MURASKI

IN THE UNITED STATES DISTRICT COURT

FOR THE WESTERN DISTRICT OF PENNSYLVANIA

MARTIN MURASKL, et al., )

Plaintiffs,

VS. Civil Action No. 3:23-135

) Judge Stephanie L. Haines

PENN HIGHLANDS HEALTHCARE, INC., _ )

Defendant.

OPINION

Plaintiffs Martin Muraski and Devin Young (“Plaintiffs”), on behalf of themselves and all

others similarly situated, bring this civil action against Penn Highlands Healthcare, Inc.

(“Defendant”) for violations of the Pennsylvania Wiretapping and Electronic Surveillance Control

Act (““WESCA”), 18 Pa. Cons. Stat. § 5701, et seq. Defendant moves to dismiss. (ECF No. 25).

For the reasons stated herein the Motion to Dismiss will be granted.

I. Procedural and Factual Background

On June 21, 2023, Plaintiffs filed a single-count Complaint, (ECF No. 1), alleging

Defendant violated WESCA when it shared tens of thousands of its patients’ and website users’

private medical and other personally identifiable information without notifying them and without

obtaining their consent. Jd. § 1. Plaintiffs allege this Court has subject matter jurisdiction pursuant □

to the Class Action Fairness Act (““CAFA”), 28 U.S.C. § 1332(d)(2). Jd. F§ 10, 11.

On September 1, 2023, Defendant filed a Motion to Dismiss (“the Motion”), (ECF No. 25), □

with supporting Brief, (ECF No. 26), pursuant to Fed. R. Civ. P. 12(b)(1) and 12(b)(6), arguing

the Court lacks subject matter jurisdiction under CAFA and further, that the WESCA claim is

legally insufficient. On November 1, 2023, Plaintiffs filed a Response, (ECF. No. 36), to which

Defendant filed a Reply, (ECF No. 37). On February 15, 2024, the Court held oral argument on

the Motion to Dismiss and took the matter under advisement. (ECF No. 40); see also Transcript

(ECF No. 47-2). Thereafter, with leave of court, Plaintiff filed a post-hearing Brief in Opposition,

(ECF No. 43), Defendant filed a Second Brief in Support of the Motion to Dismiss with

Supplemental Authority (ECF No. 47), to which Plaintiff filed a Response. (ECF No. 48). The

Motion is ripe for disposition.

The allegations in the Complaint are as follows.’ Plaintiffs are residents and citizens of

Pennsylvania, (ECF No. 1 { 7, 8), and Defendant is a corporation organized under the laws of

Pennsylvania with its headquarters in DuBois, Pennsylvania. Jd. 9. Defendant is an integrated

health system located in northwestern Pennsylvania with eight hospitals. Jd. Defendant’s website

sends patients’ medical and other personal information to Google using Google Analytics, a web

analytics service that allows website owners to track site visitors’ actions in order to target such

visitors with personalized advertisements. Id. 914. Google Analytics collects the Internet Protocol

(“IP”) addresses of individual Internet users in order to facilitate and track Internet

communications. Jd. §16. Google can use the information that Defendant discloses in order to

identify a specific website user’s actions on Defendant’s website. Jd. 416.

Google Analytics offers website owners, like Defendant, an opt-in IP anonymization

feature. Id. 417. According to Google, this feature is designed to help site owners comply with

their own privacy policies and the recommendations of data protection authorities. Jd. 18. If the

IP anonymization feature is enabled by the website owner, an additional parameter is added to the

communication between website visitors’ computers and the Google Analytics server, defined as

“aip: 1.” Id. J 19. Accordingly, when the “aip” parameter does not appear, the IP address is not

1 Unless otherwise noted, the facts included in this section are taken from the Complaint (ECF No. 1). These facts are

uncontested unless otherwise noted.

anonymized, thus enabling Google to identify website users’ IP addresses and their online actions.

Id. 22. By using the Google Analytics tool without the IP anonymization feature, Defendant is

sharing with Google its patients’ online activity relating to their private medical treatment, along

with patients’ IP addresses, even when patients have not shared, nor have consented to share, such

information. /d. § 22.

