Health System Settles Web Tracker Lawsuit for Up to $9.25M

A Missouri healthcare system has agreed to pay up to $9.25 million to settle a proposed class action lawsuit alleging that its use of online tracking tools in its patient portals transmitted sensitive patient information to third-party firms without the patients’ knowledge or consent.

See Also: Top 10 Technical Predictions for 2025

The settlement class in the lawsuit covers all patients who used the MyChart patient portal of BJC Health System between June 2017 and August 2022. BJC Health System operates 14 hospital and dozens of other medical facilities in Missouri.

The lawsuit, initially filed in Missouri state court in 2022, moved to federal court and then eventually moved back to state court with an amended petition by plaintiffs in 2023.

Plaintiffs alleged St. Louis-based BJC Health operated websites at www.bjc.org and www.barnesjewish.org for its patients to communicate with BJC. Communications included range of topics including bill payment, doctor services, treatments, medical conditions, appointments and access to the healthcare provider’s MyChart patient portal.

The lawsuit alleged that through the use of online tracking codes on those websites, BJC Health “caused the unauthorized transmission of personally identifiable patient data and redirection of the communications to be sent to Facebook, Google, SiteScout, Invoca and the Trade Desk without patient knowledge, consent, authorization or affirmative action.”

As part of the settlement, BJC Health denies the allegations and any wrongdoing or liability.

BJC Health has agreed to establish a $5.5 million settlement fund to pay costs of notice and administration for the settlement, service awards to lead plaintiffs, payment of class counsel’s attorneys’ fees and expenses, and the payment of claims.

BJC Health also agreed to pay up to $3.75 million on a claims-made basis if the initial settlement fund of $5.5 million is not sufficient to cover the claims submitted.

Under the proposed agreement, which was approved by a Missouri judge in mid-May, settlement class members can submit a claim form to receive a $35.00 cash payment by Oct. 8. A final court hearing to approve the settlement is slated for Oct. 16.

Two lead plaintiffs, identified as plaintiffs John Doe One and John Doe Two in the litigation, will each receive $15,000 service awards. Lawyers representing class members will receive no more than $3 million for attorney fees, expenses and costs.

BJC Health did not immediately respond to Information Security Media Group’s request for comments on the proposed settlement and additional details, including the number of patients potentially affected by the organization’s alleged use of web trackers in its websites and patients portal.

Court documents in the settlement do not specify a number of potential class members eligible to file claims.

Other Disputes

The BJC Health litigation is among many similar class action lawsuits that have been filed in recent years against HIPAA-regulated organizations as well as consumer health companies.

These lawsuits have alleged that the use of online tracking tools in these organizations’ websites and mobile apps are collecting and disclosing individuals’ sensitive personal and health information to third-party firms such as Meta and Google for advertising, marketing and other purposes without the patients’ or consumers’ knowledge or consent.

One such case playing out in a California federal court trial alleges that fertility-tracking mobile app maker Flo Health unlawfully shared sensitive data of millions of users without their consent with Google, Meta and other firms, who are named as co-defendants (see: Lawsuit: Fertility App Maker Sent Data to Google, Facebook).

Flo Health was also the subject of a Federal Trade Commission enforcement action in 2021, also involving similar allegations. Under a settlement with the FTC, Wilmington, Delaware-based Flo Health agreed to a major revamp of its privacy policies, including agreeing to get app users’ consent before sharing their health information (see: FTC Orders Health App Vendor to Revamp Privacy Practices).

Some privacy experts say cases like the ones involving BJC Health, Flo Health and others underscore the importance of healthcare organizations carefully implementing and managing the use of online trackers in their websites and apps that handle personally identifiable health information of patients or consumers.

“Highlight that language to put users on notice, so they can make an informed decision about whether to continue using the site,” said regulatory attorney Elizabeth Hodge of the law firm Akerman LLP.

“You also want to continue to monitor and audit your compliance measures to make sure that you are complying with your policies,” she said.