Doe v. Baystate Health System, Inc.

UNITED STATES DISTRICT COURT
DISTRICT OF MASSACHUSETTS
)
JANE DOE, individually and on behalf of 	)
all others similarly situated, 	)
)
Plaintiff, 	)
)
v. 	) 	No. 1:25-cv-10337-JEK
)
BAYSTATE HEALTH SYSTEM, INC., 	)
)
Defendant. 	)
)
MEMORANDUM AND ORDER ON DEFENDANT’S MOTION TO DISMISS
KOBICK, J.
Plaintiff Jane Doe brings this putative class action lawsuit against defendant Baystate
Health System, Inc. for improperly disclosing her private medical information, and other patients’
private medical information, without their consent. The amended complaint alleges that Baystate
installed technology on its public website to intercept its patients’ communications and, without
authorization, transmit confidential information from those communications to Meta Platforms,
Inc. and Google. Doe claims that, using this technology, Baystate shared confidential medical
information about her status as a patient at Baystate, her search for breast cancer screenings and
providers, and her scheduling of a mammogram with Meta and Google. Pending before the Court
is Baystate’s motion to dismiss for failure to state a claim. That motion will be denied because, for
the 	reasons 	that 	follow, 	Doe 	states 	plausible 	claims 	for 	a 	violation 	of 	the 	Electronic
Communications Privacy Act, 18 U.S.C. § 2510 et seq., invasion of privacy, breach of implied
contract, and breach of fiduciary duty.
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 1 of 17

2
BACKGROUND
The following facts, drawn from the amended complaint, are accepted as true for purposes
of Baystate’s motion to dismiss. Thornton v. Ipsen Biopharmaceuticals, Inc., 126 F.4th 76, 78 (1st
Cir. 2025); see ECF 1-1, at 42-84 (“Complaint”).
Baystate is an independent academic medical center and a major referral hospital in
Massachusetts. Complaint ¶ 7. It maintains a website at www.baystatehealth.org. Id. ¶¶ 1, 18. This
website permits people “to research doctors and request to schedule appointments with doctors,
register for support groups, research health conditions and learn about related services” offered by
Baystate, “and sign in to a personal patient portal called MyBaystate.” Id. ¶ 18. The website also
includes search bars where people can look for information about, among other topics, medical
conditions, medical procedures, and doctors’ names and areas of expertise. Id. At the bottom of
Baystate’s public website are hyperlinks to its Notice of Privacy Practices and its Privacy Policy.
Id. ¶¶ 22-23. Until May 15, 2023, Baystate’s Privacy Policy stated that when its website asks
patients “to provide identifiable information,” that information would “only be used to support
[the] customer/patient relationship with” Baystate. Id. ¶¶ 2, 23 (quotation marks and emphases
omitted). The Privacy Policy further stated that patients’ personal information would be disclosed
only if “required by law” or with “specific written consent.” Id. ¶ 23 (quotation marks and
emphases omitted). Baystate represented in its Privacy Policy and Notice of Privacy Practices that
it was “committed to maintaining the privacy of” personal medical information. Id. ¶¶ 2, 24
(quotation marks and emphasis omitted); see also id. ¶ 23.
Despite these assurances of confidentiality, Baystate allegedly chose to share the content
of its patients’ communications with Meta and Google, without patient consent, by intentionally
installing tracking technology on its website. Id. ¶ 29. Baystate started using Meta Pixel on its
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 2 of 17

