John Doe, Jane Doe, Jan Doe, Janet Doe, and Judy Doe, Individually and On Behalf of all Others Similarly Situated vs. Meritas Health Corporation and Board of Trustees of North Kansas City Hospital

JOHN DOE, JANE DOE, JAN DOE, ) JANET DOE, and JUDY DOE, ) INDIVIDUALLY AND ON ) BEHALF OF ALL OTHERS ) SIMILARLY SITUATED, ) ) Appellants, ) ) v. ) WD87830 ) MERITAS HEALTH ) Filed: March 3, 2026 CORPORATION and BOARD OF ) TRUSTEES OF NORTH KANSAS ) CITY HOSPITAL, ) ) Respondents. )

Appeal from the Circuit Court of Clay County The Honorable David P. Chamberlain, Judge

Before Division Four: Anthony Rex Gabbert, C.J., and Alok Ahuja and James M. Dowd, JJ. 1

The Plaintiffs in this case are five individuals who have been patients of North Kansas City Hospital. Plaintiffs sued the hospital's Board of Trustees in the Circuit Court of Clay County, on behalf of themselves and a class of similarly situated hospital patients. Plaintiffs allege that the Board has violated a variety of

1 Judge James M. Dowd of the Missouri Court of Appeals, Eastern District is sitting with this Court by special assignment.

2 common-law and statutory duties by surreptitiously collecting patients' personal data while they were using the hospital's website and online patient portal. Plaintiffs allege that, without its patients' knowledge or authorization, the Board then shared this personal information with third parties for commercial exploitation. Plaintiffs seek damages, disgorgement of profits, and equitable relief on behalf of themselves and the other members of the class. The circuit court granted the Board's motion to dismiss, finding that the Plaintiffs' claims were barred by sovereign immunity. Plaintiffs appeal. We reverse the circuit court's conclusion that Plaintiffs' claims are barred by sovereign immunity. We affirm the circuit court's judgment, however, to the extent that it dismissed Plaintiffs' statutory claims against the Board for tampering with computer data and identity theft (Counts I and VI). The case is remanded to the circuit court for further proceedings consistent with this opinion. Factual Background The facts recited below are drawn from the allegations of Plaintiffs' Third Amended Class Action Petition. In reviewing the circuit court's dismissal of Plaintiffs' Petition, we assume that all of the Petition's factual allegations are true. See, e.g., Jackson v. Barton, 548 S.W.3d 263, 267 (Mo. 2018); Barrett v. Cole Cnty., 687 S.W.3d 685, 692 (Mo. App. W.D. 2024). The Board operates North Kansas City Hospital. Pursuant to a management agreement, the Board and Meritas Health Corporation maintain a website for the hospital, and a "patient portal" accessible through the website. The website and patient portal enable patients to access information concerning

3 the health care they have received from the hospital, including the results of examinations, procedures, and tests; allow patients to search for general information relevant to their health-care concerns; permit patients to search for providers available to address the patient's particular concerns, and schedule appointments with those providers; and permit health-care providers and patients to communicate concerning the patient's medical care. The hospital's website contains a privacy policy which states that the hospital values patients' privacy and "[does] not collect personally identifying information when [patients] visit [the] site." The privacy policy assures patients that the hospital's "privacy policies and practices protect confidential health information that identifies you or could be used to identify you." The privacy policy proclaims that the hospital "never sell[s] or rent[s] [patients'] information to third parties." The privacy policy also promises patients that "uses and disclosures of [personal health information] for marketing purposes or sales of your [personal health information] require your written authorization." Besides the promises in the hospital's privacy policy, the Petition alleges that the Board and Meritas have common-law, statutory, and regulatory obligations to maintain the confidentiality of patients' personal health-care- related information, and to use that information solely for the purpose of providing health-care services to patients. Despite the privacy policy, and their legal obligations, Plaintiffs allege that the Board and Meritas embedded "tracking devices" on the hospital's website and patient portal. These tracking devices were developed by commercial technology companies, including Facebook, Google, YouTube, and Microsoft. Plaintiffs

4 allege that these tracking devices are unnecessary for the proper functioning of the hospital's website and patient portal, and were designed to be undetectable by the website's users. The Petition alleges that the tracking tools installed on the hospital's website and patient portal capture a variety of sensitive and personal health-care related information. Thus, the Petition alleges that the tracking devices collect the information submitted by patients in on-line forms, which may include specific information concerning the patient's medical history, insurance coverage, current health condition, health concerns, and personally identifiable information such as a patient's birthdate. The tracking devices also capture data concerning the searches a patient conducts on the hospital's website and patient portal, seeking information and providers to address particular health conditions. The Petition alleges that the data collected by the tracking devices is disclosed to third parties, sometimes in real time. The Petition alleges that the third parties receiving the data may be able to correlate the data with identifiable individuals. The Petition alleges that the third parties use the data shared by the Board and Meritas to build marketing databases and user profiles; the third parties then sell advertising targeted to patients with particular characteristics. The Petition alleges that, in exchange for sharing patients' data, the Board and Meritas generate revenue, and are also compensated with enhanced online advertising and data analytics services. Plaintiffs filed their initial petition in the circuit court in December 2022, naming only Meritas as a defendant. The circuit court granted Plaintiffs leave to file a Third Amended Class Action Petition on October 19, 2023. The Third

5 Amended Class Action Petition for the first time names the Board as an additional defendant. The Petition asserts claims against the Board for breach of fiduciary duty of confidentiality, invasion of privacy, identity theft, and tampering with computer data. The Petition asserts claims on behalf of the following class of individuals: During the fullest period allowed by law, all current Missouri citizens who are, or were, patients of Defendants, or any of their affiliates and who exchanged communications at Defendants' websites, including www.nkch.org and any other Defendant-affiliated website, including Defendants' patient portal. The Petition seeks monetary damages, disgorgement of profits, and injunctive relief. The Petition alleges that the Board has waived any sovereign immunity which might otherwise have applied, based on its purchase of insurance policies covering its unauthorized collection and disclosure of patients' personal information. The Board moved to dismiss the Petition based on sovereign immunity, the public duty doctrine, and Plaintiffs' failure to state a claim on which relief could be granted. On September 12, 2024, the circuit court granted the Board's motion to dismiss. The court's judgment concluded that the Board's challenged actions involved governmental rather than proprietary functions, and that the Board is accordingly protected by sovereign immunity: The operation of North Kansas City Hospital is a governmental function. The operation of the hospital website is incidental to the operation, maintenance and management of North Kansas City Hospital and the provision of health care services. Therefore, as a matter of law, the operation of the hospital website is

6 a governmental function. The Third Amended Class Action Petition does not contain any allegations which, when accepted as true, constitute a proprietary function. (Citation omitted.) The circuit court also rejected Plaintiffs' contention that the Board had waived its sovereign immunity by purchasing insurance covering Plaintiff's claims. The court concluded that the waiver of sovereign immunity based on purchase of insurance found in § 537.610.1 2 was inapplicable, "because the Board is not the State or the governing body of a political subdivision." The court also observed that, under § 71.185.1, the purchase of insurance waived a municipal entity's sovereign immunity only for claims for "property damage and personal injuries, including death"; thus, any waiver of sovereign immunity in § 71.185.1 was inapplicable to Plaintiffs' claims. The circuit court's judgment granting the Board's motion to dismiss left Plaintiffs' claims against Meritas pending. On February 6, 2025, however, the circuit court modified its September 12, 2024 judgment, to certify that judgment for immediate appeal as a partial final judgment under Supreme Court Rule 74.01(b). The Plaintiffs filed their notice of appeal on February 13, 2025. Standard of Review We review the circuit court's grant of a motion to dismiss de novo. Matthews v. Harley-Davidson, 685 S.W.3d 360, 365 (Mo. 2024). "In reviewing such a motion, the Court must accept all properly pleaded facts as true, give the pleadings their broadest intendment, and construe all allegations in the pleader's

2 Statutory citations refer to the 2016 edition of the Revised Statutes of Missouri, updated by the 2025 Cumulative Supplement.

