Healthcare pixel lawsuits in 2026: Who paid, who won and what's next
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/healthcare-pixel-lawsuits
Last updated: November 7, 2026
Hospitals and clinics are still settling class actions over the Meta Pixel, Google Analytics and similar code. Courts are split on the main legal theory, and the Seventh Circuit has scheduled argument on it for December 9, 2026. This guide tracks healthcare pixel lawsuits mainly through court records: who paid, which rulings went each way, and what is scheduled next. It is news because a federal judge certified four classes of Facebook users against Meta on October 30, 2026. Patients bring pixel lawsuits as private class actions, separate from any penalty by the HHS Office for Civil Rights (OCR).
For what tracking is still allowed, see our guide to HIPAA tracking technologies. For what happens to individual employees, see our separate guide. We are a hosting company, not a law firm, and this is not legal advice. Every case below is listed in Sources. Where we could not read a court or agency record ourselves, we say the fact was reported.
TL;DR: Quick answer
On October 30, 2026, a federal judge in California certified four classes of Facebook users suing Meta. The claims involve data from healthcare providers' websites and apps and from prescription drug websites. The order is not a finding of liability.
Kaiser's $47.5 million, approved July 14, 2026, is the largest healthcare pixel settlement in our table. Allina's $12.5 million followed on September 24, 2026.
Patients cannot sue under HIPAA itself. Healthcare pixel lawsuits rely on the federal Wiretap Act, state wiretap and privacy laws, and contract claims.
Courts disagree on the legal theory behind pixel lawsuits. Top courts in Massachusetts (October 24, 2024) and Washington (October 8, 2026) rejected state wiretap claims over public website browsing. Federal judges in Oregon and Washington let Wiretap Act claims proceed in October 2026.
We found no OCR settlement or penalty over tracking technologies as of November 7, 2026. HHS's tracking bulletin is still posted; a court vacated one part of it in 2024.
California's SB 690, signed September 30, 2026, will leave one type of website tracking claim to the Attorney General. It takes effect January 1, 2027 under the state constitution's default rule, and private suits under CIPA Sections 631 and 632 remain.
New pixel lawsuits filed in October 2026 against Phoenix Children's Hospital and St. Charles Health System name Google Analytics. St. Charles also names DoubleClick, and neither complaint names the Meta Pixel.
What happened in the Meta Pixel healthcare case on October 30, 2026?
A federal judge in California certified four classes of Facebook users against Meta on October 30, 2026, so their claims can proceed as class actions. Judge William H. Orrick granted the motion "except for the limited Section 631 and redefined CDAFA class" (In re Meta Pixel Healthcare Litigation, No. 3:22-cv-03580).
The four classes are the Patient Status Button-Click, Patient Health Information, Prescription Drug Information and Patient Device Intrusion classes. The class period runs from June 17, 2018 to the present. "Class Healthcare Providers" are entities on a list the plaintiffs filed; the plaintiffs must still prove they are covered by HIPAA. The prescription drug class covers prescription drug websites, not providers.
The claims include breach of contract, intrusion upon seclusion and California's computer data law (CDAFA, Penal Code Section 502). Three classes also sue under the federal Wiretap Act (ECPA) and the California Invasion of Privacy Act (CIPA). The CIPA Section 631 claim is limited to subclasses of patients who "either communicated from California or exchanged a communication with a California-based healthcare provider". The order calls for a redefined CDAFA class; a footnote notes the plaintiffs agreed to amend the Patient Device Intrusion class.
In this Meta Pixel lawsuit, Meta is the defendant, not the hospitals named in other pixel lawsuits. Certification lets the claims proceed as a group. It is not a finding that Meta is liable. The healthcare pixel lawsuits in our settlement table instead name the healthcare organization accused of running the code.
Revised class definitions are due within 10 days of the order, and a proposed notice plan within 30 days. A case management conference is set for November 17, 2026.
A separate federal case over alleged Google tracking on health-provider sites has no class ruling yet (Doe I v. Google LLC, N.D. Cal. No. 3:23-cv-02431). On October 30, 2026, Judge Vince Chhabria denied Google's motion to extend the class certification briefing schedule.
Who has settled healthcare pixel lawsuits, and for how much?
