Skip to content
Schedule a Call
Call Now

Facebook’s HIPPA Violation

Article by Tsaaro

7 min read

 Lawsuit Against Facebook  For Wrongly Collecting Patient Data 

Meta Platforms is facing a potential class-action lawsuit for allegedly using its Pixel tracking tool to get patient information from hospital portals for target marketing purposes. Allegedly, Facebook wrongly tracked patient information of at least 664 hospital systems or medical provider websites, according to a class-action lawsuit filed in federal court.

Kiesel Law LLP filed the case in the U.S. District Court for the Northern District of California. The plaintiff is identified as “John Doe,” described as a Maryland resident, Facebook user, and a patient of MedStar Health Inc. The lawsuit said that the patient used that company’s patient portal to view medical records and lab results “and otherwise communicate with his provider” during the time my MedStar portal had Facebook Pixel deployed on its login page. MedStar was not named as a party in the court case. 

He requests class-action status and a jury trial. The case was filed a day after The Markup found that 33 of the top 100 hospitals in the United States were using a Meta Pixel tracker on their websites. Installing the Meta Pixel gives groups access to analytics about Facebook and Instagram ads analytics. It also tracks how people use their websites: the buttons they click, the information they put in forms, and so on. The action has been assigned to Judge Nathanael M. Cousins and the Alternative Dispute Resolution Multi-Option Program. The initial case management conference is set for September 21 in San Jose, California.

 

WHAT THE LAWSUIT CLAIMS

Under HIPAA, hospitals cannot share identifiable health information with third parties without patients’ consent. They can use and share anonymized data (and often do). But information linked to an IP address can classify data as identifiable health information, which has additional protections. 

The court document said that patient data is protected by HIPAA and requires valid HIPAA-compliant authorisation before Facebook collects it. The lawsuit claims breach of contract, violations of good faith and fair dealing, invasion of privacy, federal and state privacy laws and state unfair competition law, and negligent misrepresentation by Facebook parent company Meta Platforms Inc. It seeks unspecified compensatory and punitive damages but noted the “amount in controversy” exceeds $5 million.

The Pixel tracking tool is being improperly used on hospital patient portals, resulting in a “wrongful redirection” to Facebook of patient communications to register, sign in or out, request or set appointments, or call the provider via their computer devices, the lawsuit said. “This unlawful collection of data is done without the knowledge or authorisation of the patient, like plaintiffs, in violation of federal and state laws as well as Facebook’s contract with its users,” the court document said. “When a patient communicates with a healthcare provider’s website where the Facebook Pixel is present on the patient portal login page, the Facebook Pixel source code causes the exact content of the patient’s communication with their healthcare provider to be redirected to Facebook in a fashion that identifies them as a patient.”

The legal complaint said: “When a patient communicates with a health care provider’s website where the Facebook Pixel is present on the patient portal login page, the Facebook Pixel source code causes the exact content of the patient’s communication with their health care provider to be redirected to Facebook in a fashion that identifies them as a patient.”

The lawsuit acknowledged Facebook requires businesses that use Pixel must have lawful rights to collect, use and share data. But in reality, Facebook does not need medical providers to have patient consent, and its contract for medical providers does not mention patient privacy rules of the federal Health Insurance Portability and Accountability Act of 1996 known as HIPAA. Facebook then used the patient information “to generate highly profitable targeted advertising on and off Facebook,” according to the lawsuit.

Facebook allegedly monetises the information by using it to generate profitable, targeted advertising on and off Facebook and to target patients based on their actions on the providers’ websites.  The social media network also offered “remarketing,” serving specific ad campaigns to patients based on patients’ online interactions with the health care websites. “For example, Facebook could target ads to a patient who had (1) used the patient portal and (2) viewed a page about a specific condition, such as cancer,” or could exclude patients from receiving certain ads, the lawsuit said.

 

IN THE NEWS

The lawsuit followed a June 16 report co-published by the non-profit The Mark-up, a technology watchdog media organization working with STAT medical news. The Mark-up tested websites of Newsweek’s top 100 hospitals in America and found 33 were using the Facebook Pixel online tracker, also called the Meta Pixel. The Mark-up investigated Facebook data from actual patients who volunteered for its Pixel Hunt project, a collaboration with Mozilla, the developer of the Firefox Browser for the Internet.

