Atrium Health shared patient data with Facebook, class-action lawsuit alleges
A class-action lawsuit filed in North Carolina accuses Atrium Health of allowing Facebook and Google to access patient information online to use in targeted ads.
The plaintiffs, identified only as North Carolina-resident J.S. and Michigan-citizen J.R., allege they received spam mail and Facebook ads related to their medical conditions after sharing information with Atrium.
Facebook’s Meta Pixel, a free piece of code that can be installed on websites, intercepted private information on Atrium’s website in violation of federal law, the lawsuit alleges. It was filed Wednesday in the U.S. District Court for the Western District of North Carolina.
Atrium is a Charlotte-based healthcare organization with seven emergency departments, 40 hospitals, and 1,400 other care locations across North Carolina, South Carolina, Georgia and Alabama, according to its website. It sees about 34,000 patients a day, the lawsuit says. It is part of Advocate Health, the third-largest nonprofit health system in the United States.
“No protected health information is shared with common consumer platforms, such as Facebook,” Atrium Health spokesperson Dan Fogleman wrote in a statement. “Atrium Health patients are directed to secure, confidential portals where information is shared only with their care teams.”
Screenshots filed with the federal lawsuit show how Pixel collected information by following the plaintiffs’ searches for pulmonology, neurology, radiology and emergency departments, as well as COVID testing locations and alcohol-rehab centers. The plaintiffs allege they first discovered misconduct in June 2022.
J.R. — an Atrium patient of nearly 20 years — alleges that Facebook and other social media started to push medication and prescription ads into her feed after she submitted “protected health information,” including specific symptoms and treatments, to Atrium.
Pixel followed search activity on Atrium’s website before patients logged in to their portal, the lawsuit alleges.
“The full scope of [Atrium’s] interceptions and disclosures of … communications to Meta can only be determined through formal discovery,” says the new lawsuit.
The lawsuit indicates Atrium removed Pixel “following a wave of negative press and litigation against other healthcare companies for the same unlawful activities.”
A 2022 investigation by nonprofit newsroom The Markup named North Carolina’s Atrium Health Carolinas Medical Center, Duke University Hospital, Novant Health and WakeMed. The Markup found that 33 of the top 100 hospitals in America use the Meta Pixel.
Also in 2022, Meta was sued in the Northern District of California after a Facebook user began receiving targeted ads for heart and knee conditions she entered in her private patient portal at the University of California, San Francisco Medical Center.
Atrium’s actions, according to the lawsuit, violated those patients’ expectations of privacy and constituted “criminal conduct.”
On its website, Atrium says it uses “cookies and similar technology” to connect patients with more information about services.
“Our advertisers may display targeted advertisements when you visit third party websites and social networks based on your previous interactions with our Sites as tracked by cookies and similar technologies,” the website reads. “This process also helps us understand the effectiveness of our content and marketing efforts.”
Atrium’s spokesperson said the hospital network would reserve additional comment for its response to the lawsuit, but, he added, a “nearly identical case” was previously filed against Atrium Health.
“The plaintiffs voluntarily withdrew their case after reviewing the facts about Atrium Health’s patient health portal safeguards in our request for the court to dismiss the case. Ultimately, they recognized that their case was unlikely to succeed,” Fogleman wrote in a statement.
