Jump To

Top Caption Trial Court Document

Support FLP

CourtListener is a project of Free
Law Project, a federally-recognized 501(c)(3) non-profit. Members help support our work and get special access to features.

Please become a member today.

Join Free.law Now

March 10, 2026 Get Citation Alerts Download PDF Add Note

Deborah Caine, individually and on behalf of all others similarly situated v. Sturdy Memorial Hospital, Inc.

District Court, D. Massachusetts

• Citations: None known
• Docket Number: 1:25-cv-10261

• Precedential Status: Unknown Status

• Opinion

• Authorities (16)

• Cited By (0)

• Summaries (0)

• Similar Cases (4.3K)

• PDF

Trial Court Document

UNITED STATES DISTRICT COURT

DISTRICT OF MASSACHUSETTS

                            *                                         

DEBORAH CAINE, individually and on *

behalf of all others similarly situated, *

*

Plaintiff, *

*

v. * Civil Action No. 25-cv-10261-ADB

*

STURDY MEMORIAL HOSPITAL, INC., *

*

Defendant. *

*

*

                MEMORANDUM AND ORDER                                  

BURROUGHS, D.J.

 Before the Court are a motion to dismiss by Defendant Sturdy Memorial Hospital, Inc. 

(“Sturdy Memorial” or “Defendant”), [ECF No. 8], and a motion to amend by Plaintiff Deborah
Caine (“Caine” or “Plaintiff”), [ECF No. 14]. For the following reasons, Sturdy Memorial’s
motion to dismiss is GRANTED, and Caine’s motion to amend is DENIED as moot in light of
this Order.

I. BACKGROUND

The following relevant facts are taken from Caine’s Amended Class Action Complaint
(“Amended Complaint”), [ECF No. 1-14 (“Am. Compl.”)], the factual allegations of which the
Court assumes to be true when considering a motion to dismiss. Ruivo v. Wells Fargo Bank,
N.A., 766 F.3d 87, 90 (1st Cir. 2014). As it may on a motion to dismiss, the Court has also
considered “documents incorporated by reference in [the complaint], matters of public record,
and other matters susceptible to judicial notice.” Giragosian v. Ryan, 547 F.3d 59, 65 (1st Cir.
2008) (alteration in original) (quoting In re Colonial Mortg. Bankers Corp., 324 F.3d 12, 20 (1st
Cir. 2003)).

A. Factual Background

Sturdy Memorial is an integrated health system that offers emergency and urgent care, 

hospital-based care, and primary and specialty practices across thirty-two facilities in
Massachusetts. [Am. Compl. ¶ 13]. On Sturdy Memorial’s website, www.sturdyhealth.org (“the
website”), users can research medical conditions, treatment options, and doctors. [Id. ¶¶ 40–43].

Patients can also log in to Sturdy Memorial’s patient portal through the website to book
appointments, communicate with providers, access medical records and lab results, and pay bills.

[Id. ¶¶ 44, 66].

Caine was a Sturdy Memorial patient from the 1990s through July 2023. [Am. Compl. ¶
22]. During that time, Caine “used Sturdy’s website frequently” to research medical conditions
and book appointments, [id. ¶¶ 22, 24], and “specifically to locate doctors at Sturdy’s North

Attleboro Medical Center facility and [to search] for other information concerning women’s
health that was pertinent to her,” including “information on several significant health issues, the
specifics of which are highly sensitive,” [id. ¶ 23].1

Caine alleges that patients’ communications with the website, including her own, are
“communications between Sturdy and its patients,” and that Sturdy Memorial “allows Google to
intercept those communications by embedding Google Analytics,” a user-tracking technology,

1 Caine’s motion to amend, [ECF No. 14]; see also [ECF No. 15 (supporting memorandum)],
seeks to add these specifics under seal. [ECF No. 15 at 5].

