1 UNITED STATES DISTRICT COURT 2 SOUTHERN DISTRICT OF CALIFORNIA 3 DJ GLENON, individually and on behalf Case No.: 22-cv-2061-AGS-DEB of others similarly situated, 4

ORDER DENYING DEFENDANT’S

Plaintiff, 5 MOTION TO DISMISS THE v. AMENDED COMPLAINT (ECF 14) 6

ABBOTT LABORATORIES,

7 Defendant. 8

9 In this putative class action, plaintiff alleges that defendant Abbott Laboratories 10 disclosed medical information about him and hundreds of other patients in a mass email. 11 Abbott moves to dismiss. 12 BACKGROUND1 13 In 2022, Synovation Medical Group shared with defendant Abbott Laboratories a 14 patient list of 375 chronic-pain patients. (ECF 11, at 4; ECF 19, at 8.) Abbott sent a group 15 email to those patients—including plaintiff DJ Glenon—that revealed all the recipients’ 16 email addresses. (ECF 11, at 4.) In addition, Glenon alleges that the email, excerpted 17 below, implicitly exposed his chronic-pain condition and his health-care provider: 18 Hello!

19 Synovation Medical Group is welcoming a new physician . . . and he is 20 offering an education event on November 2nd from 12-1pm. You are receiving this email because the topic addresses pain therapies that could 21 help you. 22 23 24 25 26

27 1 For motion-to-dismiss purposes, this Court accepts “the factual allegations in the complaint as true” and construes them “in the light most favorable to the plaintiff.” 28 1 (ECF 19, at 8.) The attached flyer was titled “Abbott’s Advancements in Chronic Pain 2 Relief,” and it touted a “treatment for chronic pain” for those who have “tried multiple 3 treatments for chronic pain but have not yet found effective pain relief.” (ECF 19-1, at 2.) 4 Glenon sued Abbott for violating California’s Confidentiality of Medical 5 Information Act and sought class certification. 6 DISCUSSION 7 Abbott moves to dismiss the amended complaint for failing to state a claim. To 8 survive such a motion, a complaint must contain enough facts to “state a claim to relief that 9 is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); see also Fed. R. Civ. 10 P. 12(b)(6). Facial plausibility requires more than mere “conclusions” or a “formulaic 11 recitation” of elements; it must be based on “factual allegations” that “raise a right to relief 12 above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (cleaned 13 up). 14 Under the Confidentiality of Medical Information Act, certain covered entities “shall 15 not disclose medical information regarding a patient . . . without first obtaining an 16 authorization.” Cal. Civ. Code § 56.10(a). Abbott protests that Glenon has not plausibly 17 alleged (1) “that Abbott disclosed protected ‘medical information,’” (2) “that Abbott is the 18 type of entity covered” by the CMIA, or (3) “that Abbott acted negligently.” (ECF 14-1, 19 at 13.) 20 A. Medical Information 21 First, Abbott argues that its mass email did not divulge “medical information” under 22 the CMIA, as it did not include (a) individually identifiable information, nor (b) any 23 prohibited medical topics. See Cal. Civ. Code § 56.05(i) (defining “medical information”). 24 As to the former point, Abbott disputes that Glenon’s email address constituted 25 “individually identifiable” information. But the CMIA’s definition of that term seems to 26 categorically include email addresses: 27 “Individually identifiable” means that the medical information includes or contains any element of personal identifying information sufficient to allow 28 1 identification of the individual, such as the patient’s name, address, electronic mail address, telephone number, or social security number, or other 2 information that, alone or in combination with other publicly available 3 information, reveals the identity of the individual. 4 Cal. Civ. Code § 56.05(i) (emphasis added). 5 Yet in Abbott’s view, the CMIA does not protect email addresses unless they are 6 independently shown to be “sufficient to allow identification of the individual.” (ECF 14-1, 7 at 17.) Glenon’s email address doesn’t qualify, according to Abbott, because it “did not 8 include Plaintiff’s name” or other telling details. (Id. at 17 n.10; see also id. at 17 (arguing 9 that “cryptic email addresses . . . are insufficient to identify their owner”).) This reading 10 would lead to absurd results: Glenon might need to live on “DJ Glenon Street” to invoke 11 the CMIA’s protection of home addresses. Or he might have to change his phone number 12 to “(800) D-GLENON” to ensure the CMIA shielded it from disclosure. 13 At any rate, the rule against surplusage dispenses with this argument. Courts must 14 make “every effort not to interpret a provision in a manner that renders other provisions of 15 the same statute . . . meaningless or superfluous.” United States v. Neal, 776 F.3d 645, 652 16 (9th Cir. 2015). If the phrase “sufficient to allow identification of the individual” was an 17 implied further test for every item in the definitional list, the qualifier for the last item— 18 “other information that . . . reveals the identity of the individual”—would become 19 redundant and superfluous.2 See Cal. Civ. Code § 56.05(i) (emphasis added). Thus, 20 Glenon’s email address is entitled to CMIA protection without an individualized inquiry. 21 As to Abbott’s other point, in the light most favorable to Glenon, the mass email 22 plausibly released prohibited medical content, such as his “medical history,” “physical 23 condition, or treatment.” See Cal. Civ. Code § 56.05(i). It begins, “You are receiving this 24 email because the topic addresses pain therapies that could help you.” (ECF 19, at 8 25

