Palm Beach Health Network faces class action lawsuit over data privacy breach

Palm Beach Health Network Physicians Group and Palm Beach Gardens Community Hospital are entangled in a class action lawsuit concerning using Meta Pixel tracking code on their website. The tracking code allegedly harvested sensitive patient data and transmitted it to Meta, enabling advertisers to deliver targeted ads.

The lawsuit was filed in the Florida Southern District Court by Ron Prosky, a patient of Palm Beach Health. Prosky contends that the Meta Pixel code embedded in the patient portal collected detailed personal information, including appointment details, medical test results, diagnoses, and search queries, which could be linked to users through identifiable data like IP addresses. Prosky further claims that he received targeted advertisements relevant to his medical information after using the patient portal.

Guidance issued by the Health and Human Services’ Office for Civil Rights (OCR) on HIPAA compliance with website tracking technologies was updated this year. The guidance stipulates that such technologies can only be employed if patient authorization is secured, the disclosures comply with HIPAA regulations, and a business associate agreement exists with the technology provider. According to the lawsuit, these conditions were not met. Palm Beach Health did not inform users in its privacy policy about using Meta Pixel or the potential for data transmission to third parties.

The lawsuit asserts that Palm Beach Health violated HIPAA and knowingly breached patient privacy. It seeks damages and punitive fines against the health network.

In mid-2022, a study revealed extensive use of Meta Pixel and other tracking tools on hospital websites, prompting several HIPAA-covered entities to report related data breaches to the OCR. Notably, Kaiser Permanente reported a breach affecting 13.4 million individuals. While the OCR has not yet imposed financial penalties for these breaches, the New York Attorney General recently settled a case with New York Presbyterian Hospital for $300,000 for similar violations.