                           2                                         

on its website. [Am. Compl. ¶¶ 71, 100–01]. In particular, Caine alleges that Sturdy Memorial
intercepted patients’ protected health information (“PHI”) and individually identifiable health
information (“IIHI”), and disclosed that PHI/IIHI to Google through at least July 2024. [Id. ¶¶ 2,
46]. Because the embedded Google Analytics source code is “invisible” to users, these

disclosures occurred without Caine’s or other patients’ consent or knowledge. [Id. ¶¶ 46–48];
see also [id. ¶¶ 71–72, 80–92 (explaining how the technology transmits information between
website users, website servers, and third parties like Google)]. Using Google Analytics, Sturdy
Memorial tracked and disclosed health information including: specific types of medical
treatments sought out by its patients; the name, gender, specialty, and address of providers from
whom patients sought treatment; events and locations of clinics sought out by patients; dates and
times patients logged in to the patient portal or clicked a number to call a doctor’s office; and the
precise text of patients’ search queries about specific treatments, conditions, and providers. [Id.
¶¶ 46, 55–69, 76, 140]. Further, in addition to health information, Sturdy Memorial disclosed
patients’ personally identifiable data including their Internet Protocol (“IP”) addresses, which are

unique, numerical device identifiers that “enable[d] Google to identify the person whose
sensitive health data and information Sturdy [was] transmitting to Google via Google Analytics.”

[Id. ¶¶ 47–49, 64, 70, 140]. Despite its availability, Sturdy Memorial “affirmatively ch[ose]” not
to opt in to a Google Analytics feature designed to anonymize IP address data in order to support
web developers’ compliance with various privacy policies. [Id. ¶¶ 50–53, 75]; see also [id. ¶¶
73–75, 92 (describing Google’s policy prohibiting the use of health information for advertising
purposes)].

“[A]dvertising companies like Google use such private information to determine that
specific patients were seeking specific types of . . . medical treatment . . . such as [for] cancer or

                           3                                         

pregnancy, and allows Google to target advertisements accordingly.” [Am. Compl. ¶ 79]. In
return for providing Google with information that advances its advertising business, Sturdy
Memorial, like other Google Analytics users, received “marketing and analytics benefits from
Google.” [Id. ¶ 54]; see also [id. ¶¶ 102–04 (elaborating on Google’s advertising services)]; [id.

¶ 106 (“The monetization of the data being disclosed by Sturdy, both by it and Google,
demonstrates the inherent value of the information being collected.”)]. Caine now alleges that
Sturdy Memorial violated the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. §§
2510–2522; violated Massachusetts privacy statutes, Mass. Gen. Laws ch. 214, § 1B and ch. 111,
§ 70E; breached its fiduciary duty; breached implied contracts; and acted with negligence. [Id.
¶¶ 138–94].

B. Procedural History

Caine initially filed a complaint in Suffolk Superior Court on July 24, 2024. [ECF No. 1-
2]. On January 24, 2025, Caine filed the operative Amended Complaint on behalf of a putative
class, [ECF No. 1-14], in which, as relevant here, she alleged that she used Sturdy Memorial’s

website to search for “information on several significant health issues, the specifics of which are
highly sensitive but which [she] would disclose under a confidentiality agreement,” [id. ¶ 23].

Additionally, the Amended Complaint included a new ECPA claim against Sturdy Memorial,
[id. ¶¶ 138–55], that allowed Sturdy Memorial to remove the case to this Court based on federal

jurisdiction under 28 U.S.C. § 1441 (c) and 28 U.S.C. § 1331. [ECF No. 1].

On March 14, 2025, Sturdy Memorial filed the instant motion to dismiss the Amended
Complaint for failure to state a claim pursuant to Federal Rule of Civil Procedure 12(b)(6), [ECF
No. 8]; see also [ECF No. 9 (“Def.’s Mem.”)], which Caine opposed on April 25, 2025, [ECF
No. 18 (“Pl.’s Opp’n”)]. Sturdy Memorial replied on May 16, 2025, [ECF No. 20 (“Def.’s

                           4                                         

Reply”)], and then filed a notice of supplemental authority in support of its motion to dismiss on
June 26, 2025, [ECF No. 21], to which Caine responded on June 27, 2025, [ECF No. 22]. Caine
filed another notice of supplemental authority on August 11, 2025, [ECF No. 23], and Sturdy
Memorial responded on August 19, 2025, [ECF No. 24].

