Lawsuit accuses Florida’s Palm Beach County hospital network of sharing patients’ private data

The Palm Beach Health Network has become the latest health provider accused of illegally sharing identities and private health information of its patients with the social media company Meta, owner of Facebook.

A lawsuit filed Wednesday in U.S. District Court in West Palm Beach says the health network’s websites share code with Meta that enables patients to be targeted with advertising on Facebook based on “highly sensitive personal information” they share.

It names as defendants the Palm Beach Health Network Physicians Group, doing business as Palm Beach Health Network, and Palm Beach Gardens Community Hospital, doing business as Palm Beach Gardens Medical Center.

Palm Beach Health Network is the largest health care network in Palm Beach County, the suit states. It includes a large multi-specialty physician group, ambulatory surgery centers, outpatient diagnostic facilities, and six hospital and care centers, including Delray Medical Center, Good Samaritan Medical Center, Palm Beach Children’s Hospital, St. Mary’s Medical Center, West Boca Medical Center and Palm Beach Gardens Medical Center.

The network, according to the lawsuit, has “disregarded the privacy rights of their patients who used their web properties by intentionally, willfully, recklessly and/or negligently failing to implement adequate and reasonable measures to ensure that the users’ personally identifiable information and protected health information was safeguarded.”

Andrew Lofholm, spokesman for the network, said on Thursday, “We are not commenting on that,” referring to the lawsuit.

The suit claims that the network installed Facebook’s Meta Pixel and other invisible third-party tracking technology on its websites to intercept patients’ information “with the express purpose” of disclosing the information to Meta and other third parties.

Meta encourages businesses to install its tracking code and does not offer any tools that allow users “to opt out of such extensive tracking,” the suit states, adding, “even the most sophisticated users who enable cookie blockers cannot avoid having their information tracked through the various Meta tracking tools.”

The practice violates the Health Insurance Portability and Accountability Act (HIPAA), as well as state and federal law, the suit claims.

The technology collects patient data regardless of whether they have a Facebook account, the suit states. “Facebook maintains ‘shadow profiles’ on users without Facebook accounts and links information collected via the Pixel to the user’s real-world identity using their shadow profile,” it says.

The lawsuit alleges that its lead plaintiff, Ron Prosky, used Palm Beach Gardens Medical Center’s website and patient portal to search for doctors, make appointments, review medical treatments and review his medical records, including imaging results, for a specific health issue that the publicly available version of the lawsuit redacted.

Prosky then began receiving advertisements on his Facebook account “relating to his particular medical conditions and treatments,” the suit claims. After receiving information about patients and their conditions, “Meta then shares the information with additional unauthorized third parties whose businesses and advertisements are related to those conditions,” the suit claims.

Prosky relied on the health network’s privacy policies and reasonably expected it would safeguard his private information, the suit alleges.

The lawsuit is the latest in a series of claims since 2022 accusing health networks across the United States of illegally sharing patient information with third parties such as Facebook and Google.

In January, North Carolina-based Norvant Health agreed to pay $6.6 million to settle claims against it. In 2022, the company admitted that 1.3 million patients’ information was leaked to Facebook, saying Pixel was “configured incorrectly.”

In 2023, Advocate Aurora Health agreed to pay $12.25 million to settle multiple lawsuits alleging pixel tracking tools, including Meta, Google and others. In a separate case, Milwaukee-based Froedtert Health reached a $2 million settlement over charges it installed the Meta Pixel tool without patients’ knowledge, according to Becker’s Hospital Review.

Last July, the Department of Health and Human Services’ Office for Civil Rights and the Federal Trade Commission sent letters to 66 hospitals and health systems warning that they might be violating federal health privacy laws by installing pixel tracking technologies on their websites. Palm Beach Health Network was not among the systems notified, according to a post by Becker’s Hospital Review.

Meta itself is the subject of a class-action suit in California filed in June 2022 by plaintiffs who claim at least 664 medical entities use its technology, according to published reports.

Meta blamed the providers, stating they control the code placed on their websites and they choose what information it sends to Meta. Meta also argued that the plaintiffs did not violate patients’ health privacy, saying the only information the company received were the URLs of websites browsed by the plaintiffs.

Two motions by Meta to have the lawsuit dismissed failed. One claimed patients hadn’t sufficiently established the company’s intent to collect their information. That was defeated by the judge in August.

In January, the judge disagreed with Meta’s contention that an amended complaint lacked specific examples that patients’ information was transmitted.

He ruled that the information provided was sufficient to allow the lawsuit to advance to the discovery phase.

The lawsuit against the Palm Beach County providers seeks damages, other equitable relief, treble and/or punitive damages, interest and attorneys’ fees.

It was filed by Clarkson Law Firm of Malibu, California, and Almeida Law Group of Chicago.

Provided by
South Florida Sun Sentinel