Healthcare organizations face mounting legal exposure from website and mobile-application tracking technologies that may disclose patient-related information to advertising, analytics, and other third-party vendors. According to estimates published by PrivadoAI, U.S. companies could pay approximately $1.4 billion in 2026 to settle claims arising from the alleged unauthorized disclosure of personal information through websites and mobile applications, representing a projected 36% increase over 2025.
Hospitals, health systems, pharmacies, telehealth companies, and other healthcare businesses must remain vigilant in ensuring compliance with applicable federal and state privacy laws. Tracking technologies deployed on patient-facing or consumer health-facing websites and portals have increasingly become the subject of class action litigation, while state legislatures continue to expand protections for sensitive health data.
Why Patient Data Tracking Matters for Healthcare Businesses
Tracking tools such as the Meta Pixel and Google Analytics are widely used to measure website performance and advertising results. When these technologies are deployed on appointment scheduling pages, “find a doctor” tools, online forms, and patient portals, they may transmit information about what a visitor searched for, clicked on, or scheduled to third-party technology companies. Healthcare businesses that disclose sensitive health information without the patient’s knowledge or appropriate authorization may face significant regulatory scrutiny, class action litigation, and potential liability under federal and state privacy laws.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) does not provide individuals with a private right of action. HIPAA is instead enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), and state attorneys general, who may pursue enforcement actions and seek applicable civil penalties and other remedies. Nevertheless, the absence of a private right of action under HIPAA does not insulate healthcare businesses from private litigation arising from the same underlying conduct.
Lawsuits may be brought under various other legal theories. Plaintiffs have pursued claims under a variety of federal and state laws, including the federal Wiretap Act, the California Invasion of Privacy Act, state medical privacy statutes such as California’s Confidentiality of Medical Information Act, and applicable consumer protection laws including The California Online Privacy Protection Act (CalOPPA), California’s Confidentiality of Medical Information Act (CMIA), California’s Customer Records Act (CRA), and Washington’s My Health My Data Act.
Plaintiffs have also asserted common-law claims, including negligence and invasion of privacy. Although HIPAA generally does not preempt state laws that afford greater privacy protections, many state privacy statutes contain exemptions for HIPAA-regulated entities or information subject to HIPAA. Accordingly, the applicability of these laws must be evaluated on a case-by-case basis, taking into account the nature of the information collected, the entities involved, and the scope of any applicable statutory exemptions. Additionally, while some courts have permitted plaintiffs to rely on HIPAA standards to establish the applicable standard of care in negligence actions, others have rejected this approach.
Recent Healthcare Tracking Technology Lawsuits Highlight Growing Privacy Risks
Recent class action lawsuits against hospitals and health systems underscore the growing legal and financial risks associated with third-party tracking technologies, including allegations of unauthorized patient data disclosures and multimillion-dollar settlements.
Holy Name Medical Center. In June 2026, two patients filed a proposed federal class action against Holy Name Medical Center, Inc. in the U.S. District Court for the District of New Jersey. The complaint alleges that the medical center used third-party tracking technologies to collect and disclose information concerning users’ searches for healthcare providers, medical conditions, and appointment scheduling activities without their knowledge or consent. Although these allegations have not been adjudicated, the complaint places more than $5 million in controversy.
Wellstar Health System. In July 2026, Wellstar agreed to pay $4.25 million to settle a federal class action lawsuit alleging that personally identifiable information (PII) and protected health information (PHI) were disclosed to third parties, including Meta and Google, through tracking technologies deployed on its website and patient portal.
University of Pennsylvania Health System dba Penn Medicine: In April 2026, Penn Medicine agreed to a $9.5 million settlement of a class action lawsuit alleging that tracking technologies disclosed PII to third parties in violation of Pennsylvania’s Wiretapping and Electronic Surveillance Control Act. In addition to monetary relief, the settlement required Penn Medicine to refrain from using certain analytics and advertising technologies on its website for at least two years.
These cases demonstrate that litigation exposure extends beyond monetary settlements, potentially requiring healthcare organizations to modify or discontinue digital marketing and analytics practices.
New Laws Are Raising the Stakes
In addition to increasing litigation exposure, healthcare businesses must navigate an evolving patchwork of state privacy laws imposing additional restrictions on the collection, use, and disclosure of sensitive health information.
