Deidun et al v. Humana, Inc.

1
UNITED STATES DISTRICT COURT
WESTERN DISTRICT OF KENTUCKY
LOUISVILLE DIVISION
CIVIL ACTION NO. 3:26-CV-00054-GNS
NICOLE DEIDUN et al. PLAINTIFFS
v.
HUMANA, INC. DEFENDANT
MEMORANDUM OPINION AND ORDER
This matter is before the Court on Defendant’s Motion to Dismiss (DN 36). The motion is
ripe for adjudication. For the reasons that follow, the motion is DENIED.
I. STATEMENT OF FACTS AND CLAIMS
Plaintiffs Nicole Deidun (“Deidun”), Elliot Gorlin, Kelly Jewell, Nancy MacIntyre, and
Mary Payne (collectively, “Plaintiffs”) bring this Amended Class Action Complaint asserting
claims against Defendant Humana, Inc. (“Humana”) for a violation of the Federal Wiretap Act and
breach of fiduciary duty, intrusion upon seclusion, and unjust enrichment under Kentucky law.1
(Am. Compl. ¶ 1, DN 32).
Plaintiffs assert that Humana “harvested highly sensitive health-related information from
its insureds using hidden tracking tools and secretly disseminated this private data to third parties.”
(Am. Compl. ¶ 2). Humana allegedly harvested this private data on its public-facing website—
www.humana.com—and within three internal portals: (i) the “Main Portal” or “MyHumana
Portal” which functions as the primary patient portal at my2humana.com; (ii) the “Prescription
1 Plaintiffs propose a class consisting of “[e]very current and former insured of Humana whose
Website Communications were captured from January 23, 2023, through the date of the judgment,
through the use of Tracking Technologies embedded in Defendant’s Website, www.humana.com,
subpages, and patient portals to the date of judgment herein.” (Am. Compl. ¶ 375).
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 1 of 20 PageID #:
<pageID>

2
Portal” which directs insureds from the Main Portal to centerwellpharmacy.com to manage their
prescription drug benefits; and (iii) and the “Wellness Portal” which directs eligible Humana
Medicare Advantage members seeking “behavioral health and wellness resources” to
go365medicare.mpulse.com.2 (Am. Compl. ¶¶ 8, 183, 187-189, 191-192). Plaintiffs further allege
that third-party vendors, including Coveo, Tealium, Adobe, ForeSee, and Quantum Metric,
supplied Humana with tracking technologies—“Tracking Pixels” and “Session Replay Code”—
that loaded “immediately on both public-facing pages . . . and within purportedly secure
portals . . . . ” (Am. Compl. ¶¶ 10-11). These tracking technologies then allegedly intercepted and
recorded Plaintiffs’ communications, “including but not limited to insureds’ keystrokes (text
entered into a search box or information box), web addresses (i.e., ‘URLs’) of individual pages
visited, mouse movements, clicks, and/or other electronic communications in real time . . . .” (Am.
Compl. ¶ 11).
In addition, Plaintiffs contend that the third-party vendor Adobe not only captured their
interactions with the Main Portal, “such as page location, clicks, and insureds’ search terms,” but
also created personal identifiers associated with Plaintiffs from “cookies within certain requests
assigning multiple persistent identifiers to individual insureds that can be used to link them to a
digital profile and track them across sessions and the Internet.” (Am. Compl. ¶¶ 232-240). For
example, they allege that these requests “not only include the insured’s search query (i.e.,
‘Ozempic’), but also the page location and parameters regarding the insured’s browser, like
2 Plaintiffs initially use the term “MyHumana portal,” to describe where “insureds can log in to
review care and claims, manage prescriptions, and even complete mental health assessments.”
(Am. Compl. ¶ 8). Midway through this pleading, however, Plaintiffs cease to use the term
“MyHumana Portal” and instead refer to three separate portals, including a “Main Portal” at
my2humana.com which functions as the primary patient portal. (Am. Compl. ¶ 187). For purposes
of this motion, the Court will consider the “MyHumana portal” to be the portal referred to later in
the Amended Complaint as the “Main Portal.”
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 2 of 20 PageID #:
<pageID>

3
cookies, which allow Adobe to link the insured’s sensitive search for weight loss to a unique profile
and monitor their behavior across the Internet.” (Am. Compl. ¶¶ 233-234, Figure 14). Further,
they assert that on the “Prescription” subpage of the Main Portal, “an Adobe request assigns
multiple persistent identifiers via third-party cookies . . . [which] directly transmits the insured’s
actions as they explore prescription options for the duration of their visit to Adobe Experience
Cloud servers.” (Am. Compl. ¶¶ 240-242, Figure 19).
Plaintiffs allege that they “routinely” visited the Humana website to “lo[g] into” or “access
the MyHumana portal” and perform various searches and tasks related to their medical care,
including to check the balance on a “monthly over-the-counter benefit card[,]” “obtain prior
authorizations,” “fill[] and research[] prescriptions[,]” “verify whether dentists and providers were
in-network[,]” and view “claims and explanations of benefits . . . .” (Am. Compl. ¶¶ 41-45). They
contend that Humana’s website did not show a privacy policy in “any conspicuous or easily
accessible location” before the tracking and data collection began “immediately” upon loading the
website. (Am. Compl. ¶¶ 285-290). Plaintiffs assert that within the Wellness Portal, third-party
vendors surreptitiously gathered sensitive information as they sought health and wellness
education “prior to obtaining consent and prior to insureds’ enrollment in a course.” (Am. Compl.
¶¶ 320-321). On the Main Portal, Plaintiffs allege that despite using the privacy ‘toggle’ switch
on Humana’s website to select the “highest possible privacy settings[,]” multiple third parties
continued to receive transmissions of their sensitive health information. (Am. Compl. ¶¶ 5, 340-
358). Similarly, even after switching off “Targeting Cookies” and selecting “Confirm my
Choices” within the Prescription Portal, third party vendors allegedly continued to gather
“information associated with an insured’s prescriptions . . . .” (Am. Compl. ¶¶ 367-374).
Plaintiffs also assert that Humana violated the Health Insurance Portability and Accountability Act
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 3 of 20 PageID #:
<pageID>

