The use of online tracking technologies has led to multi-million dollar lawsuits alleging that health systems are revealing private information, including personal health information, to third parties such as Google and Meta. Just recently, Advocate Aurora Health, a system operating hospitals in Wisconsin and Illinois, settled claims (without admitting liability) for $12.25 million relating to the use of tracking technologies that were embedded on its website, mobile app, and patient portal.
Pixels are snippets of code placed on web pages that permit technology companies such as Google and Meta to track a visitor’s activity on their site. Tracking is useful for website analytics and targeted advertising, but can also lead to collection of sensitive patient data, like medical or billing information. Plaintiffs have likened pixels to wiretaps or listening devices that monitor activity without knowledge or authorization.
Although these suits allege improper disclosure of private health information, it is important to note that these private class action lawsuits against health systems are separate from any investigations or fines that may also be imposed by the Office for Civil Rights, which is the federal agency that enforces HIPAA. Please see our December alert on the HIPAA risks of using tracking technologies by health care providers.
Health care providers must use caution when implementing and configuring tracking technologies on their websites or mobile apps. A first step is to audit your website and mobile apps to determine whether and where tracking technologies are being used.
Should you have any questions regarding the above, please contact a member of our Technology and Cybersecurity team, the Garfunkel Wild attorney with whom you regularly work, or contact us at [email protected].