Class Action Alleges Steward Health Care System Discloses Website Visitors’ Health Info to Third Parties Without Consent

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges that Steward Health Care System discloses website visitors’ personal and health information to Meta and Google without consent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 31-page case out of Massachusetts says that Steward Health Care System, which sees more than 2.2 million patients per year at 39 hospitals throughout the country, operates websites for its various medical facilities where patients can schedule doctor appointments or obtain information about medical conditions, medical services, doctors and specialists. Unbeknownst to visitors, Steward has installed onto its websites invisible programming code that automatically shares the precise contents of consumers’ website interactions with Meta and Google, the lawsuit alleges.

According to the suit, Steward has violated federal and state privacy laws by disclosing patients’ highly sensitive, personal medical information without consent. The complaint contends that patients reasonably expected their communications to remain confidential, especially since Steward’s privacy policy fails to mention that it discloses patients’ data to third parties and explicitly states that it is “required by law to protect the privacy of any medical information that identifies you.”

Despite Steward’s acknowledgment that it is prohibited from selling patients’ medical information without their written authorization, the healthcare network receives compensation from Meta and Google in the form of enhanced marketing services in exchange for the data it shares, the filing alleges.

The lawsuit claims that Steward uses Google Analytics, a web analytics service, and a small snippet of code known as the Meta pixel to secretly track visitors’ actions as they navigate its websites and collect information that allows the third parties to link web activity to specific users.

For instance, Steward’s websites offer a “DoctorFinder” page wherein users can search for a provider based on specific criteria before selecting a doctor of their choice, the suit says.

“As the patient sends search requests and views the resulting webpages, this information is automatically sent directly to Google,” the complaint states, adding that the tracking tool also shares patients’ IP addresses, which can be used to track an individual’s internet communications.

Similarly, the Meta pixel reveals users’ IP addresses, names, emails, phone numbers, physician appointments, appointment requests, symptoms, diagnoses and medications, which the social media giant then stores on its own servers, the filing alleges. As the case tells it, the tracking tool also collects a unique identifier, known as a Facebook ID (FID), that Meta assigns to each Facebook user.

“Anyone who possesses an FID can use this identifier to easily view its corresponding Facebook profile,” the filing reads. “So, anyone who knows how to use Facebook can use the information that Steward is disclosing to identify a Facebook using patient.”

The plaintiff, a Massachusetts resident, claims to have received personalized advertisements for medical services on Facebook since she began using one of Steward’s websites in 2021.

The lawsuit seeks to cover anyone in Massachusetts who has been a Steward patient at any time since March 31, 2016 and used any of the healthcare network’s medical websites to search for or communicate information concerning the symptoms, diagnosis or treatment of a medical condition, to use the “DoctorFinder” feature or to schedule an appointment.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.