4
(“HIPAA”) by embedding these tracking technologies inside internal portals because “portal
interactions are tied to a specific user’s identity” and thus the data displayed or transmitted in these
portals “often constitutes IIHI [individually identifiable health information], a category of PHI
[protected health information] under HIPAA.” (Am. Compl. ¶¶ 181-184). Ultimately, they
contend that Humana obtained “a significant financial benefit by covertly collecting, using, and
sharing the personal health-related data of Plaintiffs with third parties, including the Third-Party
Vendors, without consent.” (Am. Compl. ¶ 426).
On April 27, 2026, Humana moved to dismiss all claims. (Def.’s Mot. Dismiss 1, DN 36).
Plaintiffs subsequently filed a response and Humana filed a reply. (Pls.’ Resp. Def.’s Mot.
Dismiss, DN 40; Def.’s Reply Mot. Dismiss, DN 41). Accordingly, the motion is ripe for
adjudication.
II. JURISDICTION
The Court has subject-matter jurisdiction over this action because a federal question is
presented. See 28 U.S.C. § 1331. In addition, the court has supplemental jurisdiction over the
state law claims pursuant to 28 U.S.C. § 1367(a).
III. STANDARD OF REVIEW
To survive a motion to dismiss under Fed. R. Civ. P. 12(b)(6), “a complaint must contain
sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.”
Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks omitted) (citing Bell Atl.
Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A complaint “does not require ‘detailed factual
allegations,’ but it demands more than an unadorned, the-defendant-unlawfully-harmed-me
accusation.” Id. at 678 (citation omitted). A claim is facially plausible “when the plaintiff pleads
factual content that allows the court to draw the reasonable inference that the defendant is liable
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 4 of 20 PageID #:
<pageID>

5
for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556). When considering a motion
to dismiss, a court must “accept all the [plaintiff’s] factual allegations as true and construe the
complaint in the light most favorable to the [plaintiff].” Hill v. Blue Cross & Blue Shield of Mich.,
409 F.3d 710, 716 (6th Cir. 2005) (citation omitted).
IV. DISCUSSION
A. Federal Wiretap Act Claim
1. Interception of Communications
The Federal Wiretap Act (“FWA”) criminalizes the intentional interception of electronic
communications.3 See 18 U.S.C. § 2511. Specifically, the FWA penalizes any “person” who
“intentionally intercepts, endeavors to intercept, or procures any other person to intercept or
endeavor to intercept, any wire, oral, or electronic communication . . . .”4 18 U.S.C. § 2511(a). A
separate section of the FWA creates a private right of action for “any person whose wire, oral, or
electronic communication is intercepted, disclosed, or intentionally used in violation of [the
FWA] . . . .” 18 U.S.C. § 2520(a). The term “intercept” is defined as “the aural or other acquisition
of the contents of any wire, electronic, or oral communication through the use of any electronic,
mechanical, or other device.” 18 U.S.C. § 2510(4). In Luis v. Zang, 833 F.3d 619 (6th Cir. 2016),
the Sixth Circuit held that “in order for an ‘intercept’ to occur for purposes of the [Federal] Wiretap
Act, the electronic communication at issue must be acquired contemporaneously with the
transmission of that communication.” Id. at 629. The “contents” of an electronic communication
3 Some courts refer to the Federal Wiretap Act as the Electronic Communications Privacy Act
(“ECPA”), which Congress passed in 1986 to amend the FWA. For purposes of this motion,
however, the Court will refer to 18 U.S.C. §§ 2510-13 and 2515-20 as “the FWA.”
4 The term “person” is defined as any “employee, or agent of the United States or any State or
political subdivision thereof, and any individual, partnership, association, joint stock company,
trust, or corporation[.]” 18 U.S.C. § 2510(6).
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 5 of 20 PageID #:
<pageID>