3
website in January 2021. Id. ¶ 31. This technology “tracks users as they navigate the web, logging
which pages they visit, which buttons they click, and certain information they enter into forms or
search requests.” Id. ¶ 30. Also in January 2021, Baystate installed Google Analytics, which
similarly “track[s] visitor actions” and “send[s] the contents of patients’ communications with the
Baystate Website . . . to Google.” Id. ¶¶ 52-54. Through its use of Meta Pixel and Google Analytics,
Baystate disclosed to Meta and Google information about its patients’ communications, including
their searches for medical information about conditions or procedures, the identities of their
physicians, their requests to schedule appointments with physicians, and their registrations for
support groups. Id. ¶ 4. These disclosures were made without patients’ knowledge or consent. Id.
Doe has been a patient of Baystate for over ten years and visited its website “numerous
times.” Id. ¶¶ 8, 96. Within the past few years, she has entered communications on Baystate’s
public website to obtain information related to breast cancer screenings, schedule a mammogram,
log in to the MyBaystate patient portal, and search for medical providers. Id. ¶ 97. Baystate
allegedly disclosed to Meta and Google information about Doe’s medical treatments; her status as
a Baystate patient; her Facebook ID, which “is specific to [her as] a person”; and “other unique
identifiers.” Id. ¶¶ 40, 98, 103, 151-52. Using Meta’s Off Facebook Activity Report tool, Doe
determined that Baystate disclosed approximately eighty of her communications on its website to
Meta between November 19, 2021 and April 10, 2023. Id. ¶ 99. She has also confirmed that
cookies from Facebook and Google were on her device that accessed Baystate’s website. Id.
¶¶ 100-02.
Doe initiated this action in the Business Litigation Session of Suffolk Superior Court in
August 2023. ECF 14, at 3. That court permitted her to proceed by pseudonym in September 2023.
Id. at 47-49. After the Supreme Judicial Court’s decision in Vita v. New England Baptist Hospital,
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 3 of 17

4
494 Mass. 824 (2024), Doe filed an amended complaint in January 2025 to add a federal claim. Id.
at 4, 119-20; ECF 1, ¶ 2. Baystate then removed the case to this Court in February 2025. ECF 1.
The operative complaint asserts claims for a violation of the Electronic Communications Privacy
Act, 18 U.S.C. § 2510 et seq. (Count I); invasion of privacy in violation of M.G.L. c. 214, § 1B
(Count II); breach of implied contract (Count III); and breach of fiduciary duty (Count IV).
Complaint ¶¶ 122-73. Doe seeks to represent a class of Baystate patients who have similarly
exchanged communications containing their private health information on Baystate’s website
within the statute of limitations. Id. ¶¶ 110-21.
Baystate moved to dismiss the amended complaint for failure to state a claim. ECF 25.
After Doe opposed that motion and Baystate filed its reply brief, the Court held a hearing and took
the motion under advisement. ECF 30, 33, 39.
STANDARD OF REVIEW
In evaluating a motion to dismiss under Federal Rule of Civil Procedure 12(b)(6), the Court
must determine “whether, construing the well-pleaded facts of the complaint in the light most
favorable to the plaintif[f], the complaint states a claim for which relief can be granted.” Cortés-
Ramos v. Martin-Morales, 956 F.3d 36, 41 (1st Cir. 2020) (quotation marks omitted). The
complaint must allege “a plausible entitlement to relief.” Bell Atl. Corp. v. Twombly, 550 U.S. 544,
559 (2007). “A claim has facial plausibility when the plaintiff pleads factual content that allows
the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.”
Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). “While legal conclusions can provide the framework
of a complaint, they must be supported by factual allegations.” Id. at 679.
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 4 of 17

5
DISCUSSION
I. 	Invasion of Privacy.
The Court begins with Count II, which asserts that Baystate violated Doe’s privacy rights
under M.G.L. c. 214, § 1B by unreasonably disclosing information about her medical treatment to
Meta and Google without her knowledge or informed consent. Complaint ¶ 151. Section 1B
prohibits interferences with privacy that are “unreasonable, substantial or serious.” M.G.L. c. 214,
§ 1B. To sustain a Section 1B claim, Doe must plausibly allege an invasion of her privacy that is
“‘both unreasonable and substantial or serious.’” Ortiz v. Examworks, Inc., 470 Mass. 784, 793
(2015) (quoting Nelson v. Salem State Coll., 446 Mass. 525, 536 (2006)). This standard is met
when the disclosure involves “‘facts about an individual that are of a highly personal or intimate
nature when there exists no legitimate countervailing interest.’” Ayash v. Dana-Farber Cancer
Inst., 443 Mass. 367, 383 (2005) (quoting Bratt v. Int’l Bus. Machines Corp., 392 Mass. 508, 518
(1984)). In certain situations, however, “legitimate countervailing business interests . . . may render
the disclosure of personal information reasonable and not actionable under the statute.” Bratt, 392
Mass. at 520. “Generally, whether an intrusion qualifies as unreasonable, as well as either
substantial or serious, presents a question of fact.” Polay v. McMahon, 468 Mass. 379, 383 (2014).
Baystate contends that the information it allegedly shared with Meta and Google was not
a substantial or serious invasion of privacy because the information was not of a highly personal
or intimate nature. Doe alleges that she has been a patient at Baystate for over ten years and
“regularly exchanged communications” on its website, including inquiries “to obtain information
related to breast cancer screenings and schedule a mammogram, to log in to the MyBaystate patient
portal, and to search for providers.” Complaint ¶¶ 96-97. This Court and the Superior Court have
declined to dismiss Section 1B claims premised on comparable invasions of privacy. See Doe v.
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 5 of 17