26 27 2 Because “other information” is separated from the rest of the list by a second use of the word “or,” proper grammar mandates that the ending phrase—“that . . . reveals the 28 1 (emphasis added).) And if there were any lingering questions about why the email 2 recipients were selected, the attached flyer is aimed at people who have “tried multiple 3 treatments for chronic pain.” (ECF 19-1, at 2.) Chronic pain disorder is undoubtedly a 4 “serious medical condition[].” Raich v. Gonzales, 500 F.3d 850, 855 (9th Cir. 2007). 5 Glenon plausibly alleges that Abbott unveiled his “medical information”—that is, 6 his individually identifiable information held by Abbott regarding protected medical 7 subjects. 8 B. Covered Entity 9 Second, Abbott contends that the amended complaint lacks “any facts suggesting 10 that Abbott” is an entity covered by the CMIA. (ECF 14-1, at 18.) The statute reaches, 11 among other entities, any “provider of health care.” See Cal. Civ. Code §§ 56.05(o), 12 56.10(a). That term embraces any “business organized for the purpose of maintaining 13 medical information in order to make the information available to an individual or to a 14 provider of health care at the request of the individual or a provider of health care, for 15 purposes of allowing the individual to manage their information, or for the diagnosis and 16 treatment of the individual . . . .” Id. § 56.06(a). 17 Glenon alleges that Abbott is just this sort of entity, one “engaged in the business of 18 providing health services and maintaining patient records on behalf of individuals as well 19 as health care providers.” (ECF 11, at 4.) The amended complaint corroborates this 20 assertion by quoting Abbott’s own annual report, which describes its “principal business” 21 as “the discovery, development, manufacture, and sale of . . . health care products.” (See 22 id. at 3–4.) So does Abbott’s group email, which demonstrates that it held contact 23 information for hundreds of patients in a specific medical group and sought to share a new 24 chronic-pain treatment with them. (See ECF 19, at 8; ECF 19-1, at 2.) Drawing all 25 reasonable inferences in Glenon’s favor, the Court concludes he has adequately pleaded 26 that Abbott is a covered entity. Cf. Heldt v. Guardian Life Ins. Co. of Am., No. 16-cv-0885- 27 BAS-NLS, 2017 WL 5194600, at *3 (S.D. Cal. Nov. 9, 2017) (denying motion to dismiss 28 CMIA claim because complaint adequately alleged that defendant insurance company 1 || provided plaintiff “with a health care service plan,” though the CMIA generally exempts 2 || insurers). 3 ||C. Negligence 4 Finally, Abbott maintains that Glenon “alleges no facts suggesting that Abbott 5 ||negligently failed to protect the confidentiality of his medical information.” (ECF 14-1, 6 || at 20.) Negligence is judged by a “standard of reasonable care.” Sandoval v. Qualcomm 7 \[Inc., 494 P.3d 487, 496 (Cal. 2021). Assuming Abbott is a CMIA-covered entity, see 8 section B supra, it had a duty to maintain Glenon’s medical information “in a manner that 9 || preserves [its] confidentiality.” See Cal. Civ. Code § 56.101(a). Glenon claims it breached 10 ||that duty by emailing this sensitive information to hundreds of other patients—without 11 || authority and with Glenon’s email address visible in the To: line. (See ECF 19.) In the light 12 |}most favorable to Glenon, this act fell below the standard of reasonable care; it was 13 |/negligent. For example, a factfinder could plausibly conclude that Abbott should have 14 || preserved confidentiality by at least placing patients’ email addresses in the Bec: line. 15 CONCLUSION 16 Thus, Abbott’s motion to dismiss the amended complaint is DENIED. 17 ||Dated: September 18, 2023 18 A — 19 Hon. Andrew G. Schopler 20 United States District Judge 21 22 23 24 25 26 27 28