6
is defined as “any information concerning the substance, purport, or meaning of that
communication[.]” 18 U.S.C. § 2510(8).
First, Humana asserts that the FWA claim must be dismissed because the Plaintiffs have
not adequately pled that third-party trafficking technologies intercepted the contents of their
communications within Humana’s website and internal portals. (Def.’s Mot. Dismiss 6). Humana
contends that Plaintiffs have alleged “literally nothing with respect to what they ‘communicated’
on any Humana website or what information was transferred to any third party . . . .” (Def.’s Mot.
Dismiss 7). To the contrary, Plaintiffs assert that they “routinely” visited the Humana website to
“lo[g] into” or “access the MyHumana portal” and perform various searches and tasks related to
their medical care, including to check the balance on a “monthly over-the-counter benefit card[,]”
“obtain prior authorizations,” “fill[] and research[] prescriptions[,]” “verify whether dentists and
providers were in-network[,]” and view “claims and explanations of benefits . . . .” (Am. Compl.
¶¶ 41-45). Under the FWA’s broad definition, these searches and tasks qualify as “contents” of
electronic communications because the transmitted information concerns “the substance, purport,
or meaning” of communications related to seeking to medical care. See 18 U.S.C. § 2510(8); see
also In re Grp. Health Plan Litig., 709 F. Supp. 3d 707, 718 (D. Minn. 2023) (citation omitted)
(holding that plaintiffs’ “private information, including ‘symptoms, medical conditions, physician
lookup, treatment, medication, and scheduling’” qualified as “content” under the FWA).
Further, Plaintiffs plausibly allege that tracking technologies—“Tracking Pixels” and
“Session Replay Code”—contemporaneously intercepted these communications by capturing
keystrokes, web addresses, mouse movements, and other electronic communications “in real
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 6 of 20 PageID #:
<pageID>

7
time . . . .”5 (Am. Compl. ¶¶ 10-11 (emphasis added)); see Luis, 833 F.3d at 631 (finding that the
electronic device “WebWatcher” performed “near real-time monitoring” and thus plausibly
intercepted a plaintiff’s communications under the FWA). Viewing these facts in the light most
favorable to the non-moving party, it can be reasonably inferred that tracking technologies
provided by third-party vendors intercepted the contents of Plaintiffs’ communications related to
seeking medical treatment within Humana’s internal portals. (Am. Compl. ¶¶ 2, 8, 10-11, 41-45,
183, 187-189, 191-192). Accordingly, Plaintiffs have plausibly alleged “above the speculative
level,” that the contents of their communications were intercepted. See Twombly, 550 U.S. at 555.
2. Crime-Tort Exception
The FWA is a one-party consent statute and thus permits intentional interception of
electronic communications “where such person is a party to the communication or where one of
the parties to the communication has given prior consent to such interception . . . .” 18 U.S.C. §
2511(2)(d). Even if one party to the communication consents, an interception is invalid under the
FWA’s “criminal or tortious act” exception (commonly known as the “crime-tort” exception) if
“such communication is intercepted for the purpose of committing any criminal or tortious act in
violation of the Constitution or laws of the United States or of any State.” Id. While the Sixth
Circuit has yet to address the scope and application of the crime-tort exception, several circuits
have held that “to survive a motion to dismiss, a plaintiff must plead sufficient facts to support an
inference that the offender intercepted the communication for the purpose of a tortious or criminal
5 Tracking Pixels include “a broad range of HTML and JavaScript code embedded in websites
and emails” which may monitor communications contemporaneously by sending “a network traffic
request to the tracking entity’s remote server” to “track, collect, and send” information to third
parties. (Am. Compl. ¶¶ 110-113). Session Replay Code allegedly functions by logging and
tracking “everything a user does on a webpage, including mouse movements, clicks, scrolls, and
taps” including “every single key stroke, creating a complete reproduction of the user’s visit to the
website.” (Am. Compl. ¶ 121).
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 7 of 20 PageID #:
<pageID>

8
act that is independent of the intentional act of recording.” Caro v. Weintraub, 618 F.3d 94, 100
(2d Cir. 2010); see also In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125,
145 (3d Cir. 2015); Sussman v. Am. Broad. Cos., 186 F.3d 1200, 1202 (9th Cir. 1999).
Humana also contends that Plaintiffs’ FWA claim must fail because an alleged HIPAA
violation is insufficient to invoke the crime-tort exception.6 (Def.’s Mot. Dismiss 17-19). Humana
asserts that the use of tracking technologies to obtain private health information in violation of
HIPAA does not qualify as a crime or tort “independent of the interception itself” because it is
“not some separate crime or tort committed later with the fruits of the interception.”7 (Def.’s Mot.
Dismiss 18). Although the Sixth Circuit has never ruled as to whether a HIPAA violation qualifies
as an independent act under the crime-tort exception, courts have widely recognized that “[a]
defendant’s criminal or tortious purpose of ‘knowingly . . . disclos[ing] individually identifiable
health information to another person,’ 42 U.S.C. § 1320d-6, in violation of HIPAA, may satisfy
the crime-tort exception.” Cooper v. Mount Sinai Health Sys., Inc., 742 F. Supp. 3d 369, 380
(S.D.N.Y. 2024) (second alteration in original) (citations omitted); see also Stein v. Edward-
Elmhurst Health, No. 23-CV-14515, 2025 WL 580556, at *5 (N.D. Ill. Feb. 21, 2025) (“Courts
from coast to coast have recognized that a violation of HIPAA can give rise to the crime-tort
exception . . . .” (collecting cases)), appeal filed, No. 26-1742 (7th Cir. Apr. 10, 2026); Adair v.
Cigna Corp. Servs., LLC, No. 25-2384, 2026 WL 2160444, at *10 (E.D. Pa. July 27, 2026)
6 Neither party disputes that Humana, as the owner of its website, was a party to the
communications in question. (Def.’s Mot. Dismiss 9). Thus, for their FWA claim to survive a
motion to dismiss, Plaintiffs must plead sufficient facts to show that the crime-tort exception
applies in this case.
7 In their response, Plaintiffs first dispute that the FWA imposes any “independent act”
requirement. (Pls.’ Resp. Def.’s Mot. Dismiss 15). This argument is unpersuasive given that
“[t]he language and history of the [Federal] Wiretap Act indicate that Congress authored the
exception to the one-party consent rule to prevent abuses stemming from use of the recording not
the mere act of recording.” Caro, 618 F.3d at 101.
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 8 of 20 PageID #:
<pageID>