New Jersey. On June 30, 2026, Governor Mikie Sherrill signed A5328, expanding restrictions on data brokers and data collectors, including prohibitions on the sale of sensitive personal data relating to an individual’s physical or mental health condition, treatment, or diagnosis. The law establishes significant penalties, potentially reaching $50,000 per record for certain violations, and imposes registration and other compliance obligations on covered entities. The law also creates a registry for data brokers and data collectors. Annual registration fees range from $5,000 to $1.5 million, depending on how many New Jersey consumers’ records a data collector collects and sells or licenses to a data broker. The statute defines a “sale” broadly to include sharing, disclosing, or transferring personal data for monetary or other valuable consideration. Accordingly, healthcare businesses should evaluate whether their relationships with advertising and analytics vendors could constitute regulated data-sharing arrangements. The law includes exemptions for certain HIPAA-regulated information; however, their applicability depends on the nature of the information and the entity’s activities.
Connecticut. On May 27, 2026, Connecticut enacted legislation expanding its consumer privacy framework, including requirements concerning consumer consent, sensitive data, and data broker registration. The law requires affirmative consent for certain data sales and prohibits reliance on broad terms of use or consent obtained through deceptive design practices, commonly referred to as “dark patterns.” Controllers must also provide mechanisms for withdrawing consent and cease applicable processing within 15 days of withdrawal. Beginning January 1, 2027, covered data brokers must register annually and pay a $2,500 registration fee. Although certain HIPAA-related exemptions apply, healthcare businesses should assess whether their collection and disclosure of consumer health information fall outside those exemptions.
Best Practices for Compliance
Healthcare businesses should consider the following steps to mitigate regulatory and litigation risks associated with tracking technologies:
Inventory every tracking technology.
Identify pixels, software development kits, tag managers, chat widgets, and session replay tools on public pages, patient portals, scheduling flows, and mobile apps. This inventory should include tools added by website vendors and plug-ins, not just tools the business installed directly. Businesses should periodically reassess their tracking technologies as vendors, website functionality, and data collection practices evolve.
Map what each tool receives.
Determine whether page URLs, search terms, form entries, appointment details, or persistent identifiers, such as IP addresses or device IDs, are being transmitted to third parties. Tracking on login-protected pages may capture medical record numbers, appointment dates, and treatment information. Evaluate whether the information transmitted constitutes PHI or other sensitive personal information subject to applicable federal or state privacy laws.
Review vendor relationships.
Determine whether technology vendors qualify as business associates under HIPAA and, where applicable, execute appropriate business associate agreements (BAAs). Importantly, a BAA alone does not authorize an otherwise impermissible disclosure of PHI. Healthcare businesses should also review vendor agreements to address permissible data uses, redisclosure restrictions, and applicable privacy and security obligations.
Test consent mechanisms in practice.
Verify that cookie banners and consent tools actually prevent tracking when a visitor opts out. A banner alone does not satisfy HIPAA. HHS stated that the inclusion of disclosures in a website’s privacy policy, terms of use, or cookie consent banner does not, by itself, satisfy HIPAA’s requirements or otherwise authorize the impermissible disclosure of PHI to third parties.
Align privacy policies with actual practices.
Healthcare businesses should ensure that their website privacy policies accurately describe their data collection, use, and disclosure practices, including the use of third-party tracking technologies. Inaccurate or misleading disclosures may create additional regulatory and litigation exposure under applicable state consumer protection and privacy laws.
Mitigating Healthcare Data Privacy and Tracking Technology Risks
Digital engagement tools remain valuable for healthcare businesses seeking to reach and serve patients. However, increasing class action litigation and expanding state privacy laws have heightened the legal and regulatory risks associated with these technologies. Healthcare businesses should evaluate their tracking technologies, understand how patient information is collected and shared, and ensure their vendor agreements, consent practices, and privacy policies comply with applicable laws. Proactive compliance measures can help mitigate regulatory and litigation exposure.
How Frier Levitt Can Help
Frier Levitt’s healthcare attorneys advise pharmacies, telehealth companies, management services organizations, and other healthcare stakeholders on federal and state privacy laws, data privacy compliance, and related regulatory obligations. Contact Frier Levitt to discuss your organization’s digital tracking practices and compliance obligations.
