Patients pass private information to their healthcare providers and rely on them to keep all personal and medical information confidential. But this class action sues Rush System for Health, which does business as Rush University System for Health, for passing patient personally identifiable information (PII) and other information, including the contents of their communication with Rush, to others, “including Facebook, Google, and a digital advertising company called ‘Bidtellect.’”
Two classes have been defined for this action:
- The Patient Class is all persons who, during the fullest period allowed by law, are or were patients of Rush or its affiliates and who accessed Rush’s MyChart patient portal that causes transmission of PII and communications to be made to third parties.
- The Illinois Class is all residents of Illinois who, during the fullest period allowed by law, are or were patients of Rush or its affiliates and who accessed Rush’s MyChart patient portal that causes transmission of PII and communications to be made to third parties.
Rush, which includes Rush University Medical Center, Rush Copley Medical Center, and Rush Oak Park Hospital, encourages its patients to use its MyChart patient portal, the complaint says. The communications passed through it may be about bill payment, doctors, services provided, conditions, treatments, and other patient business.
Patients can do a number of things through it, including search for a condition, treatment, specialty, or doctor; schedule an appointment; communicate with their providers; get test results; ask for prescription renewals; and access health information resources.
The MyChart software allows licensees to insert analytical programs, such as Google Analytics. The complaint alleges, “Rush took advantage of MyChart’s analytics compatibility by knowingly and secretly deploying Google source code throughout its web properties … that causes the contemporaneous unauthorized transmission of personally identifiable patient data and re-direction of the precise content of patient communications with Rush to be sent to Google” as well as to Facebook and Bidtellect.
Patients may enter a Get request, for example, to get information on birth control, or a Post request, when the patient enters data into a form and enters or submits it. The complaint alleges that the information sent to the third parties includes both the specific website activity and the patient’s PII, so that the request for information or the communication is connected to a particular person.
This is done without the knowledge of consent of the patients involved.
The purpose of the third parties in gathering this information, the complaint alleges, is “to track users’ personally identifiable data and communications for marketing purposes, i.e., targeted advertising.”
Article Type: LawsuitTopic: Privacy
Most Recent Case Event
Rush University Sharing of Patient Health Communications Complaint
September 30, 2022
Patients pass private information to their healthcare providers and rely on them to keep all personal and medical information confidential. But this class action sues Rush System for Health, which does business as Rush University System for Health, for passing patient personally identifiable information (PII) and other information, including the contents of their communication with Rush, to others, “including Facebook, Google, and a digital advertising company called ‘Bidtellect.’”
Rush University Sharing of Patient Health Communications ComplaintCase Event History
Rush University Sharing of Patient Health Communications Complaint
September 30, 2022
Patients pass private information to their healthcare providers and rely on them to keep all personal and medical information confidential. But this class action sues Rush System for Health, which does business as Rush University System for Health, for passing patient personally identifiable information (PII) and other information, including the contents of their communication with Rush, to others, “including Facebook, Google, and a digital advertising company called ‘Bidtellect.’”
Rush University Sharing of Patient Health Communications Complaint