Doe v. Adventist Health System/West CA2/3

Filed 7/24/26 Doe v. Adventist Health System/West CA2/3
NOT TO BE PUBLISHED IN THE OFFICIAL REPORTS
California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions
not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion
has not been certified for publication or ordered published for purposes of rule 8.1115.

IN THE COURT OF APPEAL OF THE STATE OF CALIFORNIA

SECOND APPELLATE DISTRICT

DIVISION THREE

JAMES DOE et al., B344951

Plaintiffs and Appellants, Los Angeles County
Super. Ct. No.
v. 22STCV36304

ADVENTIST HEALTH SYSTEM/
WEST,

Defendant and Respondent.

APPEAL from an order of the Superior Court of
Los Angeles County, Laura A. Seigle, Judge. Affirmed in part,
reversed in part, and remanded.
Caddell & Chapman, Michael A. Caddell, Cynthia B.
Chapman, Amy E. Tabor; Ahmad, Zavitsanos & Mensing, Foster
C. Johnson, Kelsi White; LippSmith, Graham B. LippSmith,
MaryBeth LippSmith and Jaclyn L. Anderson for Plaintiffs
and Appellants.
Seyfarth Shaw, Kristine Rinella Argentine and Sierra J.
Chinn-Liu for Defendant and Respondent
_________________________
Plaintiffs—four Does who are or were patients of defendant
Adventist Health System/West (Adventist)—brought this
putative class action asserting claims against Adventist for,
among others, violations of the California Invasion of Privacy
Act (CIPA) (Pen. Code, §§ 630 et seq.)1 and the California
Confidentiality of Medical Information Act (CMIA). Plaintiffs
alleged Adventist shared (without their knowledge) their—and
similarly situated patients’—personal information with third
parties through web-based tracking technologies—the Meta Pixel
and/or Google Analytics—installed on Adventist’s websites,
including its public health risk assessment (HRA) website
and its password-protected patient portal. The tools allegedly
tracked site users’ activities, collected their data, and sent
the information—including personally identifiable information,
the contents of users’ communications with Adventist, and
protected health information (PHI)—to Facebook (Meta)
and Google, who shared the data with advertisers.
Plaintiffs sought to certify a class consisting of Adventist
patients with California addresses who—for the period from
November 16, 2017 to April 30, 2024—“used the Adventist
website or patient portal to exchange communications with
Adventist . . . for researching medical conditions or treatments,
finding a physician, making an appointment, or submitting a
health risk assessment form” (general class), and four subclasses.
Only two subclasses are relevant to this appeal: (1) the patient
portal subclass, consisting of all class members “who were
logged into Adventist[’s] . . . patient portal up until May 2023”;

1 Undesignated statutory references are to the Penal Code.

2
and (2) the HRA form subclass, consisting of all class members
“who submitted an online [HRA] form to Adventist.”
The trial court denied plaintiffs’ motion in its entirety.
Plaintiffs appeal from the trial court’s denial of class certification
of the patient portal and HRA form subclasses only. The trial
court concluded, as relevant here, plaintiffs failed to establish:
(1) the patient portal class was ascertainable, (2) common issues
predominated over individual ones for both subclasses, and
(3) the superiority and manageability of a class action. The
court also found plaintiffs had “dropped any attempt to certify
a class” for violations of CIPA under section 632.
The court primarily reasoned that determining whether
the data the tracking technologies sent to third parties contained
the “contents” of users’ communications (CIPA) or users’ “medical
information” (CMIA) would require an individual inquiry into the
information transmitted for each user. The court also reasoned
that plaintiffs had not explained how to ascertain which of the
patients who had logged into the patient portal had engaged in
activities that resulted in transmission of actionable information.
Plaintiffs challenge the rulings, arguing the undisputed record
evidence showed the patient portal class was ascertainable;
the court misunderstood the record, misapplied the definition
of “medical information,” ignored plaintiffs’ theory of liability,
and prematurely determined the merits in finding common issues
did not predominate; and they demonstrated the manageability of
the two subclasses and superiority of a class action to individual
trials. We reverse the court’s denial of class certification of the
HRA form subclass and partially reverse as to the patient portal
subclass.

3
BACKGROUND
1. Background on tracking technologies2
A web browser communicates with a website’s servers to
download and display the website’s content on the user’s screen.
To do so, the web browser sends HTTP (hypertext transfer
protocol) requests to download files from the website’s servers.3
The HTTP request “contains an IP address, which [is] an
identifier assigned to any Internet-connected device,” as well
as “a URL, which represents the address of the file that a
web browser is requesting from a web server,” and the “[u]ser
[a]gent,” which “identifies the details of the operating system
and web browser.” “A URL contains the server’s domain name,
the path of the file located on the server that is being requested,
and a list of query parameters that contain additional
information being sent from a web browser to a web server.”
“Cookies” are “used by web servers to keep track of past
interactions with the web browser.” Cookies can store
“identifiers” “used to identify a specific user account or a specific
device/browser.” “Third-party cookies”—set by a third-party
server—“allow cross-site tracking of a user across different
websites.” On the other hand, “first-party cookies”—set by the
first-party server—“allow same-site tracking of a user on a
particular website.”

2 We glean most of this background from the report of
plaintiffs’ expert Dr. Zubair Shafiq. Quoted material omits
footnote references.
3 The first HTTP request sent “is typically for the Hypertext
Markup Language (HTML) file.” The HTML file contains the
source code or content of a webpage.

4
A “tracking pixel”—such as the Meta Pixel and Google
Analytics—is a piece of code or image “that is used to track
users’ browsing activity on the web.” “When a tracking pixel is
installed on a website by a first party, it allows a third party (i.e.,
a domain that is different from the first-party website that a user
navigates to) to track a user across different websites where the
tracking pixel is installed. Put simply, a tracking pixel allows
a third party to tell that a user visited website A at time A,
website B at time B, and so on.” Tracking pixels “also ghostwrite
first-party cookies on the visited website’s domain to circumvent
third-party cookie blocking.”
A tracking pixel collects “two types of data”—“identifiers”
and “browsing activity”—“in HTTP requests from a user’s web
browser to the tracking pixel’s web server.” “Identifiers” are
collected through cookies stored by the web browser, and “the
combination of IP address and user agent in the transmission
from a user’s web browser to the pixel’s web server.” Identifiers
stored in cookies can include “account identifiers”—“that
uniquely identify the user visiting the website” akin to a driver’s
license number—and “device identifiers”—“that uniquely identify
the user’s device” akin to a vehicle’s license plate number.
The combination of IP address and user agent (or other browser
or device information) “contains sufficiently distinguishing
information” that can be “used as a unique identifier,” known
as “fingerprinting.”
A website may “install tracking pixels from third-party
companies such as Google and Meta to optimize ad campaigns
that they run on Google . . . and Meta.” Thus, “a website may
install and purposefully configure tracking pixels in its HTML
source code to share information about specific actions a user

5
takes on their website with the tracking pixel’s server.” For
example, these tracking technologies can track “events,” such as
when a “button” is clicked, a form is submitted, or a page is
viewed on a website.
Google describes Google Analytics as “ ‘a platform that
collects data from your websites and apps to create reports
that provide insights into your business.’ ” “ ‘Every time a user
visits a webpage, the tracking code will collect pseudonymous
information about how that user interacted with the page.’ ”
Google Analytics “uses both first-party and third-party cookies”
—that store account and device identifiers—“to track users on
and across different websites.” It also has a feature that “allows
Google to link or associate the data with Google accounts of users
who have signed into their Google accounts.” Meta describes
Meta Pixel (formerly called Facebook Pixel) as “a piece of code
on your website that can help you better understand the
effectiveness of your advertising and the actions people take
on your site, like visiting a page or adding an item to their cart.
You’ll also be able to see when customers took an action after
seeing your ad on Facebook and Instagram.” By default, the
Meta Pixel “will track URLs visited, domains visited, and the
devices [users] use.” The Meta Pixel also uses first- and third-
party cookies that store account and device identifiers to track
users across different websites. For example, the Meta Pixel—
through cookies—stores a user’s device identifier and Facebook
account identifier and “collects them on the facebook.com
domain.”
In Adventist’s words, these tracking technologies “cause
different networks (i.e., the Adventist Health server and Google/
Meta servers) to communicate with each other, causing certain

6
categories of data to be transmitted to Google/Meta.” The
“ ‘baseline data’ ” shared consists of first-party cookie identifiers,
URLs, IP addresses—whether complete or partially masked—
and user agent data.
2. Adventist’s use of tracking technologies
Adventist is a nonprofit, faith-based healthcare system
serving communities on the west coast and Hawaii. Between
2017 and 2024, Adventist installed the Meta Pixel and/or Google
Analytics on its websites, including its public-facing website at
adventisthealth.org, its patient portal at myadventisthealth.org,
and its public HRA website at adventisthealthhra.org.
Adventist placed advertisements on Facebook and other
digital platforms, encouraging potential patients to click on a
link where they could, for example, fill out an HRA form. The
ad links also could lead users to Adventist’s website or an ad
campaign landing page where they could, for example, request
an appointment, attend a webinar, or, again, fill out an HRA
form. Adventist used the tracking technologies in connection
with its online marketing efforts “to understand how many users
[we]re clicking on” a particular “ad and getting to [Adventist’s]
site so that [Adventist could] optimize the best performing ads.”
In other words, the tracking pixels enabled Adventist to
determine if an ad campaign was resulting in “conversions”—
users interacting with the website through pageviews, clicks,
form submissions (including HRAs), downloads, etc. Adventist
installed Google Analytics on its patient portal to gain “valuable
insight,” rather than for marketing purposes, however.
a. The patient portal
The patient portal—hosted by Adventist’s business
associate, Cerner—is a password-protected website where, among

7
other things, Adventist patients can access information from
their electronic health record, including test results; exchange
messages with healthcare providers; review treatment
information; schedule appointments; and pay bills. Users can
navigate directly to the patient portal login from their browser
or access it from within the main Adventist website through the
“Patient Login” button. Adventist installed only Google Analytics
on the patient portal, not the Meta Pixel.
Google Analytics normally shares information about
“events” such as, “page views, scrolls, outbound clicks,
site search, form interactions, video engagement, [and] file
downloads.” Adventist was unaware of any modification made
to the type of data Google Analytics collected and transmitted
within the patient portal.4 However, Cerner took security
measures within the patient portal to “configure[ ] [Google
Analytics] to anonymize the IP address[es]” it stored—by
“truncat[ing] the last octet of the IP address”—and “to obfuscate
[portions of] URLs that were provided when a user browses”
the website. To obfuscate the URLs, Cerner used a pattern
recognition software that scanned individual URLs and, if the
URL “matched a pattern that included an identifier or reference
to potential PHI,” that portion of the URL was removed or
replaced with a generic term. For example, if a URL included a
personal or document identification number, Cerner’s software
replaced it with “PERSON_ID” or “DOCUMENT_ID.” Cerner
also “ ‘removed the “query parameter” portion of a URL,

4 Discovery Shafiq reviewed showed Google Analytics was
tracking information inside the patient portal about “Logins,”
“Pageviews,” “Health Record – Results,” “Download/Transmit,”
“Messages,” and others.

8
if present, which reflects searches or other information input
by the user’ ” on the web page.5
In May 2023, Cerner removed Google Analytics.
b. HRA website
Beginning in 2019 or 2020, Adventist partnered with
HealthAware to provide HRAs “through the adventisthealth
hra.org website to the public as a marketing tool to identify
and reach people who may be at an increased risk for certain
health conditions and who would benefit from a medical
evaluation related” to the condition. HRAs could be accessed
directly through the “main website,” through “a specific subpage
of the main website,” or by clicking on an advertisement “on a
third-party website such as Facebook or Google”; they generally
were accessed through ads. When individuals filled out an
HRA form and clicked the link to submit it, they were told if
they were at “low risk,” “moderate risk,” or “high risk” for the
health condition assessed.
Records of the individuals who completed an HRA—
including identifying information the user provided (e.g., name,
date of birth, contact information), which HRA they took

5 The URL “query string” includes “search terms” input by
the user. For example, in the URL “https://www.adventisthealth.
org/site-search/?C=pregnancy” the query string (after the “?”)
shows a search was done at the Adventist website for information
about pregnancy. The following URL has a “path” but no query
string: “https://www.adventisthealth.org/services/cancer-
oncology.” The “path” is “services/cancer-oncology” indicating the
user viewed information about cancer-oncology under “services.”
(See In re Meta Pixel Healthcare Litigation (N.D.Cal. 2022)
647 F.Supp.3d 778, 795–796 and fn. 10 (Meta Pixel) [examples
of a URL path and query string].)

