WEDDLE v. WAKEMED HEALTH & HOSPS., 2023 NCBC 82

STATE OF NORTH CAROLINA
WAKE COUNTY
IN THE GENERAL COURT OF JUSTICE
SUPERIOR COURT DIVISION
22 CVS 13860
TRACE WEDDLE, LINDA
MATTHIAE, and KIM NAUGLE, on
behalf of themselves and all others
similarly situated,
Plaintiffs,
v.
WAKEMED HEALTH AND
HOSPITALS d/b/a WAKEMED,
Defendant.
ORDER AND OPINION ON
DEFENDANT’S MOTION TO DISMISS
1. 	Plaintiffs Trace Weddle, Linda Matthiae, and Kim Naugle are patients or
former patients of Defendant WakeMed Health and Hospitals. 	In this class action,
Plaintiffs allege that WakeMed gave Meta Platforms, Inc.—the company that owns
social media giant Facebook—unauthorized access to patients’ personal and medical
data for advertising and marketing purposes. They have asserted a variety of claims,
including negligence, breach of implied contract, and breach of fiduciary duty.
2. 	WakeMed has moved to dismiss the complaint in its entirety under Rule
12(b)(6) of the North Carolina Rules of Civil Procedure. 	(See ECF No. 59.) 	For the
following reasons, the Court GRANTS in part and DENIES in part the motion.
Milberg Coleman Bryson Phillips Grossman, PLLC, by Scott Crissman
Harris and James DeMay, and Law Offices of James Scott Farrin, by
Thomas Wilmoth and Gary Jackson, for Plaintiffs Trace Weddle, Linda
Matthiae, and Kim Naugle.
Cohen & Malad, LLP, by Amina A. Thomas and Lynn Toops, for
Plaintiffs Trace Weddle and Linda Matthiae.
Weddle v. WakeMed Health & Hosps., 2023 NCBC 82.

Lockridge Grindal Nauen P.L.L.P., by Kate Baxter-Kauf and Maureen
Kane Berg, and CR Legal Team, LLP, by Peter H. Burke, for Plaintiff
Kim Naugle.
Alston & Bird LLP, by Matthew P. McGuire, Kristine McAlister Brown,
Donald Houser, and Brandon Springer, for Defendant WakeMed Health
and Hospitals.
Conrad, Judge.
I.
BACKGROUND
3. 	The Court does not make findings of fact on a motion to dismiss. 	The
following background assumes that the allegations of the second amended complaint
are true.
4. 	This case is about something called the Meta Pixel. 	In simple terms, the
Pixel is software code created by Meta that can be put into a website to collect data.
Companies use the Pixel to assess how people interact with their websites—for
example, who they are, what they click, and what information they type into forms.
Meta also receives that data and uses it “to serve targeted ads and identify users to
be included in such targeted ads.” (2d Am. Compl. ¶¶ 26–30, ECF No. 58.)
5. 	Hospital systems are among those that use the Meta Pixel. WakeMed is one
of them, having first embedded the Pixel in its website and patient portal in March
2018. This allegedly gave Meta regular access to sensitive patient data—their contact
information, 	medical 	history, 	appointment 	calendar, 	and 	all 	sorts 	of 	other
information provided to WakeMed as a condition of receiving medical care. 	But
WakeMed did not tell patients about the Pixel or ask for their consent to share
information with Meta. (See 2d Am. Compl. ¶¶ 3–5, 11, 17, 31, 32, 39–41, 45.)

