful for an individual to intercept a communication if he
is a party to it.”). Plaintiff argues that her Wiretap Act claim is not barred in light of
the crime-tort exception to this rule, under which a party to the communication may
be liable if the “communication is intercepted for the purpose of committing any
criminal or tortious act in violation of the Constitution or laws of the United States or

of any [s]tate.” 18 U.S.C. § 2511(2)(d). The parties agree that Plaintiff’s Wiretap Act
claim hinges upon whether or not this crime-tort exception applies. (See Dkt. 17 at
12–16; Dkt. 20 at 7–12.)
Plaintiff alleges that Defendant “intentionally intercepted the contents of

Plaintiff’s . . . electronic communications for the purpose of committing a tortious act
in violation of the Constitution or laws of the United States or of any [s]tate,” because
the interception violated the FSCA. (Dkt. 1 at 64.) She also claims that Defendant’s
actions violated the Health Insurance Portability and Accountability Act (HIPAA),
(id. at 39–44), which makes it unlawful “for a ‘covered entity’—which includes

health[]care providers—to knowingly disclose individually identifiable hea[l]th
information without authorization ‘with intent to sell, transfer, or use individually
identifiable health information for commercial advantage, personal gain, or malicious
harm.’” Cooper v. Mount Sinai Health Sys., Inc., 742 F. Supp. 3d 369, 379 (S.D.N.Y.
2024) (quoting 42 U.S.C. § 1320d-6). Defendant contends that these allegations are
insufficient because the tortious or criminal purpose must be independent from the
interception itself and Plaintiff “cannot restate alleged violations of HIPAA as
violations of the [f]ederal Wiretap Act to manufacture a private right of action that

does not exist.” (Dkt. 17 at 14–16.) Plaintiff responds that the crime-tort exception
“requir[es] only ‘sufficient facts to support an inference that the offender intercepted
the communication for the purpose of a tortious or criminal act that is independent of
the intentional act of recording’” and that “‘if, at the time of the recording, the offender
plans to use the recording to harm the other party to the conversation, a civil cause of

action exists under the Wiretap Act.’” (Dkt. 20 at 10–11 (quoting Caro v. Weintraub,
618 F.3d 94, 100 (2d Cir. 2010)).) The court agrees with Plaintiff.
Both parties have amassed considerable persuasive—but no binding—authority
on this issue. (See Dkt. 17 at 13; Dkt. 20 at 8.) See, e.g., B.K. v. Eisenhower Med. Ctr.,

721 F. Supp. 3d 1056, 1065 (C.D. Cal. 2024) (determining that the crime-tort exception
did not apply to the plaintiff’s claims); Okash v. Essentia Health, No. 23-482 (JRT/LIB),
2024 WL 1285779, at *4–5 (D. Minn. Mar. 26, 2024) (same); but see, e.g., Cooper, 742
F. Supp. 3d at 380 (“A defendant’s criminal or tortious purpose of knowingly
disclosing individually identifiable health information to another person in violation

of HIPAA may satisfy the crime-tort exception.” (cleaned up)); see also Murphy v.
Thomas Jefferson Univ. Hosps., Inc., No. 22-4674, 2024 WL 4350328, at *5 (E.D. Pa.
Sept. 30, 2024) (“[The d]efendant additionally argues that financial motives are not
sufficient to prove an intent to tortiously injure [the p]laintiffs. But [the p]laintiffs need
not plead financial motive to invoke the crime-tort exception as they have already
sufficiently pleaded [the d]efendant’s intention to violate HIPAA. [The p]laintiffs’
[Wiretap Act] claim will proceed.” (footnote omitted)). While Defendant does cite
one Eleventh Circuit decision, (Dkt. 17 at 14–15), that decision is unpublished and

supports only the unremarkable proposition that the crime-tort exception applies only
to crimes and torts and not to “other injurious act[s]” as a previous iteration of the
Wiretap Act did. Lucas v. Fox News Network, LLC, No. 00-14519, 2001 WL 100181, at
*4 & n.3 (11th Cir. Jan. 16, 2001).
Plaintiff alleges that Defendant intercepted the contents of her communications

for the purposes of violating the FSCA and HIPAA. (Dkt. 1 at 39–44, 64–65.) The
court finds no basis in the text of the Wiretap Act’s crime-tort exception to conclude
that these allegations are insufficient. Moreover, given the lack of binding authority
and the split in persuasive authority on this issue, the court will not dismiss Plaintiff’s
allegations while her case is in its infancy. See Sartori v. Schrodt, No. 3:18cv204-

RV/CJK, 2018 WL 11209992, at *2 (N.D. Fla. May 22, 2018) (“In the absence of
binding caselaw, it is enough to say that a ‘complicated issue’ which generates ‘much
debate’ and a ‘split of authority’ necessarily states a plausible claim for motion to
dismiss purposes.”); Palmyra Park Hosp., Inc. v. Phoebe Putney Mem’l Hosp., Inc., No.