Upon entering Defendant’s homepage website, users can select the “Find a Provider”

button located on the top bar of the website. Id. 423. Users are then directed to the “Find a Doctor”

page, where they are able to search for a doctor by name, hospital, practice, specialty, location,

type and gender, or choose a medical provider from the list provided. Jd. { 24. Upon clicking the

“search” button, all the user’s submitted information is automatically sent directly to Google. Jd.

{ 26. Any information submitted by the patient through the search bar (e.g., doctor, specialty, type

of treatment, etc.) located on the site’s homepage is shared with Google, along with the patient’s

IP address. Jd. § 31.

Defendant is a covered entity under the Health Insurance Portability and Accountability

Act, 42 U.S.C. § 1302, et seg. (“HIPAA”), which sets minimum federal standards for privacy and

security of protected health information (“PHI”). Jd. § 33. Under HIPAA, Plaintiffs and class

members have a reasonable expectation of privacy in their data, including sensitive medical and

other personal information, communicated to Defendant through its website. Jd. § 32. HIPAA

defines “protected health information” as “individually identifiable health information” that is

“transmitted by electronic media; maintained in electronic media; or transmitted or maintained in

any other form or medium.” 45 C.F.R. § 160.103. 7d. § 34. HIPAA further prohibits a healthcare

provider from disclosing PHI to third parties, such as Google, except where an individual has

expressly consented in advance to the disclosure or under certain HIPAA-compliant contracts. 45

C.F.R. §§ 164.502, 164.508. Id. § 37. Plaintiffs and class members have no idea that Google

collects and uses their sensitive PHI and other personal information at Defendant’s direction when

they interact with Defendant’s website. Id. J 42.

Plaintiff Muraski has accessed and used the Defendant’s scheduling page, including the

“Find a Doctor” feature, on Defendant’s website numerous times, with the last time in 2023. Id.

970. He has also used the search bar on Defendant’s website, and he entered sensitive medical and

other personal information when using it to find an appropriate medical provider, including his

medical diagnosis, conditions and symptoms. When using the search bar, he was also sharing his

IP address. Jd. $71. When Plaintiff Muraski visited Defendant’s website, Google collected his PHI

and other personal information from Defendant, and had already collected some or all his personal

information from other websites in its purported wiretap network. Jd. § 76.

Likewise, Plaintiff Young used Defendant’s appointment scheduling page, including the

“Find a Doctor” feature, and entered sensitive medical and other personal information when

scheduling appointments for medical treatment, including the types of medical treatment he seeks

through Defendant, the type of provider (i.e., physician, nurse practitioner, etc.), specialty and

name of the providers with whom he seeks treatment with, the locations of the Defendant facilities

he wishes to go to, and if he searches for Defendant providers by specific gender. When using the

scheduling page, he was also sharing his IP address. /d. 481. Plaintiff Young has accessed and used

the Defendant’s scheduling page, including the “Find a Doctor” feature, on Defendant’s website

numerous times, with the last time in 2023. Id. § 82. Google utilized this access to surreptitiously

gather Plaintiff Young’s sensitive PHI and other personal information, without his consent. Id. {|

86, 87. On information and belief, when Plaintiff Young visited Defendant’s website, Google

collected his PHI and other personal information from Defendant and had already collected some

or all of his personal information from other websites in its purported wiretap network. Jd. { 88.

Thus, Google was able to link Plaintiff Young’s previous browsing activity on other websites and

his intercepted activity on Defendant’s website to his personally identifiable information, revealing

an enormous amount of private information about him. Jd. J 89.

Plaintiffs bring this action both on behalf of themselves and all others similarly situated

(the “Class”) pursuant to Federal Rules of Civil Procedure 23(a), (b)(2) and (b)(3). Jd. § 91. The

Class is defined as follows:

All individuals who visited the [Defendant’s] website in the last two years and had

their private medical and other personal information shared with Google without

providing consent. Specifically excluded from this Class are Defendant, its officers,

directors or employees, any entity in which Defendant has a controlling interest and

any affiliate, legal representative, heir or assign of Defendant. Also excluded from

this Class are any judicial officers presiding over this action, the members of the

judicial officer’s immediate family and staff and any juror assigned to this action.

91.

II. Standard of Review

A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) challenges the

“court's ‘very power to hear the case.’” Petruska v. Gannon Univ., 462 F.3d 294, 302 (3d Cir.