Our table lists 13 healthcare organizations that have settled pixel lawsuits or agreed to settle them. Kaiser Foundation Health Plan's $47.5 million is the largest pixel settlement in our table. These are private pixel class action settlements, not government fines. Each amount is what the defendant agreed to pay to resolve healthcare pixel lawsuits brought by patients or users.
Defendant | Amount | Court | Status (as of November 7, 2026) | Trackers alleged |
|---|---|---|---|---|
Kaiser Foundation Health Plan | $47.5 million | U.S. District Court, N.D. Cal. | Final approval Jul 14, 2026; judgment Jul 22, 2026 | Code from Quantum Metric, Twitter, Adobe, Microsoft Bing, Google and Dynatrace on websites and apps |
Sutter Health | $21.5 million (reported) | Sacramento County Superior Court (reported) | Final approval order entered Mar 6, 2026 (reported) | Tools sharing data with Facebook and Google on certain pages, including the portal login page (reported) |
Allina Health System | $12.5 million | U.S. District Court, D. Minn. | Final approval Sep 24, 2026 | Meta Pixel and Google Analytics |
Advocate Aurora Health | $12,225,000 | U.S. District Court, E.D. Wis. | Final approval Jul 10, 2024 | Pixels sending data to Meta and Google from websites, an app and the patient portal |
Penn Medicine | Up to $9.25 million (reported) | Philadelphia County Court of Common Pleas (reported) | Not approved; final hearing scheduled Nov 12, 2026 (reported) | Meta and Google pixels and other tools (reported) |
The Christ Hospital | Up to $7 million (reported) | Hamilton County (Ohio) Court of Common Pleas (reported) | Final approval reported by class counsel; date not confirmed (reported) | Data to third parties including Meta and Google (reported); the hospital denies trackers on its portal (reported) |
Novant Health | $6.66 million | U.S. District Court, M.D.N.C. | Final approval June 2024 (reported) | A pixel sending data to third parties including Meta, on websites or the MyChart portal |
Inova | About $3.1 million (reported) | U.S. District Court, E.D. Va. | Final approval Apr 17, 2026 (reported) | Facebook or Google pixel on public websites |
LifeStance Health Group | $3,027,874.44 | U.S. District Court, D. Ariz. | Final approval Oct 20, 2026 | Alleged "pixel-tracking technology" on its website; the order names no vendor |
Cone Health | $1,765,000 (reported) | U.S. District Court, M.D.N.C. | Final hearing held Nov 5, 2026; no order seen | Google and Meta (reported) |
Emanate Health Medical Center | $777,000 (reported) | Los Angeles County Superior Court (reported) | Not approved; final hearing set for Nov 19, 2026 (reported) | Meta Pixel; Google Analytics is named in the release (reported) |
Mount Sinai Medical Center of Florida | $220,000 for claims (reported), plus $492,750 in fees and costs | Broward County (Fla.) Circuit Court | Final approval Oct 13, 2026 | Tracking, analytics or advertising tools on the website and portal; vendors not named (reported) |
Boone Health | $20 per approved claim (reported); no fund total | Cole County (Mo.) Circuit Court (reported) | Final hearing set for Dec 1, 2026 (reported) | Third-party website technologies (reported) |
The Kaiser, Allina, Advocate Aurora and Novant records each say the settlement is not an admission of wrongdoing. Sutter Health, Penn Medicine, The Christ Hospital and Inova deny wrongdoing (reported). No defendant in these pixel lawsuits has been found liable.
Kaiser's class has about 13.1 million members who used authenticated pages of its websites or apps from November 2017 to May 2024. The court estimated each claiming member will get about $40. In April 2024, ruling on an earlier complaint, the court dismissed the Wiretap Act, CIPA and California medical privacy (CMIA) claims. Kaiser's motions to dismiss the later complaints were never decided before the settlement.
Judges have pushed back on fees and terms in some of these pixel lawsuits. In July 2024, a judge cut class counsel's fee in the Advocate Aurora case to 30% of the net fund after an objector challenged it. Another judge rejected LifeStance's first proposed deal before approving a revised one.