9
(“Courts have widely recognized that an intention to violate Section 1320d-6(a) is an ‘independent
or secondary act’ that can trigger the crime-tort exception.” (citation omitted)); Wehrle v. McLaren
Health Care Corp., No. 25-cv-11420, 2026 WL 2719088, at *5 (E.D. Mich. Sep. 15, 2026)
(finding “the reasoning of this majority view persuasive at this stage” in determining that a
plausible HIPAA violation satisfied the crime-tort exception). In light of these cases, Humana’s
alleged criminal act—a HIPAA violation under 42 U.S.C. § 1320d-6—is “independent of the
intentional act of recording” because the Amended Complaint plausibly alleges that Humana
placed tracking technology on its website and internal portals and subsequently disclosed the
private health information it obtained to third parties for financial gain. (Am. Compl. ¶¶ 184, 426);
see Caro, 618 F.3d at 100. Accordingly, Humana’s argument fails.8
a. Basis for HIPAA Violation Underlying Crime-Tort Exception
Humana further asserts that the crime-tort exception should not apply because the
Amended Complaint does not contain sufficient allegations to support that it disclosed
“individually identifiable health information” (“IIHI”) in violation of HIPAA. (Def.’s Mot.
Dismiss 9-17). Under 42 U.S.C. § 1320d-6, “HIPAA makes it a crime for a ‘covered entity’—
8 In addition, Humana argues that the crime-tort exception should not apply because Plaintiffs have
not alleged that “Humana allowed third parties to intercept their data for the purpose of violating
HIPAA or invading their privacy.” (Def.’s Mot. Dismiss 19). As Humana notes in its reply, “[t]he
case law regarding whether a plaintiff must plead that a defendant acted with a specific intent to
commit a crime or tort in order to state a FWA claim is, admittedly, mixed . . . .” (Def.’s Reply
Mot. Dismiss 11). At this point, on a motion to dismiss, Plaintiffs allege enough facts to plausibly
infer that Humana knowingly enabled third-party interceptions of sensitive health information
using tracking technologies in violation of HIPAA, and thus the Court declines to dismiss the FWA
claim on these grounds. (Am. Compl. ¶¶ 5, 340-358, 367-374, 426); see also Adair, 2026 WL
2160444, at *10 (“[A]t the pleading stage, before the benefit of discovery, courts do not demand
too much by way of what facts plausibly demonstrate a defendant’s culpable intention.”); Doe v.
Wellstar Health Sys., Inc., 799 F. Supp. 3d 1268, 1279 (N.D. Ga. 2025) (“To the extent that factual
issues remain as to Defendant’s intent behind allowing Google and Meta tools on its Web
Properties, the Court finds these issues are more appropriately resolved at the summary judgment
stage.” (citing In re Grp. Health Plan Litig., 709 F. Supp. 3d at 720)).
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 9 of 20 PageID #:
<pageID>

10
which includes health care providers—to knowingly disclose individually identifiable heath
information without authorization ‘with intent to sell, transfer, or use individually identifiable
health information for commercial advantage, personal gain, or malicious harm.’” Cooper, 742 F.
Supp. 3d at 379 (citation omitted). IIHI is defined as:
[A] subset of health information, including demographic information collected
from an individual, and: (1) Is created or received by a health care provider, health
plan, employer, or health care clearinghouse; and (2) Relates to the past, present,
or future physical or mental health or condition of an individual; the provision of
health care to an individual; or the past, present, or future payment for the provision
of health care to an individual; and (i) That identifies the individual; or (ii) With
respect to which there is a reasonable basis to believe the information can be used
to identify the individual.
45 C.F.R. § 160.103.
Humana contends that there is no basis for a plausible HIPAA violation because Plaintiffs
have not alleged “what he or she actually did on the website or what specific information he or she
shared” and thus there is “no way to discern whether any Plaintiff shared anything that might meet
the definition of IIHI.” (Def.’s Mot. Dismiss 10).9 To the contrary, as noted previously, Plaintiffs
allege that they “routinely” accessed Humana’s internal portals to “obtain prior authorizations,”
“fill[] and research[] prescriptions[,]”and view “claims and explanations of benefits . . . .” (Am.
Compl. ¶¶ 41-45). This type of medical information plausibly meets the definition of IIHI because
it: (i) is “created or received by a health care provider”; (ii) “[r]elates to the past, present, or future
physical or mental health or condition of an individual” or “future payment for the provision of
health care to an individual”; and (iii) “identifies” or provides a “reasonable basis to believe the
information can be used to identify the individual.” See 45 C.F.R. § 160.103; see also Adair, 2026
9 In its motion to dismiss and reply, Humana does not assert that Plaintiffs consented to sharing
their IIHI as a defense to the alleged HIPAA violation. Instead, Humana discusses its privacy
policies and the scope of Plaintiffs’ consent in the context of the intrusion upon seclusion and
unjust enrichment claims. (Def.’s Mot. Dismiss 10, 25; Def.’s Reply Mot. Dismiss 13-14).
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 10 of 20 PageID #:
<pageID>

