Patients Advance Kaiser Class Action Over Google Info Sharing

Kaiser Foundation Health Plan Inc. must face a proposed class action alleging it disclosed patients’ personal information to Google, Microsoft, Twitter, and other entities without their consent in violation of state wiretapping and consumer-protection laws.

Seven anonymous plaintiffs adequately pleaded claims of breach of implied contract, negligence, and violations of consumer-protection laws of Maryland, Oregon, Virginia, and Washington, Judge Edward M. Chen of the US District Court for the Northern District of California said Thursday.

Chen dismissed 15 other claims, including intrusion upon seclusion, invasion of privacy under the California Constitution, breach of express contract, and violations of the Electronic Communications Privacy Act and the consumer-protection statutes of several other states.

Their lawsuit alleged that KFHP, Kaiser Foundation Hospitals Inc., and the Permanente Medical Group Inc., installed tracking code on Kaiser Permanente websites and mobile apps, allowing the transmission of patient information to the third parties.

The suit is part of a surge of litigation against health-care providers over their use of third-party tracking software on their patient portals and apps, which are used by patients to schedule appointments, check medical results, research doctors and medical services, communicate with providers, and pay medical bills.

KFHP didn’t obtain their consent before disclosing their information to the third parties, and allowed the disclosure to take place despite HIPAA provisions requiring it to protect their information, they alleged.

Chen also dismissed claims against Kaiser Foundation Hospitals and the Permanente Medical Group, finding that the plaintiffs failed to allege wrongdoing by those entities with respect to the operation of the Kaiser Permanente website and mobile apps.

Adequate Pleadings

KFHP argued in a motion to dismiss that the claim of negligence per se should be dismissed because intentional acts couldn’t support a negligence claim, but Chen disagreed.

A negligence per se claim can be based on a violation of a statute, he said. Because KFHP didn’t show that all of the statutory claims brought by the plaintiffs were deficient, there was room for a negligence per se claim even if some of the statutory claims were dismissed, he said.

The claim for violation of the Maryland Wiretapping and Electronic Surveillance Act survived because plaintiff Jane Doe III alleged that she was a Maryland resident, allowing the inference that the interception took place in the state, he said.

Their claims of violations of the Oregon Unlawful Trade Practices Act, the Virginia Insurance Information and Privacy Protection Act, and the Washington Consumer Protection Act were also adequately pleaded, the judge said.

Chen dismissed several claims because the plaintiffs didn’t allege that KFHP knew or approved of third parties collecting and using information for their own purposes, including intrusion upon seclusion, invasion of privacy under the California Constitution, statutory larceny, the District of Columbia Consumer Protection Procedures Act, the Georgia Computer Systems Protection Act, the Virginia Computer Crimes Act, and the Washington Privacy Act.

Other claims were dismissed because the plaintiffs didn’t allege the disclosure of protected information, including breach of express contract, and violations of the California Confidentiality of Medical Information Act, the Georgia Insurance and Information Privacy Protection Act, and the Washington Health Care Information Act.

Chen gave the plaintiffs leave to file an amended complaint by May 9.

Kessler Topaz Meltzer & Check LLP and Carella, Byrne, Cecchi, Olstein, Brody & Agnello PC represent Doe and the proposed class. Sheppard Mullin Richter & Hampton LLP represents Kaiser.

The case is Doe v. Kaiser Permanente, N.D. Cal., No. 3:23-cv-02865, 4/11/24.