Some pixel lawsuits settle with per-claim payments or very small classes. Derick Dermatology agreed to settle claims from people who booked appointments online, at up to $12.50 per claim (reported in June 2026). USC Arcadia Hospital's class has about 582 people who used an email or event sign-up form; its final hearing is December 14, 2026 (reported). Legacy Health's settlement website says the settlement received final approval, and that the final hearing was set for April 16, 2026 (reported). It pays $15 per approved claim (reported). The $2.2 million figure reported for Legacy is a cap on fees and costs, not the settlement value.
Why do patients sue if HIPAA has no private right of action?
HIPAA gives patients no right to sue, so pixel lawsuits use other laws. A patient who claims their protected health information (PHI) reached Meta or Google has to rely on wiretap, privacy and contract claims.
The federal claim in these cases is the Wiretap Act, part of the Electronic Communications Privacy Act (ECPA). It lets a party to a communication intercept it, or consent to its interception. That permission ends if the communication is intercepted "for the purpose of committing any criminal or tortious act" (18 U.S.C. 2511(2)(d)). This is the crime-tort exception. A hospital is a party to a visitor's communication with its website, so it can rely on that permission. Plaintiffs argue the crime-tort exception takes that defense away.
State laws named in these pixel lawsuits include:
California's Invasion of Privacy Act (CIPA), including Penal Code Section 631: the Meta case and Adventist.
Pennsylvania's wiretap law (WESCA): Penn Medicine (reported).
New Hampshire's wiretap law: Concord Hospital (reported).
Florida's Security of Communications Act: Interim HealthCare (filed August 7, 2026) and Health First (filed October 6, 2026).
The Illinois Eavesdropping Statute: Pinnacle Fertility (filed August 13, 2026) and Health Care Service Corporation (filed September 1, 2026).
Washington's Privacy Act (RCW 9.73.030): Seattle Children's Hospital.
California's medical privacy law (CMIA): Kaiser and Adventist.
The complaints in these pixel lawsuits also plead common law claims, such as breach of contract, intrusion upon seclusion, negligence and unjust enrichment.
On October 23, 2026, the Fifth Circuit revived a Meta Pixel suit against an optical retailer (Rand v. Eyemart Express, 5th Cir. No. 25-10784). At the pleading stage, it held that some customers' shopping and scheduling data "relates to" health under HIPAA's definition. It did not decide whether HIPAA covers the retailer, and noted that HIPAA itself gives no private right of action.
How have courts ruled in pixel lawsuits?
Courts are split in pixel litigation: two state high courts ruled for hospitals on state wiretap claims, while several federal judges let Wiretap Act claims proceed. This table lists the rulings we checked in pixel lawsuits and related cases.
Court | Date | Case | What the court decided | Direction |
|---|---|---|---|---|
Massachusetts Supreme Judicial Court | Oct 24, 2024 | Vita v. New England Baptist Hospital | The state wiretap act does not reach alleged tracking of browsing on public pages; 5-1 | For hospitals |
Washington Supreme Court | Oct 8, 2026 | Baker v. Seattle Children's Hospital | The Privacy Act covers communication between individuals, not clicks and searches on an automated website; dismissal affirmed | For the hospital on that claim |
California Court of Appeal | Jul 24, 2026 (certified for publication Aug 24, 2026) | Doe v. Adventist Health System/West | Reversed the denial of class certification for a health risk assessment form subclass and surviving portal claims, and remanded; the appeals court did not certify a class | Mixed, mostly for patients |
U.S. District Court, N.D. Ill. | Mar 3, 2026 | Stein v. Edward-Elmhurst Health | Sent the crime-tort question to the Seventh Circuit; argument scheduled Dec 9, 2026 | Pending |
U.S. Court of Appeals, 7th Cir. | Oct 20, 2026 | Elkins v. Southeastern Indiana Health Management (with three related cases) | Hospitals were not "acting under" HHS, so the cases go back to Indiana state court | Procedural |
U.S. District Court, W.D. Wash. | Oct 23, 2026 | Small v. MultiCare Health System | Wiretap Act, fiduciary duty and unjust enrichment claims survive; two contract claims dismissed for good, five others with leave to amend | Mixed |
U.S. Court of Appeals, 5th Cir. | Oct 23, 2026 | Rand v. Eyemart Express | Revived a Meta Pixel suit against an optical retailer at the pleading stage | For plaintiffs (not a hospital) |
U.S. District Court, D. Or. | Oct 26, 2026 | McClellan v. Providence Health & Services | Motion to dismiss denied; an alleged HIPAA violation can supply the crime-tort purpose | For patients at this stage |
U.S. District Court, N.D. Cal. | Oct 30, 2026 | In re Meta Pixel Healthcare Litigation | Four classes of Facebook users certified against Meta | For plaintiffs, against Meta |
U.S. District Court, N.D. Tex. | Jun 20, 2024 | American Hospital Association v. Becerra | Vacated one part of HHS's tracking bulletin; HHS's appeal dismissed Sep 4, 2024 | For hospitals |
The Wiretap Act split heading to the appeals courts
Two federal appeals courts are weighing whether the act or the purpose must be criminal or tortious. One appeal comes from an Illinois hospital case (Stein v. Edward-Elmhurst Health, N.D. Ill. No. 1:23-cv-14515). In March 2026, the trial judge again read "criminal or tortious" to modify "act," not "purpose". The judge denied the hospital's request to reconsider and said requiring a criminal or tortious purpose "significantly raises the bar for liability".