9
and when, the risk level assigned, whether they wished to
be contacted, and the lead source (how they came to the HRA
website)—were stored in Adventist’s “Salesforce Customer
Relationship Management” (CRM) system. The tracking pixels
installed on the website shared with Google and Meta that an
HRA form had been submitted.
3. Plaintiffs’ class action lawsuit
Plaintiffs are current or former Adventist patients who
interacted with Adventist’s websites, including the patient portal.
Plaintiffs sued Adventist, as individuals and on behalf of a
putative statewide class of Adventist patients or prospective
patients who “exchanged communications” at one of Adventist’s
websites between November 2017 and 2024.6 Plaintiffs alleged
Adventist installed tracking technologies throughout its public
websites and patient portal that acted as “listening and recording
device[s]” permitting Meta7 and Google to “eavesdrop[ ]” on their
and purported class members’ communications with Adventist—
their healthcare provider. Through these tracking technologies,
Adventist allegedly disclosed plaintiffs’ personally identifiable
information and PHI—without their consent—to Meta and
Google. Plaintiffs alleged the tracking technologies transmitted
Adventist website users’ IP addresses, URLs generated from
users’ searches and logins, and users’ personal data input on
the websites. The information shared with Meta and Google
allegedly included, among other things, plaintiffs’ and proposed
class members’ status as Adventist patients, their medical

6 Plaintiffs filed the operative third amended complaint
(TAC) on June 25, 2024.
7 Meta owns Facebook.

10
providers, their actual or potential medical conditions and
treatments, and their “personal identities.”
Plaintiffs alleged Meta/Google used the information
collected from Adventist’s websites to sell targeted advertising
services. In return, Adventist received analytics about its
websites to optimize its marketing efforts and ad placement,
to enhance user experience, and to monitor how many users
engaged with its websites. Plaintiffs alleged they visited
Adventist’s public website and patient portal where they
entered medical information, searched for a doctor, searched
for information about a medical condition and/or its treatment,
filled out an HRA, made appointments, and/or reviewed test
results. Plaintiffs then received advertisements on their
Facebook pages relating to their medical conditions.
Plaintiffs asserted ten separate causes of action against
Adventist, including, among others: one claim for violating CIPA
by using a recording device—the tracking technologies—to record
confidential communications without plaintiffs’ or class members’
consent and transmitting that information to others (§ 632,
subd. (a)) (§ 632(a)), and by “aid[ing]” third parties in the
interception of the “contents” of plaintiffs’ and class members’
communications with Adventist (§ 631, subd. (a)) (§ 631(a)); three
separate claims for violating CMIA by failing to “maintain the
confidentiality of users’ medical information” (Civ. Code, § 56.06),
by negligently failing to “maintain, preserve, and store” plaintiffs’
and class members’ medical information “in a manner that
preserve[d] the confidentiality” of that information (Civ. Code,
§ 56.101), and by disclosing plaintiffs’ and class members’
“sensitive medical information” without their consent (Civ. Code,
§ 56.10); two claims for violating the Unfair Competition Law

11
(Bus. & Prof. Code, § 17200 et seq.) (UCL) based on its violations
of CIPA and CMIA; and a claim for invasion of privacy (Cal.
Const., art. 1, § 1).
4. Class certification motion, opposition, and reply
On June 25, 2024, plaintiffs also filed their motion for class
certification. Both sides submitted reports from their experts,
various declarations, deposition testimony, and other exhibits.8
a. Motion
Plaintiffs proposed the general class—for the period from
November 16, 2017 to April 30, 2024—consist of “all Adventist
Health patients with an address in California who used the
Adventist website or patient portal to exchange communications
with Adventist Health, including researching medical conditions
or treatments, finding a physician, making an appointment,
or submitting a health risk assessment form.”9 (Italics added.)
Plaintiffs also moved to certify four subclasses, including,
a patient portal subclass consisting of “All Class members who
were registered users of Adventist Health’s patient portal up
until March 29, 2024” (italics added), and an HRA form subclass,

8 Plaintiffs’ expert Shafiq’s report summarized his testing
and analysis as showing Adventist “uniformly shared patient
identifiers (e.g., identifiers of accounts or devices used by
patients) alongside content information (e.g., page title and URL)
with third-party companies such as Google and Meta. Therefore,
any patient who used Adventist Health’s website to search for
a doctor, make an appointment, or access the patient portal had
their identifying information together with sensitive health
information shared with third-party companies.”
9 The proposed general class in the TAC included prospective
patients and did not specify the type of communications.

12
consisting of “All Class members who submitted an online [HRA]
form to Adventist Health.” (The two others were the online
appointment and provider search subclasses.)
There was no dispute over the numerosity of the proposed
class and subclasses. Plaintiffs argued the two subclasses at
issue on appeal were ascertainable based on records maintained
by Adventist’s vendors Cerner and HealthAware. Adventist
did not dispute this fact.
Plaintiffs argued Adventist’s liability depended on
common factual and legal questions that predominated over
individual ones. For their CIPA claim, plaintiffs argued those
included whether: Adventist’s tracking pixels acted similarly
to a “bugging device” by “ ‘contemporaneously and invisibly
re-direct[ing] the users’ communications to third parties’ ”;
“the pixels’ workings constitute an interception of a message
in transit in violation of CIPA”; class members had “ ‘a
reasonable expectation of privacy’ ”; and the transmitted
information “included the ‘contents’ of patients’ communications
with Adventist.” For its CMIA claims, plaintiffs argued common
issues included whether “Adventist’s deliberate decision to deploy
the[ ] tracking pixels constituted a ‘disclosure’ of information” or
“negligent storage or maintenance of information”; whether the
disclosed information “included information ‘regarding a patient’s
medical history . . . mental or physical condition, or treatment’ ”
and was protected “ ‘medical information’ ” because it included
“ ‘individually identifiable information . . . sufficient to allow
identification of the individual’ ”; whether Adventist was
authorized to disclose patients’ medical information; and whether
an unauthorized party “ ‘viewed or accessed’ ” the disclosed
information.

13
Plaintiffs argued the factual and legal issues relating to
these questions were common to the patient portal subclass and
HRA form subclass, as well. Plaintiffs asserted Adventist had
admitted Google Analytics was enabled inside the patient portal,
and its standard configuration had not been changed. Plaintiffs
also asserted Shafiq’s investigation revealed that, after a patient
submitted an HRA form, the tracking pixels sent Meta and
Google a “full-string URL[ ]” including a “unique string of
numbers” that would allow anyone to access the HRA report’s
contents.
Finally, plaintiffs argued that a class action was superior
here to allow class members to obtain compensation—through
statutory penalties, and to stop Adventist’s “illegal disclosures
of their sensitive health information.”
b. Opposition
Adventist opposed the motion, primarily arguing several
individual issues predominated. Among other issues, Adventist
argued that, to prove their CIPA and CMIA claims, plaintiffs
would have to present evidence of each individual URL the
tracking pixels sent to Meta and/or Google to show whether
that information constituted the “ ‘content’ ” of a communication
or “medical information” and was individually identifiable.
With respect to the patient portal subclass, Adventist argued
individual URLs sent to Google also would have to be examined
to see what had been obfuscated or masked. Adventist argued
individual inquiry into proposed HRA form subclass members
would be required to determine if individuals were patients
at the time they submitted the form, whether they filled out
the form for others, and whether they accessed the form through
an ad on Google or Facebook, which would affect their reasonable

14
expectation of privacy. Defendants also presented evidence that
the Meta Pixel and Google Analytics transmitted URLs from the
HRA website differently: while Google “likely received” a URL
that included the name of the HRA, the URL transmitted to Meta
said only “hra.adventisthealth.org” or “quiz.adventisthealth.org.”
c. Reply
In their reply—filed after deposing Adventist’s expert
Emily Cohen—plaintiffs argued Cohen’s confirmation that the
tracking technologies “ ‘share[d] at least a baseline of information
consisting of first-party cookie identifiers, page view information,
including URL’s, IP addresses, whether complete or partially
masked, and user agent data’ ” established the “key liability facts
are subject to common proof.” Plaintiffs essentially contended
this baseline data was evidence providing proof common to the
class as to whether the information transmitted was individually
identifiable, conveyed PHI or medical information, or constituted
“contents.” Because the tracking technologies always conveyed
at least the baseline data, plaintiffs argued, whether the tracking
pixel transmitted additional protected information “over the
‘baseline’ ” “only increase[d] the degree of harm suffered by
class members,” and was not relevant to Adventist’s underlying
liability.
Plaintiffs agreed to limit the patient portal subclass to
“All Class members who logged into Adventist’s patient portal
up until May 2023.” (Italics added.) Plaintiffs argued it
was “immaterial what access point patients used” to log into
the patient portal, “as any transmission to Google from the
myadventisthealth.org domain [the patient portal], regardless
of access point, indicate[d] that the individual signed into the
patient portal.” Plaintiffs also argued that, although the URLs

15
sent from the patient portal were partially redacted, they still
contained descriptive “natural language” terms outside of search
parameters that revealed “key information about patients’ health
condition or treatment.” Plaintiffs contended that, because the
class included “only patients who exchanged health-care-related
communications” with Adventist, the court could determine on
a class-wide basis “whether the content” of the communications
was “PHI/medical information.” Plaintiffs also disputed
Adventist’s contentions that the court could not determine the
specific issues affecting the HRA form subclass on a class-wide
basis based on Adventist’s records and/or proposed class
members’ self-reporting.
d. Hearing and trial plan
Before hearing oral argument on plaintiffs’ motion,
the court issued a tentative ruling denying class certification.
The court heard extensive argument on December 19, 2024.
During the hearing—in response to the court’s concerns that
the class included individuals who interfaced with the Adventist
websites for non-health related reasons—plaintiffs’ counsel
proposed to amend the class definition to include patients
who used the Adventist websites to exchange communications
“for” (rather than “including”) researching medical conditions
or treatments, finding a physician, making an appointment,
or submitting an HRA. The court permitted plaintiffs to file
a trial plan and Adventist to file a response before taking
the matter under submission.
Plaintiffs’ trial plan confirmed their modifications of
the general class and patient portal subclass. Plaintiffs also
narrowed the class claims to those under CIPA, “Penal Code
§§ 630 et seq.”; CMIA, “Civil Code §§ 56.101 & 56.10”; and UCL.

16
5. The court’s denial of class certification
On February 14, 2025, the court issued an 18-page order
denying plaintiffs’ motion for class certification in its entirety.
As relevant to this appeal, the court found plaintiffs failed to
establish the patient portal subclass was ascertainable because
they didn’t explain “how to ascertain which patients logged into
the patient portal and engaged in the types of activities that
allegedly resulted in ‘content’ and ‘medical information’ being
transmitted.” The court also found plaintiffs did not show how
common issues predominated on either its CIPA or CMIA claims
for either subclass. The court found that, although plaintiffs
established “medical information may have been revealed by
some of the URLs” transmitted from the patient portal, other
URLs may not have revealed “either ‘content’ under CIPA
or ‘medical information’ under CMIA.” The court also found
“[p]laintiffs did not submit evidence that merely logging into
the patient portal transmits information in violation of CIPA
or CMIA, or that each activity that a logged-in patient can do
within the patient portal transmits information in violation of
CIPA or CMIA.” As for the HRA form subclass, the court found
a person-by-person inquiry would be required to determine
whether Google and Meta “actually followed the links” they
were sent to the completed HRA forms, such as by showing
class members received ads for health issues they disclosed in
HRA forms. Finally, the court found plaintiffs failed to show the
superiority of a class action as they cited no evidence to support
their assertion that “few class members have the time and
resources to pursue their claims on an individual basis,” and
did not address the manageability of the individual questions

17
the court had identified. Plaintiffs filed a timely notice of
appeal.10
DISCUSSION
1. Class certification and standard of review
Section 382 of the Code of Civil Procedure authorizes
a lawsuit to proceed as a class action “when the question is one
of a common or general interest, of many persons, or when the
parties are numerous, and it is impracticable to bring them all
before the court.” “The party advocating class treatment must
demonstrate the existence of an ascertainable and sufficiently
numerous class, a well-defined community of interest, and
substantial benefits from certification that render proceeding
as a class superior to the alternatives. [Citations.] ‘In turn,
the “community of interest requirement embodies three factors:
(1) predominant common questions of law or fact; (2) class
representatives with claims or defenses typical of the class;
and (3) class representatives who can adequately represent
the class.” ’ ” (Brinker Restaurant Corp. v. Superior Court (2012)
53 Cal.4th 1004, 1021 (Brinker).)
The certification question is “ ‘ “essentially a procedural
one that does not ask whether an action is legally or factually
meritorious,” ’ ” and thus, “resolution of disputes over the
merits of a case generally must be postponed until after class
certification has been decided [citation], with the court assuming
for purposes of the certification motion that any claims have
merit.” (Brinker, supra, 53 Cal.4th at p. 1023.) Our Supreme

10 An order denying class certification is appealable under
the “ ‘death knell’ ” doctrine. (See Meinhardt v. City of Sunnyvale
(2024) 16 Cal.5th 643, 656, fn. 8.)