7 favor." Graves v. Mo. Dep't of Corr., 630 S.W.3d 769, 772 (Mo. 2021) (cleaned up). [T]he appellate court reviews the petition in an almost academic manner, to determine if the facts alleged meet the elements of a recognized cause of action, or of a cause that might be adopted in that case. If the motion to dismiss can be sustained on any ground alleged in the motion, the [circuit] court's ruling will be affirmed. Foster v. State, 352 S.W.3d 357, 359 (Mo. 2011) (cleaned up). I. We first address the circuit court's conclusion that the Board is entitled to sovereign immunity because the claims asserted in Plaintiffs' Third Amended Petition arise out of the Board's performance of a governmental function. Sovereign immunity is not an affirmative defense; instead, when suing a public entity, the burden is on the plaintiff to plead facts with specificity that give rise to an exception to sovereign immunity. Accordingly, to state a cause of action sufficient to survive a motion to dismiss on the pleadings, the petition, when viewed in its most favorable light, must plead facts, which if taken as true, establish an exception to the rule of sovereign immunity. State ex rel. City of Kansas City v. Harrell, 575 S.W.3d 489, 492 (Mo. App. W.D. 2019) (cleaned up). Because a plaintiff's petition must affirmatively plead facts establishing that a governmental entity's sovereign immunity is inapplicable, the failure to plead such facts justifies dismissal. A. The Board is not a separate legal entity, but is considered to be "part of the City" of North Kansas City; accordingly, "for purposes of sovereign immunity, the Board enjoys such immunity as the City would enjoy." State ex rel. Bd. of

8 Trustees of City of N. Kansas City Mem'l. Hosp. v. Russell, 843 S.W.2d 353, 357 (Mo. 1992). "Municipality immunity is an oft-confused area of law." Kunzie v. City of Olivette, 184 S.W.3d 570, 573 (Mo. 2006). Unlike the State and its agencies, municipalities only enjoy sovereign immunity when they are performing "governmental" – as opposed to "proprietary" – functions. Under the common law, a municipality is not entitled to full sovereign immunity. Because municipalities operate as both political subdivisions of the state and independent corporations, they perform both governmental and non-governmental functions. And because sovereign immunity protects the state, as a sovereign, municipalities are cloaked with immunity only when acting as an arm of the state. Thus, unlike state entities which receive full sovereign immunity, municipalities are entitled to sovereign immunity only when engaged in "governmental" functions, but not "proprietary" functions. . . . . . . . The distinction between governmental and proprietary functions is a murky one. A maze of inconsistency has developed in suits against cities, producing uneven and unequal results which defy understanding. Though frequently criticized and described by our courts as "obscure," the dichotomy nevertheless remains the benchmark by which immunity is determined for tort claims against municipalities. Crouch v. City of Kansas City, 444 S.W.3d 517, 521-22 (Mo. App. W.D. 2014) (cleaned up). Although the distinction between "governmental" and "proprietary" functions may be "murky," caselaw provides general definitions which are helpful in distinguishing between governmental and proprietary activities. The determination of whether a particular function of a municipality is governmental or proprietary depends upon whether

9 the function is performed for the common good of all. Acts performed by the municipality as an agent of the state, including the establishment and operation of schools and hospitals, the creation of municipal fire departments, and the exercise of legislative or judicial powers, have been found to be governmental functions. Proprietary functions, on the other hand, are those performed by the municipality for profit or for the special benefit of the municipality. These functions often involve the provision of services or conveniences to a municipality's own citizens. The distinction between governmental functions and proprietary ones is often obscure, however, and many municipal actions have a dual function. Bennartz v. City of Columbia, 300 S.W.3d 251, 259 (Mo. App. W.D. 2009) (cleaned up); see also, Kunzie, 184 S.W.3d at 574 (distinguishing between "actions benefiting the general public" and "actions benefiting or profiting the municipality in its corporate capacity" (citations omitted)); Shade-Schaefer v. City of Eureka, 693 S.W.3d 67, 74 (Mo. App. E.D. 2023). The circuit court's judgment concluded that the Board was performing a governmental function in this case, because its alleged collection and sharing of patients' personal data was bound up with the operation of the North Kansas City Hospital: The operation of North Kansas City Hospital is a governmental function. The operation of the hospital website is incidental to the operation, maintenance and management of North Kansas City Hospital and the provision of health care services. Therefore, as a matter of law, the operation of the hospital website is a governmental function. (Citation omitted.) The circuit court erred by viewing the Board's actions at an overly high level of generality or abstraction. To determine whether a municipal entity is performing a governmental or proprietary function, it is inappropriate to focus

10 on the municipality's overall purpose or mission; instead, "the analysis focuses on the activity giving rise to the injury to determine whether the activity was an exercise of a governmental or a proprietary function." Russell, 843 S.W.2d at 358 (emphasis added). "Whether the ultimate service provided is governmental or proprietary is controlling for purposes of the application of sovereign immunity only if the service provided actually caused the alleged injury." Bennartz, 300 S.W.3d at 260. In this case, although the Board's "ultimate service" might be the operation of a hospital, that was not the activity out of which Plaintiffs' alleged injuries arose. Rather, according to Plaintiffs' Third Amended Class Action Petition, "the activity giving rise to the injury" was the Board's surreptitious collection of Plaintiffs' personal data during their use of the hospital's website and patient portal, and the Board's unauthorized distribution of that data to third parties for commercial exploitation. The Board's allegedly unauthorized collection and disclosure of Plaintiffs' personal data – not the Board's overarching "operation of North Kansas City Hospital" – is the relevant activity to which the governmental/proprietary distinction must be applied. A review of prior decisions applying the governmental/proprietary distinction illustrates that Missouri courts focus on the specific activity giving rise to the alleged injuries, not on the nature of the overall program or facility within which a specific activity occurs. For example, a series of cases have held that, where a plaintiff's claims arise out of their municipal employment, the municipality's management of its personnel is the relevant function; the nature of the work the employees are performing is irrelevant. Thus, Bennartz involved a

11 claim of wrongful discharge brought by an employee of a municipal water department. Although a municipality's operation of a water company is often treated as a proprietary function, the Court held that the relevant activity for sovereign immunity purposes was not the operation of the water department, but the management of municipal employees – a governmental function. The Court explained: Bennartz initially argued that his claims are not barred by sovereign immunity because City provides water for profit and thus was engaged in a proprietary activity. . . . However, in determining whether a claim is barred by sovereign immunity, the analysis focuses on the activity giving rise to the injury to determine whether the activity was an exercise of a governmental or a proprietary function. Whether the ultimate service provided is governmental or proprietary is controlling for purposes of the application of sovereign immunity only if the service provided actually caused the alleged injury. . . . . Bennartz does not claim any injury arising out of Columbia's provision of water. Rather he claims that City's failure to act to correct [his co-workers'] behavior caused his working conditions to be so intolerable that he was forced to leave the water department in favor of other employment with City. Missouri courts have consistently held that personnel decisions and the internal administration of operating a municipal department are governmental, not proprietary functions. Therefore, claims of wrongful discharge and constructive discharge have consistently been found to be barred by sovereign immunity. 300 S.W.3d at 260 (cleaned up). Similarly, in Nichols v. City of Kirksville, 68 F.3d 245 (8th Cir. 1995), an employee of the City of Kirksville alleged that he had been wrongfully discharged. In response to the City's sovereign immunity arguments, the employee alleged