The judge certified this question: does the crime-tort exception apply when a complaint "alleges that the defendant acted with a lawful purpose"? The question adds that the complaint "does not allege that a defendant acted with a criminal or tortious purpose".
As the order describes the split, some courts require a criminal or tortious act, and others a criminal or tortious purpose. The split matters for any of these pixel lawsuits that rely on the Wiretap Act.
The Seventh Circuit agreed to hear the appeal. The American Hospital Association and the Illinois Health and Hospital Association filed a brief for the hospital on May 27, 2026. The U.S. Chamber of Commerce submitted one the same day. Argument is scheduled for December 9, 2026.
The First Circuit's Cape Cod Healthcare appeal raises the same split (Goulart v. Cape Cod Healthcare, 1st Cir. No. 25-1672). It was reportedly argued on April 6, 2026, and we found no opinion as of November 7, 2026. Either court could rule first.
On October 26, 2026, in a case against Providence, an Oregon federal judge applied the purpose test, not the act test, following Ninth Circuit precedent. The judge held that an alleged intentional disclosure of PHI in violation of HIPAA can supply that purpose. The claim survived (McClellan v. Providence Health & Services, D. Or. No. 3:26-cv-00540).
The Seventh Circuit's October 20, 2026 ruling in four Indiana cases was about jurisdiction only (Elkins v. Southeastern Indiana Health Management, 7th Cir. No. 23-3159). It did not decide whether the tracking was lawful.
What did California SB 690 change, and what other laws apply?
SB 690 will let only the Attorney General bring one type of California claim over website and app tracking: the Section 638.51 claim against private actors. The Governor approved SB 690 on September 30, 2026 (Chapter 976, Statutes of 2026).
The new Penal Code Section 637.2(d)(1) says such a claim "may be brought under this section only by the Attorney General". The amendments "apply retroactively to any pending claim in an action commenced within two years before the operative date". SB 690 is not an urgency statute, so it takes effect January 1, 2027 under the state constitution's default rule.
Private suits under Sections 631 and 632 remain, and so does the $5,000 per violation remedy. So SB 690 does not end pixel lawsuits in California.
Washington's My Health My Data Act (RCW 19.373) allows private suits through the state Consumer Protection Act. But it exempts HIPAA protected health information. It also exempts data mixed in with that PHI so the two cannot be told apart, when a covered entity or provider keeps it. That makes the Act a poor fit for pixel lawsuits over a hospital's PHI, though not everything a hospital holds is exempt.
New York's Health Information Privacy Act (S9269) is still a bill. It passed both houses in June 2026. As of November 7, 2026, the Senate website shows no delivery, signature or veto.
Has OCR fined anyone over tracking pixels?
We found no OCR settlement or penalty over tracking technologies as of November 7, 2026. The HHS Office for Civil Rights announced a right of access case on October 8 and a ransomware case on October 29, 2026. Neither involved tracking. Our separate guide explains OCR's civil penalty tiers.