6
Tenet Healthcare Corp., 731 F. Supp. 3d 142, 151-52 (D. Mass. 2024) (denying motion to dismiss
such a claim because “the health information that was allegedly disclosed to Facebook (e.g.,
Plaintiff’s identity, patient status, request for medical treatment, health conditions and treatments,
and appointment time and location) constitutes information of a ‘highly personal or intimate
nature’”); Doe v. Emerson Hosp., No. 2277-cv-1000, 2023 WL 8869624, at *5 (Mass. Super. Nov.
22, 2023) (same where defendant allegedly disclosed “information about Plaintiff’s status as [its]
patient” and “about treating doctors, potential doctors, conditions, treatments, appointments,
search terms, [and] bill payment”); Doe v. Boston Med. Ctr. Corp., No. 2384-cv-326-BLS-1, 2023
WL 7105628, at *5 (Mass. Super. Sep. 14, 2023) (same where plaintiff “alleged disclosure of
personal and healthcare-related information over multiple website visits for the sole purpose of
targeted advertising efforts”). The Supreme Judicial Court, too, has held that disclosure of
information about medical treatment to third parties, without the consent of the patient, is the sort
of substantial and serious invasion of privacy prohibited by Section 1B. See Tower v. Hirschhorn,
397 Mass. 581, 586-87 (1986); Bratt, 392 Mass. at 522-24. Based on this precedent, Doe’s
communications about cancer screenings and medical providers, her status as a patient, and her
scheduling of a mammogram constitute medical information of a highly intimate or personal nature
under Section 1B.
Citing Doe’s allegation that Baystate “chose to install the tracking technology on [its]
Website for marketing and/or analytics purposes,” Complaint ¶ 85, Baystate next argues that it had
a legitimate interest in disclosing Doe’s confidential medical information to Google and Meta. But
under Massachusetts law, whether marketing and business analytics are legitimate purposes that
outweigh intrusions on Doe’s privacy interests is “a question of fact not suitable for resolution on
a motion to dismiss.” Polay, 468 Mass. at 384; see Bratt, 392 Mass. at 523 (physicians may
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 6 of 17

7
disclose a patient’s confidential medical information “to a person with a legitimate interest in the
patient’s health” only under “compelling circumstances” (quotation marks omitted)). Doe has
therefore adequately alleged an invasion of privacy claim under Section 1B.
II. 	Electronic Communications Privacy Act.
Count I asserts that Baystate violated the Electronic Communications Privacy Act
(“ECPA”), 18 U.S.C. § 2510 et seq., through its unauthorized disclosures of Doe’s confidential
medical information from her communications on its website. The ECPA “provides a private right
of action against one who ‘intentionally intercepts, endeavors to intercept, or procures any other
person to intercept or endeavor to intercept, any wire, oral, or electronic communication.’” In re
Pharmatrak, Inc., 329 F.3d 9, 18 (1st Cir. 2003) (quoting 18 U.S.C. § 2511(1)(a) and citing 18
U.S.C. § 2520). Under the statute, “intercept” is defined as “the aural or other acquisition of the
contents of any wire, electronic, or oral communication through the use of any electronic,
mechanical, or other device.” 18 U.S.C. § 2510(4). To state a claim under the ECPA, Doe must
allege that Baystate “(1) intentionally (2) intercepted, endeavored to intercept or procured another
person to intercept or endeavor to intercept (3) the contents of (4) an electronic communication
(5) using a device,” In re Pharmatrak, 329 F.3d at 18, and (6) that the communication was
“intercepted contemporaneously,” Boudreau v. Lussier, 901 F.3d 65, 78 (1st Cir. 2018).
Under the ECPA, it is not unlawful for a person “to intercept a . . . communication where
such person is a party to the communication.” 18 U.S.C. § 2511(2)(d). All agree that Baystate was
a party to the communications at issue in this case. But this one-party consent rule has an exception,
known as the crime-tort exception, which applies when communications are “intercepted for the
purpose of committing any criminal or tortious act in violation of the Constitution or laws of the
United States or of any State.” Id. Doe relies on this exception in seeking to hold Baystate liable
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 7 of 17