1:08-CV-102 (WLS), 2009 WL 10673436, at *6 (M.D. Ga. Mar. 31, 2009) (“[T]he
[c]ourt thinks it is a better approach to save the novel issue presented to the [c]ourt for
a later day with a more complete record, especially considering the present status of
this litigation and the low burden necessary to survive a motion to dismiss.”).
Application of the crime-tort exception appears more fit for resolution at
summary judgment or trial than at the motion to dismiss stage. See In re Grp. Health
Plan Litig., 709 F. Supp. 3d at 720 (“This case is at the pleading stage. While [the

p]laintiffs have alleged [the defendant’s] motivations, determination of [the
defendant’s] actual purpose for installing and using the Pixel Code requires a factual
undertaking. [The p]laintiffs, without the benefit of discovery, have met the pleading
requirements to plausibly allege [that] the crime-tort exception applies.”); Cooper, 742

F. Supp. 3d at 381 (“[The defendant] will be at liberty to attempt to establish in
discovery facts supporting, inter alia, that, to the extent it took the above actions, it did
so without intending to facilitate Facebook’s receipt of confidential patient
information or to financially benefit. . . . But, taking the [complaint]’s allegations as
true, as the [c]ourt must at the motion to dismiss stage, they plausibly support the

inference that [the defendant], for commercial ends, intentionally disclosed
individually identifiable patient health information[] and thus violated HIPAA . . . .”
(footnote omitted)). Indeed, courts in the Northern and Middle Districts of Florida
have likewise declined to dismiss Wiretap Act claims in cases asserting virtually
identical arguments at the motion to dismiss stage. See Tallahassee Mem’l Healthcare,

2024 WL 2318621, at *1; Cyr, No. 8:23-cv-588-WFJ-CPT, Dkt. 37. For all of these
reasons, the court denies Defendant’s motion to dismiss Plaintiff’s Wiretap Act claim.
C. Breach of Confidence
A common law breach of confidence claim requires an “unconsented,
unprivileged disclosure to a third party of nonpublic information that the defendant
has learned within a confidential relationship.” Muransky v. Godiva Chocolatier, Inc.,
979 F.3d 917, 932 (11th Cir. 2020) (en banc) (quotation omitted); Desue v. 20/20 Eye
Care Network, Inc., No. 21-CIV-61275-RAR, 2022 WL 796367, at *9 (S.D. Fla. Mar.

15, 2022) (same); cf. Gracey v. Eaker, 837 So. 2d 348 (Fla. 2002) (recognizing a cause of
action for breach of fiduciary duty in the medical context when a healthcare provider
has disclosed confidential information to a third party). Defendant argues that
Plaintiff fails to “plead facts sufficient to show that any of her alleged medical

information provided in the course of a doctor-patient relationship was actually
transmitted to Facebook, Google, or any other third party.” (Dkt. 17 at 17.)
Defendant also argues that the information “allegedly being sent to Facebook and
Google is merely internet metadata automatically generated as a function of a person’s
browsing activities or the searching of information and not any actual doctor-patient

communications.” (Id. at 19.)
However, Plaintiff alleges that the tracking tools on Defendant’s website
intercepted her protected health information and transmitted it to Meta and Google.
(Id. at 35–38.) She specifically alleges that she used Defendant’s website “to find
gastroenterologists and cardiologists,” and in so doing, “she communicated her

[protected health information] related to ileostomy, heart pains, fatty liver disease,
blacking out when standing up, and meningiomas to find doctors and information
concerning these medical conditions and symptoms.” (Id. at 35.) Her complaint
includes exhaustive detail as to how exactly the tracking tools Defendant installed on
its website intercepted her health information. (Id. at 18–34.) Moreover, Plaintiff
includes allegations supporting the interception of her medical information.
Specifically, she alleges that after communicating this information to Defendant she
received advertisements on Facebook for products and services related to the medical

conditions referenced in her communications with Defendant’s website. (Id. at 36–
38.) Therefore, the information Plaintiff alleges she shared with Defendant through
its website was not merely “metadata” but was rather information directly related to
her status as Defendant’s patient and to her health. See Norman-Bloodsaw v. Lawrence
Berkeley Lab’y, 135 F.3d 1260, 1269 (9th Cir. 1998) (“One can think of few subject areas

more personal and more likely to implicate privacy interests than that of one’s
health . . . .”); In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d 778, 799 (N.D. Cal.
2022) (“[U]nlike communications made while inquiring about items of clothing on a
retail website, health-related communications with a medical provider are almost

uniquely personal.” (citation omitted)).
Accordingly, Plaintiff’s allegations are sufficient to state a claim for breach of
confidence, and Defendant’s motion as to this claim is denied. See Tallahassee Mem’l
Healthcare, 2024 WL 2318621, at *1; Cyr, No. 8:23-cv-588-WFJ-CPT, Dkt. 37.
D. Invasion of Privacy—Intrusion Upon Seclusion