OCR issued its tracking bulletin on December 1, 2022 and revised it on March 18, 2024. A court vacated one part on June 20, 2024, and HHS's appeal was dismissed on September 4, 2024. HHS's bulletin page says HHS is evaluating its next steps. The bulletin says an impermissible disclosure of PHI is presumed a breach unless a low probability of compromise is shown.
OCR's breach portal lists a Blue Shield of California report, submitted April 9, 2025, covering 4,700,000 individuals. OCR's summary says Blue Shield reported that Google Analytics was configured on its website so that PHI may have been sent to Google. It adds that the entity stopped using tracking technologies on authenticated pages without a business associate agreement in place. This is a breach report, not a penalty.
What the FTC and state attorneys general have done
Outside the pixel lawsuits, the Federal Trade Commission (FTC) has acted on health data shared for advertising. The FTC announced actions against GoodRx (February 1, 2023, a $1.5 million civil penalty) and Premom (May 17, 2023). It finalized its BetterHelp order on July 14, 2023. Monument (April 11, 2024) and Cerebral (April 15, 2024) followed. On July 20, 2023, the FTC and HHS sent about 130 hospital systems and telehealth providers a joint letter on tracking technologies.
The FTC, Utah and California announced a suit against Hims & Hers Health on July 29, 2026. Their complaint alleges Hims shared registration and purchase events with Meta about 8 million times through the Meta Pixel and Conversions API. These are allegations only. Hims has moved to dismiss, and a hearing is set for January 14, 2027, per the court's October 30 minute entry. Separate private suits against Hims were consolidated on October 30, 2026.
New York's $300,000 settlement with NewYork-Presbyterian Hospital (December 27, 2023) is the only state attorney general hospital website-tracking settlement we found. It required the hospital to test third-party tools before deploying them. California's $1.55 million Healthline settlement (July 1, 2025) was with a health publisher, not a HIPAA covered entity.
What are plaintiffs targeting now?
Recent pixel lawsuits name Google Analytics, DoubleClick and session or experience tools, not just the Meta Pixel. They focus on portals, appointment pages, doctor search and forms. These are examples from court records and news reports, not a count of all pixel lawsuits.
New pixel lawsuits filed in October 2026 include the three below. They are allegations only.
Health First (filed October 6, 2026): the complaint names Google Analytics, Google AdSense and Google Tag Manager on its website.
Phoenix Children's Hospital (filed October 13, 2026): the complaint says tracking on its website, including Google Analytics, captured doctor and condition searches, scheduling and payments.
St. Charles Health System (filed October 20, 2026): the complaint alleges "the Google Analytics Tracker and the DoubleClick Tracker" captured provider searches and scheduling.
Google Analytics appears in several of these pixel lawsuits. Separately, Google offers no BAA for Google Analytics.
Other pixel lawsuits reach past Meta and Google Analytics. A suit against Interim HealthCare, filed August 7, 2026, names Microsoft Clarity. A suit against Health Care Service Corporation (Blue Cross and Blue Shield of Illinois) was filed September 1, 2026. It alleges "hidden tracking codes" from Adobe, Medallia, Qualtrics and Dynatrace. St. Joseph Hospital in Nashua, New Hampshire, agreed to settle claims over alleged Microsoft tracking code inside MyChart (reported in June 2026).
In one MyChart tracking pixel lawsuit, filed August 5, 2026, the complaint against UCHealth names its My Health Connection portal, built on Epic MyChart. On information and belief, it alleges the Meta Pixel or similar tracking was on some or all portal pages. UCHealth moved to dismiss on September 21, 2026.
The theory now reaches eyewear retailers, not just hospitals and clinics. A suit against Eyemart Express was revived on appeal on October 23, 2026, and WebEyeCare was sued on October 29, 2026.
What is scheduled next in pixel lawsuits?
As of November 7, 2026, the next hearing we found in pixel lawsuits was Penn Medicine's final approval hearing, set for November 12, 2026 (reported). Other dates on the calendar in pixel lawsuits and related cases, as of November 7, 2026:
November 17, 2026: case management conference in the Meta case.
November 19, 2026: Emanate final approval hearing (reported).
November 20, 2026: consolidated amended complaint due in the private Hims & Hers case.
December 1, 2026: final hearings in the Boone Health and Wellstar settlements (reported).