  On April 22, 2025, while the parties’ motion-to-dismiss briefing was in progress, Caine 

filed the instant motion to amend. [ECF No. 14]; see also [ECF No. 15 (supporting
memorandum)]. Caine requests leave to add “the private health information Sturdy shared with
Google,” which Caine had previously offered to disclose in a confidentiality agreement, and to
“redact[] that information so only Sturdy and the Court may view it.” [ECF No. 15 at 5]. Caine
makes her request on the basis that “[t]he crux of Sturdy’s motion is that [her] failure to specify
exactly what aspects of her private health information [she] shared with Google renders her
claims invalid.” [Id.]. Sturdy Memorial opposed the motion to amend on May 5, 2025. [ECF
No. 19].

II. LEGAL STANDARD

  On a motion to dismiss pursuant to Rule 12(b)(6), the Court must accept as true all well-

pleaded facts, analyze them in the light most favorable to the plaintiff, and draw all reasonable
inferences from those facts in favor of the plaintiff. United States ex rel. Hutcheson v.
Blackstone Med., Inc., 647 F.3d 377, 383 (1st Cir. 2011). In addition to “the facts alleged in the
complaint,” the Court may also consider “documents incorporated by reference therein and facts
susceptible to judicial notice.” MIT Fed. Credit Union v. Cordisco, 470 F. Supp. 3d 81, 84 (D.
Mass. 2020) (citing Haley v. City of Bos., 657 F.3d 39, 46 (1st Cir. 2011)). “[A] complaint must
provide ‘a short and plain statement of the claim showing that the pleader is entitled to relief,’”
Cardigan Mountain Sch. v. N.H. Ins. Co., 787 F.3d 82, 84 (1st Cir. 2015) (quoting Fed. R. Civ. 5

P. 8 (a)(2)), and set forth “factual allegations, either direct or inferential, respecting each material
element necessary to sustain recovery under some actionable legal theory,” Pitta v. Medeiros, 90
F.4th 11, 17 (1st Cir. 2024) (quoting Gagliardi v. Sullivan, 513 F.3d 301, 305 (1st Cir. 2008)).

Although detailed factual allegations are not required, a complaint must set forth “more than

labels and conclusions,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007), and
“[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory
statements, do not suffice,” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). Rather, “a complaint
must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible
on its face.’” Id. (quoting Twombly, 550 U.S. at 570). “[A]ssessing plausibility is ‘a context-
specific task that requires the reviewing court to draw on its judicial experience and common
sense.’” Frith v. Whole Foods Mkt., Inc., 38 F.4th 263, 270 (1st Cir. 2022) (quoting Rodríguez-
Reyes v. Molina-Rodríguez, 711 F.3d 49, 53 (1st Cir. 2013)).

III. DISCUSSION

Count I of Caine’s Amended Complaint, which asserts a violation of the ECPA, provides

the sole basis for federal jurisdiction. [Am. Compl. ¶¶ 138–55]. The ECPA prohibits any person
from intentionally intercepting, endeavoring to intercept, or procuring any other person to
intercept or endeavor to intercept any wire, oral, or electronic communication; intentionally
disclosing or endeavoring to disclose to any other person the contents of any electronic
communication, knowing or having reason to know that the information was obtained through
the interception of an electronic communication in violation of 18 U.S.C. § 2511 (1); or
intentionally using or endeavoring to use the contents of any electronic communication, knowing
or having reason to know that the information was obtained through the interception of an
electronic communication in violation of 18 U.S.C. § 2511 (1). 18 U.S.C. § 2511 (1)(a), (c)–(d).

                             6                                         

Under § 2511(2)(d), a party can generally avoid liability if they are “a party to the
communication” that they intercept or if “one of the parties to the communication has given prior
consent to such interception,” unless they trigger the crime-tort exception. Id. § 2511(2)(d).

Under the crime-tort exception, as relevant here, a party can be liable under the ECPA only if

they “intercepted [the communication] for the purpose of committing any criminal or tortious act
in violation of the Constitution or laws of the United States or of any State.” Id.