11
WL 2160444, at *1, *8 (citation omitted) (finding that a plaintiff accessing the “myCigna” member
healthcare portal “‘to search for prescriptions and to research health conditions,’” supported a
plausible inference that “Defendants intercepted Plaintiffs’ [IIHI].”).
Courts have generally recognized that “browsing activity on a publicly available website”
such as the “URLs, or the content of the pages located at those URLs,” does not qualify as IIHI,
while “the transmission of information submitted to a private patient portal—such as a user
clicking on the ‘log in’ button on that webpage—reveals patient status, which in and of itself is
protected health information.” Nienaber v. Overlake Hosp. Med. Ctr., 733 F. Supp. 3d 1072, 1081-
82 (W.D. Wash. 2024) (collecting cases). Humana asserts that “[m]uch of what Plaintiffs describe
in their Complaint is the transfer of information of tracking technologies on the public-facing
website[,]” but Plaintiffs also allege that Humana harvested their information when they logged
into three internal, non-public portals: the “Main Portal,” the “Prescription Portal” and the
“Wellness Portal.” (Def.’s Mot. Dismiss 13; Am. Compl. ¶¶ 8, 183, 187-189, 191-192). Humana
argues that information obtained from logging into these secure portals does not plausibly qualify
as IIHI because “while logging into the Humana portal might suggest that one is a Humana insured,
Plaintiffs have failed to allege how their logging into Humana’s portal might reveal their status as
a patient of any particular health care provider.” (Def.’s Mot. Dismiss 11). This characterization
demands too high of a pleading standard under Fed. R. Civ. P. 12(b)(6). For example, Deidun
alleges that she was insured by Humana, received disability benefits, and routinely accessed
MyHumana portal, “where she searche[d] for providers, view[ed] claims and explanations of
benefits . . . and check[ed] the balance on her monthly over-the-counter benefit card.” (Am.
Compl. ¶ 41). While there is a possibility that logging into her MyHumana portal would show
only that she is insured by Humana and elicit no information regarding her patient status with a
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 11 of 20 PageID #:
<pageID>

12
particular provider, viewing the Amended Complaint in the light most favorable to the non-moving
party, it is plausible that Deidun logging into an internal portal and viewing an explanation of
benefits detailing claims related to her disability would reveal her patient status. (Am. Compl.
¶ 41). Therefore, Plaintiffs have pled sufficient factual content to support “the reasonable
inference” that logging into Humana’s portal revealed their patient status to third-party vendors.
See Iqbal, 556 U.S. at 678 (citation omitted); see also Keys v. Humana, Inc., 684 F.3d 605, 610
(6th Cir. 2012) (finding that “[i]f a reasonable court can draw the necessary inference from the
factual material stated in the complaint, the plausibility standard has been satisfied.”).
Finally, Humana argues that Plaintiffs have not addressed how this information is
identifiable because the Amended Complaint alleges only “the transfer of rote metadata, not
identifiable health-related information.” (Def.’s Mot. Dismiss 15). The Amended Complaint,
however, contains plausible allegations that the third-party vendor Adobe not only captured
Plaintiffs’ “full and exact search term[s]” during interactions with Humana’s Main Portal, but also
created personal identifiers associated with “cookies within certain requests assigning multiple
persistent identifiers to individual insureds that can be used to link them to a digital profile and
track them across sessions and the Internet.” (Am. Compl. ¶¶ 232-240). Further, Plaintiffs allege
that while visiting the “Prescription” subpage of the Main Portal, “an Adobe request assigns
multiple persistent identifiers via third-party cookies . . . [which] directly transmits the insured’s
actions as they explore prescription options for the duration of their visit to Adobe Experience
Cloud servers.” (Am. Compl. ¶¶ 240-242, Figure 19). Contrary to Humana’s assertion, these
requests allegedly included more than the transfer of “rote metadata” because Adobe not only
tracked “the insured’s search query (i.e., ‘Ozempic’), but also the page location and parameters
regarding the insured’s browser, like cookies, which allow Adobe to link the insured’s sensitive
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 12 of 20 PageID #:
<pageID>