The Mark-up was unable to determine whether or how Facebook used the data. A Meta spokesperson told The Mark-up that Facebook has filters that detect and remove sensitive health data sent from businesses. It’s unclear if the data transmitted by hospital websites was or was not caught by those filters. But the filters don’t always work as described. Another investigation from The Mark-up found that details about people looking for information about abortion or emergency contraceptives (which are not supposed to be sent to Facebook) made their way through to the platform.

 

THE LARGER TREND

In September 2020, a federal judge dismissed a lawsuit against the University of Chicago Medical Center and Google over data sharing.

In 2017, The University of Chicago, the University of Chicago Medical Center and Google began a research partnership in which they used machine-learning techniques to create predictive health models to reduce hospital readmissions. As part of the research, the University de-identified electronic medical records of adult patients, the court document said. 

The judge said the plaintiff received a disclaimer from The University of Chicago Medical Center on sharing information for research purposes. The court dismissed the plaintiff’s claim of breach of contract and requested monetary damages.

545 thoughts on “Facebook’s HIPPA Violation”

  1. Candyt

    Fantastic perspective! The points you made are thought-provoking. For more information, I found this resource useful: FIND OUT MORE. What do others think about this?

Comments are closed.

Let’s Decode DeepSeek AI and Associated Privacy Concerns  
Tsaaro Consulting

Let’s Decode DeepSeek AI and Associated Privacy Concerns  

“It was invigorating to have a new competitor… DeepSeek’s model is impressive, particularly around what they’re able to deliver for …

•
January 31, 2025
certain legitimate uses
What are ‘Certain Legitimate Uses’ under the DPDP Act, 2023 and the Draft DPDP Rules, 2025? 
Tsaaro Consulting

What are ‘Certain Legitimate Uses’ under the DPDP Act, 2023 and the Draft DPDP Rules, 2025? 

Introduction The Digital Personal Data Protection Act 2023 (DPDP Act) provides that consent is a prerequisite to process the personal …

•
January 30, 2025
Data Fiduciaries Under the DPDP Act,
Understanding the Obligations of Significant Data Fiduciaries Under the DPDP Act, 2023 and the Draft DPDP Rules, 2025
Tsaaro Consulting

Understanding the Obligations of Significant Data Fiduciaries Under the DPDP Act, 2023 and the Draft DPDP Rules, 2025

The Digital Personal Data Protection (DPDP) Act, 2023, introduces an overall approach to the protection of the digital personal data …

•
January 23, 2025
Draft DPDP Rules
Fortifying Data: A Guide to Security Safeguards under the DPDPA and Draft DPDP Rules
Tsaaro Consulting

Fortifying Data: A Guide to Security Safeguards under the DPDPA and Draft DPDP Rules

Today, personal data has become one of the most valuable resources, powering industries and shaping digital economies. However, the misuse …

•
January 20, 2025
draft dpdp rules 2025
Understanding Data Principal Rights Under DPDPA, 2023 and Draft DPDP Rules, 2025
Tsaaro Consulting

Understanding Data Principal Rights Under DPDPA, 2023 and Draft DPDP Rules, 2025

Introduction: Data protection laws worldwide empower individuals, referred to as ‘Data Subjects’ under the GDPR or ‘Data Principals’ under India’s …

•
January 9, 2025
Recent Comments

SHARE THIS POST

Would you like to read regular updates from Tsaaro.
Subscribe to our newsletter

Our Latest Blogs

Read what the latest hapennings in the cyber world are and learn what the
experts have to say about them

© 2024 Tsaaro Consulting. All rights reserved.
Linkedin Instagram Youtube

About Tsaaro

Resources

Other Links

Tsaaro Netherlands Office

Regus Schiphol Rijk Beech Avenue 54-62, Het Poortgebouw, Amsterdam, 1119 PW, Netherlands

Tsaaro Pune Office

Tech Centre, Rajiv Gandhi Infotech Park, Hinjewadi, Pune, Maharashtra

Tsaaro Noida Office

302, Tower C, ATS Bouquet, Noida Sector – 132, Uttar Pradesh, India

Tsaaro Bengaluru Office I

Manyata, Embassy Business Park, Outer Ring Road, Bengaluru, Karnataka

Tsaaro Bengaluru Office II

Second State, CMH Road, Indiranagar, Bengaluru, Karnataka

Call Our Experts:

+91 95577 22103

small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png
small_c_popup.png

We’d love to help your organization achieve your Data Protection goals!

Schedule a complimentary consultation with our Team of Experts.