The United States District Court for the District of Maryland stated in its September 30, 2025 Memorandum Opinion denying the defendant hospital’s motion to dismiss the plaintiffs’ claims that her personally identifiable health information was improperly disclosed to a third-party:
Plaintiffs are patients who sought and received treatment from Shady Grove Reproductive Science Center, P.C. (“Shady Grove”), a physician practice group specializing in fertility services. Plaintiffs do not criticize the treatment they received but allege that Shady Grove incorporated “analytics and advertising tracking technology” operated by Google, Meta, and Microsoft (collectively, “Analytics Companies”) onto its website. Plaintiffs allege that those services resulted in Plaintiffs’ personally identifiable health information, and specifically the fact that they were seeking fertility treatment, being transmitted to those third-party companies. They allege that this violated Maryland common law (intrusion on seclusion and unjust enrichment) and two Maryland statutes (the Maryland Consumer Protection Act and the Maryland Wiretapping and Electronic Surveillance Act). Shady Grove has filed a motion to dismiss.
Plaintiffs allege that Shady Grove “knowingly and intentionally” incorporated analytics and advertising technology into multiple pages on its website with the purpose of disclosing website users’ private communications to the Analytics Companies. Id. ¶¶ 11, 31, 38, 105, 112. Plaintiffs contend that Shady Grove was on notice about the potential privacy violations “since at least December 2022” because entities such as the Federal Trade Commission and the U.S. Department of Health & Human Services Office for Civil Rights had issued warnings about the use of this type of tracking technology on health care websites. Id. ¶¶ 35–37. Plaintiffs contend that, despite this notice, Shady Grove “knowingly and intentionally concealed, suppressed, and omitted material facts in connection with its disclosure of Plaintiffs’ and Class members’ private communications.” Id. ¶ 116.
Plaintiffs allege that they did not consent to these disclosures and could not have known about them because the tracking technology was “inconspicuously incorporated” into the website’s code. Id. ¶¶ 20, 28, 59. Shady Grove’s privacy policy stated that it would “[m]aintain the confidentiality of [Plaintiffs’ and Class members’] protected health information” and would not “use or disclose [the] PHI [protected health information] for purposes not described in this Notice unless [users] give [Shady Grove] written authorization to do so.” Id. ¶ 9. Plaintiffs allege that the use of tracking technologies and the related information sharing is “directly contrary” to the privacy policy’s “clear representations” about how information would be used and shared. Id. ¶¶ 11, 28.
Standing
The federal district court stated: “Here, Plaintiffs have alleged that they expected that their communications
relating to fertility services would remain private, ECF No. 1 ¶¶ 8, 10, 63–71, and that, contrary to Plaintiffs’ expectations, Shady Grove “disclosed their private communications on the SGF webpages” to the Analytics Companies. Id. ¶ 11. Shady Grove denies that the information that the tools disclosed to the Analytics Companies was in fact personally identifiable or contained any confidential information. ECF No. 23 at 3, 7. The Court need not accept bare legal conclusions at the pleading stage, and discovery might bear out Shady Grove’s point. But the Court must accept Plaintiffs’ factual allegations as true at this stage, and Plaintiffs have alleged that Shady Grove did disclose personally identifiable health data, including the fact that Plaintiffs had scheduled appointments or contacted Shady Grove for fertility treatment infra. The Fourth Circuit has recently reiterated that “a legally cognizable privacy injury” establishes “Article III standing.””
“If it turns out the information that the software disclosed to the Analytics Companies was not personally identifiable, that may ultimately affect the question of whether Plaintiffs have standing … The Court need not and does not decide at this stage whether, if Shady Grove’s incorporation of the software into its website had only disclosed data that was not personally identifiable, that would satisfy the Article III injury-in-fact requirement. That is because Plaintiffs have alleged that Shady Grove, by installing the tracking software onto its website, effectively directed that Plaintiffs’ personally identifiable information be transmitted to the Analytics Companies. This is sufficient to allege a cognizable injury in fact. Accordingly, Shady Grove’s motion to dismiss on standing grounds will be denied.”
Intrusion Upon Seclusion
“To state a claim for intrusion upon seclusion under Maryland law, a plaintiff must allege an intentional intrusion upon the plaintiff’s solitude, “seclusion or private affairs in a manner that would be highly offensive to a reasonable person” … Here, the complaint sufficiently alleges both points. Plaintiffs allege that the information collected was private health data, including “the name[s] of the fertility provider” that both Plaintiffs searched for, that Jane Doe I “contacted her fertility provider,” and the specific Shady Grove clinic location that Jane Doe I intended to visit. ECF No. 1 ¶¶ 19, 27. They also allege that the information collected was personally identifiable. For example, Plaintiffs allege that certain information from a Shady Grove webpage was “transmitted alongside a Client ID (‘cid’), which is a unique identifier Google uses to distinguish the specific individual from all other individuals.” Id. ¶ 55; see also id. ¶ 51 … Of course, at this stage, the Court does not decide whether Shady Grove, by incorporating the tracking software, in fact disclosed personally identifiable private health information to the Analytics Companies. But Plaintiffs have alleged that it did, and those allegations are sufficiently factual, as opposed to constituting legal conclusions, to be sufficient for pleading purposes … the alleged disclosures involve information that Plaintiffs plausibly allege is inherently private and particularly sensitive.”