2006) (quoting Mortensen v. First Federal Savings and Loan Ass’n, 549 F.2d 884, 891 Gd Cir.

1977)). The party asserting the existence of federal jurisdiction bears the burden of proving that

jurisdiction over the subject matter exists. Brown vy. Tucci, Civil Action No. 12-1769, 2013 WL

2190145 (W.D. Pa. May 20, 2013) (citing Development Finance Corp. v. Alpha Housing & Health

Care, 54 F.3d 156, 158 (Gd Cir. 1995)).

There are two types of Rule 12(b)(1) motions. A “facial” attack assumes that the allegations

of the complaint are true, but contends that the pleadings fail to present an action within the court’s

jurisdiction. Mortensen v. First Fed. Sav. & Loan Ass’n, 549 F.2d 884, 891 (3d Cir. 1977). The

United States Court of Appeals for the Third Circuit has explained:

In reviewing a facial attack, “the court must only consider the allegations of the

complaint and documents referenced therein and attached thereto, in the light most

favorable to the plaintiff.” Jn re Schering Plough Corp., 678 F.3d at 243 (quoting

Gould Elecs. Inc. v. United States, 220 F.3d 169, 176 (3d Cir. 2000)) (internal

quotation marks omitted). Thus, a facial attack calls for a district court to apply the

same standard of review it would use in considering a motion to dismiss under Rule

12(b)(6), i.e., construing the alleged facts in favor of the nonmoving party.

Constitution Party of Pennsylvania v. Aichele, 757 F.3d 347, 358 (d Cir. 2014). A “factual”

attack, on the other hand, argues that, while the pleadings themselves facially establish jurisdiction,

one or more of the factual allegations is untrue, causing the case to fall outside the court's

jurisdiction. Jd. In such a case, “no presumptive truthfulness attaches to plaintiff's allegations” and

the court must evaluate the merits of the disputed allegations because “the trial court’s . . . very

power to hear the case” is at issue. Jd. With a factual attack, the Court is free to consider evidence

outside the pleadings and weigh that evidence. Petruska, 462 F.3d at 302 n.3; see also Gould

Elecs., Inc. v. U.S., 220 F.3d 169, 176 (3d Cir. 2000). “[T]he existence of disputed material facts

will not preclude the trial court from evaluating for itself the merits of jurisdictional claims.”

Petruska, 462 F.3d at 302 n.3 (quoting Mortenson, 549 F.2d at 891).

A motion to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(6) tests the legal

sufficiency of the complaint. See Kost v. Kozakiewicz, 1 F.3d 176, 183 (3d Cir. 1993). In deciding

a motion to dismiss, the Court is not opining on whether the plaintiff will likely prevail on the

merits; the plaintiff must only present factual allegations sufficient “to raise a right to relief above

the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citing 5 C. Wright

& A. Miller, Federal Practice, and Procedure § 1216, pp. 235-236 (3d ed. 2004)); see also Ashcroft

v. Igbal, 556 U.S. 662 (2009). A complaint should only be dismissed under Rule 12(b)(6) if it

fails to allege “enough facts to state a claim to relief that is plausible on its face.” Twombly, 550

U.S. at 570 (rejecting the traditional 12(b)(6) standard established in Conley v. Gibson, 355 U.S.

41 (1957)). In making this determination, the Court must accept as true all well-pled factual

allegations in the complaint and views them in a light most favorable to the plaintiff. See U.S.

Express Lines Ltd. v. Higgins, 281 F.3d 383, 388 (3d Cir. 2002).

While a complaint does not need detailed factual allegations to survive a motion to dismiss,

a complaint must provide more than labels and conclusions. See Twombly, 550 U.S. at 555. A

“formulaic recitation of the elements of a cause of action will not do.” Jd. (citing Papasan v.

Allain, 478 U.S. 265, 286 (1986)). Moreover, a court need not accept inferences drawn by a

plaintiff if they are unsupported by the facts as stated in the complaint. See California Pub. Emp.

Ret. Sys. v. The Chubb Corp., 394 F.3d 126, 143 (3d Cir. 2004) (citing Morse v. Lower Merion

Sch. Dist., 132 F.3d 902, 906 (3d Cir. 1997)). Nor must the Court accept legal conclusions

disguised as factual allegations. See Twombly, 550 US. at 555. See also McTernan y. City of

York, Pennsylvania, 577 F.3d 521, 531 (3d Cir. 2009) (“The tenet that a court must accept as true

all of the allegations contained in a complaint is inapplicable to legal conclusions.”).