12 that the work he performed for the City constituted a proprietary function, and that the City therefore did not have sovereign immunity from his wrongful- discharge claims. Id. at 247. The Eighth Circuit disagreed. It concluded that the plaintiff's job duties were irrelevant to the sovereign immunity analysis, "because the alleged wrongful act in this case is not something that Mr. Nichols did in his job but what the city did, i.e., firing him. Hiring and firing city employees are governmental, not proprietary, activities." Id. The focus on the specific activity alleged to have caused injury is also illustrated in cases involving damages caused by flooding from a municipally operated water system. Missouri caselaw generally holds that, "[w]here a city supplies water for use in putting out fires, it is performing a governmental function and is immune from liability. But, when a municipality is in the business of selling water to customers for profit or revenue, it is engaged in a proprietary function." Jr. College Dist. of St. Louis v. City of St. Louis, 149 S.W.3d 442, 448 (Mo. 2004) (citations omitted). Under this caselaw, the supply of water to different customers, for different purposes, is characterized differently for sovereign immunity purposes. For this reason, the Supreme Court has held that claims for flooding caused by a municipal water system may or may not be subject to sovereign immunity, depending on the purpose for which specific water was being provided. Thus, in the Junior College District case, the Court held that a claim against a municipality was not subject to a sovereign immunity bar. Id. at 448-49. The Court concluded that the water supply at issue was proprietary, because "[t]he water that flooded was not being used . . . to fight a fire or for another public purpose. The water was being purchased by the College

13 to run through lines solely owned by the College and intended for use solely on its property." Id. at 448. On the other hand, in Lober v. Kansas City, 74 S.W.2d 815 (Mo. 1934), the Supreme Court held that a municipality was entitled to sovereign immunity where private property was flooded by water flowing from a fire hydrant, which a city employee had opened in order to clean a public street. The Court noted that "the fire hydrant in question was used solely for two purposes, extinguishing fires . . . and the cleaning of the streets . . ., both of which . . . are governmental purposes." Id. at 823. A third group of cases holds that a municipality's performance of security services in a building or facility is a governmental function subject to sovereign immunity, even though the overall operation of the building or facility itself serves a proprietary function. See Wasserman v. Kansas City, 471 S.W.2d 199, 201-02 (Mo. 1971) (while maintaining the safe condition of public parks is a proprietary function, "failure to maintain good order in the park [is] a police function, a governmental function for which [a municipality] may not be held liable"); State ex rel. City of Kansas City v. Harrell, 575 S.W.3d 489, 494 (Mo. App. W.D. 2019) ("Whether or not the overall operation of City Hall is a governmental or proprietary function, the City's provision of security services at City Hall is plainly a governmental function, for which the City is entitled to sovereign immunity." (footnote omitted)); Gregg v. City of Kansas City, 272 S.W.3d 353, 361 (Mo. App. W.D. 2008) ("While owning and operating an airport may, at least in some instances, be a proprietary function, airport security seems . . . to be prototypically a governmental function.").

14 For present purposes, the most germane case may be KITC Homes, LLC v. City of Richmond Heights, 642 S.W.3d 318 (Mo. App. E.D. 2022). In KITC, the City of Richmond Heights demolished a building located on private property in the City in April 2017. Id. at 322. The City did not attempt to assess the property's owner for the demolition costs until September 2018, however; in the meantime, KITC purchased the property at a tax-foreclosure sale. Id. When the City demanded payment from KITC for the demolition work, KITC sued the City, alleging claims for negligence and tortious interference with contract. Id. KITC's claims separately challenged (1) the City's demolition of the building on the property KITC later purchased; and (2) the City's belated attempt to collect the demolition costs from KITC. The Eastern District found that circuit court had erroneously dismissed KITC's tort claims, because KITC had pleaded sufficient facts to show that both the building demolition, and the subsequent assessment for demolition costs, were proprietary functions. Significantly, the Court separately analyzed whether sovereign immunity applied to KITC's claims concerning the building demolition, and to its claims concerning the assessment for demolition costs. The Court explained: Because the City's two purported actions are distinct, we note for purposes of further proceedings that any finding as to whether there is sufficient proof of performance of a proprietary function relating to one of the alleged actions (for example, demolition) would not be dispositive as to whether there is sufficient proof of performance of a proprietary function relating to the other alleged action (for example, submission of the special assessment). Id. at 326 n.9.

15 Even if the underlying demolition constituted a governmental function, the Court held that KITC had adequately pleaded a claim that the assessment to recover the costs of that demolition was proprietary: KITC alleges the City submitted the special assessment for the cost of the demolition to "receiv[e] income." Taking this allegation as true and viewing all reasonable inferences in favor of KITC, we hold KITC sufficiently alleged the nature of the City's submission of the special assessment for the cost of demolition was done to benefit the City in its corporate capacity. In other words, KITC sufficiently, specifically alleged that when the City submitted the special assessment, the City was performing a proprietary function, and therefore, the City may have liability for any resulting damages. Id. at 326 (citation omitted). Under this caselaw, the relevant question here is not whether the Board's operation of the North Kansas City Hospital, generally, is a governmental or proprietary function. Instead, the relevant question is whether the Board's gathering of personal information on its patients, and disclosure of that information to third parties for commercial use, constituted a governmental or proprietary act. The Board emphasizes that, in Russell, the Supreme Court stated that, "[i]n examining the question of whether an activity is governmental or proprietary, the nature of the particular defendant's conduct is often less important than the generic nature of the activity." 843 S.W.2d at 359 (emphasis added); see also State ex rel. City of Lee's Summit v. Garrett, 568 S.W.3d 515, 521 (Mo. App. W.D. 2019). Russell made the quoted statement to reject the plaintiff's argument that the Board's operation of North Kansas City Hospital was proprietary because the Board allegedly ran the hospital for the purpose of generating revenue. 843 S.W.2d at 359. Rejecting this argument, the Court emphasized that the analysis

16 did not focus on "the motives of the city employees who were performing the function," but instead on the nature of the activity itself. Id. The Lee's Summit case is similar: it held that a municipality's enforcement of its building codes was a governmental function, even though the city allegedly operated its codes- enforcement program with profit-generation in mind. 568 S.W.3d at 521-22. Thus, under Russell and Lee's Summit, the characterization of an activity as governmental or proprietary depends on the nature of the activity, rather than the motivations for which a municipality is performing it. That principle does not alter the fact that the alleged injury-causing activity in this case was not the Board's "operation of North Kansas City Hospital," writ large, but instead its collection of patient data on the hospital's website, and subsequent sharing of that information with third parties. B. Plaintiffs' Third Amended Petition is 110 pages long, and contains detailed allegations concerning the Board's collection and disclosure of patients' personal information. Those allegations, if proven, would be sufficient to support the conclusion that the Board's data collection and data disclosure were not "performed for the common good of all," but were instead undertaken "for profit or for the special benefit of the municipality." Bennartz, 300 S.W.3d at 259. We offer only a thumbnail summary of the Petition's allegations here. The Petition details how the Board installed tracking devices on its website which had been developed by third parties, including Facebook, Google, and Microsoft. The Petition alleges that the website's users had not authorized the use of such tracking devices, and were unaware of the tracking devices' presence.

17 Indeed, the Petition alleges that the privacy policies posted on the hospital's website promised that such data collection and data sharing would not occur. The Petition also alleges that the collection and sharing of patients' personal information is inconsistent with the Hippocratic Oath; with health-care providers' fiduciary duties to their patients; with the Board's legal obligations under state and federal statutes and regulations; and with patients' reasonable expectations of privacy in the physician-patient relationship. The Petition alleges that the tracking devices act "like a physical wiretap on a phone." According to the Petition, the tracking devices capture a wide variety of personal data on patients visiting the hospital's website, including patients' identities; the specific webpages they visit; the personal information patients provide in forms on the website (such as to schedule appointments or to obtain online advice); and the searches patients conduct for information on specific medical conditions, or on specific health-care providers and services. The Petition alleges that the third parties to whom the Board discloses patients' private information use that information for commercial marketing purposes: "to sell targeted advertising that is customized to a user's personal communications and browsing history." The Petition alleges that the surreptitious installation of third-party tracking technology on consumer-focused websites, and the subsequent collection and sharing of users' personal data, is ubiquitous across the internet, and is designed to profit large technology companies like Facebook, Google, YouTube, and Microsoft, as well as the website's hosts.

