Recently, a Pennsylvania federal judge dismissed a suit challenging the use of a third-party website analytics tool by defendant Highlands Healthcare, Inc., an integrated health system with eight hospitals in Pennsylvania. The Court concluded plaintiffs had failed to plead the “specifics” of their interactions with defendant’s website, which were “essential to convert [the] case” from a “law-school hypothetical to an actionable dispute” under the Pennsylvania Wiretapping and Electronic Surveillance Control Act (“WESCA”), the state law analog to the Federal Wiretap Act. Muraski v. Penn Highlands Healthcare, Inc., 2026 WL 353041 (W.D. Pa. Feb. 9, 2026).
The two plaintiffs in this case asserted, on behalf of a putative class, that Highlands Healthcare used a third-party analytics tool on its website to allegedly collect data from plaintiffs’ interactions with Highlands’s website, search bar, and “Find a Doctor” page—including: (1) visitors’ IP addresses; (2) URLs; and (3) “information submitted by [Plaintiffs] through the search bar,” including “medical diagnosis, conditions and symptoms”—without plaintiffs’ consent. Plaintiffs contended Highlands Healthcare was a covered entity under the Health Insurance Portability and Accountability Act (“HIPAA”) and plaintiffs had a reasonable expectation of privacy in their data communicated to Highlands via its website.
Finding the exercise of subject-matter jurisdiction proper under the Class Action Fairness Act (“CAFA”), the Court nevertheless ordered dismissal of the complaint for failure to state a claim under WESCA.
The Court found “persuasive” a recent federal decision from the Eastern District of Pennsylvania,which dismissed claims under the Federal Wiretap Act upon finding the plaintiffs there had not established that individually identifiable health information (“IIHI”) had been “intercepted” in violation of HIPAA, as to trigger the crime-tort exemption to the party exception. See Santoro v. Tower Health, 2024 WL 1773371 (E.D. Pa. Apr. 24, 2024). As in Santoro, whether plaintiffs’ IIHI was intercepted “depends on how the particular user interacts with the website,” and the Court here determined that plaintiffs had “failed to allege . . . a HIPAA violation” with “any particularity.” Plaintiffs did not allege, for example, that a “particular medical condition was scheduled through the application” or “how their inputted information relates to Plaintiffs’ own medical care and diagnoses,” nor did they allege “what information was searched, what [protected health information (‘PHI’)] was disclosed,” or “what confidential diagnoses were revealed.” Absent such “specifics,” the Court concluded, plaintiffs’ WESCA claim necessarily failed.