Unjust Enrichment
“An unjust enrichment claim requires “(1) [a] benefit conferred upon the defendant by the plaintiff; (2) [a]n appreciation or knowledge by the defendant to the benefit; and (3) [t]he acceptance or retention by the defendant of the benefit under such circumstances as to make it inequitable for the defendant to retain the benefit without the payment of its value.” … Plaintiffs do not contend that Shady Grove obtained an unjust benefit by receiving Plaintiffs’ private health information. Instead, Plaintiffs allege that when Shady Grove disclosed Plaintiffs’ private health information to the Analytics Companies, that resulted in two “benefits” for Shady Grove: (1) the use of their personal data for marketing purposes, ECF No. 1 ¶ 104, and (2) the revenue Plaintiffs paid Shady Grove for services that Plaintiffs would not have purchased “had they known Shady Grove would share and misuse their private health data.” ECF No. 27 at 25 (citing ECF No. 1 ¶¶ 106, 122). Here, the Court concludes that the first category of benefit is sufficient to satisfy the “benefit” element for pleading purposes; the Court need not and does not reach the question of whether the second would qualify.”
Maryland Consumer Protection Act
“To state a claim under the Maryland Consumer Protection Act (“MCPA”), a plaintiff “must allege (1) an unfair or deceptive practice or misrepresentation that is (2) relied upon, and (3) causes them actual injury” … The MCPA lists various categories of conduct that comprise “[u]nfair, abusive, or deceptive trade practices.” Md. Code Ann., Com. Law § 13-301. Plaintiffs allege that Shady Grove’s disclosure of their information to the Analytics Companies constituted a “[f]ailure to state a material fact” that “deceive[d] or tend[ed] to deceive” in violation of § 13-301(3) and “[d]eception, fraud, false pretense, false premise, misrepresentation, or knowing concealment, suppression, or omission of any material fact with the intent that a consumer rely on the same in connection with . . . the promotion or sale of any . . . consumer service” in violation of § 13-301(9). ECF No. 1 ¶ 111 … Plaintiffs have sufficiently alleged that they relied on the alleged omission by Shady Grove and that the omission was material based in part on data that reflects that the general public attaches importance to their personal data. ECF No. 1 ¶¶ 65–70. Plaintiffs also allege that the nature of the information (relating to fertility treatment) was inherently private and was disclosed to the Analytics Companies. Id. ¶ 60. Therefore, Plaintiffs have sufficiently alleged facts to establish reliance and causation under the MCPA.”
Maryland Wiretapping & Electronic Surveillance Act
“A claim under the Maryland Wiretapping & Electronic Surveillance Act (“MWESA”), requires, in pertinent part, that a person “[w]illfully . . . procure[d] any other person to intercept . . . any wire, oral, or electronic communication; . . . or
[w]illfully use[d], or endeavor[ed] to use, the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication.” Md. Code Ann., Cts. & Jud. Proc. § 10-402(a)(1), (3). Shady Grove argues Count 4 should be dismissed because Plaintiffs fail to allege (1) that Shady Grove acted willfully or (2) that the “contents” of “communications” were disclosed as those terms are used in the MWESA … Here, Plaintiffs have sufficiently alleged that Shady Grove “willfully” incorporated the Analytics Companies’ tracking technologies into its website. Maryland courts have had little opportunity to evaluate similar technologies as those alleged in this Complaint. But courts applying other states’ laws have held that, because adding Meta Pixel and other similar technologies is a multi-step process that must be undertaken by the website owner, health providers that incorporated these technologies into their websites engaged in sufficiently purposeful conduct to qualify as “willful” (or knowing and deliberate) under similar statutes … Therefore, Plaintiffs have sufficiently pleaded that Shady Grove met the requisite mental state under MWESA .”
“Plaintiffs do allege that the software disclosed that Plaintiffs were communicating with Shady Grove about seeking fertility treatment. The information users relayed through Shady Grove’s website, particularly on the “Schedule
Appointment” and “Contact SGF” webpages, is similar to some of the information that one would communicate to a physician directly during a face-to-face appointment. In addition, as discussed above, Plaintiffs sufficiently allege that their personally identifiable information was relayed to the Analytics Companies, namely, user and device identifiers such as GUID, Client ID, c_user cookie, and IP Addresses. ECF No. 1 ¶ 54 … Thus, they allege, by disclosing user and device identifiers to the Analytics Companies, Shady Grove was providing information that the Analytics Companies could match up with other data from which to determine or confirm what person—as opposed to an anonymous user—was seeking fertility treatment at Shady Grove. Id. ¶ 53 … For these reasons, the motion to dismiss Count 4 will be denied.”
Source Doe v. Shady Grove Reproductive Science Center, P.C., Case No. 24-cv-2368-ABA.
If you or a loved one may have been injured (or worse) as a result of medical malpractice in Maryland, you should promptly find the best Maryland medical malpractice lawyer for you, who may investigate your medical malpractice claim for you and represent you or your loved one in a Maryland medical malpractice case, if appropriate.
Click here to visit our website or call us toll-free at 800-295-3959 to find experienced Maryland medical malpractice attorneys who may assist you.
Turn to us when you don’t know where to turn.
