Lex Digitales Мониторинг трендов регулирования цифровой экономики

← к документу

Что изменилось

Doe v. Adventist Health System/West · редакция 1 → 2 · зафиксировано 2026-09-17 03:22 · +3 −3 строк

Filed 7/24/26; Certified for Publication 8/24/26 (order attached)
The court found it was “questionable whether the fact that a person filled out an HRA reveals the contents of a patient’s communications with [Adventist] or anything about the patient’s physical or mental condition or treatment. On the other hand, the actual HRAs likely contain both contents of patients’ communications and their medical information.” This difference between a URL/event data indicating a patient had submitted an HRA form, and the completed HRA form or results report itself, is the only reasoning the court expressed for finding plaintiffs failed to demonstrate common issues predominated for the HRA form subclass on their CIPA claim.
But plaintiffs alleged that every submission of an HRA questionnaire resulted in the transmission of a URL that linked directly to an HRA report. And whether the transmission of those URLs linking to completed reports—rather than transmission of the reports themselves—is the transmission of “contents” under CIPA or medical information under CMIA, is a merits question. (See Linder v. Thrifty Oil Co. (2000) 23 Cal.4th 429, 439–440 (Linder)[question of class certification is “essentially a procedural one that does not ask whether an action is legally or factually meritorious”]; see also Sav-On Drug Stores, Inc. v. Superior Court (2004) 34 Cal.4th 319, 327 (Sav-On) [“focus in a certification dispute is on what type of questions— common or individual—are likely to arise in the action, rather than on the merits of the case”].) Plaintiffs presented evidence that this merits question could be answered—one way or the other—with common proof. They presented evidence that the tracking technologies were installed on the HRA portion of the Adventist website and where patients filled out HRA forms; the tracking technologies uniformly shared “a baseline of information” that included URLs, along with first-party cookie identifiers, IP addresses, and user agent data; and after a user submitted an HRA form, a URL was generated providing the user with a report of the results. In other words plaintiffs’ evidence allegedly would show that patients who submitted HRA forms would have received a report of their results through a URL link, and the tracking technologies uniformly would have shared that URL link with Google and/or Meta regardless of the specific HRA submitted. And arguably the results report for any submitted HRA—as in the examples above—likely would contain the “contents” of patients’ communications and their medical information.
But plaintiffs alleged that every submission of an HRA questionnaire resulted in the transmission of a URL that linked directly to an HRA report. And whether the transmission of those URLs linking to completed reports—rather than transmission of the reports themselves—is the transmission of “contents” under CIPA or medical information under CMIA, is a merits question. (See Linder v. Thrifty Oil Co. (2000) 23 Cal.4th 429, 439–440 (Linder) [question of class certification is “essentially a procedural one that does not ask whether an action is legally or factually meritorious”]; see also Sav-On Drug Stores, Inc. v. Superior Court (2004) 34 Cal.4th 319, 327 (Sav-On) [“focus in a certification dispute is on what type of questions— common or individual—are likely to arise in the action, rather than on the merits of the case”].) Plaintiffs presented evidence that this merits question could be answered—one way or the other—with common proof. They presented evidence that the tracking technologies were installed on the HRA portion of the Adventist website and where patients filled out HRA forms; the tracking technologies uniformly shared “a baseline of information” that included URLs, along with first-party cookie identifiers, IP addresses, and user agent data; and after a user submitted an HRA form, a URL was generated providing the user with a report of the results. In other words plaintiffs’ evidence allegedly would show that patients who submitted HRA forms would have received a report of their results through a URL link, and the tracking technologies uniformly would have shared that URL link with Google and/or Meta regardless of the specific HRA submitted. And arguably the results report for any submitted HRA—as in the examples above—likely would contain the “contents” of patients’ communications and their medical information.
Adventist nevertheless argues plaintiffs “presented no evidence that links to particular HRA results were uniformly transmitted,” and Shafiq’s report did not show the tracking pixels actually shared the HRA results URL with Google and/or Meta. Shafiq stated—under penalty of perjury—that his “testing and analysis” showed Adventist installed tracking pixels from Google and Meta on the HRA section of its website, including where the patient fills out the HRA form. Anne Dinapoli Block—a representative from Adventist’s marketing firm BPD—testified Google Tag Manager containers that included tracking pixels for Google and Meta were “on the HRAs.” And Shafiq’s report included the two URL examples noted above.