18 According to Plaintiffs' Petition, the Board did not install the tracking devices on its website in order to provide health-care services, or to enable electronic communication between providers and patients. The Petition explicitly alleges that the third-party tracking devices which the Board has installed on the hospital's website are not required for the website or patient portal to function. The Petition alleges that such tracking devices "are not typically helpful to the [website] user," but are instead "typically used for data collection, behavioral profiling, and targeted advertising." Although it was possible to operate the website and patient portal without third-party tracking devices, the Petition alleges that "Defendants willfully chose to implement [third- party tracking devices] on their websites and to aid in the disclosure of personally identifiable information and sensitive medical information about their patients, as well as the contents of their communications with Defendants." According to the Petition, the data collection and data disclosure were not inadvertent, or unauthorized. Instead, the Petition alleges that the Board and Meritas "made the decision to barter their patients' personal health information to [third-party technology companies] because [they] wanted access to the" enhanced analytics and advertising opportunities those technology companies could provide. The Petition alleges that the Board and Meritas installed third- party tracking devices on their websites despite their knowledge that "they were [thereby] permitting [third parties] to collect, use, and share Plaintiffs' and the Class Members' personal health information, including sensitive medical information and personally identifiable data." The Petition alleges that Defendants' decision to hide their use of the [tracking devices] from their patients and their refusal to remove such technologies

19 from their websites even after learning that their patients' personal health information was being routinely collected, transmitted, and exploited by [third parties] is malicious, oppressive, and in reckless disregard of Plaintiffs' and Class Members' rights. The Petition also alleges that the Board has installed tracking devices on the hospital's website to enrich itself, at its patients' expense. Thus, the Petition alleges that, in exchange for installing its third-party tracking device, "Facebook provides website owners like Defendants with analytics about the ads they've placed on Facebook and Instagram and tools to target people who have visited their website." The Petition alleges that the Board "obtain[ed] additional revenue from their deployment of third-party tracking tools through which it discloses personally identifiable patient data and communications to third parties," and that this additional revenue rightfully belongs to the patients whose information is being improperly shared. The petition alleges that the Board's "sole purpose for installing tracking technologies on their Web Properties was marketing and profits," and that the Board was "compensated by Facebook with enhanced online advertising services, including (but not limited to) retargeting and enhanced analytics functions." The Petition alleged that, "[b]y utilizing tracking technologies . . ., Defendants' cost of advertising and retargeting was reduced, thereby benefitting Defendants." The copiously detailed allegations of Plaintiffs' Third-Amended Petition – if proven – would be sufficient to establish that the Board conducted its data- collection and data-sharing activities not to benefit the general public, or even to benefit the hospital's patients, but instead to enrich the Board itself. According to the Petition, the Board's activities were unrelated to the provision of health-care services to its patients, but were instead intended only to generate revenue and

20 reduce advertising costs for the Board. The data collected and shared is used for commercial purposes by commercial enterprises, and the Board's actions are indistinguishable from those engaged in by commercial enterprises throughout the economy. The Petition adequately alleged that the Board's challenged activities furthered proprietary, rather than governmental, purposes. We recognize that, in Russell, the Missouri Supreme Court held that the Board was entitled to sovereign immunity, because "[t]he operation of a hospital by a city has traditionally been held to be governmental." 843 S.W.2d at 359 (citations omitted). But Russell involved a medical malpractice claim, in which "[t]he alleged negligence . . . arose from the provision of medical services in a city hospital." Id. As we have explained in detail above, Plaintiffs' allegations in this case do not arise from "the provision of medical services in a city hospital," but instead from the collection and sale of consumer data to third parties for commercial purposes. The Petition alleges that the data disclosure does nothing to facilitate the hospital's provision of health-care services to its patients, but instead furthers the commercial objectives of the Board and of third parties, which may be wholly unrelated to the provision of medical services. The circuit court erred in dismissing the Petition on the basis that the Board was exercising a governmental function for which it was entitled to sovereign immunity. II. The Board argues that, even if the circuit court's judgment cannot be sustained on the basis of sovereign immunity, the dismissal of Plaintiffs' claims was nevertheless warranted under the "public duty" doctrine. The public duty

21 doctrine was raised by the Board in its motion to dismiss; because it may provide an alternate basis for affirmance of the judgment, we address it here. "The public duty doctrine states that a public employee is not civilly liable for the breach of a duty owed to the general public, rather than a particular individual." Southers v. City of Farmington, 263 S.W.3d 603, 611 (Mo. 2008) (citing Jungerman v. City of Raytown, 925 S.W.2d 202, 205 (Mo. 1996)); 3 see also, e.g., Roark v. KC Pet Project, 707 S.W.3d 699, 705, 709-10 (Mo. App. W.D. 2024). "[T]he public duty doctrine shields employees from liability, but it also shields public officers, and the governmental bodies that employ them, from liability." Southers, 263 S.W.3d at 612 (cleaned up). In this case, Plaintiffs' Third Amended Petition seeks to assert claims on behalf of persons who were hospital patients, "who exchanged communications at Defendants' websites." Plaintiffs contend that the Board and Meritas misappropriated and commercially exploited data belonging to hospital patients, in violation of the duties the Board and Meritas owed those patients. The public duty doctrine does not apply to Plaintiffs' claims against the Board. The Missouri Supreme Court has held that the public duty doctrine is inapplicable where a hospital is alleged to have violated duties owed to patients, because "once the hospital accepts a patient, it owes the patient a specific duty of reasonable care proportionate to the patient's needs as the patient's known condition requires." Stacy v. Truman Med. Ctr., 836 S.W.2d 911, 922 (Mo. 1992)

3 Southers abrogated Jungerman, as well as the Stacy and Howenstine cases discussed below, but only to the extent that those cases held that the public duty doctrine shielded governmental entities from liability even if a statute waived the entities' sovereign immunity. See Southers, 263 S.W.3d at 613-14 & n.13.

22 (citations omitted). A hospital's breach of duties owed to its patients does not involve duties owed indiscriminately to the general public. In addition, Plaintiffs' Petition alleges that they entrusted the Board with their personal information, which belonged to the Plaintiffs and had monetary value. Plaintiffs allege that the Board misappropriated their data, and unlawfully provided that data to third parties. Plaintiffs' allegations are analogous to the claims made in Jungerman, 925 S.W.2d 202. In Jungerman, an individual was arrested while wearing an expensive watch. Id. at 204. City of Raytown police officers removed the arrestee's watch when placing him in a holding area at the police station. Id. Police lost the arrestee's watch; he then sued and obtained a money judgment against the City. Id. On appeal, the City claimed that its treatment of the arrestee and his property were part and parcel of the City's duty to the general public to police the community. Id. at 206. The Supreme Court disagreed, focusing on the police department's specific actions of impounding arrestees' property, rather than its general performance of a policing function: Raytown cites cases declaring that the duties of police to enforce the laws and keep the peace are generally owed to the public at large and not to any one individual. However, the mere involvement of police in an activity does not automatically make the duty "public." Here, the specific duty at issue is to properly inventory, record, and secure Jungerman's property after its removal at the station. Although inventorying property may serve public purposes, such as the correct identification of arrestees, its primary purpose is to account for an arrestee's property in order that all lawful property not kept as evidence is returned upon release. . . . . . . .