18
Court has recognized that, when “evidence or legal issues
germane to the certification question bear as well on aspects
of the merits, a court may properly evaluate them.” (Id.
at pp. 1023–1024.) However, “[s]uch inquiries are closely
circumscribed.” (Id. at p. 1024.) “[A]ny ‘peek’ a court takes
into the merits at the certification stage must ‘be limited to
those aspects of the merits that affect the decisions essential’
to class certification.” (Ibid.)
“ ‘The decision to certify a class rests squarely within the
discretion of the trial court, and we afford that decision great
deference on appeal, reversing only for a manifest abuse of
discretion: “Because trial courts are ideally situated to evaluate
the efficiencies and practicalities of permitting group action, they
are afforded great discretion in granting or denying certification.”
[Citation.] A certification order generally will not be disturbed
unless (1) it is unsupported by substantial evidence, (2) it rests on
improper criteria, or (3) it rests on erroneous legal assumptions.’ ”
(Brinker, supra, 53 Cal.4th at p. 1022.) Therefore, “ ‘[u]nlike the
general rule compelling a reviewing court to scrutinize the result
below, not the trial court’s rationale, we analyze the propriety
of an order denying class certification based solely on the lower
court’s stated reason for the decision.’ [Citation.]” (Leeds v. City
of Los Angeles (2025) 115 Cal.App.5th 537, 545–546 (Leeds).)
“ ‘Under this standard, an order based upon improper
criteria or incorrect assumptions calls for reversal “ ‘even though
there may be substantial evidence to support the court’s
order.’ ” ’ ” (Noel v. Thrifty Payless, Inc. (2019) 7 Cal.5th 955,
968 (Noel); see also Ayala v. Antelope Valley Newspapers, Inc.
(2014) 59 Cal.4th 522, 537 [“[a] certification decision is reviewed
for abuse of discretion, but when the supporting reasoning

19
reveals the court based its decision on erroneous legal
assumptions about the relevant questions, that decision
cannot stand”]; Cochran v. Schwan’s Home Service, Inc.
(2014) 228 Cal.App.4th 1137, 1143, quoting Knapp v. AT&T
Wireless Services, Inc. (2011) 195 Cal.App.4th 932, 939 (Knapp)
[“ ‘A trial court’s decision that rests on an error of law is an
abuse of discretion.’ ”].)
2. Ascertainability of the patient portal subclass11
A class is ascertainable “when it is defined ‘in terms of
objective characteristics and common transactional facts’ that
make ‘the ultimate identification of class members possible
when that identification becomes necessary.’ ” (Noel, supra,
7 Cal.5th at p. 980.) “[T]his standard . . . include[es] class
definitions that are ‘sufficient to allow a member of [the class]
to identify himself or herself as having a right to recover based
on the [class] description.’ ” (Ibid.)
Plaintiffs defined the patient portal subclass as “All Class
members who were logged into Adventist Health’s patient portal
up until May 2023.” Plaintiffs ultimately defined the general
class—i.e., all class members—as, “For the period November 16,
2017 to April 30, 2024, all Adventist Health patients with an
address in California who used the Adventist website or patient
portal to exchange communications with Adventist Health for
[1] researching medical conditions or treatments, [2] finding a
physician, [3] making an appointment, or [4] submitting a health
risk assessment form.” The initial class definition, however,
encompassed patients “who used the Adventist website or

11 The court found the HRA form subclass members were
ascertainable based on Adventist’s and/or its vendor’s records.

20
patient portal to exchange communications with Adventist
Health, including” the four above activities. (Italics added.)
Plaintiffs’ counsel suggested the revised definition during
the hearing on plaintiffs’ motion and—in plaintiffs’ trial plan—
proposed the court certify the general class as revised.
Accordingly, as Adventist asserts, the patient portal
subclass definition incorporated the revised definition of
the general class. Substituting “[a]ll Class members” with
plaintiffs’ definition of the general class, the patient portal
subclass definition is: All Adventist patients with an address
in California who logged into the patient portal up until May
2023 to exchange communications with Adventist for researching
medical conditions or treatments, finding a physician, making
an appointment, or submitting a health risk assessment form.
The court found plaintiffs did not establish the members
of the general class were ascertainable. The court noted
plaintiffs “propose[d] that [Adventist] generate a list of all
California patients and then ‘patients could identify themselves
as having used the website or patient portal to research medical
conditions or treatments, find a physician, make an appointment,
or submit a health risk assessment form.’ ” Plaintiffs argued
patients would “be able to figure out from the class definition
whether they are part of the class and they can ‘self-report.’ ”
The court found “[i]t [wa]s not so simple,” in part because the
class definition “d[id] not clearly tell putative class member[s]
how to self-report.” The court then concluded the patient portal
subclass had “a similar problem.” Plaintiffs had argued patient
portal subclass members were ascertainable because Adventist
had “information of all registered patient portal users in its
records.” The court found “being a registered user of the patient

21
portal does not mean a patient engaged in activity on the patient
portal that resulted in information, let alon[e] ‘content’ and
‘medical information,’ being transmitted to third parties.” The
court continued, “Plaintiffs do not explain how to ascertain which
patients logged into the patient portal and engaged in the types
of activities that allegedly resulted in ‘content’ and ‘medical
information’ being transmitted, as discussed below,” referring
to its predominance analysis.
Plaintiffs argue the record shows the patient portal
subclass is ascertainable through Adventist’s or its provider
Cerner’s records. As plaintiffs note, the evidence shows
Adventist could create a report of the patient identification
numbers (ID) that created a portal account and the number
of times the patient ID “accessed the portal.” Accordingly,
plaintiffs demonstrated patients who logged into the patient
portal during the subclass period were readily identifiable.
However, as the court implied12 and Adventist argues,
plaintiffs did not demonstrate how to identify patients who
logged into the patient portal and engaged in one of the four
enumerated activities. A patient’s options within the patient
portal were not limited to researching medical conditions
or treatments, finding a physician, making an appointment,
and submitting an HRA. Within the patient portal, patients
also could view lab, radiology, and other results; view their

12 As we noted, the court found the general class definition
did “not clearly tell putative class member[s] how to self-report.”
We can infer the court found the patient portal—which had a
“similar problem”—also did not clearly tell members how to self-
report, in part, because it necessarily subsumed the definition
of the class.

22
health record; download a document; send or receive messages;
pay a bill; and other activities.
Plaintiffs argue Adventist never disputed the patient portal
subclass was ascertainable. In opposing plaintiffs’ motion—
before plaintiffs modified the class definition—Adventist did
not dispute that it could identify patients who had logged into
the patient portal. But in response to plaintiffs’ trial plan,
Adventist argued the “revised general class definition creates
serious impediments to certification of their Patient Portal
Subclass. Specifically, a patient who merely logs in to the patient
portal and does nothing else is not a class member.” (Boldface
omitted.) Adventist specifically noted plaintiffs’ revised class
definition included “only those Adventist Health patients who
used the Adventist Health websites (and the patient portal)
for only four specific things”—researching medical conditions
or treatments, finding a physician, making an appointment, or
submitting a HRA form. Adventist asserted that, as a result,
“not all patient portal users fall within the class; rather, only
those who used the patient portal for identified purposes fall
within the revised class definition.” Adventist argued this
definition raised “additional individual questions about,”
among other things, “what each patient portal user was doing
on the patient portal website” and “whether the actions taken
using the portal fall within one of these four specific categories.”
Plaintiffs argue patients identified as having logged into
the patient portal “could easily recall if they had ever once used
the Patient Portal for any of the purposes for which it was
designed.” Patients may be able to recall what actions they took
within the patient portal, but plaintiffs have not explained how
patients could determine—as Adventist notes—if, for example,

23
their messaging a doctor, downloading a health record, or paying
a bill counted as “researching medical conditions or treatments,”
“finding a physician,” “making an appointment,” or none of those
things.
Nevertheless, as the court itself acknowledged, any
interactions a patient had within the patient portal—unlike
on Adventist’s general website—necessarily would have related
to the patient’s health care. It does not appear that plaintiffs
intended to limit the patient portal subclass only to those
patients who engaged in one of the four specified activities—
especially when, as we discuss below, plaintiffs contend the
baseline information transmitted when a patient logged into the
patient portal transmitted “contents” and “medical information”
to Google. Indeed, plaintiffs’ counsel suggested the revision to
the general class definition to address the court’s stated concerns
about “the general website.” Counsel explained, “I think there’s
one word change that could be made in the proposed class
definition for the general website. [¶] . . . [¶] . . . Strike the word
‘including.’ ” (Italics added.) The court responded, “Oh, replace it
with like about: to exchange communications about researching
medical, finding a physician, making an appointment. [¶] . . .
[¶] . . . So that would eliminate my concern about like you’re
just going on to find the address.” Counsel continued, “Yes,
Your Honor, and we acknowledge that that class would require
self-identification anyway . . . . So that one change would we
think solve the court’s concern with respect or at least address
the court’s concern with respect to the general website.” (Italics
added.)

24
Accordingly, when discussing plaintiffs’ proposed revision
to the general class definition, both plaintiffs’ counsel and
the court had patients’ interactions with the general website
—rather than the authenticated patient portal—in mind.
Critically, earlier in the hearing the court had “agree[d] . . .
the patient portal is people who were patients who are engaging
in the website because of their medical conditions,” not “just some
person on the website looking around the website for whatever
reason.”13 In any event, the posture of this case has changed.
Plaintiffs no longer seek to certify a general class of patients
who used the general Adventist website. For the remaining
patient portal and HRA form subclasses, the enumeration of
specific health-related activities simply is unnecessary to weed
out patients who used the website for non-health-care-related
activities. The patient portal subclass includes only California
patients who logged into the patient portal, and the HRA form
subclass includes only California patients who submitted an
HRA form. Neither subclass raises the concerns the court
had that led plaintiffs’ counsel to revise the class definition.

13 Plaintiffs’ expert Shafiq also stated the class definition
was “limited to patients who interacted with Adventist Health’s
website in specific ways (submitting a health risk assessment,
searching for a medical condition, searching for a physician,
booking an appointment with a provider, or logging into the
patient portal) that involve exchanging health-care-related
information with Adventist.” (Italics added.) In other words,
Shafiq understood that logging into the patient portal itself was
one of the ways in which purported class members could interact
with Adventist’s websites to exchange health-care-related
information.

25
In essence, plaintiffs’ appeal has rendered their post-hearing
revision to the general class moot.
And as we discussed, Adventist and/or its provider Cerner
have records identifying patients who logged into the patient
portal during the relevant period. If some small number of
patients who logged into the portal never used the portal, or
never used it for themselves, “ ‘those [persons] can be eliminated
from the class at that time.’ ” (Nicodemus v. Saint Francis
Memorial Hospital (2016) 3 Cal.App.5th 1200, 1213–1214
(Nicodemus) [data set of all patients’ attorneys’ requests for
patient records attaching release authorizations that may
have included some requests made after litigation began or
for nonlitigation reasons (and thus outside the proposed class)
was sufficient to demonstrate ascertainability].) Moreover,
Adventist did not dispute that the patient portal class was
ascertainable before plaintiffs revised the general class definition.
As plaintiffs note, the court also found they did “not explain
how to ascertain which patients logged into the patient portal
and engaged in the types of activities that allegedly resulted
in ‘content’ and ‘medical information’ being transmitted.”
Whether Adventist violated CIPA or CMIA by transmitting the
contents of patients communications or their medical information
are merits questions that plaintiffs were not required to answer
to demonstrate ascertainability. In turn, whether Adventist’s
liability under those statutes is subject to common proof relates
to the court’s predominance inquiry, which we discuss below.
Accordingly, we conclude plaintiffs demonstrated the patient
portal subclass members are ascertainable.

