As healthcare increasingly relies on patient portals, telehealth, and digital tools to engage patients, the line between valuable analytics and intrusive tracking has blurred. Against this backdrop, the recent Adena Health settlement, totaling $17.8 million to resolve claims tied to pixel tracking on its MyChart portal, highlights just how high the stakes have become.
More than a single lawsuit, this case marks a pivotal moment for health systems. It raises urgent questions about privacy, healthcare compliance, and the responsibilities that come with digital care.
In this article, we explore the Adena case, review similar lawsuits, examine regulatory trends, and offer practical guidance for healthcare leaders navigating this complex terrain.
What Happened: Digging Deeper into the Adena Settlement
How the Pixel Tracking Worked
Plaintiffs allege that Adena Health embedded third-party tracking codes, including Meta (Facebook) Pixel, Google Analytics, and related tools, within its MyChart portal. Patients used this portal to view medical records, manage appointments, and communicate with providers.
Whenever users interacted with the portal, even while logged in, these codes reportedly captured and transmitted protected health information (PHI) or personally identifiable information (PII) to third-party platforms.
The data allegedly included:
- Health conditions or symptoms reviewed by patients
- Appointment and provider selections
- Search queries or treatment exploration
- Unique identifiers such as Facebook IDs or device data
- IP addresses, timestamps, and metadata
Because many interactions occurred while users were authenticated, plaintiffs argued that pixel tracking effectively tied personal medical activity to identifiable users and external advertisers.
Claims, Defenses, and Settlement Structure
The lawsuit alleged multiple causes of action, including negligence, breach of fiduciary duty, invasion of privacy, unjust enrichment, and violations of wiretapping laws. Although Adena Health denied wrongdoing, it chose to settle to avoid further litigation and reputational damage.
Under the settlement:
- The class includes patients who accessed MyChart between November 1, 2022, and June 3, 2024.
- Eligible participants may receive a fixed cash payment (about $21) plus credit monitoring and identity protection services.
- The total settlement fund covers claims, administrative costs, and attorneys’ fees.
- Final court approval remains pending before the settlement becomes effective.
Ultimately, this case underscores that healthcare systems can no longer treat analytics as harmless overhead. Every tracking tool now carries potential legal and reputational risk.
Why the Case Matters
The $17.8 million settlement sends a strong message across the healthcare industry. It demonstrates that regulators and courts increasingly view digital tracking as part of the compliance landscape.
Moreover, the case highlights a broader pattern: healthcare organizations that rely on marketing or analytics tools must ensure that these systems do not expose patient data, even unintentionally.
Broader Landscape: Other Cases, Wins, Losses, and Lessons
The Adena case is part of a growing wave of lawsuits targeting tracking pixels and related technologies in healthcare. Across the country, both regulators and plaintiffs’ attorneys are scrutinizing how hospitals use web analytics and marketing tools.
Notable Examples
| Health Entity | Allegation / Tool | Settlement / Outcome |
|---|---|---|
| Novant Health | Use of tracking pixels in MyChart disclosing PHI | $6.6 million settlement |
| Mount Sinai (NYC) | Use of Facebook Pixel / CAPI in patient portal | ~$5.3 million settlement |
| MarinHealth | Meta Pixel on public site | $3 million settlement |
| The Christ Hospital (Cincinnati) | Pixel tracking on MyChart portal | Up to $7 million settlement |
| DaVita | Analytics tools exposing PHI | $3.8 million settlement |
| Lee Memorial Hospital (Florida) | Use of Meta Pixel tools | Dismissed (sovereign immunity) |
| Palomar Health | Meta Pixel use claim | Motion to dismiss granted |
As seen above, some cases end in multi-million-dollar settlements, while others are dismissed based on jurisdictional or immunity defenses. Nevertheless, they all share a common theme: unauthorized data capture through web tracking.
Recent Judicial Developments
Courts have begun to refine their positions on these cases. For instance, the Lee Memorial case was dismissed under sovereign immunity, preventing the plaintiff from pursuing damages.
However, other courts are less forgiving. In New York, a judge recently allowed Teladoc Health litigation to proceed, rejecting the company’s attempt to dismiss claims related to web tracking.
Meanwhile, regulators such as the U.S. Department of Health and Human Services (HHS) have reiterated that pixel tools can violate the HIPAA Privacy Rule when they expose PHI.
Emerging Analogues Beyond Hospitals
Similar privacy concerns have surfaced beyond traditional health systems.
- Flo Health: A California jury found that Meta illegally collected users’ menstrual health data from the Flo app, violating privacy laws.