23 Jungerman unquestionably had a special, direct, and distinct interest in the proper handling of his personal property by the Raytown police department. Clearly, injury to him as a distinct, identifiable individual was foreseeable from a breach of the duty to inventory and secure his watch. Id. at 206 (citations omitted). As in Jungerman, the Plaintiffs' claims in this case invoke the Board's duty to safeguard and protect personal information which Plaintiffs entrusted to the Board. Each Plaintiff, and every other hospital patient falling within the class definition, is "a distinct, identifiable individual" with "a special, direct, and distinct interest in the proper handling" of their highly sensitive medical information. Id. Because the Plaintiffs do not rely on a duty which the Board owed broadly to the general public, the public duty doctrine does not bar their claims. The Board cites State ex rel. Howenstine v. Roper, 155 S.W.3d 747 (Mo. 2005). In Howenstine, the Missouri Supreme Court held that the medical director of a public health clinic was protected by the public duty doctrine from liability to a patient who was allegedly injured by the negligence of clinic staff. The medical director "assisted in adopting protocols and participated in training, consulting and supervision at the clinic," but was "not being sued for any neglect on her part in personally providing treatment" to the patient. Id. at 749, 753. In these circumstances, the Supreme Court held that the medical director's "acts to improve the operations, treatment and training at the clinic were for the public at large and not specifically for" the plaintiff. Id. at 755; see also Rodgers v. City of North Kansas City, 340 S.W.3d 154, 160-61 (Mo. App. W.D. 2011) (following Stacy, and affirming summary judgment granted to managerial employees at

24 North Kansas City Hospital based on the public duty doctrine, for claims arising from a nurse's sexual assault of a patient). Unlike Stacy and Rodgers, this case does not involve attempts to impose liability on supervisory employees of a public entity, who had no direct personal role in the injury-causing conduct. Plaintiffs' claims are not based on the Board's failure to establish appropriate policies for subordinate employees, or supervise particular employees who engaged in misconduct. Instead, Plaintiffs claim that the Board is itself liable for the injury-causing conduct. Stacy and Rogers are inapplicable here. The public duty doctrine cannot sustain the circuit court's dismissal of Plaintiffs' claims. III. Plaintiffs also contend that the circuit court erred in finding that the Petition failed to adequately allege that the Board waived its sovereign immunity by purchasing applicable insurance. In §§ I and II above, we have held that Plaintiffs' Third Amended Class Action Petition adequately alleged facts which would make the Board's sovereign immunity, and the public duty doctrine, inapplicable here. Our discussion in §§ I and II holds only that the Plaintiffs' allegations are sufficient to make the Board's immunities inapplicable. On remand, it will be the Plaintiffs' burden to prove those allegations. Because we have not definitively held that sovereign immunity and the public duty doctrine are inapplicable in this case, we also address the circuit court's rejection of Plaintiffs' claim that the Board waived its immunities by purchasing relevant insurance.

25 A. In finding that Plaintiffs could not establish a waiver of the Board's sovereign immunity on the basis of the Board's purchase of insurance, the circuit court held that § 537.610.1 was inapplicable, "because the Board is not the State or the governing body of a political subdivision." The circuit court held that the only insurance-waiver statute applicable here was § 71.185.1, which applies only to claims for "property damage and personal injuries, including death." The circuit court erred when it concluded that § 537.610.1 is inapplicable here. Section 537.610.1 provides in relevant part: . . . [T]he governing body of each political subdivision of this state, notwithstanding any other provision of law, may purchase liability insurance for tort claims, made against the State or the political subdivision, but the maximum amount of such coverage shall not exceed two million dollars for all claims arising out of a single occurrence and shall not exceed three hundred thousand dollars for any one person in a single accident or occurrence, . . . and no amount in excess of the above limits shall be awarded or settled upon. Sovereign immunity for the state of Missouri and its political subdivisions is waived only to the maximum amount of and only for the purposes covered by such policy of insurance . . . . Section 71.185.1 specifically authorizes municipalities to purchase liability insurance. It provides: Any municipality engaged in the exercise of governmental functions may carry liability insurance and pay the premiums therefor to insure such municipality and their employees against claims or causes of action for property damage or personal injuries, including death, caused while in the exercise of the governmental functions, and shall be liable as in other cases of torts for property damage and personal injuries including death suffered by third persons while the municipality is engaged in the exercise of the governmental functions to the extent of the insurance so carried.

26 In State ex rel. Board of Trustees of City of North Kansas City Memorial Hospital v. Russell, 843 S.W.2d 353 (Mo. 1992), the Missouri Supreme Court held that the Board was subject to the insurance-waiver provisions found in both §§ 71.185.1 and 537.610.1. In Russell, the Board had purchased two liability insurance policies. Both policies were subject to an endorsement which stated (a) that the insurance did not apply to claims barred by sovereign immunity; and (b) that the insurance policies did not themselves waive the Board's sovereign immunity. The Supreme Court separately analyzed whether the policies waived sovereign immunity under either § 71.185.1 or § 537.610.1. The Court explained: Even when public entities have full sovereign immunity, they may waive that immunity through the purchase of insurance, as provided in section 537.610. Similarly, municipalities are specifically granted the power to purchase liability insurance by section 71.185, but, as in section 537.610, the purchase of such insurance may waive immunity. Thus, an analysis of a defendant's immunity requires inquiry into the questions of whether there is insurance and whether the insurance waives immunity under the appropriate statutes. . . . First, section 537.610 permits political subdivisions of the state to purchase insurance and thus waive sovereign immunity. In this case, the Board had purchased a pair of insurance policies with identical coverage[, each subject to a non-waiver endorsement.] . . . We recently decided that a similar policy, purchased by a county hospital, did not constitute a waiver of sovereign immunity under section 537.610. . . . Nothing in this case offers any reason to treat this policy any differently . . . . Second, municipalities may purchase insurance and, by doing so, waive the sovereign immunity that protected them in the exercise of governmental functions. § 71.185. This statute predates section 537.610 by several years, and, as under the new section, immunity is waived only "to the extent of the insurance" purchased. Id. The language of section 71.185 differs from that in section 537.610, but the differences are not material in this case. The endorsement disclaiming coverage of any claim barred by the doctrine of

27 sovereign immunity avoids any waiver of sovereign immunity in this suit. The Board did not waive its sovereign immunity. Id. at 360. The Board argues that "[i]n Russell, the court did not need to determine whether § 71.185 or § 537.610 applied to the Board because the Board's insurance disclaimed coverage of any claim barred by sovereign immunity." We do not read Russell so narrowly. Rather, we read Russell as holding that the Board, as a municipal agency, was subject to both §§ 71.185.1 and 537.610.1. In Russell the Court plainly presumed that, if the Board's sovereign immunity had been waived by operation of either statute, then the plaintiffs' claims could proceed. The Board's crabbed reading of Russell is conclusively refuted by the Supreme Court's later decision in Kunzie v. City of Olivette, 184 S.W.3d 570 (Mo. 2006). Kunzie involved wrongful-discharge claims filed against a municipality by a former employee. The Supreme Court held that the municipality may have waived its sovereign immunity, and the public duty doctrine, by operation of § 536.710.1. In doing so, the Court recognized that § 71.185.1 might lead to a different outcome: If the city maintains insurance that covers these types of claims, then it will have waived its immunity under section 537.610 for the specific purpose of and to the extent of its insurance coverage. A municipality's procurement of insurance constitutes an absolute and complete waiver of all immunities. This absolute waiver includes governmental function immunity, the discretionary immunity doctrine, and the public duty doctrine. Jungerman v. City of Raytown, 925 S.W.2d 202 (Mo. banc 1996), is inapplicable to cases under section 537.610 due to the difference between the waiver in section 537.610 and the imposition of liability under section 71.185. Section 71.185 applies to claims against municipalities for personal injury or property damage while

28 in the exercise of governmental functions and provides that municipalities "shall be liable as in other cases of torts." Section 71.185 does not explicitly waive any particular immunity, whereas section 537.610 provides that "[s]overeign immunity . . . is waived" to the extent of insurance coverage. Id. at 574 & n.4; see also State ex rel. City of Grandview v. Grate, 490 S.W.3d 368, 371-72 (Mo. 2016) (citing to both §§ 71.185.1 and 537.610.1 in determining whether a municipality had waived its sovereign immunity by the purchase of liability insurance). This Court has also held that municipal entities are subject to the insurance-waiver provision found in § 537.610.1. In Bennartz v. City of Columbia, 300 S.W.3d 251 (Mo. App. W.D. 2009), this Court stated that "[a] municipality has sovereign immunity from actions at common law tort in all but four cases . . . ." Id. at 259. The fourth circumstance Bennartz listed, in which a municipality could be held liable in tort, was "to the extent the municipality has procured insurance, thereby waiving sovereign immunity up to but not beyond the policy limit and only for acts covered by the policy (section 537.610)." Id. (emphasis added). This Court has cited to and applied § 537.610.1 when analyzing the sovereign immunity of municipal entities in multiple additional cases. See, e.g., Hendrix v. City of St. Louis, 636 S.W.3d 889, 900-01 (Mo. App. E.D. 2021); White v. City of Ladue, 422 S.W.3d 439, 449-51 (Mo. App. E.D. 2013); Topps v. City of Country Club Hills, 272 S.W.3d 409, 414-15 (Mo. App. E.D. 2008); Parish v. Novus Equities Co., 231 S.W.3d 236, (Mo. App. E.D. 2007) (negligence claim against municipality; although also citing § 71.185.1, recognizing that "[s]ection 537.610 provides an independent basis for waiving