6. 	After a news organization published a report in June 2022 about hospitals’
use of the Pixel, WakeMed removed it. 	A few months later, WakeMed notified its
patients for the first time that it had embedded the Pixel in its website and patient
portal. 	Although WakeMed professed that its intent was to collect anonymous data
to improve the user experience and access to healthcare, it acknowledged that the
Pixel had collected patient-specific data and may have sent some of that data to Meta.
(See 2d Am. Compl. ¶¶ 31, 35, 36, 46–48; Ex. D to 2d Am. Compl., ECF No. 58.4.)
7. 	Plaintiffs are patients or former patients of WakeMed who claim to have
been 	harmed 	by 	its 	unauthorized 	disclosure 	of 	sensitive 	personal 	and 	health
information to Meta. 	Individually and on behalf of a putative class of similarly
situated individuals, they assert claims for negligence, negligence per se, invasion of
privacy, breach of implied contract, unjust enrichment, unfair or deceptive trade
practices under N.C.G.S. § 75-1.1, breach of fiduciary duty, and violation of the North
Carolina Electronic Surveillance Act.
8. 	WakeMed has moved to dismiss all claims against it. (See ECF No. 59.) The
motion is fully briefed, and the Court held a hearing on 8 November 2023. The motion
is ripe for decision.
II.
LEGAL STANDARD
9. 	A motion to dismiss for failure to state a claim “tests the legal sufficiency of
the complaint.” 	Isenhour v. Hutto, 350 N.C. 601, 604 (1999) (citation and quotation
marks omitted). Dismissal is proper when “(1) the complaint on its face reveals that
no law supports the plaintiff’s claim; (2) the complaint on its face reveals the absence

of facts sufficient to make a good claim; or (3) the complaint discloses some fact that
necessarily defeats the plaintiff’s claim.” Corwin v. Brit. Am. Tobacco PLC, 371 N.C.
605, 615 (2018) (citation and quotation marks omitted). In deciding the motion, the
Court must treat all well-pleaded allegations as true and view the facts and
permissible inferences in the light most favorable to the nonmoving party. See, e.g.,
Sykes v. Health Network Sols., Inc., 372 N.C. 326, 332 (2019).
III.
ANALYSIS
10. 	In their opposition brief, Plaintiffs abandoned their claim for violation of the
North Carolina Electronic Surveillance Act. The Court therefore dismisses that claim
without further discussion and turns to the remaining seven claims.
A. Common-Law Negligence and Negligence Per Se
11. 	Plaintiffs’ first and second causes of action are for common-law negligence
and negligence per se. 	Because the claims involve similar allegations and legal
principles, they are best addressed together.
12. 	Negligence at common law is the “failure to exercise proper care in the
performance of some legal duty which the defendant owed the plaintiff, under the
circumstances in which they were placed.” Wood v. Guilford Cnty., 355 N.C. 161, 166
(2002) (citation and quotation marks omitted). 	Stated another way, “[t]he law
imposes upon every person who enters upon an active course of conduct the positive
duty to exercise ordinary care to protect others from harm, and calls a violation of
that duty negligence.” 	Council v. Dickerson’s, Inc., 233 N.C. 472, 474 (1951). 	The
duty of ordinary care “does not require perfect prescience, but instead extends only

to causes of injury that were reasonably foreseeable and avoidable through the
exercise of due care.” Fussell v. N.C. Farm Bureau Mut. Ins. Co., 364 N.C. 222, 226
(2010).
13. 	Negligence per se looks to statutory standards rather than common-law
standards. 	“The violation of a statute which imposes a duty upon the defendant in
order to promote the safety of others, including the plaintiff, is negligence per se,
unless the statute, itself, otherwise provides, and such negligence is actionable if it is
the proximate cause of injury to the plaintiff.” Lamm v. Bissette Realty, Inc., 327 N.C.
412, 415 (1990) (citation and quotation marks omitted). “The statute prescribes the
standard, and the standard fixed by the statute is absolute. The common law rule of
ordinary care does not apply—proof of the breach of the statute is proof of negligence.”
Cowan v. Murrows Transfer, Inc., 262 N.C. 550, 554 (1964).
14. 	Plaintiffs allege that WakeMed’s unauthorized disclosure of private patient
information to Meta violated federal law—namely, section 5 of the Federal Trade
Commission 	(“FTC”) 	Act 	and 	regulations 	implementing 	the 	Health 	Insurance
Portability and Accountability Act (“HIPAA”). 	These statutory and regulatory
violations, they claim, are negligence per se. Failing that, they claim, WakeMed had
a common-law duty to keep their information private and to notify them of the privacy
breach.
15. 	The negligence per se claim is untenable because neither the FTC Act nor
the HIPAA regulations are public safety laws. As our Supreme Court has explained,
“[a] safety statute or ordinance is one designed for the protection of life or limb and