Here, the parties’ dispute turns on the applicability of the crime-tort exception. Caine,
leaning on cases in which courts have interpreted the exception broadly, argues that it applies
because Sturdy Memorial “captured and redirected Plaintiff’s information to third parties without
consent,” thus violating the Health Insurance Portability and Accountability Act (“HIPAA”), 42
U.S.C. § 1320d-6, and intruding upon Caine’s seclusion. See [Pl.’s Opp’n at 13–16
(enumerating cases interpreting § 2511(2)(d))]; see, e.g., In re Grp. Health Plan Litig., 709 F.
Supp. 3d 707, 719 (D. Minn. 2023) (“The existence of a lawful purpose does not sanitize an
interception that was also made for an illegitimate purpose.” (quoting In re Meta Pixel

Healthcare Litig., 647 F. Supp. 3d 778, 797 (N.D. Cal. 2022))); [Am. Compl. ¶¶ 150–53
(premising the § 2511(2)(d) allegations on a violation of HIPAA and “[a] knowing intrusion
upon Plaintiff’s and Class members’ seclusion”)]. Sturdy Memorial, in contrast, emphasizes
cases that construe the exception narrowly. See [Def.’s Mem. at 13–16]; [Def.’s Reply at 8–16].

In particular, Sturdy Memorial urges an interpretation that requires a specific intent to commit a
crime or tort, as well as intent to harm, for the exception to apply. See, e.g., [Def.’s Reply at 9–
10 (citing Thomas v. Pearl, 998 F.2d 447, 451 (7th Cir. 1993) (holding that the crime-tort
exception required plaintiff to “show that [defendant] either intended to break the law or commit
a tort against him in order to prove a violation of” the statute))]; [id. at 10 (“[I]t seems apparent

                           7                                         

from the context in which the statute was enacted that the sort of conduct contemplated was an
interception by a party to a conversation with an intent to use that interception against the non-
consenting party in some harmful way and in a manner in which the offending party had no right
to proceed.” (quoting Meredith v. Gavin, 446 F.2d 794, 799 (8th Cir. 1971)))]; [id. at 13 (“For

the crime-tort exception to apply, Plaintiff must—but does not—plausibly allege that Sturdy
Memorial . . . installed Google technologies on its public website for the distinct purpose of
violating HIPAA or perpetrating a tort, like invasion of privacy or breach of confidentiality—i.e.,
that Sturdy Memorial deployed these technologies because it ‘intended to harm’ its patients and
other visitors to its website.” (quoting United States v. McHugh, 57 F. Supp. 3d 95, 100 (D.
Mass. 2014)))].

This Court does not read “for the purpose of committing any criminal or tortious act,” 18
U.S.C. § 2511 (2)(d), to require the specific intent to commit a crime or tort, nor the intent to
harm. Stein v. Edward-Elmhurst Health, No. 23-cv-14515, 2025 WL 580556, at *6 (N.D. Ill.
Feb. 21, 2025) (“A desire to commit a crime qua crime, or a tort qua tort, isn’t necessary.”), cert.

granted, No. 23-cv-14515, 2026 WL 594752 (N.D. Ill. Mar. 3, 2026); Doe v. Lawrence Gen.
Hosp., No. 25-cv-10081, 2025 WL 2808055, at *20 (D. Mass. Aug. 29, 2025) (“ECPA . . . says
nothing about harm or injury. . . . Given that the word ‘injurious’ did not make it into the final
version as enacted, it seems anomalous to read the statute as if it had.”), report and
recommendation accepted in relevant part, No. 25-cv-10081, 2025 WL 2807673 (D. Mass. Sept.
30, 2025). Further, the Court agrees with Caine that Sturdy Memorial’s lawful purposes—like
marketing—do not preclude the possibility that its conduct might trigger § 2511(2)(d). The
statutory language is not so narrow. At the same time, “‘purpose’ is an essential element of
ECPA.” Doe, 2025 WL 2808055, at *12. Accordingly, to state a claim under the ECPA’s

                           8                                         

crime-tort exception, Caine must plead facts showing that Sturdy Memorial purposefully—not
merely knowingly or negligently—committed criminal or tortious acts. Stein, 2025 WL 580556,
at *6 (“The purpose must be to commit an act, and that act must be criminal or tortious. If the
purpose is to do X, and if X is a crime or a tort, then the crime-tort exception . . . applies.”).