8
under the ECPA. The parties agree that, to invoke the crime-tort exception, Doe “must plead
sufficient facts to support an inference that [Baystate] intercepted the communication for the
purpose of a tortious or criminal act that is independent of the intentional act of recording.” Caro
v. Weintraub, 618 F.3d 94, 100 (2d Cir. 2010); accord Planned Parenthood Fed’n of Am., Inc. v.
Newman, 51 F.4th 1125, 1135-36 (9th Cir. 2022); Fisher v. Perron, 30 F.4th 289, 298-300 (6th
Cir. 2022); In re Google Inc. Cookie Placement Consumer Privacy Litig., 806 F.3d 125, 145 (3d
Cir. 2015); see ECF 26, at 7; ECF 30, at 8-13.
Doe plausibly alleges that Baystate intentionally intercepted her communications on its
website for the purpose of committing a tortious act in violation of M.G.L. c. 214, § 1B. According
to the amended complaint, Baystate, through its Privacy Policy, affirmatively misled Doe by
promising that any “identifiable information” she submitted would “only be used to support [her]
customer/patient relationship with” it and would be disclosed only if “required by law” or with
“specific written consent.” Complaint ¶¶ 2, 23 (quotation marks and emphases omitted); see id.
¶¶ 3, 85, 139. Despite these assurances of privacy, Baystate allegedly transmitted her confidential
information—including her Facebook ID and information about her patient status, her search for
breast cancer screenings and providers, and her scheduling of a mammogram—to Meta and
Google without her authorization. Id. ¶¶ 96-98, 103, 136-40. Doe’s theory is that Baystate decided,
based on a cost-benefit analysis, not to tell patients the truth in its Privacy Policy and Notice of
Privacy Practices in order to encourage them to submit their private health information, which, in
turn, it disclosed to third parties for commercial gain. At this early juncture, these allegations are
sufficient to support the plausible inference that Baystate intercepted Doe’s communications on
its website “‘for the purpose of facilitating some further impropriety’”—namely, violating Section
1B by disclosing Doe’s private health information without her consent. Planned Parenthood, 51
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 8 of 17

