Children’s Healthcare of Atlanta Illegally Shared Patient Data with Facebook, Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Children’s Healthcare of Atlanta has illegally shared patients’ private information with third parties, including Facebook.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 56-page privacy lawsuit alleges that Children’s—the largest pediatric healthcare provider in Georgia—has installed tracking tools on its website, CHOA.org, and MyChart patient portal that expose “intimate details” about patients’ medical treatments without their knowledge or consent. According to the case, this data is used by Children’s to market its services and by the social media giant for targeted advertising purposes.

The complaint contends that Children’s carries out its alleged data-sharing practices using Facebook’s Meta pixel, a piece of back-end code that the defendant “knowingly” configured to track any interactions a user has with its website and online portal. The Meta pixel then sends this data to Facebook, revealing details about patients’ health concerns, medical appointments, treatments and doctors, the suit claims.

Per the case, the pixel also collects a visitor’s IP address, browser and device information and Facebook ID, which is a unique identifier that can be used to locate the individual’s Facebook profile. This means that the company can connect a patient’s activities on CHOA.org or MyChart with their identity, the lawsuit asserts.

“Facebook, in turn, sells [the plaintiff’s] and class members’ private information to third-party marketers, who then target [the plaintiff] and class members with online advertisements, based on the information they communicated to [the defendant] via the website,” the complaint says. “Facebook and any third-party purchasers of [the plaintiff’s] and class members’ private information also could reasonably infer from the data that a specific patient was being treated for a specific type of medical condition, such as cancer, pregnancy, dementia, or HIV.”

Children’s was required under HIPAA and its own privacy policy to keep patients’ health information confidential unless given written authorization, the case relays. The plaintiff, a Georgia resident, says she has been using CHOA.org for her children’s healthcare since 2020 but was never informed by the defendant that it was sharing their private information with third parties for profit.

“Healthcare patients simply do not anticipate that their trusted healthcare provider will send their private health information to a hidden third party—let alone Facebook, a company with a sordid history of violating consumer privacy in pursuit of ever-increasing advertising revenue—without their consent,” the filing shares.

The complaint also claims that Children’s uses tracking tools from AdRoll and Marketo to send patient data to the companies.

The lawsuit looks to represent any Georgia residents whose private information was disclosed by Children’s Healthcare of Atlanta to third parties through the Meta pixel and related technology without authorization. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.