Discovery is ongoing. After the certification hearing, in January 2025, the court granted plaintiffs’ motion to compel Adventist to produce certain Google Analytic logs it had provided to its expert Cohen, which Shafiq would use for further statistical analysis. At the certification hearing, plaintiffs’ counsel noted the pending motion to compel and argued that, with those data logs, Shafiq could “do a probability analysis . . . to identify the likelihood that an individual class member will have transmitted protected health information at least once during the class period.”
the court did not deny certification of the HRA form subclass for failing to satisfy the predominance prong on the ground plaintiffs failed to show Adventist—through tracking technologies—uniformly shared URL links to patients’ HRA reports with Meta and/or Google. (See Leeds, supra, 115 Cal.App.5th at pp. 545–546 [appellate court analyzes denial of class certification “ ‘based solely on the lower court’s stated reason for the decision’ ”]; Knapp, supra,195 Cal.App.4th at p. 939 [“We may only consider the reasons stated by the trial court and must ignore any unexpressed reason that might support the ruling.”].)
the court did not deny certification of the HRA form subclass for failing to satisfy the predominance prong on the ground plaintiffs failed to show Adventist—through tracking technologies—uniformly shared URL links to patients’ HRA reports with Meta and/or Google. (See Leeds, supra, 115 Cal.App.5th at pp. 545–546 [appellate court analyzes denial of class certification “ ‘based solely on the lower court’s stated reason for the decision’ ”]; Knapp, supra, 195 Cal.App.4th at p. 939 [“We may only consider the reasons stated by the trial court and must ignore any unexpressed reason that might support the ruling.”].)
Adventist also contends the court correctly found “there is significant variability within the URLs and event data that are allegedly transferred to Google and/or Meta” with respect to the HRA form subclass. In its discussion of the predominance prong for plaintiffs’ CIPA and CMIA claims as to the general class, the court referred to—in addition to “ ‘ “HRA Report Accessed” ’ ”—other “ ‘specific events’ ” and “page URLs” from the HRA website that Shafiq’s report stated Adventist tracked and transmitted, such as “ ‘ “HRA Disclaimer Agree,” ’ ” “ ‘ “HRA Email Sign Up,” ’ ” “ ‘patient-assessment-report,’ ” “ ‘https://hraadventisthealth.org,’ ” and “ ‘https://quiz.adventist health.org.’ ” The court noted Shafiq didn’t state whether the referenced “events” “contain[ed] patient search terms” and didn’t differentiate between URLs and page titles that included “user-inputted search terms” and those that did not. The court found the noted events “appear[ed] to be records of page views or buttons/links that a patient clicked” and thus were “not ‘content.’ ” The court also found the noted URLs and events “provide[d] no information on their face about a patient’s medical history, mental or physical condition, or treatment.”
Again, the court did not find plaintiffs failed to show common evidence was available to determine whether the information transmitted could enable Google to identify the individual. (See footnote 18.)
supra, 44 Cal.App.5th at p. 1113.) As this was the only element the court discussed in its predominance analysis of the CIPA cause of action for the patient portal subclass, the denial of class certification on this ground is unsupported. (See Leeds, supra, 115 Cal.App.5th at pp. 545–546; Knapp, supra,195 Cal.App.4th at p. 939.)
supra, 44 Cal.App.5th at p. 1113.) As this was the only element the court discussed in its predominance analysis of the CIPA cause of action for the patient portal subclass, the denial of class certification on this ground is unsupported. (See Leeds, supra, 115 Cal.App.5th at pp. 545–546; Knapp, supra, 195 Cal.App.4th at p. 939.)
ii. Substantial evidence supported the court’s finding that plaintiffs failed to show their CMIA claim was subject to common proof for the patient portal subclass We cannot say the same for plaintiffs’ CMIA claim. The trial court found plaintiffs failed to show common proof could establish whether the URLs transmitted from the patient portal disclosed plaintiffs’ medical information under CMIA based on essentially the same reasons as its analysis of plaintiffs’ evidence of “contents” under CIPA. Plaintiffs argue that, because the patient portal was “dedicated solely to communications regarding patients’ medical treatment,” whether the URLs transmitted from the patient portal disclosed patients’ medical information is a common question. They contend the differences in the specificity of the URLs’ descriptive terms thus would not require examination of each individual URL because all the descriptive terms—even the most generic ones—arguably would “regard, concern, and relate to the medical treatments that the patients have received or plan to receive from [Adventist].”
## HANASONO, J.