which imposes a duty upon members of society to uphold that protection.” 	State v.
Powell, 336 N.C. 762, 768–69 (1994). Section 5 of the FTC Act targets unfair methods
of competition and unfair or deceptive trade practices. 	See 15 U.S.C. § 45(a)(1).
HIPAA has many purposes 	related to the health insurance industry and the
confidentiality of patient information. See, e.g., 45 C.F.R. §§ 164.504, 164.508 (2023).
These are primarily competition and privacy laws, not laws for the protection of life
or limb.
16. 	Plaintiffs argue that a violation of a public safety statute, though sufficient
to state a claim for negligence per se, is not necessary. 	That is incorrect. 	Binding
appellate precedent makes clear that “negligence per se applies only when the statute
violated is a public safety statute.” 	Hardin v. York Mem’l Park, 221 N.C. App. 317,
326 (2012); see also Stein v. Asheville City Bd. of Educ., 360 N.C. 321, 326 (2006)
(stating that “the violation of a public safety statute constitutes negligence per se”
(cleaned up)); State Farm Mut. Auto. Ins. Co. v. Holland, 324 N.C. 466, 475 (1989)
(stating that “the violation of a statute enacted for the safety and protection of the
public constitutes negligence per se”); Cowan, 262 N.C. at 554 (“It is the generally
accepted view that the violation of a statute enacted for the safety and protection of
the public constitutes negligence per se, i.e., negligence as a matter of law.”).
17. 	Because Plaintiffs have not alleged a violation of a public safety statute, they
have failed to state a claim for negligence per se.1
1 For these and other reasons, courts around the country routinely dismiss negligence per se
claims based on the FTC Act and HIPAA regulations. 	See Citizens Bank of Pa. v.
Reimbursement Techs., Inc., 609 F. App’x 88, 93–94 (3d Cir. 2015) (unpublished) (affirming
dismissal of negligence per se claim under Pennsylvania law based on alleged HIPAA

18. 	Plaintiffs 	have, 	however, 	adequately 	stated 	a 	claim 	for 	common-law
negligence. 	The gist of their claim is that WakeMed owed a duty to exercise
reasonable care when handling its patients’ confidential information and that it
breached that duty by using the Pixel and giving Meta unauthorized access to the
information. 	That unauthorized disclosure led to foreseeable, avoidable harm,
compounded by WakeMed’s delay in notifying its patients of the breach of confidence.
(See 2d Am. Compl. ¶¶ 120–25.)
19. 	WakeMed argues that North Carolina law does not recognize a duty of care
in these circumstances. Not so. “It is well established that hospitals and doctors in
their employ owe their patients a duty to exercise the degree of care that a reasonable
person would in similar circumstances to prevent an unreasonable risk of harm to
their patients.” 	Demarco v. Charlotte-Mecklenburg Hosp. Auth., 268 N.C. App. 334,
338 (2019). Our courts have applied that “general duty of reasonable care” in proper
violation); In re Capital One Consumer Data Sec. Breach Litig., 488 F. Supp. 3d 374, 408
(E.D. Va. 2020) (concluding that the FTC Act is not “aimed at protecting public safety, as that
term is applied under Virginia law”); see also J.R. v. Walgreens Boots Alliance, Inc., 2021 U.S.
App. LEXIS 31389, at *18–21 (4th Cir. 2021) (unpublished) (concluding that violations of
HIPAA and FTC Act could not support claim for negligence per se under South Carolina law
because neither allowed for a private right of action); Gilbert v. Bioplus Specialty Pharm.
Servs., LLC, 2023 U.S. Dist. LEXIS 90820, at *5–6 (M.D. Fla. Mar. 3, 2023) (“Courts have
declined to find a private right of action under the FTC Act or HIPAA, so those cannot support
a negligence per se claim.”); In re Netgain Tech., LLC Consumer Data Breach Litig., 2022 U.S.
Dist. LEXIS 98342, at *42 (D. Minn. June 2, 2022) (“Plaintiffs have not cited any precedent
in California, Minnesota, Nevada, South Carolina, or Wisconsin that permits a state-law
negligence per se claim to proceed based on the theory that there is a violation of Section 5 of
the FTC Act.”); Walters v. Blue Cross & Blue Shield of Tex., Inc., 2022 U.S. Dist. LEXIS
55061, at *14 (N.D. Tex. Mar. 28, 2022) (concluding that plaintiff had “cite[d] no case law
supporting his contention that HIPAA . . . can be the basis for a negligence per se claim”
under Texas law); Cohen v. Ne. Radiology, P.C., 2021 U.S. Dist. LEXIS 16497, at *20
(S.D.N.Y. Jan. 28, 2021) (“[S]everal New York courts have concluded that neither HIPAA nor
the FTC Act can sustain a negligence per se claim.”).