Florida recognizes a common law claim of intrusion upon seclusion—one form
of the tort of invasion of privacy—which it defines as an intrusion “physically or
electronically . . . into one’s private quarters.” Allstate Ins. Co. v. Ginsberg, 863 So. 2d
156, 162 (Fla. 2003) (quotation omitted). This tort requires intrusion “into a ‘place’ in
which there is a reasonable expectation of privacy,” id., which intrusion must be
“highly offensive to a reasonable person,” Jackman v. Cebrink-Swartz, 334 So. 3d 653,
656 (Fla. Dist. Ct. App. 2021) (quoting Restatement (Second) of Torts § 652B (Am. L.

Inst. 1977)); see Rebalko v. City of Coral Springs, 552 F. Supp. 3d 1285, 1332 (S.D. Fla.
2020) (“An intrusion claim has three elements. First, there must be a private quarter.
Second, there must be some physical or electronic intrusion into that private quarter.
Third, the intrusion must be highly offensive to a reasonable person.” (quotation

omitted)).
Defendant argues that Plaintiff has failed to state a claim for intrusion upon
seclusion because she does not allege an intrusion into her private quarters. (Dkt. 17
at 20.) The court agrees. “Florida law explicitly requires an intrusion into a private
place and not merely into a private activity.” Pet Supermarket, Inc. v. Eldridge, 360 So.

3d 1201, 1207 (Fla. Dist. Ct. App. 2023) (quoting Spilfogel v. Fox Broad. Co., 433 F.
App’x 724, 727 (11th Cir. 2011)). This standard is met where a plaintiff’s home is
intruded into. Cf. Jackman, 334 So. 3d at 655–57 (finding the plaintiffs had
demonstrated a substantial likelihood of success on the merits of their intrusion upon
seclusion claim where the defendants had installed a camera “positioned to see over

the [plaintiffs]’ [six-foot-high] privacy fence, allowing the [defendants] to see into a
portion of the [plaintiffs]’ backyard and the edge of their lanai”). An intrusion that
occurs in a public setting, on the other hand, does not satisfy this standard. See Rebalko,
552 F. Supp. 3d at 1332–33 (determining that “a police officer’s stop at the intersection
of a public street—in full view of dozens of motorists and other passersby” was not an
intrusion into a plaintiff’s private quarters). Florida courts have not identified all of
the settings qualifying as a private place. See id. at 1332 (“Although a person’s home
plainly constitutes a private quarter, Florida’s courts have said precious little about

what else might qualify.” (cleaned up)).
Plaintiff argues that Defendant intruded into her private quarters because its
tracking tools intruded into her web browser “conversations with [her] healthcare
providers.” (Dkt. 20 at 15–16.) She points to no authority, however, demonstrating
that such internet activity constitutes an intrusion into one’s private quarters under

Florida law. (See id. at 15–17.) Defendant, however, has identified caselaw that
indicates the contrary. (See Dkt. 17 at 20 (citing Bradley v. City of St. Cloud, No. 6:12-
cv-1348-Orl-37TBS, 2013 WL 3270403, at *4–5 (M.D. Fla. June 26, 2013) (dismissing
an intrusion upon seclusion claim based on “allegations that [a defendant] investigated

[the plaintiff] and viewed her medical records[] at [a] hospital . . . without her
authorization” because the plaintiff had “not allege[d] that [the d]efendants intruded
into her home or another private place”), and Watts v. City of Hollywood, 146 F. Supp.
3d 1254, 1267–68 (S.D. Fla. 2015) (“The [defendant]’s accessing of [the plaintiff]’s
driver’s license information in the [Driver and Vehicle Information Database

