{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=us:calctapp-b344951-2026-08-24", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=us:calctapp-b344951-2026-08-24)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-10", "fingerprint": "ewai:us:e7268f", "proof": "sha256:ac66343aec122113692cfd0cb6d1d5500e03f1fdf0e9c947492b39413ce07d90", "jurisdiction": "us", "lang": "en", "publisher": "NovaCopilot by ExploreWorld Legal", "terms": "https://legal.exploreworldai.com/om" }, "brand_source": "Source: NovaCopilot", "item": { "schema_version": "1.0.0", "id": "us:calctapp-b344951-2026-08-24", "jurisdiction": "us", "lang": "en", "brand_source": "Source: NovaCopilot", "brand": { "product": "NovaCopilot", "platform": "ExploreWorldAI", "infrastructure": "ExploreWorld Legal", "infrastructure_url": "legal.exploreworldai.com", "legal_entity": "Valkiv Ventures AB", "permanent_url": "https://legal.exploreworldai.com/novacopilot", "source": "Source: NovaCopilot", "powered_by": "Powered by NovaCopilot", "license": "https://legal.exploreworldai.com/licensvillkor" }, "sections": [ { "title": "Filed 7/24/26; Certified for Publication 8/24/26 (order attached)", "paragraphs": [] }, { "title": "IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA", "paragraphs": [] }, { "title": "SECOND APPELLATE DISTRICT", "paragraphs": [] }, { "title": "DIVISION THREE", "paragraphs": [ "para_5", "para_6", "para_7" ] }, { "title": "ADVENTIST HEALTH SYSTEM/", "paragraphs": [ "para_9", "para_10" ] }, { "title": "B344951", "paragraphs": [] }, { "title": "Los Angeles County", "paragraphs": [ "para_13" ] }, { "title": "22STCV36304", "paragraphs": [] }, { "title": "APPEAL from an order of the Superior Court of", "paragraphs": [ "para_16", "para_17", "para_18" ] }, { "title": "Chapman, Amy E. Tabor; Ahmad, Zavitsanos & Mensing, Foster", "paragraphs": [ "para_20" ] }, { "title": "MaryBeth LippSmith and Jaclyn L. Anderson for Plaintiffs", "paragraphs": [ "para_22", "para_23" ] }, { "title": "Chinn-Liu for Defendant and Respondent", "paragraphs": [ "para_25" ] }, { "title": "2", "paragraphs": [] }, { "title": "Plaintiffs—four Does who are or were patients of defendant", "paragraphs": [] }, { "title": "Adventist Health System/West (Adventist)—brought this", "paragraphs": [ "para_29", "para_30" ] }, { "title": "Act (CIPA) (Pen. Code, §§ 630 et seq.)1 and the California", "paragraphs": [] }, { "title": "Confidentiality of Medical Information Act (CMIA). Plaintiffs", "paragraphs": [ "para_33", "para_34", "para_35", "para_36", "para_37", "para_38", "para_39", "para_40", "para_41", "para_42", "para_43" ] }, { "title": "Plaintiffs sought to certify a class consisting of Adventist", "paragraphs": [ "para_45" ] }, { "title": "November 16, 2017 to April 30, 2024—“used the Adventist", "paragraphs": [ "para_47", "para_48", "para_49", "para_50" ] }, { "title": "Only two subclasses are relevant to this appeal: (1) the patient", "paragraphs": [ "para_52", "para_53", "para_54" ] }, { "title": "3", "paragraphs": [ "para_56", "para_57", "para_58" ] }, { "title": "Plaintiffs appeal from the trial court’s denial of class certification", "paragraphs": [ "para_60", "para_61" ] }, { "title": "(1) the patient portal class was ascertainable, (2) common issues", "paragraphs": [ "para_63" ] }, { "title": "(3) the superiority and manageability of a class action. The", "paragraphs": [ "para_65", "para_66" ] }, { "title": "The court primarily reasoned that determining whether", "paragraphs": [ "para_68", "para_69", "para_70", "para_71", "para_72", "para_73", "para_74" ] }, { "title": "Plaintiffs challenge the rulings, arguing the undisputed record", "paragraphs": [ "para_76", "para_77", "para_78", "para_79", "para_80", "para_81", "para_82" ] }, { "title": "HRA form subclass and partially reverse as to the patient portal", "paragraphs": [ "para_84" ] }, { "title": "4", "paragraphs": [] }, { "title": "BACKGROUND", "paragraphs": [] }, { "title": "1. Background on tracking technologies2", "paragraphs": [] }, { "title": "A web browser communicates with a website’s servers to", "paragraphs": [ "para_89" ] }, { "title": "To do so, the web browser sends HTTP (hypertext transfer", "paragraphs": [ "para_91" ] }, { "title": "The HTTP request “contains an IP address, which [is] an", "paragraphs": [ "para_93", "para_94", "para_95", "para_96", "para_97", "para_98", "para_99", "para_100", "para_101", "para_102", "para_103", "para_104", "para_105", "para_106", "para_107", "para_108" ] }, { "title": "2 We glean most of this background from the report of", "paragraphs": [ "para_110", "para_111" ] }, { "title": "3 The first HTTP request sent “is typically for the Hypertext", "paragraphs": [] }, { "title": "Markup Language (HTML) file.” The HTML file contains the", "paragraphs": [ "para_114" ] }, { "title": "5", "paragraphs": [] }, { "title": "A “tracking pixel”—such as the Meta Pixel and Google", "paragraphs": [] }, { "title": "Analytics—is a piece of code or image “that is used to track", "paragraphs": [ "para_118", "para_119", "para_120", "para_121", "para_122", "para_123", "para_124", "para_125", "para_126" ] }, { "title": "A tracking pixel collects “two types of data”—“identifiers”", "paragraphs": [ "para_128", "para_129", "para_130", "para_131", "para_132", "para_133", "para_134", "para_135", "para_136" ] }, { "title": "The combination of IP address and user agent (or other browser", "paragraphs": [ "para_138", "para_139", "para_140" ] }, { "title": "A website may “install tracking pixels from third-party", "paragraphs": [ "para_142", "para_143", "para_144", "para_145" ] }, { "title": "6", "paragraphs": [ "para_147", "para_148", "para_149", "para_150" ] }, { "title": "Google describes Google Analytics as “ ‘a platform that", "paragraphs": [ "para_152", "para_153", "para_154", "para_155" ] }, { "title": "Google Analytics “uses both first-party and third-party cookies”", "paragraphs": [ "para_157", "para_158" ] }, { "title": "Google to link or associate the data with Google accounts of users", "paragraphs": [ "para_160" ] }, { "title": "Meta Pixel (formerly called Facebook Pixel) as “a piece of code", "paragraphs": [ "para_162", "para_163", "para_164" ] }, { "title": "You’ll also be able to see when customers took an action after", "paragraphs": [ "para_166" ] }, { "title": "Meta Pixel “will track URLs visited, domains visited, and the", "paragraphs": [ "para_168", "para_169", "para_170", "para_171", "para_172", "para_173" ] }, { "title": "In Adventist’s words, these tracking technologies “cause", "paragraphs": [ "para_175" ] }, { "title": "Meta servers) to communicate with each other, causing certain", "paragraphs": [] }, { "title": "7", "paragraphs": [ "para_178", "para_179" ] }, { "title": "URLs, IP addresses—whether complete or partially masked—", "paragraphs": [ "para_181" ] }, { "title": "2. Adventist’s use of tracking technologies", "paragraphs": [] }, { "title": "Adventist is a nonprofit, faith-based healthcare system", "paragraphs": [ "para_184" ] }, { "title": "2017 and 2024, Adventist installed the Meta Pixel and/or Google", "paragraphs": [] }, { "title": "Analytics on its websites, including its public-facing website at", "paragraphs": [ "para_187", "para_188" ] }, { "title": "Adventist placed advertisements on Facebook and other", "paragraphs": [ "para_190", "para_191", "para_192", "para_193", "para_194", "para_195", "para_196", "para_197", "para_198" ] }, { "title": "In other words, the tracking pixels enabled Adventist to", "paragraphs": [ "para_200", "para_201", "para_202", "para_203", "para_204", "para_205" ] }, { "title": "The patient portal—hosted by Adventist’s business", "paragraphs": [ "para_207" ] }, { "title": "8", "paragraphs": [ "para_209", "para_210", "para_211", "para_212", "para_213", "para_214", "para_215", "para_216" ] }, { "title": "Google Analytics normally shares information about", "paragraphs": [ "para_218", "para_219", "para_220", "para_221", "para_222", "para_223" ] }, { "title": "Analytics] to anonymize the IP address[es]” it stored—by", "paragraphs": [ "para_225", "para_226", "para_227", "para_228" ] }, { "title": "URL “matched a pattern that included an identifier or reference", "paragraphs": [ "para_230", "para_231", "para_232", "para_233", "para_234" ] }, { "title": "4 Discovery Shafiq reviewed showed Google Analytics was", "paragraphs": [ "para_236", "para_237", "para_238" ] }, { "title": "9", "paragraphs": [ "para_240", "para_241", "para_242", "para_243" ] }, { "title": "Beginning in 2019 or 2020, Adventist partnered with", "paragraphs": [] }, { "title": "HealthAware to provide HRAs “through the adventisthealth", "paragraphs": [ "para_246", "para_247", "para_248", "para_249", "para_250", "para_251", "para_252", "para_253" ] }, { "title": "HRA form and clicked the link to submit it, they were told if", "paragraphs": [ "para_255", "para_256" ] }, { "title": "Records of the individuals who completed an HRA—", "paragraphs": [ "para_258", "para_259" ] }, { "title": "5 The URL “query string” includes “search terms” input by", "paragraphs": [ "para_261", "para_262", "para_263", "para_264", "para_265", "para_266", "para_267" ] }, { "title": "(See In re Meta Pixel Healthcare Litigation (N.D.Cal. 2022)", "paragraphs": [] }, { "title": "647 F.Supp.3d 778, 795–796 and fn. 10 (Meta Pixel) [examples", "paragraphs": [ "para_270" ] }, { "title": "10", "paragraphs": [ "para_272", "para_273", "para_274" ] }, { "title": "Relationship Management” (CRM) system. The tracking pixels", "paragraphs": [ "para_276", "para_277" ] }, { "title": "3. Plaintiffs’ class action lawsuit", "paragraphs": [] }, { "title": "Plaintiffs are current or former Adventist patients who", "paragraphs": [ "para_280" ] }, { "title": "Plaintiffs sued Adventist, as individuals and on behalf of a", "paragraphs": [ "para_282", "para_283", "para_284" ] }, { "title": "Adventist installed tracking technologies throughout its public", "paragraphs": [ "para_286", "para_287", "para_288", "para_289" ] }, { "title": "Adventist allegedly disclosed plaintiffs’ personally identifiable", "paragraphs": [ "para_291" ] }, { "title": "Google. Plaintiffs alleged the tracking technologies transmitted", "paragraphs": [] }, { "title": "Adventist website users’ IP addresses, URLs generated from", "paragraphs": [ "para_294", "para_295", "para_296", "para_297" ] }, { "title": "6 Plaintiffs filed the operative third amended complaint", "paragraphs": [ "para_299", "para_300" ] }, { "title": "11", "paragraphs": [ "para_302", "para_303" ] }, { "title": "Plaintiffs alleged Meta/Google used the information", "paragraphs": [ "para_305", "para_306", "para_307", "para_308", "para_309" ] }, { "title": "Adventist’s public website and patient portal where they", "paragraphs": [ "para_311", "para_312", "para_313", "para_314", "para_315" ] }, { "title": "Plaintiffs asserted ten separate causes of action against", "paragraphs": [] }, { "title": "Adventist, including, among others: one claim for violating CIPA", "paragraphs": [ "para_318", "para_319", "para_320", "para_321", "para_322", "para_323", "para_324", "para_325", "para_326", "para_327", "para_328", "para_329", "para_330", "para_331" ] }, { "title": "12", "paragraphs": [] }, { "title": "(Bus. & Prof. Code, § 17200 et seq.) (UCL) based on its violations", "paragraphs": [ "para_334", "para_335" ] }, { "title": "4. Class certification motion, opposition, and reply", "paragraphs": [] }, { "title": "On June 25, 2024, plaintiffs also filed their motion for class", "paragraphs": [ "para_338", "para_339", "para_340" ] }, { "title": "Plaintiffs proposed the general class—for the period from", "paragraphs": [] }, { "title": "November 16, 2017 to April 30, 2024—consist of “all Adventist", "paragraphs": [] }, { "title": "Health patients with an address in California who used the", "paragraphs": [] }, { "title": "Adventist website or patient portal to exchange communications", "paragraphs": [ "para_345", "para_346", "para_347", "para_348", "para_349", "para_350", "para_351" ] }, { "title": "8 Plaintiffs’ expert Shafiq’s report summarized his testing", "paragraphs": [ "para_353", "para_354", "para_355", "para_356", "para_357", "para_358", "para_359", "para_360" ] }, { "title": "9 The proposed general class in the TAC included prospective", "paragraphs": [ "para_362" ] }, { "title": "13", "paragraphs": [ "para_364", "para_365", "para_366" ] }, { "title": "There was no dispute over the numerosity of the proposed", "paragraphs": [ "para_368", "para_369", "para_370", "para_371" ] }, { "title": "Plaintiffs argued Adventist’s liability depended on", "paragraphs": [ "para_373", "para_374", "para_375", "para_376", "para_377", "para_378", "para_379", "para_380", "para_381", "para_382", "para_383", "para_384", "para_385", "para_386", "para_387", "para_388", "para_389", "para_390", "para_391", "para_392", "para_393" ] }, { "title": "14", "paragraphs": [] }, { "title": "Plaintiffs argued the factual and legal issues relating to", "paragraphs": [ "para_396" ] }, { "title": "HRA form subclass, as well. Plaintiffs asserted Adventist had", "paragraphs": [ "para_398", "para_399", "para_400", "para_401" ] }, { "title": "Google a “full-string URL[ ]” including a “unique string of", "paragraphs": [ "para_403", "para_404" ] }, { "title": "Finally, plaintiffs argued that a class action was superior", "paragraphs": [ "para_406", "para_407", "para_408", "para_409" ] }, { "title": "Adventist opposed the motion, primarily arguing several", "paragraphs": [ "para_411", "para_412", "para_413", "para_414", "para_415", "para_416" ] }, { "title": "With respect to the patient portal subclass, Adventist argued", "paragraphs": [ "para_418", "para_419", "para_420", "para_421", "para_422", "para_423", "para_424" ] }, { "title": "15", "paragraphs": [ "para_426", "para_427" ] }, { "title": "HRA website differently: while Google “likely received” a URL", "paragraphs": [ "para_429", "para_430", "para_431" ] }, { "title": "In their reply—filed after deposing Adventist’s expert", "paragraphs": [] }, { "title": "Emily Cohen—plaintiffs argued Cohen’s confirmation that the", "paragraphs": [ "para_434", "para_435", "para_436", "para_437", "para_438", "para_439", "para_440", "para_441", "para_442", "para_443", "para_444", "para_445", "para_446", "para_447" ] }, { "title": "Plaintiffs agreed to limit the patient portal subclass to", "paragraphs": [ "para_449", "para_450", "para_451", "para_452", "para_453", "para_454", "para_455" ] }, { "title": "16", "paragraphs": [ "para_457", "para_458", "para_459", "para_460", "para_461", "para_462", "para_463", "para_464" ] }, { "title": "Adventist’s contentions that the court could not determine the", "paragraphs": [ "para_466", "para_467", "para_468", "para_469", "para_470", "para_471", "para_472" ] }, { "title": "During the hearing—in response to the court’s concerns that", "paragraphs": [ "para_474", "para_475", "para_476", "para_477", "para_478", "para_479", "para_480", "para_481", "para_482" ] }, { "title": "Plaintiffs’ trial plan confirmed their modifications of", "paragraphs": [ "para_484", "para_485", "para_486" ] }, { "title": "17", "paragraphs": [] }, { "title": "5. The court’s denial of class certification", "paragraphs": [] }, { "title": "On February 14, 2025, the court issued an 18-page order", "paragraphs": [ "para_490" ] }, { "title": "As relevant to this appeal, the court found plaintiffs failed to", "paragraphs": [ "para_492", "para_493", "para_494", "para_495", "para_496", "para_497", "para_498", "para_499", "para_500" ] }, { "title": "URLs may not have revealed “either ‘content’ under CIPA", "paragraphs": [ "para_502", "para_503", "para_504", "para_505", "para_506" ] }, { "title": "CIPA or CMIA.” As for the HRA form subclass, the court found", "paragraphs": [ "para_508", "para_509", "para_510", "para_511" ] }, { "title": "HRA forms. Finally, the court found plaintiffs failed to show the", "paragraphs": [ "para_513", "para_514", "para_515", "para_516" ] }, { "title": "18", "paragraphs": [ "para_518", "para_519" ] }, { "title": "DISCUSSION", "paragraphs": [] }, { "title": "1. Class certification and standard of review", "paragraphs": [] }, { "title": "Section 382 of the Code of Civil Procedure authorizes", "paragraphs": [ "para_523", "para_524", "para_525", "para_526", "para_527", "para_528", "para_529", "para_530", "para_531" ] }, { "title": "(1) predominant common questions of law or fact; (2) class", "paragraphs": [ "para_533", "para_534", "para_535" ] }, { "title": "53 Cal.4th 1004, 1021 (Brinker).)", "paragraphs": [] }, { "title": "The certification question is “ ‘ “essentially a procedural", "paragraphs": [ "para_538", "para_539", "para_540", "para_541", "para_542", "para_543" ] }, { "title": "10 An order denying class certification is appealable under", "paragraphs": [ "para_545" ] }, { "title": "(2024) 16 Cal.5th 643, 656, fn. 8.)", "paragraphs": [] }, { "title": "19", "paragraphs": [] }, { "title": "Court has recognized that, when “evidence or legal issues", "paragraphs": [ "para_549", "para_550", "para_551", "para_552", "para_553", "para_554", "para_555", "para_556", "para_557", "para_558", "para_559", "para_560", "para_561", "para_562", "para_563", "para_564" ] }, { "title": "(Brinker, supra, 53 Cal.4th at p. 1022.) Therefore, “ ‘[u]nlike the", "paragraphs": [ "para_566", "para_567", "para_568", "para_569", "para_570", "para_571", "para_572", "para_573", "para_574", "para_575" ] }, { "title": "(2014) 59 Cal.4th 522, 537 [“[a] certification decision is reviewed", "paragraphs": [ "para_577" ] }, { "title": "20", "paragraphs": [ "para_579", "para_580", "para_581" ] }, { "title": "(2014) 228 Cal.App.4th 1137, 1143, quoting Knapp v. AT&T", "paragraphs": [] }, { "title": "Wireless Services, Inc. (2011) 195 Cal.App.4th 932, 939 (Knapp)", "paragraphs": [ "para_584", "para_585" ] }, { "title": "2. Ascertainability of the patient portal subclass11", "paragraphs": [] }, { "title": "A class is ascertainable “when it is defined ‘in terms of", "paragraphs": [ "para_588", "para_589", "para_590" ] }, { "title": "7 Cal.5th at p. 980.) “[T]his standard . . . include[es] class", "paragraphs": [ "para_592", "para_593", "para_594" ] }, { "title": "Plaintiffs defined the patient portal subclass as “All Class", "paragraphs": [ "para_596", "para_597", "para_598" ] }, { "title": "2017 to April 30, 2024, all Adventist Health patients with an", "paragraphs": [ "para_600", "para_601", "para_602", "para_603", "para_604", "para_605" ] }, { "title": "11 The court found the HRA form subclass members were", "paragraphs": [ "para_607" ] }, { "title": "21", "paragraphs": [ "para_609" ] }, { "title": "Health, including” the four above activities. (Italics added.)", "paragraphs": [] }, { "title": "Plaintiffs’ counsel suggested the revised definition during", "paragraphs": [ "para_612", "para_613" ] }, { "title": "Accordingly, as Adventist asserts, the patient portal", "paragraphs": [ "para_615", "para_616", "para_617", "para_618", "para_619" ] }, { "title": "2023 to exchange communications with Adventist for researching", "paragraphs": [ "para_621", "para_622" ] }, { "title": "The court found plaintiffs did not establish the members", "paragraphs": [ "para_624", "para_625" ] }, { "title": "California patients and then ‘patients could identify themselves", "paragraphs": [ "para_627", "para_628", "para_629", "para_630", "para_631" ] }, { "title": "The court found “[i]t [wa]s not so simple,” in part because the", "paragraphs": [ "para_633", "para_634", "para_635", "para_636", "para_637", "para_638" ] }, { "title": "22", "paragraphs": [ "para_640", "para_641", "para_642", "para_643", "para_644", "para_645", "para_646", "para_647" ] }, { "title": "Plaintiffs argue the record shows the patient portal", "paragraphs": [ "para_649" ] }, { "title": "Cerner’s records. As plaintiffs note, the evidence shows", "paragraphs": [] }, { "title": "Adventist could create a report of the patient identification", "paragraphs": [ "para_652", "para_653", "para_654", "para_655", "para_656", "para_657", "para_658", "para_659", "para_660", "para_661", "para_662", "para_663" ] }, { "title": "12 As we noted, the court found the general class definition", "paragraphs": [ "para_665" ] }, { "title": "We can infer the court found the patient portal—which had a", "paragraphs": [ "para_667", "para_668", "para_669" ] }, { "title": "23", "paragraphs": [ "para_671", "para_672" ] }, { "title": "Plaintiffs argue Adventist never disputed the patient portal", "paragraphs": [ "para_674", "para_675", "para_676", "para_677" ] }, { "title": "Adventist argued the “revised general class definition creates", "paragraphs": [ "para_679" ] }, { "title": "Subclass. Specifically, a patient who merely logs in to the patient", "paragraphs": [ "para_681", "para_682", "para_683", "para_684", "para_685", "para_686", "para_687", "para_688", "para_689", "para_690", "para_691", "para_692", "para_693", "para_694" ] }, { "title": "Plaintiffs argue patients identified as having logged into", "paragraphs": [ "para_696", "para_697", "para_698", "para_699", "para_700" ] }, { "title": "24", "paragraphs": [ "para_702", "para_703", "para_704", "para_705" ] }, { "title": "Nevertheless, as the court itself acknowledged, any", "paragraphs": [ "para_707", "para_708", "para_709", "para_710", "para_711", "para_712", "para_713", "para_714", "para_715", "para_716", "para_717", "para_718", "para_719", "para_720", "para_721", "para_722", "para_723", "para_724" ] }, { "title": "Your Honor, and we acknowledge that that class would require", "paragraphs": [ "para_726", "para_727", "para_728", "para_729" ] }, { "title": "25", "paragraphs": [] }, { "title": "Accordingly, when discussing plaintiffs’ proposed revision", "paragraphs": [ "para_732", "para_733", "para_734", "para_735", "para_736", "para_737", "para_738", "para_739" ] }, { "title": "Plaintiffs no longer seek to certify a general class of patients", "paragraphs": [ "para_741", "para_742", "para_743", "para_744", "para_745", "para_746", "para_747" ] }, { "title": "HRA form. Neither subclass raises the concerns the court", "paragraphs": [ "para_749" ] }, { "title": "13 Plaintiffs’ expert Shafiq also stated the class definition", "paragraphs": [ "para_751", "para_752", "para_753", "para_754", "para_755", "para_756" ] }, { "title": "Shafiq understood that logging into the patient portal itself was", "paragraphs": [ "para_758", "para_759", "para_760" ] }, { "title": "26", "paragraphs": [] }, { "title": "In essence, plaintiffs’ appeal has rendered their post-hearing", "paragraphs": [ "para_763" ] }, { "title": "And as we discussed, Adventist and/or its provider Cerner", "paragraphs": [ "para_765", "para_766", "para_767", "para_768", "para_769" ] }, { "title": "Memorial Hospital (2016) 3 Cal.App.5th 1200, 1213–1214", "paragraphs": [] }, { "title": "(Nicodemus) [data set of all patients’ attorneys’ requests for", "paragraphs": [ "para_772", "para_773", "para_774", "para_775" ] }, { "title": "Adventist did not dispute that the patient portal class was", "paragraphs": [ "para_777" ] }, { "title": "As plaintiffs note, the court also found they did “not explain", "paragraphs": [ "para_779", "para_780", "para_781" ] }, { "title": "Whether Adventist violated CIPA or CMIA by transmitting the", "paragraphs": [ "para_783", "para_784", "para_785", "para_786", "para_787" ] }, { "title": "Accordingly, we conclude plaintiffs demonstrated the patient", "paragraphs": [ "para_789" ] }, { "title": "27", "paragraphs": [] }, { "title": "3. The court’s predominance inquiry", "paragraphs": [ "para_792", "para_793", "para_794", "para_795", "para_796", "para_797", "para_798", "para_799", "para_800", "para_801", "para_802" ] }, { "title": "Office Solutions, Inc. (2007) 148 Cal.App.4th 1440, 1450", "paragraphs": [] }, { "title": "(Walsh) [“In examining whether common issues of law or fact", "paragraphs": [ "para_805", "para_806", "para_807", "para_808", "para_809", "para_810" ] }, { "title": "The “pertinent questions” under the predominance inquiry are:", "paragraphs": [ "para_812", "para_813", "para_814" ] }, { "title": "1103, 1113 (Downey).) Moreover, “ ‘[T]he possibility that a", "paragraphs": [ "para_816", "para_817", "para_818", "para_819" ] }, { "title": "3 Cal.App.5th at p. 1219.)", "paragraphs": [] }, { "title": "28", "paragraphs": [] }, { "title": "Plaintiffs’ trial plan stated it was seeking class certification", "paragraphs": [ "para_823", "para_824", "para_825", "para_826", "para_827" ] }, { "title": "(2) CMIA claims, alleging Adventist violated Civil Code sections", "paragraphs": [] }, { "title": "56.10 and 56.101; and (3) UCL claims based on Adventist’s", "paragraphs": [ "para_830" ] }, { "title": "In essence, the trial court found that—although plaintiffs", "paragraphs": [ "para_832", "para_833", "para_834", "para_835", "para_836", "para_837" ] }, { "title": "(See Duran v. U.S. Bank National Assn. (2014) 59 Cal.4th 1, 28", "paragraphs": [] }, { "title": "(Duran) [“class treatment is not appropriate ‘if every member", "paragraphs": [ "para_840", "para_841", "para_842" ] }, { "title": "We first state the applicable law and then review the court’s", "paragraphs": [ "para_844", "para_845", "para_846", "para_847" ] }, { "title": "14 We discuss that finding at the end of the Discussion", "paragraphs": [ "para_849", "para_850" ] }, { "title": "29", "paragraphs": [ "para_852", "para_853", "para_854", "para_855", "para_856", "para_857", "para_858", "para_859", "para_860", "para_861", "para_862", "para_863", "para_864" ] }, { "title": "1112–1114, 1116, 1122–1224 [to state a claim for “aiding and", "paragraphs": [ "para_866", "para_867", "para_868", "para_869" ] }, { "title": "The court’s predominance analysis focused on whether", "paragraphs": [ "para_871", "para_872" ] }, { "title": "Meta included the “contents” of patients’ communications with", "paragraphs": [] }, { "title": "Adventist. CIPA does not define “contents.” A similar provision", "paragraphs": [ "para_875", "para_876", "para_877", "para_878", "para_879" ] }, { "title": "Wiretap Act’ ”]; 18 U.S.C. § 2511(1)(a)–(e).) According to the", "paragraphs": [] }, { "title": "Ninth Circuit, the “ ‘contents’ ” of an online communication", "paragraphs": [] }, { "title": "30", "paragraphs": [ "para_883", "para_884", "para_885", "para_886" ] }, { "title": "2014) 750 F.3d 1098, 1106–1107 (Zynga).) In Zynga, the Ninth", "paragraphs": [] }, { "title": "Circuit explained a URL that included “only basic identification", "paragraphs": [ "para_889", "para_890", "para_891", "para_892" ] }, { "title": "1107 [granting motion to dismiss where alleged information", "paragraphs": [ "para_894", "para_895", "para_896" ] }, { "title": "Since Zynga, other federal district courts within California", "paragraphs": [ "para_898", "para_899" ] }, { "title": "In Meta Pixel, supra, 647 F.Supp.3d at pp. 785, 795–796, 798", "paragraphs": [ "para_901", "para_902", "para_903", "para_904", "para_905", "para_906", "para_907", "para_908" ] }, { "title": "Agent identifiers,” “[c]ontent of the button (‘Log in’),” “[c]ontents", "paragraphs": [ "para_910", "para_911", "para_912" ] }, { "title": "31", "paragraphs": [ "para_914" ] }, { "title": "URLs, which included both “the ‘path’ and the ‘query string,’ ”", "paragraphs": [ "para_916", "para_917", "para_918", "para_919", "para_920" ] }, { "title": "Federal district courts have “ ‘employ[ed] a contextual", "paragraphs": [ "para_922", "para_923", "para_924", "para_925" ] }, { "title": "2022) 615 F.Supp.3d 1069, 1092–1093.) “ ‘Generally, customer", "paragraphs": [ "para_927", "para_928", "para_929", "para_930", "para_931", "para_932", "para_933", "para_934", "para_935", "para_936", "para_937", "para_938" ] }, { "title": "949 (Google RTB) [finding redirected electronic communications", "paragraphs": [ "para_940", "para_941", "para_942", "para_943" ] }, { "title": "32", "paragraphs": [ "para_945", "para_946" ] }, { "title": "CMIA in turn prohibits a health care provider from", "paragraphs": [ "para_948", "para_949" ] }, { "title": "CMIA defines “medical information” as “any individually", "paragraphs": [ "para_951", "para_952", "para_953", "para_954", "para_955", "para_956", "para_957", "para_958", "para_959", "para_960", "para_961", "para_962", "para_963", "para_964" ] }, { "title": "226 Cal.App.4th 430, 435 (Eisenhower).)", "paragraphs": [ "para_966", "para_967", "para_968", "para_969", "para_970", "para_971" ] }, { "title": "HRA forms under CIPA or CMIA", "paragraphs": [] }, { "title": "As plaintiffs note, in assessing the predominance prong", "paragraphs": [ "para_974" ] }, { "title": "33", "paragraphs": [ "para_976", "para_977", "para_978" ] }, { "title": "Google and Meta to be notified when an HRA form had been", "paragraphs": [ "para_980", "para_981", "para_982", "para_983", "para_984", "para_985" ] }, { "title": "65e83697f7b0/report/a2d7dfd4-c6fe-4c53-8d41-eacf4e4e87a0.’ ”16", "paragraphs": [] }, { "title": "Shafiq noted “anyone can go” to that URL “to access the contents", "paragraphs": [ "para_988" ] }, { "title": "When “clicked” the two example HRA URLs in Shafiq’s", "paragraphs": [ "para_990", "para_991", "para_992", "para_993" ] }, { "title": "WeightAware report recommended the individual lose weight", "paragraphs": [ "para_995", "para_996", "para_997", "para_998", "para_999", "para_1000" ] }, { "title": "16 This link is to a “WeightAware” report—an HRA for", "paragraphs": [ "para_1002", "para_1003", "para_1004", "para_1005" ] }, { "title": "34", "paragraphs": [ "para_1007", "para_1008" ] }, { "title": "The court found it was “questionable whether the fact that", "paragraphs": [ "para_1010", "para_1011", "para_1012", "para_1013", "para_1014", "para_1015", "para_1016", "para_1017", "para_1018", "para_1019" ] }, { "title": "But plaintiffs alleged that every submission of an HRA", "paragraphs": [ "para_1021", "para_1022", "para_1023", "para_1024", "para_1025", "para_1026" ] }, { "title": "Cal.4th 429, 439–440 (Linder) [question of class certification", "paragraphs": [ "para_1028", "para_1029" ] }, { "title": "Stores, Inc. v. Superior Court (2004) 34 Cal.4th 319, 327 (Sav-On)", "paragraphs": [ "para_1031", "para_1032", "para_1033", "para_1034", "para_1035", "para_1036" ] }, { "title": "35", "paragraphs": [ "para_1038", "para_1039", "para_1040", "para_1041", "para_1042", "para_1043", "para_1044", "para_1045", "para_1046" ] }, { "title": "URL link with Google and/or Meta regardless of the specific HRA", "paragraphs": [ "para_1048" ] }, { "title": "HRA—as in the examples above—likely would contain the", "paragraphs": [ "para_1050", "para_1051" ] }, { "title": "Adventist nevertheless argues plaintiffs “presented no", "paragraphs": [ "para_1053", "para_1054", "para_1055" ] }, { "title": "Shafiq stated—under penalty of perjury—that his “testing and", "paragraphs": [ "para_1057", "para_1058", "para_1059", "para_1060" ] }, { "title": "Google Tag Manager containers that included tracking pixels", "paragraphs": [ "para_1062", "para_1063" ] }, { "title": "Shafiq also stated he tested how Adventist “installs", "paragraphs": [ "para_1065", "para_1066" ] }, { "title": "He filled out three different HRAs and a cancer genetic risk", "paragraphs": [] }, { "title": "36", "paragraphs": [ "para_1069", "para_1070", "para_1071", "para_1072" ] }, { "title": "Moreover, Shafiq opined the “tracking pixel source code on", "paragraphs": [] }, { "title": "Adventist Health’s website operates deterministically, meaning", "paragraphs": [ "para_1075", "para_1076", "para_1077", "para_1078", "para_1079", "para_1080", "para_1081", "para_1082", "para_1083", "para_1084", "para_1085", "para_1086" ] }, { "title": "Adventist asserts Shafiq’s report showed tracking", "paragraphs": [ "para_1088", "para_1089", "para_1090", "para_1091", "para_1092", "para_1093", "para_1094", "para_1095", "para_1096", "para_1097", "para_1098" ] }, { "title": "37", "paragraphs": [ "para_1100", "para_1101", "para_1102", "para_1103", "para_1104", "para_1105", "para_1106", "para_1107" ] }, { "title": "Whether plaintiffs can prove Adventist in fact transmitted", "paragraphs": [] }, { "title": "URL links to HRA reports to Google and/or Meta also is a merits", "paragraphs": [ "para_1110", "para_1111", "para_1112", "para_1113", "para_1114", "para_1115", "para_1116", "para_1117", "para_1118", "para_1119", "para_1120", "para_1121", "para_1122" ] }, { "title": "Adventist to produce certain Google Analytic logs it had provided", "paragraphs": [ "para_1124", "para_1125", "para_1126", "para_1127", "para_1128", "para_1129", "para_1130" ] }, { "title": "38", "paragraphs": [ "para_1132", "para_1133", "para_1134", "para_1135", "para_1136" ] }, { "title": "Cal.App.5th at pp. 545–546 [appellate court analyzes denial", "paragraphs": [ "para_1138", "para_1139", "para_1140", "para_1141", "para_1142" ] }, { "title": "Adventist also contends the court correctly found “there", "paragraphs": [ "para_1144", "para_1145", "para_1146", "para_1147", "para_1148" ] }, { "title": "Accessed” ’ ”—other “ ‘specific events’ ” and “page URLs” from", "paragraphs": [ "para_1150", "para_1151", "para_1152", "para_1153", "para_1154", "para_1155", "para_1156", "para_1157", "para_1158", "para_1159", "para_1160" ] }, { "title": "39", "paragraphs": [ "para_1162", "para_1163" ] }, { "title": "The proposed HRA form subclass, however, includes only", "paragraphs": [ "para_1165", "para_1166", "para_1167", "para_1168", "para_1169", "para_1170" ] }, { "title": "HRA page would not be part of the subclass. Only individuals", "paragraphs": [ "para_1172", "para_1173", "para_1174", "para_1175", "para_1176", "para_1177", "para_1178", "para_1179", "para_1180", "para_1181", "para_1182", "para_1183", "para_1184", "para_1185", "para_1186" ] }, { "title": "40", "paragraphs": [ "para_1188", "para_1189", "para_1190", "para_1191" ] }, { "title": "As the court noted, “Liability under CMIA requires a", "paragraphs": [ "para_1193", "para_1194", "para_1195" ] }, { "title": "University of California v. Superior Court (2013) 220 Cal.App.4th", "paragraphs": [ "para_1197" ] }, { "title": "Illuminate Education, Inc. (2026) 19 Cal.5th 705, 723 (J.M.).)", "paragraphs": [] }, { "title": "Undoubtedly, the reports generated in response to a patient’s", "paragraphs": [ "para_1200", "para_1201", "para_1202", "para_1203", "para_1204", "para_1205", "para_1206", "para_1207", "para_1208", "para_1209", "para_1210", "para_1211", "para_1212" ] }, { "title": "18 Adventist argues that whether Adventist transferred", "paragraphs": [ "para_1214", "para_1215", "para_1216", "para_1217" ] }, { "title": "41", "paragraphs": [] }, { "title": "In essentially finding Adventist’s liability under CMIA", "paragraphs": [ "para_1220", "para_1221" ] }, { "title": "Shafiq’s report—“containing a [unique] string of numbers", "paragraphs": [ "para_1223" ] }, { "title": "Rather[,] it provides access to medication information.” In Vigil", "paragraphs": [ "para_1225" ] }, { "title": "(Vigil),19 the appellate court held “a breach of confidentiality", "paragraphs": [ "para_1227", "para_1228", "para_1229", "para_1230", "para_1231", "para_1232", "para_1233", "para_1234", "para_1235", "para_1236", "para_1237", "para_1238", "para_1239", "para_1240", "para_1241", "para_1242", "para_1243", "para_1244", "para_1245", "para_1246", "para_1247" ] }, { "title": "19 As we discuss, Vigil was disapproved of in J.M., supra, 19", "paragraphs": [ "para_1249" ] }, { "title": "42", "paragraphs": [ "para_1251", "para_1252", "para_1253" ] }, { "title": "Adventist’s disclosure of the link violated CMIA.21", "paragraphs": [] }, { "title": "After this matter was submitted for decision, our high", "paragraphs": [ "para_1256", "para_1257", "para_1258" ] }, { "title": "The court held “the primary inquiry with regard to breach", "paragraphs": [ "para_1260", "para_1261" ] }, { "title": "The court disapproved Vigil to the extent it held otherwise.22", "paragraphs": [] }, { "title": "(Ibid.)", "paragraphs": [] }, { "title": "20 Vigil involved a data breach where a former employee of", "paragraphs": [ "para_1265", "para_1266", "para_1267", "para_1268", "para_1269", "para_1270", "para_1271" ] }, { "title": "21 As plaintiffs note, whether a third party “actually viewed", "paragraphs": [ "para_1273", "para_1274", "para_1275", "para_1276" ] }, { "title": "22 As we discuss, the J.M. decision does not affect our", "paragraphs": [ "para_1278", "para_1279", "para_1280", "para_1281" ] }, { "title": "43", "paragraphs": [ "para_1283", "para_1284", "para_1285", "para_1286", "para_1287", "para_1288", "para_1289", "para_1290", "para_1291", "para_1292" ] }, { "title": "Google routinely collect, analyze[ ], and exploit users’ data", "paragraphs": [ "para_1294", "para_1295" ] }, { "title": "Subclass,” plaintiffs contend this element “is a common issue", "paragraphs": [ "para_1297", "para_1298", "para_1299", "para_1300" ] }, { "title": "Adventist argues plaintiffs never argued Meta’s and", "paragraphs": [] }, { "title": "Google’s algorithmic processing of data constituted “ ‘viewing’ ”", "paragraphs": [ "para_1303", "para_1304", "para_1305", "para_1306" ] }, { "title": "(J.M., supra, 19 Cal.5th at p. 723.) To the extent J.M. raises new", "paragraphs": [ "para_1308", "para_1309" ] }, { "title": "23 The court denied Adventist’s motion to strike Golbeck’s", "paragraphs": [ "para_1311" ] }, { "title": "44", "paragraphs": [ "para_1313", "para_1314", "para_1315" ] }, { "title": "We disagree. In their motion, plaintiffs argued that", "paragraphs": [ "para_1317", "para_1318", "para_1319" ] }, { "title": "Plaintiffs provided their support for that statement—as they did", "paragraphs": [ "para_1321", "para_1322", "para_1323", "para_1324", "para_1325", "para_1326", "para_1327", "para_1328" ] }, { "title": "Plaintiffs filed Golbeck’s report with their motion as a supporting", "paragraphs": [ "para_1330", "para_1331", "para_1332", "para_1333", "para_1334", "para_1335", "para_1336", "para_1337", "para_1338", "para_1339", "para_1340", "para_1341" ] }, { "title": "45", "paragraphs": [] }, { "title": "Adventist relies on Holden v. City of San Diego (2019) 43", "paragraphs": [] }, { "title": "Cal.App.5th 404. There, the court found a plaintiff was precluded", "paragraphs": [ "para_1345", "para_1346", "para_1347", "para_1348" ] }, { "title": "There, the plaintiff’s footnote stated the city had ignored a", "paragraphs": [ "para_1350", "para_1351", "para_1352" ] }, { "title": "(Ibid.) The plaintiff also failed to provide any substantive", "paragraphs": [ "para_1354", "para_1355", "para_1356", "para_1357", "para_1358", "para_1359", "para_1360", "para_1361" ] }, { "title": "Holden, plaintiffs’ opening and reply briefs on appeal", "paragraphs": [ "para_1363", "para_1364" ] }, { "title": "The court did not mention plaintiffs’ algorithm theory of", "paragraphs": [ "para_1366" ] }, { "title": "It thus did not determine if this element of plaintiffs’ CMIA claim", "paragraphs": [ "para_1368", "para_1369" ] }, { "title": "Adventist never argued plaintiffs’ algorithm theory would not", "paragraphs": [ "para_1371", "para_1372" ] }, { "title": "46", "paragraphs": [ "para_1374", "para_1375", "para_1376", "para_1377", "para_1378", "para_1379", "para_1380", "para_1381", "para_1382", "para_1383", "para_1384", "para_1385" ] }, { "title": "Plaintiffs’ algorithmic processing theory . . . and therefore cannot", "paragraphs": [ "para_1387", "para_1388", "para_1389", "para_1390", "para_1391" ] }, { "title": "We agree and conclude plaintiffs presented sufficient", "paragraphs": [ "para_1393", "para_1394", "para_1395" ] }, { "title": "In plaintiffs’ words, Golbeck’s report explained how Google", "paragraphs": [ "para_1397", "para_1398" ] }, { "title": "Golbeck’s report. She explained companies like Meta/Facebook", "paragraphs": [ "para_1400", "para_1401", "para_1402", "para_1403" ] }, { "title": "47", "paragraphs": [ "para_1405", "para_1406", "para_1407", "para_1408", "para_1409", "para_1410", "para_1411", "para_1412" ] }, { "title": "As we understand their theory, plaintiffs contend they", "paragraphs": [ "para_1414", "para_1415", "para_1416", "para_1417" ] }, { "title": "Adventist transmitted. That data then necessarily would have", "paragraphs": [ "para_1419", "para_1420", "para_1421", "para_1422", "para_1423", "para_1424", "para_1425", "para_1426" ] }, { "title": "But whether a third-party’s computer system’s assimilation of", "paragraphs": [ "para_1428", "para_1429", "para_1430", "para_1431", "para_1432", "para_1433", "para_1434" ] }, { "title": "48", "paragraphs": [] }, { "title": "In summary, we conclude the court’s reasoning did not", "paragraphs": [ "para_1437", "para_1438", "para_1439", "para_1440", "para_1441", "para_1442" ] }, { "title": "Plaintiffs’ ultimate theory was that the baseline", "paragraphs": [ "para_1444", "para_1445", "para_1446", "para_1447", "para_1448", "para_1449", "para_1450", "para_1451", "para_1452", "para_1453", "para_1454", "para_1455", "para_1456" ] }, { "title": "Shafiq stated Adventist “shared at least the following types", "paragraphs": [ "para_1458", "para_1459", "para_1460" ] }, { "title": "URLs from Adventist’s public website that included query strings", "paragraphs": [ "para_1462", "para_1463", "para_1464" ] }, { "title": "URL example showed a search at “doctors.adventisthealth.org”", "paragraphs": [] }, { "title": "49", "paragraphs": [ "para_1467", "para_1468" ] }, { "title": "The trial court noted those URL examples included search", "paragraphs": [ "para_1470", "para_1471", "para_1472", "para_1473" ] }, { "title": "The court noted the first page title example appeared to contain", "paragraphs": [ "para_1475", "para_1476", "para_1477", "para_1478" ] }, { "title": "Cousin II, supra, 702 F.Supp.3d at p. 976.) The court further", "paragraphs": [ "para_1480", "para_1481", "para_1482" ] }, { "title": "Scheduling Confirmation,” ’ ” “ ‘patient-assessment-report,’ ”", "paragraphs": [ "para_1484", "para_1485" ] }, { "title": "Webinar Pageview,’ ” but he did not “say these events contain", "paragraphs": [ "para_1487", "para_1488", "para_1489" ] }, { "title": "The court noted that although Shafiq gave examples of", "paragraphs": [] }, { "title": "URLs “containing patients’ search terms,” his report “define[d]", "paragraphs": [ "para_1492" ] }, { "title": "25 The page title “MyAdventistHealth Patient Portal” appears", "paragraphs": [ "para_1494", "para_1495", "para_1496" ] }, { "title": "50", "paragraphs": [ "para_1498", "para_1499", "para_1500" ] }, { "title": "750 F.3d at pp. 1108–1109.) Accordingly, because one patient’s", "paragraphs": [ "para_1502", "para_1503", "para_1504", "para_1505", "para_1506", "para_1507" ] }, { "title": "Plaintiffs do not dispute this reasoning as applied to the", "paragraphs": [ "para_1509", "para_1510", "para_1511", "para_1512", "para_1513", "para_1514", "para_1515", "para_1516", "para_1517", "para_1518", "para_1519" ] }, { "title": "26 The full page URL in the patient portal for this example", "paragraphs": [ "para_1521", "para_1522", "para_1523", "para_1524", "para_1525", "para_1526" ] }, { "title": "DOCUMENT_ID/download.”", "paragraphs": [] }, { "title": "51", "paragraphs": [ "para_1529", "para_1530", "para_1531", "para_1532", "para_1533", "para_1534", "para_1535", "para_1536", "para_1537", "para_1538" ] }, { "title": "As plaintiffs note, unlike the public website, none of", "paragraphs": [ "para_1540", "para_1541", "para_1542", "para_1543", "para_1544", "para_1545", "para_1546", "para_1547", "para_1548", "para_1549", "para_1550", "para_1551", "para_1552" ] }, { "title": "27 These descriptive terms reflected the tabs or buttons within", "paragraphs": [ "para_1554", "para_1555", "para_1556", "para_1557" ] }, { "title": "52", "paragraphs": [ "para_1559", "para_1560" ] }, { "title": "First, we do not interpret the court’s reference to “events”", "paragraphs": [ "para_1562", "para_1563", "para_1564", "para_1565", "para_1566", "para_1567", "para_1568", "para_1569", "para_1570", "para_1571", "para_1572", "para_1573", "para_1574", "para_1575", "para_1576", "para_1577", "para_1578", "para_1579", "para_1580" ] }, { "title": "We do not disagree that the different descriptive terms within", "paragraphs": [ "para_1582", "para_1583" ] }, { "title": "Nevertheless, those descriptive terms—as we noted—", "paragraphs": [ "para_1585", "para_1586", "para_1587", "para_1588" ] }, { "title": "53", "paragraphs": [ "para_1590", "para_1591", "para_1592", "para_1593", "para_1594", "para_1595", "para_1596" ] }, { "title": "1109.)28 For purposes of determining whether the URLs", "paragraphs": [ "para_1598" ] }, { "title": "CIPA, it thus would not seem to matter whether the descriptive", "paragraphs": [ "para_1600", "para_1601", "para_1602", "para_1603" ] }, { "title": "28 For Adventist’s public website, in contrast, the URL", "paragraphs": [ "para_1605", "para_1606" ] }, { "title": "Adventist and not simply browsing the website. For the patient", "paragraphs": [ "para_1608", "para_1609", "para_1610", "para_1611", "para_1612", "para_1613", "para_1614", "para_1615", "para_1616", "para_1617", "para_1618", "para_1619" ] }, { "title": "54", "paragraphs": [ "para_1621", "para_1622", "para_1623", "para_1624", "para_1625", "para_1626" ] }, { "title": "In any event, plaintiffs argue—as they did below—that", "paragraphs": [ "para_1628", "para_1629", "para_1630", "para_1631", "para_1632", "para_1633", "para_1634" ] }, { "title": "Medical Center (W.D.Wash. 2024) 733 F.Supp.3d 1072, 1081", "paragraphs": [] }, { "title": "(Nienaber) [“transmission of information submitted to a private", "paragraphs": [ "para_1637", "para_1638", "para_1639", "para_1640", "para_1641" ] }, { "title": "29 Griffith v. TikTok, Inc. (C.D.Cal., Sept. 9, 2024, No. 5:23-cv-", "paragraphs": [] }, { "title": "00964-SB-E) 2024 WL 4308813, relied on by Adventist, is thus", "paragraphs": [ "para_1644", "para_1645", "para_1646", "para_1647", "para_1648", "para_1649", "para_1650" ] }, { "title": "55", "paragraphs": [ "para_1652", "para_1653" ] }, { "title": "Plaintiffs assert that—“[a]t the merits stage”—their expert", "paragraphs": [ "para_1655", "para_1656", "para_1657", "para_1658" ] }, { "title": "The court found plaintiffs “did not submit evidence that", "paragraphs": [ "para_1660", "para_1661", "para_1662", "para_1663", "para_1664", "para_1665", "para_1666", "para_1667", "para_1668", "para_1669" ] }, { "title": "Adventist the user is a verified patient who wants to log into his", "paragraphs": [ "para_1671" ] }, { "title": "F.Supp.3d at p. 795 [construing “log-in buttons” to patient portal", "paragraphs": [ "para_1673", "para_1674", "para_1675", "para_1676", "para_1677" ] }, { "title": "30 Again, the court did not find plaintiffs failed to show", "paragraphs": [ "para_1679", "para_1680", "para_1681" ] }, { "title": "56", "paragraphs": [ "para_1683", "para_1684", "para_1685", "para_1686" ] }, { "title": "115 Cal.App.5th at pp. 545–546; Knapp, supra, 195 Cal.App.4th", "paragraphs": [ "para_1688", "para_1689", "para_1690" ] }, { "title": "CMIA claim was subject to common proof", "paragraphs": [ "para_1692" ] }, { "title": "We cannot say the same for plaintiffs’ CMIA claim. The", "paragraphs": [ "para_1694", "para_1695", "para_1696", "para_1697", "para_1698", "para_1699", "para_1700", "para_1701", "para_1702", "para_1703", "para_1704", "para_1705", "para_1706", "para_1707" ] }, { "title": "Although patients engaged only in health-related activities", "paragraphs": [ "para_1709", "para_1710", "para_1711", "para_1712" ] }, { "title": "57", "paragraphs": [ "para_1714", "para_1715", "para_1716", "para_1717", "para_1718" ] }, { "title": "For purposes of showing Adventist transmitted “medical", "paragraphs": [ "para_1720", "para_1721", "para_1722", "para_1723", "para_1724", "para_1725", "para_1726" ] }, { "title": "But a URL revealing that a patient “download[ed]” an", "paragraphs": [ "para_1728", "para_1729", "para_1730", "para_1731", "para_1732", "para_1733" ] }, { "title": "2025) 349 F.R.D. 557, on which plaintiffs rely. There, a court", "paragraphs": [ "para_1735", "para_1736", "para_1737", "para_1738", "para_1739", "para_1740", "para_1741", "para_1742", "para_1743", "para_1744" ] }, { "title": "58", "paragraphs": [ "para_1746", "para_1747", "para_1748", "para_1749", "para_1750", "para_1751" ] }, { "title": "818–819 [denying motion to dismiss CMIA claim where plaintiff", "paragraphs": [ "para_1753", "para_1754", "para_1755", "para_1756" ] }, { "title": "While we agree that whether or not the descriptive URLs", "paragraphs": [ "para_1758", "para_1759", "para_1760", "para_1761", "para_1762", "para_1763", "para_1764", "para_1765" ] }, { "title": "F.Supp.3d at p. 793; Nienaber, supra, 733 F.Supp.3d at p. 1081.)", "paragraphs": [] }, { "title": "Patient status is not “medical information” protected under", "paragraphs": [ "para_1768", "para_1769" ] }, { "title": "32 The Health Insurance Portability and Accountability Act", "paragraphs": [] }, { "title": "(HIPAA) (42 U.S.C. § 1320 et seq.). See 45 C.F.R. § 160.103", "paragraphs": [] }, { "title": "(2026) (defining PHI under HIPAA as “individually identifiable", "paragraphs": [ "para_1773", "para_1774", "para_1775" ] }, { "title": "59", "paragraphs": [] }, { "title": "CMIA, however. (Eisenhower, supra, 226 Cal.App.4th at pp. 435–", "paragraphs": [] }, { "title": "436 [fact individual “may have been a patient at a hospital at", "paragraphs": [ "para_1779", "para_1780", "para_1781", "para_1782" ] }, { "title": "We also reject plaintiffs’ contention that the court did not", "paragraphs": [ "para_1784", "para_1785", "para_1786" ] }, { "title": "Code. The court noted Shafiq’s report’s references to “ ‘sensitive", "paragraphs": [ "para_1788", "para_1789" ] }, { "title": "Shafiq’s analysis aggregate[d] different types of information—", "paragraphs": [ "para_1791", "para_1792", "para_1793", "para_1794", "para_1795", "para_1796", "para_1797", "para_1798", "para_1799", "para_1800", "para_1801" ] }, { "title": "Accordingly, we conclude substantial evidence supported the", "paragraphs": [ "para_1803", "para_1804", "para_1805" ] }, { "title": "60", "paragraphs": [] }, { "title": "4. The superiority and manageability of the subclasses", "paragraphs": [] }, { "title": "The court also denied plaintiffs’ motion for class", "paragraphs": [ "para_1809", "para_1810", "para_1811", "para_1812", "para_1813", "para_1814", "para_1815", "para_1816", "para_1817", "para_1818" ] }, { "title": "121.) “In certifying a class action, the court must also conclude", "paragraphs": [ "para_1820", "para_1821" ] }, { "title": "(Duran, supra, 59 Cal.4th at pp. 28–29; id. at pp. 32–33 [trial", "paragraphs": [ "para_1823", "para_1824" ] }, { "title": "The court found plaintiffs did not show the superiority", "paragraphs": [ "para_1826", "para_1827", "para_1828" ] }, { "title": "(2) did not “state the value of the individual claims.”", "paragraphs": [] }, { "title": "In their reply, plaintiffs asserted they were seeking", "paragraphs": [ "para_1831", "para_1832", "para_1833", "para_1834", "para_1835", "para_1836" ] }, { "title": "61", "paragraphs": [ "para_1838", "para_1839" ] }, { "title": "CIPA (Pen. Code, § 637.2), $2,500 in statutory damages under", "paragraphs": [] }, { "title": "CMIA (Civ. Code, § 56.36), and estimated damages under the", "paragraphs": [] }, { "title": "UCL “to be in the range of $200.”", "paragraphs": [] }, { "title": "We aren’t sure what other evidence plaintiffs could have", "paragraphs": [ "para_1844", "para_1845", "para_1846", "para_1847", "para_1848", "para_1849", "para_1850", "para_1851", "para_1852", "para_1853", "para_1854", "para_1855", "para_1856", "para_1857", "para_1858", "para_1859", "para_1860", "para_1861", "para_1862", "para_1863", "para_1864" ] }, { "title": "33 Shafiq was paid $500 per hour, and Golbeck was paid", "paragraphs": [ "para_1866" ] }, { "title": "62", "paragraphs": [ "para_1868", "para_1869", "para_1870", "para_1871", "para_1872", "para_1873", "para_1874" ] }, { "title": "Accordingly, we conclude plaintiffs sufficiently demonstrated", "paragraphs": [ "para_1876", "para_1877" ] }, { "title": "As for the manageability question, the court primarily", "paragraphs": [ "para_1879" ] }, { "title": "As to the two relevant subclasses, the court found plaintiffs failed", "paragraphs": [ "para_1881", "para_1882", "para_1883", "para_1884", "para_1885", "para_1886", "para_1887", "para_1888", "para_1889" ] }, { "title": "HRA reports under the CMIA. The issue the court identified", "paragraphs": [ "para_1891" ] }, { "title": "115 Cal.App.5th at pp. 545–546 [appellate court considers only", "paragraphs": [ "para_1893" ] }, { "title": "As for the patient portal subclass, the court stated", "paragraphs": [ "para_1895", "para_1896", "para_1897" ] }, { "title": "63", "paragraphs": [ "para_1899", "para_1900", "para_1901", "para_1902", "para_1903", "para_1904", "para_1905", "para_1906", "para_1907", "para_1908", "para_1909", "para_1910", "para_1911", "para_1912" ] }, { "title": "As we have discussed, although this may have been", "paragraphs": [ "para_1914", "para_1915", "para_1916", "para_1917" ] }, { "title": "Adventist. As we explained, that some URLs conveyed more", "paragraphs": [ "para_1919", "para_1920", "para_1921", "para_1922", "para_1923", "para_1924", "para_1925", "para_1926", "para_1927" ] }, { "title": "64", "paragraphs": [ "para_1929", "para_1930" ] }, { "title": "In sum, we conclude the record does not support finding", "paragraphs": [ "para_1932", "para_1933", "para_1934" ] }, { "title": "5. The trial court did not abuse its discretion in finding", "paragraphs": [ "para_1936", "para_1937" ] }, { "title": "As the trial court noted, plaintiffs’ CIPA claim in their", "paragraphs": [] }, { "title": "TAC alleged Adventist violated section 632(a) when it “used a", "paragraphs": [ "para_1940", "para_1941" ] }, { "title": "The court however, found plaintiffs had “dropped any attempt to", "paragraphs": [ "para_1943", "para_1944", "para_1945", "para_1946", "para_1947", "para_1948", "para_1949" ] }, { "title": "Plaintiffs contend the court erred. They assert their", "paragraphs": [ "para_1951", "para_1952", "para_1953", "para_1954", "para_1955", "para_1956", "para_1957", "para_1958" ] }, { "title": "65", "paragraphs": [ "para_1960" ] }, { "title": "647 F.Supp.3d at p. 799.) Plaintiffs also contend Adventist", "paragraphs": [ "para_1962", "para_1963", "para_1964", "para_1965", "para_1966", "para_1967", "para_1968", "para_1969" ] }, { "title": "01277-BAS-KSC) 2021 WL 1102423, plaintiffs added italics.)", "paragraphs": [] }, { "title": "Plaintiffs bore the burden on their motion for class", "paragraphs": [ "para_1972", "para_1973", "para_1974", "para_1975", "para_1976", "para_1977" ] }, { "title": "CIPA claim—for which they cited only section 631—plaintiffs", "paragraphs": [ "para_1979", "para_1980", "para_1981", "para_1982" ] }, { "title": "Mendell in discussing the issue of whether class members had", "paragraphs": [ "para_1984", "para_1985", "para_1986", "para_1987" ] }, { "title": "Finally, we do not find plaintiffs’ belated citation to", "paragraphs": [ "para_1989" ] }, { "title": "66", "paragraphs": [ "para_1991", "para_1992", "para_1993", "para_1994", "para_1995" ] }, { "title": "34 Adventist’s response to plaintiffs’ trial plan noted plaintiffs’", "paragraphs": [ "para_1997", "para_1998", "para_1999", "para_2000", "para_2001" ] }, { "title": "CIPA claim as somehow agreeing that plaintiffs’ motion raised", "paragraphs": [ "para_2003" ] }, { "title": "67", "paragraphs": [] }, { "title": "DISPOSITION", "paragraphs": [] }, { "title": "We affirm the court’s order finding plaintiffs forfeited their", "paragraphs": [ "para_2007", "para_2008", "para_2009", "para_2010", "para_2011", "para_2012", "para_2013" ] }, { "title": "We concur:", "paragraphs": [ "para_2015", "para_2016" ] }, { "title": "Filed 8/24/26", "paragraphs": [] }, { "title": "CERTIFIED FOR PUBLICATION", "paragraphs": [] }, { "title": "IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA", "paragraphs": [] }, { "title": "SECOND APPELLATE DISTRICT", "paragraphs": [] }, { "title": "DIVISION THREE", "paragraphs": [ "para_2022", "para_2023", "para_2024" ] }, { "title": "ADVENTIST HEALTH SYSTEM/", "paragraphs": [ "para_2026", "para_2027" ] }, { "title": "B344951", "paragraphs": [] }, { "title": "Los Angeles County", "paragraphs": [] }, { "title": "Super. Ct. No. 22STCV36304", "paragraphs": [] }, { "title": "ORDER CERTIFYING", "paragraphs": [] }, { "title": "FOR PUBLICATION", "paragraphs": [ "para_2033" ] }, { "title": "JUDGMENT]", "paragraphs": [] }, { "title": "THE COURT:", "paragraphs": [ "para_2036", "para_2037", "para_2038", "para_2039", "para_2040", "para_2041" ] } ], "paragraphs": [ { "text": "Filed 7/24/26; Certified for Publication 8/24/26 (order attached)", "paragraph_id": "para_1" }, { "text": "IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA", "paragraph_id": "para_2" }, { "text": "SECOND APPELLATE DISTRICT", "paragraph_id": "para_3" }, { "text": "DIVISION THREE", "paragraph_id": "para_4" }, { "text": "JAMES DOE et al.,", "paragraph_id": "para_5" }, { "text": "Plaintiffs and Appellants,", "paragraph_id": "para_6" }, { "text": "v.", "paragraph_id": "para_7" }, { "text": "ADVENTIST HEALTH SYSTEM/", "paragraph_id": "para_8" }, { "text": "WEST,", "paragraph_id": "para_9" }, { "text": "Defendant and Respondent.", "paragraph_id": "para_10" }, { "text": "B344951", "paragraph_id": "para_11" }, { "text": "Los Angeles County", "paragraph_id": "para_12" }, { "text": "Super. Ct. No.", "paragraph_id": "para_13" }, { "text": "22STCV36304", "paragraph_id": "para_14" }, { "text": "APPEAL from an order of the Superior Court of", "paragraph_id": "para_15" }, { "text": "Los Angeles County, Laura A. Seigle, Judge. Affirmed in part,", "paragraph_id": "para_16" }, { "text": "reversed in part, and remanded.", "paragraph_id": "para_17" }, { "text": "Caddell & Chapman, Michael A. Caddell, Cynthia B.", "paragraph_id": "para_18" }, { "text": "Chapman, Amy E. Tabor; Ahmad, Zavitsanos & Mensing, Foster", "paragraph_id": "para_19" }, { "text": "C. Johnson, Kelsi White; LippSmith, Graham B. LippSmith,", "paragraph_id": "para_20" }, { "text": "MaryBeth LippSmith and Jaclyn L. Anderson for Plaintiffs", "paragraph_id": "para_21" }, { "text": "and Appellants.", "paragraph_id": "para_22" }, { "text": "Seyfarth Shaw, Kristine Rinella Argentine and Sierra J.", "paragraph_id": "para_23" }, { "text": "Chinn-Liu for Defendant and Respondent", "paragraph_id": "para_24" }, { "text": "_________________________", "paragraph_id": "para_25" }, { "text": "2", "paragraph_id": "para_26" }, { "text": "Plaintiffs—four Does who are or were patients of defendant", "paragraph_id": "para_27" }, { "text": "Adventist Health System/West (Adventist)—brought this", "paragraph_id": "para_28" }, { "text": "putative class action asserting claims against Adventist for,", "paragraph_id": "para_29" }, { "text": "among others, violations of the California Invasion of Privacy", "paragraph_id": "para_30" }, { "text": "Act (CIPA) (Pen. Code, §§ 630 et seq.)1 and the California", "paragraph_id": "para_31" }, { "text": "Confidentiality of Medical Information Act (CMIA). Plaintiffs", "paragraph_id": "para_32" }, { "text": "alleged Adventist shared (without their knowledge) their—and", "paragraph_id": "para_33" }, { "text": "similarly situated patients’—personal information with third", "paragraph_id": "para_34" }, { "text": "parties through web-based tracking technologies—the Meta Pixel", "paragraph_id": "para_35" }, { "text": "and/or Google Analytics—installed on Adventist’s websites,", "paragraph_id": "para_36" }, { "text": "including its public health risk assessment (HRA) website", "paragraph_id": "para_37" }, { "text": "and its password-protected patient portal. The tools allegedly", "paragraph_id": "para_38" }, { "text": "tracked site users’ activities, collected their data, and sent", "paragraph_id": "para_39" }, { "text": "the information—including personally identifiable information,", "paragraph_id": "para_40" }, { "text": "the contents of users’ communications with Adventist, and", "paragraph_id": "para_41" }, { "text": "protected health information (PHI)—to Facebook (Meta)", "paragraph_id": "para_42" }, { "text": "and Google, who shared the data with advertisers.", "paragraph_id": "para_43" }, { "text": "Plaintiffs sought to certify a class consisting of Adventist", "paragraph_id": "para_44" }, { "text": "patients with California addresses who—for the period from", "paragraph_id": "para_45" }, { "text": "November 16, 2017 to April 30, 2024—“used the Adventist", "paragraph_id": "para_46" }, { "text": "website or patient portal to exchange communications with", "paragraph_id": "para_47" }, { "text": "Adventist . . . for researching medical conditions or treatments,", "paragraph_id": "para_48" }, { "text": "finding a physician, making an appointment, or submitting a", "paragraph_id": "para_49" }, { "text": "health risk assessment form” (general class), and four subclasses.", "paragraph_id": "para_50" }, { "text": "Only two subclasses are relevant to this appeal: (1) the patient", "paragraph_id": "para_51" }, { "text": "portal subclass, consisting of all class members “who were", "paragraph_id": "para_52" }, { "text": "logged into Adventist[’s] . . . patient portal up until May 2023”;", "paragraph_id": "para_53" }, { "text": "1 Undesignated statutory references are to the Penal Code.", "paragraph_id": "para_54" }, { "text": "3", "paragraph_id": "para_55" }, { "text": "and (2) the HRA form subclass, consisting of all class members", "paragraph_id": "para_56" }, { "text": "“who submitted an online [HRA] form to Adventist.”", "paragraph_id": "para_57" }, { "text": "The trial court denied plaintiffs’ motion in its entirety.", "paragraph_id": "para_58" }, { "text": "Plaintiffs appeal from the trial court’s denial of class certification", "paragraph_id": "para_59" }, { "text": "of the patient portal and HRA form subclasses only. The trial", "paragraph_id": "para_60" }, { "text": "court concluded, as relevant here, plaintiffs failed to establish:", "paragraph_id": "para_61" }, { "text": "(1) the patient portal class was ascertainable, (2) common issues", "paragraph_id": "para_62" }, { "text": "predominated over individual ones for both subclasses, and", "paragraph_id": "para_63" }, { "text": "(3) the superiority and manageability of a class action. The", "paragraph_id": "para_64" }, { "text": "court also found plaintiffs had “dropped any attempt to certify", "paragraph_id": "para_65" }, { "text": "a class” for violations of CIPA under section 632.", "paragraph_id": "para_66" }, { "text": "The court primarily reasoned that determining whether", "paragraph_id": "para_67" }, { "text": "the data the tracking technologies sent to third parties contained", "paragraph_id": "para_68" }, { "text": "the “contents” of users’ communications (CIPA) or users’ “medical", "paragraph_id": "para_69" }, { "text": "information” (CMIA) would require an individual inquiry into the", "paragraph_id": "para_70" }, { "text": "information transmitted for each user. The court also reasoned", "paragraph_id": "para_71" }, { "text": "that plaintiffs had not explained how to ascertain which of the", "paragraph_id": "para_72" }, { "text": "patients who had logged into the patient portal had engaged in", "paragraph_id": "para_73" }, { "text": "activities that resulted in transmission of actionable information.", "paragraph_id": "para_74" }, { "text": "Plaintiffs challenge the rulings, arguing the undisputed record", "paragraph_id": "para_75" }, { "text": "evidence showed the patient portal class was ascertainable;", "paragraph_id": "para_76" }, { "text": "the court misunderstood the record, misapplied the definition", "paragraph_id": "para_77" }, { "text": "of “medical information,” ignored plaintiffs’ theory of liability,", "paragraph_id": "para_78" }, { "text": "and prematurely determined the merits in finding common issues", "paragraph_id": "para_79" }, { "text": "did not predominate; and they demonstrated the manageability of", "paragraph_id": "para_80" }, { "text": "the two subclasses and superiority of a class action to individual", "paragraph_id": "para_81" }, { "text": "trials. We reverse the court’s denial of class certification of the", "paragraph_id": "para_82" }, { "text": "HRA form subclass and partially reverse as to the patient portal", "paragraph_id": "para_83" }, { "text": "subclass.", "paragraph_id": "para_84" }, { "text": "4", "paragraph_id": "para_85" }, { "text": "BACKGROUND", "paragraph_id": "para_86" }, { "text": "1. Background on tracking technologies2", "paragraph_id": "para_87" }, { "text": "A web browser communicates with a website’s servers to", "paragraph_id": "para_88" }, { "text": "download and display the website’s content on the user’s screen.", "paragraph_id": "para_89" }, { "text": "To do so, the web browser sends HTTP (hypertext transfer", "paragraph_id": "para_90" }, { "text": "protocol) requests to download files from the website’s servers.3", "paragraph_id": "para_91" }, { "text": "The HTTP request “contains an IP address, which [is] an", "paragraph_id": "para_92" }, { "text": "identifier assigned to any Internet-connected device,” as well", "paragraph_id": "para_93" }, { "text": "as “a URL, which represents the address of the file that a", "paragraph_id": "para_94" }, { "text": "web browser is requesting from a web server,” and the “[u]ser", "paragraph_id": "para_95" }, { "text": "[a]gent,” which “identifies the details of the operating system", "paragraph_id": "para_96" }, { "text": "and web browser.” “A URL contains the server’s domain name,", "paragraph_id": "para_97" }, { "text": "the