Expounding on the Twombly/Iqbal line of cases, the Third Circuit has articulated the

following three-step approach:

First, the court must ‘tak[e] note of the elements a plaintiff must

plead to state a claim.’ Second, the court should identify allegations

that, ‘because they are no more than conclusions, are not entitled to

the assumption of truth.’ Finally, ‘where there are well-pleaded

factual allegations, a court should assume their veracity and then

determine whether they plausibly give rise to an entitlement for

relief.’

Burtch v. Milberg Factors, Inc., 662 F.3d 212, 221 d Cir. 2011) (quoting Santiago v. Warminster

Twp., 629 F.3d 121, 130 (3d Cir. 2010)). This determination is “a context-specific task that

requires the reviewing court to draw on its judicial experience and common sense.” Jgbal, 556

USS. at 679.

When ruling on a motion to dismiss under Rule 12(b)(6), the court must generally consider

only the allegations in the complaint, exhibits attached to the complaint, matters of public record,

and documents that form the basis of a claim. See In re Burlington Coat Factory Sec. Litig., 114

F.3d 1410, 1426 (3d Cir. 1997)).

Il. Discussion

A. CAFA Jurisdiction

Defendant’s motion challenges the threshold question of subject-matter jurisdiction, which

the court must resolve before addressing the Rule 12(b)(6) motion to dismiss. Papurello v. State

Farm Fire & Cas. Co., 144 F. Supp. 3d 746, 751 (W.D. Pa. 2015).

CAFA grants federal courts jurisdiction over actions that meet three requirements: (1) the

parties are minimally diverse, (2) the class consists of at least 100 members, and (3) the amount in

controversy exceeds $5 million. Judon v. Travelers Property Cas. Co. of Am., 773 F.3d 495, 500

(3d Cir. 2014) (citing 28 U.S.C. § 1332(d)(2), (5)(B), (6)). In these respects, it differs from the

usual, non-class-action jurisdictional requirements of complete diversity of citizenship and an

amount in controversy exceeding $75,000. See 28 U.S.C. § 1332(a); Smith v. HSN, Inc., No.

CV2012869KMESK, 2020 WL 7022640, at *2 (D.N.J. Nov. 30, 2020).

Defendant does not dispute that this case meets the requirements that the proposed class of

more than 100 persons and an amount in controversy exceeding $5,000,000 “as Plaintiffs have not

provided evidence of either.” Defendant “focuses its briefing on the complete lack of diversity

required for this Court to proceed.” (ECF No. 37 at 3). Regardless, out of an abundance of caution,

the Court will address each of the three requirements.

8 .

First, the amount in controversy exceeds $5,000,000. “To ‘determine whether [CAFA’s]

matter in controversy’ exceeds [the] sum [or value of $5,000,000, exclusive of interest and costs],

‘the claims of the individual class members shall be aggregated.’” Standard Fire Ins. Co. v.

Knowles, 568 U.S. 588, 592 (2013) (quoting 28 U.S.C. § 1332(d)(6)). “[T]hose ‘class members’

include ‘persons (named or unnamed) who fall within the definition of the proposed or certified

class.’” Id. (quoting 28 U.S.C. § 1332(d)(1)(D)). Plaintiffs allege there are tens of thousands of

class members, (ECF No. 1 § 94), and that they are entitled to statutory damages of $100 per

violation and $1,000 per day, punitive damages, as well as reasonable attorney’s fees under

WESCA. (/d. 7103). The first requirement is clearly met here.

Second, facially, CAFA’s minimal diversity requirement is satisfied. 28 U.S.C. §

1332(d)(2)(A). Under CAFA, “a federal court may exercise jurisdiction over a class action if ‘any

member of a class of plaintiffs is a citizen of a State different from any defendant.’” Mississippi

ex rel. Hood v. AU Optronics Corp., 571 U.S. 161, 165 (2014) (quoting 18 U.S.C. §

1332(d)(2)(A)). The court looks to the “[c]itizenship of the members of the proposed plaintiff

class[] . . . as of the date of filing of the complaint.” 18 U.S.C. § 1332(d)(7). Here, the Complaint

pleads that named Plaintiffs are residents of Pennsylvania, (ECF No. 1 {{f 7, 8), but also states that

members of the proposed class “reside in Pennsylvania, Ohio, West Virginia, and New York while

[Defendant] is incorporated in and has its principal place of business in Pennsylvania” Jd. §11.