26
3. The court’s predominance inquiry
“The ‘ultimate question’ the element of predominance
presents is whether ‘the issues which may be jointly tried, when
compared with those requiring separate adjudication, are so
numerous or substantial that the maintenance of a class action
would be advantageous to the judicial process and to the
litigants.’ [Citations.]” (Brinker, supra, 53 Cal.4th at p. 1021.)
“A court must examine the allegations of the complaint and
supporting declarations [citation] and consider whether
the legal and factual issues they present are such that their
resolution in a single class proceeding would be both desirable
and feasible.” (Id. at pp. 1021–1022; see also Walsh v. IKON
Office Solutions, Inc. (2007) 148 Cal.App.4th 1440, 1450
(Walsh) [“In examining whether common issues of law or fact
predominate, the court must consider the plaintiff’s legal
theory of liability.”].)
“ ‘As a general rule if the defendant’s liability can be
determined by facts common to all members of the class, a class
will be certified even if the members must individually prove
their damages.’ ” (Brinker, supra, 53 Cal.4th at p. 1022.)
The “pertinent questions” under the predominance inquiry are:
“(1) What elements must be proven to establish the defendant’s
liability, and (2) Are these elements susceptible of common
proof?” (Downey v. Public Storage, Inc. (2020) 44 Cal.App.5th
1103, 1113 (Downey).) Moreover, “ ‘[T]he possibility that a
defendant may be able to defeat the showing of an element
of a cause of action “ ‘as to a few individual class members[,]
does not transform the common question into a multitude
of individual ones.’ ” [Citation.]’ ” (Nicodemus, supra,
3 Cal.App.5th at p. 1219.)

27
Plaintiffs’ trial plan stated it was seeking class certification
of their (1) CIPA claim, which alleged in the TAC that Adventist
had violated two provisions of CIPA: section 631(a), known as
the “wiretapping provision” and section 632(a), known as the
“recording provision”—which the court found plaintiffs had
abandoned (see Meta Pixel, supra, 647 F.Supp.3d at p. 798);14
(2) CMIA claims, alleging Adventist violated Civil Code sections
56.10 and 56.101; and (3) UCL claims based on Adventist’s
alleged violations of CIPA and CMIA.15
In essence, the trial court found that—although plaintiffs
had established the existence of several issues subject to common
proof—due to variations in the actual information shared
with Google and/or Meta through the URLs and other data
transmitted by the pixels, plaintiffs failed to meet their burden
to show Adventist’s liability under CIPA or CMIA could be
determined based on evidence common to all class members.
(See Duran v. U.S. Bank National Assn. (2014) 59 Cal.4th 1, 28
(Duran) [“class treatment is not appropriate ‘if every member
of the alleged class would be required to litigate numerous
and substantial questions determining his individual right to
recover following the “class judgment” ’ on common issues”].)
We first state the applicable law and then review the court’s
predominance analysis as to the two subclasses.
a. Applicable law
The wiretapping provision of CIPA, as relevant here,
imposes statutory penalties on anyone “who willfully and without

14 We discuss that finding at the end of the Discussion
section.
15 Accordingly, we need not separately address that claim.

28
the consent of all parties to the communication,” “reads or
attempts to read, or to learn the contents or meaning of any
message, report, or communication while the same is in transit
or passing over any wire, line, or cable, or is being sent from, or
received at any place within this state; or who uses, or attempts
to use, in any manner, or for any purpose, or to communicate
in any way, any information so obtained, or who aids, agrees
with, employs, or conspires with any person or persons to
unlawfully do, or permit, or cause to be done any of the acts
or things mentioned above in this section.” (§ 631(a).) Plaintiffs
alleged Adventist aided and abetted Meta and Google’s violation
of the “ ‘eavesdropping’ ” and “use” clauses of section 631(a). (See
Rodriguez v. Ford Motor Co. (S.D.Cal. 2024) 722 F.Supp.3d 1104,
1112–1114, 1116, 1122–1224 [to state a claim for “aiding and
abetting” under section 631(a), plaintiff must allege the third
party “ ‘violated one of the first three clauses of section 631(a),
and that [d]efendant aided, agreed with, employed, or conspired
with that person or entity to commit those unlawful acts’ ”].)
The court’s predominance analysis focused on whether
plaintiffs had demonstrated common evidence could be used
to determine whether the URLs shared with Google and/or
Meta included the “contents” of patients’ communications with
Adventist. CIPA does not define “contents.” A similar provision
in the federal Wiretap Act, however, broadly defines “ ‘contents’ ”
to “include[ ] any information concerning the substance, purport,
or meaning of that communication.” (18 U.S.C. § 2510(8);
see Meta Pixel, supra, 647 F.Supp.3d at p. 798 [analysis for
a violation of CIPA “ ‘is the same as that under the federal
Wiretap Act’ ”]; 18 U.S.C. § 2511(1)(a)–(e).) According to the
Ninth Circuit, the “ ‘contents’ ” of an online communication

29
“refers to the intended message conveyed by the communication,
and does not include record information regarding the
characteristics of the message that is generated in the course
of the communication.” (In re Zynga Privacy Litigation (9th Cir.
2014) 750 F.3d 1098, 1106–1107 (Zynga).) In Zynga, the Ninth
Circuit explained a URL that included “only basic identification
and address information” did not constitute “the contents of
a communication,” but a URL that contained “a search term
or similar communication made by the user” may constitute
“contents.” (Id. at pp. 1108–1109; see id. at pp. 1102–1103,
1107 [granting motion to dismiss where alleged information
transmitted—user’s Facebook ID and address of webpage user
was viewing when user clicked link to a gaming application—
was not “ ‘contents’ ” but record information].)
Since Zynga, other federal district courts within California
have considered whether URLs shared or intercepted by tracking
technologies constitute the “contents” of a communication.
In Meta Pixel, supra, 647 F.Supp.3d at pp. 785, 795–796, 798
the trial court—in deciding a motion for preliminary injunction—
found alleged transmissions of patients’ log-in communications
with their health care provider MedStar Health System’s patient
portal “likely constitute[d] ‘contents’ ” under the Wiretap Act
and CIPA. Plaintiffs there alleged that, when they “press[ed]
the login button” to enter their patient portal, the information
was sent to Meta through a transmission that included the
“patient’s identity in the form of cookies, IP address, and User-
Agent identifiers,” “[c]ontent of the button (‘Log in’),” “[c]ontents
of the page from which the patient clicked to log in to the patient
portal,” and “[c]ontent of the page the patient will land as a result
of clicking ‘Log in’ to the patient portal.” (Id. at p. 785.) The

30
court found the patient portal “log-in buttons” and the descriptive
URLs, which included both “the ‘path’ and the ‘query string,’ ”
were “ ‘contents’ ” because “they concern[ed] the substance of
a communication.” (Id. at pp. 795–796 [also explaining “contact
information provided as part of a sign-up process constitutes
‘content’ because this information is the subject of the
communication”].)
Federal district courts have “ ‘employ[ed] a contextual
“case-specific” analysis hinging on “how much information would
be revealed” by the information’s tracking and disclosure.’ ”
(Cousin v. Sharp Healthcare (S.D.Cal. 2023) 702 F.Supp.3d 967,
976 (Cousin II), quoting Hammerling v. Google, LLC (N.D.Cal.
2022) 615 F.Supp.3d 1069, 1092–1093.) “ ‘Generally, customer
information such as a person’s name, address, and subscriber
number or identity is record information, but it may be contents
when it is part of the substance of the message conveyed to the
recipient. [Citations.] Similarly, URLs are record information
when they only reveal a general webpage address and basic
identification information, but when they reproduce a person’s
personal search engine queries, they are contents.’ ” (Ibid.
[denying motion to dismiss where alleged data included “personal
search queries—such as specialty healthcare providers and
treatments for medical conditions—and therefore plausibly
conveyed content: their PHI”]; see also In re Google RTB
Consumer Privacy Litigation (N.D.Cal. 2022) 606 F.Supp.3d 935,
949 (Google RTB) [finding redirected electronic communications
allegedly comprised of “ ‘content categories of the site or app,’ ”
“ ‘[content] categories that describe [the] current section of the
site or app,’ ” the “ ‘URL of the page where the impression will be
shown,’ ” “ ‘referrer URL that caused navigation to the current

31
page,’ ” and a “ ‘list of keywords about [the] site or app,’ ” among
other items, constituted “content”].)
CMIA in turn prohibits a health care provider from
disclosing “medical information regarding a patient . . . without
first obtaining authorization.” (Civ. Code, § 56.10, subd. (a).)
CMIA defines “medical information” as “any individually
identifiable information . . . regarding a patient’s medical history,
. . . mental or physical condition, or treatment. ‘Individually
identifiable’ means that the medical information includes
or contains any element of personal identifying information
sufficient to allow identification of the individual, such as the
person’s name, address, electronic mail address, telephone
number, or social security number, or other information that,
alone or in combination with other publicly available information,
reveals the identity of the individual.” (Civ. Code, § 56.05, subd.
(j)(1), former subd. (j) (2024–2025), former subd. (i) (2022–2023),
and former subd. (j) (2014–2021).) The definition of “medical
information” “does not encompass demographic or numeric
information that does not reveal medical history, diagnosis,
or care.” (Eisenhower Medical Center v. Superior Court (2014)
226 Cal.App.4th 430, 435 (Eisenhower).)
b. HRA form subclass
i. The court made a merits determination in
implicitly deciding plaintiffs could not establish
by common proof that Adventist transmitted
the contents of communications or medical
information of patients who submitted
HRA forms under CIPA or CMIA
As plaintiffs note, in assessing the predominance prong
for the HRA form subclass, the court discussed the evidence

32
relating to plaintiffs’ CIPA and CMIA claims together. The court
noted plaintiffs’ motion asserted—citing Shafiq’s report—the
tracking code Adventist employed on the HRA forms caused
Google and Meta to be notified when an HRA form had been
completed and transmitted “ ‘full-string URLs’ . . . that ‘included
a unique string of numbers that would allow anyone . . . to access
the HRA reports’ contents.’ ” The court noted the cited portions
of Shafiq’s report stated Adventist shared information “ ‘about
specific events such as “HRA Report Accessed” ’ and URLs such
as ‘https://quiz.adventisthealth.org/v3/c6c2ecf4-abec-4222-843a-
65e83697f7b0/report/a2d7dfd4-c6fe-4c53-8d41-eacf4e4e87a0.’ ”16
Shafiq noted “anyone can go” to that URL “to access the contents
of the report.”
When “clicked” the two example HRA URLs in Shafiq’s
report indeed link directly to reports that assess the user’s risk
factors for the specified health condition based on information
the user input into the HRA form. (See footnote 16.) The reports
thus refer to that user-provided information. For example, the
WeightAware report recommended the individual lose weight
and indicated, among other things, that the individual had
high blood pressure and cholesterol or was taking medication
for those conditions, had sleep apnea and asthma, and exercised
a moderate amount. Similarly, the HeartAware report accessed
from a second link included the individual’s age, sex, and weight,
and noted the person had cholesterol outside the recommended

16 This link is to a “WeightAware” report—an HRA for
weight loss. Shafiq’s report also included the following link
to a “HeartAware” report—an HRA for cardiovascular risk:
https://quiz.adventisthealth.org/v3/64d7e7c0-d719-4d61-be6d-
a2a3f50cebbe/report/8f3a968d-1615-4857-a52b-ebde3074886b.