9
F.4th at 1135-36 (quoting Sussman v. Am. Broad. Companies, Inc., 186 F.3d 1200, 1202 (9th Cir.
1999)); accord Meredith v. Gavin, 446 F.2d 794, 799 (8th Cir. 1971).1
The amended complaint’s allegations that Baystate installed the tracking technologies from
Meta and Google on its website “for marketing and/or analytics purposes” as well as “for financial
gain” do not change this conclusion. Complaint ¶¶ 85, 139. That is so because “the existence of a
lawful purpose does not mean that the interception is not also for a tortious or unlawful purpose.”
Sussman, 186 F.3d at 1202; see Doe v. Lawrence Gen. Hosp., No. 25-cv-10081-NMG, 2025 WL
2808055, at *20 (D. Mass. Aug. 29, 2025) (“The broad theory that the presence of a primary
financial motive inoculates a defendant from liability under the ECPA is wrong.” (quotation marks
omitted)), report and recommendation adopted in part, rejected in part, 2025 WL 2807673
(D. Mass. Sept. 30, 2025); McManus v. Tufts Med. Ctr., Inc., No. 25-cv-10008-ADB, 2025 WL
2778025, at *3 n.1 (D. Mass. Sept. 29, 2025) (“the defendant’s alleged financial motivation does
not necessarily defeat the application of the crime-tort exception”). A party seeking to invoke the
crime-tort exception must show “either (1) that the primary motivation, or (2) that a determinative
factor in the actor’s motivation for intercepting the conversation was to commit a criminal,
tortious, or other injurious act.” United States v. Cassiere, 4 F.3d 1006, 1021 (1st Cir. 1993)
(quotation marks omitted). Whether Baystate was primarily or determinatively motivated to
intercept and share Doe’s communications with Meta and Google for a lawful purpose (marketing,
analytics, and financial gain), an unlawful purpose (violating M.G.L. c. 214, § 1B), or both is a
question of fact not fit for resolution at the pleading stage. See id. Viewed in the light most
1 In light of the alleged violation of M.G.L. c. 214, § 1B, the Court need not consider whether
Baystate also acted with the intent to violate the Health Insurance Portability and Accountability
Act of 1996 (“HIPAA”) or the Federal Trade Commission Act. See Complaint ¶ 134.
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 9 of 17

10
favorable to Doe, the amended complaint sufficiently alleges that Baystate acted with the purpose
of committing a tortious act in violation of Section 1B.
Doe also adequately alleges that Baystate’s tortious purpose was separate and independent
from the act of the recording. See Caro, 618 F.3d at 100-01 (the crime-tort exception “requires
that the interceptor intend to commit a crime or tort independent of the act of recording itself,” in
part because the ECPA’s “language and history . . . indicate that Congress authored the exception
. . . to prevent abuses stemming from use of the recording not the mere act of recording”).2 Certain
courts have held that the common law privacy claim of intrusion upon seclusion cannot satisfy the
ECPA’s tortious intent requirement because “‘it is a tort that occurs through the act of interception
itself.’” In re Google, 806 F.3d at 145 (quoting Caro, 618 F.3d at 101); see In re Nickelodeon
Consumer Priv. Litig., 827 F.3d 262, 276 (3d Cir. 2016) (applying the “reasoning in Google” to
affirm dismissal of an ECPA claim alleging “that the defendants’ use of cookies amounted to the
common law tort of intrusion upon seclusion”); Weston v. Lefiti, No. 24-541, 2024 WL 4579237,
at *2 (9th Cir. Oct. 25, 2024) (affirming dismissal of ECPA claim where plaintiff’s “invasion of
privacy . . . argumen[t] stem[med] from the mere act of recording”). Other invasion of privacy
claims, however, may satisfy this exception, as they require “the tortfeasor . . . to take an
affirmative step or steps beyond the recording” itself. Caro, 618 F.3d at 101 (applying Connecticut
law); see Phillips v. Bell, 365 F. App’x 133, 142 (10th Cir. 2010) (reversing denial of motion to
dismiss ECPA claim where there were “no additional factual allegations to support [plaintiff’s]
contention” that recordings of her conversations were made “to invade her privacy”).
2 While the First Circuit has not adopted this test, other sessions of this Court have employed
it. See Goulart v. Cape Cod Healthcare, Inc., No. 25-cv-10445-RGS, 2025 WL 1745732, at *3 &
*4 n.3 (D. Mass. June 24, 2025); Lawrence Gen. Hosp., 2025 WL 2808055, at *12-14.
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 10 of 17