December 9, 2026: Seventh Circuit argument in the Edward-Elmhurst appeal, scheduled.
December 14, 2026: USC Arcadia Hospital final hearing (reported).
January 1, 2027: SB 690 takes effect under the state constitution's default rule.
January 14, 2027: hearing on Hims's motion to dismiss the FTC case, per the October 30 minute entry.
January 14, 2027: final hearing in Tenet's Saint Francis Hospital-Memphis settlement (reported).
No date yet: a First Circuit decision in the Cape Cod Healthcare appeal.
What should a hospital or clinic take from these cases?
These pixel lawsuits show changes some healthcare organizations made or agreed to make, and Meta's own terms tell businesses not to send it health information. Meta's Business Tools Terms do not mention HIPAA or BAAs. This table lists what settlements in these pixel lawsuits required or recorded.
Case | Change | Term | Status (as of November 7, 2026) |
|---|---|---|---|
Emanate | A Web Governance Committee; no re-deployment of the Meta Pixel or Google Analytics for 2 years unless certain restrictions are met (reported) | 2 years after final approval, for the re-deployment limit (reported) | Proposed; hearing Nov 19, 2026 (reported) |
Penn Medicine | No analytics or ad tech on pennmedicine.org unless its web governance committee finds the use lawful (reported) | 2 years (reported) | Proposed; hearing Nov 12, 2026 (reported) |
The Christ Hospital | Injunctive terms of a January 13, 2023 agreed court order extended; they apply to the portal and website, including forms (reported). HIPAA compliant analytics tools under a BAA allowed (reported) | 2 years from final approval (reported) | Final approval granted (reported) |
Boone Health | No Meta Pixel, Google Analytics or similar tracking in the patient portal (reported) | 3 years after final approval (reported) | Proposed; not in effect; hearing Dec 1, 2026 (reported) |
LifeStance | Injunctive Relief Benefits; the order does not describe them | 5 years from the Effective Date | Final approval Oct 20, 2026 |
Kaiser | Trackers "disabled, deleted, or modified" and consent banners added after the plaintiffs moved for a preliminary injunction | No fixed term in the record | Done before approval |
The Allina, Advocate Aurora and Novant orders and agreements we read show no tracker terms. Kaiser added consent banners during its case. OCR's bulletin separately says website banners asking users to accept or reject tracking are not a valid HIPAA authorization.
Meta's developer documentation says that beginning September 2, 2025, it would start rolling out restrictions on custom conversions. It says custom conversions suggesting specific health conditions will be flagged and blocked from ad campaigns.
Our tracking guide, linked above, explains how to find the trackers on your own site. If an agency runs your tags, see what agencies that manage these tags owe their clients.
Most of these cases turn on third-party code in web pages and apps. Removing a tracker from pages tied to care needs no new host and no purchase from us. If your patient portal, intake forms or booking pages run on servers you manage, the host is a vendor too. Our managed healthcare hosting runs on single-tenant AWS with six-year audit logging. Managed plans from $229 a month. We sign the BAA within 24 hours of signup, before patient data moves. Our business associate agreement covers the servers and services we run, so Meta, Google and other tool vendors on your pages are outside it. We sell HIPAA compliant hosting, so weigh this as a disclosure.
Frequently asked questions
What is a pixel lawsuit?
A pixel lawsuit claims that tracking code on a website or app sent visitors' information to a third party, such as Meta or Google. Healthcare pixel lawsuits we reviewed point to portals, appointment pages, doctor search and forms. The claims run under wiretap, privacy and contract law, because HIPAA gives patients no right to sue.
Does HIPAA have a private right of action?
No. HIPAA itself gives patients no private right of action, as the Fifth Circuit noted on October 23, 2026. In pixel lawsuits, patients sue instead under the federal Wiretap Act, state wiretap and medical privacy laws, and contract or privacy claims.
What is the largest healthcare pixel settlement so far?
Kaiser's $47.5 million is the largest settlement in healthcare pixel lawsuits that we found in court records. A federal court in California approved it on July 14, 2026, for a class of about 13.1 million members. The judgment says the settlement is not an admission of wrongdoing.
How much does a pixel settlement pay per person?
