NY Health System Settles Web Tracker Privacy Claim for $5.3M

A New York City healthcare system has agreed to pay nearly $5.3 million to settle a proposed class action lawsuit alleging that the hospital’s use of online tracking tools in its patient portal and website sent patient information to Facebook without their knowledge or consent for years.

See Also: Top 10 Technical Predictions for 2025

The proposed class action lawsuit filed in a New York federal court alleged multiple claims against Mount Sinai Health System under federal and New York state law, including violations of the federal Electronic Communications Privacy Act for unauthorized interception; use and disclosure; violations of New York Deceptive Trade Practices; negligence; invasion of privacy; and breach of implied contract.

The settlement class in the litigation against Mount Sinai consists of more than 1.3 million MyChart patient portal account holders who logged into their accounts between Oct. 27, 2020, and Oct. 27, 2023, court documents said.

The plaintiffs claimed their personal health information was collected and shared with Meta and its Facebook social media platform through Mount Sinai’s implementation of the Facebook Pixel and Conversions Application Programming Interface on the healthcare provider’s website and patient portal.

According to the settlement, Mount Sinai denies the allegations, including sharing medical information from its patient portal or the website with Facebook.

Under the preliminary $5.3 million settlement, each eligible class member who submits a valid claim will receive a payment equal to the pro rata share of the money remaining in the settlement fund after the payment of settlement class counsels’ attorneys’ fees and expenses, named plaintiff service awards, and settlement and administration costs.

The court approved preliminary settlement said attorney fees are not to exceed 35% of the settlement fund, or about $1.8 million. Three lead plaintiffs are also each slated to receive $2,500 service awards, under the settlement.

A final hearing is slated by the court for Oct. 24.

Mount Sinai did not immediately respond to Information Security Media Group’s request for comment on the settlement.

The Web Tracking Hot Potato

The Mount Sinai settlement is the latest of a long list of other lawsuits that have been filed – and often settled – in the last few years involving the use of online tracking tools on the health-related websites and apps of HIPAA and non-HIPAA regulated entities.

The Mount Sinai settlement “is consistent with the strategy of settling health data breach class actions quickly and paying a relatively small amount of damages considering the number of patients affected,” said regulatory attorney Paul Hales of the Hales Law Group, who is not involved in the Mount Sinai case.

“Patient portals are a hazardous location for tracking technology. Information that identifies a patient, healthcare provider and dates of service is HIPAA-protected health information,” he said.

In a similar case, St. Louis-based BJC Health System in July agreed to pay up to $9.25 million to settle a proposed class action lawsuit also alleging that its use of online tracking tools in its patient portals transmitted sensitive patient information to third-party firms without the patients’ knowledge or consent (see: Health System Settles Web Tracker Lawsuit for Up to $9.25M).

Earlier this month, Flo Health, a consumer fertility-tracking mobile app maker, also agreed to settle a federal class action lawsuit that alleged the California-based company shared the sensitive data of millions of users without their consent with Google, Meta and other firms, who were named as co-defendants (see: Lawsuit: Fertility App Maker Sent Data to Google, Facebook).

“Website tracking technology is everywhere on the internet, even if you don’t see it,” said Maggie Hales, an attorney and CEO of ET&C Group LLC, a HIPAA compliance consulting firm. “Google and Meta – Facebook/Instagram – embed tracking technology in their services because the analytic information is a source of revenue,” she said.

“People often think that internet usage is free, but their user data is sold to third parties, such as advertisers and other sellers,” she said. “A person searches for shoes on the internet and suddenly receives shoe ads across every site. However, in healthcare, user information is considered protected health information under HIPAA and should not be disclosed without authorization.”

Besides civil lawsuits, the use of tracking tools on the websites of HIPAA-regulated entities and in non-HIPAA-regulated mobile apps and websites have respectively attracted the ire of the U.S. Department of Health and Human Services and the Federal Trade Commission, especially during the Biden administration (see: Feds Publicly Name 103 Healthcare Firms Using Web Trackers).

Flo Health was also the subject of a Federal Trade Commission enforcement action in 2021, also involving similar allegations (see: FTC Orders Health App Vendor to Revamp Privacy Practices).

Taking Action

Often, healthcare providers don’t even realize their websites and patient portals are potentially violating patients’ privacy, some experts said.

“Many healthcare organizations that we have worked with were unaware that tracking tools such as Google Analytics, Google Ads and Meta Pixels were active on their websites,” said Jan Carpenter, co-founder of marketing consulting firm CorkTree.

“The first step is to work with your web or marketing partner to scan and identify all tracking pixels in use. Until there is a clear understanding of what data is being collected and where it is transmitted, these pixels should be disabled or removed to protect patient privacy and avoid unauthorized disclosures,” she said.

“Healthcare organizations should recognize that web tracking is not just a marketing concern but an organization-wide responsibility. Marketing, IT, compliance and risk management teams should work together to inventory all tracking technologies, website forms, social media interactions and establish standard operating procedures for each,” she said.

Healthcare organizations should also confirm that all third-party vendors have signed business associate agreements, where required, she said. “When platforms like Google and Meta will not sign BAAs, adopt technologies that de-identify user data so advertising can continue without exposing protected health information,” she recommended.

Also to avoid these kinds of disputes, regulatory attorney Rachel Rose also suggested that healthcare sector organizations should consider taking several “fundamental and prudent steps” related to their potential use of online trackers.

That includes identifying all software and pixels during an annual risk analysis; having a policy and procedure in place to evaluate new technologies or applications and if a new one is added then add it to an inventory list; and if pixels or other tracking are indeed used, provide adequate disclosure and obtain consent, she said. “State laws should also be consulted regarding data tracking.”

Training, adequate policies and procedures also top the list. “If these are adequate and in place, then ongoing monitoring should be a part of that on top of what is discovered in a risk analysis. Unfortunately, some organizations turn a blind eye and others, especially smaller entities, are overwhelmed, so it is not a priority.”

Mount Sinai is “a large entity with resources,” said Rose, who is not involved in the case. “Perhaps it was a conscious decision to use [tracking tools] or perhaps a glaring oversight that it was used without obtaining patient consent,” she said. “It should serve as a cautionary tale.”