circumstances to the maintenance and dissemination of patient records. 	Id. at 339;
see also Acosta v. Byrum, 180 N.C. App. 562, 568 (2006) (holding that plaintiff had
adequately alleged the existence of a “duty to maintain privacy in her confidential
medical records”).
20. 	Acosta and Demarco have not been overruled, as WakeMed contends. 	In
fact, the case it cites for that proposition has nothing to do with the duties that doctors
owe patients. 	See Cedarbrook Residential Ctr., Inc. v. N.C. Dep’t of Health & Hum.
Servs., 383 N.C. 31, 61–72 (2022) (refusing to recognize a claim for negligent
regulation by a government agency).
21. 	Nor did the Court of Appeals apply the wrong standard of review in Acosta
and Demarco. WakeMed misreads those cases to allow a plaintiff to give “notice of a
theory of duty” even if that duty is not one “recognized under the law.” (Br. Supp. 7,
ECF No. 60.) 	But courts do not indulge futile claims. 	In both cases, the Court of
Appeals held that the plaintiffs had stated valid claims for relief and had properly
pointed to “HIPAA, its implementing regulations, and hospital privacy policies . . . to
plead a specific standard of care sufficient to overcome dismissal under Rule 12(b)(6).”
Demarco, 268 N.C. App. at 339; see also Acosta, 180 N.C. App. at 568. 	Plaintiffs in
this case have done the same. (See, e.g., 2d Am. Compl. ¶¶ 19–22, 67, 71–74.)
22. 	The Court therefore grants WakeMed’s motion to dismiss the claim for
negligence per se but denies its motion to dismiss the claim for common-law
negligence. 	See Hart v. Ivey, 332 N.C. 299, 303–05 (1992) (concluding that plaintiff

had adequately alleged common-law negligence but had not alleged a violation of a
public safety statute for purposes of negligence per se).
B. Invasion of Privacy
23. 	Several torts fall under the umbrella of invasion of privacy. See Renwick v.
News and Observer Publ’g Co., 310 N.C. 312, 322 (1984). 	Plaintiffs frame their
privacy claim as one for intrusion into seclusion.
24. 	“[O]ne who intentionally intrudes, physically or otherwise, upon the solitude
or seclusion of another or his private affairs or concerns, is subject to liability to the
other for invasion of his privacy, if the intrusion would be highly offensive to a
reasonable person.” 	Miller v. Brooks, 123 N.C. App. 20, 26 (1996) (citation and
quotation marks omitted). “Generally, there must be a physical or sensory intrusion
or an unauthorized prying into confidential personal records to support a claim for
invasion of privacy by intrusion.” Broughton v. McClatchy Newspapers, Inc., 161 N.C.
App. 20, 29 (2003). Examples include “physically invading a person’s home or other
private 	place, 	eavesdropping 	by 	wiretapping 	or 	microphones, 	peering 	through
windows, persistent telephoning, unauthorized prying into a bank account, and
opening personal mail of another.” Id. (quoting Burgess v. Busby, 142 N.C. App. 393,
406 (2001)).
25. 	As WakeMed correctly observes, Plaintiffs do not allege that it intruded into
their private affairs, either physically or by prying into their personal records without
authorization. Rather, they allege that they voluntarily shared sensitive information
with WakeMed and that WakeMed then gave Meta unauthorized access to that