Payouts vary across healthcare pixel lawsuits. The court estimated about $40 per Kaiser claimant. Advocate Aurora's deal capped payments at $50 per valid claim, but the court said the high claim rate meant payouts would not reach that cap. Sutter's payments were reported at $68.81 per valid claim. Penn Medicine's proposed deal offers up to $15 per claim (reported).
Is a pixel settlement legit?
Check the court record. Find the case number for the pixel lawsuits it settles, then confirm the claims administrator named in the court's orders. Each settlement in this article's table has its case number in Sources. LifeStance's final approval order, for example, names Angeion Group, LLC.
Has HHS fined anyone for tracking pixels?
We found no OCR settlement or penalty over tracking technologies as of November 7, 2026. OCR is the HHS Office for Civil Rights. Its newest announced cases, on October 8 and October 29, 2026, involved right of access and ransomware. Private pixel lawsuits are separate from OCR enforcement. HHS's tracking bulletin page says HHS is evaluating its next steps.
Is Meta being sued over hospital pixel data?
Yes. The main Meta Pixel lawsuit over health data is In re Meta Pixel Healthcare Litigation, in federal court in California. On October 30, 2026, a judge certified four classes of Facebook users. Hospitals are not defendants there; providers face separate pixel lawsuits. Certification lets the claims proceed as a class; it does not decide liability.
Can a small clinic be sued over a pixel?
Yes. Not all healthcare pixel lawsuits target hospitals. A dermatology practice reportedly agreed to settle a Florida state court class action over alleged website tracking. The class covers people who booked appointments online, and the settlement was reported to offer up to $12.50 per claim.
Our health system self-reported a tracking issue. Are we protected from lawsuits?
Nothing we reviewed suggests a self-report stops pixel lawsuits. The Novant settlement agreement says the litigation arose after Novant's letter dated on or about August 12, 2022; the first suit followed August 23, 2022. OCR's bulletin says an impermissible disclosure of PHI is presumed a breach unless a low probability of compromise is shown. Ask counsel about your facts.
Recap: pixel lawsuits
In short, healthcare pixel lawsuits keep settling: the Kaiser, Allina and LifeStance settlements all received final approval in 2026. Courts are split on the Wiretap Act theory, and two federal appeals courts are weighing the question. We found no OCR settlement or penalty over tracking technologies as of November 7, 2026. OCR's tracking bulletin is still posted, though a court vacated one part of it in 2024. Patients bring pixel lawsuits under wiretap, privacy and contract law, not HIPAA. If your practice website, portal or booking pages need a host that signs a BAA before patient data moves, request a quote for your practice.
Not legal advice. This article is general information about pixel lawsuits against healthcare organizations. It describes court records, agency actions, laws, settlement notices and news reports we checked through November 7, 2026. Outcomes depend on the facts and on state law, so ask a qualified attorney about your situation. We sell HIPAA compliant hosting. Reviewed November 2026.
Sources
Primary sources:
Meta case, N.D. Cal. No. 3:22-cv-03580: class certification order, Doc. 1425 and docket.
Google case, N.D. Cal. No. 3:23-cv-02431: docket.
Kaiser, N.D. Cal. No. 3:23-cv-02865: final approval order, Doc. 454 and final judgment, Doc. 459.
Allina, D. Minn. No. 0:24-cv-03674: preliminary approval memorandum, Doc. 56 and final approval order, Doc. 68.
Advocate Aurora, E.D. Wis. No. 2:22-cv-01253: final approval order, Doc. 54 and judgment, Doc. 55.
Novant, M.D.N.C. No. 1:22-cv-00697: settlement agreement on the court's website. Inova, E.D. Va. No. 1:24-cv-00700: amended preliminary approval order, Doc. 56.
LifeStance, D. Ariz. No. 2:23-cv-00682: final approval order, Doc. 107.
Mount Sinai Medical Center of Florida, Broward County No. CACE-26-006904: signed final approval order. Cone Health, M.D.N.C. No. 1:24-cv-00558: docket.
Stein v. Edward-Elmhurst Health, N.D. Ill. No. 1:23-cv-14515 and 7th Cir. No. 26-1742: certification order, Doc. 71, docket and Seventh Circuit argument calendar.
