Class Action Lawsuit Alleges Cone Health Secretly Shared Patient Data with Google, Facebook

New to ClassAction.org? Read our Newswire Disclaimer

The Moses H. Cone Memorial Hospital and parent company Cone Health face a proposed class action lawsuit that claims the entities have secretly disclosed patients’ medical information to Facebook and Google.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 131-page privacy lawsuit alleges the North Carolina-based health network’s web properties, ConeHealth.com and MyChart.ConeHealth.com, intentionally utilize invisible pieces of code that intercept and record every movement a patient makes on the sites.

The tracking technologies—which currently include several tools developed by Google—subsequently share the collected data with the third-party tech giant for advertising purposes, the complaint contends. Per the suit, Cone Health also used similar data collection tools from Facebook on its online platforms from around September 2016 to July 2022.

The case charges that Cone Health has violated HIPAA privacy rules and the federal Electronic Communications Privacy Act by failing to obtain consumers’ consent before tracking and exposing their private information to unrelated third parties.

“Cone Health did so because it knew that this sensitive information had tremendous value and that [the] plaintiff and class members would not consent to the collection, disclosure and use of their private information if they were provided a choice or would demand significant compensation,” the filing argues.

According to the complaint, these transmissions include data shared by consumers while using Cone Health’s website and patient portal for purposes such as communicating with healthcare providers, scheduling appointments, searching for doctors, accessing medical records and test results, or researching medical conditions and treatment options.

“Transmitting the private information allows a third party (e.g., Google and/or Meta/Facebook) to know that a specific patient was seeking confidential medical care,” the suit stresses. “This type of disclosure could also allow a third party to reasonably infer that a specific patient was being treated for a specific type of medical condition such as cancer, pregnancy or AIDS.”

In addition, the tracking tools allow third parties to link a patient’s online activity with their identity by capturing IP addresses, device identifiers, demographic details, email addresses, phone numbers and more, the suit contends. The case says that certain tools also collected consumers’ Facebook IDs, which are strings of numbers the social media platform uses to identify and connect to a user’s Facebook profile.

The filing notes that Cone Health’s alleged data-sharing practices run contrary to promises made in its privacy policy, which states that the health network will refrain from using patients’ identifiable health information for marketing purposes without written permission.

“Simply put, Cone Health broke those promises again and again,” the complaint says, claiming that “potentially millions” of individuals have had their privacy invaded by the defendants.

The Cone Health wiretapping lawsuit looks to represent anyone in the United States whose private information was disclosed to a third party without authorization or consent through the Google or Facebook tracking tools allegedly embedded into Cone Health’s website and patient portal.

Are you owed unclaimed settlement money? Check out our class action rebates page full of open class action settlements.