29 sovereign immunity" (emphasis added)); see also Torres v. City of St. Louis, 39 F.4th 494, 509 (8th Cir. 2022). The circuit court erred by failing to apply § 537.610.1 to determine whether the Board waived its sovereign immunity by purchasing liability insurance. B. The Board separately contends that Plaintiffs failed to adequately plead facts supporting their claim that the Board had waived its sovereign immunity through the purchase of liability insurance. We disagree. A party pleading an exception to sovereign immunity must plead the facts giving rise to the exception. Phelps v. City of Kansas City, 371 S.W.3d 909, 916 (Mo. App. W.D. 2012). Rule 55.05 delineates what pleadings must include to set forth a claim for relief: (1) a short and plain statement of the facts showing that the pleader is entitled to relief and (2) a demand for judgment for the relief to which the pleader claims to be entitled. The party seeking relief need only plead ultimate facts, not evidentiary facts. Ultimate facts are those the jury must find to return a verdict for the plaintiff. Barrett v. Cole Cnty., 687 S.W.3d 685, 695 (Mo. App. W.D. 2024) (cleaned up). Plaintiffs' Third Amended Class Action Petition contains the following allegations concerning the Board's insurance coverage: Defendants have each purchased and maintained insurance policies which cover their unlawful interception and disclosure of their patients' sensitive medical information to Facebook, Google, and other third parties which contain no exclusions for sovereign immunity. Accordingly, each Defendant has waived any sovereign immunity that might otherwise have applied under Mo. Rev. Stat. § 537.600 to Plaintiffs' claims up to the full value of those insurance policies. See Mo. Rev. Stat. §§ 537.610, 71.185.

30 In Kunzie, 184 S.W.3d 570, the Missouri Supreme Court held that similar allegations concerning a municipality's insurance coverage were sufficient to invoke § 537.610.1's insurance-waiver provision. Kunzie alleges that the city maintains liability insurance "to handle the consequences of employment related actions brought against them." By doing so, Kunzie has sufficiently alleged facts that, if proved, would bring his tort claims within the purview of the statute. Because the trial court dismissed Kunzie's petition prior to the commencement of discovery, Kunzie was not able to prove the existence and content of the insurance policy. Id. at 574; see also Topps v. City of Country Club Hills, 236 S.W.3d 660, 663 (Mo. App. E.D. 2007) (under Kunzie, plaintiff adequately invoked § 537.610.1 where she "alleged that [the municipal defendant] maintained insurance which covered 'employment practices liability'"); Taylor v. St. Louis Cnty., No. 4:24- CV-00034-AGF, 2024 WL 3413263, at *8 (E.D. Mo. July 15, 2024) (insurance- waiver adequately pleaded where complaint alleges that county "has secured liability insurance coverage applicable to his wrongful death claim that did not preserve sovereign immunity, and has therefore waived sovereign immunity"; collecting other federal cases reaching similar result); Blakeney v. City of Pine Lawn, Mo., No. 4:19-CV-02017-SNLJ, 2020 WL 4569175, at *5 (E.D. Mo. Aug. 7, 2020) (Limbaugh, J.) (plaintiff pleaded that the defendant municipality "has a policy of insurance which provides coverage for the conduct Plaintiff has alleged," and that the city "has procured liability insurance [for] claims such as this"; concluding that, "on the basis of Kunzie, plaintiff's bare-bones allegations seem to suffice"). Kunzie appears to be the sole Missouri Supreme Court case addressing the sufficiency of a petition's allegations to invoke § 537.610.1. That decision is

31 controlling in this Court under Article V, § 2 of the Missouri Constitution. Without citing Kunzie, the Board argues that Plaintiffs' Petition is insufficient to invoke § 537.610.1, relying on two decisions of this Court and two federal district- court cases. Even if those cases supported the Board's arguments, we could not follow them in disregard of Kunzie. But those cases are distinguishable in any event: o Although plaintiffs' petition in Hendricks v. Curators of University of Missouri, 308 S.W.3d 740 (Mo. App. W.D. 2010), alleged that the defendants had waived sovereign immunity through adoption of a self-insurance plan, the plan itself was attached to the petition, and contained a non-waiver clause which preserved the defendants' sovereign immunity. Id. at 747. This Court held that the bare legal conclusion alleged in plaintiffs' petition – that the defendants' self- insurance plan waived their sovereign immunity – could not overcome the clear terms of the plan itself, which were themselves part of plaintiffs' petition. Id. o In A.F. v. Hazelwood School District, 491 S.W.3d 628 (Mo. App. E.D. 2016), the Court found the allegations of a plaintiff's petition to be inadequate where the petition alleged that a governmental defendant had insurance "which provides coverage for the incident in question," but it was "unclear to what 'incident in question'" the petition was referring, given that the petition claimed that the defendant's liability arose out of multiple independent actions. Id. at

o In Berry v. Missouri Department of Corrections, No. 2:24 CV 25 CDP, 2024 WL 3874485 (E.D. Mo. Aug. 20, 2024), a complaint alleged that the defendant agency participated in the Missouri Public Entity Risk Management Fund (or "MOPERM"), but did not specifically allege "that the terms of the policy cover the plaintiff's claims." Id. at *2. o Finally, Blankenship v. Williams, No. 4:24-CV-00306-DGK, 2024 WL 4593871 (W.D. Mo. Oct. 28, 2024), follows Berry, and holds that a complaint's "bare, conclusory assertion that [a governmental defendant] either has insurance or a self-insurance policy is

32 inadequate," without a further allegation that the insurance provides coverage applicable to the plaintiff's claims. Id. at *9. Under Kunzie, Plaintiffs' Third Amended Class Action Petition sufficiently alleged that the Board had waived sovereign immunity through the purchase of liability insurance which covered Plaintiffs' claims. C. In the briefing on its motion to dismiss, the Board submitted to the circuit court what it contended was the relevant insurance policy. The Board argued that the provisions of the policy (including various definitions, exclusions, and endorsements) established that the policy was inapplicable to Plaintiffs' claims, and did not waive the Board's sovereign immunity. Plaintiffs moved to strike the policy, arguing that it could not properly be considered on a motion to dismiss, because the motion to dismiss was solely a test of the allegations of Plaintiffs' Third Amended Class Action Petition. The circuit court's judgment expressly stated that "[t]he court did not consider the affidavit or exhibits attached to the Board's Suggestions in Support of its Motion to Dismiss when ruling on the motion." On appeal, the Board relies extensively on the provisions of the policy it submitted to the circuit court, to argue that the insurance it procured did not waive its sovereign immunity. The Board argues that this Court may properly consider the policy, because its motion to dismiss implicated a lack of subject matter jurisdiction. Because its motion to dismiss purportedly raised a jurisdictional issue, the Board contends that it was appropriate for the circuit court to consider matters beyond the allegations of Plaintiffs' Petition alone.