(DAVID)] system is likewise not an intrusion into a ‘place.’ [The plaintiff]’s attempt
to liken the archiving of her information in DAVID to the keeping of personal effects
in a home safe or desk drawer is both unsupported and unpersuasive. Similarly, [the
plaintiff]’s argument ‘her privacy was invaded electronically, and included the private
information about her physical domains of home and vehicle,’ . . . is not supported by
a single citation to legal authority . . . .” (citations omitted))).)
Plaintiff’s attempt to distinguish Watts on the basis of the substance of the

information at issue is unavailing. (See Dkt. 20 at 16 (“Watts addressed driver license
records—not private, sensitive, and confidential medical information.”).) The Watts
court found no “place” to be implicated not because of the contents of the information
at issue, but because it found the plaintiff had no reasonable expectation of privacy in

the location of that information—a database owned by the state. See Watts, 146 F.
Supp. 3d at 1267. The Bradley court articulated this same understanding, finding an
unauthorized viewing of medical records did not constitute an intrusion upon the
plaintiff’s seclusion “[b]ecause [the p]laintiff d[id] not allege that [the d]efendants
intruded into her home or another private place.” 2013 WL 3270403, at *4–5.

Plaintiff’s allegations demonstrate that her claim is based on an intrusion into
private activities, rather than a private place, and therefore, her claim is not cognizable
under Florida law. (See Dkt. 1 at 68–69 (alleging Defendant violated Plaintiff’s privacy
because “it installed the [t]racking [t]ools onto its [w]ebsite . . . to disseminate
patient[s’] communications with the [w]ebsite”).) See Hammer v. Sorensen, 824 F. App’x

689, 695 (11th Cir. 2020) (“[T]he Supreme Court of Florida has construed the tort of
intrusion upon seclusion even more narrowly than the Restatement . . . [and i]t has
required a plaintiff to show an intrusion into a private place and not merely a private
activity.” (citation omitted)).
Aside from Jackman, which is distinguishable, Plaintiff cites no authority to
demonstrate that Florida would recognize an intrusion upon seclusion claim based on
the facts alleged in her complaint. (See Dkt. 20 at 15–17.) Cf. Spilfogel, 433 F. App’x

at 726–27 (affirming the district court’s dismissal of an intrusion upon seclusion claim
where the “[p]laintiff fail[ed] to produce any meaningful support for her argument”
because she “cite[d] to no Florida cases whatsoever in support of her intrusion upon
seclusion claim”); Rebalko, 552 F. Supp. 3d at 1333 (dismissing intrusion upon

seclusion claims with prejudice where the intrusion did not appear to implicate the
plaintiffs’ private quarters and they “pointed the court to no authority that would
suggest otherwise”).
Accordingly, Defendant’s motion is granted as to this claim. While leave to
amend may be futile, the court will nevertheless grant Plaintiff leave to amend her

complaint to replead an invasion of privacy claim in light of the strong federal policy
favoring amendment. See Fed. R. Civ. P. 15(a)(2) (“The court should freely give leave
[to amend a pleading before trial] when justice so requires.”).
E. Unjust Enrichment
Under Florida law, the “essential” elements of a claim for unjust enrichment

are “(1) a benefit conferred upon a defendant by the plaintiff, (2) the defendant’s
appreciation of the benefit, and (3) the defendant’s acceptance and retention of the
benefit under circumstances that make it inequitable for him to retain it without paying
the value thereof.” Vega v. T-Mobile USA, Inc., 564 F.3d 1256, 1275 (11th Cir. 2009)
(quoting Rollins, Inc. v. Butland, 951 So. 2d 860, 876 (Fla. Dist. Ct. App. 2006)).
Defendant contends that Plaintiff has failed to plead that a benefit was conferred
upon Defendant. (Dkt. 17 at 21–22.) Plaintiff, however, alleges that she “conferred a
benefit upon Defendant in the form of [p]rivate [i]nformation that Defendant collected

from Plaintiff . . . without authorization [or] proper compensation,” and that
Defendant “consciously collected and used this information for its own gain, providing
Defendant with economic, intangible, and other benefits, including substantial
monetary compensation.” (Dkt. 1 at 70.) Moreover, she specifically alleges that her
private information “has economic value.” (Id. at 48–50.) The court agrees that

private information, at least in the context of sensitive medical information, has value.
See In re Marriot Int’l, Inc., Customer Data Sec. Breach Litig., 440 F. Supp. 3d 447, 462 (D.
Md. 2020) (“Neither should the [c]ourt ignore what common sense compels it to
acknowledge—the value that personal identifying information has in our increasingly

digital economy. . . . Consumers too recognize the value of their personal information
and offer it in exchange for goods and services.”). Moreover, in the context of an
unjust enrichment claim, “whether a defendant benefitted at the plaintiff’s
expense . . . ‘is a factual question not appropriately resolved on a motion to dismiss.’”
Daniel v. Navient Sols., LLC, 328 F. Supp. 3d 1319, 1326 (M.D. Fla. 2018) (quoting