Thus, the Court concludes that at least one member of the putative class is diverse from Defendant.

Third, the Complaint alleges that there are “tens of thousands” of class members. (ECF No.

1 4 94). Therefore, the requirement that the class be composed of at least 100 members is satisfied.

Accordingly, Plaintiffs have alleged sufficient facts to meet the initial jurisdictional

requirements under CAFA.

1. Exceptions to Jurisdiction

Once the jurisdiction requirements are established by the party asserting federal jurisdiction

— Plaintiff, in this case — the burden shifts to the opponent—Defendant in this case—to prove an

exception to jurisdiction. Kaufman v. Allstate N.J. Ins. Co., 561 F.3d 144, 154 Gd Cir. 2009).

Defendant invokes two exceptions to CAFA jurisdiction. (ECF No. 26 at 16, ECF No. 37

at 2). One is the home-state exception, requiring courts to decline to exercise jurisdiction when

“the citizenship of the members of two-thirds or more of the putative class is the state in which the

action was originally filed” and a non-diverse defendant is the primary defendant. Vodenichar v.

Halcon Energy Props., Inc., 733 F.3d 497, 503-04 (3d Cir. 2013) (citing 28 U.S.C. §

1332(d)(4)(B)). A primary defendant is the one which the plaintiff seeks to hold directly liable and

which would sustain the greatest loss if found liable—in other words, the “real target” of the suit.

Id. at 505.

Another exception is the local-controversy exception. A party seeking to invoke the local

controversy exception must show that:

(1) greater than two-thirds of the putative class are citizens of the state in which the

action was originally filed; (2) at least one defendant is a citizen of the state in

which the action was originally filed (the “local defendant”); (3) the local

defendant’s conduct forms a significant basis for the claims asserted; (4) plaintiffs

are seeking significant relief from the local defendant; (5) the principal injuries

occurred in the state in which the action was originally filed; and (6) no other class

action asserting the same or similar allegations against any of the defendants had

been filed in the preceding three years.

Id. at 506-07. “These elements ensure that the exception is invoked when the class is primarily

local, the lawsuit is against ‘at least one real in-state defendant whose alleged conduct is central to

the class claims and from whom the class seeks significant relief,’ the injuries the defendant

allegedly caused occurred within the forum, and no other similar class actions have been filed

against any of the defendants.” Id. at 507 (quoting 151 Cong. Rec. 8999-02, 2005 WL 283380

10

(daily ed. Feb. 7, 2005) (statement of Sen. Specter)). The court “may consider pleadings as well

as evidence that the parties submit to determine whether subject matter jurisdiction exists or an

exception thereto applies.” Jd. at 503 n.1. Failure to show any one of the several elements of the

local controversy exception precludes its applicability. See Vodenichar, 733 F.3d at 506-07.

2. Analysis

In its opening brief, Defendant argues that minimal diversity between the parties is lacking,

based on the Plaintiff's disclosure statement, which represents that the named Plaintiffs are citizens

of Pennsylvania, but the remaining unidentified class members are from “Various States.” (ECF

No. 26 at 12, citing ECF No. 6 at 2). Defendant argues that practicality and reasonable presumption

lead to the conclusion that the probable citizenship of the proposed class is from Pennsylvania,

the Defendant’s location and small size. (ECF No. 26 at 14-15). It argues that the Court

should decline to exercise jurisdiction of Plaintiffs purported class action because both the “home

state” and “local controversy” exceptions, to jurisdiction under CAFA apply.” (ECF No. 26 at 16,

ECF NO. 37 at 2).

In Response, Plaintiffs argue that Defendant has not met its burden to prove that either the

home state exception or the local controversy exception applies, arguing that “Defendant has not

submitted any evidence to support that contention.” (ECF No. 36 at 10-13) (citing, inter alia, Ellis

v. Montgomery Cnty., 267 F. Supp.3d 510, 516 (E.D. Pa. 2017).