path of the file located on the server that is being requested,", "paragraph_id": "para_98" }, { "text": "and a list of query parameters that contain additional", "paragraph_id": "para_99" }, { "text": "information being sent from a web browser to a web server.”", "paragraph_id": "para_100" }, { "text": "“Cookies” are “used by web servers to keep track of past", "paragraph_id": "para_101" }, { "text": "interactions with the web browser.” Cookies can store", "paragraph_id": "para_102" }, { "text": "“identifiers” “used to identify a specific user account or a specific", "paragraph_id": "para_103" }, { "text": "device/browser.” “Third-party cookies”—set by a third-party", "paragraph_id": "para_104" }, { "text": "server—“allow cross-site tracking of a user across different", "paragraph_id": "para_105" }, { "text": "websites.” On the other hand, “first-party cookies”—set by the", "paragraph_id": "para_106" }, { "text": "first-party server—“allow same-site tracking of a user on a", "paragraph_id": "para_107" }, { "text": "particular website.”", "paragraph_id": "para_108" }, { "text": "2 We glean most of this background from the report of", "paragraph_id": "para_109" }, { "text": "plaintiffs’ expert Dr. Zubair Shafiq. Quoted material omits", "paragraph_id": "para_110" }, { "text": "footnote references.", "paragraph_id": "para_111" }, { "text": "3 The first HTTP request sent “is typically for the Hypertext", "paragraph_id": "para_112" }, { "text": "Markup Language (HTML) file.” The HTML file contains the", "paragraph_id": "para_113" }, { "text": "source code or content of a webpage.", "paragraph_id": "para_114" }, { "text": "5", "paragraph_id": "para_115" }, { "text": "A “tracking pixel”—such as the Meta Pixel and Google", "paragraph_id": "para_116" }, { "text": "Analytics—is a piece of code or image “that is used to track", "paragraph_id": "para_117" }, { "text": "users’ browsing activity on the web.” “When a tracking pixel is", "paragraph_id": "para_118" }, { "text": "installed on a website by a first party, it allows a third party (i.e.,", "paragraph_id": "para_119" }, { "text": "a domain that is different from the first-party website that a user", "paragraph_id": "para_120" }, { "text": "navigates to) to track a user across different websites where the", "paragraph_id": "para_121" }, { "text": "tracking pixel is installed. Put simply, a tracking pixel allows", "paragraph_id": "para_122" }, { "text": "a third party to tell that a user visited website A at time A,", "paragraph_id": "para_123" }, { "text": "website B at time B, and so on.” Tracking pixels “also ghostwrite", "paragraph_id": "para_124" }, { "text": "first-party cookies on the visited website’s domain to circumvent", "paragraph_id": "para_125" }, { "text": "third-party cookie blocking.”", "paragraph_id": "para_126" }, { "text": "A tracking pixel collects “two types of data”—“identifiers”", "paragraph_id": "para_127" }, { "text": "and “browsing activity”—“in HTTP requests from a user’s web", "paragraph_id": "para_128" }, { "text": "browser to the tracking pixel’s web server.” “Identifiers” are", "paragraph_id": "para_129" }, { "text": "collected through cookies stored by the web browser, and “the", "paragraph_id": "para_130" }, { "text": "combination of IP address and user agent in the transmission", "paragraph_id": "para_131" }, { "text": "from a user’s web browser to the pixel’s web server.” Identifiers", "paragraph_id": "para_132" }, { "text": "stored in cookies can include “account identifiers”—“that", "paragraph_id": "para_133" }, { "text": "uniquely identify the user visiting the website” akin to a driver’s", "paragraph_id": "para_134" }, { "text": "license number—and “device identifiers”—“that uniquely identify", "paragraph_id": "para_135" }, { "text": "the user’s device” akin to a vehicle’s license plate number.", "paragraph_id": "para_136" }, { "text": "The combination of IP address and user agent (or other browser", "paragraph_id": "para_137" }, { "text": "or device information) “contains sufficiently distinguishing", "paragraph_id": "para_138" }, { "text": "information” that can be “used as a unique identifier,” known", "paragraph_id": "para_139" }, { "text": "as “fingerprinting.”", "paragraph_id": "para_140" }, { "text": "A website may “install tracking pixels from third-party", "paragraph_id": "para_141" }, { "text": "companies such as Google and Meta to optimize ad campaigns", "paragraph_id": "para_142" }, { "text": "that they run on Google . . . and Meta.” Thus, “a website may", "paragraph_id": "para_143" }, { "text": "install and purposefully configure tracking pixels in its HTML", "paragraph_id": "para_144" }, { "text": "source code to share information about specific actions a user", "paragraph_id": "para_145" }, { "text": "6", "paragraph_id": "para_146" }, { "text": "takes on their website with the tracking pixel’s server.” For", "paragraph_id": "para_147" }, { "text": "example, these tracking technologies can track “events,” such as", "paragraph_id": "para_148" }, { "text": "when a “button” is clicked, a form is submitted, or a page is", "paragraph_id": "para_149" }, { "text": "viewed on a website.", "paragraph_id": "para_150" }, { "text": "Google describes Google Analytics as “ ‘a platform that", "paragraph_id": "para_151" }, { "text": "collects data from your websites and apps to create reports", "paragraph_id": "para_152" }, { "text": "that provide insights into your business.’ ” “ ‘Every time a user", "paragraph_id": "para_153" }, { "text": "visits a webpage, the tracking code will collect pseudonymous", "paragraph_id": "para_154" }, { "text": "information about how that user interacted with the page.’ ”", "paragraph_id": "para_155" }, { "text": "Google Analytics “uses both first-party and third-party cookies”", "paragraph_id": "para_156" }, { "text": "—that store account and device identifiers—“to track users on", "paragraph_id": "para_157" }, { "text": "and across different websites.” It also has a feature that “allows", "paragraph_id": "para_158" }, { "text": "Google to link or associate the data with Google accounts of users", "paragraph_id": "para_159" }, { "text": "who have signed into their Google accounts.” Meta describes", "paragraph_id": "para_160" }, { "text": "Meta Pixel (formerly called Facebook Pixel) as “a piece of code", "paragraph_id": "para_161" }, { "text": "on your website that can help you better understand the", "paragraph_id": "para_162" }, { "text": "effectiveness of your advertising and the actions people take", "paragraph_id": "para_163" }, { "text": "on your site, like visiting a page or adding an item to their cart.", "paragraph_id": "para_164" }, { "text": "You’ll also be able to see when customers took an action after", "paragraph_id": "para_165" }, { "text": "seeing your ad on Facebook and Instagram.” By default, the", "paragraph_id": "para_166" }, { "text": "Meta Pixel “will track URLs visited, domains visited, and the", "paragraph_id": "para_167" }, { "text": "devices [users] use.” The Meta Pixel also uses first- and third-", "paragraph_id": "para_168" }, { "text": "party cookies that store account and device identifiers to track", "paragraph_id": "para_169" }, { "text": "users across different websites. For example, the Meta Pixel—", "paragraph_id": "para_170" }, { "text": "through cookies—stores a user’s device identifier and Facebook", "paragraph_id": "para_171" }, { "text": "account identifier and “collects them on the facebook.com", "paragraph_id": "para_172" }, { "text": "domain.”", "paragraph_id": "para_173" }, { "text": "In Adventist’s words, these tracking technologies “cause", "paragraph_id": "para_174" }, { "text": "different networks (i.e., the Adventist Health server and Google/", "paragraph_id": "para_175" }, { "text": "Meta servers) to communicate with each other, causing certain", "paragraph_id": "para_176" }, { "text": "7", "paragraph_id": "para_177" }, { "text": "categories of data to be transmitted to Google/Meta.” The", "paragraph_id": "para_178" }, { "text": "“ ‘baseline data’ ” shared consists of first-party cookie identifiers,", "paragraph_id": "para_179" }, { "text": "URLs, IP addresses—whether complete or partially masked—", "paragraph_id": "para_180" }, { "text": "and user agent data.", "paragraph_id": "para_181" }, { "text": "2. Adventist’s use of tracking technologies", "paragraph_id": "para_182" }, { "text": "Adventist is a nonprofit, faith-based healthcare system", "paragraph_id": "para_183" }, { "text": "serving communities on the west coast and Hawaii. Between", "paragraph_id": "para_184" }, { "text": "2017 and 2024, Adventist installed the Meta Pixel and/or Google", "paragraph_id": "para_185" }, { "text": "Analytics on its websites, including its public-facing website at", "paragraph_id": "para_186" }, { "text": "adventisthealth.org, its patient portal at myadventisthealth.org,", "paragraph_id": "para_187" }, { "text": "and its public HRA website at adventisthealthhra.org.", "paragraph_id": "para_188" }, { "text": "Adventist placed advertisements on Facebook and other", "paragraph_id": "para_189" }, { "text": "digital platforms, encouraging potential patients to click on a", "paragraph_id": "para_190" }, { "text": "link where they could, for example, fill out an HRA form. The", "paragraph_id": "para_191" }, { "text": "ad links also could lead users to Adventist’s website or an ad", "paragraph_id": "para_192" }, { "text": "campaign landing page where they could, for example, request", "paragraph_id": "para_193" }, { "text": "an appointment, attend a webinar, or, again, fill out an HRA", "paragraph_id": "para_194" }, { "text": "form. Adventist used the tracking technologies in connection", "paragraph_id": "para_195" }, { "text": "with its online marketing efforts “to understand how many users", "paragraph_id": "para_196" }, { "text": "[we]re clicking on” a particular “ad and getting to [Adventist’s]", "paragraph_id": "para_197" }, { "text": "site so that [Adventist could] optimize the best performing ads.”", "paragraph_id": "para_198" }, { "text": "In other words, the tracking pixels enabled Adventist to", "paragraph_id": "para_199" }, { "text": "determine if an ad campaign was resulting in “conversions”—", "paragraph_id": "para_200" }, { "text": "users interacting with the website through pageviews, clicks,", "paragraph_id": "para_201" }, { "text": "form submissions (including HRAs), downloads, etc. Adventist", "paragraph_id": "para_202" }, { "text": "installed Google Analytics on its patient portal to gain “valuable", "paragraph_id": "para_203" }, { "text": "insight,” rather than for marketing purposes, however.", "paragraph_id": "para_204" }, { "text": "a. The patient portal", "paragraph_id": "para_205" }, { "text": "The patient portal—hosted by Adventist’s business", "paragraph_id": "para_206" }, { "text": "associate, Cerner—is a password-protected website where, among", "paragraph_id": "para_207" }, { "text": "8", "paragraph_id": "para_208" }, { "text": "other things, Adventist patients can access information from", "paragraph_id": "para_209" }, { "text": "their electronic health record, including test results; exchange", "paragraph_id": "para_210" }, { "text": "messages with healthcare providers; review treatment", "paragraph_id": "para_211" }, { "text": "information; schedule appointments; and pay bills. Users can", "paragraph_id": "para_212" }, { "text": "navigate directly to the patient portal login from their browser", "paragraph_id": "para_213" }, { "text": "or access it from within the main Adventist website through the", "paragraph_id": "para_214" }, { "text": "“Patient Login” button. Adventist installed only Google Analytics", "paragraph_id": "para_215" }, { "text": "on the patient portal, not the Meta Pixel.", "paragraph_id": "para_216" }, { "text": "Google Analytics normally shares information about", "paragraph_id": "para_217" }, { "text": "“events” such as, “page views, scrolls, outbound clicks,", "paragraph_id": "para_218" }, { "text": "site search, form interactions, video engagement, [and] file", "paragraph_id": "para_219" }, { "text": "downloads.” Adventist was unaware of any modification made", "paragraph_id": "para_220" }, { "text": "to the type of data Google Analytics collected and transmitted", "paragraph_id": "para_221" }, { "text": "within the patient portal.4 However, Cerner took security", "paragraph_id": "para_222" }, { "text": "measures within the patient portal to “configure[ ] [Google", "paragraph_id": "para_223" }, { "text": "Analytics] to anonymize the IP address[es]” it stored—by", "paragraph_id": "para_224" }, { "text": "“truncat[ing] the last octet of the IP address”—and “to obfuscate", "paragraph_id": "para_225" }, { "text": "[portions of] URLs that were provided when a user browses”", "paragraph_id": "para_226" }, { "text": "the website. To obfuscate the URLs, Cerner used a pattern", "paragraph_id": "para_227" }, { "text": "recognition software that scanned individual URLs and, if the", "paragraph_id": "para_228" }, { "text": "URL “matched a pattern that included an identifier or reference", "paragraph_id": "para_229" }, { "text": "to potential PHI,” that portion of the URL was removed or", "paragraph_id": "para_230" }, { "text": "replaced with a generic term. For example, if a URL included a", "paragraph_id": "para_231" }, { "text": "personal or document identification number, Cerner’s software", "paragraph_id": "para_232" }, { "text": "replaced it with “PERSON_ID” or “DOCUMENT_ID.” Cerner", "paragraph_id": "para_233" }, { "text": "also “ ‘removed the “query parameter” portion of a URL,", "paragraph_id": "para_234" }, { "text": "4 Discovery Shafiq reviewed showed Google Analytics was", "paragraph_id": "para_235" }, { "text": "tracking information inside the patient portal about “Logins,”", "paragraph_id": "para_236" }, { "text": "“Pageviews,” “Health Record – Results,” “Download/Transmit,”", "paragraph_id": "para_237" }, { "text": "“Messages,” and others.", "paragraph_id": "para_238" }, { "text": "9", "paragraph_id": "para_239" }, { "text": "if present, which reflects searches or other information input", "paragraph_id": "para_240" }, { "text": "by the user’ ” on the web page.5", "paragraph_id": "para_241" }, { "text": "In May 2023, Cerner removed Google Analytics.", "paragraph_id": "para_242" }, { "text": "b. HRA website", "paragraph_id": "para_243" }, { "text": "Beginning in 2019 or 2020, Adventist partnered with", "paragraph_id": "para_244" }, { "text": "HealthAware to provide HRAs “through the adventisthealth", "paragraph_id": "para_245" }, { "text": "hra.org website to the public as a marketing tool to identify", "paragraph_id": "para_246" }, { "text": "and reach people who may be at an increased risk for certain", "paragraph_id": "para_247" }, { "text": "health conditions and who would benefit from a medical", "paragraph_id": "para_248" }, { "text": "evaluation related” to the condition. HRAs could be accessed", "paragraph_id": "para_249" }, { "text": "directly through the “main website,” through “a specific subpage", "paragraph_id": "para_250" }, { "text": "of the main website,” or by clicking on an advertisement “on a", "paragraph_id": "para_251" }, { "text": "third-party website such as Facebook or Google”; they generally", "paragraph_id": "para_252" }, { "text": "were accessed through ads. When individuals filled out an", "paragraph_id": "para_253" }, { "text": "HRA form and clicked the link to submit it, they were told if", "paragraph_id": "para_254" }, { "text": "they were at “low risk,” “moderate risk,” or “high risk” for the", "paragraph_id": "para_255" }, { "text": "health condition assessed.", "paragraph_id": "para_256" }, { "text": "Records of the individuals who completed an HRA—", "paragraph_id": "para_257" }, { "text": "including identifying information the user provided (e.g., name,", "paragraph_id": "para_258" }, { "text": "date of birth, contact information), which HRA they took", "paragraph_id": "para_259" }, { "text": "5 The URL “query string” includes “search terms” input by", "paragraph_id": "para_260" }, { "text": "the user. For example, in the URL “https://www.adventisthealth.", "paragraph_id": "para_261" }, { "text": "org/site-search/?C=pregnancy” the query string (after the “?”)", "paragraph_id": "para_262" }, { "text": "shows a search was done at the Adventist website for information", "paragraph_id": "para_263" }, { "text": "about pregnancy. The following URL has a “path” but no query", "paragraph_id": "para_264" }, { "text": "string: “https://www.adventisthealth.org/services/cancer-", "paragraph_id": "para_265" }, { "text": "oncology.” The “path” is “services/cancer-oncology” indicating the", "paragraph_id": "para_266" }, { "text": "user viewed information about cancer-oncology under “services.”", "paragraph_id": "para_267" }, { "text": "(See In re Meta Pixel Healthcare Litigation (N.D.Cal. 2022)", "paragraph_id": "para_268" }, { "text": "647 F.Supp.3d 778, 795–796 and fn. 10 (Meta Pixel) [examples", "paragraph_id": "para_269" }, { "text": "of a URL path and query string].)", "paragraph_id": "para_270" }, { "text": "10", "paragraph_id": "para_271" }, { "text": "and when, the risk level assigned, whether they wished to", "paragraph_id": "para_272" }, { "text": "be contacted, and the lead source (how they came to the HRA", "paragraph_id": "para_273" }, { "text": "website)—were stored in Adventist’s “Salesforce Customer", "paragraph_id": "para_274" }, { "text": "Relationship Management” (CRM) system. The tracking pixels", "paragraph_id": "para_275" }, { "text": "installed on the website shared with Google and Meta that an", "paragraph_id": "para_276" }, { "text": "HRA form had been submitted.", "paragraph_id": "para_277" }, { "text": "3. Plaintiffs’ class action lawsuit", "paragraph_id": "para_278" }, { "text": "Plaintiffs are current or former Adventist patients who", "paragraph_id": "para_279" }, { "text": "interacted with Adventist’s websites, including the patient portal.", "paragraph_id": "para_280" }, { "text": "Plaintiffs sued Adventist, as individuals and on behalf of a", "paragraph_id": "para_281" }, { "text": "putative statewide class of Adventist patients or prospective", "paragraph_id": "para_282" }, { "text": "patients who “exchanged communications” at one of Adventist’s", "paragraph_id": "para_283" }, { "text": "websites between November 2017 and 2024.6 Plaintiffs alleged", "paragraph_id": "para_284" }, { "text": "Adventist installed tracking technologies throughout its public", "paragraph_id": "para_285" }, { "text": "websites and patient portal that acted as “listening and recording", "paragraph_id": "para_286" }, { "text": "device[s]” permitting Meta7 and Google to “eavesdrop[ ]” on their", "paragraph_id": "para_287" }, { "text": "and purported class members’ communications with Adventist—", "paragraph_id": "para_288" }, { "text": "their healthcare provider. Through these tracking technologies,", "paragraph_id": "para_289" }, { "text": "Adventist allegedly disclosed plaintiffs’ personally identifiable", "paragraph_id": "para_290" }, { "text": "information and PHI—without their consent—to Meta and", "paragraph_id": "para_291" }, { "text": "Google. Plaintiffs alleged the tracking technologies transmitted", "paragraph_id": "para_292" }, { "text": "Adventist website users’ IP addresses, URLs generated from", "paragraph_id": "para_293" }, { "text": "users’ searches and logins, and users’ personal data input on", "paragraph_id": "para_294" }, { "text": "the websites. The information shared with Meta and Google", "paragraph_id": "para_295" }, { "text": "allegedly included, among other things, plaintiffs’ and proposed", "paragraph_id": "para_296" }, { "text": "class members’ status as Adventist patients, their medical", "paragraph_id": "para_297" }, { "text": "6 Plaintiffs filed the operative third amended complaint", "paragraph_id": "para_298" }, { "text": "(TAC) on June 25, 2024.", "paragraph_id": "para_299" }, { "text": "7 Meta owns Facebook.", "paragraph_id": "para_300" }, { "text": "11", "paragraph_id": "para_301" }, { "text": "providers, their actual or potential medical conditions and", "paragraph_id": "para_302" }, { "text": "treatments, and their “personal identities.”", "paragraph_id": "para_303" }, { "text": "Plaintiffs alleged Meta/Google used the information", "paragraph_id": "para_304" }, { "text": "collected from Adventist’s websites to sell targeted advertising", "paragraph_id": "para_305" }, { "text": "services. In return, Adventist received analytics about its", "paragraph_id": "para_306" }, { "text": "websites to optimize its marketing efforts and ad placement,", "paragraph_id": "para_307" }, { "text": "to enhance user experience, and to monitor how many users", "paragraph_id": "para_308" }, { "text": "engaged with its websites. Plaintiffs alleged they visited", "paragraph_id": "para_309" }, { "text": "Adventist’s public website and patient portal where they", "paragraph_id": "para_310" }, { "text": "entered medical information, searched for a doctor, searched", "paragraph_id": "para_311" }, { "text": "for information about a medical condition and/or its treatment,", "paragraph_id": "para_312" }, { "text": "filled out an HRA, made appointments, and/or reviewed test", "paragraph_id": "para_313" }, { "text": "results. Plaintiffs then received advertisements on their", "paragraph_id": "para_314" }, { "text": "Facebook pages relating to their medical conditions.", "paragraph_id": "para_315" }, { "text": "Plaintiffs asserted ten separate causes of action against", "paragraph_id": "para_316" }, { "text": "Adventist, including, among others: one claim for violating CIPA", "paragraph_id": "para_317" }, { "text": "by using a recording device—the tracking technologies—to record", "paragraph_id": "para_318" }, { "text": "confidential communications without plaintiffs’ or class members’", "paragraph_id": "para_319" }, { "text": "consent and transmitting that information to others (§ 632,", "paragraph_id": "para_320" }, { "text": "subd. (a)) (§ 632(a)), and by “aid[ing]” third parties in the", "paragraph_id": "para_321" }, { "text": "interception of the “contents” of plaintiffs’ and class members’", "paragraph_id": "para_322" }, { "text": "communications with Adventist (§ 631, subd. (a)) (§ 631(a)); three", "paragraph_id": "para_323" }, { "text": "separate claims for violating CMIA by failing to “maintain the", "paragraph_id": "para_324" }, { "text": "confidentiality of users’ medical information” (Civ. Code, § 56.06),", "paragraph_id": "para_325" }, { "text": "by negligently failing to “maintain, preserve, and store” plaintiffs’", "paragraph_id": "para_326" }, { "text": "and class members’ medical information “in a manner that", "paragraph_id": "para_327" }, { "text": "preserve[d] the confidentiality” of that information (Civ. Code,", "paragraph_id": "para_328" }, { "text": "§ 56.101), and by disclosing plaintiffs’ and class members’", "paragraph_id": "para_329" }, { "text": "“sensitive medical information” without their consent (Civ. Code,", "paragraph_id": "para_330" }, { "text": "§ 56.10); two claims for violating the Unfair Competition Law", "paragraph_id": "para_331" }, { "text": "12", "paragraph_id": "para_332" }, { "text": "(Bus. & Prof. Code, § 17200 et seq.) (UCL) based on its violations", "paragraph_id": "para_333" }, { "text": "of CIPA and CMIA; and a claim for invasion of privacy (Cal.", "paragraph_id": "para_334" }, { "text": "Const., art. 1, § 1).", "paragraph_id": "para_335" }, { "text": "4. Class certification motion, opposition, and reply", "paragraph_id": "para_336" }, { "text": "On June 25, 2024, plaintiffs also filed their motion for class", "paragraph_id": "para_337" }, { "text": "certification. Both sides submitted reports from their experts,", "paragraph_id": "para_338" }, { "text": "various declarations, deposition testimony, and other exhibits.8", "paragraph_id": "para_339" }, { "text": "a. Motion", "paragraph_id": "para_340" }, { "text": "Plaintiffs proposed the general class—for the period from", "paragraph_id": "para_341" }, { "text": "November 16, 2017 to April 30, 2024—consist of “all Adventist", "paragraph_id": "para_342" }, { "text": "Health patients with an address in California who used the", "paragraph_id": "para_343" }, { "text": "Adventist website or patient portal to exchange communications", "paragraph_id": "para_344" }, { "text": "with Adventist Health, including researching medical conditions", "paragraph_id": "para_345" }, { "text": "or treatments, finding a physician, making an appointment,", "paragraph_id": "para_346" }, { "text": "or submitting a health risk assessment form.”9 (Italics added.)", "paragraph_id": "para_347" }, { "text": "Plaintiffs also moved to certify four subclasses, including,", "paragraph_id": "para_348" }, { "text": "a patient portal subclass consisting of “All Class members who", "paragraph_id": "para_349" }, { "text": "were registered users of Adventist Health’s patient portal up", "paragraph_id": "para_350" }, { "text": "until March 29, 2024” (italics added), and an HRA form subclass,", "paragraph_id": "para_351" }, { "text": "8 Plaintiffs’ expert Shafiq’s report summarized his testing", "paragraph_id": "para_352" }, { "text": "and analysis as showing Adventist “uniformly shared patient", "paragraph_id": "para_353" }, { "text": "identifiers (e.g., identifiers of accounts or devices used by", "paragraph_id": "para_354" }, { "text": "patients) alongside content information (e.g., page title and URL)", "paragraph_id": "para_355" }, { "text": "with third-party companies such as Google and Meta. Therefore,", "paragraph_id": "para_356" }, { "text": "any patient who used Adventist Health’s website to search for", "paragraph_id": "para_357" }, { "text": "a doctor, make an appointment, or access the patient portal had", "paragraph_id": "para_358" }, { "text": "their identifying information together with sensitive health", "paragraph_id": "para_359" }, { "text": "information shared with third-party companies.”", "paragraph_id": "para_360" }, { "text": "9 The proposed general class in the TAC included prospective", "paragraph_id": "para_361" }, { "text": "patients and did not specify the type of communications.", "paragraph_id": "para_362" }, { "text": "13", "paragraph_id": "para_363" }, { "text": "consisting of “All Class members who submitted an online [HRA]", "paragraph_id": "para_364" }, { "text": "form to Adventist Health.” (The two others were the online", "paragraph_id": "para_365" }, { "text": "appointment and provider search subclasses.)", "paragraph_id": "para_366" }, { "text": "There was no dispute over the numerosity of the proposed", "paragraph_id": "para_367" }, { "text": "class and subclasses. Plaintiffs argued the two subclasses at", "paragraph_id": "para_368" }, { "text": "issue on appeal were ascertainable based on records maintained", "paragraph_id": "para_369" }, { "text": "by Adventist’s vendors Cerner and HealthAware. Adventist", "paragraph_id": "para_370" }, { "text": "did not dispute this fact.", "paragraph_id": "para_371" }, { "text": "Plaintiffs argued Adventist’s liability depended on", "paragraph_id": "para_372" }, { "text": "common factual and legal questions that predominated over", "paragraph_id": "para_373" }, { "text": "individual ones. For their CIPA claim, plaintiffs argued those", "paragraph_id": "para_374" }, { "text": "included whether: Adventist’s tracking pixels acted similarly", "paragraph_id": "para_375" }, { "text": "to a “bugging device” by “ ‘contemporaneously and invisibly", "paragraph_id": "para_376" }, { "text": "re-direct[ing] the users’ communications to third parties’ ”;", "paragraph_id": "para_377" }, { "text": "“the pixels’ workings constitute an interception of a message", "paragraph_id": "para_378" }, { "text": "in transit in violation of CIPA”; class members had “ ‘a", "paragraph_id": "para_379" }, { "text": "reasonable expectation of privacy’ ”; and the transmitted", "paragraph_id": "para_380" }, { "text": "information “included the ‘contents’ of patients’ communications", "paragraph_id": "para_381" }, { "text": "with Adventist.” For its CMIA claims, plaintiffs argued common", "paragraph_id": "para_382" }, { "text": "issues included whether “Adventist’s deliberate decision to deploy", "paragraph_id": "para_383" }, { "text": "the[ ] tracking pixels constituted a ‘disclosure’ of information” or", "paragraph_id": "para_384" }, { "text": "“negligent storage or maintenance of information”; whether the", "paragraph_id": "para_385" }, { "text": "disclosed information “included information ‘regarding a patient’s", "paragraph_id": "para_386" }, { "text": "medical history . . . mental or physical condition, or treatment’ ”", "paragraph_id": "para_387" }, { "text": "and was protected “ ‘medical information’ ” because it included", "paragraph_id": "para_388" }, { "text": "“ ‘individually identifiable information . . . sufficient to allow", "paragraph_id": "para_389" }, { "text": "identification of the individual’ ”; whether Adventist was", "paragraph_id": "para_390" }, { "text": "authorized to disclose patients’ medical information; and whether", "paragraph_id": "para_391" }, { "text": "an unauthorized party “ ‘viewed or accessed’ ” the disclosed", "paragraph_id": "para_392" }, { "text": "information.", "paragraph_id": "para_393" }, { "text": "14", "paragraph_id": "para_394" }, { "text": "Plaintiffs argued the factual and legal issues relating to", "paragraph_id": "para_395" }, { "text": "these questions were common to the patient portal subclass and", "paragraph_id": "para_396" }, { "text": "HRA form subclass, as well. Plaintiffs asserted Adventist had", "paragraph_id": "para_397" }, { "text": "admitted Google Analytics was enabled inside the patient portal,", "paragraph_id": "para_398" }, { "text": "and its standard configuration had not been changed. Plaintiffs", "paragraph_id": "para_399" }, { "text": "also asserted Shafiq’s investigation revealed that, after a patient", "paragraph_id": "para_400" }, { "text": "submitted an HRA form, the tracking pixels sent Meta and", "paragraph_id": "para_401" }, { "text": "Google a “full-string URL[ ]” including a “unique string of", "paragraph_id": "para_402" }, { "text": "numbers” that would allow anyone to access the HRA report’s", "paragraph_id": "para_403" }, { "text": "contents.", "paragraph_id": "para_404" }, { "text": "Finally, plaintiffs argued that a class action was superior", "paragraph_id": "para_405" }, { "text": "here to allow class members to obtain compensation—through", "paragraph_id": "para_406" }, { "text": "statutory penalties, and to stop Adventist’s “illegal disclosures", "paragraph_id": "para_407" }, { "text": "of their sensitive health information.”", "paragraph_id": "para_408" }, { "text": "b. Opposition", "paragraph_id": "para_409" }, { "text": "Adventist opposed the motion, primarily arguing several", "paragraph_id": "para_410" }, { "text": "individual issues predominated. Among other issues, Adventist", "paragraph_id": "para_411" }, { "text": "argued that, to prove their CIPA and CMIA claims, plaintiffs", "paragraph_id": "para_412" }, { "text": "would have to present evidence of each individual URL the", "paragraph_id": "para_413" }, { "text": "tracking pixels sent to Meta and/or Google to show whether", "paragraph_id": "para_414" }, { "text": "that information constituted the “ ‘content’ ” of a communication", "paragraph_id": "para_415" }, { "text": "or “medical information” and was individually identifiable.", "paragraph_id": "para_416" }, { "text": "With respect to the patient portal subclass, Adventist argued", "paragraph_id": "para_417" }, { "text": "individual URLs sent to Google also would have to be examined", "paragraph_id": "para_418" }, { "text": "to see what had been obfuscated or masked. Adventist argued", "paragraph_id": "para_419" }, { "text": "individual inquiry into proposed HRA form subclass members", "paragraph_id": "para_420" }, { "text": "would be required to determine if individuals were patients", "paragraph_id": "para_421" }, { "text": "at the time they submitted the form, whether they filled out", "paragraph_id": "para_422" }, { "text": "the form for others, and whether they accessed the form through", "paragraph_id": "para_423" }, { "text": "an ad on Google or Facebook, which would affect their reasonable", "paragraph_id": "para_424" }, { "text": "15", "paragraph_id": "para_425" }, { "text": "expectation of privacy. Defendants also presented evidence that", "paragraph_id": "para_426" }, { "text": "the Meta Pixel and Google Analytics transmitted URLs from the", "paragraph_id": "para_427" }, { "text": "HRA website differently: while Google “likely received” a URL", "paragraph_id": "para_428" }, { "text": "that included the name of the HRA, the URL transmitted