33
range, had a family history of early cardiovascular disease,
and exercised a moderate amount, among other information.
The court found it was “questionable whether the fact that
a person filled out an HRA reveals the contents of a patient’s
communications with [Adventist] or anything about the patient’s
physical or mental condition or treatment. On the other hand,
the actual HRAs likely contain both contents of patients’
communications and their medical information.” This difference
between a URL/event data indicating a patient had submitted
an HRA form, and the completed HRA form or results report
itself, is the only reasoning the court expressed for finding
plaintiffs failed to demonstrate common issues predominated
for the HRA form subclass on their CIPA claim.
But plaintiffs alleged that every submission of an HRA
questionnaire resulted in the transmission of a URL that linked
directly to an HRA report. And whether the transmission
of those URLs linking to completed reports—rather than
transmission of the reports themselves—is the transmission
of “contents” under CIPA or medical information under CMIA,
is a merits question. (See Linder v. Thrifty Oil Co. (2000) 23
Cal.4th 429, 439–440 (Linder) [question of class certification
is “essentially a procedural one that does not ask whether an
action is legally or factually meritorious”]; see also Sav-On Drug
Stores, Inc. v. Superior Court (2004) 34 Cal.4th 319, 327 (Sav-On)
[“focus in a certification dispute is on what type of questions—
common or individual—are likely to arise in the action, rather
than on the merits of the case”].) Plaintiffs presented evidence
that this merits question could be answered—one way or
the other—with common proof. They presented evidence that
the tracking technologies were installed on the HRA portion of

34
the Adventist website and where patients filled out HRA forms;
the tracking technologies uniformly shared “a baseline of
information” that included URLs, along with first-party cookie
identifiers, IP addresses, and user agent data; and after a user
submitted an HRA form, a URL was generated providing the user
with a report of the results. In other words plaintiffs’ evidence
allegedly would show that patients who submitted HRA forms
would have received a report of their results through a URL link,
and the tracking technologies uniformly would have shared that
URL link with Google and/or Meta regardless of the specific HRA
submitted. And arguably the results report for any submitted
HRA—as in the examples above—likely would contain the
“contents” of patients’ communications and their medical
information.
Adventist nevertheless argues plaintiffs “presented no
evidence that links to particular HRA results were uniformly
transmitted,” and Shafiq’s report did not show the tracking pixels
actually shared the HRA results URL with Google and/or Meta.
Shafiq stated—under penalty of perjury—that his “testing and
analysis” showed Adventist installed tracking pixels from Google
and Meta on the HRA section of its website, including where
the patient fills out the HRA form. Anne Dinapoli Block—a
representative from Adventist’s marketing firm BPD—testified
Google Tag Manager containers that included tracking pixels
for Google and Meta were “on the HRAs.” And Shafiq’s report
included the two URL examples noted above.
Shafiq also stated he tested how Adventist “installs
tracking pixels from third party companies while interacting with
the website in the form of assessments, surveys, and quizzes.”
He filled out three different HRAs and a cancer genetic risk

35
survey and, after submitting them, received a final report
for each that he “could view, print, or email.” Shafiq stated
his “testing showed Adventist did share the full-string URL
on the HRA portion of its website with both Google and Meta.”
Moreover, Shafiq opined the “tracking pixel source code on
Adventist Health’s website operates deterministically, meaning
it consistently executes in the same manner, always sharing
identifiers and content information with third parties such
as Google or Meta.” Shafiq further explained, “[s]uch code is
designed to behave uniformly for all users, meaning it will
execute the same way and share identical types of information
for every patient accessing Adventist Health’s website.” He
concluded Adventist’s website “uniformly installed tracking
pixels from third-party companies such as Google and Meta
over the class period.” And Adventist’s expert Cohen testified
she was unaware of any instances where the tracking pixels
installed on the “various Adventist websites” did not “share
at least a baseline of information,” including URLs.
Adventist asserts Shafiq’s report showed tracking
technologies only on “the homepage/disclaimer page for one
particular HRA,” but the report did not show “Google or Meta
tracking pixels being used on an HRA results page.” Adventist
notes its manager of marketing automation, Crystal Long,
“testified that, to the extent they were used at all, tracking pixels
would be on the initial disclaimer pages.” Long testified it
was her “understanding” that there was a pixel on the initial
disclaimer page but that pixel did not record if someone
completed an assessment, “[s]o the person could have left the
[HRA] and never checked the box and never proceeded, but
they’re thinking that somebody took that HRA because they

36
got to that page.” She recalled that issue “led to a discrepancy
between the number of people who visited the [HRA] page and
the number that actually completed it.” She did not testify that
pixels were not firing on the pages or events that came up when
a person checked the disclaimer box and completed the HRA
form, however. Adventist also asserts Shafiq “fail[ed] to show—
through DevTools, historical Google Analytics data, or otherwise”
—that the HRA results URL was transmitted to a third party.
Whether plaintiffs can prove Adventist in fact transmitted
URL links to HRA reports to Google and/or Meta also is a merits
question. At this stage, however, plaintiffs had to demonstrate
the claim was subject to common proof, not that they likely would
prevail on the claim. (Downey, supra, 44 Cal.App.5th at p. 1113
[predominance inquiry asks if the elements of the claim are
“susceptible of common proof”].) We conclude the evidence
plaintiffs presented was sufficient to demonstrate this issue—
whether Adventist uniformly shared URL links to patient HRA
reports with Google and/or Meta—could be answered through
common proof rather than individual inquiry. We offer no
opinion as to whether the evidence plaintiffs ultimately produce
will be sufficient to prove that is what happened.17 In any event,

17 Discovery is ongoing. After the certification hearing,
in January 2025, the court granted plaintiffs’ motion to compel
Adventist to produce certain Google Analytic logs it had provided
to its expert Cohen, which Shafiq would use for further statistical
analysis. At the certification hearing, plaintiffs’ counsel noted
the pending motion to compel and argued that, with those data
logs, Shafiq could “do a probability analysis . . . to identify the
likelihood that an individual class member will have transmitted
protected health information at least once during the class
period.”

37
the court did not deny certification of the HRA form subclass
for failing to satisfy the predominance prong on the ground
plaintiffs failed to show Adventist—through tracking
technologies—uniformly shared URL links to patients’ HRA
reports with Meta and/or Google. (See Leeds, supra, 115
Cal.App.5th at pp. 545–546 [appellate court analyzes denial
of class certification “ ‘based solely on the lower court’s stated
reason for the decision’ ”]; Knapp, supra, 195 Cal.App.4th at
p. 939 [“We may only consider the reasons stated by the trial
court and must ignore any unexpressed reason that might
support the ruling.”].)
Adventist also contends the court correctly found “there
is significant variability within the URLs and event data that
are allegedly transferred to Google and/or Meta” with respect to
the HRA form subclass. In its discussion of the predominance
prong for plaintiffs’ CIPA and CMIA claims as to the general
class, the court referred to—in addition to “ ‘ “HRA Report
Accessed” ’ ”—other “ ‘specific events’ ” and “page URLs” from
the HRA website that Shafiq’s report stated Adventist tracked
and transmitted, such as “ ‘ “HRA Disclaimer Agree,” ’ ”
“ ‘ “HRA Email Sign Up,” ’ ” “ ‘patient-assessment-report,’ ”
“ ‘https://hraadventisthealth.org,’ ” and “ ‘https://quiz.adventist
health.org.’ ” The court noted Shafiq didn’t state whether the
referenced “events” “contain[ed] patient search terms” and
didn’t differentiate between URLs and page titles that included
“user-inputted search terms” and those that did not. The court
found the noted events “appear[ed] to be records of page views
or buttons/links that a patient clicked” and thus were “not
‘content.’ ” The court also found the noted URLs and events

38
“provide[d] no information on their face about a patient’s
medical history, mental or physical condition, or treatment.”
The proposed HRA form subclass, however, includes only
patients who submitted HRA forms. The fact that Adventist
transmitted different URLs or event data depending on whether
a patient visited an HRA page, clicked on an HRA “quiz,” or
accessed an HRA report after submitting an HRA form thus
did not create individualized issues of proof—patients who
viewed but did not submit an HRA form or who only visited an
HRA page would not be part of the subclass. Only individuals
who submitted an HRA form would have received a URL link to
the report with the results. And as plaintiffs assert, all patients
who submitted an HRA form would have “proceeded through
[the] entire workflow” of multiple page view events. Moreover,
determining whether the sharing of a URL that links directly
to an HRA report can itself constitute the transmission of the
“contents” of a communication or of medical information would
not require review of each individual URL. Nor did the court
conclude the URLs that Adventist shared when patients
submitted HRA forms were too varied to determine by common
proof whether they constituted the contents of a communication
or medical information. As we now discuss, the court found
proof of plaintiffs’ CMIA claim for the HRA form subclass would
require individualized inquiry based on an entirely different
reason.

39
ii. Plaintiffs presented evidence that the question
of whether Google and/or Meta viewed or
accessed submitted HRA forms and/or reports
under the CMIA was subject to common proof
As the court noted, “Liability under CMIA requires a
showing ‘that the confidential nature of the plaintiff’s medical
information was breached as a result of the health care provider’s
negligence’ or affirmative conduct.” (Quoting Regents of
University of California v. Superior Court (2013) 220 Cal.App.4th
549, 564, 570, disapproved of on another ground in J.M. v.
Illuminate Education, Inc. (2026) 19 Cal.5th 705, 723 (J.M.).)
Undoubtedly, the reports generated in response to a patient’s
submitted HRA form—as we described above—contained
information “regarding” that patient’s medical history, condition,
or treatment. (Civ. Code, § 56.05, subd. (j)(1) [defining “medical
information”].) Plaintiffs also presented evidence that the
tracking technologies on the Adventist websites transmitted
identifiers including—at a minimum—first-party cookie
identifiers, IP addresses, and user agent data from which Google
and/or Meta could identify the specific user.18 (Ibid. [“medical
information” is “any individually identifiable information”
regarding a patient’s medical history, etc.].) And, as we
discussed, plaintiffs presented evidence that whether Adventist
transmitted URL links to its patients’ HRA reports is subject
to common proof.

18 Adventist argues that whether Adventist transferred
“identifying information . . . for any particular user” to Google
and/or Meta is a “significant individualized issue.” The court’s
order, however, did not find plaintiffs failed to show common
issues predominated on this question. Without getting into too

40
In essentially finding Adventist’s liability under CMIA
was not susceptible to class-wide proof for the HRA form
subclass, the court noted the “quiz” URL plaintiffs cited from
Shafiq’s report—“containing a [unique] string of numbers
and letters”—“does not, on its face, reveal medical information.
Rather[,] it provides access to medication information.” In Vigil
v. Muir Medical Group IPA, Inc. (2022) 84 Cal.App.5th 197, 213
(Vigil),19 the appellate court held “a breach of confidentiality
under the CMIA requires a showing that an unauthorized party
viewed the confidential information.” (Italics added.) Thus, an
unauthorized party’s possession of or access to the confidential
information would be insufficient to show a breach. (Id. at
pp. 217–219.) The court in Vigil also agreed “breach of
confidentiality under the CMIA is an individualized issue.” (Id.
at p. 219; id. at p. 220 [concluding “each class member would
have to show that his or her medical information was viewed by
an unauthorized party to recover under the CMIA” under Civil

much technical detail, Shafiq explained Google and/or Meta could
determine a user’s identity through “[d]eterministic matching . . .
based on identifiers such as email address, phone number, and
device identifiers,” or “[p]robabilistic matching (also known as
fingerprinting),” which “relies on statistical analysis of multiple
signals.” Shafiq opined the “IP address, user agent, and device
properties from the patient’s browser” that Adventist shared
through the tracking technologies contained a sufficient amount
of data “bits” to enable Google/Meta to “reasonably identi[f]y
an individual”—“even when the patients are not account holders”
—through “identity services” using deterministic and/or
probabilistic matching.
19 As we discuss, Vigil was disapproved of in J.M., supra, 19
Cal.5th at p. 723.

41
Code §§ 56.36, subd. (b) and 56.101, subd. (a)].)20 Following Vigil,
the court here found plaintiffs would have to show Google
and/or Meta actually viewed the contents of the HRAs to show
Adventist’s disclosure of the link violated CMIA.21
After this matter was submitted for decision, our high
court rejected the Vigil “rule that no breach of confidentiality
has occurred until medical information is actually viewed by
an unauthorized person.” (J.M., supra, 19 Cal.5th at p. 721.)
The court held “the primary inquiry with regard to breach
of confidentiality is whether the information is exposed to a
significant risk of unauthorized access or use.” (Id. at p. 723.)
The court disapproved Vigil to the extent it held otherwise.22
(Ibid.)