The Amended Complaint falls short of that standard.  Caine essentially proposes two acts 

to which she argues the crime-tort exception applies: Sturdy Memorial’s (1) acquisition of IIHI
without authorization;2 and (2) knowing intrusion upon seclusion. See [Am. Compl. ¶¶ 150–53].

To rely on § 2511(2)(d), then, Caine must—but fails to—plausibly allege that Sturdy Memorial
purposefully acquired IIHI without authorization or purposefully intruded upon her seclusion.

With respect to IIHI, although Caine emphasizes that Sturdy Memorial chose not to opt in to
Google Analytics’ IP anonymization feature, [id. ¶¶ 50–53], the facts are too thin to support the
inference that Sturdy Memorial installed the tracking tools for the purpose of acquiring IIHI
without authorization. Likewise, even though Caine suggests that Sturdy Memorial may have
been on notice regarding privacy risks surrounding the collection of health data, [id. ¶¶ 73–75,

92], the Court cannot, based on the Amended Complaint, draw the inference that the health care
system purposefully intruded on its patients’ seclusion or privacy.

2 Caine alleges that Sturdy Memorial violated HIPAA because “[a]n individual or corporation
violates [HIPAA] if it knowingly: ‘(1) uses or causes to be used a unique health identifier; or obtains individually identifiable health information relating to an individual,’” and also
alleges that Sturdy Memorial is subject to criminal penalties under HIPAA because it acquired
IIHI “‘with intent to sell, transfer, or use’ [the IIHI] ‘for commercial advantage [or] personal
gain.’” [Am. Compl. ¶¶ 118–120, 150 (quoting 42 U.S.C. § 1320d-6)]. Further, Caine contends
that Sturdy Memorial’s unauthorized acquisition of IIHI is “tortious in and of itself.” [Id. ¶ 150].

For the purposes of this Order, which deals with the limited question of whether Sturdy
Memorial’s acts satisfy the ECPA’s crime-tort exception, the Court treats these allegations as
boiling down to one act: the acquisition of IIHI without authorization.

                           9                                         
  Because the Amended Complaint does not plausibly allege that Sturdy Memorial 

intercepted communications “for the purpose of committing [a] criminal or tortious act,” 18
U.S.C. § 2511 (2)(d), the ECPA claim fails, and Count I is DISMISSED.

The Court declines to exercise supplemental jurisdiction over the remaining claims, all of

which arise under state law. See 28 U.S.C. § 1367 (c) (stating that “district courts may decline to
exercise supplemental jurisdiction” when “the district court has dismissed all claims over which
it has original jurisdiction”); United Mine Workers of Am. v. Gibbs, 383 U.S. 715, 726 (1966)
(“It has consistently been recognized that pendent jurisdiction is a doctrine of discretion, not of
plaintiff’s right. . . . Needless decisions of state law should be avoided both as a matter of comity
and to promote justice between the parties, by procuring for them a surer-footed reading of
applicable law. Certainly, if the federal claims are dismissed before trial . . . the state claims
should be dismissed as well.”).

IV. CONCLUSION

For the reasons stated above, Sturdy Memorial’s motion to dismiss the Amended

Complaint is GRANTED without prejudice and with leave to amend within 21 days. Further,
because this Order grants leave to amend, Caine’s motion to amend is DENIED as moot.3
SO ORDERED.

March 10, 2026 /s/ Allison D. Burroughs

ALLISON D. BURROUGHS

U.S. DISTRICT JUDGE

3 The Court notes that the specifics Caine sought to add in her motion to amend would not have
cured the deficiencies discussed in this Order. That is not to say, however, that those specifics
may not be included in any future amendment.

                            10