Hi, CIPAWorld! Kelly Sandberg here, with a case on how individually identifiable health information was adequately alleged and found to provide a cognizable injury.
In Rand v. Eyemart Express, L.L.C., Plaintiffs brought a putative class action against Defendant Eyemart Express L.L.C. for violations of the Federal Wiretap Act, the Missouri Wiretap Act, and the Illinois Eavesdropping Act, in addition to intrusion upon seclusion tort claims and breach of contract claims for Eyemart’s use of tracking technology on their website which allegedly gathered users’ private health information without their knowledge or consent. Rand v. Eyemart Express, L.L.C., No. 25-10784, 2026 WL 3180055 (5th Cir. Oct. 23, 2026).
Eyemart owns and operates a chain of physical stores, as well as a website that provides consumers with the ability to browse and purchase prescription eyewear and schedule eye exams. Eyemart uses Meta’s tracking technology, Pixel, on its website to track, share, and collect its website users’ browsing information to then later send users targeted advertisements.
Plaintiffs alleged that Eyemart failed to notify users of the Pixel’s tracking or request for their consent to the tracking. They alleged that the information gathered constituted individually identifiable health information (IIHI) protected under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Put plainly, IIHI is any information collected from an individual relating to a medical condition or healthcare services, whether past, present, or future, and is sufficient to identify the individual with the condition or receiving the services.
In this appeal, Plaintiffs contested that they had adequately alleged they shared their IIHI with Eyemart and that the Pixel on Eyemart’s website provided their IIHI to Meta without their knowledge or consent. Eyemart opposed, arguing Plaintiffs lacked standing to sue and had failed to state a claim upon which relief could be granted.
In reviewing a motion to dismiss under Rule 1(b)(1), the 5th Circuit could consider “(1) the complaint alone; (2) the complaint supplemented by undisputed facts evidenced in the record; or (3) the complaint supplemented by undisputed facts plus the court’s resolution of disputed facts.” In re S. Recycling, L.L.C., 982 F.3d 374, 379 (5th Cir. 2020) (quoting Barrera-Montenegro v. United States, 74 F.3d 657, 659 (5th Cir. 1996)).
Article III Standing
To meet Article III standing, a plaintiff must show: (1) they suffered a concrete, particularized, and actual or imminent injury, (2) that the injury was likely caused by the defendant, and (3) that the injury is likely to be redressed by judicial relief.
Eyemart challenged the issue of concrete injury alone, and the 5th Circuit found that although the injury was intangible, it was also cognizable.
The Court relied on rulings from the 6th Circuit, the 2nd Circuit, the 3rd Circuit, and the D.C. Circuit, all of which have determined that the unauthorized disclosure of an individual’s private browsing information, along with identifiable personal information, constitutes an injury in fact.
The Fifth Circuit determined that Plaintiffs’ private health information is inherently sensitive and personal, and sharing that information without their consent parallels the harm underlying both the tort of intrusion upon seclusion and the public disclosure of private facts because it was their own private information being disclosed.
Because there was a close historical or common law analogue for the Plaintiffs’ modern injury, the 5th Circuit found that a concrete injury existed.
Failure to State A Claim
The putative class was split into two sections: the Search Plaintiffs who merely browsed on Eyemart’s website, and the Prescription Plaintiffs who provided their health information on the website.
Search Plaintiffs
The 5th Circuit found that the Search Plaintiffs adequately alleged a claim because IIHI covers information that relates to an individual’s health or condition and “need not reveal a specific diagnosis or condition; that it pertains to a condition or provision of healthcare is sufficient.”
Based on the nature of Eyemart’s website —providing health care products and services— Plaintiffs’ shopping and eye exam scheduling on the website related to the Search Plaintiffs’ health and provision of healthcare services within HIPAA’s definition of IIHI and thus stated a valid claim.
Prescription Plaintiffs
Although the lower court properly found that the Prescription Plaintiffs shared their IIHI with Eyemart, they erred in finding that Plaintiffs failed to plead that their IIHI was shared with Meta.
The lower court’s finding was based on a screenshot that exemplified data shared through the Pixel on Eyemart’s website but did not contain any data relating to any Plaintiffs’ actual purchases or other activity on the website. The lower court made several inferences about the example and reasoned that because nothing depicted disclosure of prescription information or that the lenses were prescription lenses, no IIHI was shared with Meta.
The 5th Circuit found this analysis too narrow, that the lower court had impermissibly made inferences in the light most favorable to Eyemart rather than to Plaintiffs, and had failed to explain why it was appropriate to extrapolate only a sample of information while expressly ignoring Plaintiffs’ other allegations.
Ultimately, the 5th Circuit reversed and remanded upon finding that Plaintiffs had standing to bring their claims and had adequately alleged that their IIHI was shared with Eyemart and that Pixel conveyed that data to Meta without their knowledge or consent.
The important takeaway to note here is that court’s appear to be finding IIHI or private health information under data privacy statutes was gathered more readily when a company website provides health care products or services of any kind – making the receipt of consent for these type of companies all the more imperative!