Atrium Health Settles Class Action Lawsuit for $1.8 Million Over Web Tracking Practices
In a recent development within the healthcare sector, Atrium Health, based in North Carolina, has agreed to pay $1.8 million to settle a class-action lawsuit regarding privacy invasion linked to its use of web tracking technologies on its patient portal. Allegations have surfaced claiming that the nonprofit health system misappropriately shared sensitive patient information with third-party companies, including tech giants Meta and Google, for marketing purposes.
The lawsuit emphasizes the confidentiality breach that occurred during the deployment of pixel tracking codes between January 2015 and July 2019. These codes reportedly led to the unauthorized transmission of data pertaining to nearly 586,000 individuals. The case highlights a growing concern among patients who argue that their private health information was disseminated without their explicit consent.
Atrium Health operates an extensive network of healthcare services, including an academic medical center situated in Charlotte, as well as 11 additional hospitals and more than 900 care locations across North and South Carolina. The organization disclosed the use of third-party tracking technology to federal regulators in 2024, categorizing the incident as a violation of the Health Insurance Portability and Accountability Act (HIPAA), which mandates strict guidelines for safeguarding medical data.
Under the terms of the proposed settlement, which is now pending approval, Atrium Health is set to allocate $1.5 million from the total $1.8 million to cover service awards for several individuals serving as class representatives, as well as the legal fees and expenses incurred by class counsel, which are yet to be quantified. The remaining funds will be distributed among class members categorized into two groups.
"Group 1" includes individuals who actively utilized their patient portal accounts during the specified timeframe when the tracking technology was in operation. In total, these individuals are entitled to receive payments; however, the precise amount each member will receive will hinge on the total number of claims submitted. Meanwhile, "Group 2" pertains to patients who held accounts after the installation of web trackers but did not engage with their accounts during the time the tracking codes were implemented. This group may receive a payment of up to $10, contingent on the volume of claims received.
Atrium Health did not respond immediately to requests for commentary regarding the settlement. However, the breach has become part of a broader narrative, illustrating that other healthcare organizations have faced similar lawsuits linked to privacy violations concerning their online tracking practices.
Reports submitted to the U.S. Department of Health and Human Services (HHS) reveal that, in 2023 and 2024, a significant number of HIPAA breaches were documented, many of which were associated with the use of web trackers. The prevalence of these breaches has prompted sharp scrutiny from federal regulators, specifically during the Biden administration.
The HHS’s Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) have both placed heightened emphasis on the employment of web tracking tools within health-related digital platforms, such as patient portals, websites, and mobile applications. As a response to the growing concerns, federal regulators issued guidance materials in 2022 and 2024, articulating the potential HIPAA violations stemming from the employment of online trackers.
Moreover, the FTC has undertaken enforcement actions against various telehealth companies for similar infractions related to their use of web trackers, including notable cases involving firms like GoodRx and BetterHelp. These developments underscore the increasing regulatory environment surrounding data privacy and security within the healthcare sector.
Atrium Health is not alone in facing legal ramifications as evidenced by recent actions against other healthcare organizations, highlighting that the proposed settlement joins a series of class action lawsuits filed over the use of pixel tracking technology. A federal court in California, for instance, recently signaled that it would grant final approval for a settlement worth up to $47.5 million related to similar data privacy allegations against Kaiser Permanente, further illustrating the trend within the healthcare industry.
Since the issuance of warnings by the HHS OCR, many healthcare organizations have re-evaluated their usage of tracking technologies. Some have eliminated these tools entirely, while others have updated their patient consent procedures to align with regulatory standards, recognizing the need for explicit consent before utilizing such technologies.
Legal experts, like regulatory attorney Adam Greene, have observed a shift in the landscape, noting that while healthcare organizations were initially unaware of litigations pertaining to website trackers, the awareness generated by OCR’s guidelines compelled many to take immediate action, either by ceasing the use of trackers or significantly reducing their deployment.
In conclusion, the settlement agreement reached by Atrium Health serves as a poignant reminder of the ongoing scrutiny regarding data privacy within the healthcare sector. As patients become more aware of how their information is handled, the emphasis on ethical data sharing practices will undoubtedly continue to shape the dynamic between healthcare organizations and regulatory bodies in the coming years. The ramifications of technological practices not only impact patient trust but also expose organizations to substantial legal risks that they must diligently navigate.