information. 	(See 2d Am. Compl. ¶ 150 (alleging that WakeMed’s “disclosure of”
personal information was “an intentional intrusion on Plaintiffs’ . . . solitude or
seclusion”).) Even if true, that unauthorized disclosure of confidential information to
a third party is not an intrusion into Plaintiffs’ private affairs. See Hall v. Post, 323
N.C. 259, 270 (1988) (holding that North Carolina does not recognize “a claim for
relief for invasion of privacy by public disclosure of true but ‘private’ facts”); see also
Sabrowski v. Albani-Bayeux, Inc., 2003 U.S. Dist. LEXIS 23242, at *38 (M.D.N.C.
Dec. 	19, 	2003) 	(applying 	North 	Carolina 	law 	and 	holding 	that 	a 	“wrongful
dissemination of Plaintiff’s confidential information would not be recognized as the
tort of intrusion”).
26. 	Plaintiffs’ reliance on Toomer v. Garrett, 155 N.C. App. 462 (2002), is
misplaced. There, the Court of Appeals allowed an intrusion claim to proceed based
on allegations that the defendants engaged in an “unauthorized examination” of the
plaintiff’s personnel file and then disclosed that file to other “unauthorized persons.”
See id. at 467, 480. 	Missing here is any allegation of unauthorized examination by
WakeMed. 	Absent that, the claim fails. 	See, e.g., Alexander v. City of Greensboro,
762 F. Supp. 2d 764, 815–16 (M.D.N.C. 2011) (observing that Toomer “focused its
intrusion 	discussion 	on 	the 	‘unauthorized 	examination’ ” 	of 	information 	by
defendants “rather than on the later public disclosure of those contents” (quoting
Toomer, 155 N.C. App. at 480)); Sabrowski, 2003 U.S. Dist. LEXIS 23242, at *38
(observing that the defendants in Toomer and another case “intruded into the
plaintiffs’ privacy by improperly accessing the plaintiffs’ medical and employment

records”); Allen v. Novant Health, Inc., 2023 U.S. Dist. LEXIS 149692, at *4–5
(M.D.N.C. Aug. 23, 2023) (applying North Carolina law and dismissing invasion of
privacy claim brought against another hospital system for its use of the Meta Pixel
“[b]ecause the plaintiffs acknowledge in the complaint that they voluntarily provided
their information directly to Novant”).
27. 	The Court grants the motion to dismiss the claim for invasion of privacy.
C. Breach of Implied Contract
28. 	An implied contract “arises where the intent of the parties is not expressed,
but an agreement in fact, creating an obligation, is implied or presumed from their
acts.” 	Creech v. Melnik, 347 N.C. 520, 526 (1998). 	As the Court of Appeals has put
it, “[o]ur system of notice pleading means the bar to plead a valid contract is low.”
Lannan v. Bd. of Governors of the Univ. of N.C., 285 N.C. App. 574, 596 (2022)
(citation and quotation marks omitted). 	All that Plaintiffs must plead are the
elements required for any valid contract—“offer, acceptance, and consideration.” Id.
at 597.
29. 	The complaint adequately alleges each element. 	As alleged, WakeMed
“offered health services to Plaintiffs,” who “accepted . . . and paid for those services.”
(2d Am. Compl. ¶ 158.) Plaintiffs also provided their personal information; in return,
WakeMed “agreed to safeguard and protect such information and to timely and
accurately notify Plaintiffs . . . if their information was compromised and or accessed
without authorization.” (2d Am. Compl. ¶ 161.) These allegations, taken as true, are
sufficient to plead the existence of an implied contract.