13
search for weight loss to a unique profile and monitor their behavior across the Internet.” (Am.
Compl. ¶¶ 233-234, Figure 14; Def.’s Mot. Dismiss 15). Therefore, at this stage, the Amended
Complaint contains sufficient information related to Plaintiffs’ interactions with Humana’s
internal portals to reasonably infer that Humana harvested their IIHI in violation of HIPAA. See
A.D. v. Aspen Dental Mgmt., Inc., No. 24 C 1404, 2024 WL 4119153, at *3 (N.D. Ill. Sep. 9, 2024)
(“Plaintiffs’ allegations regarding their individual experiences using Aspen’s online platform—
and the inferences drawn from those experiences—are sufficient to plausibly allege that Aspen
disclosed information regarding their personal health conditions and treatments to third parties.
Such information qualifies as IIHI for purposes of HIPAA.”).
In conclusion, Plaintiffs have sufficiently alleged that: (i) the contents of their
communications were intercepted; and (ii) the crime-tort exception applies due to Humana’s
plausible HIPAA violation. Accordingly, the motion is denied as to the FWA claim.
B. Breach of Fiduciary Duty
Humana also seeks dismissal of Plaintiffs’ claim for breach of fiduciary duty. (Def.’s Mot.
Dismiss 21). The Kentucky Supreme Court has outlined four elements to prove a breach of
fiduciary duty claim: “(1) the existence of a fiduciary duty; (2) the breach of that duty; (3) injury;
and (4) causation.” Baptist Physicians Lexington, Inc. v. New Lexington Clinic, P.S.C., 436
S.W.3d 189, 193 (Ky. 2013). “Under Kentucky law, a fiduciary relationship requires a relationship
‘founded on trust or confidence reposed by one person in the integrity and fidelity of another and
which also necessarily involves an undertaking in which a duty is created in one person to act
primarily for another’s benefit in matters connected with such undertaking.’” ATC Distrib. Grp.,
Inc. v. Whatever It Takes Transmissions & Parts, Inc., 402 F.3d 700, 715 (6th Cir. 2005) (quoting
Steelvest, Inc. v. Scansteel Serv. Ctr., Inc., 807 S.W.2d 476, 485 (Ky. 1991)).
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 13 of 20 PageID #:
<pageID>

14
Humana states that Plaintiffs failed to meet these elements due to “the absence of any
allegations related to the disclosure of any protected health information” which is thus “fatal” to
their breach of fiduciary duty claim. (Def.’s Mot. Dismiss 1). This argument fails because as
previously noted with respect to the FWA claim, the Amended Complaint alleges sufficient facts
under the Fed. R. Civ. P. 12(b)(6) pleading standard to support a reasonable inference that Humana
harvested Plaintiffs’ IIHI and private medical information. Thus, at this stage, Plaintiffs have
alleged all four elements of this claim: (i) a fiduciary duty existed because they “entrusted”
Humana to maintain the confidentiality and privacy of their insureds’ personal information; (ii)
Humana breached that fiduciary duty by harvesting IIHI “while deliberately concealing” these
actions; (iii) Plaintiffs suffered injury, “including but not limited to the unauthorized disclosure of
their highly sensitive health information”; and (iv) they suffered this injury as a “direct result” of
Humana’s data harvesting practices. (Am. Compl. ¶¶ 403-411). Accordingly, the motion is denied
with respect to the breach of fiduciary duty claim.
C. Intrusion Upon Seclusion
In addition, Humana seeks to dismiss Plaintiffs’ intrusion upon seclusion claim.10 (Def.’s
Mot. Dismiss 21). Kentucky has adopted the elements for a claim of intrusion upon seclusion
from the Restatement (Second) of Torts. McKenzie, 369 F. Supp. 3d at 819. To prevail on this
claim, a plaintiff must show: “(1) an intentional intrusion by the defendant, (2) into a matter the
plaintiff has a right to keep private, (3) which is highly offensive to a reasonable person.” Smith
10 Under Kentucky law, “invasion of privacy may consist of four distinct torts: (1) unreasonable
intrusion upon seclusion; (2) misappropriation of another’s name [or] likeness; (3) unreasonable
publicity given to one’s private life; and (4) publicity that places another in a false light.” Lurry
v. PharMerica Corp., No. 3:23-CV-297-RGJ, 2024 WL 2965642, at *6 (W.D. Ky. June 12, 2024)
(citing McKenzie v. Allconnect, Inc., 369 F. Supp. 3d 810, 819 (E.D. Ky. 2019)). In this case, only
intrusion upon seclusion is at issue.
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 14 of 20 PageID #:
<pageID>

