Facebook Pixel Gathers Patient Info from Health Providers Class Action

Meta Platforms, Inc. owns the Facebook Pixel tracking tool, which gathers information on consumers and transmits it to Facebook for eventual use by advertisers. The complaint for this class action alleges that Pixel is being “improperly used” on hospital websites and that the resulting collection of patient data violates the patients’ medical privacy.

The class for this action is all Facebook users who are current or former patients of medical providers in the US with web properties through which Facebook acquired patient communications relating to medical provider patient portals, appointments, phone calls, and communications associated with patient portal users, for which neither the medical provider nor Facebook obtained a HIPAA consent or any other valid consent.

The Facebook Pixel is a bit of code that can be installed on websites to allow Facebook to track activity on the website. Facebook describes it this way: “When someone visits your website and takes an action (for example, buying something), the Facebook pixel is triggered and reports this action”—that is, it reports the action to Facebook, to later be used for advertising purposes. Facebook hangs on to this information, so that advertisers will “be able to reach this customer again by using a custom audience.”

However, the US has privacy laws concerning healthcare information, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Among other things, the complaint says, the HIPAA privacy rule “requires appropriate safeguards to protect the privacy of protected health information and sets limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization.”

The complaint alleges, “The Facebook Data Policy expressly provides that Facebook ‘requires’ businesses that use the Facebook Pixel ‘to have lawful rights to collect, use, and share your data before providing any data to [Facebook].’”

However, the complaint alleges that Facebook does not truly “require” that medical providers have lawful rights to share information from patient portals and appointment software before it is sent to Facebook. The complaint asserts, “In reality, Facebook does not actually verify publishers have obtained adequate consent per the contract.”

“By design,” the complaint alleges, “Facebook receives the content of a patient’s patient portal sign-in communication immediately after the patient clicks the log-in button and before the medical provider receives it. The complaint reviews the information Facebook obtains from this process, and its availability to others, including the identification of patients who have Facebook accounts.

The complaint claims that the information Facebook logs includes “[t]he specific communications a patient exchanges at the provider’s property, including those related to specific providers, conditions, and treatments…”

While Facebook announced in November 2021 that it was removing the ability to target people based on “sensitive” information relating to health, the complaint alleges the company “did not change the most insidious types of targeting based on health:[,]” that is, targeting “based on their communications with their medical providers.”

Article Type: Lawsuit
Topic: Privacy
Tags: Sharing Medical Information Without Consent, Sharing Personal Information with Third Parties, Your Privacy