Inits Reply, Defendant addresses this evidentiary concern. “Courts may consider pleadings

as well as evidence that the parties submit to determine whether subject matter jurisdiction exists,

or an exception thereto applies.” Whitaker v. Herr Foods, Inc., 198 F. Supp. 3d 476, 482 (E.D. Pa.

2 There is no allegation or dispute that there have been no other class actions filed against Defendant on this issue in

the preceding three years, and further, that Defendant is a citizen of Pennsylvania.

11

2016) (quoting Vodenichar, 733 F.3d 497, 503 n. 1)). This is a “factual” attack, because while the

pleadings themselves may facially establish jurisdiction, Defendant argues that one or more of the

factual allegations is untrue, causing the case to fall outside the court’s jurisdiction. Constitution

Party of Pennsylvania, 757 F.3d at 358.

Defendant argues that data supports the reasonable presumption that more than two-thirds

of the proposed class are Pennsylvania citizens, (ECF No. 37 at 5-6), and attaches two affidavits,

sworn pursuant to 28 U.S.C. 1746: (1) affidavit of David Trudell, Director of Marketing,

Communication and Sales for Defendant, (ECF No. 37-1), and (2) affidavit of Marcy Little,

System Director, Corporate Analytics for Defendant. (ECF No. 37-2). Trudell states that

Defendant at all times relevant hereto, was a healthcare delivery system comprised of eight

hospitals and providers operating in twenty-six counties in central and western Pennsylvania, and

further, does not have any medical facilities located outside of Pennsylvania. (ECF No. 37-1 {§ 4-

5). In addition, Trudell states that during the at-issue period, Defendant utilized analytical tools

that could identify the states from which a website user’s IP address originated from and performed

a lookback to identify the percentage of users by state that visited the Find a Doctor page on

phhealthcare.org. Id. J] 6-7. The data reflects 78.8% of all IP addresses for Find a Doctor webpage

visitors originated in Pennsylvania, with the combination of website visitors from New York,

Ohio, and West Virginia only at 6.55% of all total users. Jd. J 8-10. As to those users who actually

used the Find a Doctor interface, the originating state for IP addresses for those users were 81.24%

in Pennsylvania and the combination for New York, Ohio, and West Virginia being only 5.22%

of all total users. Jd. JJ 11-13. These analytics show that more than two-thirds of all IP addresses

originated in Pennsylvania. Jd. 414. Next, Little states that Defendant performed analytics on the

demographic makeup of actual patient encounters at its facilities. During the two-year period at

12

issue, Defendant tracked the percentage of patients by state that sought medical care at one of

Defendant’s hospitals. The data reflects that 99.1% of all patient encounters are from Pennsylvania

residents and only .9% of all patient encounters are from non-Pennsylvania residents. (ECF No.

37-2 ¥{ 9-10).

While initially compelling, the Court is persuaded by Plaintiffs’ argument that these

analytics and statements do not accurately reflect the class definition here. Plaintiffs filed this □

lawsuit on behalf of “fa]ll individuals who visited the [Defendant’s] website in the last two years

and had their private medical and other personal information shared with Google without providing

consent.” (ECF No. 1 at 24) (emphasis added). As Plaintiffs’ aptly note, Little reported data on the

Defendant’s patients, rather than its website users. (ECF No. 43 at 4) (citing ECF No. 37-2 at 6).

Presumably, not all patients used the website, and some non-Pennsylvania website users were

never patients. As for Trudell’s statement, he limited his data to those who used the Find a Doctor

function and those who used Find a Doctor plus a search feature. (ECF No. 37-1 at ff 7, 11).

Plaintiffs’ complaint, however, alleges that website users who used the search bar feature on

Defendant’s homepage had their private medical and personal information shared with Google.

(ECF No. 37 at {§ 31, 71, 73, 83, 85). Understandably, Defendant limited its data as it did because,

broadly speaking, the Complaint emphasizes the use of the Find the Doctor function, (see, e.g.,

ECF No. 1 at 20-31), however, the Plaintiffs are correct that their allegations are broader.