11
Here, the amended complaint alleges that Baystate acted with the purpose of violating
M.G.L. c. 214, § 1B when it intercepted Doe’s communications containing confidential medical
information. Complaint ¶ 134. This alleged violation of Section 1B did not “‘occu[r] through the
act of interception,’” but rather through Baystate’s “use of the acquired internet” communications
from Doe that it disclosed to Meta and Google. In re Google, 806 F.3d at 145 (quoting Caro, 618
F.3d at 101). Unlike a claim for intrusion upon seclusion, Doe’s invasion of privacy claim is
premised on Baystate’s intent to disclose confidential medical information to Meta and Google
without her consent, not merely its intent to intercept her communications. Tower, 397 Mass. at
586-87. Put otherwise, Baystate’s alleged intent to intercept Doe’s communications was, as
alleged, independent of its plan to disclose those communications to third parties. See Caro, 618
F.3d at 100 (if “the offender plans to use the recording to harm the other party to the conversation,
a civil cause of action exists” under the ECPA); R.S. v. Prime Healthcare Servs., Inc., No. 24-cv-
330-ODW-SPX, 2025 WL 103488, at *6 (C.D. Cal. Jan. 13, 2025) (“[T]he intent to disclose
private information . . . is distinct from the interception itself.”). Since Doe’s factual allegations
support the plausible inference that Baystate intercepted her communications for the purpose of
committing a tortious act separate from the interception itself, the crime-tort exception under 18
U.S.C. § 2511(2)(d) applies.
Beyond the crime-tort exception, Baystate contends that its alleged disclosures to Google
and Meta do not qualify as “contents” under the ECPA. The statute defines “contents” as “any
information concerning the substance, purport, or meaning of that communication.” 18 U.S.C.
§ 2510(8). This broad “definition encompasses personally identifiable information such as a
party’s name, date of birth, and medical condition.” In re Pharmatrak, 329 F.3d at 18. Congress
explained that “‘the communication to be protected [was] intended to be comprehensive’” and
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 11 of 17

12
cover “‘the identity of the parties, the substance of the communication between them, [and] the
fact of the communication itself.’” Gelbard v. United States, 408 U.S. 41, 51 n.10 (1972) (citation
omitted). In Baystate’s telling, Doe fails to allege that it disclosed any of her confidential
information because merely browsing on its public website “cannot identify an individual or the
individual’s” private health information. Am. Hosp. Ass’n v. Becerra, 738 F. Supp. 3d 780, 802-
03 (N.D. Tex. 2024). This position ignores Doe’s factual allegations, which describe her specific
information that Baystate allegedly disclosed. See Complaint ¶¶ 96-98; Nienaber v. Overlake
Hosp. Med. Ctr., No. 23-cv-1159-TL, 2025 WL 692097, at *5-6 (W.D. Wash. Mar. 4, 2025)
(distinguishing Becerra where plaintiff alleged that she “sought and received medical treatment
from Defendant,” which disclosed her “specific identity through her Facebook ID”).
Doe alleges that Baystate disclosed to Meta and Google, among other things, its patients’
“searches for medical information about conditions and procedures, the identities of their
physicians, their requests to schedule appointments with physicians, registrations for support
groups, [and] patients’ request to log in to the patient portal.” Complaint ¶ 4. Baystate also
allegedly disclosed Doe’s “Facebook ID . . . and other unique identifiers,” as well as her searches
regarding breast cancer screenings and providers, her scheduling of a mammogram, and her status
as a patient. Id. ¶¶ 96-97, 103, 152. These factual allegations are sufficient to treat Doe’s
intercepted private health information and personal identifiers as “contents” for purposes of the
ECPA. See Cousin v. Sharp Healthcare, 702 F. Supp. 3d 967, 976 (S.D. Cal. 2023) (“Plaintiffs
allege that their data included personal search queries—such as specialty healthcare providers and
treatments for medical conditions—and therefore plausibly conveyed content: their [protected
health information].”). Accordingly, Doe’s ECPA claim will not be dismissed.
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 12 of 17