15
v. Bob Smith Chevrolet, Inc., 275 F. Supp. 2d 808, 822 (W.D. Ky. 2003) (citing Restatement
(Second) of Torts § 652(B) (1977)). Federal courts applying Kentucky law have generally held
that a defendant intentionally intrudes on a plaintiff’s seclusion when “the [d]efendant acts with
such reckless disregard for the privacy of the plaintiff that the actions rise to the level of being an
intentional tort.” McKenzie, 369 F. Supp. 3d at 819 (citing Smith, 275 F. Supp. 2d at 821); see
also Bowen v. Paxton Media Grp., LLC, No. 5:21-CV-00143-GNS, 2022 WL 4110319, at *7-8
(W.D. Ky. Sep. 8, 2022); Lurry, 2024 WL 2965642, at *6.
Humana asserts that Plaintiffs failed to meet the first element— an intentional intrusion by
the defendant —because “the conduct of which Plaintiffs complain is not Humana’s intrusion on
a private communication . . . but the sharing of allegedly private information with third parties.”
(Def.’s Mot. Dismiss 22). This Court, however, has consistently held that under Kentucky law
intrusion upon seclusion is a valid claim in the context of data breach cases where a defendant—
the intended recipient of the communications—recklessly fails to prevent the release of a plaintiff’s
information to third parties. See Stinson v. Yum! Brands, Inc., No. 3:23-CV-183-DJH-LLK, 2025
WL 2755879, at *21 (W.D. Ky. Aug. 29, 2025) (“[C]ourts have repeatedly held that being aware
of the risk of data breaches and failing to implement appropriate policies is sufficient to state a
claim for intrusion upon seclusion.” (quoting Lurry, 2024 WL 2965642, at *6)); see also Bowen,
2022 WL 4110319, at *8. Further, unlike a typical data breach case where a defendant recklessly
fails to protect a plaintiff’s data, in this instance Plaintiffs claim that Humana “deliberately
intruded” upon their privacy by using third-party tracking technology “to intercept Plaintiffs’
private health data and surreptitiously transmitted that private health data to third parties.” (Am.
Compl. ¶ 418; Pls.’ Resp. Def.’s Mot. Dismiss 21). Thus, Plaintiffs have plausibly alleged that
Humana’s actions—embedding these tracking technologies inside portals without their consent
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 15 of 20 PageID #:
<pageID>

16
and transmitting their information to third parties—constituted an intentional intrusion. (Am.
Compl. ¶¶ 2, 5, 184).
As to the second element, Humana posits that Plaintiffs have not sufficiently alleged a
violation of “any expectation of privacy” with respect to their data.11 (Def.’s Mot. Dismiss 22;
Def.’s Reply Mot. Dismiss 13). Plaintiffs contend that they did not consent to third-party vendors
intruding upon their personal health information because Humana’s website failed to show a
privacy policy in “any conspicuous or easily accessible location” before the tracking and data
collection began “immediately” upon loading the website.” (Am. Compl. ¶¶ 285-290). In
response, Humana argues that Plaintiffs do not have an expectation of privacy because its “Website
Privacy Policy . . . expressly describes the kinds of tracking technologies Humana uses . . . .”
(Def.’s Reply Mot. Dismiss 14; Def.’s Mot. Dismiss 23). Plaintiffs, however, do not primarily
allege that Humana’s privacy policy was inadequate in defining the scope of their expectation of
privacy and consent. In addition, they claim that on the Main Portal, despite using the privacy
“toggle” switch to select the “highest possible privacy settings[,]” multiple third parties continued
to receive transmissions of their sensitive health information, and on the Wellness Portal, third-
party vendors surreptitiously gathered sensitive information as they sought health and wellness
education “prior to obtaining consent and prior to insureds’ enrollment in a course.” (Am. Compl.
¶¶ 5, 320-321, 340-358). Similarly, even after switching off “Targeting Cookies” and selecting
“Confirm my Choices” within the Prescription Portal, third party vendors allegedly continued to
gather “information associated with an insured’s prescriptions . . . .” (Am. Compl. ¶¶ 367-374).
11 Humana also says that Plaintiffs lack an expectation of privacy because “in the absence of any
allegations that Plaintiffs’ protected health information was disclosed, they have no privacy
interest in their routine data.” (Def.’s Mot. Dismiss 1-2). As noted with respect to the FWA claim,
Plaintiffs have pled sufficient facts to allow the Court to reasonably infer that Humana harvested
their protected health information.
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 16 of 20 PageID #:
<pageID>

17
At this stage, the Amended Complaint thus plausibly pleads the second element: without
Plaintiffs’ consent, Humana intruded upon their sensitive health information—a matter that they
had “a right to keep private . . . .” Smith, 275 F. Supp. 2d at 822 (citation omitted).
Finally, Humana argues that Plaintiffs have failed to meet the third element of their
intrusion upon seclusion claim because they cannot be “highly offended by the use of tracking
technologies that collected what amounts to their routine web browsing data.” 12 (Def.’s Reply
Mot. Dismiss 13). This argument is unavailing because Plaintiffs plausibly assert that Humana
intruded upon sensitive health information beyond routine web browsing data—including
activities such as obtaining “prior authorizations[,]” “fill[ing] and research[ing] prescriptions[,]”
and “viewing claims and explanations of benefits”—information that if exposed, would be highly
offensive to a reasonable person. (Am. Compl. ¶¶ 41-45); see In re Grp. Health Plan Litig., 709
F. Supp. 3d at 714 (citation omitted) (finding that a healthcare company intruded upon plaintiffs’
sensitive health information “beyond [a] kind of non-descript, vanilla, browsing history” and thus
such an intrusion would be “highly offensive to a reasonable person.”). Accordingly, Plaintiffs
have sufficiently alleged all three elements, and the motion is denied with respect to the intrusion
upon seclusion claim.
12 Humana cites a ruling on an intrusion upon seclusion claim in Cook v. GameStop, Inc., 689 F.
Supp. 3d 58, 72 (W.D. Pa. 2023), aff’d, 148 F.4th 153 (3d Cir. 2025), to support the proposition
that a plaintiff cannot be highly offended by the collection of routine web browsing data. (Def.’s
Mot. Dismiss 22); Cook, 689 F. Supp. 3d at 72. This reliance on Cook is misguided. Unlike the
personal medical communications alleged in this case, Cook involved the tracking of a plaintiff’s
electronic communications and interactions within GameStop’s website, which does not approach
the same level of sensitivity for the purposes of this intrusion upon seclusion analysis. See Cook,
689 F. Supp. 3d at 72.
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 17 of 20 PageID #:
<pageID>