Accordingly, the Court finds that, at this juncture in the proceedings, without a more

fulsome record on the critical question of jurisdiction, Defendant has not met its burden with

respect to the applicability of either the home state exception or the local controversy exception,

each of which require a showing that greater than two-thirds of the putative class are citizens of

the state in which the action was originally filed. The Motion to Dismiss is denied in this regard.

13

In the event Plaintiff seeks leave to amend, and this matter proceeds further, record evidence may

support a different conclusion, and the Court can revisit the jurisdictional issue, if appropriate.

B. Motion to Dismiss for Failure to State a Claim Under 12(b)(6)

Next the Court addresses Defendant’s Motion to Dismiss on the grounds Plaintiffs have

failed to plead a claim under WESCA. To establish a violation of WESCA, a plaintiff must show:

(1) that [the claimant] engaged in a communication; (2) that he possessed

an expectation that the communication would not be intercepted; (3) that

his expectation was justifiable under the circumstances; and (4) that the

defendant attempted to, or successfully intercepted the communication, or

encouraged another to do so.

Emmett v. Delta Air Lines, Inc., No. 2:22-1568, 2024 WL 2816502, at *7 (W.D. Pa. June 3, 2024)

(citing Kelly v. Carlisle, 622 F.3d 248, 257 (3d Cir. 2010) and quoting Agnew v. Dupler, 553 Pa.

33, 717 A.2d 519, 522 (Pa. 1998)).

Defendant argues that Plaintiffs have failed to allege’ that Plaintiffs had an expectation of

privacy/non-interception in their communication under the circumstances, and further, that any

private information was intercepted or disclosed. (ECF No. 26 at 20-23. Defendant does not

dispute that Google Analytics was embedded on its website, or that it was used to collect and

transmit the information of the website user.

As to the second and third element, Defendant argues that the voluntary transmission of an

IP address is not a private communication and thus is not a violation of WESCA, citing, inter alia,

Commonwealth v. Kurtz, 294 A.3d 509, 521 (Pa. Super. 2023). Defendant then argues that no

private medical or personal information was intercepted or disclosed, citing, inter alia, Santoro v.

Tower Health, No. CV 22-4580, 2024 WL 1773371, at *1 (E.D. Pa. Apr. 24, 2024).

Plaintiffs allege that Defendant intercepted their communications that contained private

3 Plaintiffs have sufficiently alleged element one. (ECF No. | at §¥ 68-72, 80-84). Defendant does not contest this.

ECF No. 26 at 13-14).

14

medical information as follows. Defendant intercepted “information submitted by [Plaintiffs]

through the search bar (e.g., doctor, specialty, type of treatment, etc.” (ECF No. 1 at §31). Plaintiffs

allege the interception of “sensitive medical and other personal information” when using the search

bar on Defendant’s website, “including [Plaintiffs’] medical diagnosis, conditions and symptoms”

(id. at J§ 71, 83), as well as Plaintiffs’ “IP addresses.” (/d. at J] 22, 31, 69, 71, 81, 83). Plaintiffs

further allege that their sensitive medical and other personal information, “including the types of

medical treatment [sought] through [Defendant], the type of provider (i.e., physician, nurse

practitioner, etc.), specialty and name of the providers with whom [they sought] treatment with,

the locations of the [Defendant] facilities [they chose] to go to and if [they searched] for

[Defendant] providers by specific gender,” was intercepted through the website’s “Find a Doctor”

feature. (/d. at Ff 69, 81). Plaintiffs allege that Defendant also unlawfully intercepts and shares all

Uniform Resource Locators (“URLs”) from Plaintiffs’ interactions and communications on its

website, which allows Google to intercept information on each and every webpage viewed by

Plaintiffs and every other individual website user of Defendant. (/d. at 4] 27-28, 30-31).

WESCA prohibits the interception of any wire, electronic or oral communication and the

intentional disclosure of the “contents” of the communication. 18 Pa. Cons. Stat. § 5725.

“Contents” is defined as “any information concerning the substance, purport, or meaning of that

communication.” 18 Pa. Cons. Stat. § 5702; (ECF No. 1 4 105). Accordingly, Plaintiffs allege that

“Plaintiffs’ and Class members’ intercepted PHI and other personal information constitute the

‘contents’ of ‘electronic communication[s]’ within the meaning of WESCA.” (d.).,

The HIPAA regulation define individually identifiable health information as “information

that is a subset of health information, including demographic information collected from an

individual, and: (1) [] created or received by a health care provider ... and (2) [rJelates to the past,

15

present, or future physical or mental health or condition of an individual; the provision of health

care to an individual ... and (i) [t]hat identifies the individual; or (ii) [w]ith respect to which there

is a reasonable basis to believe the information can be used to identify the individual.” 42 U.S.C.