33 The circuit court properly refused to consider the exhibits the Board submitted in support of its motion to dismiss, including what the Board claimed was the relevant insurance policy. Rule 55.27(a) precludes the consideration of matters beyond the petition in deciding a motion to dismiss for failure to state a claim, unless the parties are notified that the motion is being converted into a summary judgment motion, and given the opportunity to engage in normal summary-judgment practice: If, on a motion asserting the defense numbered (6) to dismiss for failure of the pleading to state a claim upon which relief can be granted, matters outside the pleadings are presented to and not excluded by the court, the motion shall be treated as one for summary judgment and disposed of as provided in Rule 74.04. All parties shall be given reasonable opportunity to present all material made pertinent to such a motion by Rule 74.04. The circuit court did not treat the Board's motion to dismiss as a motion for summary judgment, and it therefore properly refused to consider evidence beyond the allegations of Plaintiffs' Third Amended Class Action Petition. The Board's contention that the motion to dismiss alleged a lack of subject- matter jurisdiction is meritless. In State ex rel. Clinton No. 1, Inc. v. Baker, 708 S.W.3d 474 (Mo. 2024), the Supreme Court recently held that the defendant's invocation of an immunity from suit did not implicate the circuit court's subject- matter jurisdiction, and therefore could not justify the consideration of matters beyond the pleadings on a motion to dismiss. In Baker, a defendant moved to dismiss a plaintiff's wrongful death claim, on the basis that the claim was barred by a federal statute granting health care providers immunity from liability for injuries resulting from COVID-19. Id. at 477. In order to establish that it was protected by the federal statute, the defendant submitted an affidavit detailing

34 the circumstances in which the plaintiff's decedent died, beyond the allegations of the plaintiff's petition itself. Id. The Supreme Court held that the affidavit could not properly be considered on a motion to dismiss on immunity grounds. According to [defendant], the question of subject matter jurisdiction may be presented by means of affidavit on a motion to dismiss without converting it to a motion for summary judgment. But subject matter jurisdiction refers to "the court's authority to render a judgment in a particular category of case." The subject matter jurisdiction of circuit courts is established in article V, section 14. Article V, section 14 provides that "circuit courts shall have original jurisdiction over all cases and matters, civil and criminal." Under this plenary grant of subject matter jurisdiction, the circuit court had subject matter jurisdiction over the wrongful death claim. A claim that a defendant is immune from suit is properly raised by a motion pursuant to Rule 55.27(a)(6). That rule provides the defense of failure to state a claim upon which relief can be granted can be asserted by motion. To argue immunity applies is to argue the plaintiff failed to state a claim upon which relief can be granted. If the circuit court considers matters outside the pleadings on a motion to dismiss for failure to state a claim upon which relief can be granted, the motion must be treated as one for summary judgment, and "[a]ll parties shall be given reasonable opportunity to present all material made pertinent to such a motion by Rule 74.04." The rule likewise contemplates the circuit court can exclude matters outside the pleadings in such a motion. Id. at 479 (emphasis added; citations omitted). In light of J.C.W. ex rel. Webb v. Wyciskalla, 275 S.W.3d 249, 253-55 (Mo. 2009), "Missouri courts have rejected the theory that sovereign immunity is jurisdictional." Hays v. Dep't of Corr., 690 S.W.3d 523, 528 (Mo. App. E.D. 2024) (citing St. John's Clinic, Inc. v. Pulaski Cnty. Ambulance Dist., 422 S.W.3d 469, 471 (Mo. App. S.D. 2014)). Therefore, the result in Baker is fully applicable here: without converting the motion to dismiss to a motion for summary

35 judgment, the circuit court could not have considered the insurance policy the Board submitted to it. Because the policy is not properly before this Court, we refuse to consider the Board's arguments based on the policy's purported terms and conditions. IV. Even if this Court does not affirm the dismissal of all of Plaintiffs' claims, the Board argues that it is nevertheless entitled to dismissal of Count I (alleging tampering with computer data) and Count VI (alleging identity theft). The Board makes several arguments to support its contention that Plaintiffs failed to state claims for data tampering and identity theft. We agree that Counts I and VI fail to state claims against the Board, because Counts I and VI are based on criminal statutes which do not apply to municipal entities like the Board. We accordingly do not address the remainder of the Board's arguments concerning Counts I and VI. Plaintiffs' claim for tampering with computer data is based on § 569.095, which defines a criminal offense. Section 569.095 provides:

1. A person commits the offense of tampering with computer

data if he or she knowingly and without authorization or without reasonable grounds to believe that he has such authorization: . . . . (3) Discloses or takes data, programs, or supporting documentation, residing or existing internal or external to a computer, computer system, or computer network . . . . . . . .

1. The offense of tampering with computer data is a class A

misdemeanor, unless the offense is committed for the purpose of devising or executing any scheme or artifice to defraud or to obtain

36 any property, the value of which is seven hundred fifty dollars or more, in which case it is a class E felony. Section 537.525.1 provides that, "[i]n addition to any other civil remedy available," injured parties "may bring a civil action against any person who violates section[ ] 569.095 . . . for compensatory damages." Section 537.525.2 authorizes an award of attorney's fees in any such civil action. Plaintiffs' identity-theft claim is likewise based on a criminal statute. Section 570.223 provides in relevant part:

1. A person commits the offense of identity theft if he or she

knowingly and with the intent to deceive or defraud obtains, possesses, transfers, uses, or attempts to obtain, transfer or use, one or more means of identification not lawfully issued for his or her use.

1. The offense of identity theft is a class B misdemeanor

unless the identity theft results in the theft or appropriation of credit, money, goods, services, or other property [having certain threshold values, in which case the offense may constitute a higher- level misdemeanor or felony]. . . . .

1. In addition to the criminal penalties in subsections 2 and 3

of this section, any person who commits an act made unlawful by subsection 1 of this section shall be liable to the person to whom the identifying information belonged for civil damages of up to five thousand dollars for each incident, or three times the amount of actual damages, whichever amount is greater. . . . The court, in an action brought under this subsection, may award reasonable attorneys' fees to the plaintiff. Plaintiffs' claims for tampering with computer data and identity theft are based on statutes which authorize civil actions "against any person who violates" a criminal statute, and against "any person who commits an act made unlawful by" a criminal statute. Thus, in order for Plaintiffs to have viable claims for data tampering and identity theft against the Board, Plaintiffs would need to establish

37 that the Board committed the criminal offenses defined in §§ 569.095.1 and 570.223. Both §§ 569.095.1 and 570.223 describe offenses committed by "person[s]." Section 1.020(12) provides that, [a]s used in the statutory laws of this state, unless otherwise specially provided or unless plainly repugnant to the intent of the legislature or to the context thereof[,] . . . [t]he word "person" may extend and be applied to bodies politic and corporate, and to partnerships and other unincorporated associations. The Board of Trustees of North Kansas City Hospital is not a separate legal entity, but is "a part of the City" of North Kansas City. State ex rel. Bd. of Trustees of City of N. Kansas City Mem'l. Hosp. v. Russell, 843 S.W.2d 353, 357 (Mo. 1992). Therefore, the Board is a "body politic" which could be comprehended within the word "person" appearing in §§ 569.095.1 and 570.223. Moreover, although the two statutes use the gendered terms "he" and "she", § 1.030.2 provides that, "[w]hen any . . . person is described or referred to by . . . the masculine gender, . . . bodies corporate as well as individuals, are included." Thus, the Board could be included within §§ 569.095.1 and 570.223, despite those statutes' references to male and female "persons." Even though the Board could fall within the words employed in §§ 569.095.1 and 570.223, we conclude that it is not subject to those criminal statutes. Municipal entities like the Board cannot commit criminal offenses like those defined in §§ 569.095.1 and 570.223. Almost 150 years ago, the Missouri Supreme Court held that municipal entities could not be subject to punitive or treble damages under a statute authorizing such damages against "any person," even though municipalities were generally considered to be "persons." In