30. 	WakeMed’s contrary argument rests on a cramped reading of the complaint.
It points to paragraph 159, which refers to “promises” in WakeMed’s “Privacy Policy.”
(2d Am. Compl. ¶ 159.) That policy, according to WakeMed, did not exist until after
the Meta Pixel had been removed from the patient portal, meaning that Plaintiffs
could not have read or relied upon any promises within it before providing their
personal information. As a result, WakeMed contends, there was no meeting of the
minds and no valid contract. 	But this ignores other allegations that WakeMed
adopted a privacy policy before the Pixel incident with similar promises to keep
patient information confidential. (See 2d Am. Compl. ¶¶ 18–24.) And in any event,
whether there was a meeting of the minds is a fact issue for discovery. 	“[I]t will be
for the trier of fact to determine on what terms there was a meeting of the minds and
thus what terms are included in the alleged contract on which Plaintiffs will
ultimately need to demonstrate breach to prevail.” 	Lannan, 285 N.C. App. at 598
(affirming denial of motion to dismiss).
31. 	At this point, Plaintiffs need only give notice of their claim and the basis for
it, which they have done. Thus, the Court denies WakeMed’s motion with respect to
Plaintiffs’ claim for breach of implied contract.
D. Unjust Enrichment
32. 	“The doctrine of unjust enrichment was devised by equity to exact the return
of, or payment for, benefits received under circumstances where it would be unfair
for the recipient to retain them without the contributor being repaid or compensated.”
Snow Enter., LLC v. Bankers Ins. Co., 282 N.C. App. 132, 146 (2022) (quoting Collins

v. Davis, 68 N.C. App. 588, 591 (1984)). 	North Carolina case law “typically
contemplates unjust enrichment as an appropriate remedy only in situations where
the complaining party intentionally and deliberately undertook an action with an
expectation of compensation or other benefit in return.” 	Butler v. Butler, 239 N.C.
App. 1, 12 (2015).
33. 	Plaintiffs’ allegations fall short. 	They allege that they provided personal
information (and paid money) to WakeMed in exchange for medical services. (See 2d
Am. Compl. ¶¶ 39, 173.) 	But they do not allege that they expected to receive any
other compensation or benefit, apart from medical services, in return for their
personal information. 	Taking their allegations as true, Plaintiffs either had no
expectation of compensation or received all the compensation that they expected in
the form of medical services. 	See Twiford v. Waterfield, 240 N.C. 582, 585 (1954)
(requiring a “mutual understanding” that “payment was intended on the one hand
and expected on the other”); Allen, 2023 U.S. Dist. LEXIS 149692, at *7–8 (dismissing
unjust enrichment claim based on defendant hospital’s use of the Meta Pixel because
“[t]here is no allegation the plaintiffs did not receive the medical care they expected
in return”).
34. 	In their opposition brief, Plaintiffs argue that they conferred the “marketing
value of their data,” which WakeMed used to enrich itself “with advertising and
marketing services” from Meta. (Opp’n 13, ECF No. 61.) This appears to be a novel
theory; nothing in the complaint treats the marketing value of Plaintiffs’ personal
information as something distinct from the information itself. Regardless, Plaintiffs

have not pointed to any allegations that they intentionally conferred the marketing
value of their data on WakeMed or that they expected compensation for it. And “the
mere fact that one party was enriched, even at the expense of the other, does not
bring the doctrine of unjust enrichment into play.” 	Watson Elec. Constr. Co. v.
Summit Cos., LLC, 160 N.C. App. 647, 652 (2003).
35. 	The Court dismisses Plaintiffs’ claim for unjust enrichment.
E. Section 75-1.1
36. 	Plaintiffs claim that WakeMed’s disclosure of its patients’ information to
Meta violated section 75-1.1. 	WakeMed argues that its alleged misconduct, even if
true, falls outside the statute’s bounds.
37. 	Section 75-1.1 proscribes “unfair or deceptive acts or practices in or affecting
commerce.” 	N.C.G.S. § 75-1.1(a). 	Commerce, though broadly defined, excludes
“professional services rendered by a member of a learned profession.” 	N.C.G.S.
§ 75-1.1(b). 	This statutory exemption, which “for medical professionals has been
broadly interpreted,” 	requires 	a 	two-part 	inquiry: 	“First, 	the 	person 	or entity
performing the alleged act must be a member of a learned profession. 	Second, the
conduct in question must be a rendering of professional services.” Sykes, 372 N.C. at
334; accord Wheeless v. Maria Parham Med. Ctr., Inc., 237 N.C. App. 584, 589 (2014).
38. 	That two-part inquiry is easily satisfied here. WakeMed, a hospital system,
is undoubtedly a member of a learned profession. 	See, e.g., Shelton v. Duke Univ.
Health Sys., Inc., 179 N.C. App. 120, 126 (2006).