§ 1320d-6(a)(3).

Defendant’s reliance on Santoro is compelling. In Santoro, 2024 WL 1773371, at *4, the

Court dismissed Plaintiff's claim for violation of the Federal Wiretap Act, 18 U.S.C. § 2510, in

which plaintiff alleged Defendant shared HIPAA protected information to a third-party. In that

case, Plaintiffs maintained that defendant regional healthcare provider, Tower Health, installed

Meta Pixel software on its public website, which is a small piece of code that records information

about visitors’ activity on a particular webpage. Jd. at *1. Plaintiffs maintained that the information

included content specific to the user such as IP addresses and Facebook IDs, and tracked what

visitors did on that webpage, including how much time the users spent there or what links they

clicked. Id. The Meta Pixel would then transmit the recorded information to Meta, which was

analyzed for its own commercial purposes, including building a comprehensive profile of the

individual user to better target advertisements. /d. The court reasoned:

As best as we can tell from the allegations and undisputed representations, whether

individually identifiable health information is intercepted could depend upon how

the particular user interacts with the website, including how long they spend on a

page, what links are clicked on, and what search terms they input—as well as the

nature of the user's health condition and treatment plan. We need not define what

constitutes HIP[A]A-protected information or otherwise flesh out plaintiffs’

speculation. It is plaintiffs’ responsibility to make factual allegations that plausibly

state a claim for relief, and they have not done so here . . . For that reason, we

conclude that plaintiffs fail to state a claim for a violation of the Wiretap Act.

Id. at *5.

This case is persuasive, despite Plaintiffs’ objection that the Federal Wiretap Statute was

the purported cause of action. (ECF No. 48 at 2-3). WESCA is Pennsylvania's state law equivalent

16

to the Federal Wiretap Act. See Popa v. Harriet Carter Gifts, Inc., 52 F Ath 121, 125 (3d Cir. 2022)

(explaining WESCA “operates in conjunction with and as a supplement to the Federal Wiretap

Act, 18 U.S.C. § 2510, which provides uniform minimum protections for wire, electronic, or oral

communications”). “Because the relevant provisions and statutory definitions (e.g., “intercept” and

“contents”) from [WESCA] are identical to those in the [Federal Wiretap Act, 18 U.S.C. §

5725(a)], the Court can look to decisions applying those provisions and definitions for guidance.”

Cook v GameStop Inc., 689 F. Supp. 3d 58, 68 n. 6.

Plaintiff argues that the Courts should adopt the reasoning in Emmett v. Delta Airlines,

Inc., No. 2:22-1568, 2024 WL 2816502 (W.D. Pa. June 3, 2024) (Colville, J.) That case, however,

addressed the data collected by Session Replay Code, which identified all website visitor actions;

under those circumstance, Plaintiff had a justifiable expectation that his keystroke and mouse

movant activity on Defendant’s website was not being recorded. Jd. at *9. Here, the interception

of Plaintiff's individually identifiable health information depends on how the particular user

interacts with the website. Like the Plaintiff in Santoro, here Plaintiffs have failed to allege with

any particularity that there was a HIPAA violation. Plaintiffs do not allege what information was

searched, what PHI was disclosed, what confidential diagnoses were revealed, or that a particular

medical condition was scheduled through the application, or how their inputted information relates

to Plaintiffs’ own medical care and diagnoses. “The specifics are essential to convert a case like

this from a law-school hypothetical to an actionable dispute.” Santoro, 2024 WL 1773371, at * 1.

17

IV. Conclusion

For the reasons stated above, Defendant’s Motion to Dismiss (ECF No. 25) will be granted

without prejudice.

An appropriate Order will be entered. A ~~ A

Ney . hk feo.

Cf OS ge 1a SORE Lae □□□

Dated: February 9, 2026 uf df fied PHN Lie

Steplianie L. Haines

United States District Judge

cc/ecf: All counsel of record

18