13
III. 	Breach of Implied Contract.
Count III asserts a claim for breach of implied contract against Baystate. “In the absence
of an express agreement, an implied contract may be inferred from (1) the conduct of the parties
and (2) the relationship of the parties.” T.F. v. B.L., 442 Mass. 522, 526-27 (2004). An implied
contract “‘is an obligation created by law for reasons of justice, without any expression of assent
and sometimes even against a clear expression of dissent.’” Metro. Life Ins. Co. v. Cotter, 464
Mass. 623, 643 (2013) (quoting Salamon v. Terra, 394 Mass. 857, 859 (1985)). Because the theory
of an implied contract involves “a legal obligation closely akin to a duty to make restitution,”
considerations “of equity and morality play a large part” in determining whether such a contract
exists. Salamon, 394 Mass. at 859 (quotation marks omitted).
Doe plausibly alleges that Baystate breached an implied contract between them by
disclosing her confidential medical information to Meta and Google. According to the amended
complaint, Doe chose to pay Baystate for medical care as a patient and, as part of that service,
entered her private information into its website. Complaint ¶¶ 156-58. In exchange for her
submission of private information, Baystate agreed not to disclose that information to third parties
without her consent. Id. Doe “reasonably believed and expected” that Baystate would not share
her health information because it promised that it would not do so. Id. ¶ 159. In particular,
Baystate’s Privacy Policy assured patients that “identifiable information” would be disclosed only
with their “specific written consent” or if “required by law,” and would “only be used to support
[the] customer/patient relationship.” Id. ¶¶ 3, 23 (quotation marks and emphases omitted). Baystate
allegedly breached this implied contract by disclosing Doe’s confidential information to Meta and
Google “and using it for non-medical purposes, i.e., to obtain enhanced marketing and analytical
services.” Id. ¶¶ 162-63. And, finally, Doe alleges that Baystate “derived benefit” from that
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 13 of 17

14
“valuable information” by “obtain[ing] enhanced advertising and analytics services from Meta and
Google” “without sharing the benefits with” Doe. Id. ¶ 163. These allegations are sufficient to state
a plausible claim for breach of an implied contract. See Tenet Healthcare, 731 F. Supp. 3d at 150
(denying motion to dismiss breach of implied contract claim alleging that the defendant “breached
its implied contractual obligations by using third-party trackers on its Website” where “Plaintiff
paid [defendant] for healthcare services with the understanding that [it] would maintain [her]
Private Information confidentially, as expected in a physician-patient relationship”).
Baystate’s arguments for dismissal of this claim are unpersuasive. Doe need not, as
Baystate asserts, have alleged that Baystate assented to the implied contract. See Salamon, 394
Mass. at 859. Baystate also argues that there was no consideration because it had a preexisting
obligation under the Health Insurance Portability and Accountability Act of 1996 to protect Doe’s
medical information. But this assertion overlooks Doe’s allegation that Baystate obtained a benefit
from its receipt of that information. Complaint ¶¶ 161-63; see Emerson Hosp., 2023 WL 8869624,
at *4 & n.10 (finding consideration in similar circumstances and holding that “the allegations
sufficiently suggest[ed] that [defendant] may have entered into an implied contract which included
an agreement not to disclose health information to third parties, like Facebook, without consent”).
Baystate’s contention that Doe was not harmed by its alleged conduct is similarly contradicted by
her allegation that Baystate “took valuable information from” her without her consent and “derived
benefit therefrom” without “sharing the benefits.” Complaint ¶ 163. At this stage, dismissal of
Doe’s claim for breach of an implied contract is not warranted.
IV. 	Breach of Fiduciary Duty.
Count IV asserts that Baystate breached its fiduciary duty to Doe as a patient by disclosing
her confidential medical information to Meta and Google without her authorization. “‘To establish
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 14 of 17