to Meta", "paragraph_id": "para_429" }, { "text": "said only “hra.adventisthealth.org” or “quiz.adventisthealth.org.”", "paragraph_id": "para_430" }, { "text": "c. Reply", "paragraph_id": "para_431" }, { "text": "In their reply—filed after deposing Adventist’s expert", "paragraph_id": "para_432" }, { "text": "Emily Cohen—plaintiffs argued Cohen’s confirmation that the", "paragraph_id": "para_433" }, { "text": "tracking technologies “ ‘share[d] at least a baseline of information", "paragraph_id": "para_434" }, { "text": "consisting of first-party cookie identifiers, page view information,", "paragraph_id": "para_435" }, { "text": "including URL’s, IP addresses, whether complete or partially", "paragraph_id": "para_436" }, { "text": "masked, and user agent data’ ” established the “key liability facts", "paragraph_id": "para_437" }, { "text": "are subject to common proof.” Plaintiffs essentially contended", "paragraph_id": "para_438" }, { "text": "this baseline data was evidence providing proof common to the", "paragraph_id": "para_439" }, { "text": "class as to whether the information transmitted was individually", "paragraph_id": "para_440" }, { "text": "identifiable, conveyed PHI or medical information, or constituted", "paragraph_id": "para_441" }, { "text": "“contents.” Because the tracking technologies always conveyed", "paragraph_id": "para_442" }, { "text": "at least the baseline data, plaintiffs argued, whether the tracking", "paragraph_id": "para_443" }, { "text": "pixel transmitted additional protected information “over the", "paragraph_id": "para_444" }, { "text": "‘baseline’ ” “only increase[d] the degree of harm suffered by", "paragraph_id": "para_445" }, { "text": "class members,” and was not relevant to Adventist’s underlying", "paragraph_id": "para_446" }, { "text": "liability.", "paragraph_id": "para_447" }, { "text": "Plaintiffs agreed to limit the patient portal subclass to", "paragraph_id": "para_448" }, { "text": "“All Class members who logged into Adventist’s patient portal", "paragraph_id": "para_449" }, { "text": "up until May 2023.” (Italics added.) Plaintiffs argued it", "paragraph_id": "para_450" }, { "text": "was “immaterial what access point patients used” to log into", "paragraph_id": "para_451" }, { "text": "the patient portal, “as any transmission to Google from the", "paragraph_id": "para_452" }, { "text": "myadventisthealth.org domain [the patient portal], regardless", "paragraph_id": "para_453" }, { "text": "of access point, indicate[d] that the individual signed into the", "paragraph_id": "para_454" }, { "text": "patient portal.” Plaintiffs also argued that, although the URLs", "paragraph_id": "para_455" }, { "text": "16", "paragraph_id": "para_456" }, { "text": "sent from the patient portal were partially redacted, they still", "paragraph_id": "para_457" }, { "text": "contained descriptive “natural language” terms outside of search", "paragraph_id": "para_458" }, { "text": "parameters that revealed “key information about patients’ health", "paragraph_id": "para_459" }, { "text": "condition or treatment.” Plaintiffs contended that, because the", "paragraph_id": "para_460" }, { "text": "class included “only patients who exchanged health-care-related", "paragraph_id": "para_461" }, { "text": "communications” with Adventist, the court could determine on", "paragraph_id": "para_462" }, { "text": "a class-wide basis “whether the content” of the communications", "paragraph_id": "para_463" }, { "text": "was “PHI/medical information.” Plaintiffs also disputed", "paragraph_id": "para_464" }, { "text": "Adventist’s contentions that the court could not determine the", "paragraph_id": "para_465" }, { "text": "specific issues affecting the HRA form subclass on a class-wide", "paragraph_id": "para_466" }, { "text": "basis based on Adventist’s records and/or proposed class", "paragraph_id": "para_467" }, { "text": "members’ self-reporting.", "paragraph_id": "para_468" }, { "text": "d. Hearing and trial plan", "paragraph_id": "para_469" }, { "text": "Before hearing oral argument on plaintiffs’ motion,", "paragraph_id": "para_470" }, { "text": "the court issued a tentative ruling denying class certification.", "paragraph_id": "para_471" }, { "text": "The court heard extensive argument on December 19, 2024.", "paragraph_id": "para_472" }, { "text": "During the hearing—in response to the court’s concerns that", "paragraph_id": "para_473" }, { "text": "the class included individuals who interfaced with the Adventist", "paragraph_id": "para_474" }, { "text": "websites for non-health related reasons—plaintiffs’ counsel", "paragraph_id": "para_475" }, { "text": "proposed to amend the class definition to include patients", "paragraph_id": "para_476" }, { "text": "who used the Adventist websites to exchange communications", "paragraph_id": "para_477" }, { "text": "“for” (rather than “including”) researching medical conditions", "paragraph_id": "para_478" }, { "text": "or treatments, finding a physician, making an appointment,", "paragraph_id": "para_479" }, { "text": "or submitting an HRA. The court permitted plaintiffs to file", "paragraph_id": "para_480" }, { "text": "a trial plan and Adventist to file a response before taking", "paragraph_id": "para_481" }, { "text": "the matter under submission.", "paragraph_id": "para_482" }, { "text": "Plaintiffs’ trial plan confirmed their modifications of", "paragraph_id": "para_483" }, { "text": "the general class and patient portal subclass. Plaintiffs also", "paragraph_id": "para_484" }, { "text": "narrowed the class claims to those under CIPA, “Penal Code", "paragraph_id": "para_485" }, { "text": "§§ 630 et seq.”; CMIA, “Civil Code §§ 56.101 & 56.10”; and UCL.", "paragraph_id": "para_486" }, { "text": "17", "paragraph_id": "para_487" }, { "text": "5. The court’s denial of class certification", "paragraph_id": "para_488" }, { "text": "On February 14, 2025, the court issued an 18-page order", "paragraph_id": "para_489" }, { "text": "denying plaintiffs’ motion for class certification in its entirety.", "paragraph_id": "para_490" }, { "text": "As relevant to this appeal, the court found plaintiffs failed to", "paragraph_id": "para_491" }, { "text": "establish the patient portal subclass was ascertainable because", "paragraph_id": "para_492" }, { "text": "they didn’t explain “how to ascertain which patients logged into", "paragraph_id": "para_493" }, { "text": "the patient portal and engaged in the types of activities that", "paragraph_id": "para_494" }, { "text": "allegedly resulted in ‘content’ and ‘medical information’ being", "paragraph_id": "para_495" }, { "text": "transmitted.” The court also found plaintiffs did not show how", "paragraph_id": "para_496" }, { "text": "common issues predominated on either its CIPA or CMIA claims", "paragraph_id": "para_497" }, { "text": "for either subclass. The court found that, although plaintiffs", "paragraph_id": "para_498" }, { "text": "established “medical information may have been revealed by", "paragraph_id": "para_499" }, { "text": "some of the URLs” transmitted from the patient portal, other", "paragraph_id": "para_500" }, { "text": "URLs may not have revealed “either ‘content’ under CIPA", "paragraph_id": "para_501" }, { "text": "or ‘medical information’ under CMIA.” The court also found", "paragraph_id": "para_502" }, { "text": "“[p]laintiffs did not submit evidence that merely logging into", "paragraph_id": "para_503" }, { "text": "the patient portal transmits information in violation of CIPA", "paragraph_id": "para_504" }, { "text": "or CMIA, or that each activity that a logged-in patient can do", "paragraph_id": "para_505" }, { "text": "within the patient portal transmits information in violation of", "paragraph_id": "para_506" }, { "text": "CIPA or CMIA.” As for the HRA form subclass, the court found", "paragraph_id": "para_507" }, { "text": "a person-by-person inquiry would be required to determine", "paragraph_id": "para_508" }, { "text": "whether Google and Meta “actually followed the links” they", "paragraph_id": "para_509" }, { "text": "were sent to the completed HRA forms, such as by showing", "paragraph_id": "para_510" }, { "text": "class members received ads for health issues they disclosed in", "paragraph_id": "para_511" }, { "text": "HRA forms. Finally, the court found plaintiffs failed to show the", "paragraph_id": "para_512" }, { "text": "superiority of a class action as they cited no evidence to support", "paragraph_id": "para_513" }, { "text": "their assertion that “few class members have the time and", "paragraph_id": "para_514" }, { "text": "resources to pursue their claims on an individual basis,” and", "paragraph_id": "para_515" }, { "text": "did not address the manageability of the individual questions", "paragraph_id": "para_516" }, { "text": "18", "paragraph_id": "para_517" }, { "text": "the court had identified. Plaintiffs filed a timely notice of", "paragraph_id": "para_518" }, { "text": "appeal.10", "paragraph_id": "para_519" }, { "text": "DISCUSSION", "paragraph_id": "para_520" }, { "text": "1. Class certification and standard of review", "paragraph_id": "para_521" }, { "text": "Section 382 of the Code of Civil Procedure authorizes", "paragraph_id": "para_522" }, { "text": "a lawsuit to proceed as a class action “when the question is one", "paragraph_id": "para_523" }, { "text": "of a common or general interest, of many persons, or when the", "paragraph_id": "para_524" }, { "text": "parties are numerous, and it is impracticable to bring them all", "paragraph_id": "para_525" }, { "text": "before the court.” “The party advocating class treatment must", "paragraph_id": "para_526" }, { "text": "demonstrate the existence of an ascertainable and sufficiently", "paragraph_id": "para_527" }, { "text": "numerous class, a well-defined community of interest, and", "paragraph_id": "para_528" }, { "text": "substantial benefits from certification that render proceeding", "paragraph_id": "para_529" }, { "text": "as a class superior to the alternatives. [Citations.] ‘In turn,", "paragraph_id": "para_530" }, { "text": "the “community of interest requirement embodies three factors:", "paragraph_id": "para_531" }, { "text": "(1) predominant common questions of law or fact; (2) class", "paragraph_id": "para_532" }, { "text": "representatives with claims or defenses typical of the class;", "paragraph_id": "para_533" }, { "text": "and (3) class representatives who can adequately represent", "paragraph_id": "para_534" }, { "text": "the class.” ’ ” (Brinker Restaurant Corp. v. Superior Court (2012)", "paragraph_id": "para_535" }, { "text": "53 Cal.4th 1004, 1021 (Brinker).)", "paragraph_id": "para_536" }, { "text": "The certification question is “ ‘ “essentially a procedural", "paragraph_id": "para_537" }, { "text": "one that does not ask whether an action is legally or factually", "paragraph_id": "para_538" }, { "text": "meritorious,” ’ ” and thus, “resolution of disputes over the", "paragraph_id": "para_539" }, { "text": "merits of a case generally must be postponed until after class", "paragraph_id": "para_540" }, { "text": "certification has been decided [citation], with the court assuming", "paragraph_id": "para_541" }, { "text": "for purposes of the certification motion that any claims have", "paragraph_id": "para_542" }, { "text": "merit.” (Brinker, supra, 53 Cal.4th at p. 1023.) Our Supreme", "paragraph_id": "para_543" }, { "text": "10 An order denying class certification is appealable under", "paragraph_id": "para_544" }, { "text": "the “ ‘death knell’ ” doctrine. (See Meinhardt v. City of Sunnyvale", "paragraph_id": "para_545" }, { "text": "(2024) 16 Cal.5th 643, 656, fn. 8.)", "paragraph_id": "para_546" }, { "text": "19", "paragraph_id": "para_547" }, { "text": "Court has recognized that, when “evidence or legal issues", "paragraph_id": "para_548" }, { "text": "germane to the certification question bear as well on aspects", "paragraph_id": "para_549" }, { "text": "of the merits, a court may properly evaluate them.” (Id.", "paragraph_id": "para_550" }, { "text": "at pp. 1023–1024.) However, “[s]uch inquiries are closely", "paragraph_id": "para_551" }, { "text": "circumscribed.” (Id. at p. 1024.) “[A]ny ‘peek’ a court takes", "paragraph_id": "para_552" }, { "text": "into the merits at the certification stage must ‘be limited to", "paragraph_id": "para_553" }, { "text": "those aspects of the merits that affect the decisions essential’", "paragraph_id": "para_554" }, { "text": "to class certification.” (Ibid.)", "paragraph_id": "para_555" }, { "text": "“ ‘The decision to certify a class rests squarely within the", "paragraph_id": "para_556" }, { "text": "discretion of the trial court, and we afford that decision great", "paragraph_id": "para_557" }, { "text": "deference on appeal, reversing only for a manifest abuse of", "paragraph_id": "para_558" }, { "text": "discretion: “Because trial courts are ideally situated to evaluate", "paragraph_id": "para_559" }, { "text": "the efficiencies and practicalities of permitting group action, they", "paragraph_id": "para_560" }, { "text": "are afforded great discretion in granting or denying certification.”", "paragraph_id": "para_561" }, { "text": "[Citation.] A certification order generally will not be disturbed", "paragraph_id": "para_562" }, { "text": "unless (1) it is unsupported by substantial evidence, (2) it rests on", "paragraph_id": "para_563" }, { "text": "improper criteria, or (3) it rests on erroneous legal assumptions.’ ”", "paragraph_id": "para_564" }, { "text": "(Brinker, supra, 53 Cal.4th at p. 1022.) Therefore, “ ‘[u]nlike the", "paragraph_id": "para_565" }, { "text": "general rule compelling a reviewing court to scrutinize the result", "paragraph_id": "para_566" }, { "text": "below, not the trial court’s rationale, we analyze the propriety", "paragraph_id": "para_567" }, { "text": "of an order denying class certification based solely on the lower", "paragraph_id": "para_568" }, { "text": "court’s stated reason for the decision.’ [Citation.]” (Leeds v. City", "paragraph_id": "para_569" }, { "text": "of Los Angeles (2025) 115 Cal.App.5th 537, 545–546 (Leeds).)", "paragraph_id": "para_570" }, { "text": "“ ‘Under this standard, an order based upon improper", "paragraph_id": "para_571" }, { "text": "criteria or incorrect assumptions calls for reversal “ ‘even though", "paragraph_id": "para_572" }, { "text": "there may be substantial evidence to support the court’s", "paragraph_id": "para_573" }, { "text": "order.’ ” ’ ” (Noel v. Thrifty Payless, Inc. (2019) 7 Cal.5th 955,", "paragraph_id": "para_574" }, { "text": "968 (Noel); see also Ayala v. Antelope Valley Newspapers, Inc.", "paragraph_id": "para_575" }, { "text": "(2014) 59 Cal.4th 522, 537 [“[a] certification decision is reviewed", "paragraph_id": "para_576" }, { "text": "for abuse of discretion, but when the supporting reasoning", "paragraph_id": "para_577" }, { "text": "20", "paragraph_id": "para_578" }, { "text": "reveals the court based its decision on erroneous legal", "paragraph_id": "para_579" }, { "text": "assumptions about the relevant questions, that decision", "paragraph_id": "para_580" }, { "text": "cannot stand”]; Cochran v. Schwan’s Home Service, Inc.", "paragraph_id": "para_581" }, { "text": "(2014) 228 Cal.App.4th 1137, 1143, quoting Knapp v. AT&T", "paragraph_id": "para_582" }, { "text": "Wireless Services, Inc. (2011) 195 Cal.App.4th 932, 939 (Knapp)", "paragraph_id": "para_583" }, { "text": "[“ ‘A trial court’s decision that rests on an error of law is an", "paragraph_id": "para_584" }, { "text": "abuse of discretion.’ ”].)", "paragraph_id": "para_585" }, { "text": "2. Ascertainability of the patient portal subclass11", "paragraph_id": "para_586" }, { "text": "A class is ascertainable “when it is defined ‘in terms of", "paragraph_id": "para_587" }, { "text": "objective characteristics and common transactional facts’ that", "paragraph_id": "para_588" }, { "text": "make ‘the ultimate identification of class members possible", "paragraph_id": "para_589" }, { "text": "when that identification becomes necessary.’ ” (Noel, supra,", "paragraph_id": "para_590" }, { "text": "7 Cal.5th at p. 980.) “[T]his standard . . . include[es] class", "paragraph_id": "para_591" }, { "text": "definitions that are ‘sufficient to allow a member of [the class]", "paragraph_id": "para_592" }, { "text": "to identify himself or herself as having a right to recover based", "paragraph_id": "para_593" }, { "text": "on the [class] description.’ ” (Ibid.)", "paragraph_id": "para_594" }, { "text": "Plaintiffs defined the patient portal subclass as “All Class", "paragraph_id": "para_595" }, { "text": "members who were logged into Adventist Health’s patient portal", "paragraph_id": "para_596" }, { "text": "up until May 2023.” Plaintiffs ultimately defined the general", "paragraph_id": "para_597" }, { "text": "class—i.e., all class members—as, “For the period November 16,", "paragraph_id": "para_598" }, { "text": "2017 to April 30, 2024, all Adventist Health patients with an", "paragraph_id": "para_599" }, { "text": "address in California who used the Adventist website or patient", "paragraph_id": "para_600" }, { "text": "portal to exchange communications with Adventist Health for", "paragraph_id": "para_601" }, { "text": "[1] researching medical conditions or treatments, [2] finding a", "paragraph_id": "para_602" }, { "text": "physician, [3] making an appointment, or [4] submitting a health", "paragraph_id": "para_603" }, { "text": "risk assessment form.” The initial class definition, however,", "paragraph_id": "para_604" }, { "text": "encompassed patients “who used the Adventist website or", "paragraph_id": "para_605" }, { "text": "11 The court found the HRA form subclass members were", "paragraph_id": "para_606" }, { "text": "ascertainable based on Adventist’s and/or its vendor’s records.", "paragraph_id": "para_607" }, { "text": "21", "paragraph_id": "para_608" }, { "text": "patient portal to exchange communications with Adventist", "paragraph_id": "para_609" }, { "text": "Health, including” the four above activities. (Italics added.)", "paragraph_id": "para_610" }, { "text": "Plaintiffs’ counsel suggested the revised definition during", "paragraph_id": "para_611" }, { "text": "the hearing on plaintiffs’ motion and—in plaintiffs’ trial plan—", "paragraph_id": "para_612" }, { "text": "proposed the court certify the general class as revised.", "paragraph_id": "para_613" }, { "text": "Accordingly, as Adventist asserts, the patient portal", "paragraph_id": "para_614" }, { "text": "subclass definition incorporated the revised definition of", "paragraph_id": "para_615" }, { "text": "the general class. Substituting “[a]ll Class members” with", "paragraph_id": "para_616" }, { "text": "plaintiffs’ definition of the general class, the patient portal", "paragraph_id": "para_617" }, { "text": "subclass definition is: All Adventist patients with an address", "paragraph_id": "para_618" }, { "text": "in California who logged into the patient portal up until May", "paragraph_id": "para_619" }, { "text": "2023 to exchange communications with Adventist for researching", "paragraph_id": "para_620" }, { "text": "medical conditions or treatments, finding a physician, making", "paragraph_id": "para_621" }, { "text": "an appointment, or submitting a health risk assessment form.", "paragraph_id": "para_622" }, { "text": "The court found plaintiffs did not establish the members", "paragraph_id": "para_623" }, { "text": "of the general class were ascertainable. The court noted", "paragraph_id": "para_624" }, { "text": "plaintiffs “propose[d] that [Adventist] generate a list of all", "paragraph_id": "para_625" }, { "text": "California patients and then ‘patients could identify themselves", "paragraph_id": "para_626" }, { "text": "as having used the website or patient portal to research medical", "paragraph_id": "para_627" }, { "text": "conditions or treatments, find a physician, make an appointment,", "paragraph_id": "para_628" }, { "text": "or submit a health risk assessment form.’ ” Plaintiffs argued", "paragraph_id": "para_629" }, { "text": "patients would “be able to figure out from the class definition", "paragraph_id": "para_630" }, { "text": "whether they are part of the class and they can ‘self-report.’ ”", "paragraph_id": "para_631" }, { "text": "The court found “[i]t [wa]s not so simple,” in part because the", "paragraph_id": "para_632" }, { "text": "class definition “d[id] not clearly tell putative class member[s]", "paragraph_id": "para_633" }, { "text": "how to self-report.” The court then concluded the patient portal", "paragraph_id": "para_634" }, { "text": "subclass had “a similar problem.” Plaintiffs had argued patient", "paragraph_id": "para_635" }, { "text": "portal subclass members were ascertainable because Adventist", "paragraph_id": "para_636" }, { "text": "had “information of all registered patient portal users in its", "paragraph_id": "para_637" }, { "text": "records.” The court found “being a registered user of the patient", "paragraph_id": "para_638" }, { "text": "22", "paragraph_id": "para_639" }, { "text": "portal does not mean a patient engaged in activity on the patient", "paragraph_id": "para_640" }, { "text": "portal that resulted in information, let alon[e] ‘content’ and", "paragraph_id": "para_641" }, { "text": "‘medical information,’ being transmitted to third parties.” The", "paragraph_id": "para_642" }, { "text": "court continued, “Plaintiffs do not explain how to ascertain which", "paragraph_id": "para_643" }, { "text": "patients logged into the patient portal and engaged in the types", "paragraph_id": "para_644" }, { "text": "of activities that allegedly resulted in ‘content’ and ‘medical", "paragraph_id": "para_645" }, { "text": "information’ being transmitted, as discussed below,” referring", "paragraph_id": "para_646" }, { "text": "to its predominance analysis.", "paragraph_id": "para_647" }, { "text": "Plaintiffs argue the record shows the patient portal", "paragraph_id": "para_648" }, { "text": "subclass is ascertainable through Adventist’s or its provider", "paragraph_id": "para_649" }, { "text": "Cerner’s records. As plaintiffs note, the evidence shows", "paragraph_id": "para_650" }, { "text": "Adventist could create a report of the patient identification", "paragraph_id": "para_651" }, { "text": "numbers (ID) that created a portal account and the number", "paragraph_id": "para_652" }, { "text": "of times the patient ID “accessed the portal.” Accordingly,", "paragraph_id": "para_653" }, { "text": "plaintiffs demonstrated patients who logged into the patient", "paragraph_id": "para_654" }, { "text": "portal during the subclass period were readily identifiable.", "paragraph_id": "para_655" }, { "text": "However, as the court implied12 and Adventist argues,", "paragraph_id": "para_656" }, { "text": "plaintiffs did not demonstrate how to identify patients who", "paragraph_id": "para_657" }, { "text": "logged into the patient portal and engaged in one of the four", "paragraph_id": "para_658" }, { "text": "enumerated activities. A patient’s options within the patient", "paragraph_id": "para_659" }, { "text": "portal were not limited to researching medical conditions", "paragraph_id": "para_660" }, { "text": "or treatments, finding a physician, making an appointment,", "paragraph_id": "para_661" }, { "text": "and submitting an HRA. Within the patient portal, patients", "paragraph_id": "para_662" }, { "text": "also could view lab, radiology, and other results; view their", "paragraph_id": "para_663" }, { "text": "12 As we noted, the court found the general class definition", "paragraph_id": "para_664" }, { "text": "did “not clearly tell putative class member[s] how to self-report.”", "paragraph_id": "para_665" }, { "text": "We can infer the court found the patient portal—which had a", "paragraph_id": "para_666" }, { "text": "“similar problem”—also did not clearly tell members how to self-", "paragraph_id": "para_667" }, { "text": "report, in part, because it necessarily subsumed the definition", "paragraph_id": "para_668" }, { "text": "of the class.", "paragraph_id": "para_669" }, { "text": "23", "paragraph_id": "para_670" }, { "text": "health record; download a document; send or receive messages;", "paragraph_id": "para_671" }, { "text": "pay a bill; and other activities.", "paragraph_id": "para_672" }, { "text": "Plaintiffs argue Adventist never disputed the patient portal", "paragraph_id": "para_673" }, { "text": "subclass was ascertainable. In opposing plaintiffs’ motion—", "paragraph_id": "para_674" }, { "text": "before plaintiffs modified the class definition—Adventist did", "paragraph_id": "para_675" }, { "text": "not dispute that it could identify patients who had logged into", "paragraph_id": "para_676" }, { "text": "the patient portal. But in response to plaintiffs’ trial plan,", "paragraph_id": "para_677" }, { "text": "Adventist argued the “revised general class definition creates", "paragraph_id": "para_678" }, { "text": "serious impediments to certification of their Patient Portal", "paragraph_id": "para_679" }, { "text": "Subclass. Specifically, a patient who merely logs in to the patient", "paragraph_id": "para_680" }, { "text": "portal and does nothing else is not a class member.” (Boldface", "paragraph_id": "para_681" }, { "text": "omitted.) Adventist specifically noted plaintiffs’ revised class", "paragraph_id": "para_682" }, { "text": "definition included “only those Adventist Health patients who", "paragraph_id": "para_683" }, { "text": "used the Adventist Health websites (and the patient portal)", "paragraph_id": "para_684" }, { "text": "for only four specific things”—researching medical conditions", "paragraph_id": "para_685" }, { "text": "or treatments, finding a physician, making an appointment, or", "paragraph_id": "para_686" }, { "text": "submitting a HRA form. Adventist asserted that, as a result,", "paragraph_id": "para_687" }, { "text": "“not all patient portal users fall within the class; rather, only", "paragraph_id": "para_688" }, { "text": "those who used the patient portal for identified purposes fall", "paragraph_id": "para_689" }, { "text": "within the revised class definition.” Adventist argued this", "paragraph_id": "para_690" }, { "text": "definition raised “additional individual questions about,”", "paragraph_id": "para_691" }, { "text": "among other things, “what each patient portal user was doing", "paragraph_id": "para_692" }, { "text": "on the patient portal website” and “whether the actions taken", "paragraph_id": "para_693" }, { "text": "using the portal fall within one of these four specific categories.”", "paragraph_id": "para_694" }, { "text": "Plaintiffs argue patients identified as having logged into", "paragraph_id": "para_695" }, { "text": "the patient portal “could easily recall if they had ever once used", "paragraph_id": "para_696" }, { "text": "the Patient Portal for any of the purposes for which it was", "paragraph_id": "para_697" }, { "text": "designed.” Patients may be able to recall what actions they took", "paragraph_id": "para_698" }, { "text": "within the patient portal, but plaintiffs have not explained how", "paragraph_id": "para_699" }, { "text": "patients could determine—as Adventist notes—if, for example,", "paragraph_id": "para_700" }, { "text": "24", "paragraph_id": "para_701" }, { "text": "their messaging a doctor, downloading a health record, or paying", "paragraph_id": "para_702" }, { "text": "a bill counted as “researching medical conditions or treatments,”", "paragraph_id": "para_703" }, { "text": "“finding a physician,” “making an appointment,” or none of those", "paragraph_id": "para_704" }, { "text": "things.", "paragraph_id": "para_705" }, { "text": "Nevertheless, as the court itself acknowledged, any", "paragraph_id": "para_706" }, { "text": "interactions a patient had within the patient portal—unlike", "paragraph_id": "para_707" }, { "text": "on Adventist’s general website—necessarily would have related", "paragraph_id": "para_708" }, { "text": "to the patient’s health care. It does not appear that plaintiffs", "paragraph_id": "para_709" }, { "text": "intended to limit the patient portal subclass only to those", "paragraph_id": "para_710" }, { "text": "patients who engaged in one of the four specified activities—", "paragraph_id": "para_711" }, { "text": "especially when, as we discuss below, plaintiffs contend the", "paragraph_id": "para_712" }, { "text": "baseline information transmitted when a patient logged into the", "paragraph_id": "para_713" }, { "text": "patient portal transmitted “contents” and “medical information”", "paragraph_id": "para_714" }, { "text": "to Google. Indeed, plaintiffs’ counsel suggested the revision to", "paragraph_id": "para_715" }, { "text": "the general class definition to address the court’s stated concerns", "paragraph_id": "para_716" }, { "text": "about “the general website.” Counsel explained, “I think there’s", "paragraph_id": "para_717" }, { "text": "one word change that could be made in the proposed class", "paragraph_id": "para_718" }, { "text": "definition for the general website. [¶] . . . [¶] . . . Strike the word", "paragraph_id": "para_719" }, { "text": "‘including.’ ” (Italics added.) The court responded, “Oh, replace it", "paragraph_id": "para_720" }, { "text": "with like about: to exchange communications about researching", "paragraph_id": "para_721" }, { "text": "medical, finding a physician, making an appointment. [¶] . . .", "paragraph_id": "para_722" }, { "text": "[¶] . . . So that would eliminate my concern about like you’re", "paragraph_id": "para_723" }, { "text": "just going on to find the address.” Counsel continued, “Yes,", "paragraph_id": "para_724" }, { "text": "Your Honor, and we acknowledge that that class would require", "paragraph_id": "para_725" }, { "text": "self-identification anyway . . . . So that one change would we", "paragraph_id": "para_726" }, { "text": "think solve the court’s concern with respect or at least address", "paragraph_id": "para_727" }, { "text": "the court’s concern with respect to the general website.” (Italics", "paragraph_id": "para_728" }, { "text": "added.)", "paragraph_id": "para_729" }, { "text": "25", "paragraph_id": "para_730" }, { "text": "Accordingly, when discussing plaintiffs’ proposed revision", "paragraph_id": "para_731" }, { "text": "to the general class definition, both plaintiffs’ counsel and", "paragraph_id": "para_732" }, { "text": "the court had patients’ interactions with the general website", "paragraph_id": "para_733" }, { "text": "—rather than the authenticated patient portal—in mind.", "paragraph_id": "para_734" }, { "text": "Critically, earlier in the hearing the court had “agree[d] . . .", "paragraph_id": "para_735" }, { "text": "the patient portal is people who were patients who are engaging", "paragraph_id": "para_736" }, { "text": "in the website because of their medical conditions,” not “just some", "paragraph_id": "para_737" }, { "text": "person on the website looking around the website for whatever", "paragraph_id": "para_738" }, { "text": "reason.”13 In any event, the posture of this case has changed.", "paragraph_id": "para_739" }, { "text": "Plaintiffs no longer seek to certify a general class of patients", "paragraph_id": "para_740" }, { "text": "who used the general Adventist website. For the remaining", "paragraph_id": "para_741" }, { "text": "patient portal and HRA form subclasses, the enumeration of", "paragraph_id": "para_742" }, { "text": "specific health-related activities simply is unnecessary to weed", "paragraph_id": "para_743" }, { "text": "out patients who used the website for non-health-care-related", "paragraph_id": "para_744" }, { "text": "activities. The patient portal subclass includes only California", "paragraph_id": "para_745" }, { "text": "patients who logged into the patient portal, and the HRA form", "paragraph_id": "para_746" }, { "text": "subclass includes only California patients who submitted an", "paragraph_id": "para_747" }, { "text": "HRA form. Neither subclass raises the concerns the court", "paragraph_id": "para_748" }, { "text": "had that led plaintiffs’ counsel to revise the class definition.", "paragraph_id": "para_749" }, { "text": "13 Plaintiffs’ expert Shafiq also stated the class definition", "paragraph_id": "para_750" }, { "text": "was “limited to patients who interacted with Adventist Health’s", "paragraph_id": "para_751" }, { "text": "website in specific ways (submitting a health risk assessment,", "paragraph_id": "para_752" }, { "text": "searching for a medical condition, searching for a physician,", "paragraph_id": "para_753" }, { "text": "booking an appointment with a provider, or logging into the", "paragraph_id": "para_754" }, { "text": "patient portal) that involve exchanging health-care-related", "paragraph_id": "para_755" }, { "text": "information with Adventist.” (Italics added.) In other words,", "paragraph_id": "para_756" }, { "text": "Shafiq understood that logging into the patient portal itself was", "paragraph_id": "para_757" }, { "text": "one of the ways in which purported class members could interact", "paragraph_id": "para_758" }, { "text": "with Adventist’s websites to exchange health-care-related", "paragraph_id": "para_759" }, { "text": "information.", "paragraph_id": "para_760" }, { "text": "26", "paragraph_id": "para_761" }, { "text": "In essence, plaintiffs’ appeal has rendered their post-hearing", "paragraph_id": "para_762" }, { "text": "revision to the general class moot.", "paragraph_id": "para_763" }, { "text": "And as we discussed, Adventist and/or its provider Cerner", "paragraph_id": "para_764" }, { "text": "have records identifying patients who logged into the patient", "paragraph_id": "para_765" }, { "text": "portal during the relevant period. If some small number of", "paragraph_id": "para_766" }, { "text": "patients who logged into the portal never used the portal, or", "paragraph_id": "para_767" }, { "text": "never used it for themselves, “ ‘those [persons] can be eliminated", "paragraph_id": "para_768" }, { "text": "from the class at that time.’ ” (Nicodemus v. Saint Francis", "paragraph_id": "para_769" }, { "text": "Memorial Hospital (2016) 3 Cal.App.5th 1200, 1213–1214", "paragraph_id": "para_770" }, { "text": "(Nicodemus) [data set of all patients’ attorneys’ requests for", "paragraph_id": "para_771" }, { "text": "patient records attaching release authorizations that may", "paragraph_id": "para_772" }, { "text": "have included some requests made after litigation began or", "paragraph_id": "para_773" }, { "text": "for nonlitigation reasons (and thus outside the proposed class)", "paragraph_id": "para_774" }, { "text": "was sufficient to demonstrate ascertainability].) Moreover,", "paragraph_id": "para_775" }, { "text": "Adventist did not dispute that the patient portal class was", "paragraph_id": "para_776" }, { "text": "ascertainable before plaintiffs revised the general class definition.", "paragraph_id": "para_777" }, { "text": "As plaintiffs note, the court also found they did “not explain", "paragraph_id": "para_778" }, { "text": "how to ascertain which patients logged into the patient portal", "paragraph_id": "para_779" }, { "text": "and engaged in the types of activities that allegedly resulted", "paragraph_id": "para_780" }, { "text": "in ‘content’ and ‘medical information’ being transmitted.”", "paragraph_id": "para_781" }, { "text": "Whether Adventist violated CIPA or CMIA by transmitting the", "paragraph_id": "para_782" }, { "text": "contents of patients communications or their medical information", "paragraph_id": "para_783" }, { "text": "are merits questions that plaintiffs were not required to answer", "paragraph_id": "para_784" }, { "text": "to demonstrate ascertainability. In turn, whether Adventist’s", "paragraph_id": "para_785" }, { "text": "liability under those statutes is subject to common proof relates", "paragraph_id": "para_786" }, { "text": "to the court’s predominance inquiry, which we discuss below.", "paragraph_id": "para_787" }, { "text": "Accordingly, we conclude plaintiffs demonstrated the patient", "paragraph_id": "para_788" }, { "text": "portal subclass members are ascertainable.", "paragraph_id": "para_789" }, { "text": "27", "paragraph_id": "para_790" }, { "text": "3. The court’s predominance inquiry", "paragraph_id": "para_791" }, { "text": "“The ‘ultimate question’ the element of predominance", "paragraph_id": "para_792" }, { "text": "presents is whether ‘the issues which may be jointly tried, when", "paragraph_id": "para_793" }, { "text": "compared with those requiring separate adjudication, are so", "paragraph_id": "para_794" }, { "text": "numerous or substantial that the maintenance of a class action", "paragraph_id": "para_795" }, { "text": "would be advantageous to the judicial process and to the", "paragraph_id": "para_796" }, { "text": "litigants.’ [Citations.]” (Brinker, supra, 53 Cal.4th at p. 1021.)", "paragraph_id": "para_797" }, { "text": "“A court must examine the allegations of the complaint and", "paragraph_id": "para_798" }, { "text": "supporting declarations [citation] and consider whether", "paragraph_id": "para_799" }, { "text": "the legal and factual issues they present are such that their", "paragraph_id": "para_800" }, { "text": "resolution in a single class proceeding would be both desirable", "paragraph_id": "para_801" }, { "text": "and feasible.” (Id. at pp. 1021–1022; see also Walsh v. IKON", "paragraph_id": "para_802" }, { "text": "Office Solutions, Inc. (2007) 148 Cal.App.4th 1440, 1450", "paragraph_id": "para_803" }, { "text": "(Walsh) [“In examining whether common issues of law or fact", "paragraph_id": "para_804" }, { "text": "predominate, the court must consider the plaintiff’s legal", "paragraph_id": "para_805" }, { "text": "theory of liability.”].)", "paragraph_id": "para_806" }, { "text": "“ ‘As a general rule if the defendant’s liability can be", "paragraph_id": "para_807" }, { "text": "determined by facts common to all members of the class, a class", "paragraph_id": "para_808" }, { "text": "will be certified even if the members must individually prove", "paragraph_id": "para_809" }, { "text": "their damages.’ ” (Brinker, supra, 53 Cal.4th at p. 1022.)", "paragraph_id": "para_810" }, { "text": "The “pertinent questions” under the predominance inquiry are:", "paragraph_id": "para_811" }, { "text": "“(1) What elements must be proven to establish the defendant’s", "paragraph_id": "para_812" }, { "text": "liability, and (2) Are these elements susceptible of common", "paragraph_id": "para_813" }, { "text": "proof?” (Downey v. Public Storage, Inc. (2020) 44 Cal.App.5th", "paragraph_id": "para_814" }, { "text": "1103, 1113 (Downey).) Moreover, “ ‘[T]he possibility that a", "paragraph_id": "para_815" }, { "text": "defendant may be able to defeat the showing of an element", "paragraph_id": "para_816" }, { "text": "of a cause of action “ ‘as to a few individual class members[,]", "paragraph_id": "para_817" }, { "text": "does not transform the common question into a multitude", "paragraph_id": "para_818" }, { "text": "of individual ones.’ ” [Citation.]’ ” (Nicodemus, supra,", "paragraph_id": "para_819" }, { "text": "3 Cal.App.5th at p. 1219.)", "paragraph_id": "para_820" }, { "text": "28", "paragraph_id": "para_821" }, { "text": "Plaintiffs’ trial plan stated it was seeking class certification", "paragraph_id": "para_822" }, { "text": "of their (1) CIPA claim, which alleged in the TAC that Adventist", "paragraph_id": "para_823" }, { "text": "had violated two provisions of CIPA: section 631(a), known as", "paragraph_id": "para_824" }, { "text": "the “wiretapping provision” and section 632(a), known as the", "paragraph_id": "para_825" }, { "text": "“recording provision”—which the court found plaintiffs had", "paragraph_id": "para_826" }, { "text": "abandoned (see Meta Pixel, supra, 647 F.Supp.3d at p. 798);14", "paragraph_id": "para_827" }, { "text": "(2) CMIA claims, alleging Adventist violated Civil Code sections", "paragraph_id": "para_828" }, { "text": "56.10 and 56.101; and (3) UCL claims based on Adventist’s", "paragraph_id": "para_829" }, { "text": "alleged violations of CIPA and CMIA.15", "paragraph_id": "para_830" }, { "text": "In essence, the trial court found that—although plaintiffs", "paragraph_id": "para_831" }, { "text": "had established the existence of several issues subject to common", "paragraph_id": "para_832" }, { "text": "proof—due to variations in the actual information shared", "paragraph_id": "para_833" }, { "text": "with Google and/or Meta through the URLs and other data", "paragraph_id": "para_834" }, { "text": "transmitted by the pixels, plaintiffs failed to meet their burden", "paragraph_id": "para_835" }, { "text": "to show Adventist’s liability under CIPA or CMIA could be", "paragraph_id": "para_836" }, { "text": "determined based on evidence common to all class members.", "paragraph_id": "para_837" }, { "text": "(See Duran v. U.S. Bank National Assn. (2014) 59 Cal.4th 1, 28", "paragraph_id": "para_838" }, { "text": "(Duran) [“class treatment is not appropriate ‘if every member", "paragraph_id": "para_839" }, { "text": "of the alleged class would be required to litigate numerous", "paragraph_id": "para_840" }, { "text": "and substantial questions determining his individual right to", "paragraph_id": "para_841" }, { "text": "recover following the “class judgment” ’ on common issues”].)", "paragraph_id": "para_842" }, { "text": "We first state the applicable law and then review the court’s", "paragraph_id": "para_843" }, { "text": "predominance analysis as to the two subclasses.", "paragraph_id": "para_844" }, { "text": "a. Applicable law", "paragraph_id": "para_845" }, { "text": "The wiretapping provision of CIPA, as relevant here,", "paragraph_id": "para_846" }, { "text": "imposes statutory penalties on anyone “who willfully and without", "paragraph_id": "para_847" }, { "text": "14 We discuss that finding at the end of the Discussion", "paragraph_id": "para_848" }, { "text": "section.", "paragraph_id": "para_849" }, { "text": "15 Accordingly, we need not separately address that claim.", "paragraph_id": "para_850" }, { "text": "29", "paragraph_id": "para_851" }, { "text": "the consent of all parties to the communication,” “reads or", "paragraph_id": "para_852" }, { "text": "attempts to read, or to learn the contents or meaning of any", "paragraph_id": "para_853" }, { "text": "message, report, or communication while the same is in transit", "paragraph_id": "para_854" }, { "text": "or passing over any wire, line, or cable, or is being sent from, or", "paragraph_id": "para_855" }, { "text": "received at any place within this state; or who uses, or attempts", "paragraph_id": "para_856" }, { "text": "to use, in any manner, or for any purpose, or to communicate", "paragraph_id": "para_857" }, { "text": "in any way, any information so obtained, or who aids, agrees", "paragraph_id": "para_858" }, { "text": "with, employs, or conspires with any person or persons to", "paragraph_id": "para_859" }, { "text": "unlawfully do, or permit, or cause to be done any of the acts", "paragraph_id": "para_860" }, { "text": "or things mentioned above in this section.” (§ 631(a).) Plaintiffs", "paragraph_id": "para_861" }, { "text": "alleged Adventist aided and abetted Meta and Google’s violation", "paragraph_id": "para_862" }, { "text": "of the “ ‘eavesdropping’ ” and “use” clauses of section 631(a). (See", "paragraph_id": "para_863" }, { "text": "Rodriguez v. Ford Motor Co. (S.D.Cal. 2024) 722 F.Supp.3d 1104,", "paragraph_id": "para_864" }, { "text": "1112–1114, 1116, 1122–1224 [to state a claim for “aiding and", "paragraph_id": "para_865" }, { "text": "abetting” under section 631(a), plaintiff must allege the third", "paragraph_id": "para_866" }, { "text": "party “ ‘violated one of the first three clauses of section 631(a),", "paragraph_id": "para_867" }, { "text": "and that [d]efendant aided, agreed with, employed, or conspired", "paragraph_id": "para_868" }, { "text": "with that person or entity to commit those unlawful acts’ ”].)", "paragraph_id": "para_869" }, { "text": "The court’s predominance analysis focused on whether", "paragraph_id": "para_870" }, { "text": "plaintiffs had demonstrated common evidence could be used", "paragraph_id": "para_871" }, { "text": "to determine whether the URLs shared with Google and/or", "paragraph_id": "para_872" }, { "text": "Meta included the “contents” of patients’ communications with", "paragraph_id": "para_873" }, { "text": "Adventist. CIPA does not define “contents.” A similar provision", "paragraph_id": "para_874" }, { "text": "in the federal Wiretap Act, however, broadly defines “ ‘contents’ ”", "paragraph_id": "para_875" }, { "text": "to “include[ ] any information concerning the substance, purport,", "paragraph_id": "para_876" }, { "text": "or meaning of that communication.” (18 U.S.C. § 2510(8);", "paragraph_id": "para_877" }, { "text": "see Meta Pixel, supra, 647 F.Supp.3d at p. 798 [analysis for", "paragraph_id": "para_878" }, { "text": "a violation of CIPA “ ‘is the same as that under the federal", "paragraph_id": "para_879" }, { "text": "Wiretap Act’ ”]; 18 U.S.C. § 2511(1)(a)–(e).) According to the", "paragraph_id": "para_880" }, { "text": "Ninth Circuit, the “ ‘contents’ ” of an online communication", "paragraph_id": "para_881" }, { "text": "30", "paragraph_id": "para_882" }, { "text": "“refers to the intended message conveyed by the communication,", "paragraph_id": "para_883" }, { "text": "and does not include record information regarding the", "paragraph_id": "para_884" }, { "text": "characteristics of the message that is generated in the course", "paragraph_id": "para_885" }, { "text": "of the communication.” (In re Zynga Privacy Litigation (9th Cir.", "paragraph_id": "para_886" }, { "text": "2014) 750 F.3d 1098, 1106–1107 (Zynga).) In Zynga, the Ninth", "paragraph_id": "para_887" }, { "text": "Circuit explained a URL that included “only basic identification", "paragraph_id": "para_888" }, { "text": "and address information” did not constitute “the contents of", "paragraph_id": "para_889" }, { "text": "a communication,” but a URL that contained “a search term", "paragraph_id": "para_890" }, { "text": "or similar communication made by the user” may constitute", "paragraph_id": "para_891" }, { "text": "“contents.” (Id. at pp. 1108–1109; see id. at pp. 1102–1103,", "paragraph_id": "para_892" }, { "text": "1107 [granting motion to dismiss where alleged information", "paragraph_id": "para_893" }, { "text": "transmitted—user’s Facebook ID and address of webpage user", "paragraph_id": "para_894" }, { "text": "was viewing when user clicked link to a gaming application—", "paragraph_id": "para_895" }, { "text": "was not “ ‘contents’ ” but record information].)", "paragraph_id": "para_896" }, { "text": "Since Zynga, other federal district courts within California", "paragraph_id": "para_897" }, { "text": "have considered whether URLs shared or intercepted by tracking", "paragraph_id": "para_898" }, { "text": "technologies constitute the “contents” of a communication.", "paragraph_id": "para_899" }, { "text": "In Meta Pixel, supra, 647 F.Supp.3d at pp. 785, 795–796, 798", "paragraph_id": "para_900" }, { "text": "the trial court—in deciding a motion for preliminary injunction—", "paragraph_id": "para_901" }, { "text": "found alleged transmissions of patients’ log-in communications", "paragraph_id": "para_902" }, { "text": "with their health care provider MedStar Health System’s patient", "paragraph_id": "para_903" }, { "text": "portal “likely constitute[d] ‘contents’ ” under the Wiretap Act", "paragraph_id": "para_904" }, { "text": "and CIPA. Plaintiffs there alleged that, when they “press[ed]", "paragraph_id": "para_905" }, { "text": "the login button” to enter their patient portal, the information", "paragraph_id": "para_906" }, { "text": "was sent to Meta through a transmission that included the", "paragraph_id": "para_907" }, { "text": "“patient’s identity in the form of cookies, IP address, and User-", "paragraph_id": "para_908" }, { "text": "Agent identifiers,” “[c]ontent of the button (‘Log in’),” “[c]ontents", "paragraph_id": "para_909" }, { "text": "of the page from which the patient clicked to log in to the patient", "paragraph_id": "para_910" }, { "text": "portal,” and “[c]ontent of the page the patient will land as a result", "paragraph_id": "para_911" }, { "text": "of clicking ‘Log in’ to the patient portal.” (Id. at p. 785.) The", "paragraph_id": "para_912" }, { "text": "31", "paragraph_id": "para_913" }, { "text": "court found the patient portal “log-in buttons” and the descriptive", "paragraph_id": "para_914" }, { "text": "URLs, which included both “the ‘path’ and the ‘query string,’ ”", "paragraph_id": "para_915" }, { "text": "were “ ‘contents’ ” because “they concern[ed] the substance of", "paragraph_id": "para_916" }, { "text": "a communication.” (Id. at pp. 795–796 [also explaining “contact", "paragraph_id": "para_917" }, { "text": "information provided as part of a sign-up process constitutes", "paragraph_id": "para_918" }, { "text": "‘content’ because this information is the subject of the", "paragraph_id": "para_919" }, { "text": "communication”].)", "paragraph_id": "para_920" }, { "text": "Federal district courts have “ ‘employ[ed] a contextual", "paragraph_id": "para_921" }, { "text": "“case-specific” analysis hinging on “how much information would", "paragraph_id": "para_922" }, { "text": "be revealed” by the information’s tracking and disclosure.’ ”", "paragraph_id": "para_923" }, { "text": "(Cousin v. Sharp Healthcare (S.D.Cal. 2023) 702 F.Supp.3d 967,", "paragraph_id": "para_924" }, { "text": "976 (Cousin II), quoting Hammerling v. Google, LLC (N.D.Cal.", "paragraph_id": "para_925" }, { "text": "2022) 615 F.Supp.3d 1069, 1092–1093.) “ ‘Generally, customer", "paragraph_id": "para_926" }, { "text": "information such as a person’s name, address, and subscriber", "paragraph_id": "para_927" }, { "text": "number or identity is record information, but it may be contents", "paragraph_id": "para_928" }, { "text": "when it is part of the substance of the message conveyed to the", "paragraph_id": "para_929" }, { "text": "recipient. [Citations.] Similarly, URLs are record information", "paragraph_id": "para_930" }, { "text": "when they only reveal a general webpage address and basic", "paragraph_id": "para_931" }, { "text": "identification information, but when they reproduce a person’s", "paragraph_id": "para_932" }, { "text": "personal search engine queries, they are contents.’ ” (Ibid.", "paragraph_id": "para_933" }, { "text": "[denying motion to dismiss where alleged data included “personal", "paragraph_id": "para_934" }, { "text": "search queries—such as specialty healthcare providers and", "paragraph_id": "para_935" }, { "text": "treatments for medical conditions—and therefore plausibly", "paragraph_id": "para_936" }, { "text": "conveyed content: their PHI”]; see also In re Google RTB", "paragraph_id": "para_937" }, { "text": "Consumer Privacy Litigation (N.D.Cal. 2022) 606 F.Supp.3d 935,", "paragraph_id": "para_938" }, { "text": "949 (Google RTB) [finding redirected electronic communications", "paragraph_id": "para_939" }, { "text": "allegedly comprised of “ ‘content categories of the site or app,’ ”", "paragraph_id": "para_940" }, { "text": "“ ‘[content] categories that describe [the] current section of the", "paragraph_id": "para_941" }, { "text": "site or app,’ ” the “ ‘URL of the page where the impression will be", "paragraph_id": "para_942" }, { "text": "shown,’ ” “ ‘referrer URL that caused navigation to the current", "paragraph_id": "para_943" }, { "text": "32", "paragraph_id": "para_944" }, { "text": "page,’ ” and a “ ‘list of keywords about [the] site or app,’ ” among", "paragraph_id": "para_945" }, { "text": "other items, constituted “content”].)", "paragraph_id": "para_946" }, { "text": "CMIA in turn prohibits a health care provider from", "paragraph_id": "para_947" }, { "text": "disclosing “medical information regarding a patient . . . without", "paragraph_id": "para_948" }, { "text": "first obtaining authorization.” (Civ. Code, § 56.10, subd. (a).)", "paragraph_id": "para_949" }, { "text": "CMIA defines “medical information” as “any individually", "paragraph_id": "para_950" }, { "text": "identifiable information . . . regarding a patient’s medical history,", "paragraph_id": "para_951" }, { "text": ". . . mental or physical condition, or treatment. ‘Individually", "paragraph_id": "para_952" }, { "text": "identifiable’ means that the medical information includes", "paragraph_id": "para_953" }, { "text": "or contains any element of personal identifying information", "paragraph_id": "para_954" }, { "text": "sufficient to allow identification of the individual, such as the", "paragraph_id": "para_955" }, { "text": "person’s name, address, electronic mail address, telephone", "paragraph_id": "para_956" }, { "text": "number, or social security number, or other information that,", "paragraph_id": "para_957" }, { "text": "alone or in combination with other publicly available information,", "paragraph_id": "para_958" }, { "text": "reveals the identity of the individual.” (Civ. Code, § 56.05, subd.", "paragraph_id": "para_959" }, { "text": "(j)(1), former subd. (j) (2024–2025), former subd. (i) (2022–2023),", "paragraph_id": "para_960" }, { "text": "and former subd. (j) (2014–2021).) The definition of “medical", "paragraph_id": "para_961" }, { "text": "information” “does not encompass demographic or numeric", "paragraph_id": "para_962" }, { "text": "information that does not reveal medical history, diagnosis,", "paragraph_id": "para_963" }, { "text": "or care.” (Eisenhower Medical Center v. Superior Court (2014)", "paragraph_id": "para_964" }, { "text": "226 Cal.App.4th 430, 435 (Eisenhower).)", "paragraph_id": "para_965" }, { "text": "b. HRA form subclass", "paragraph_id": "para_966" }, { "text": "i. The court made a merits determination in", "paragraph_id": "para_967" }, { "text": "implicitly deciding plaintiffs could not establish", "paragraph_id": "para_968" }, { "text": "by common proof that Adventist transmitted", "paragraph_id": "para_969" }, { "text": "the contents of communications or medical", "paragraph_id": "para_970" }, { "text": "information of patients who submitted", "paragraph_id": "para_971" }, { "text": "HRA forms under CIPA or CMIA", "paragraph_id": "para_972" }, { "text": "As plaintiffs note, in assessing the predominance prong", "paragraph_id": "para_973" }, { "text": "for the HRA form subclass, the court discussed the evidence", "paragraph_id": "para_974" }, { "text": "33", "paragraph_id": "para_975" }, { "text": "relating to plaintiffs’ CIPA and CMIA claims together. The court", "paragraph_id": "para_976" }, { "text": "noted plaintiffs’ motion asserted—citing Shafiq’s report—the", "paragraph_id": "para_977" }, { "text": "tracking code Adventist employed on the HRA forms caused", "paragraph_id": "para_978" }, { "text": "Google and Meta to be notified when an HRA form had been", "paragraph_id": "para_979" }, { "text": "completed and transmitted “ ‘full-string URLs’ . . . that ‘included", "paragraph_id": "para_980" }, { "text": "a unique string of numbers that would allow anyone . . . to access", "paragraph_id": "para_981" }, { "text": "the HRA reports’ contents.’ ” The court noted the cited portions", "paragraph_id": "para_982" }, { "text": "of Shafiq’s report stated Adventist shared information “ ‘about", "paragraph_id": "para_983" }, { "text": "specific events such as “HRA Report Accessed” ’ and URLs such", "paragraph_id": "para_984" }, { "text": "as ‘https://quiz.adventisthealth.org/v3/c6c2ecf4-abec-4222-843a-", "paragraph_id": "para_985" }, { "text": "65e83697f7b0/report/a2d7dfd4-c6fe-4c53-8d41-eacf4e4e87a0.’ ”16", "paragraph_id": "para_986" }, { "text": "Shafiq noted “anyone can go” to that URL “to access the contents", "paragraph_id": "para_987" }, { "text": "of the report.”", "paragraph_id": "para_988" }, { "text": "When “clicked” the two example HRA URLs in Shafiq’s", "paragraph_id": "para_989" }, { "text": "report indeed link directly to reports that assess the user’s risk", "paragraph_id": "para_990" }, { "text": "factors for the specified health condition based on information", "paragraph_id": "para_991" }, { "text": "the user input into the HRA form. (See footnote 16.) The reports", "paragraph_id": "para_992" }, { "text": "thus refer to that user-provided information. For example, the", "paragraph_id": "para_993" }, { "text": "WeightAware report recommended the individual lose weight", "paragraph_id": "para_994" }, { "text": "and indicated, among other things, that the individual had", "paragraph_id": "para_995" }, { "text": "high blood pressure and cholesterol or was taking medication", "paragraph_id": "para_996" }, { "text": "for those conditions, had sleep apnea and asthma, and exercised", "paragraph_id": "para_997" }, { "text": "a moderate amount. Similarly, the HeartAware report accessed", "paragraph_id": "para_998" }, { "text": "from a second link included the individual’s age, sex, and weight,", "paragraph_id": "para_999" }, { "text": "and noted the person had cholesterol outside the recommended", "paragraph_id": "para_1000" }, { "text": "16 This link is to a “WeightAware” report—an HRA for", "paragraph_id": "para_1001" }, { "text": "weight loss. Shafiq’s report also included the following link", "paragraph_id": "para_1002" }, { "text": "to a “HeartAware” report—an HRA for cardiovascular risk:", "paragraph_id": "para_1003" }, { "text": "https://quiz.adventisthealth.org/v3/64d7e7c0-d719-4d61-be6d-", "paragraph_id": "para_1004" }, { "text": "a2a3f50cebbe/report/8f3a968d-1615-4857-a52b-ebde3074886b.", "paragraph_id": "para_1005" }, { "text": "34", "paragraph_id": "para_1006" }, { "text": "range, had a family history of early cardiovascular disease,", "paragraph_id": "para_1007" }, { "text": "and exercised a moderate amount, among other information.", "paragraph_id": "para_1008" }, { "text": "The court found it was “questionable whether the fact that", "paragraph_id": "para_1009" }, { "text": "a person filled out an HRA reveals the contents of a patient’s", "paragraph_id": "para_1010" }, { "text": "communications with [Adventist] or anything about the patient’s", "paragraph_id": "para_1011" }, { "text": "physical or mental condition or treatment. On the other hand,", "paragraph_id": "para_1012" }, { "text": "the actual HRAs likely contain both contents of patients’", "paragraph_id": "para_1013" }, { "text": "communications and their medical information.” This difference", "paragraph_id": "para_1014" }, { "text": "between a URL/event data indicating a patient had submitted", "paragraph_id": "para_1015" }, { "text": "an HRA form, and the completed HRA form or results report", "paragraph_id": "para_1016" }, { "text": "itself, is the only reasoning the court expressed for finding", "paragraph_id": "para_1017" }, { "text": "plaintiffs failed to demonstrate common issues predominated", "paragraph_id": "para_1018" }, { "text": "for the HRA form subclass on their CIPA claim.", "paragraph_id": "para_1019" }, { "text": "But plaintiffs alleged that every submission of an HRA", "paragraph_id": "para_1020" }, { "text": "questionnaire resulted in the transmission of a URL that linked", "paragraph_id": "para_1021" }, { "text": "directly to an HRA report. And whether the transmission", "paragraph_id": "para_1022" }, { "text": "of those URLs linking to completed reports—rather than", "paragraph_id": "para_1023" }, { "text": "transmission of the reports themselves—is the transmission", "paragraph_id": "para_1024" }, { "text": "of “contents” under CIPA or medical information under CMIA,", "paragraph_id": "para_1025" }, { "text": "is a merits question. (See Linder v. Thrifty Oil Co. (2000) 23", "paragraph_id": "para_1026" }, { "text": "Cal.4th 429, 439–440 (Linder) [question of class certification", "paragraph_id": "para_1027" }, { "text": "is “essentially a procedural one that does not ask whether an", "paragraph_id": "para_1028" }, { "text": "action is legally or factually meritorious”]; see also Sav-On Drug", "paragraph_id": "para_1029" }, { "text": "Stores, Inc. v. Superior Court (2004) 34 Cal.4th 319, 327 (Sav-On)", "paragraph_id": "para_1030" }, { "text": "[“focus in a certification dispute is on what type of questions—", "paragraph_id": "para_1031" }, { "text": "common or individual—are likely to arise in the action, rather", "paragraph_id": "para_1032" }, { "text": "than on the merits of the case”].) Plaintiffs presented evidence", "paragraph_id": "para_1033" }, { "text": "that this merits question could be answered—one way or", "paragraph_id": "para_1034" }, { "text": "the other—with common proof. They presented evidence that", "paragraph_id": "para_1035" }, { "text": "the tracking technologies were installed on the HRA portion of", "paragraph_id": "para_1036" }, { "text": "35", "paragraph_id": "para_1037" }, { "text": "the Adventist website and where patients filled out HRA forms;", "paragraph_id": "para_1038" }, { "text": "the tracking technologies uniformly shared “a baseline of", "paragraph_id": "para_1039" }, { "text": "information” that included URLs, along with first-party cookie", "paragraph_id": "para_1040" }, { "text": "identifiers, IP addresses, and user agent data; and after a user", "paragraph_id": "para_1041" }, { "text": "submitted an HRA form, a URL was generated providing the user", "paragraph_id": "para_1042" }, { "text": "with a report of the results. In other words plaintiffs’ evidence", "paragraph_id": "para_1043" }, { "text": "allegedly would show that patients who submitted HRA forms", "paragraph_id": "para_1044" }, { "text": "would have received a report of their results through a URL link,", "paragraph_id": "para_1045" }, { "text": "and the tracking technologies uniformly would have shared that", "paragraph_id": "para_1046" }, { "text": "URL link with Google and/or Meta regardless of the specific HRA", "paragraph_id": "para_1047" }, { "text": "submitted. And arguably the results report for any submitted", "paragraph_id": "para_1048" }, { "text": "HRA—as in the examples above—likely would contain the", "paragraph_id": "para_1049" }, { "text": "“contents” of patients’ communications and their medical", "paragraph_id": "para_1050" }, { "text": "information.", "paragraph_id": "para_1051" }, { "text": "Adventist nevertheless argues plaintiffs “presented no", "paragraph_id": "para_1052" }, { "text": "evidence that links to particular HRA results were uniformly", "paragraph_id": "para_1053" }, { "text": "transmitted,” and Shafiq’s report did not show the tracking pixels", "paragraph_id": "para_1054" }, { "text": "actually shared the HRA results URL with Google and/or Meta.", "paragraph_id": "para_1055" }, { "text": "Shafiq stated—under penalty of perjury—that his “testing and", "paragraph_id": "para_1056" }, { "text": "analysis” showed Adventist installed tracking pixels from Google", "paragraph_id": "para_1057" }, { "text": "and Meta on the HRA section of its website, including where", "paragraph_id": "para_1058" }, { "text": "the patient fills out the HRA form. Anne Dinapoli Block—a", "paragraph_id": "para_1059" }, { "text": "representative from Adventist’s marketing firm BPD—testified", "paragraph_id": "para_1060" }, { "text": "Google Tag Manager containers that included tracking pixels", "paragraph_id": "para_1061" }, { "text": "for Google and Meta were “on the HRAs.” And Shafiq’s report", "paragraph_id": "para_1062" }, { "text": "included the two URL examples noted above.", "paragraph_id": "para_1063" }, { "text": "Shafiq also stated he tested how Adventist “installs", "paragraph_id": "para_1064" }, { "text": "tracking pixels from third party companies while interacting with", "paragraph_id": "para_1065" }, { "text": "the website in the form of assessments, surveys, and quizzes.”", "paragraph_id": "para_1066" }, { "text": "He filled out three different HRAs and a cancer genetic risk", "paragraph_id": "para_1067" }, { "text": "36", "paragraph_id": "para_1068" }, { "text": "survey and, after submitting them, received a final report", "paragraph_id": "para_1069" }, { "text": "for each that he “could view, print, or email.” Shafiq stated", "paragraph_id": "para_1070" }, { "text": "his “testing showed Adventist did share the full-string URL", "paragraph_id": "para_1071" }, { "text": "on the HRA portion of its website with both Google and Meta.”", "paragraph_id": "para_1072" }, { "text": "Moreover, Shafiq opined the “tracking pixel source code on", "paragraph_id": "para_1073" }, { "text": "Adventist Health’s website operates deterministically, meaning", "paragraph_id": "para_1074" }, { "text": "it consistently executes in the same manner, always sharing", "paragraph_id": "para_1075" }, { "text": "identifiers and content information with third parties such", "paragraph_id": "para_1076" }, { "text": "as Google or Meta.” Shafiq further explained, “[s]uch code is", "paragraph_id": "para_1077" }, { "text": "designed to behave uniformly for all users, meaning it will", "paragraph_id": "para_1078" }, { "text": "execute the same way and share identical types of information", "paragraph_id": "para_1079" }, { "text": "for every patient accessing Adventist Health’s website.” He", "paragraph_id": "para_1080" }, { "text": "concluded Adventist’s website “uniformly installed