18
D. Unjust Enrichment
Humana also seeks dismissal of Plaintiffs’ unjust enrichment claim. (Def.’s Mot. Dismiss
23). Under Kentucky law, an unjust enrichment claim requires: “(1) [a] benefit conferred upon
[a] defendant at [a] plaintiff’s expense; (2) a resulting appreciation of benefit by [the] defendant;
and (3) inequitable retention of [the] benefit without payment for its value.” Kentucky v. Marathon
Petroleum Co., LP, 191 F. Supp. 3d 694, 706 (W.D. Ky. 2016) (citation omitted). “Kentucky
courts have consistently found that the first element not only requires a benefit be conferred upon
the defendant, but also that the plaintiff be the party conferring that benefit.” Id. (quoting Pixler
v. Huff, No. 3:11-CV-00207-JHM, 2011 WL 5597327, at *11 (W.D. Ky. Nov. 17, 2011)).
As to the first and second elements, Humana asserts that Plaintiffs failed to plead sufficient
facts to support that “a supposed benefit was conferred upon Humana at their expense . . . .” (Def.’s
Mot. Dismiss 23). To the contrary, Plaintiffs plausibly allege that Humana obtained “a significant
financial benefit by covertly collecting, using, and sharing the personal health-related data of
Plaintiffs with third parties, including the Third-Party Vendors, without consent” and this benefit
took the form of “valuable personal health-related information” and “insurance premiums paid to
[Humana].” (Am. Compl. ¶¶ 425-426). Plaintiffs further claim that conferring this benefit came
at their expense because they suffered specific forms of harm, “including the loss of privacy and
the potential for identity theft.” (Am. Compl. ¶ 429). In addition, they allegedly “would not have
purchased [Humana’s] insurance, or would have paid less for [Humana’s] insurance had they
known [Humana] would surreptitiously track and sell their private data.” (Am. Compl. ¶ 430).
While Humana argues that these “types of vague assertions of loss are not sufficient to support a
claim for unjust enrichment[,]” at the motion to dismiss stage, the Amended Complaint “does not
require ‘detailed factual allegations,’ but it demands more than an unadorned, the-defendant-
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 18 of 20 PageID #:
<pageID>

19
unlawfully-harmed-me accusation.” (Def.’s Mot. Dismiss 24); Iqbal, 556 U.S. at 678 (emphasis
added) (citation omitted). Thus, viewing these factual allegations in the light most favorable to
the non-moving party, it is plausible that Plaintiffs conferred a benefit upon Humana in the form
of their valuable medical information and suffered harm as a result.
With respect to the third element—the inequitable retention of a benefit—Humana
contends that the Amended Complaint failed to allege that it “wrongfully retained” the benefit of
Plaintiffs’ sensitive health information. (Def.’s Mot. Dismiss 23). Humana argues that it “never
promised Plaintiffs that its website would not use tracking technologies and so they cannot claim
to have been deprived of the value of what they bargained for when they purchased insurance.”
(Def.’s Mot. Dismiss 25). As noted with respect to the intrusion upon seclusion claim, however,
the Amended Complaint contains sufficient allegations claiming Plaintiffs did not consent to such
tracking because even after switching off “Targeting Cookies” and selecting “Confirm my
Choices” within internal portals, third party vendors continued to gather their sensitive health
information “prior to obtaining consent . . . .” (Am. Compl. ¶¶ 5, 320-321, 340-358, 367-374).
As a result, Plaintiffs have plausibly alleged that it would be inequitable under unjust enrichment
principles for Humana to retain a financial benefit as a result of its nonconsensual data tracking
practices. See Doe, 799 F. Supp. 3d at 1276-77 (refusing to dismiss an unjust enrichment claim
where plaintiffs alleged that a health system went beyond “the scope of patients’ permission” by
using data tracking tools to transmit their sensitive information to third parties and concluding that
“Plaintiffs sufficiently allege that they provided Defendant with benefits they did not intend to
confer and for which they were not compensated.”). Accordingly, the motion is also denied with
respect to the unjust enrichment claim.
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 19 of 20 PageID #:
<pageID>

20
IV. 	CONCLUSION
For the foregoing reasons, IT IS HEREBY ORDERED that Defendant’s Motion to
Dismiss (DN 36) is DENIED.
cc: 	counsel of record
October 8, 2026
Case 3:26-cv-00054-GNS Document 49 Filed 10/08/26 Page 20 of 20 PageID #:
<pageID>