15
a breach of fiduciary duty, there must be a duty owed to the plaintiff by the defendant and injury
to the plaintiff proximately caused by the breach.’” Hornibrook v. Richard, 488 Mass. 74, 81
(2021) (quoting Estate of Moulton v. Puopolo, 467 Mass. 478, 492 (2014)). The Supreme Judicial
Court has “recognized that the physician-patient relationship possesses fiduciary . . . aspects” and
has held that “a duty of confidentiality arises from the physician-patient relationship.” Alberts, 395
Mass. at 69 (citing Warsofskyv. Sherman, 326 Mass. 290, 292 (1950)). “Patient confidentiality ‘is
a cardinal rule of the medical profession,’” and “[d]isclosure of confidential medical information,
in violation of that professional duty, can constitute an actionable tort.” Commonwealth v.
Brandwein, 435 Mass. 623, 629-30 (2002) (quoting Alberts, 395 Mass. at 66).
Baystate contends that as a hospital, unlike a physician, it does not owe a fiduciary duty to
patients. As part of “the medical profession,” however, hospitals have a “professional duty” not to
disclose patients’ private health information without their consent. Brandwein, 435 Mass. at 629-
30. Massachusetts courts have repeatedly recognized a fiduciary relationship between hospitals
and patients. See Tenet Healthcare, 731 F. Supp. 3d at 151 (“a fiduciary relationship exists between
healthcare providers and patients”); Emerson Hospital, 2023 WL 8869624, at *3 (rejecting
argument as premature that “a fiduciary relationship cannot exist between a health system (as
opposed to a specific doctor) and a patient”); Shedd v. Sturdy Mem’l Hosp., Inc., No. 2173-cv-
498-C, 2022 WL 1102524, at *9 (Mass. Super. Apr. 5, 2022) (similar). That relationship exists
because patients place their “faith, confidence, and trust” in a hospital and are therefore dependent
on the hospital’s commitment to protect their confidential information. UBS Fin. Servs., Inc. v.
Aliberti, 483 Mass. 396, 408 (2019) (quotation marks omitted). Indeed, the Supreme Judicial Court
recently “emphasize[d] that the Legislature has provided . . . common-law protections,” including
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 15 of 17

16
“claims for . . . breach of fiduciary duty,” that are “applicable to . . . misuse of private medical
information.” Vita, 494 Mass. at 849-50 (citing Tenet Healthcare, 731 F. Supp. 3d 142).
Baystate next argues that Doe’s use of its public website was “beyond the context of
medical treatment” and thus outside “the scope of the fiduciary duty a doctor owes a patient.”
Korper v. Weinstein, 57 Mass. App. Ct. 433, 438 n.11 (2003). But, as explained, hospitals also
have “a fiduciary duty to maintain the confidentiality of a [patient’s] medical records.” Id. at 437
(citing Alberts, 395 Mass. at 69). Doe alleges that a “fiduciary relationship existed between
Baystate, a healthcare provider, and” her, as its patient, and that Baystate had “a duty to keep
[medical] information completely confidential.” Complaint ¶¶ 166, 168. Baystate also promised
patients that “identifiable information” would be disclosed only with their “specific written
consent” or if “required by law” and would “only be used to support [the] customer/patient
relationship.” Id. ¶¶ 3, 23 (quotation marks and emphases omitted). These facts are sufficient to
plausibly give rise to a fiduciary duty. See In re Shields Health Care Grp., Inc. Data Breach Litig.,
721 F. Supp. 3d 152, 165 (D. Mass. 2024) (plaintiffs’ “healthcare provider” “owed them a fiduciary
duty to protect their private information” where it “required them to provide private information
and represented it would ‘[m]aintain the privacy of [their] health information as required by law’”
(citation omitted)).
Doe also adequately alleges that Baystate breached that fiduciary duty through its “secret
and unauthorized disclosures” of her confidential medical information to Google and Meta.
Complaint ¶¶ 170-72. Baystate allegedly disclosed, without Doe’s consent, her status as its patient,
her scheduling of a mammogram, her search for providers and breast cancer screenings, and her
use of its patient portal. Id. ¶¶ 96-97, 129, 152. Taken together, the amended complaint sufficiently
states a breach of fiduciary duty claim against Baystate. See Tenet Healthcare, 731 F. Supp. 3d at
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 16 of 17

17
151 (“Plaintiff, a patient at Tenet, states a viable claim of breach of fiduciary duty against her
healthcare provider for disclosing her Private Information.”); Emerson Hosp., 2023 WL 8869624,
at *3 (denying motion to dismiss such a claim where defendant provider allegedly disclosed
information about plaintiff’s “‘medical treatment to third parties without [his] knowledge, consent,
or authorization,’” including about his patient status and potential physicians (citation omitted)).
CONCLUSION AND ORDER
For the foregoing reasons, Baystate’s motion to dismiss, ECF 25, is DENIED.
SO ORDERED.
/s/ Julia E. Kobick
JULIA E. KOBICK
Dated: March 19, 2026 	UNITED STATES DISTRICT JUDGE
Case 1:25-cv-10337-JEK Document 42 Filed 03/19/26 Page 17 of 17