39. 	And WakeMed’s alleged conduct is a rendering of professional services
because its collection, use, and storage of patients’ personal and health information
is entwined with its provision of professional services. The complaint bears this out.
The 	data 	that 	WakeMed 	collects—about 	medical 	conditions, 	treatments,
prescriptions, appointments, insurance coverage, and more—go directly to patient
care and the relationship between patient and provider. 	(See 2d Am. Compl. ¶¶ 2,
17.) In Plaintiffs’ own words, this information “is used to facilitate both payment and
the provision of services.” (2d Am. Compl. ¶ 173.) Indeed, each Plaintiff shared his
or her personal information “as a condition of receiving [WakeMed’s] healthcare
services.” (2d Am. Compl. ¶¶ 36, 81, 92, 99.)
40. 	Numerous cases have applied the learned profession exemption in similar
circumstances and to conduct less closely tied to patient care. 	See, e.g., Sykes, 372
N.C. at 336 (concluding that exemption applied to intermediary that “terminate[d]
providers’ in-network access to patients when those providers exceed[ed] a certain
average cost per patient”); Wheeless, 237 N.C. App. at 590–91 (concluding that
exemption applied to submission of a complaint about the plaintiff to the North
Carolina Medical Board); McNew v. Fletcher Hosp., Inc., 2022 NCBC LEXIS 109, at
*17–18 (N.C. Super. Ct. Sept. 20, 2022) (concluding that exemption applied to a
hospital’s alleged “overbilling without disclosing its actual rates to Plaintiff at the
time of treatment”).
41. 	The Court grants WakeMed’s motion to dismiss the section 75-1.1 claim.

F. Breach of Fiduciary Duty
42. 	To plead a claim for breach of fiduciary duty, Plaintiffs must allege the
existence of a duty, a breach of that duty, and an injury proximately caused by the
breach. See Sykes, 372 N.C. at 339. The relationship between “physician and patient”
is, of course, “inherently fiduciary.” King v. Bryant, 369 N.C. 451, 464 (2017). Even
so, WakeMed argues that whatever duties it owed to Plaintiffs were limited to
diagnosis and treatment and had no bearing on its alleged unauthorized disclosure
of confidential information.
43. 	The Court disagrees. Yes, physicians owe their patients a duty of care when
making diagnoses and prescribing treatment. They also owe a duty of confidentiality.
The law recognizes that the relationship between physician and patient is fiduciary
in nature both because the physician possesses special knowledge and skill and
because of “the high level of personal trust and confidence undergirding the patient’s
decision to disclose sensitive, confidential medical information to the physician and
rely on that physician’s treatment advice.” McNew, 2022 NCBC LEXIS 109, at *7–8.
Thus, “a patient may legitimately expect that confidential information will not be
disclosed to the general public or to hospital personnel unconcerned with his
treatment . . . .” Smith v. State, 298 N.C. 115, 132 (1979). That expectation of privacy
could be lost, however, if “the patient breaks the fiduciary relationship with the
physician by revealing, or permitting revelation of, the substance of the information