- Google Analytics Exposure: A misconfiguration reportedly exposed private health data of 4.7 million members to Google Ads.
- Other digital health apps: Research has revealed widespread use of third-party tracking libraries in mental health and symptom-checking apps, often without informed consent.
In short, the pixel problem extends across the digital health ecosystem.
Compliance, Risk, and Regulatory Context
HIPAA, HHS OCR Guidance, and Legal Contours
In December 2022, the HHS Office for Civil Rights (OCR) issued guidance warning that tracking tools might violate HIPAA if they allow third parties to access PHI.
However, HIPAA itself does not grant individuals the right to sue directly. Consequently, plaintiffs often pursue class actions or state-law claims such as wiretapping, invasion of privacy, or unfair trade practices.
OCR enforces compliance through investigations and settlements but cannot impose blanket bans on analytics. Therefore, healthcare providers must rely on layered compliance, documentation, and vendor accountability.
Data Protection in Other Jurisdictions
Outside the U.S., different legal frameworks also shape privacy obligations.
- GDPR (EU): Requires a lawful basis, typically explicit consent, for processing sensitive health data.
- CCPA and Virginia CDPA: Extend protections to health-adjacent data even when it is de-identified.
- Telehealth Regulations: Cross-border services often fall under multiple privacy regimes, increasing compliance complexity.
Risk Assessment and Mitigation Framework
To manage compliance and operational risk, health systems should adopt a structured approach.
- Inventory all tracking and analytics code to identify every pixel, SDK, or tag in use.
- Perform data flow and impact analysis to determine what data is transmitted and whether it includes PHI or PII.
- Evaluate necessity and purpose to confirm whether each tool is essential to patient experience or business function.
- Implement isolation and segmentation to keep analytics separate from authenticated environments.
- Obtain express consent and transparency to explain tracking clearly and use opt-in mechanisms.
- Strengthen vendor contracts to include Business Associate Agreements and audit rights.
- Monitor continuously through regular audits and alerting for unusual data flows.
- Prepare for incidents by maintaining an incident response plan and communication strategy.
By following this roadmap, organizations can align analytics with compliance obligations and patient trust.
Best Practices Checklist for Health Systems
| Best Practice | Why It Matters | Key Action Items |
|---|---|---|
| Limit tracking in authenticated portals | Reduces PHI exposure | Restrict analytics to public pages |
| Use anonymization and aggregation | Mitigates identifiability | Remove user-level identifiers |
| Apply strict consent architecture | Honors patient autonomy | Obtain explicit opt-in for health data |
| Enforce tag governance | Prevents unauthorized scripts | Maintain version control in tag managers |
| Strengthen vendor oversight | Controls downstream risk | Enforce BAAs and audit clauses |
| Adopt privacy-by-design principles | Embeds protection from the start | Involve compliance early in development |
| Conduct training and awareness | Reduces human error | Educate marketing and web teams |
| Enable rapid audit and rollback | Ensures swift fixes | Maintain change logs and kill switches |
Frequently Asked Questions (FAQ)
Q: Are tracking pixels always prohibited in healthcare settings?
Not necessarily. Pixels can be used safely if data is anonymized, consented, and secured through vendor agreements. The key is to ensure that no identifiable PHI is ever transmitted.
Q: Can patients sue under HIPAA?
No. HIPAA does not grant individuals a private right of action. However, patients can still sue under state privacy or wiretapping laws.
Q: What is the difference between a pixel, cookie, and tag manager?
A pixel is a tiny image or code that transmits data. A cookie stores data in the browser. A tag manager organizes multiple tracking tools. Each can carry risk if misused.
Q: Should we remove all analytics tools?
Not entirely. Instead, segment public and authenticated environments, anonymize data, and maintain vendor compliance.
Q: What if a pixel was misconfigured and exposed PHI?
Act quickly. Identify the source, disable tracking, notify affected parties if necessary, and document remediation efforts.
Q: Do these cases only affect U.S. healthcare systems?
No. Similar data protection laws apply globally, including under GDPR, PIPEDA, and other national frameworks.
Conclusion: The Road Ahead
The Adena Health settlement represents more than a single lawsuit; it is a wake-up call for the entire healthcare industry. As digital engagement becomes central to care delivery, analytics and marketing tools must be treated as compliance-sensitive technologies, not harmless add-ons.
Going forward, healthcare leaders should assess every tracking tool for tracking technology risk, embed privacy-by-design principles into systems, and promote a culture of ongoing vigilance. The Adena case is unlikely to be the last, as similar lawsuits are already emerging across the sector.
By acting now, organizations can protect their patients, preserve trust, and reduce exposure in a rapidly evolving digital landscape.