tracking", "paragraph_id": "para_1081" }, { "text": "pixels from third-party companies such as Google and Meta", "paragraph_id": "para_1082" }, { "text": "over the class period.” And Adventist’s expert Cohen testified", "paragraph_id": "para_1083" }, { "text": "she was unaware of any instances where the tracking pixels", "paragraph_id": "para_1084" }, { "text": "installed on the “various Adventist websites” did not “share", "paragraph_id": "para_1085" }, { "text": "at least a baseline of information,” including URLs.", "paragraph_id": "para_1086" }, { "text": "Adventist asserts Shafiq’s report showed tracking", "paragraph_id": "para_1087" }, { "text": "technologies only on “the homepage/disclaimer page for one", "paragraph_id": "para_1088" }, { "text": "particular HRA,” but the report did not show “Google or Meta", "paragraph_id": "para_1089" }, { "text": "tracking pixels being used on an HRA results page.” Adventist", "paragraph_id": "para_1090" }, { "text": "notes its manager of marketing automation, Crystal Long,", "paragraph_id": "para_1091" }, { "text": "“testified that, to the extent they were used at all, tracking pixels", "paragraph_id": "para_1092" }, { "text": "would be on the initial disclaimer pages.” Long testified it", "paragraph_id": "para_1093" }, { "text": "was her “understanding” that there was a pixel on the initial", "paragraph_id": "para_1094" }, { "text": "disclaimer page but that pixel did not record if someone", "paragraph_id": "para_1095" }, { "text": "completed an assessment, “[s]o the person could have left the", "paragraph_id": "para_1096" }, { "text": "[HRA] and never checked the box and never proceeded, but", "paragraph_id": "para_1097" }, { "text": "they’re thinking that somebody took that HRA because they", "paragraph_id": "para_1098" }, { "text": "37", "paragraph_id": "para_1099" }, { "text": "got to that page.” She recalled that issue “led to a discrepancy", "paragraph_id": "para_1100" }, { "text": "between the number of people who visited the [HRA] page and", "paragraph_id": "para_1101" }, { "text": "the number that actually completed it.” She did not testify that", "paragraph_id": "para_1102" }, { "text": "pixels were not firing on the pages or events that came up when", "paragraph_id": "para_1103" }, { "text": "a person checked the disclaimer box and completed the HRA", "paragraph_id": "para_1104" }, { "text": "form, however. Adventist also asserts Shafiq “fail[ed] to show—", "paragraph_id": "para_1105" }, { "text": "through DevTools, historical Google Analytics data, or otherwise”", "paragraph_id": "para_1106" }, { "text": "—that the HRA results URL was transmitted to a third party.", "paragraph_id": "para_1107" }, { "text": "Whether plaintiffs can prove Adventist in fact transmitted", "paragraph_id": "para_1108" }, { "text": "URL links to HRA reports to Google and/or Meta also is a merits", "paragraph_id": "para_1109" }, { "text": "question. At this stage, however, plaintiffs had to demonstrate", "paragraph_id": "para_1110" }, { "text": "the claim was subject to common proof, not that they likely would", "paragraph_id": "para_1111" }, { "text": "prevail on the claim. (Downey, supra, 44 Cal.App.5th at p. 1113", "paragraph_id": "para_1112" }, { "text": "[predominance inquiry asks if the elements of the claim are", "paragraph_id": "para_1113" }, { "text": "“susceptible of common proof”].) We conclude the evidence", "paragraph_id": "para_1114" }, { "text": "plaintiffs presented was sufficient to demonstrate this issue—", "paragraph_id": "para_1115" }, { "text": "whether Adventist uniformly shared URL links to patient HRA", "paragraph_id": "para_1116" }, { "text": "reports with Google and/or Meta—could be answered through", "paragraph_id": "para_1117" }, { "text": "common proof rather than individual inquiry. We offer no", "paragraph_id": "para_1118" }, { "text": "opinion as to whether the evidence plaintiffs ultimately produce", "paragraph_id": "para_1119" }, { "text": "will be sufficient to prove that is what happened.17 In any event,", "paragraph_id": "para_1120" }, { "text": "17 Discovery is ongoing. After the certification hearing,", "paragraph_id": "para_1121" }, { "text": "in January 2025, the court granted plaintiffs’ motion to compel", "paragraph_id": "para_1122" }, { "text": "Adventist to produce certain Google Analytic logs it had provided", "paragraph_id": "para_1123" }, { "text": "to its expert Cohen, which Shafiq would use for further statistical", "paragraph_id": "para_1124" }, { "text": "analysis. At the certification hearing, plaintiffs’ counsel noted", "paragraph_id": "para_1125" }, { "text": "the pending motion to compel and argued that, with those data", "paragraph_id": "para_1126" }, { "text": "logs, Shafiq could “do a probability analysis . . . to identify the", "paragraph_id": "para_1127" }, { "text": "likelihood that an individual class member will have transmitted", "paragraph_id": "para_1128" }, { "text": "protected health information at least once during the class", "paragraph_id": "para_1129" }, { "text": "period.”", "paragraph_id": "para_1130" }, { "text": "38", "paragraph_id": "para_1131" }, { "text": "the court did not deny certification of the HRA form subclass", "paragraph_id": "para_1132" }, { "text": "for failing to satisfy the predominance prong on the ground", "paragraph_id": "para_1133" }, { "text": "plaintiffs failed to show Adventist—through tracking", "paragraph_id": "para_1134" }, { "text": "technologies—uniformly shared URL links to patients’ HRA", "paragraph_id": "para_1135" }, { "text": "reports with Meta and/or Google. (See Leeds, supra, 115", "paragraph_id": "para_1136" }, { "text": "Cal.App.5th at pp. 545–546 [appellate court analyzes denial", "paragraph_id": "para_1137" }, { "text": "of class certification “ ‘based solely on the lower court’s stated", "paragraph_id": "para_1138" }, { "text": "reason for the decision’ ”]; Knapp, supra, 195 Cal.App.4th at", "paragraph_id": "para_1139" }, { "text": "p. 939 [“We may only consider the reasons stated by the trial", "paragraph_id": "para_1140" }, { "text": "court and must ignore any unexpressed reason that might", "paragraph_id": "para_1141" }, { "text": "support the ruling.”].)", "paragraph_id": "para_1142" }, { "text": "Adventist also contends the court correctly found “there", "paragraph_id": "para_1143" }, { "text": "is significant variability within the URLs and event data that", "paragraph_id": "para_1144" }, { "text": "are allegedly transferred to Google and/or Meta” with respect to", "paragraph_id": "para_1145" }, { "text": "the HRA form subclass. In its discussion of the predominance", "paragraph_id": "para_1146" }, { "text": "prong for plaintiffs’ CIPA and CMIA claims as to the general", "paragraph_id": "para_1147" }, { "text": "class, the court referred to—in addition to “ ‘ “HRA Report", "paragraph_id": "para_1148" }, { "text": "Accessed” ’ ”—other “ ‘specific events’ ” and “page URLs” from", "paragraph_id": "para_1149" }, { "text": "the HRA website that Shafiq’s report stated Adventist tracked", "paragraph_id": "para_1150" }, { "text": "and transmitted, such as “ ‘ “HRA Disclaimer Agree,” ’ ”", "paragraph_id": "para_1151" }, { "text": "“ ‘ “HRA Email Sign Up,” ’ ” “ ‘patient-assessment-report,’ ”", "paragraph_id": "para_1152" }, { "text": "“ ‘https://hraadventisthealth.org,’ ” and “ ‘https://quiz.adventist", "paragraph_id": "para_1153" }, { "text": "health.org.’ ” The court noted Shafiq didn’t state whether the", "paragraph_id": "para_1154" }, { "text": "referenced “events” “contain[ed] patient search terms” and", "paragraph_id": "para_1155" }, { "text": "didn’t differentiate between URLs and page titles that included", "paragraph_id": "para_1156" }, { "text": "“user-inputted search terms” and those that did not. The court", "paragraph_id": "para_1157" }, { "text": "found the noted events “appear[ed] to be records of page views", "paragraph_id": "para_1158" }, { "text": "or buttons/links that a patient clicked” and thus were “not", "paragraph_id": "para_1159" }, { "text": "‘content.’ ” The court also found the noted URLs and events", "paragraph_id": "para_1160" }, { "text": "39", "paragraph_id": "para_1161" }, { "text": "“provide[d] no information on their face about a patient’s", "paragraph_id": "para_1162" }, { "text": "medical history, mental or physical condition, or treatment.”", "paragraph_id": "para_1163" }, { "text": "The proposed HRA form subclass, however, includes only", "paragraph_id": "para_1164" }, { "text": "patients who submitted HRA forms. The fact that Adventist", "paragraph_id": "para_1165" }, { "text": "transmitted different URLs or event data depending on whether", "paragraph_id": "para_1166" }, { "text": "a patient visited an HRA page, clicked on an HRA “quiz,” or", "paragraph_id": "para_1167" }, { "text": "accessed an HRA report after submitting an HRA form thus", "paragraph_id": "para_1168" }, { "text": "did not create individualized issues of proof—patients who", "paragraph_id": "para_1169" }, { "text": "viewed but did not submit an HRA form or who only visited an", "paragraph_id": "para_1170" }, { "text": "HRA page would not be part of the subclass. Only individuals", "paragraph_id": "para_1171" }, { "text": "who submitted an HRA form would have received a URL link to", "paragraph_id": "para_1172" }, { "text": "the report with the results. And as plaintiffs assert, all patients", "paragraph_id": "para_1173" }, { "text": "who submitted an HRA form would have “proceeded through", "paragraph_id": "para_1174" }, { "text": "[the] entire workflow” of multiple page view events. Moreover,", "paragraph_id": "para_1175" }, { "text": "determining whether the sharing of a URL that links directly", "paragraph_id": "para_1176" }, { "text": "to an HRA report can itself constitute the transmission of the", "paragraph_id": "para_1177" }, { "text": "“contents” of a communication or of medical information would", "paragraph_id": "para_1178" }, { "text": "not require review of each individual URL. Nor did the court", "paragraph_id": "para_1179" }, { "text": "conclude the URLs that Adventist shared when patients", "paragraph_id": "para_1180" }, { "text": "submitted HRA forms were too varied to determine by common", "paragraph_id": "para_1181" }, { "text": "proof whether they constituted the contents of a communication", "paragraph_id": "para_1182" }, { "text": "or medical information. As we now discuss, the court found", "paragraph_id": "para_1183" }, { "text": "proof of plaintiffs’ CMIA claim for the HRA form subclass would", "paragraph_id": "para_1184" }, { "text": "require individualized inquiry based on an entirely different", "paragraph_id": "para_1185" }, { "text": "reason.", "paragraph_id": "para_1186" }, { "text": "40", "paragraph_id": "para_1187" }, { "text": "ii. Plaintiffs presented evidence that the question", "paragraph_id": "para_1188" }, { "text": "of whether Google and/or Meta viewed or", "paragraph_id": "para_1189" }, { "text": "accessed submitted HRA forms and/or reports", "paragraph_id": "para_1190" }, { "text": "under the CMIA was subject to common proof", "paragraph_id": "para_1191" }, { "text": "As the court noted, “Liability under CMIA requires a", "paragraph_id": "para_1192" }, { "text": "showing ‘that the confidential nature of the plaintiff’s medical", "paragraph_id": "para_1193" }, { "text": "information was breached as a result of the health care provider’s", "paragraph_id": "para_1194" }, { "text": "negligence’ or affirmative conduct.” (Quoting Regents of", "paragraph_id": "para_1195" }, { "text": "University of California v. Superior Court (2013) 220 Cal.App.4th", "paragraph_id": "para_1196" }, { "text": "549, 564, 570, disapproved of on another ground in J.M. v.", "paragraph_id": "para_1197" }, { "text": "Illuminate Education, Inc. (2026) 19 Cal.5th 705, 723 (J.M.).)", "paragraph_id": "para_1198" }, { "text": "Undoubtedly, the reports generated in response to a patient’s", "paragraph_id": "para_1199" }, { "text": "submitted HRA form—as we described above—contained", "paragraph_id": "para_1200" }, { "text": "information “regarding” that patient’s medical history, condition,", "paragraph_id": "para_1201" }, { "text": "or treatment. (Civ. Code, § 56.05, subd. (j)(1) [defining “medical", "paragraph_id": "para_1202" }, { "text": "information”].) Plaintiffs also presented evidence that the", "paragraph_id": "para_1203" }, { "text": "tracking technologies on the Adventist websites transmitted", "paragraph_id": "para_1204" }, { "text": "identifiers including—at a minimum—first-party cookie", "paragraph_id": "para_1205" }, { "text": "identifiers, IP addresses, and user agent data from which Google", "paragraph_id": "para_1206" }, { "text": "and/or Meta could identify the specific user.18 (Ibid. [“medical", "paragraph_id": "para_1207" }, { "text": "information” is “any individually identifiable information”", "paragraph_id": "para_1208" }, { "text": "regarding a patient’s medical history, etc.].) And, as we", "paragraph_id": "para_1209" }, { "text": "discussed, plaintiffs presented evidence that whether Adventist", "paragraph_id": "para_1210" }, { "text": "transmitted URL links to its patients’ HRA reports is subject", "paragraph_id": "para_1211" }, { "text": "to common proof.", "paragraph_id": "para_1212" }, { "text": "18 Adventist argues that whether Adventist transferred", "paragraph_id": "para_1213" }, { "text": "“identifying information . . . for any particular user” to Google", "paragraph_id": "para_1214" }, { "text": "and/or Meta is a “significant individualized issue.” The court’s", "paragraph_id": "para_1215" }, { "text": "order, however, did not find plaintiffs failed to show common", "paragraph_id": "para_1216" }, { "text": "issues predominated on this question. Without getting into too", "paragraph_id": "para_1217" }, { "text": "41", "paragraph_id": "para_1218" }, { "text": "In essentially finding Adventist’s liability under CMIA", "paragraph_id": "para_1219" }, { "text": "was not susceptible to class-wide proof for the HRA form", "paragraph_id": "para_1220" }, { "text": "subclass, the court noted the “quiz” URL plaintiffs cited from", "paragraph_id": "para_1221" }, { "text": "Shafiq’s report—“containing a [unique] string of numbers", "paragraph_id": "para_1222" }, { "text": "and letters”—“does not, on its face, reveal medical information.", "paragraph_id": "para_1223" }, { "text": "Rather[,] it provides access to medication information.” In Vigil", "paragraph_id": "para_1224" }, { "text": "v. Muir Medical Group IPA, Inc. (2022) 84 Cal.App.5th 197, 213", "paragraph_id": "para_1225" }, { "text": "(Vigil),19 the appellate court held “a breach of confidentiality", "paragraph_id": "para_1226" }, { "text": "under the CMIA requires a showing that an unauthorized party", "paragraph_id": "para_1227" }, { "text": "viewed the confidential information.” (Italics added.) Thus, an", "paragraph_id": "para_1228" }, { "text": "unauthorized party’s possession of or access to the confidential", "paragraph_id": "para_1229" }, { "text": "information would be insufficient to show a breach. (Id. at", "paragraph_id": "para_1230" }, { "text": "pp. 217–219.) The court in Vigil also agreed “breach of", "paragraph_id": "para_1231" }, { "text": "confidentiality under the CMIA is an individualized issue.” (Id.", "paragraph_id": "para_1232" }, { "text": "at p. 219; id. at p. 220 [concluding “each class member would", "paragraph_id": "para_1233" }, { "text": "have to show that his or her medical information was viewed by", "paragraph_id": "para_1234" }, { "text": "an unauthorized party to recover under the CMIA” under Civil", "paragraph_id": "para_1235" }, { "text": "much technical detail, Shafiq explained Google and/or Meta could", "paragraph_id": "para_1236" }, { "text": "determine a user’s identity through “[d]eterministic matching . . .", "paragraph_id": "para_1237" }, { "text": "based on identifiers such as email address, phone number, and", "paragraph_id": "para_1238" }, { "text": "device identifiers,” or “[p]robabilistic matching (also known as", "paragraph_id": "para_1239" }, { "text": "fingerprinting),” which “relies on statistical analysis of multiple", "paragraph_id": "para_1240" }, { "text": "signals.” Shafiq opined the “IP address, user agent, and device", "paragraph_id": "para_1241" }, { "text": "properties from the patient’s browser” that Adventist shared", "paragraph_id": "para_1242" }, { "text": "through the tracking technologies contained a sufficient amount", "paragraph_id": "para_1243" }, { "text": "of data “bits” to enable Google/Meta to “reasonably identi[f]y", "paragraph_id": "para_1244" }, { "text": "an individual”—“even when the patients are not account holders”", "paragraph_id": "para_1245" }, { "text": "—through “identity services” using deterministic and/or", "paragraph_id": "para_1246" }, { "text": "probabilistic matching.", "paragraph_id": "para_1247" }, { "text": "19 As we discuss, Vigil was disapproved of in J.M., supra, 19", "paragraph_id": "para_1248" }, { "text": "Cal.5th at p. 723.", "paragraph_id": "para_1249" }, { "text": "42", "paragraph_id": "para_1250" }, { "text": "Code §§ 56.36, subd. (b) and 56.101, subd. (a)].)20 Following Vigil,", "paragraph_id": "para_1251" }, { "text": "the court here found plaintiffs would have to show Google", "paragraph_id": "para_1252" }, { "text": "and/or Meta actually viewed the contents of the HRAs to show", "paragraph_id": "para_1253" }, { "text": "Adventist’s disclosure of the link violated CMIA.21", "paragraph_id": "para_1254" }, { "text": "After this matter was submitted for decision, our high", "paragraph_id": "para_1255" }, { "text": "court rejected the Vigil “rule that no breach of confidentiality", "paragraph_id": "para_1256" }, { "text": "has occurred until medical information is actually viewed by", "paragraph_id": "para_1257" }, { "text": "an unauthorized person.” (J.M., supra, 19 Cal.5th at p. 721.)", "paragraph_id": "para_1258" }, { "text": "The court held “the primary inquiry with regard to breach", "paragraph_id": "para_1259" }, { "text": "of confidentiality is whether the information is exposed to a", "paragraph_id": "para_1260" }, { "text": "significant risk of unauthorized access or use.” (Id. at p. 723.)", "paragraph_id": "para_1261" }, { "text": "The court disapproved Vigil to the extent it held otherwise.22", "paragraph_id": "para_1262" }, { "text": "(Ibid.)", "paragraph_id": "para_1263" }, { "text": "20 Vigil involved a data breach where a former employee of", "paragraph_id": "para_1264" }, { "text": "a medical group, before her employment ended, “downloaded", "paragraph_id": "para_1265" }, { "text": "copies of information for over 5,400 patients that included", "paragraph_id": "para_1266" }, { "text": "insurance and clinical information.” (Vigil, supra, 84 Cal.App.5th", "paragraph_id": "para_1267" }, { "text": "at pp. 205–206.) The named plaintiff had argued “the case could", "paragraph_id": "para_1268" }, { "text": "be decided on a classwide basis because there was evidence", "paragraph_id": "para_1269" }, { "text": "that [the former employee] downloaded, retained, and viewed", "paragraph_id": "para_1270" }, { "text": "a patient spreadsheet.” (Id. at p. 207.)", "paragraph_id": "para_1271" }, { "text": "21 As plaintiffs note, whether a third party “actually viewed", "paragraph_id": "para_1272" }, { "text": "the information” is not an element under CIPA. (See § 631(a)", "paragraph_id": "para_1273" }, { "text": "[CIPA is violated when a party “reads or attempts to read,", "paragraph_id": "para_1274" }, { "text": "or to learn the contents or meaning of any message, report,", "paragraph_id": "para_1275" }, { "text": "or communication” in transit]; see also footnote 22.)", "paragraph_id": "para_1276" }, { "text": "22 As we discuss, the J.M. decision does not affect our", "paragraph_id": "para_1277" }, { "text": "disposition. If plaintiffs’ proffered theory of proof would enable", "paragraph_id": "para_1278" }, { "text": "a factfinder to determine on a class-wide basis whether Google", "paragraph_id": "para_1279" }, { "text": "and/or Meta viewed or accessed the HRA report links—as we", "paragraph_id": "para_1280" }, { "text": "conclude it does below—it also would enable a factfinder to", "paragraph_id": "para_1281" }, { "text": "43", "paragraph_id": "para_1282" }, { "text": "Not having the benefit of J.M., however, on appeal,", "paragraph_id": "para_1283" }, { "text": "plaintiffs have argued the trial court ignored their proposed", "paragraph_id": "para_1284" }, { "text": "theory of how they commonly could prove “whether third", "paragraph_id": "para_1285" }, { "text": "parties viewed or accessed HRA Subclass members’ medical", "paragraph_id": "para_1286" }, { "text": "information.” Plaintiffs assert they will present evidence at", "paragraph_id": "para_1287" }, { "text": "trial—through their expert Dr. Jennifer Golbeck’s testimony—", "paragraph_id": "para_1288" }, { "text": "that Meta and Google “used sophisticated computer algorithms", "paragraph_id": "para_1289" }, { "text": "to process and analyze the data received from tracking pixel", "paragraph_id": "para_1290" }, { "text": "transmissions.” As plaintiffs note, in her report, Golbeck", "paragraph_id": "para_1291" }, { "text": "summarized her analysis as showing “that Facebook and", "paragraph_id": "para_1292" }, { "text": "Google routinely collect, analyze[ ], and exploit users’ data", "paragraph_id": "para_1293" }, { "text": "for advertising purposes, including the data of Adventist’s", "paragraph_id": "para_1294" }, { "text": "patients.”23 As “Golbeck’s testimony will apply to the entire", "paragraph_id": "para_1295" }, { "text": "Subclass,” plaintiffs contend this element “is a common issue", "paragraph_id": "para_1296" }, { "text": "supporting predominance.” To the extent that this evidence", "paragraph_id": "para_1297" }, { "text": "would satisfy an actual “viewing” or “accessing” requirement,", "paragraph_id": "para_1298" }, { "text": "it would necessarily demonstrate exposure to a significant risk", "paragraph_id": "para_1299" }, { "text": "of unauthorized access.", "paragraph_id": "para_1300" }, { "text": "Adventist argues plaintiffs never argued Meta’s and", "paragraph_id": "para_1301" }, { "text": "Google’s algorithmic processing of data constituted “ ‘viewing’ ”", "paragraph_id": "para_1302" }, { "text": "of that information for purposes of CMIA. Adventist", "paragraph_id": "para_1303" }, { "text": "acknowledges plaintiffs mentioned their algorithm theory", "paragraph_id": "para_1304" }, { "text": "determine if the information in the HRA report links was", "paragraph_id": "para_1305" }, { "text": "“exposed to a significant risk of unauthorized access or use.”", "paragraph_id": "para_1306" }, { "text": "(J.M., supra, 19 Cal.5th at p. 723.) To the extent J.M. raises new", "paragraph_id": "para_1307" }, { "text": "issues, however, the parties may raise them in the trial court", "paragraph_id": "para_1308" }, { "text": "on remand.", "paragraph_id": "para_1309" }, { "text": "23 The court denied Adventist’s motion to strike Golbeck’s", "paragraph_id": "para_1310" }, { "text": "report and opinions.", "paragraph_id": "para_1311" }, { "text": "44", "paragraph_id": "para_1312" }, { "text": "in a footnote but essentially contends that, because a footnote", "paragraph_id": "para_1313" }, { "text": "was insufficient to “advance their ‘algorithmic processing’ theory", "paragraph_id": "para_1314" }, { "text": "at . . . trial,” plaintiffs forfeited the argument.", "paragraph_id": "para_1315" }, { "text": "We disagree. In their motion, plaintiffs argued that", "paragraph_id": "para_1316" }, { "text": "whether Adventist violated CMIA depended on questions", "paragraph_id": "para_1317" }, { "text": "common to the class, including whether “the disclosed", "paragraph_id": "para_1318" }, { "text": "information was ‘viewed or accessed’ by an unauthorized party.”", "paragraph_id": "para_1319" }, { "text": "Plaintiffs provided their support for that statement—as they did", "paragraph_id": "para_1320" }, { "text": "for other common questions their motion identified for this cause", "paragraph_id": "para_1321" }, { "text": "of action—in a footnote. Plaintiffs asserted their expert Golbeck", "paragraph_id": "para_1322" }, { "text": "“will testify that Facebook and Google have sophisticated systems", "paragraph_id": "para_1323" }, { "text": "for processing and analyzing the data and building profiles used", "paragraph_id": "para_1324" }, { "text": "to serve targeted advertising. [Citing ¶¶ 35–77 of Golbeck’s", "paragraph_id": "para_1325" }, { "text": "report.] How these algorithms work and whether processing", "paragraph_id": "para_1326" }, { "text": "by computer algorithm constitutes being ‘viewed or otherwise", "paragraph_id": "para_1327" }, { "text": "accessed’ for CMIA purposes present common questions.”", "paragraph_id": "para_1328" }, { "text": "Plaintiffs filed Golbeck’s report with their motion as a supporting", "paragraph_id": "para_1329" }, { "text": "exhibit. Plaintiffs also cited to Cousin II in support of this", "paragraph_id": "para_1330" }, { "text": "theory. In that case, the district court denied defendant’s motion", "paragraph_id": "para_1331" }, { "text": "to dismiss the plaintiffs’ CMIA claim where the plaintiffs had", "paragraph_id": "para_1332" }, { "text": "“plead[ed] information regarding Meta’s business model and", "paragraph_id": "para_1333" }, { "text": "how it uses the information for targeted advertising.” (Cousin II,", "paragraph_id": "para_1334" }, { "text": "supra, 702 F.Supp.3d at p. 975.) The court explained “whether", "paragraph_id": "para_1335" }, { "text": "the alleged use by Meta of the information, through perhaps", "paragraph_id": "para_1336" }, { "text": "algorithms, amounts to viewing or accessing under CMIA is", "paragraph_id": "para_1337" }, { "text": "a question the Court cannot answer on Defendant’s motion to", "paragraph_id": "para_1338" }, { "text": "dismiss. It is sufficiently plausible at this time that Plaintiffs’", "paragraph_id": "para_1339" }, { "text": "information was ‘viewed or otherwise accessed’ as contemplated", "paragraph_id": "para_1340" }, { "text": "by CMIA.” (Ibid.)", "paragraph_id": "para_1341" }, { "text": "45", "paragraph_id": "para_1342" }, { "text": "Adventist relies on Holden v. City of San Diego (2019) 43", "paragraph_id": "para_1343" }, { "text": "Cal.App.5th 404. There, the court found a plaintiff was precluded", "paragraph_id": "para_1344" }, { "text": "from raising a legal issue on appeal—that the defendant city", "paragraph_id": "para_1345" }, { "text": "had failed to comply with a statute—where he had raised that", "paragraph_id": "para_1346" }, { "text": "issue “only in a footnote in his opening [trial court] brief” without", "paragraph_id": "para_1347" }, { "text": "substantive legal analysis. (Id. at p. 419.) Holden is inapposite.", "paragraph_id": "para_1348" }, { "text": "There, the plaintiff’s footnote stated the city had ignored a", "paragraph_id": "para_1349" }, { "text": "statutory requirement without quoting the relevant language", "paragraph_id": "para_1350" }, { "text": "from the statute or providing any legal analysis that the city", "paragraph_id": "para_1351" }, { "text": "was required to comply with the statute and failed to do so.", "paragraph_id": "para_1352" }, { "text": "(Ibid.) The plaintiff also failed to provide any substantive", "paragraph_id": "para_1353" }, { "text": "analysis of the issue in his opening brief on appeal, again", "paragraph_id": "para_1354" }, { "text": "referring to a footnote. (Ibid.) Here, however, plaintiffs’ motion", "paragraph_id": "para_1355" }, { "text": "contended up front that common issues existed as to Adventist’s", "paragraph_id": "para_1356" }, { "text": "liability under CMIA and set forth those common questions in a", "paragraph_id": "para_1357" }, { "text": "bullet-pointed list. From our reading of the motion, counsel made", "paragraph_id": "para_1358" }, { "text": "a style choice to use footnotes to describe the common evidence", "paragraph_id": "para_1359" }, { "text": "plaintiffs would present to answer those questions rather than", "paragraph_id": "para_1360" }, { "text": "interrupt the flow of that list. And, unlike the plaintiff in", "paragraph_id": "para_1361" }, { "text": "Holden, plaintiffs’ opening and reply briefs on appeal", "paragraph_id": "para_1362" }, { "text": "substantively address their algorithm theory. We find no", "paragraph_id": "para_1363" }, { "text": "forfeiture.24", "paragraph_id": "para_1364" }, { "text": "The court did not mention plaintiffs’ algorithm theory of", "paragraph_id": "para_1365" }, { "text": "proof in finding they failed to show common issues predominated.", "paragraph_id": "para_1366" }, { "text": "It thus did not determine if this element of plaintiffs’ CMIA claim", "paragraph_id": "para_1367" }, { "text": "—whether Google and/or Meta viewed or accessed the HRA", "paragraph_id": "para_1368" }, { "text": "24 Moreover, in opposition to plaintiffs’ certification motion,", "paragraph_id": "para_1369" }, { "text": "Adventist never argued plaintiffs’ algorithm theory would not", "paragraph_id": "para_1370" }, { "text": "enable a factfinder to answer the viewing/accessing question", "paragraph_id": "para_1371" }, { "text": "on a class-wide basis for the HRA form subclass.", "paragraph_id": "para_1372" }, { "text": "46", "paragraph_id": "para_1373" }, { "text": "report links—could be determined on a class-wide basis under", "paragraph_id": "para_1374" }, { "text": "the theory plaintiffs proposed. (See Brinker, supra, 53 Cal.4th at", "paragraph_id": "para_1375" }, { "text": "p. 1021 [answer to question of predominance “hinges on ‘whether", "paragraph_id": "para_1376" }, { "text": "the theory of recovery advanced by the proponents of certification", "paragraph_id": "para_1377" }, { "text": "is, as an analytical matter, likely to prove amenable to class", "paragraph_id": "para_1378" }, { "text": "treatment’ ”]; Walsh, supra, 148 Cal.App.4th at p. 1450 [court", "paragraph_id": "para_1379" }, { "text": "must consider plaintiffs’ theory of liability to determine if", "paragraph_id": "para_1380" }, { "text": "common issues predominate].) This was error. As plaintiffs", "paragraph_id": "para_1381" }, { "text": "argue, the theory they advanced through Golbeck’s report", "paragraph_id": "para_1382" }, { "text": "was that “Google’s and Facebook’s sophisticated algorithms", "paragraph_id": "para_1383" }, { "text": "automatically processed the transmitted data.” Accordingly,", "paragraph_id": "para_1384" }, { "text": "“[t]he trial court’s ‘actual clicks’ theory b[ore] no relationship to", "paragraph_id": "para_1385" }, { "text": "Plaintiffs’ algorithmic processing theory . . . and therefore cannot", "paragraph_id": "para_1386" }, { "text": "support denial of certification.” They argue “[i]t is a class-wide", "paragraph_id": "para_1387" }, { "text": "merits issue whether the algorithmic processing that Plaintiffs", "paragraph_id": "para_1388" }, { "text": "will show Facebook and Google performed satisfies this element", "paragraph_id": "para_1389" }, { "text": "as ‘viewing’ or ‘accessing.’ ” (Citing the district court’s holding", "paragraph_id": "para_1390" }, { "text": "in Cousin II, supra, 702 F.Supp.3d at p. 975, stated above.)", "paragraph_id": "para_1391" }, { "text": "We agree and conclude plaintiffs presented sufficient", "paragraph_id": "para_1392" }, { "text": "evidence to demonstrate their algorithm theory of proof would", "paragraph_id": "para_1393" }, { "text": "enable a factfinder to determine on a class-wide basis whether", "paragraph_id": "para_1394" }, { "text": "Google and/or Meta viewed or accessed the HRA report links.", "paragraph_id": "para_1395" }, { "text": "In plaintiffs’ words, Golbeck’s report explained how Google", "paragraph_id": "para_1396" }, { "text": "and Facebook process, analyze, and assimilate users’ data", "paragraph_id": "para_1397" }, { "text": "they receive to provide targeted advertising. We have reviewed", "paragraph_id": "para_1398" }, { "text": "Golbeck’s report. She explained companies like Meta/Facebook", "paragraph_id": "para_1399" }, { "text": "and Google use machine learning systems to analyze all available", "paragraph_id": "para_1400" }, { "text": "user data to develop predictive models to develop targeted", "paragraph_id": "para_1401" }, { "text": "advertising. “[B]ecause a machine learning system constructs", "paragraph_id": "para_1402" }, { "text": "its predictive model from all data made available, all the data", "paragraph_id": "para_1403" }, { "text": "47", "paragraph_id": "para_1404" }, { "text": "made available is necessarily used by that system, regardless of", "paragraph_id": "para_1405" }, { "text": "what degree of predictive weight a resulting model places on any", "paragraph_id": "para_1406" }, { "text": "given data point.” Golbeck opined “it is reasonable to state that", "paragraph_id": "para_1407" }, { "text": "all data available to [a] model in operation is used by that model,", "paragraph_id": "para_1408" }, { "text": "and it is not usually feasible (and not part of the usual parlance", "paragraph_id": "para_1409" }, { "text": "of those working with machine learning) to discuss the", "paragraph_id": "para_1410" }, { "text": "relationship between a particular piece of data and the", "paragraph_id": "para_1411" }, { "text": "predictions made by the model.”", "paragraph_id": "para_1412" }, { "text": "As we understand their theory, plaintiffs contend they", "paragraph_id": "para_1413" }, { "text": "can show Meta’s and/or Google’s sophisticated data processing", "paragraph_id": "para_1414" }, { "text": "systems/computer algorithms, as a matter of course, would have", "paragraph_id": "para_1415" }, { "text": "“accessed” or “viewed” the data within the actual HRA reports", "paragraph_id": "para_1416" }, { "text": "—i.e., patients’ medical information—through the URL links", "paragraph_id": "para_1417" }, { "text": "Adventist transmitted. That data then necessarily would have", "paragraph_id": "para_1418" }, { "text": "been used in some way by the predictive models those systems", "paragraph_id": "para_1419" }, { "text": "created to develop targeted advertising. Such an analysis would", "paragraph_id": "para_1420" }, { "text": "show on a class-wide basis whether or not Adventist’s alleged", "paragraph_id": "para_1421" }, { "text": "transmission of URL links to patients’ HRA reports resulted", "paragraph_id": "para_1422" }, { "text": "in a breach of the “confidential nature” of patients’ medical", "paragraph_id": "para_1423" }, { "text": "information. Defendants argued below and on appeal that", "paragraph_id": "para_1424" }, { "text": "what Adventist allegedly transmitted was the URL, not the", "paragraph_id": "para_1425" }, { "text": "report itself, and the URL does not reveal medical information.", "paragraph_id": "para_1426" }, { "text": "But whether a third-party’s computer system’s assimilation of", "paragraph_id": "para_1427" }, { "text": "data—as plaintiffs’ expert described—amounts to the viewing", "paragraph_id": "para_1428" }, { "text": "or accessing of that data under the CMIA is a merits question", "paragraph_id": "para_1429" }, { "text": "common to the HRA form subclass. Accordingly, we conclude", "paragraph_id": "para_1430" }, { "text": "plaintiffs met their burden in the trial court to show whether", "paragraph_id": "para_1431" }, { "text": "unauthorized parties viewed or accessed HRA form subclass", "paragraph_id": "para_1432" }, { "text": "members’ medical information can be determined based on", "paragraph_id": "para_1433" }, { "text": "common proof.", "paragraph_id": "para_1434" }, { "text": "48", "paragraph_id": "para_1435" }, { "text": "In summary, we conclude the court’s reasoning did not", "paragraph_id": "para_1436" }, { "text": "support its finding that plaintiffs did not show common issues", "paragraph_id": "para_1437" }, { "text": "predominated on their CIPA and CMIA claims as to the HRA", "paragraph_id": "para_1438" }, { "text": "form subclass.", "paragraph_id": "para_1439" }, { "text": "c. The patient portal subclass", "paragraph_id": "para_1440" }, { "text": "i. Plaintiffs demonstrated their CIPA –", "paragraph_id": "para_1441" }, { "text": "wiretapping claim was subject to common proof", "paragraph_id": "para_1442" }, { "text": "Plaintiffs’ ultimate theory was that the baseline", "paragraph_id": "para_1443" }, { "text": "information the tracking pixels uniformly shared whenever", "paragraph_id": "para_1444" }, { "text": "patients interacted with an Adventist website—the first-party", "paragraph_id": "para_1445" }, { "text": "cookie identifiers, page view information, URLs (whether", "paragraph_id": "para_1446" }, { "text": "partially obfuscated or not), IP addresses (whether complete", "paragraph_id": "para_1447" }, { "text": "or partially masked), and user agent data—was evidence", "paragraph_id": "para_1448" }, { "text": "applicable class-wide to prove plaintiffs’ CIPA (and CMIA) claim,", "paragraph_id": "para_1449" }, { "text": "demonstrating common issues predominated. Plaintiffs relied", "paragraph_id": "para_1450" }, { "text": "on their expert Shafiq’s reports to show the question of whether", "paragraph_id": "para_1451" }, { "text": "this information included the “contents” of Adventist’s patients’", "paragraph_id": "para_1452" }, { "text": "communications was subject to common proof. Those reports,", "paragraph_id": "para_1453" }, { "text": "which the court examined, included Shafiq’s analysis of the data", "paragraph_id": "para_1454" }, { "text": "transmitted to Google and/or Meta from both Adventist’s public", "paragraph_id": "para_1455" }, { "text": "websites and the patient portal, however.", "paragraph_id": "para_1456" }, { "text": "Shafiq stated Adventist “shared at least the following types", "paragraph_id": "para_1457" }, { "text": "of sensitive information about patient activity . . . alongside the", "paragraph_id": "para_1458" }, { "text": "patient identifiers:” “Page URL that includes search terms” and", "paragraph_id": "para_1459" }, { "text": "“Page title that includes search terms.” Shafiq gave examples of", "paragraph_id": "para_1460" }, { "text": "URLs from Adventist’s public website that included query strings", "paragraph_id": "para_1461" }, { "text": "with search terms such as “pregnancy,” “breast . . . cancer,”", "paragraph_id": "para_1462" }, { "text": "and the name of a provider combined with the search term", "paragraph_id": "para_1463" }, { "text": "“mental . . . health” or “radiation . . . oncology.” Another page", "paragraph_id": "para_1464" }, { "text": "URL example showed a search at “doctors.adventisthealth.org”", "paragraph_id": "para_1465" }, { "text": "49", "paragraph_id": "para_1466" }, { "text": "that included a query string with the search terms “surgical”", "paragraph_id": "para_1467" }, { "text": "and “abortion.”", "paragraph_id": "para_1468" }, { "text": "The trial court noted those URL examples included search", "paragraph_id": "para_1469" }, { "text": "terms. The court also referred to Shafiq’s finding that Adventist", "paragraph_id": "para_1470" }, { "text": "shared “Page title that includes search terms such as ‘surgical", "paragraph_id": "para_1471" }, { "text": "abortion – Find a Physician or Provider/Adventist Health’", "paragraph_id": "para_1472" }, { "text": "and ‘MyAdventistHealth Patient Portal/Adventist Health.’ ”25", "paragraph_id": "para_1473" }, { "text": "The court noted the first page title example appeared to contain", "paragraph_id": "para_1474" }, { "text": "search terms but the second did not. The court concluded page", "paragraph_id": "para_1475" }, { "text": "titles like the example “ ‘MyAdventistHealth Patient Portal’ ”", "paragraph_id": "para_1476" }, { "text": "“merely identif[ied] the page” and were “not ‘a person’s personal", "paragraph_id": "para_1477" }, { "text": "search engine queries’ that [could] be content.” (Quoting", "paragraph_id": "para_1478" }, { "text": "Cousin II, supra, 702 F.Supp.3d at p. 976.) The court further", "paragraph_id": "para_1479" }, { "text": "noted Shafiq’s report referred to Adventist having tracked", "paragraph_id": "para_1480" }, { "text": "and transmitted “ ‘specific events’ ”—again, from Adventist’s", "paragraph_id": "para_1481" }, { "text": "public website—“ ‘such as “HRA Report Accessed,” “Online", "paragraph_id": "para_1482" }, { "text": "Scheduling Confirmation,” ’ ” “ ‘patient-assessment-report,’ ”", "paragraph_id": "para_1483" }, { "text": "“ ‘Knee Webinar Thank-You,’ . . . ‘Lodi Ortho Thank-You,’ . . .", "paragraph_id": "para_1484" }, { "text": "‘Adventist Health All Contact Button Clicks,’ [and] ‘Heart", "paragraph_id": "para_1485" }, { "text": "Webinar Pageview,’ ” but he did not “say these events contain", "paragraph_id": "para_1486" }, { "text": "patient search terms.” As we mentioned, the court found", "paragraph_id": "para_1487" }, { "text": "they appeared to be “records of page views or buttons/links", "paragraph_id": "para_1488" }, { "text": "that a patient clicked” and “[a]s such,” were “not ‘content.’ ”", "paragraph_id": "para_1489" }, { "text": "The court noted that although Shafiq gave examples of", "paragraph_id": "para_1490" }, { "text": "URLs “containing patients’ search terms,” his report “define[d]", "paragraph_id": "para_1491" }, { "text": "‘content information’ as including page titles.” “Navigating to", "paragraph_id": "para_1492" }, { "text": "25 The page title “MyAdventistHealth Patient Portal” appears", "paragraph_id": "para_1493" }, { "text": "to be the page where a patient can log into the portal, not", "paragraph_id": "para_1494" }, { "text": "necessarily the page within the patient portal after the patient", "paragraph_id": "para_1495" }, { "text": "has logged in.", "paragraph_id": "para_1496" }, { "text": "50", "paragraph_id": "para_1497" }, { "text": "a webpage without entering search terms,” the court reasoned,", "paragraph_id": "para_1498" }, { "text": "“does not transmit ‘contents,’ even if information about that", "paragraph_id": "para_1499" }, { "text": "webpage (i.e., record data) is transmitted.” (Citing Zynga, supra,", "paragraph_id": "para_1500" }, { "text": "750 F.3d at pp. 1108–1109.) Accordingly, because one patient’s", "paragraph_id": "para_1501" }, { "text": "transmitted information might contain “search terms” that", "paragraph_id": "para_1502" }, { "text": "“could be content,” while another patient’s transmitted", "paragraph_id": "para_1503" }, { "text": "information might consist of a “webpage or event information”", "paragraph_id": "para_1504" }, { "text": "that could be merely “record information,” the court found", "paragraph_id": "para_1505" }, { "text": "plaintiffs failed to show common issues predominated relating", "paragraph_id": "para_1506" }, { "text": "to this element of proof.", "paragraph_id": "para_1507" }, { "text": "Plaintiffs do not dispute this reasoning as applied to the", "paragraph_id": "para_1508" }, { "text": "variety of transmissions from Adventist’s public website with", "paragraph_id": "para_1509" }, { "text": "respect to the general class. Plaintiffs contend, however, that", "paragraph_id": "para_1510" }, { "text": "the court’s reasoning—that their CIPA claim was not susceptible", "paragraph_id": "para_1511" }, { "text": "to common proof because some URLs contained patient search", "paragraph_id": "para_1512" }, { "text": "terms and others did not—did not apply to the patient portal", "paragraph_id": "para_1513" }, { "text": "subclass because no “query strings” were transmitted from the", "paragraph_id": "para_1514" }, { "text": "patient portal. In reasoning plaintiffs failed to show common", "paragraph_id": "para_1515" }, { "text": "issues predominated for the patient portal subclass, the court", "paragraph_id": "para_1516" }, { "text": "noted one example URL transmitted from within the patient", "paragraph_id": "para_1517" }, { "text": "portal included the words “/health-record/radiology”26 revealing—", "paragraph_id": "para_1518" }, { "text": "as Adventist’s expert confirmed—that the patient had requested", "paragraph_id": "para_1519" }, { "text": "26 The full page URL in the patient portal for this example", "paragraph_id": "para_1520" }, { "text": "was “https://patientportal.myadventisthealthportal.org/", "paragraph_id": "para_1521" }, { "text": "person/dS7xf9Kt4in8df5/health-record/radiology/15999379949/", "paragraph_id": "para_1522" }, { "text": "download.” Before sharing the full page URL, Cerner would", "paragraph_id": "para_1523" }, { "text": "have substituted the identifying number strings with", "paragraph_id": "para_1524" }, { "text": "“PERSON_ID” and “DOCUMENT_ID.” One such example is:", "paragraph_id": "para_1525" }, { "text": "“/person/PERSON_ID/health-record/radiology/types/common/", "paragraph_id": "para_1526" }, { "text": "DOCUMENT_ID/download.”", "paragraph_id": "para_1527" }, { "text": "51", "paragraph_id": "para_1528" }, { "text": "a radiology report. The court noted such a URL may have", "paragraph_id": "para_1529" }, { "text": "revealed the patient’s medical information—and thus we can", "paragraph_id": "para_1530" }, { "text": "infer also arguably conveyed the “contents” of the patient’s", "paragraph_id": "para_1531" }, { "text": "communication. The court, however, noted other URLs that", "paragraph_id": "para_1532" }, { "text": "reflected the “patient’s activity in the patient portal caused a", "paragraph_id": "para_1533" }, { "text": "‘Download/Transmit’ or ‘Health Record – Results’ event,” “may", "paragraph_id": "para_1534" }, { "text": "not reveal . . . ‘content’ under CIPA” (or “ ‘medical information’", "paragraph_id": "para_1535" }, { "text": "under CMIA”). The court reasoned “ ‘Download/Transmit’ and", "paragraph_id": "para_1536" }, { "text": "‘Health Record – Results’ appear[ed] not to contain patient", "paragraph_id": "para_1537" }, { "text": "search terms.”27", "paragraph_id": "para_1538" }, { "text": "As plaintiffs note, unlike the public website, none of", "paragraph_id": "para_1539" }, { "text": "the URLs transmitted from the patient portal included patient", "paragraph_id": "para_1540" }, { "text": "search terms because all query strings were removed. Nor would", "paragraph_id": "para_1541" }, { "text": "any Page search terms (such as the surgical abortion example", "paragraph_id": "para_1542" }, { "text": "above) have been included, as Cerner’s security software would", "paragraph_id": "para_1543" }, { "text": "have removed any terms revealing health information within", "paragraph_id": "para_1544" }, { "text": "search parameters. Accordingly, as no patient portal URLs", "paragraph_id": "para_1545" }, { "text": "contained user search terms or query strings, plaintiffs argue", "paragraph_id": "para_1546" }, { "text": "there would be no need to examine the individual URLs for", "paragraph_id": "para_1547" }, { "text": "search terms to determine if they transmitted “contents,” as the", "paragraph_id": "para_1548" }, { "text": "court had reasoned was required for the public website. Rather,", "paragraph_id": "para_1549" }, { "text": "plaintiffs contend that whether Adventist’s uniform transmission", "paragraph_id": "para_1550" }, { "text": "of URLs from the portal with path information, “including", "paragraph_id": "para_1551" }, { "text": "descriptive natural language terms like ‘Health Record – Results’", "paragraph_id": "para_1552" }, { "text": "27 These descriptive terms reflected the tabs or buttons within", "paragraph_id": "para_1553" }, { "text": "the patient portal that logged-in patients could “click.” Others", "paragraph_id": "para_1554" }, { "text": "included “lab results,” “radiology,” “medications,” “procedures,”", "paragraph_id": "para_1555" }, { "text": "“health record,” “messages,” “appointments,” “documents,” and", "paragraph_id": "para_1556" }, { "text": "“view results.”", "paragraph_id": "para_1557" }, { "text": "52", "paragraph_id": "para_1558" }, { "text": "and ‘Radiology,’ ” satisfies the “contents” element of CIPA “is a", "paragraph_id": "para_1559" }, { "text": "merits question, and it is a common one.”", "paragraph_id": "para_1560" }, { "text": "First, we do not interpret the court’s reference to “events”", "paragraph_id": "para_1561" }, { "text": "not containing “search terms” to mean the court mistakenly", "paragraph_id": "para_1562" }, { "text": "believed some URLs in the patient portal had “query strings” and", "paragraph_id": "para_1563" }, { "text": "some did not, as plaintiffs seem to contend. Rather, the court", "paragraph_id": "para_1564" }, { "text": "was comparing the “radiology” example—which showed the", "paragraph_id": "para_1565" }, { "text": "patient had downloaded a radiology record through inclusion of", "paragraph_id": "para_1566" }, { "text": "the substantive term “radiology”—with the other two examples", "paragraph_id": "para_1567" }, { "text": "that generally described the patient’s activity—having instigated", "paragraph_id": "para_1568" }, { "text": "an unknown “download” or viewed some type of “results” within", "paragraph_id": "para_1569" }, { "text": "the patient’s health record. Critically, the court did not state", "paragraph_id": "para_1570" }, { "text": "the “radiology” example included user search terms while the", "paragraph_id": "para_1571" }, { "text": "“download/transmit” example did not. Rather, we understand", "paragraph_id": "para_1572" }, { "text": "the court to have reasoned that, without a user search term,", "paragraph_id": "para_1573" }, { "text": "specific document accessed, or other similar user communication,", "paragraph_id": "para_1574" }, { "text": "the descriptor “download/transmit” likely did not convey the", "paragraph_id": "para_1575" }, { "text": "contents of the patient’s communications whereas “radiology”", "paragraph_id": "para_1576" }, { "text": "might. (Cf. Cousin II, supra, 702 F.Supp.3d at pp. 975–976", "paragraph_id": "para_1577" }, { "text": "[alleging data collected included “specialty healthcare providers”", "paragraph_id": "para_1578" }, { "text": "and “treatments for medical conditions” was sufficient to show", "paragraph_id": "para_1579" }, { "text": "“ ‘contents of communications’ ” to state a claim under CIPA].)", "paragraph_id": "para_1580" }, { "text": "We do not disagree that the different descriptive terms within", "paragraph_id": "para_1581" }, { "text": "the patient portal URLs seem to convey different levels of", "paragraph_id": "para_1582" }, { "text": "information—despite uniformly not including query strings.", "paragraph_id": "para_1583" }, { "text": "Nevertheless, those descriptive terms—as we noted—", "paragraph_id": "para_1584" }, { "text": "denote the activity choice the patient made within the patient’s", "paragraph_id": "para_1585" }, { "text": "personalized portal. Presumably, a URL that included the", "paragraph_id": "para_1586" }, { "text": "descriptive term “health record” or “messages” indicated the", "paragraph_id": "para_1587" }, { "text": "patient had accessed her electronic health record or sent or read", "paragraph_id": "para_1588" }, { "text": "53", "paragraph_id": "para_1589" }, { "text": "a message to or from a provider, just as the term “radiology”", "paragraph_id": "para_1590" }, { "text": "that appeared in the example above showed a patient checked", "paragraph_id": "para_1591" }, { "text": "a radiology result. In the context of an authenticated patient", "paragraph_id": "para_1592" }, { "text": "portal, therefore, the description of the chosen page visited,", "paragraph_id": "para_1593" }, { "text": "or activity performed within the portal, arguably is not “basic", "paragraph_id": "para_1594" }, { "text": "identification [or] address information” that constitutes merely", "paragraph_id": "para_1595" }, { "text": "“record information.” (Zynga, supra, 750 F.3d at pp. 1107,", "paragraph_id": "para_1596" }, { "text": "1109.)28 For purposes of determining whether the URLs", "paragraph_id": "para_1597" }, { "text": "transmitted from the patient portal conveyed “contents” under", "paragraph_id": "para_1598" }, { "text": "CIPA, it thus would not seem to matter whether the descriptive", "paragraph_id": "para_1599" }, { "text": "term assigned to the chosen activity was more specific like", "paragraph_id": "para_1600" }, { "text": "“radiology” or more generic like “download,” as any term arguably", "paragraph_id": "para_1601" }, { "text": "would convey the “purport” of the patient’s communications with", "paragraph_id": "para_1602" }, { "text": "Adventist—to message a provider, download a health record,", "paragraph_id": "para_1603" }, { "text": "28 For Adventist’s public website, in contrast, the URL", "paragraph_id": "para_1604" }, { "text": "arguably would need to include specific terms to disclose that the", "paragraph_id": "para_1605" }, { "text": "patient was exchanging health-care-related communications with", "paragraph_id": "para_1606" }, { "text": "Adventist and not simply browsing the website. For the patient", "paragraph_id": "para_1607" }, { "text": "portal subclass, however, the information Adventist allegedly", "paragraph_id": "para_1608" }, { "text": "transmitted did not show the patient simply navigated to the", "paragraph_id": "para_1609" }, { "text": "patient portal login page, but that the patient actually had logged", "paragraph_id": "para_1610" }, { "text": "into the portal and took a specific action. (Compare, e.g., Zynga,", "paragraph_id": "para_1611" }, { "text": "supra, 750 F.3d at pp. 1108–1109 [address of website visited", "paragraph_id": "para_1612" }, { "text": "was not the “contents of a communication”] with Google RTB,", "paragraph_id": "para_1613" }, { "text": "supra, 606 F.Supp.3d at p. 949 [finding alleged transmission of", "paragraph_id": "para_1614" }, { "text": "“ ‘content categories’ ” of website, categories that describe current", "paragraph_id": "para_1615" }, { "text": "section of the website, and other information, all disclosed", "paragraph_id": "para_1616" }, { "text": "“content”].) Again, the court agreed that patients who logged", "paragraph_id": "para_1617" }, { "text": "into the patient portal only would be engaging in activities", "paragraph_id": "para_1618" }, { "text": "related to their health care with Adventist.", "paragraph_id": "para_1619" }, { "text": "54", "paragraph_id": "para_1620" }, { "text": "view a test result, etc.29 (See 18 U.S.C.§ 2510(8).) Whether", "paragraph_id": "para_1621" }, { "text": "plaintiffs successfully can establish those URLs—despite having", "paragraph_id": "para_1622" }, { "text": "generic descriptive terms—satisfy CIPA’s contents element is", "paragraph_id": "para_1623" }, { "text": "a merits question, however. (See Brinker, supra, 53 Cal.4th at", "paragraph_id": "para_1624" }, { "text": "p. 1023 [certification question does not ask whether action is", "paragraph_id": "para_1625" }, { "text": "legally or factually meritorious].)", "paragraph_id": "para_1626" }, { "text": "In any event, plaintiffs argue—as they did below—that", "paragraph_id": "para_1627" }, { "text": "the baseline information the tracking technologies universally", "paragraph_id": "para_1628" }, { "text": "transmitted when a patient logged into the patient portal is", "paragraph_id": "para_1629" }, { "text": "common evidence that will show Adventist transmitted the", "paragraph_id": "para_1630" }, { "text": "“contents” of the subclass members’ communications in violation", "paragraph_id": "para_1631" }, { "text": "of CIPA. They argue that “simply logging into the portal", "paragraph_id": "para_1632" }, { "text": "disclosed the individual’s status as [Adventist’s] patient” and", "paragraph_id": "para_1633" }, { "text": "thus transmitted content. (See Nienaber v. Overlake Hosp.", "paragraph_id": "para_1634" }, { "text": "Medical Center (W.D.Wash. 2024) 733 F.Supp.3d 1072, 1081", "paragraph_id": "para_1635" }, { "text": "(Nienaber) [“transmission of information submitted to a private", "paragraph_id": "para_1636" }, { "text": "patient portal—such as a user clicking on the ‘log in’ button on", "paragraph_id": "para_1637" }, { "text": "that webpage—reveals patient status”].) Plaintiffs presented", "paragraph_id": "para_1638" }, { "text": "evidence through Shafiq’s report that, along with the URL path", "paragraph_id": "para_1639" }, { "text": "showing the user logged into the patient portal, the tracking", "paragraph_id": "para_1640" }, { "text": "technologies transmitted the “partially masked IP address,", "paragraph_id": "para_1641" }, { "text": "29 Griffith v. TikTok, Inc. (C.D.Cal., Sept. 9, 2024, No. 5:23-cv-", "paragraph_id": "para_1642" }, { "text": "00964-SB-E) 2024 WL 4308813, relied on by Adventist, is thus", "paragraph_id": "para_1643" }, { "text": "distinguishable. The alleged CIPA violations there were based", "paragraph_id": "para_1644" }, { "text": "on the TikTok pixel having transmitted the contents of purported", "paragraph_id": "para_1645" }, { "text": "class members’ communications from various websites. (Id. at", "paragraph_id": "para_1646" }, { "text": "*1–2, 4.) The viability of plaintiffs’ CIPA claims thus would", "paragraph_id": "para_1647" }, { "text": "depend on the nature of each website, each plaintiff’s activity", "paragraph_id": "para_1648" }, { "text": "on the various websites, and how each different website", "paragraph_id": "para_1649" }, { "text": "implemented the software. (Id. at *4.)", "paragraph_id": "para_1650" }, { "text": "55", "paragraph_id": "para_1651" }, { "text": "user agent, and cookies containing identifiers,” which were", "paragraph_id": "para_1652" }, { "text": "sufficient to enable Google to identify the individual patient.30", "paragraph_id": "para_1653" }, { "text": "Plaintiffs assert that—“[a]t the merits stage”—their expert", "paragraph_id": "para_1654" }, { "text": "will use Google Analytics logs—that were produced after class", "paragraph_id": "para_1655" }, { "text": "certification briefing had completed—“to show that descriptive,", "paragraph_id": "para_1656" }, { "text": "full-string URLs were disclosed to Google uniformly for all”", "paragraph_id": "para_1657" }, { "text": "patient portal subclass members. (See footnote 17.)", "paragraph_id": "para_1658" }, { "text": "The court found plaintiffs “did not submit evidence that", "paragraph_id": "para_1659" }, { "text": "merely logging into the patient portal transmits information", "paragraph_id": "para_1660" }, { "text": "in violation of CIPA or CMIA.” This was a premature", "paragraph_id": "para_1661" }, { "text": "determination of the merits of plaintiffs’ theory of proof, at least", "paragraph_id": "para_1662" }, { "text": "for the CIPA claim. (Sav-On, supra, 34 Cal.4th at p. 327; Linder,", "paragraph_id": "para_1663" }, { "text": "supra, 23 Cal.4th at pp. 439–440.) Sharing a URL path along", "paragraph_id": "para_1664" }, { "text": "with patient identifiers that indicated a patient had logged into", "paragraph_id": "para_1665" }, { "text": "the Adventist patient portal arguably transmitted the “contents”", "paragraph_id": "para_1666" }, { "text": "of the patient’s communication. Arguably, the “purport” of—or", "paragraph_id": "para_1667" }, { "text": "the “intended message conveyed by”—entering login credentials", "paragraph_id": "para_1668" }, { "text": "on the patient portal page and hitting the “login” button is to tell", "paragraph_id": "para_1669" }, { "text": "Adventist the user is a verified patient who wants to log into his", "paragraph_id": "para_1670" }, { "text": "or her personal patient portal. (See Meta Pixel, supra, 647", "paragraph_id": "para_1671" }, { "text": "F.Supp.3d at p. 795 [construing “log-in buttons” to patient portal", "paragraph_id": "para_1672" }, { "text": "as “ ‘contents’ ”].) Because plaintiffs presented evidence showing", "paragraph_id": "para_1673" }, { "text": "the tracking technologies transmitted the same baseline", "paragraph_id": "para_1674" }, { "text": "information discussed above for all subclass members, we", "paragraph_id": "para_1675" }, { "text": "conclude they met their burden to show the contents element of", "paragraph_id": "para_1676" }, { "text": "their CIPA claim was subject to common proof. (See Downey,", "paragraph_id": "para_1677" }, { "text": "30 Again, the court did not find plaintiffs failed to show", "paragraph_id": "para_1678" }, { "text": "common evidence was available to determine whether the", "paragraph_id": "para_1679" }, { "text": "information transmitted could enable Google to identify", "paragraph_id": "para_1680" }, { "text": "the individual. (See footnote 18.)", "paragraph_id": "para_1681" }, { "text": "56", "paragraph_id": "para_1682" }, { "text": "supra, 44 Cal.App.5th at p. 1113.) As this was the only element", "paragraph_id": "para_1683" }, { "text": "the court discussed in its predominance analysis of the CIPA", "paragraph_id": "para_1684" }, { "text": "cause of action for the patient portal subclass, the denial of class", "paragraph_id": "para_1685" }, { "text": "certification on this ground is unsupported. (See Leeds, supra,", "paragraph_id": "para_1686" }, { "text": "115 Cal.App.5th at pp. 545–546; Knapp, supra, 195 Cal.App.4th", "paragraph_id": "para_1687" }, { "text": "at p. 939.)", "paragraph_id": "para_1688" }, { "text": "ii. Substantial evidence supported the court’s", "paragraph_id": "para_1689" }, { "text": "finding that plaintiffs failed to show their", "paragraph_id": "para_1690" }, { "text": "CMIA claim was subject to common proof", "paragraph_id": "para_1691" }, { "text": "for the patient portal subclass", "paragraph_id": "para_1692" }, { "text": "We cannot say the same for plaintiffs’ CMIA claim. The", "paragraph_id": "para_1693" }, { "text": "trial court found plaintiffs failed to show common proof could", "paragraph_id": "para_1694" }, { "text": "establish whether the URLs transmitted from the patient portal", "paragraph_id": "para_1695" }, { "text": "disclosed plaintiffs’ medical information under CMIA based on", "paragraph_id": "para_1696" }, { "text": "essentially the same reasons as its analysis of plaintiffs’ evidence", "paragraph_id": "para_1697" }, { "text": "of “contents” under CIPA. Plaintiffs argue that, because the", "paragraph_id": "para_1698" }, { "text": "patient portal was “dedicated solely to communications regarding", "paragraph_id": "para_1699" }, { "text": "patients’ medical treatment,” whether the URLs transmitted", "paragraph_id": "para_1700" }, { "text": "from the patient portal disclosed patients’ medical information", "paragraph_id": "para_1701" }, { "text": "is a common question. They contend the differences in the", "paragraph_id": "para_1702" }, { "text": "specificity of the URLs’ descriptive terms thus would not require", "paragraph_id": "para_1703" }, { "text": "examination of each individual URL because all the descriptive", "paragraph_id": "para_1704" }, { "text": "terms—even the most generic ones—arguably would “regard,", "paragraph_id": "para_1705" }, { "text": "concern, and relate to the medical treatments that the patients", "paragraph_id": "para_1706" }, { "text": "have received or plan to receive from [Adventist].”", "paragraph_id": "para_1707" }, { "text": "Although patients engaged only in health-related activities", "paragraph_id": "para_1708" }, { "text": "within the patient portal, we cannot conclude the variation", "paragraph_id": "para_1709" }, { "text": "in the descriptive URLs would not raise individual issues for", "paragraph_id": "para_1710" }, { "text": "the “medical information” element of CMIA, as we did for the", "paragraph_id": "para_1711" }, { "text": "“contents” element of CIPA. While more generic descriptive", "paragraph_id": "para_1712" }, { "text": "57", "paragraph_id": "para_1713" }, { "text": "terms still indicated the choice the patient made within", "paragraph_id": "para_1714" }, { "text": "the portal—and thus, whether a patient’s choice of activity", "paragraph_id": "para_1715" }, { "text": "constituted “contents” could be answered with common evidence", "paragraph_id": "para_1716" }, { "text": "—we agree with the trial court that those same descriptive terms", "paragraph_id": "para_1717" }, { "text": "did not uniformly convey “medical information.”", "paragraph_id": "para_1718" }, { "text": "For purposes of showing Adventist transmitted “medical", "paragraph_id": "para_1719" }, { "text": "information” under CMIA, the variations in the descriptive terms", "paragraph_id": "para_1720" }, { "text": "used to describe patients’ activities within the portal thus raised", "paragraph_id": "para_1721" }, { "text": "individual issues. As the trial court found, a URL revealing that", "paragraph_id": "para_1722" }, { "text": "a patient downloaded a “radiology” report may have constituted", "paragraph_id": "para_1723" }, { "text": "the disclosure of medical information—that a patient underwent", "paragraph_id": "para_1724" }, { "text": "an imaging test or procedure arguably discloses information", "paragraph_id": "para_1725" }, { "text": "“regarding” the patient’s medical history, condition, or treatment.", "paragraph_id": "para_1726" }, { "text": "But a URL revealing that a patient “download[ed]” an", "paragraph_id": "para_1727" }, { "text": "unspecified document, viewed something in the patient’s health", "paragraph_id": "para_1728" }, { "text": "record, or generally made an appointment or sent a message—", "paragraph_id": "para_1729" }, { "text": "without more—would not seem to convey information regarding", "paragraph_id": "para_1730" }, { "text": "the