In a highly anticipated decision on an issue facing courts across the country, the Massachusetts Supreme Judicial Court held in late October that Massachusetts hospitals’ use of online tracking technologies that collect and transmit browsing activities of website visitors does not violate the Massachusetts Wiretap Law. 

The Court determined that online interactions between visitors and the hospitals’ websites did not unambiguously qualify as a “wire communication” subject to the wiretap law, and therefore, the hospitals merited the benefit of the doubt under the “rule of lenity.” The Court accordingly reversed the trial court’s denial of the hospital-defendants’ motions to dismiss the complaints.

The case was brought as a class action alleging that two Massachusetts hospitals violated the Massachusetts Wiretap Law by “aiding… third-party software providers” in unlawfully intercepting communications involving the individuals. The communications in the complaint were the browsing activities of each individual on the hospitals’ websites, including obtaining information about specific doctors and conditions, as well as accessing medical records through a patient portal. The plaintiffs alleged that the hospitals’ collection of information on website users (such as URLs, IP addresses, and device characteristics) and third-party tracking software to monitor user activities on the websites constituted impermissible interceptions under the Massachusetts Wiretap Law. The plaintiffs sought civil remedies under that law. Notably, the allegations mirrored in similar actions brought against other hospitals in Massachusetts (under the same state law) and hospitals in different states (often under those states’ analogous wiretap laws).

The Court undertook a statutory construction analysis of the specific terms in the Massachusetts Wiretap Law. It concluded that the interactions between a user and the website were not unambiguously “communications” accepted under the wiretap law (e.g., person-to-person communications). The Court observed that when visiting a website, the “user is not communicating with another person but instead interfacing with pre-generated information on a website” and that a website visitor is not “engaging in a conversation but accessing published information and databases.” The Court noted that although the Wiretap Law dates to 1968 —long before the internet age — it contains a “forward-looking mandate” concerning its applicability to new technologies, citing a 2013 decision affirming the applicability to cell phone calls and text messages. However, the Court was unwilling to expose the hospitals to potential civil and criminal penalties for “activities that do not capture such person-to-person communications or messaging” because “the text of the wiretap act is inconclusive at best as to whether website browsing is a “communication” protected by the act.”

The decision has been welcomed by hospitals and health care organizations in Massachusetts, many of whom have litigated similar allegations under the same state law – while also seeking to align with changing federal guidance on tracking technologies – for several years. Nonetheless, health care organizations should strongly consider the use and disclosures associated with website tracking technologies since the Court acknowledged the alleged conduct “raises serious concerns” and could potentially “violate various other statutes and give rise to common-law causes of action” involving protecting confidential medical information. Moreover, the decision included a lengthy dissent from one judge , who strongly disputed the majority holding and criticized the hospitals’ activities.