20 Vigil involved a data breach where a former employee of
a medical group, before her employment ended, “downloaded
copies of information for over 5,400 patients that included
insurance and clinical information.” (Vigil, supra, 84 Cal.App.5th
at pp. 205–206.) The named plaintiff had argued “the case could
be decided on a classwide basis because there was evidence
that [the former employee] downloaded, retained, and viewed
a patient spreadsheet.” (Id. at p. 207.)
21 As plaintiffs note, whether a third party “actually viewed
the information” is not an element under CIPA. (See § 631(a)
[CIPA is violated when a party “reads or attempts to read,
or to learn the contents or meaning of any message, report,
or communication” in transit]; see also footnote 22.)
22 As we discuss, the J.M. decision does not affect our
disposition. If plaintiffs’ proffered theory of proof would enable
a factfinder to determine on a class-wide basis whether Google
and/or Meta viewed or accessed the HRA report links—as we
conclude it does below—it also would enable a factfinder to

42
Not having the benefit of J.M., however, on appeal,
plaintiffs have argued the trial court ignored their proposed
theory of how they commonly could prove “whether third
parties viewed or accessed HRA Subclass members’ medical
information.” Plaintiffs assert they will present evidence at
trial—through their expert Dr. Jennifer Golbeck’s testimony—
that Meta and Google “used sophisticated computer algorithms
to process and analyze the data received from tracking pixel
transmissions.” As plaintiffs note, in her report, Golbeck
summarized her analysis as showing “that Facebook and
Google routinely collect, analyze[ ], and exploit users’ data
for advertising purposes, including the data of Adventist’s
patients.”23 As “Golbeck’s testimony will apply to the entire
Subclass,” plaintiffs contend this element “is a common issue
supporting predominance.” To the extent that this evidence
would satisfy an actual “viewing” or “accessing” requirement,
it would necessarily demonstrate exposure to a significant risk
of unauthorized access.
Adventist argues plaintiffs never argued Meta’s and
Google’s algorithmic processing of data constituted “ ‘viewing’ ”
of that information for purposes of CMIA. Adventist
acknowledges plaintiffs mentioned their algorithm theory

determine if the information in the HRA report links was
“exposed to a significant risk of unauthorized access or use.”
(J.M., supra, 19 Cal.5th at p. 723.) To the extent J.M. raises new
issues, however, the parties may raise them in the trial court
on remand.
23 The court denied Adventist’s motion to strike Golbeck’s
report and opinions.

43
in a footnote but essentially contends that, because a footnote
was insufficient to “advance their ‘algorithmic processing’ theory
at . . . trial,” plaintiffs forfeited the argument.
We disagree. In their motion, plaintiffs argued that
whether Adventist violated CMIA depended on questions
common to the class, including whether “the disclosed
information was ‘viewed or accessed’ by an unauthorized party.”
Plaintiffs provided their support for that statement—as they did
for other common questions their motion identified for this cause
of action—in a footnote. Plaintiffs asserted their expert Golbeck
“will testify that Facebook and Google have sophisticated systems
for processing and analyzing the data and building profiles used
to serve targeted advertising. [Citing ¶¶ 35–77 of Golbeck’s
report.] How these algorithms work and whether processing
by computer algorithm constitutes being ‘viewed or otherwise
accessed’ for CMIA purposes present common questions.”
Plaintiffs filed Golbeck’s report with their motion as a supporting
exhibit. Plaintiffs also cited to Cousin II in support of this
theory. In that case, the district court denied defendant’s motion
to dismiss the plaintiffs’ CMIA claim where the plaintiffs had
“plead[ed] information regarding Meta’s business model and
how it uses the information for targeted advertising.” (Cousin II,
supra, 702 F.Supp.3d at p. 975.) The court explained “whether
the alleged use by Meta of the information, through perhaps
algorithms, amounts to viewing or accessing under CMIA is
a question the Court cannot answer on Defendant’s motion to
dismiss. It is sufficiently plausible at this time that Plaintiffs’
information was ‘viewed or otherwise accessed’ as contemplated
by CMIA.” (Ibid.)

44
Adventist relies on Holden v. City of San Diego (2019) 43
Cal.App.5th 404. There, the court found a plaintiff was precluded
from raising a legal issue on appeal—that the defendant city
had failed to comply with a statute—where he had raised that
issue “only in a footnote in his opening [trial court] brief” without
substantive legal analysis. (Id. at p. 419.) Holden is inapposite.
There, the plaintiff’s footnote stated the city had ignored a
statutory requirement without quoting the relevant language
from the statute or providing any legal analysis that the city
was required to comply with the statute and failed to do so.
(Ibid.) The plaintiff also failed to provide any substantive
analysis of the issue in his opening brief on appeal, again
referring to a footnote. (Ibid.) Here, however, plaintiffs’ motion
contended up front that common issues existed as to Adventist’s
liability under CMIA and set forth those common questions in a
bullet-pointed list. From our reading of the motion, counsel made
a style choice to use footnotes to describe the common evidence
plaintiffs would present to answer those questions rather than
interrupt the flow of that list. And, unlike the plaintiff in
Holden, plaintiffs’ opening and reply briefs on appeal
substantively address their algorithm theory. We find no
forfeiture.24
The court did not mention plaintiffs’ algorithm theory of
proof in finding they failed to show common issues predominated.
It thus did not determine if this element of plaintiffs’ CMIA claim
—whether Google and/or Meta viewed or accessed the HRA

24 Moreover, in opposition to plaintiffs’ certification motion,
Adventist never argued plaintiffs’ algorithm theory would not
enable a factfinder to answer the viewing/accessing question
on a class-wide basis for the HRA form subclass.

45
report links—could be determined on a class-wide basis under
the theory plaintiffs proposed. (See Brinker, supra, 53 Cal.4th at
p. 1021 [answer to question of predominance “hinges on ‘whether
the theory of recovery advanced by the proponents of certification
is, as an analytical matter, likely to prove amenable to class
treatment’ ”]; Walsh, supra, 148 Cal.App.4th at p. 1450 [court
must consider plaintiffs’ theory of liability to determine if
common issues predominate].) This was error. As plaintiffs
argue, the theory they advanced through Golbeck’s report
was that “Google’s and Facebook’s sophisticated algorithms
automatically processed the transmitted data.” Accordingly,
“[t]he trial court’s ‘actual clicks’ theory b[ore] no relationship to
Plaintiffs’ algorithmic processing theory . . . and therefore cannot
support denial of certification.” They argue “[i]t is a class-wide
merits issue whether the algorithmic processing that Plaintiffs
will show Facebook and Google performed satisfies this element
as ‘viewing’ or ‘accessing.’ ” (Citing the district court’s holding
in Cousin II, supra, 702 F.Supp.3d at p. 975, stated above.)
We agree and conclude plaintiffs presented sufficient
evidence to demonstrate their algorithm theory of proof would
enable a factfinder to determine on a class-wide basis whether
Google and/or Meta viewed or accessed the HRA report links.
In plaintiffs’ words, Golbeck’s report explained how Google
and Facebook process, analyze, and assimilate users’ data
they receive to provide targeted advertising. We have reviewed
Golbeck’s report. She explained companies like Meta/Facebook
and Google use machine learning systems to analyze all available
user data to develop predictive models to develop targeted
advertising. “[B]ecause a machine learning system constructs
its predictive model from all data made available, all the data

46
made available is necessarily used by that system, regardless of
what degree of predictive weight a resulting model places on any
given data point.” Golbeck opined “it is reasonable to state that
all data available to [a] model in operation is used by that model,
and it is not usually feasible (and not part of the usual parlance
of those working with machine learning) to discuss the
relationship between a particular piece of data and the
predictions made by the model.”
As we understand their theory, plaintiffs contend they
can show Meta’s and/or Google’s sophisticated data processing
systems/computer algorithms, as a matter of course, would have
“accessed” or “viewed” the data within the actual HRA reports
—i.e., patients’ medical information—through the URL links
Adventist transmitted. That data then necessarily would have
been used in some way by the predictive models those systems
created to develop targeted advertising. Such an analysis would
show on a class-wide basis whether or not Adventist’s alleged
transmission of URL links to patients’ HRA reports resulted
in a breach of the “confidential nature” of patients’ medical
information. Defendants argued below and on appeal that
what Adventist allegedly transmitted was the URL, not the
report itself, and the URL does not reveal medical information.
But whether a third-party’s computer system’s assimilation of
data—as plaintiffs’ expert described—amounts to the viewing
or accessing of that data under the CMIA is a merits question
common to the HRA form subclass. Accordingly, we conclude
plaintiffs met their burden in the trial court to show whether
unauthorized parties viewed or accessed HRA form subclass
members’ medical information can be determined based on
common proof.

47
In summary, we conclude the court’s reasoning did not
support its finding that plaintiffs did not show common issues
predominated on their CIPA and CMIA claims as to the HRA
form subclass.
c. The patient portal subclass
i. Plaintiffs demonstrated their CIPA –
wiretapping claim was subject to common proof
Plaintiffs’ ultimate theory was that the baseline
information the tracking pixels uniformly shared whenever
patients interacted with an Adventist website—the first-party
cookie identifiers, page view information, URLs (whether
partially obfuscated or not), IP addresses (whether complete
or partially masked), and user agent data—was evidence
applicable class-wide to prove plaintiffs’ CIPA (and CMIA) claim,
demonstrating common issues predominated. Plaintiffs relied
on their expert Shafiq’s reports to show the question of whether
this information included the “contents” of Adventist’s patients’
communications was subject to common proof. Those reports,
which the court examined, included Shafiq’s analysis of the data
transmitted to Google and/or Meta from both Adventist’s public
websites and the patient portal, however.
Shafiq stated Adventist “shared at least the following types
of sensitive information about patient activity . . . alongside the
patient identifiers:” “Page URL that includes search terms” and
“Page title that includes search terms.” Shafiq gave examples of
URLs from Adventist’s public website that included query strings
with search terms such as “pregnancy,” “breast . . . cancer,”
and the name of a provider combined with the search term
“mental . . . health” or “radiation . . . oncology.” Another page
URL example showed a search at “doctors.adventisthealth.org”

48
that included a query string with the search terms “surgical”
and “abortion.”
The trial court noted those URL examples included search
terms. The court also referred to Shafiq’s finding that Adventist
shared “Page title that includes search terms such as ‘surgical
abortion – Find a Physician or Provider/Adventist Health’
and ‘MyAdventistHealth Patient Portal/Adventist Health.’ ”25
The court noted the first page title example appeared to contain
search terms but the second did not. The court concluded page
titles like the example “ ‘MyAdventistHealth Patient Portal’ ”
“merely identif[ied] the page” and were “not ‘a person’s personal
search engine queries’ that [could] be content.” (Quoting
Cousin II, supra, 702 F.Supp.3d at p. 976.) The court further
noted Shafiq’s report referred to Adventist having tracked
and transmitted “ ‘specific events’ ”—again, from Adventist’s
public website—“ ‘such as “HRA Report Accessed,” “Online
Scheduling Confirmation,” ’ ” “ ‘patient-assessment-report,’ ”
“ ‘Knee Webinar Thank-You,’ . . . ‘Lodi Ortho Thank-You,’ . . .
‘Adventist Health All Contact Button Clicks,’ [and] ‘Heart
Webinar Pageview,’ ” but he did not “say these events contain
patient search terms.” As we mentioned, the court found
they appeared to be “records of page views or buttons/links
that a patient clicked” and “[a]s such,” were “not ‘content.’ ”
The court noted that although Shafiq gave examples of
URLs “containing patients’ search terms,” his report “define[d]
‘content information’ as including page titles.” “Navigating to

25 The page title “MyAdventistHealth Patient Portal” appears
to be the page where a patient can log into the portal, not
necessarily the page within the patient portal after the patient
has logged in.

49
a webpage without entering search terms,” the court reasoned,
“does not transmit ‘contents,’ even if information about that
webpage (i.e., record data) is transmitted.” (Citing Zynga, supra,
750 F.3d at pp. 1108–1109.) Accordingly, because one patient’s
transmitted information might contain “search terms” that
“could be content,” while another patient’s transmitted
information might consist of a “webpage or event information”
that could be merely “record information,” the court found
plaintiffs failed to show common issues predominated relating
to this element of proof.
Plaintiffs do not dispute this reasoning as applied to the
variety of transmissions from Adventist’s public website with
respect to the general class. Plaintiffs contend, however, that
the court’s reasoning—that their CIPA claim was not susceptible
to common proof because some URLs contained patient search
terms and others did not—did not apply to the patient portal
subclass because no “query strings” were transmitted from the
patient portal. In reasoning plaintiffs failed to show common
issues predominated for the patient portal subclass, the court
noted one example URL transmitted from within the patient
portal included the words “/health-record/radiology”26 revealing—
as Adventist’s expert confirmed—that the patient had requested

26 The full page URL in the patient portal for this example
was “https://patientportal.myadventisthealthportal.org/
person/dS7xf9Kt4in8df5/health-record/radiology/15999379949/
download.” Before sharing the full page URL, Cerner would
have substituted the identifying number strings with
“PERSON_ID” and “DOCUMENT_ID.” One such example is:
“/person/PERSON_ID/health-record/radiology/types/common/
DOCUMENT_ID/download.”