patient’s medical history, mental or physical condition, or", "paragraph_id": "para_1731" }, { "text": "treatment.31 (See Eisenhower, supra, 226 Cal.App.4th at p. 435", "paragraph_id": "para_1732" }, { "text": "31 This is in contrast to Frasco v. Flo Health, Inc. (N.D.Cal.", "paragraph_id": "para_1733" }, { "text": "2025) 349 F.R.D. 557, on which plaintiffs rely. There, a court", "paragraph_id": "para_1734" }, { "text": "certified a class of users of a menstruation and ovulation tracker", "paragraph_id": "para_1735" }, { "text": "app whose personal information about menstruation, ovulation,", "paragraph_id": "para_1736" }, { "text": "pregnancy goals, and the like, allegedly was shared with Google", "paragraph_id": "para_1737" }, { "text": "and Meta. (Id. at p. 569.) The descriptive terms of the custom", "paragraph_id": "para_1738" }, { "text": "events transmitted there, however, all revealed a user’s personal", "paragraph_id": "para_1739" }, { "text": "health information, such as “PREGNANCY_WEEK_CHOSEN”", "paragraph_id": "para_1740" }, { "text": "or entries relating to a user’s goals—such as “ ‘Track my cycle,’ ”", "paragraph_id": "para_1741" }, { "text": "“ ‘Get Pregnant,’ ” or “ ‘Track pregnancy’ ”—that all new users", "paragraph_id": "para_1742" }, { "text": "were required to input. (Id. at pp. 572–573.) The naming", "paragraph_id": "para_1743" }, { "text": "conventions of the events within the patient portal here", "paragraph_id": "para_1744" }, { "text": "58", "paragraph_id": "para_1745" }, { "text": "[rejecting plaintiffs’ interpretation of CMIA that would mean", "paragraph_id": "para_1746" }, { "text": "“release by a health care provider of personal identification would", "paragraph_id": "para_1747" }, { "text": "be sufficient whether or not there was a release of substantive", "paragraph_id": "para_1748" }, { "text": "information regarding that person’s medical condition, history,", "paragraph_id": "para_1749" }, { "text": "or treatment” (italics added)]; cf., e.g., Doe v. Regents of", "paragraph_id": "para_1750" }, { "text": "University of California (N.D.Cal. 2023) 672 F.Supp.3d 813,", "paragraph_id": "para_1751" }, { "text": "818–819 [denying motion to dismiss CMIA claim where plaintiff", "paragraph_id": "para_1752" }, { "text": "alleged she entered “information relating to her heart issues", "paragraph_id": "para_1753" }, { "text": "and high blood pressure” in her patient portal that defendant", "paragraph_id": "para_1754" }, { "text": "disclosed to Meta and that she began receiving advertisements", "paragraph_id": "para_1755" }, { "text": "on Facebook for high blood pressure medication].)", "paragraph_id": "para_1756" }, { "text": "While we agree that whether or not the descriptive URLs", "paragraph_id": "para_1757" }, { "text": "disclosed medical information is a merits determination,", "paragraph_id": "para_1758" }, { "text": "plaintiffs did not demonstrate that merits determination", "paragraph_id": "para_1759" }, { "text": "is subject to common proof. Moreover, that the baseline", "paragraph_id": "para_1760" }, { "text": "information transmitted when patients logged into the patient", "paragraph_id": "para_1761" }, { "text": "portal arguably revealed subclass members’ patient status", "paragraph_id": "para_1762" }, { "text": "does not also translate into class-wide evidence to prove their", "paragraph_id": "para_1763" }, { "text": "medical information was disclosed. Plaintiffs correctly note", "paragraph_id": "para_1764" }, { "text": "patient status is PHI under HIPAA.32 (Meta Pixel, supra, 647", "paragraph_id": "para_1765" }, { "text": "F.Supp.3d at p. 793; Nienaber, supra, 733 F.Supp.3d at p. 1081.)", "paragraph_id": "para_1766" }, { "text": "Patient status is not “medical information” protected under", "paragraph_id": "para_1767" }, { "text": "do not universally convey the same type of personal or", "paragraph_id": "para_1768" }, { "text": "specific information.", "paragraph_id": "para_1769" }, { "text": "32 The Health Insurance Portability and Accountability Act", "paragraph_id": "para_1770" }, { "text": "(HIPAA) (42 U.S.C. § 1320 et seq.). See 45 C.F.R. § 160.103", "paragraph_id": "para_1771" }, { "text": "(2026) (defining PHI under HIPAA as “individually identifiable", "paragraph_id": "para_1772" }, { "text": "health information” that is “[t]ransmitted by electronic media”;", "paragraph_id": "para_1773" }, { "text": "“[m]aintained in electronic media”; or “[t]ransmitted or", "paragraph_id": "para_1774" }, { "text": "maintained in any other form or medium”).", "paragraph_id": "para_1775" }, { "text": "59", "paragraph_id": "para_1776" }, { "text": "CMIA, however. (Eisenhower, supra, 226 Cal.App.4th at pp. 435–", "paragraph_id": "para_1777" }, { "text": "436 [fact individual “may have been a patient at a hospital at", "paragraph_id": "para_1778" }, { "text": "some time” or was identified as “a patient is not in itself medical", "paragraph_id": "para_1779" }, { "text": "information” under CMIA]; see also id. at pp. 436–437 [noting", "paragraph_id": "para_1780" }, { "text": "“the definition of ‘individually identifiable health information’", "paragraph_id": "para_1781" }, { "text": "under federal law differs markedly from that in the CMIA”].)", "paragraph_id": "para_1782" }, { "text": "We also reject plaintiffs’ contention that the court did not", "paragraph_id": "para_1783" }, { "text": "apply CMIA’s definition of medical information. In its discussion", "paragraph_id": "para_1784" }, { "text": "of whether common issues predominated on the CMIA claim for", "paragraph_id": "para_1785" }, { "text": "the general class, the court quoted the definition from the Civil", "paragraph_id": "para_1786" }, { "text": "Code. The court noted Shafiq’s report’s references to “ ‘sensitive", "paragraph_id": "para_1787" }, { "text": "information’ ” included more than “medical information” as", "paragraph_id": "para_1788" }, { "text": "defined by CMIA. The court expressly found that, “[b]ecause", "paragraph_id": "para_1789" }, { "text": "Shafiq’s analysis aggregate[d] different types of information—", "paragraph_id": "para_1790" }, { "text": "such as URLs that may or may not convey medical information,", "paragraph_id": "para_1791" }, { "text": "page titles that may or may not include descriptive or generic", "paragraph_id": "para_1792" }, { "text": "search terms or no search terms, and page views and events", "paragraph_id": "para_1793" }, { "text": "with generic names that may not convey medical information—", "paragraph_id": "para_1794" }, { "text": "into the category of ‘sensitive information,’ his reports do not", "paragraph_id": "para_1795" }, { "text": "support Plaintiffs’ conclusion of a common question concerning", "paragraph_id": "para_1796" }, { "text": "whether the transmissions violate CMIA.” The court had no need", "paragraph_id": "para_1797" }, { "text": "to repeat CMIA’s definitions or the above findings when it", "paragraph_id": "para_1798" }, { "text": "analyzed the descriptive terms included in the URLs transmitted", "paragraph_id": "para_1799" }, { "text": "from the patient portal and concluded those terms did not", "paragraph_id": "para_1800" }, { "text": "universally constitute “ ‘medical information’ under CMIA.”", "paragraph_id": "para_1801" }, { "text": "Accordingly, we conclude substantial evidence supported the", "paragraph_id": "para_1802" }, { "text": "trial court’s reasoning that plaintiffs failed to demonstrate", "paragraph_id": "para_1803" }, { "text": "common proof was available to determine whether Adventist", "paragraph_id": "para_1804" }, { "text": "disclosed the subclass members’ “medical information.”", "paragraph_id": "para_1805" }, { "text": "60", "paragraph_id": "para_1806" }, { "text": "4. The superiority and manageability of the subclasses", "paragraph_id": "para_1807" }, { "text": "The court also denied plaintiffs’ motion for class", "paragraph_id": "para_1808" }, { "text": "certification on superiority and manageability grounds. Courts", "paragraph_id": "para_1809" }, { "text": "generally consider four factors in determining if a class action", "paragraph_id": "para_1810" }, { "text": "would be superior to individual suits: (1) the interest of each", "paragraph_id": "para_1811" }, { "text": "purported class member in personally controlling his or her", "paragraph_id": "para_1812" }, { "text": "own case; (2) any difficulties “ ‘likely to be encountered in", "paragraph_id": "para_1813" }, { "text": "managing a class action’ ”; (3) the “ ‘nature and extent of any", "paragraph_id": "para_1814" }, { "text": "litigation by individual class members already in progress", "paragraph_id": "para_1815" }, { "text": "involving the same controversy’ ”; and (4) the “ ‘desirability of", "paragraph_id": "para_1816" }, { "text": "consolidating all claims in a single action before a single court.’ ”", "paragraph_id": "para_1817" }, { "text": "(Basurco v. 21st Century Ins. Co. (2003) 108 Cal.App.4th 110,", "paragraph_id": "para_1818" }, { "text": "121.) “In certifying a class action, the court must also conclude", "paragraph_id": "para_1819" }, { "text": "that litigation of individual issues, including those arising from", "paragraph_id": "para_1820" }, { "text": "affirmative defenses, can be managed fairly and efficiently.”", "paragraph_id": "para_1821" }, { "text": "(Duran, supra, 59 Cal.4th at pp. 28–29; id. at pp. 32–33 [trial", "paragraph_id": "para_1822" }, { "text": "court failed to manage individual issues raised by defendant’s", "paragraph_id": "para_1823" }, { "text": "affirmative defense properly].)", "paragraph_id": "para_1824" }, { "text": "The court found plaintiffs did not show the superiority", "paragraph_id": "para_1825" }, { "text": "of a class action because they (1) cited “no evidence” in support", "paragraph_id": "para_1826" }, { "text": "of their assertion that “few class members have the time and", "paragraph_id": "para_1827" }, { "text": "resources to pursue their claims on an individual basis” and", "paragraph_id": "para_1828" }, { "text": "(2) did not “state the value of the individual claims.”", "paragraph_id": "para_1829" }, { "text": "In their reply, plaintiffs asserted they were seeking", "paragraph_id": "para_1830" }, { "text": "statutory damages under CIPA and CMIA. At the hearing,", "paragraph_id": "para_1831" }, { "text": "plaintiffs’ counsel clarified that the CIPA and CMIA claims", "paragraph_id": "para_1832" }, { "text": "were worth $2,500 and $5,000 in statutory damages, respectively,", "paragraph_id": "para_1833" }, { "text": "for each plaintiff. For plaintiffs’ other claims, counsel stated", "paragraph_id": "para_1834" }, { "text": "their damages expert—in other tracking pixel cases—had", "paragraph_id": "para_1835" }, { "text": "estimated the value of the disclosed information to be about", "paragraph_id": "para_1836" }, { "text": "61", "paragraph_id": "para_1837" }, { "text": "“$200 a class member.” Plaintiffs’ post-hearing trial plan also", "paragraph_id": "para_1838" }, { "text": "stated that plaintiffs sought $5,000 in statutory damages under", "paragraph_id": "para_1839" }, { "text": "CIPA (Pen. Code, § 637.2), $2,500 in statutory damages under", "paragraph_id": "para_1840" }, { "text": "CMIA (Civ. Code, § 56.36), and estimated damages under the", "paragraph_id": "para_1841" }, { "text": "UCL “to be in the range of $200.”", "paragraph_id": "para_1842" }, { "text": "We aren’t sure what other evidence plaintiffs could have", "paragraph_id": "para_1843" }, { "text": "presented to demonstrate few Adventist patients would have", "paragraph_id": "para_1844" }, { "text": "“the time and resources to pursue their claims on an individual", "paragraph_id": "para_1845" }, { "text": "basis.” With at most $7,700 (plus attorney fees) at stake, it is", "paragraph_id": "para_1846" }, { "text": "hard to imagine how the average person could afford to pursue", "paragraph_id": "para_1847" }, { "text": "these claims individually. For example, the cost to hire expert", "paragraph_id": "para_1848" }, { "text": "witnesses to develop the technical evidence necessary to prove", "paragraph_id": "para_1849" }, { "text": "these claims alone would exceed any one individual’s expected", "paragraph_id": "para_1850" }, { "text": "recovery.33 As a class action, however, the alleged damages", "paragraph_id": "para_1851" }, { "text": "in the aggregate would consist of millions of dollars.", "paragraph_id": "para_1852" }, { "text": "“Generally, a class suit is appropriate ‘when numerous", "paragraph_id": "para_1853" }, { "text": "parties suffer injury of insufficient size to warrant individual", "paragraph_id": "para_1854" }, { "text": "action and when denial of class relief would result in unjust", "paragraph_id": "para_1855" }, { "text": "advantage to the wrongdoer.’ ” (Linder, supra, 23 Cal.4th", "paragraph_id": "para_1856" }, { "text": "at p. 435.) That is the case here. Absent a class action, each", "paragraph_id": "para_1857" }, { "text": "individual proposed class member—whether the HRA form or", "paragraph_id": "para_1858" }, { "text": "patient portal subclass—effectively would be unable to seek", "paragraph_id": "para_1859" }, { "text": "redress for Adventist’s alleged privacy violations. As plaintiffs", "paragraph_id": "para_1860" }, { "text": "argued, a class action is “not only the best, but realistically the", "paragraph_id": "para_1861" }, { "text": "only, way to compensate Class members and hold Adventist", "paragraph_id": "para_1862" }, { "text": "accountable for” its alleged disclosures of its patients’ information", "paragraph_id": "para_1863" }, { "text": "to Meta and Google. Moreover, given the cost of litigation would", "paragraph_id": "para_1864" }, { "text": "33 Shafiq was paid $500 per hour, and Golbeck was paid", "paragraph_id": "para_1865" }, { "text": "$550 per hour.", "paragraph_id": "para_1866" }, { "text": "62", "paragraph_id": "para_1867" }, { "text": "far exceed any one individual’s recovery, it is unlikely individual", "paragraph_id": "para_1868" }, { "text": "class members would have an interest in controlling their own", "paragraph_id": "para_1869" }, { "text": "cases. Nor does Adventist contend any of its patients has ongoing", "paragraph_id": "para_1870" }, { "text": "litigation against it involving these same claims. Finally, given", "paragraph_id": "para_1871" }, { "text": "the common issues we have discussed, we agree with plaintiffs", "paragraph_id": "para_1872" }, { "text": "that “it would be grossly inefficient for the courts to hear", "paragraph_id": "para_1873" }, { "text": "the same liability facts in a deluge of individual actions.”", "paragraph_id": "para_1874" }, { "text": "Accordingly, we conclude plaintiffs sufficiently demonstrated", "paragraph_id": "para_1875" }, { "text": "the superiority of class action treatment for the HRA form", "paragraph_id": "para_1876" }, { "text": "and patient portal subclasses.", "paragraph_id": "para_1877" }, { "text": "As for the manageability question, the court primarily", "paragraph_id": "para_1878" }, { "text": "was looking at that issue through the lens of the general class.", "paragraph_id": "para_1879" }, { "text": "As to the two relevant subclasses, the court found plaintiffs failed", "paragraph_id": "para_1880" }, { "text": "to “address” the manageability of the individual questions that", "paragraph_id": "para_1881" }, { "text": "we have concluded plaintiffs established can be determined", "paragraph_id": "para_1882" }, { "text": "through common proof. For the HRA form subclass, the court", "paragraph_id": "para_1883" }, { "text": "stated that plaintiffs did not discuss, for example, “whether there", "paragraph_id": "para_1884" }, { "text": "is a way to identify the URLs containing links to HRAs that third", "paragraph_id": "para_1885" }, { "text": "parties actually clicked on to view the HRAs.” As we discussed,", "paragraph_id": "para_1886" }, { "text": "plaintiffs presented a common theory of proof that would not", "paragraph_id": "para_1887" }, { "text": "require a showing of “ ‘actual clicks’ ” on individual URLs to", "paragraph_id": "para_1888" }, { "text": "establish Google and/or Meta viewed or accessed the linked", "paragraph_id": "para_1889" }, { "text": "HRA reports under the CMIA. The issue the court identified", "paragraph_id": "para_1890" }, { "text": "thus would not create a manageability problem. (Leeds, supra,", "paragraph_id": "para_1891" }, { "text": "115 Cal.App.5th at pp. 545–546 [appellate court considers only", "paragraph_id": "para_1892" }, { "text": "stated reason].)", "paragraph_id": "para_1893" }, { "text": "As for the patient portal subclass, the court stated", "paragraph_id": "para_1894" }, { "text": "plaintiffs, for example, did not discuss “whether some kind of", "paragraph_id": "para_1895" }, { "text": "statistical analysis could show the percentage of patients’ activity", "paragraph_id": "para_1896" }, { "text": "in the patient portal that resulted in URLs containing medical", "paragraph_id": "para_1897" }, { "text": "63", "paragraph_id": "para_1898" }, { "text": "information being sent to third parties.” The court also noted—", "paragraph_id": "para_1899" }, { "text": "again, as an example—plaintiffs’ trial plan stated common issues", "paragraph_id": "para_1900" }, { "text": "which included “ ‘Whether the baseline information transmitted", "paragraph_id": "para_1901" }, { "text": "by Google Analytics and the Facebook Meta Pixel constitutes", "paragraph_id": "para_1902" }, { "text": "“contents” under CIPA,’ and ‘Whether the baseline data", "paragraph_id": "para_1903" }, { "text": "constitutes “medical information” under [CMIA].’ ” The court", "paragraph_id": "para_1904" }, { "text": "noted, however, that—as it had found—“some of that ‘baseline", "paragraph_id": "para_1905" }, { "text": "data’ (such as page view information and URLs) may or may not", "paragraph_id": "para_1906" }, { "text": "be ‘contents’ or ‘medical information’ depending on whether the", "paragraph_id": "para_1907" }, { "text": "data reveals patient’s search terms, the descriptive quality of", "paragraph_id": "para_1908" }, { "text": "the search terms, and other characteristics. The trial plan does", "paragraph_id": "para_1909" }, { "text": "not explain how analyzing the different types of ‘baseline data’", "paragraph_id": "para_1910" }, { "text": ". . . can be handled to determine which class members had their", "paragraph_id": "para_1911" }, { "text": "‘contents’ or ‘medical information’ transmitted to a third party.”", "paragraph_id": "para_1912" }, { "text": "As we have discussed, although this may have been", "paragraph_id": "para_1913" }, { "text": "an issue for the general class, it is not one for the patient portal", "paragraph_id": "para_1914" }, { "text": "subclass. Under plaintiffs’ theory of proof, the baseline data", "paragraph_id": "para_1915" }, { "text": "transmitted when any patient logged into the patient portal", "paragraph_id": "para_1916" }, { "text": "included the contents of the patient’s communication with", "paragraph_id": "para_1917" }, { "text": "Adventist. As we explained, that some URLs conveyed more", "paragraph_id": "para_1918" }, { "text": "specific terms to describe patients’ activities within the patient", "paragraph_id": "para_1919" }, { "text": "portal would not affect plaintiffs’ contention that all patients", "paragraph_id": "para_1920" }, { "text": "who logged into the patient portal had the contents of their", "paragraph_id": "para_1921" }, { "text": "communications transmitted to a third party. Arguably, then,", "paragraph_id": "para_1922" }, { "text": "no statistical analysis would be necessary to analyze the terms", "paragraph_id": "para_1923" }, { "text": "in the URLs, as under plaintiffs’ theory, they did not raise an", "paragraph_id": "para_1924" }, { "text": "issue requiring individual proof. And as plaintiffs failed to", "paragraph_id": "para_1925" }, { "text": "demonstrate their CMIA claim was subject to common proof", "paragraph_id": "para_1926" }, { "text": "for the patient portal subclass, we need not determine whether", "paragraph_id": "para_1927" }, { "text": "64", "paragraph_id": "para_1928" }, { "text": "plaintiffs could manage individualized issues relating to that", "paragraph_id": "para_1929" }, { "text": "claim for that subclass.", "paragraph_id": "para_1930" }, { "text": "In sum, we conclude the record does not support finding", "paragraph_id": "para_1931" }, { "text": "the HRA form subclass, and the patient portal subclass for", "paragraph_id": "para_1932" }, { "text": "plaintiffs’ CIPA claim, raised individual issues that cannot be", "paragraph_id": "para_1933" }, { "text": "managed.", "paragraph_id": "para_1934" }, { "text": "5. The trial court did not abuse its discretion in finding", "paragraph_id": "para_1935" }, { "text": "plaintiffs forfeited certification of their CIPA –", "paragraph_id": "para_1936" }, { "text": "recording claim", "paragraph_id": "para_1937" }, { "text": "As the trial court noted, plaintiffs’ CIPA claim in their", "paragraph_id": "para_1938" }, { "text": "TAC alleged Adventist violated section 632(a) when it “used a", "paragraph_id": "para_1939" }, { "text": "recording device to record confidential communications . . . and", "paragraph_id": "para_1940" }, { "text": "then transmitted such information to others, such as Facebook.”", "paragraph_id": "para_1941" }, { "text": "The court however, found plaintiffs had “dropped any attempt to", "paragraph_id": "para_1942" }, { "text": "certify a class for alleged violations of section 632.” In so finding,", "paragraph_id": "para_1943" }, { "text": "the court noted “[n]either [p]laintiffs’ motion nor reply brief", "paragraph_id": "para_1944" }, { "text": "mentions section 632.” The court acknowledged plaintiffs’ trial", "paragraph_id": "para_1945" }, { "text": "plan—filed after the hearing by permission—“list[ed] section 632", "paragraph_id": "para_1946" }, { "text": "issues to be decided in the trial,” but found “asserting those", "paragraph_id": "para_1947" }, { "text": "issues after the hearing without briefing or citations to the", "paragraph_id": "para_1948" }, { "text": "evidence is too late.” We agree.", "paragraph_id": "para_1949" }, { "text": "Plaintiffs contend the court erred. They assert their", "paragraph_id": "para_1950" }, { "text": "motion’s arguments about their CIPA claims “encompass[ed] both", "paragraph_id": "para_1951" }, { "text": "[s]ections 631 and 632.” They note a key distinction between", "paragraph_id": "para_1952" }, { "text": "sections 631 and 632 is that section 632 “requires a showing that", "paragraph_id": "para_1953" }, { "text": "the communications were ‘confidential.’ ” They argue their list", "paragraph_id": "para_1954" }, { "text": "of common issues for their CIPA claim included “[w]hether Class", "paragraph_id": "para_1955" }, { "text": "members had a ‘reasonable expectation of privacy.’ ” They argue", "paragraph_id": "para_1956" }, { "text": "that issue was relevant only to their section 632 claim and they", "paragraph_id": "para_1957" }, { "text": "discussed it substantively, citing to discussion in Meta Pixel that", "paragraph_id": "para_1958" }, { "text": "65", "paragraph_id": "para_1959" }, { "text": "related to a section 632 CIPA claim. (Citing Meta Pixel, supra,", "paragraph_id": "para_1960" }, { "text": "647 F.Supp.3d at p. 799.) Plaintiffs also contend Adventist", "paragraph_id": "para_1961" }, { "text": "“understood” plaintiffs had addressed section 632 in their motion", "paragraph_id": "para_1962" }, { "text": "because Adventist cited a case for the proposition that “ ‘[i]n", "paragraph_id": "para_1963" }, { "text": "a case involving alleged violations of CIPA, “individualized", "paragraph_id": "para_1964" }, { "text": "inquiries into the reasonableness of each class member’s", "paragraph_id": "para_1965" }, { "text": "individual expectation of confidentiality . . . [we]re unavoidable”", "paragraph_id": "para_1966" }, { "text": "and, therefore such claims were “not capable of being resolved", "paragraph_id": "para_1967" }, { "text": "on a class-wide basis.” ’ ” (Citing Adventist’s citation of Mendell", "paragraph_id": "para_1968" }, { "text": "v. Am. Med. Response, Inc. (S.D.Cal., Mar. 23, 2021, No. 19-cv-", "paragraph_id": "para_1969" }, { "text": "01277-BAS-KSC) 2021 WL 1102423, plaintiffs added italics.)", "paragraph_id": "para_1970" }, { "text": "Plaintiffs bore the burden on their motion for class", "paragraph_id": "para_1971" }, { "text": "certification. That burden included providing citation to the law", "paragraph_id": "para_1972" }, { "text": "on the claims for which they were seeking certification and", "paragraph_id": "para_1973" }, { "text": "substantive discussion of each of the elements. Plaintiffs never", "paragraph_id": "para_1974" }, { "text": "mentioned section 632(a) in their moving or reply papers, as", "paragraph_id": "para_1975" }, { "text": "the court found. Although they briefly mentioned the issue of", "paragraph_id": "para_1976" }, { "text": "a “reasonable expectation of privacy” in their discussion of their", "paragraph_id": "para_1977" }, { "text": "CIPA claim—for which they cited only section 631—plaintiffs", "paragraph_id": "para_1978" }, { "text": "never set forth all of the elements they would be required to", "paragraph_id": "para_1979" }, { "text": "prove under section 632(a). Nor do we find plaintiffs’ brief", "paragraph_id": "para_1980" }, { "text": "mention of a “reasonable expectation of privacy” constituted a", "paragraph_id": "para_1981" }, { "text": "substantive discussion of the issue. Moreover, Adventist cited", "paragraph_id": "para_1982" }, { "text": "Mendell in discussing the issue of whether class members had", "paragraph_id": "para_1983" }, { "text": "a reasonable expectation of privacy “for purposes of an invasion", "paragraph_id": "para_1984" }, { "text": "of privacy claim,” not a section 632 claim. After all, plaintiffs", "paragraph_id": "para_1985" }, { "text": "originally had pursued an invasion of privacy claim against", "paragraph_id": "para_1986" }, { "text": "Adventist, alleged as the fifth cause of action in their TAC.", "paragraph_id": "para_1987" }, { "text": "Finally, we do not find plaintiffs’ belated citation to", "paragraph_id": "para_1988" }, { "text": "section 632 in their trial plan’s list of common questions—", "paragraph_id": "para_1989" }, { "text": "66", "paragraph_id": "para_1990" }, { "text": "or Adventist’s response to the trial plan—cures their failure", "paragraph_id": "para_1991" }, { "text": "to cite and properly discuss section 632 in their moving and", "paragraph_id": "para_1992" }, { "text": "reply papers.34 Accordingly, the trial court did not clearly abuse", "paragraph_id": "para_1993" }, { "text": "its discretion in not considering plaintiffs’ section 632(a) claim", "paragraph_id": "para_1994" }, { "text": "for class certification.", "paragraph_id": "para_1995" }, { "text": "34 Adventist’s response to plaintiffs’ trial plan noted plaintiffs’", "paragraph_id": "para_1996" }, { "text": "plan’s proposed common question—“ ‘Whether Class members’", "paragraph_id": "para_1997" }, { "text": "communications with Adventist were confidential’ ”—was", "paragraph_id": "para_1998" }, { "text": "“a specific element of a Section 632 CIPA claim.” Adventist", "paragraph_id": "para_1999" }, { "text": "again cited to Mendell. We do not read Adventist’s response", "paragraph_id": "para_2000" }, { "text": "to plaintiffs’ trial plan’s mention of an element of a section 632", "paragraph_id": "para_2001" }, { "text": "CIPA claim as somehow agreeing that plaintiffs’ motion raised", "paragraph_id": "para_2002" }, { "text": "the claim.", "paragraph_id": "para_2003" }, { "text": "67", "paragraph_id": "para_2004" }, { "text": "DISPOSITION", "paragraph_id": "para_2005" }, { "text": "We affirm the court’s order finding plaintiffs forfeited their", "paragraph_id": "para_2006" }, { "text": "section 632(a) claim and denying class certification of their CMIA", "paragraph_id": "para_2007" }, { "text": "claims for the patient portal subclass. We reverse the court’s", "paragraph_id": "para_2008" }, { "text": "order denying class certification for the HRA form subclass", "paragraph_id": "para_2009" }, { "text": "and the surviving claims for the patient portal subclass and", "paragraph_id": "para_2010" }, { "text": "remand the matter for further proceedings.", "paragraph_id": "para_2011" }, { "text": "The parties are to bear their own costs on appeal.", "paragraph_id": "para_2012" }, { "text": "EGERTON, Acting P. J.", "paragraph_id": "para_2013" }, { "text": "We concur:", "paragraph_id": "para_2014" }, { "text": "ADAMS, J.", "paragraph_id": "para_2015" }, { "text": "HANASONO, J.", "paragraph_id": "para_2016" }, { "text": "Filed 8/24/26", "paragraph_id": "para_2017" }, { "text": "CERTIFIED FOR PUBLICATION", "paragraph_id": "para_2018" }, { "text": "IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA", "paragraph_id": "para_2019" }, { "text": "SECOND APPELLATE DISTRICT", "paragraph_id": "para_2020" }, { "text": "DIVISION THREE", "paragraph_id": "para_2021" }, { "text": "JAMES DOE et al.,", "paragraph_id": "para_2022" }, { "text": "Plaintiffs and Appellants,", "paragraph_id": "para_2023" }, { "text": "v.", "paragraph_id": "para_2024" }, { "text": "ADVENTIST HEALTH SYSTEM/", "paragraph_id": "para_2025" }, { "text": "WEST,", "paragraph_id": "para_2026" }, { "text": "Defendant and Respondent.", "paragraph_id": "para_2027" }, { "text": "B344951", "paragraph_id": "para_2028" }, { "text": "Los Angeles County", "paragraph_id": "para_2029" }, { "text": "Super. Ct. No. 22STCV36304", "paragraph_id": "para_2030" }, { "text": "ORDER CERTIFYING", "paragraph_id": "para_2031" }, { "text": "FOR PUBLICATION", "paragraph_id": "para_2032" }, { "text": "[NO CHANGE IN", "paragraph_id": "para_2033" }, { "text": "JUDGMENT]", "paragraph_id": "para_2034" }, { "text": "THE COURT:", "paragraph_id": "para_2035" }, { "text": "The opinion in the above-entitled matter, filed on July 24, 2026,", "paragraph_id": "para_2036" }, { "text": "was not certified for publication in the Official Reports. For good cause,", "paragraph_id": "para_2037" }, { "text": "it now appears that the opinion should be published in the Official Reports.", "paragraph_id": "para_2038" }, { "text": "There is no change in the judgment.", "paragraph_id": "para_2039" }, { "text": "________________________________________________________________________", "paragraph_id": "para_2040" }, { "text": "EGERTON, J. ADAMS, P. J. HANASONO, J.", "paragraph_id": "para_2041" } ], "word_count": 17408, "cites": [ "750 F.3d 1098" ], "cited_by": [], "sha256": "66a941774b573e10209dde2700112fbaff18b2b6766c28597751937066bd0eb9", "source_url": "https://www.courts.ca.gov/opinions/documents/B344951.PDF", "fetched_at": "2026-10-06T07:16:45.608+00:00", "canonical": "https://legal.exploreworldai.com/ai/judgments/us/calctapp-b344951-2026-08-24", "risk_graph": "https://legal.exploreworldai.com/api/public/v1/risk?id=us:calctapp-b344951-2026-08-24", "relations_graph": "https://legal.exploreworldai.com/api/public/v1/relations?id=us:calctapp-b344951-2026-08-24", "changes": "https://legal.exploreworldai.com/api/public/v1/us-praxis/changes", "agent": "https://legal.exploreworldai.com/api/public/v1/us-praxis/agent?id=us:calctapp-b344951-2026-08-24", "verification": { "stored_sha256": "66a941774b573e10209dde2700112fbaff18b2b6766c28597751937066bd0eb9", "recomputed_sha256": "66a941774b573e10209dde2700112fbaff18b2b6766c28597751937066bd0eb9", "intact": true, "checked_at": "2026-10-10T22:27:26.464Z" } }, "hash": "sha256:ac66343aec122113692cfd0cb6d1d5500e03f1fdf0e9c947492b39413ce07d90", "version": "legal-2026-10-10", "expires": "2026-10-11T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-10+legal-2026-10-10+2026-10-10T17:32:53", "content_hash": "sha256:ac66343aec122113692cfd0cb6d1d5500e03f1fdf0e9c947492b39413ce07d90", "revalidate_after": "2026-10-10T23:27:26.607Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=us:calctapp-b344951-2026-08-24", "follow": [ { "rel": "risk", "href": "https://legal.exploreworldai.com/api/public/v1/risk?id=us:calctapp-b344951-2026-08-24" }, { "rel": "relations", "href": "https://legal.exploreworldai.com/api/public/v1/relations?id=us:calctapp-b344951-2026-08-24" }, { "rel": "agent", "href": "https://legal.exploreworldai.com/api/public/v1/us-praxis/agent?id=us:calctapp-b344951-2026-08-24" }, { "rel": "obligations", "href": "https://legal.exploreworldai.com/api/public/v1/obligation-chain" }, { "rel": "changes", "href": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=us" } ], "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering", "access_class": "public", "access_view": "public" }