Edward-Elmhurst appeal: AHA and Illinois Health and Hospital Association brief, U.S. Chamber of Commerce brief and Seventh Circuit opinions search.
Goulart v. Cape Cod Healthcare, 1st Cir. No. 25-1672: AHA amicus filing and First Circuit opinions search.
McClellan v. Providence Health & Services, D. Or. No. 3:26-cv-00540: order, Doc. 47. Small v. MultiCare Health System, W.D. Wash. No. 3:24-cv-05552: order, Doc. 33.
Appeals opinions: Fifth Circuit, No. 25-10784 (Rand v. Eyemart Express) and Seventh Circuit, No. 23-3159 (Elkins v. Southeastern Indiana Health Management).
State courts: Massachusetts SJC-13542 (Vita), Washington No. 104590-5, slip opinion copy (Baker) and No. B344951 (Adventist).
American Hospital Association v. Becerra, N.D. Tex. No. 4:23-cv-01110: order, Doc. 67, district docket and appeal docket.
FTC, Utah and California v. Hims & Hers Health, N.D. Cal. No. 3:26-cv-07871: FTC announcement, complaint and motion to dismiss, Doc. 58.
Hims dockets: FTC case docket text, October 30 minute entry and private case, No. 3:26-cv-07941.
October complaints: Health First, M.D. Fla. No. 6:26-cv-02323, Phoenix Children's Hospital, D. Ariz. No. 2:26-cv-07475 and St. Charles Health System, D. Or. No. 6:26-cv-02302.
Other complaints: Interim HealthCare, S.D. Fla. No. 0:26-cv-62189, Health Care Service Corporation, N.D. Ill. No. 1:26-cv-10557 and Pinnacle Fertility, D. Ariz. No. 2:26-cv-05720.
WebEyeCare, E.D. Pa. No. 2:26-cv-08273: complaint.
Statutes and bills: 18 U.S.C. 2511, California Legislature bulk bill data (1.29 GB zip; SB 690 is Chapter 976) and New York S9269. The January 1, 2027 date applies the California Constitution, art. IV, sec. 8(c)(1).
Washington: RCW 19.373 and RCW 19.86.090.
HHS: tracking bulletin, December 1, 2022 announcement and resolution agreements.
HHS: Lehigh Valley Health Network press release, October 29, 2026, Shen Smiles press release, October 8, 2026 and OCR breach portal, Archive tab.
FTC: FTC and HHS letter (2023), GoodRx and BetterHelp.
State attorneys general: New York and NewYork-Presbyterian and California and Healthline.
Vendor documents: Google Analytics HIPAA help page, Meta Business Tools Terms and Meta Pixel conversion tracking docs.
Reported items, from notices, settlement websites and news:
Sutter Health, Sacramento County No. 34-2019-00258072-CU-BT-GDS (reported): notice copy, notice of entry of final approval and OpenClassActions update.
Penn Medicine, Philadelphia County No. 230102149 (reported): notice copy, ClassAction.org report and settlement FAQ.
The Christ Hospital, Hamilton County No. A2204749 (reported): settlement agreement copy and class counsel's post, cited for approval status only.
Novant approval (reported): Bloomberg Law report. Inova amount and approval (reported): OpenClassActions summary.
Mount Sinai Medical Center of Florida claims fund and tools (reported): long form notice. Emanate, Los Angeles County No. 22STCV28142 (reported): class counsel's final approval motion.
Cone Health and Wellstar (reported): HIPAA Journal report and Cone settlement website.
Boone Health, Cole County No. 22AC-CC07646 (reported): notice copy and ClassAction.org report.
Legacy Health, Multnomah County No. 25CV40104 (reported): settlement website and notice copy.
Derick Dermatology, Broward County No. CACE-26-003864 (reported): settlement website and ClassAction.org report.
USC Arcadia Hospital, Los Angeles County No. 23STCV01900 (reported): settlement website and OpenClassActions summary.
Tenet, Shelby County No. CT-3086-23 (reported): settlement website and ClassAction.org report.
St. Joseph Hospital (reported): Nashua Telegraph report. Concord Hospital, Hillsborough County No. 217-2024-CV-00295 (reported): settlement FAQ.
Cape Cod Healthcare argument date (reported): Law360 report and Bloomberg Law report.