50
a radiology report. The court noted such a URL may have
revealed the patient’s medical information—and thus we can
infer also arguably conveyed the “contents” of the patient’s
communication. The court, however, noted other URLs that
reflected the “patient’s activity in the patient portal caused a
‘Download/Transmit’ or ‘Health Record – Results’ event,” “may
not reveal . . . ‘content’ under CIPA” (or “ ‘medical information’
under CMIA”). The court reasoned “ ‘Download/Transmit’ and
‘Health Record – Results’ appear[ed] not to contain patient
search terms.”27
As plaintiffs note, unlike the public website, none of
the URLs transmitted from the patient portal included patient
search terms because all query strings were removed. Nor would
any Page search terms (such as the surgical abortion example
above) have been included, as Cerner’s security software would
have removed any terms revealing health information within
search parameters. Accordingly, as no patient portal URLs
contained user search terms or query strings, plaintiffs argue
there would be no need to examine the individual URLs for
search terms to determine if they transmitted “contents,” as the
court had reasoned was required for the public website. Rather,
plaintiffs contend that whether Adventist’s uniform transmission
of URLs from the portal with path information, “including
descriptive natural language terms like ‘Health Record – Results’

27 These descriptive terms reflected the tabs or buttons within
the patient portal that logged-in patients could “click.” Others
included “lab results,” “radiology,” “medications,” “procedures,”
“health record,” “messages,” “appointments,” “documents,” and
“view results.”

51
and ‘Radiology,’ ” satisfies the “contents” element of CIPA “is a
merits question, and it is a common one.”
First, we do not interpret the court’s reference to “events”
not containing “search terms” to mean the court mistakenly
believed some URLs in the patient portal had “query strings” and
some did not, as plaintiffs seem to contend. Rather, the court
was comparing the “radiology” example—which showed the
patient had downloaded a radiology record through inclusion of
the substantive term “radiology”—with the other two examples
that generally described the patient’s activity—having instigated
an unknown “download” or viewed some type of “results” within
the patient’s health record. Critically, the court did not state
the “radiology” example included user search terms while the
“download/transmit” example did not. Rather, we understand
the court to have reasoned that, without a user search term,
specific document accessed, or other similar user communication,
the descriptor “download/transmit” likely did not convey the
contents of the patient’s communications whereas “radiology”
might. (Cf. Cousin II, supra, 702 F.Supp.3d at pp. 975–976
[alleging data collected included “specialty healthcare providers”
and “treatments for medical conditions” was sufficient to show
“ ‘contents of communications’ ” to state a claim under CIPA].)
We do not disagree that the different descriptive terms within
the patient portal URLs seem to convey different levels of
information—despite uniformly not including query strings.
Nevertheless, those descriptive terms—as we noted—
denote the activity choice the patient made within the patient’s
personalized portal. Presumably, a URL that included the
descriptive term “health record” or “messages” indicated the
patient had accessed her electronic health record or sent or read

52
a message to or from a provider, just as the term “radiology”
that appeared in the example above showed a patient checked
a radiology result. In the context of an authenticated patient
portal, therefore, the description of the chosen page visited,
or activity performed within the portal, arguably is not “basic
identification [or] address information” that constitutes merely
“record information.” (Zynga, supra, 750 F.3d at pp. 1107,
1109.)28 For purposes of determining whether the URLs
transmitted from the patient portal conveyed “contents” under
CIPA, it thus would not seem to matter whether the descriptive
term assigned to the chosen activity was more specific like
“radiology” or more generic like “download,” as any term arguably
would convey the “purport” of the patient’s communications with
Adventist—to message a provider, download a health record,

28 For Adventist’s public website, in contrast, the URL
arguably would need to include specific terms to disclose that the
patient was exchanging health-care-related communications with
Adventist and not simply browsing the website. For the patient
portal subclass, however, the information Adventist allegedly
transmitted did not show the patient simply navigated to the
patient portal login page, but that the patient actually had logged
into the portal and took a specific action. (Compare, e.g., Zynga,
supra, 750 F.3d at pp. 1108–1109 [address of website visited
was not the “contents of a communication”] with Google RTB,
supra, 606 F.Supp.3d at p. 949 [finding alleged transmission of
“ ‘content categories’ ” of website, categories that describe current
section of the website, and other information, all disclosed
“content”].) Again, the court agreed that patients who logged
into the patient portal only would be engaging in activities
related to their health care with Adventist.

53
view a test result, etc.29 (See 18 U.S.C.§ 2510(8).) Whether
plaintiffs successfully can establish those URLs—despite having
generic descriptive terms—satisfy CIPA’s contents element is
a merits question, however. (See Brinker, supra, 53 Cal.4th at
p. 1023 [certification question does not ask whether action is
legally or factually meritorious].)
In any event, plaintiffs argue—as they did below—that
the baseline information the tracking technologies universally
transmitted when a patient logged into the patient portal is
common evidence that will show Adventist transmitted the
“contents” of the subclass members’ communications in violation
of CIPA. They argue that “simply logging into the portal
disclosed the individual’s status as [Adventist’s] patient” and
thus transmitted content. (See Nienaber v. Overlake Hosp.
Medical Center (W.D.Wash. 2024) 733 F.Supp.3d 1072, 1081
(Nienaber) [“transmission of information submitted to a private
patient portal—such as a user clicking on the ‘log in’ button on
that webpage—reveals patient status”].) Plaintiffs presented
evidence through Shafiq’s report that, along with the URL path
showing the user logged into the patient portal, the tracking
technologies transmitted the “partially masked IP address,

29 Griffith v. TikTok, Inc. (C.D.Cal., Sept. 9, 2024, No. 5:23-cv-
00964-SB-E) 2024 WL 4308813, relied on by Adventist, is thus
distinguishable. The alleged CIPA violations there were based
on the TikTok pixel having transmitted the contents of purported
class members’ communications from various websites. (Id. at
*1–2, 4.) The viability of plaintiffs’ CIPA claims thus would
depend on the nature of each website, each plaintiff’s activity
on the various websites, and how each different website
implemented the software. (Id. at *4.)

54
user agent, and cookies containing identifiers,” which were
sufficient to enable Google to identify the individual patient.30
Plaintiffs assert that—“[a]t the merits stage”—their expert
will use Google Analytics logs—that were produced after class
certification briefing had completed—“to show that descriptive,
full-string URLs were disclosed to Google uniformly for all”
patient portal subclass members. (See footnote 17.)
The court found plaintiffs “did not submit evidence that
merely logging into the patient portal transmits information
in violation of CIPA or CMIA.” This was a premature
determination of the merits of plaintiffs’ theory of proof, at least
for the CIPA claim. (Sav-On, supra, 34 Cal.4th at p. 327; Linder,
supra, 23 Cal.4th at pp. 439–440.) Sharing a URL path along
with patient identifiers that indicated a patient had logged into
the Adventist patient portal arguably transmitted the “contents”
of the patient’s communication. Arguably, the “purport” of—or
the “intended message conveyed by”—entering login credentials
on the patient portal page and hitting the “login” button is to tell
Adventist the user is a verified patient who wants to log into his
or her personal patient portal. (See Meta Pixel, supra, 647
F.Supp.3d at p. 795 [construing “log-in buttons” to patient portal
as “ ‘contents’ ”].) Because plaintiffs presented evidence showing
the tracking technologies transmitted the same baseline
information discussed above for all subclass members, we
conclude they met their burden to show the contents element of
their CIPA claim was subject to common proof. (See Downey,

30 Again, the court did not find plaintiffs failed to show
common evidence was available to determine whether the
information transmitted could enable Google to identify
the individual. (See footnote 18.)

55
supra, 44 Cal.App.5th at p. 1113.) As this was the only element
the court discussed in its predominance analysis of the CIPA
cause of action for the patient portal subclass, the denial of class
certification on this ground is unsupported. (See Leeds, supra,
115 Cal.App.5th at pp. 545–546; Knapp, supra, 195 Cal.App.4th
at p. 939.)
ii. Substantial evidence supported the court’s
finding that plaintiffs failed to show their
CMIA claim was subject to common proof
for the patient portal subclass
We cannot say the same for plaintiffs’ CMIA claim. The
trial court found plaintiffs failed to show common proof could
establish whether the URLs transmitted from the patient portal
disclosed plaintiffs’ medical information under CMIA based on
essentially the same reasons as its analysis of plaintiffs’ evidence
of “contents” under CIPA. Plaintiffs argue that, because the
patient portal was “dedicated solely to communications regarding
patients’ medical treatment,” whether the URLs transmitted
from the patient portal disclosed patients’ medical information
is a common question. They contend the differences in the
specificity of the URLs’ descriptive terms thus would not require
examination of each individual URL because all the descriptive
terms—even the most generic ones—arguably would “regard,
concern, and relate to the medical treatments that the patients
have received or plan to receive from [Adventist].”
Although patients engaged only in health-related activities
within the patient portal, we cannot conclude the variation
in the descriptive URLs would not raise individual issues for
the “medical information” element of CMIA, as we did for the
“contents” element of CIPA. While more generic descriptive

56
terms still indicated the choice the patient made within
the portal—and thus, whether a patient’s choice of activity
constituted “contents” could be answered with common evidence
—we agree with the trial court that those same descriptive terms
did not uniformly convey “medical information.”
For purposes of showing Adventist transmitted “medical
information” under CMIA, the variations in the descriptive terms
used to describe patients’ activities within the portal thus raised
individual issues. As the trial court found, a URL revealing that
a patient downloaded a “radiology” report may have constituted
the disclosure of medical information—that a patient underwent
an imaging test or procedure arguably discloses information
“regarding” the patient’s medical history, condition, or treatment.
But a URL revealing that a patient “download[ed]” an
unspecified document, viewed something in the patient’s health
record, or generally made an appointment or sent a message—
without more—would not seem to convey information regarding
the patient’s medical history, mental or physical condition, or
treatment.31 (See Eisenhower, supra, 226 Cal.App.4th at p. 435

31 This is in contrast to Frasco v. Flo Health, Inc. (N.D.Cal.
2025) 349 F.R.D. 557, on which plaintiffs rely. There, a court
certified a class of users of a menstruation and ovulation tracker
app whose personal information about menstruation, ovulation,
pregnancy goals, and the like, allegedly was shared with Google
and Meta. (Id. at p. 569.) The descriptive terms of the custom
events transmitted there, however, all revealed a user’s personal
health information, such as “PREGNANCY_WEEK_CHOSEN”
or entries relating to a user’s goals—such as “ ‘Track my cycle,’ ”
“ ‘Get Pregnant,’ ” or “ ‘Track pregnancy’ ”—that all new users
were required to input. (Id. at pp. 572–573.) The naming
conventions of the events within the patient portal here

57
[rejecting plaintiffs’ interpretation of CMIA that would mean
“release by a health care provider of personal identification would
be sufficient whether or not there was a release of substantive
information regarding that person’s medical condition, history,
or treatment” (italics added)]; cf., e.g., Doe v. Regents of
University of California (N.D.Cal. 2023) 672 F.Supp.3d 813,
818–819 [denying motion to dismiss CMIA claim where plaintiff
alleged she entered “information relating to her heart issues
and high blood pressure” in her patient portal that defendant
disclosed to Meta and that she began receiving advertisements
on Facebook for high blood pressure medication].)
While we agree that whether or not the descriptive URLs
disclosed medical information is a merits determination,
plaintiffs did not demonstrate that merits determination
is subject to common proof. Moreover, that the baseline
information transmitted when patients logged into the patient
portal arguably revealed subclass members’ patient status
does not also translate into class-wide evidence to prove their
medical information was disclosed. Plaintiffs correctly note
patient status is PHI under HIPAA.32 (Meta Pixel, supra, 647
F.Supp.3d at p. 793; Nienaber, supra, 733 F.Supp.3d at p. 1081.)
Patient status is not “medical information” protected under

do not universally convey the same type of personal or
specific information.
32 The Health Insurance Portability and Accountability Act
(HIPAA) (42 U.S.C. § 1320 et seq.). See 45 C.F.R. § 160.103
(2026) (defining PHI under HIPAA as “individually identifiable
health information” that is “[t]ransmitted by electronic media”;
“[m]aintained in electronic media”; or “[t]ransmitted or
maintained in any other form or medium”).

