Class Action Claims Penn Medicine App, Websites Secretly Disclose Patients’ Health Info to Facebook

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges the University of Pennsylvania and its board of trustees have violated the medical privacy rights of Penn Medicine patients by disclosing their data to Facebook without consent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 23-page lawsuit claims the Ivy League institution’s board of trustees, which operates the Hospital of the University of Pennsylvania Health System (Penn Medicine), has secretly deployed a piece of code known as the Facebook tracking pixel on the myPennMedicine app, PennMedicine.org, PennBehavioralHealth.org and UPHS.UPenn.edu. The case contends that as unsuspecting consumers use the Penn Medicine app or websites to schedule an appointment, pay their bills or research medical conditions and treatments, Facebook surreptitiously gains access to the exact contents of these interactions.

A 2022 investigation by the Markup revealed that Penn Medicine is one of 33 top hospitals in the United States that utilize the Facebook tracking pixel on their websites, the suit relays. The Markup also found that the tracking tool is able to identify Penn Medicine app and website users by collecting their IP addresses and Facebook IDs (FID), unique identifiers that Facebook assigns to each user.

“Notably, while Facebook can easily identify any individual on its own Facebook platform with only their unique FID, so too can any ordinary person who comes into possession of an FID,” the filing reads.

According to the complaint, Facebook offers the tracking tool to third-party advertisers to learn more about its users’ offsite interests and behaviors. After intercepting and analyzing this information, Facebook then compiles it into datasets that advertisers can access for marketing purposes, the suit contends.

The case alleges that UPenn’s board of trustees has violated the Pennsylvania Wiretapping and Electronic Surveillance Control Act, which prohibits the interception and disclosure of the contents of electronic communications. Moreover, the healthcare system operator was required under the Health Insurance Portability and Accountability Act (HIPAA) to protect sensitive patient health information from being disclosed without the patient’s knowledge and consent, the lawsuit says.

A December 2022 bulletin issued by the Office of Civil Rights stated that such “impermissible disclosures” of patients’ health information could lead to “identity theft, financial loss, discrimination, stigma, mental anguish, or other serious negative consequences to the reputation, health, or physical safety of the individual or others identified in the individual’s [protected health information],” the case says.

The lawsuit looks to cover anyone in Pennsylvania whose personal information was collected through the Facebook tracking pixel via the myPennMedicine app, PennMedicine.org, PennBehavioralHealth.org or UPHS.UPenn.edu.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.