transmitted to the physician.” Cates v. Wilson, 321 N.C. 1, 15 (1987); accord Jones v.
Asheville Radiological Grp., P.A., 129 N.C. App. 449, 459 (1998).2
44. 	WakeMed insists that one party’s decision to share confidential information
with another does not create a fiduciary relationship. That is true as far as it goes.
Here, though, Plaintiffs have alleged that they shared confidential information with
WakeMed in the context of a physician–patient relationship and for the purpose of
receiving medical care. (See, e.g., 2d Am. Compl. ¶¶ 81, 92, 99, 188.) That is enough
to plead the existence of a fiduciary relationship. And the allegation that WakeMed
disclosed confidential information without authorization is enough to plead a breach.
See 	King, 	369 	N.C. 	at 	466 	(holding 	that 	a 	patient’s 	provision 	of 	confidential
information supported the existence of a de facto fiduciary duty before creation of
physician–patient relationship); Watts v. Cumberland Cnty. Hosp. Sys., Inc., 75 N.C.
App. 1, 9–12 (1985) (reversing order granting summary judgment on claim for breach
2 Courts in other jurisdictions agree that a healthcare provider has a fiduciary duty of
confidentiality whose breach can give rise to a claim for damages in tort. See, e.g., Sorensen
v. Barbuto, 177 P.3d 614, 618 (Utah 2008) (“Utah law recognizes a healthcare fiduciary duty
of confidentiality.”); Fairfax Hosp. v. Curtis, 254 Va. 437, 442 (1997) (“[A] health care provider
owes a duty to the patient not to disclose information gained from the patient during the
course of treatment without the patient’s authorization, and . . . violation of this duty gives
rise to an action in tort.”); Alberts v. Devine, 395 Mass. 59, 69 (1985) (“We hold today that a
duty of confidentiality arises from the physician-patient relationship and that a violation of
that duty, resulting in damages, gives rise to a cause of action sounding in tort against the
physician.”); Vassiliades v. Garfinckel’s, Brooks Bros., Miller & Rhoades, Inc., 492 A.2d 580,
591–92 (D.C. 1985) (recognizing an independent cause of action for breach of confidentiality,
partially due to the fiduciary relationship between physician and patient); Horne v. Patton,
291 Ala. 701, 708–09 (1973) (“[A] medical doctor is under a general duty not to make extra-
judicial disclosures of information acquired in the course of the doctor-patient relationship
. . . .”); Hammonds v. Aetna Cas. & Sur. Co., 243 F. Supp. 793, 801–02 (N.D. Ohio 1965)
(holding that a similar duty exists under Ohio law and characterizing the duty as fiduciary);
but see Quarles v. Sutherland, 215 Tenn. 651, 657 (1965) (refusing to recognize a cause of
action for a physician’s disclosure of a patient’s confidential information to a third person).

of fiduciary duty and reasoning that “a health care provider may be liable for medical
malpractice based in part upon the provider’s breach of a duty to maintain the
patient’s trust and confidence”), rev’d in part on other grounds, 317 N.C. 321 (1986);
Allen, 2023 U.S. Dist. LEXIS 149692, at *14–15 (denying motion to dismiss patients’
breach of fiduciary duty claim based on hospital system’s use of the Meta Pixel).
45. 	The Court denies WakeMed’s motion to dismiss Plaintiffs’ claim for breach
of fiduciary duty.
IV.
CONCLUSION
46. 	For the foregoing reasons, the Court GRANTS in part and DENIES in
part WakeMed’s motion to dismiss as follows:
a. 	The Court GRANTS the motion with respect to Plaintiffs’ claims for
negligence per se, invasion of privacy, unjust enrichment, violation of
section 	75-1.1, 	and 	violation 	of 	the 	North 	Carolina 	Electronic
Surveillance Act. These claims are DISMISSED with prejudice.
b. 	The Court DENIES the motion with respect to Plaintiffs’ claims for
common-law negligence, breach of implied contract, and breach of
fiduciary duty.
SO ORDERED, this the 4th day of December, 2023.
/s/ Adam M. Conrad
Adam M. Conrad
Special Superior Court Judge
for Complex Business Cases