Excela Health Shared Web Visitors’ Info with Facebook Without Consent, Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

Excela Health faces a proposed class action over the health organization’s alleged disclosure of website visitors’ personal and health information to Facebook with consent.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 27-page lawsuit claims that ExcelaHealth.org utilized a tracking tool called the Meta pixel to secretly collect and send Facebook information about certain actions users took on the site, including what they clicked on, which pages they viewed and the information they entered into the search bar. As a result, the case says, patients who visited the website before the code was removed around March 22 of this year unknowingly provided Facebook access to highly confidential data regarding their medical conditions and treatments.

At no point did Excela Health disclose to patients that its site tracked their activities and transmitted their data to Facebook, which in return provided the health organization with advertising analytics and tools to better target visitors to ExcelaHealth.org, the filing alleges.

As the case tells it, the tracking tool also gathered data about the name, gender and specialty of the physician with whom a patient was pursuing treatment, the location where the patient was seeking medical care and when they made a telephone call to schedule an appointment with a particular doctor through the site.

The complaint goes on to say that the Meta pixel could expose a website visitor’s identity by collecting their Facebook ID (FID), a string of numbers that uniquely identifies their Facebook account.

“Anyone who possesses an FID can use it to quickly and easily locate, access, and view its corresponding Facebook profile,” the filing reads. “Simply put, anyone who knows how to use Facebook can access and use the information that Excela Health was improperly disclosing to identify a patient as a Facebook user and access his or her confidential medical information.”

According to the suit, Excela Health’s alleged data-sharing practice violates Pennsylvania wiretapping law, which prohibits the interception and disclosure of an individual’s electronic communications without their permission. Moreover, the use of tracking technologies on ExcelaHealth.org is considered an “impressible disclosure[] of protected health information” under the Health Information Portability and Accountability Act (HIPAA), the complaint contends.

The plaintiffs, two Excela Health patients from Pennsylvania, say they had “no idea” the health organization was sharing their information as they used ExcelaHealth.org to check appointments, view test results and exchange communications related to providers and medical conditions. Per the case, the plaintiffs’ personal data and website activity are private information that “no third party has a right to access” without permission.

The lawsuit seeks to cover all Pennsylvania residents who were Excela Health patients at any time within the period that the Meta pixel was active on its website and who used ExcelaHealth.org during that time to search for a physician; schedule an appointment; or search for or communicate information concerning the symptoms, diagnosis or treatment of a medical condition.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.