Shands Teaching Hosp. & Clinics, Inc. v. Beech St. Corp., 899 So. 2d 1222, 1228 (Fla. Dist.
Ct. App. 2005)).
Defendant states that Plaintiff’s unjust enrichment claim must be dismissed
“because courts routinely recognize that allegations of collection and dissemination of
website usage information are insufficient to establish an uncompensated benefit as
needed to support a claim for unjust enrichment.” (Dkt. 17 at 22–23.) The court finds
this argument unpersuasive both because the information at issue here is not merely
“website usage information” and because Defendant cites no controlling law to

illustrate that Florida courts would not recognize Plaintiff’s allegations as constituting
a benefit conferred. (See id.) The court finds Plaintiff’s allegations sufficient to state
an unjust enrichment claim under Florida law. Accordingly, the court denies
Defendant’s motion to dismiss this claim. See also Tallahassee Mem’l Healthcare, 2024
WL 2318621, at *1; Cyr, No. 8:23-cv-588-WFJ-CPT, Dkt. 37.

F. Breach of Implied Contract
To the extent that Plaintiff asserts a claim for breach of contract implied in law,
the claim survives for the reasons explained above in connection with Plaintiff’s unjust
enrichment claim. See Com. P’ship 8098 Ltd. P’ship v. Equity Contracting Co., 695 So. 2d

383, 386 (Fla. Dist. Ct. App. 1997) (noting that “unjust enrichment” is one of several
terms used to describe a contract implied in law). Following the parties’ lead, (see Dkt.
17 at 23–25; Dkt. 20 at 19–21), the court treats Plaintiff’s claim for breach of implied
contract as a claim for breach of contract implied in fact.
“A contract implied in fact is one form of an enforceable contract; it is based on

a tacit promise, one that is inferred in whole or in part from the parties’ conduct, not
solely from their words.” SBP Homes, LLC v. 84 Lumber Co., 384 So. 3d 241, 245 (Fla.
Dist. Ct. App. 2024) (quoting Com. P’ship 8098, 695 So. 2d at 385). Defendant argues
that Plaintiff’s complaint contains “no allegations that plausibly show that [Defendant]
agreed not to use website analytics tools on its publicly accessible website.” (Dkt. 17
at 24.) Defendant also argues that Plaintiff has failed to allege damages. (Id. at 24–
25.) However, arguments as to whether there was a meeting of the minds between the
parties, or regarding damages, are generally questions of fact best resolved after

discovery. See Vanguard Plastic Surgery, PLLC v. UnitedHealthcare Ins. Co., 658 F. Supp.
3d 1250, 1261–62 (S.D. Fla. 2023) (determining that, under Florida law, “whether
there has been a ‘meeting of the minds’ is a question of fact,” and that “whether an
implied-in-fact contract has been formed can be a fact-intensive inquiry better resolved
after discovery”); see also In re Grp. Health Plan Litig., 709 F. Supp. 3d at 715

(“Arguments about whether [the p]laintiffs and [the defendant] had a meeting of the
minds or debates over the value of [the p]laintiffs’ loss[es] are fact disputes better left
for summary judgment or trial.”). Moreover, Florida law permits a breach of contract
claim to proceed even absent proof of quantifiable damages, because the plaintiff in

such a case would still be entitled to nominal damages if she established a breach. See
AMC/Jeep of Vero Beach, Inc. v. Funston, 403 So. 2d 602, 605 (Fla. Dist. Ct. App. 1981)
(“While there is a legal remedy for every legal wrong and, thus, a cause of action exists
for every breach of contract, an aggrieved party who has suffered no damage is only
entitled to a judgment for nominal damages.”).

Defendant’s motion to dismiss this claim is thus denied. See Tallahassee Mem’l
Healthcare, 2024 WL 2318621, at *1; Cyr, No. 8:23-cv-588-WFJ-CPT, Dkt. 37.
CONCLUSION
Accordingly:
1. Defendant Orlando Health, Inc.’s Motion to Dismiss Plaintiff's Complaint
(Dkt. 17) is GRANTED in part and DENIED in part. Count IV is
DISMISSED without prejudice. Defendant’s motion is otherwise
DENIED.
2. Plaintiff may file an amended complaint on or before March 21, 2025.
3. If Plaintiff amends, Defendant’s response is due on or before April 4, 2025.

ORDERED in Orlando, Florida, on March 6, 2025.
te ie □
JUMIE S. SNEED □
UNITED STATES DISTRICT JUDGE
Copies furnished to:
Counsel of Record

-29 -

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/10818465. Public record. Not legal advice.