58
CMIA, however. (Eisenhower, supra, 226 Cal.App.4th at pp. 435–
436 [fact individual “may have been a patient at a hospital at
some time” or was identified as “a patient is not in itself medical
information” under CMIA]; see also id. at pp. 436–437 [noting
“the definition of ‘individually identifiable health information’
under federal law differs markedly from that in the CMIA”].)
We also reject plaintiffs’ contention that the court did not
apply CMIA’s definition of medical information. In its discussion
of whether common issues predominated on the CMIA claim for
the general class, the court quoted the definition from the Civil
Code. The court noted Shafiq’s report’s references to “ ‘sensitive
information’ ” included more than “medical information” as
defined by CMIA. The court expressly found that, “[b]ecause
Shafiq’s analysis aggregate[d] different types of information—
such as URLs that may or may not convey medical information,
page titles that may or may not include descriptive or generic
search terms or no search terms, and page views and events
with generic names that may not convey medical information—
into the category of ‘sensitive information,’ his reports do not
support Plaintiffs’ conclusion of a common question concerning
whether the transmissions violate CMIA.” The court had no need
to repeat CMIA’s definitions or the above findings when it
analyzed the descriptive terms included in the URLs transmitted
from the patient portal and concluded those terms did not
universally constitute “ ‘medical information’ under CMIA.”
Accordingly, we conclude substantial evidence supported the
trial court’s reasoning that plaintiffs failed to demonstrate
common proof was available to determine whether Adventist
disclosed the subclass members’ “medical information.”

59
4. The superiority and manageability of the subclasses
The court also denied plaintiffs’ motion for class
certification on superiority and manageability grounds. Courts
generally consider four factors in determining if a class action
would be superior to individual suits: (1) the interest of each
purported class member in personally controlling his or her
own case; (2) any difficulties “ ‘likely to be encountered in
managing a class action’ ”; (3) the “ ‘nature and extent of any
litigation by individual class members already in progress
involving the same controversy’ ”; and (4) the “ ‘desirability of
consolidating all claims in a single action before a single court.’ ”
(Basurco v. 21st Century Ins. Co. (2003) 108 Cal.App.4th 110,
121.) “In certifying a class action, the court must also conclude
that litigation of individual issues, including those arising from
affirmative defenses, can be managed fairly and efficiently.”
(Duran, supra, 59 Cal.4th at pp. 28–29; id. at pp. 32–33 [trial
court failed to manage individual issues raised by defendant’s
affirmative defense properly].)
The court found plaintiffs did not show the superiority
of a class action because they (1) cited “no evidence” in support
of their assertion that “few class members have the time and
resources to pursue their claims on an individual basis” and
(2) did not “state the value of the individual claims.”
In their reply, plaintiffs asserted they were seeking
statutory damages under CIPA and CMIA. At the hearing,
plaintiffs’ counsel clarified that the CIPA and CMIA claims
were worth $2,500 and $5,000 in statutory damages, respectively,
for each plaintiff. For plaintiffs’ other claims, counsel stated
their damages expert—in other tracking pixel cases—had
estimated the value of the disclosed information to be about

60
“$200 a class member.” Plaintiffs’ post-hearing trial plan also
stated that plaintiffs sought $5,000 in statutory damages under
CIPA (Pen. Code, § 637.2), $2,500 in statutory damages under
CMIA (Civ. Code, § 56.36), and estimated damages under the
UCL “to be in the range of $200.”
We aren’t sure what other evidence plaintiffs could have
presented to demonstrate few Adventist patients would have
“the time and resources to pursue their claims on an individual
basis.” With at most $7,700 (plus attorney fees) at stake, it is
hard to imagine how the average person could afford to pursue
these claims individually. For example, the cost to hire expert
witnesses to develop the technical evidence necessary to prove
these claims alone would exceed any one individual’s expected
recovery.33 As a class action, however, the alleged damages
in the aggregate would consist of millions of dollars.
“Generally, a class suit is appropriate ‘when numerous
parties suffer injury of insufficient size to warrant individual
action and when denial of class relief would result in unjust
advantage to the wrongdoer.’ ” (Linder, supra, 23 Cal.4th
at p. 435.) That is the case here. Absent a class action, each
individual proposed class member—whether the HRA form or
patient portal subclass—effectively would be unable to seek
redress for Adventist’s alleged privacy violations. As plaintiffs
argued, a class action is “not only the best, but realistically the
only, way to compensate Class members and hold Adventist
accountable for” its alleged disclosures of its patients’ information
to Meta and Google. Moreover, given the cost of litigation would

33 Shafiq was paid $500 per hour, and Golbeck was paid
$550 per hour.

61
far exceed any one individual’s recovery, it is unlikely individual
class members would have an interest in controlling their own
cases. Nor does Adventist contend any of its patients has ongoing
litigation against it involving these same claims. Finally, given
the common issues we have discussed, we agree with plaintiffs
that “it would be grossly inefficient for the courts to hear
the same liability facts in a deluge of individual actions.”
Accordingly, we conclude plaintiffs sufficiently demonstrated
the superiority of class action treatment for the HRA form
and patient portal subclasses.
As for the manageability question, the court primarily
was looking at that issue through the lens of the general class.
As to the two relevant subclasses, the court found plaintiffs failed
to “address” the manageability of the individual questions that
we have concluded plaintiffs established can be determined
through common proof. For the HRA form subclass, the court
stated that plaintiffs did not discuss, for example, “whether there
is a way to identify the URLs containing links to HRAs that third
parties actually clicked on to view the HRAs.” As we discussed,
plaintiffs presented a common theory of proof that would not
require a showing of “ ‘actual clicks’ ” on individual URLs to
establish Google and/or Meta viewed or accessed the linked
HRA reports under the CMIA. The issue the court identified
thus would not create a manageability problem. (Leeds, supra,
115 Cal.App.5th at pp. 545–546 [appellate court considers only
stated reason].)
As for the patient portal subclass, the court stated
plaintiffs, for example, did not discuss “whether some kind of
statistical analysis could show the percentage of patients’ activity
in the patient portal that resulted in URLs containing medical

62
information being sent to third parties.” The court also noted—
again, as an example—plaintiffs’ trial plan stated common issues
which included “ ‘Whether the baseline information transmitted
by Google Analytics and the Facebook Meta Pixel constitutes
“contents” under CIPA,’ and ‘Whether the baseline data
constitutes “medical information” under [CMIA].’ ” The court
noted, however, that—as it had found—“some of that ‘baseline
data’ (such as page view information and URLs) may or may not
be ‘contents’ or ‘medical information’ depending on whether the
data reveals patient’s search terms, the descriptive quality of
the search terms, and other characteristics. The trial plan does
not explain how analyzing the different types of ‘baseline data’
. . . can be handled to determine which class members had their
‘contents’ or ‘medical information’ transmitted to a third party.”
As we have discussed, although this may have been
an issue for the general class, it is not one for the patient portal
subclass. Under plaintiffs’ theory of proof, the baseline data
transmitted when any patient logged into the patient portal
included the contents of the patient’s communication with
Adventist. As we explained, that some URLs conveyed more
specific terms to describe patients’ activities within the patient
portal would not affect plaintiffs’ contention that all patients
who logged into the patient portal had the contents of their
communications transmitted to a third party. Arguably, then,
no statistical analysis would be necessary to analyze the terms
in the URLs, as under plaintiffs’ theory, they did not raise an
issue requiring individual proof. And as plaintiffs failed to
demonstrate their CMIA claim was subject to common proof
for the patient portal subclass, we need not determine whether

63
plaintiffs could manage individualized issues relating to that
claim for that subclass.
In sum, we conclude the record does not support finding
the HRA form subclass, and the patient portal subclass for
plaintiffs’ CIPA claim, raised individual issues that cannot be
managed.
5. The trial court did not abuse its discretion in finding
plaintiffs forfeited certification of their CIPA –
recording claim
As the trial court noted, plaintiffs’ CIPA claim in their
TAC alleged Adventist violated section 632(a) when it “used a
recording device to record confidential communications . . . and
then transmitted such information to others, such as Facebook.”
The court however, found plaintiffs had “dropped any attempt to
certify a class for alleged violations of section 632.” In so finding,
the court noted “[n]either [p]laintiffs’ motion nor reply brief
mentions section 632.” The court acknowledged plaintiffs’ trial
plan—filed after the hearing by permission—“list[ed] section 632
issues to be decided in the trial,” but found “asserting those
issues after the hearing without briefing or citations to the
evidence is too late.” We agree.
Plaintiffs contend the court erred. They assert their
motion’s arguments about their CIPA claims “encompass[ed] both
[s]ections 631 and 632.” They note a key distinction between
sections 631 and 632 is that section 632 “requires a showing that
the communications were ‘confidential.’ ” They argue their list
of common issues for their CIPA claim included “[w]hether Class
members had a ‘reasonable expectation of privacy.’ ” They argue
that issue was relevant only to their section 632 claim and they
discussed it substantively, citing to discussion in Meta Pixel that

64
related to a section 632 CIPA claim. (Citing Meta Pixel, supra,
647 F.Supp.3d at p. 799.) Plaintiffs also contend Adventist
“understood” plaintiffs had addressed section 632 in their motion
because Adventist cited a case for the proposition that “ ‘[i]n
a case involving alleged violations of CIPA, “individualized
inquiries into the reasonableness of each class member’s
individual expectation of confidentiality . . . [we]re unavoidable”
and, therefore such claims were “not capable of being resolved
on a class-wide basis.” ’ ” (Citing Adventist’s citation of Mendell
v. Am. Med. Response, Inc. (S.D.Cal., Mar. 23, 2021, No. 19-cv-
01277-BAS-KSC) 2021 WL 1102423, plaintiffs added italics.)
Plaintiffs bore the burden on their motion for class
certification. That burden included providing citation to the law
on the claims for which they were seeking certification and
substantive discussion of each of the elements. Plaintiffs never
mentioned section 632(a) in their moving or reply papers, as
the court found. Although they briefly mentioned the issue of
a “reasonable expectation of privacy” in their discussion of their
CIPA claim—for which they cited only section 631—plaintiffs
never set forth all of the elements they would be required to
prove under section 632(a). Nor do we find plaintiffs’ brief
mention of a “reasonable expectation of privacy” constituted a
substantive discussion of the issue. Moreover, Adventist cited
Mendell in discussing the issue of whether class members had
a reasonable expectation of privacy “for purposes of an invasion
of privacy claim,” not a section 632 claim. After all, plaintiffs
originally had pursued an invasion of privacy claim against
Adventist, alleged as the fifth cause of action in their TAC.
Finally, we do not find plaintiffs’ belated citation to
section 632 in their trial plan’s list of common questions—

65
or Adventist’s response to the trial plan—cures their failure
to cite and properly discuss section 632 in their moving and
reply papers.34 Accordingly, the trial court did not clearly abuse
its discretion in not considering plaintiffs’ section 632(a) claim
for class certification.

34 Adventist’s response to plaintiffs’ trial plan noted plaintiffs’
plan’s proposed common question—“ ‘Whether Class members’
communications with Adventist were confidential’ ”—was
“a specific element of a Section 632 CIPA claim.” Adventist
again cited to Mendell. We do not read Adventist’s response
to plaintiffs’ trial plan’s mention of an element of a section 632
CIPA claim as somehow agreeing that plaintiffs’ motion raised
the claim.

66
DISPOSITION
We affirm the court’s order finding plaintiffs forfeited their
section 632(a) claim and denying class certification of their CMIA
claims for the patient portal subclass. We reverse the court’s
order denying class certification for the HRA form subclass
and the surviving claims for the patient portal subclass and
remand the matter for further proceedings.
The parties are to bear their own costs on appeal.

NOT TO BE PUBLISHED IN THE OFFICIAL REPORTS

EGERTON, Acting P. J.

We concur:

ADAMS, J.

HANASONO, J.

67