38 reaching this result, the Court observed that "respectable authority" held that municipalities could not commit criminal offenses: Whether a municipal corporation can be held liable for treble damages is an open question in this State, and one which admits of much doubt. . . . It is a statutory rule of construction in this State that the words "any person" shall be held to include bodies corporate as well as individuals. . . . Private corporations are undoubtedly answerable in exemplary damages for the willful and malicious acts of their agents done in the course of their employment . . . . But we are inclined to think that a distinction should be drawn in this particular between private corporations, which are organized and conducted solely for the purpose of private and personal emolument, and public corporations, created by government for political purposes and exercising authority, delegated by the State, for the administration of the local and internal affairs of a city or town of a public character. There is respectable authority to the effect that a municipal corporation can not, as such, do a criminal act or a willful and malicious wrong and they cannot therefore be made liable for exemplary damages. . . . Nor could they, by a parity of reasoning, . . . become liable in double or treble damages under statutes providing for such damages for willful or malicious trespass. . . . [T]here is not the same reason for holding municipal corporations, engaged in the performance of acts for the public benefit, liable for the willful or malicious acts of its officers, as there is in the case of private corporations. Hunt v. City of Boonville, 65 Mo. 620, 624-25 (1877); see also, e.g., Angelo v. City of Hazelwood, 810 S.W.2d 706, 707 (Mo. App. E.D. 1991). Notably, the Supreme Court of the United States cited and quoted this passage from Hunt, as reflecting the law across the country at the time of Reconstruction. City of Newport v. Fact Concerts, Inc., 453 U.S. 247, 261 (1981). In Chappell v. City of Springfield, 423 S.W.2d 810 (Mo. 1968), the Missouri Supreme Court reaffirmed Hunt's core holding "that in the absence of a statute specifically authorizing such recovery, punitive or exemplary damages are

39 not recoverable against a municipal corporation." Id. at 813 (citations omitted). In doing so, Chappell explained that the primary rationales for the award of punitive damages – to punish wrongdoers, and to deter future wrongdoing – did not apply to municipal entities. One of the principal reasons advanced by the courts why punitive damages should not be recoverable against a municipality, in the absence of specific legislative authority, is that to permit such recovery would contravene public policy. The reasoning is that since punishment is the objective, the people who would bear the burden of the punishment – the tax paying citizens – are the same group who are supposed to benefit from the public example which the punishment makes of the wrongdoer. . . . We conclude that the underlying justification and purpose of punitive damages, that is, the punishment of a wrongdoer, is not applicable when applied to a municipal corporation. . . . . The theory that punitive damages serve as a deterrent to others adds little justification for the award against a municipality. It is assumed that public officials will do their duty, and if discipline of a wrongdoing municipal employee is indicated, appropriate measures are available through the electorate, or by superior officials responsible to the electorate, without recourse to punitive awards through the courts. Id. at 814. Like punitive damages, criminal laws are intended to punish wrongdoers and deter future wrongdoing. See generally State v. Wade, 421 S.W.3d 429, 436–38 (Mo. 2013); State v. Honeycutt, 421 S.W.3d 410, 424-26 (Mo. 2013), overruled on other grounds by State v. Harris, 675 S.W.3d 202, 206 n.6 (Mo. 2023). Yet Chappell holds that punitive and deterrence rationales – the objectives underlying criminal statutes – do not apply to municipal entities. This provides additional support for Hunt's observation "that a municipal corporation

40 can not, as such, do a criminal act." 65 Mo. at 624. Plaintiffs have not cited this Court to a single case, in Missouri or elsewhere, in which a court held that a municipality had committed a criminal offense. Besides the general principle that municipalities are not subject to penal measures like punitive damages or criminal liability, another consideration supports the conclusion that the Board is not a "person" subject to §§ 569.095.1 and 570.223. Section 1.020(12) provides that the word "person" "may extend" to bodies politic, "unless plainly repugnant to the intent of the legislature or to the [statutory] context." "Section 1.020(12), . . . does not provide that 'person' is always synonymous with 'corporation.' Rather, it provides that 'person' may include corporations, but not if the inclusion of 'corporation' is 'plainly repugnant to the intent of the legislature or to the context thereof[.]'" Sherrer v. Boston Scientific Corp., 609 S.W.3d 697, 705-06 (Mo. 2020). Courts have read the word "may" in § 1.020(12) "as permissive" rather than mandatory, and emphasized that "[c]onstruction of the word 'person' to include 'corporation' is not required." Mark Twain Cape Girardeau Bank v. State Banking Bd., 528 S.W.2d 443, 446 (Mo. App. 1975). To determine whether entities are included in the term "person" in particular statutes, courts have considered such factors as "'the problem that the statute was enacted to remedy'" 4 ; "the scheme and purpose of an enactment" 5 ; "variations in the language employed within . . . statutes"

4 Sherrer, 609 S.W.3d at 706 (citation omitted). 5 Structo Corp. v. Leverage Inv. Enterprises, Ltd., 613 S.W.2d 197, 202 (Mo. App. W.D. 1981) (citation omitted).

41 addressing related subject matter 6 ; and "[c]ommon sense." Mark Twain, 528 S.W.2d at 446. It is significant that the commonly understood, lay definition of the word "person" would exclude entities like the Board (or the City of North Kansas City). "[T]he word 'person' commonly means 'natural persons.'" State v. Fretwell, 224 S.W.3d 602, 603 (Mo. App. W.D. 2006). Although dictionaries recognize a broader legal definition of the term "person," the lay definition of a "person" is straightforward: it refers to a "human, individual." Person, https://www.merriam-webster.com/dictionary/person (last visited Feb. 25, 2026). Section 1.020(12) "extends the [commonly understood] definition to these other entities." Fretwell, 224 S.W.3d at 603 (citation omitted). Thus, the term "person" as used in §§ 569.095.1 and 570.223 is subject to differing constructions, and interpreting "person" to include the Board would be contrary to the word's common meaning. These circumstances may invoke the rule of lenity. "'Under the rule of lenity, an ambiguity in a penal statute will be construed against the government or party seeking to exact statutory penalties and in favor of persons on whom such penalties are sought to be imposed.'" State v. McCord, 621 S.W.3d 496, 498-99 (Mo. 2021) (quoting State v. Graham, 204 S.W.3d 655, 656 (Mo. 2006)). "Traditionally, this rule applies to statutes defining criminal behavior and providing for sentencing. The rule, however, is applicable where violation of a civil statute has penal consequences." United Pharmacal Co. v. Mo. Bd. of Pharmacy, 208 S.W.3d 907, 913 (Mo. 2006)

6 St. Joseph Light & Power Co. v. Nodaway Work Elec. Co-op., Inc., 822 S.W.2d 574, 577 (Mo. App. W.D. 1992).

42 (citations omitted); see also J.S. v. Beaird, 28 S.W.3d 875, 877 (Mo. 2000) (although noting that "the requirement of registration [as a sex offender] is not necessarily punitive," applying the rule of lenity to statutes imposing a duty to register, because other statutes "penalize a failure to register as a" crime); Kersting v. Replogle, 492 S.W.3d 600, 605-06 (Mo. App. W.D. 2016) (same). Although Plaintiffs in this case seek to impose only civil liability on the Board, their data tampering and identity theft claims invoke "statutes defining criminal behavior"; moreover, those statutes specify that violations of the standards of conduct on which Plaintiffs rely "ha[ve] penal consequences." United Pharmacal, 208 S.W.3d at 913. To the extent §§ 569.095.1 and 570.223 are determined to be ambiguous, the rule of lenity would apply. In Smith v. Curators of University of Missouri, No. 17-4016-CV-C-WJE, 2017 WL 11492763 (W.D. Mo. Dec. 20, 2017), the District Court applied the rule of lenity to § 570.223, and construed the statute not to apply to a body politic like the Board. Smith found the use of the term "person" in § 570.223 to be ambiguous, "given the lack of legislative guidance" in the statute, and given the fact that "Missouri courts have used varying applications of 'person' in accordance with Section 1.020." Id. at *7. The court held that the rule of lenity was applicable to the construction of § 570.223, because it "is primarily a criminal statute to punish identity fraud but has a civil component." Id. Application of the rule of lenity would produce the same outcome as the principle that municipal entities cannot commit criminal offenses: Plaintiffs cannot state claims for tampering with computer data and identity theft against the Board under §§ 537.525.1, 569.095.1, and 570.223.

43 We affirm the circuit court's judgment to the extent that it dismissed Counts I and VI. Conclusion We affirm the circuit court's dismissal of Counts I and VI of Plaintiffs' Third Amended Class Action Petition, which purport to state claims against the Board for tampering with computer data and identity theft. The judgment of the circuit court is otherwise reversed, and the case is remanded for further proceedings consistent with this opinion.

_______________________ Alok Ahuja, Judge All concur.