'Pixel tracking' suit lodged against Goshen Health

GOSHEN — A proposed class action lawsuit accuses Goshen Health System Inc. of sharing confidential patient information with companies including Facebook and Google.

The lawsuit, filed by Goshen resident Kaitlin Lamarr and a proposed class of Goshen Health patients, alleges that the hospital allowed Google, Facebook parent Meta and a number of marketing companies to acquire their private information for targeted advertising purposes. The companies embedded a piece of code called a tracking pixel into the Goshen Health website and into web-based tools and services that patients use to search for physicians, pay bills and learn about specific health conditions, according to the lawsuit.

In recent years numerous lawsuits over pixel tracking have been filed against hospital systems around the country as well as tech giants like Meta Platforms Inc. and TikTok Inc. Lamarr’s complaint was transferred to the Elkhart County court system this month after it was originally filed in Marion County in May 2023.

A pixel tracks what web pages are viewed, what buttons are clicked and what information is submitted, then transmits the data to a third party, according to the lawsuit. It was filed by a legal team including Indianapolis law firm Cohen and Malad LLP and law firms in Nashville, Tennessee, and Madison, Wisconsin.

It compares a pixel tracker to wiretapping a phone call.

“By installing the Meta Pixel on its Website, Defendant effectively planted a bug on Plaintiff’s and Class Members’ web browsers and compelled them to disclose Private Information and confidential communications to Facebook, without Plaintiff’s and Class Members’ authorization or knowledge,” the complaint states. “Defendant utilized data from these trackers to market its services and bolster its profits.”

The information that Facebook receives can include the type of medical treatment sought, the individual’s healthcare provider or health condition or registration details for a class or event, according to the lawsuit. Facebook may sell the private information to third-party marketers who then target the website user’s Facebook page.

Facebook and third-party data buyers could infer that a specific patient was being treated for a medical condition such as cancer, pregnancy, dementia or HIV, the lawsuit alleges. It accuses Goshen Health of violating its own privacy policy and the standards of the Health Insurance Portability and Privacy Act.

The six counts in the complaint include negligence, invasion of privacy, unjust enrichment and violation of the Indiana Wiretapping Act. The lawsuit seeks class certification for Goshen patients and relief including restitution from the hospital as well as an order that it pay for at least three years of credit monitoring services.

Goshen Health filed a motion to dismiss the lawsuit on March 6, which hasn’t yet received a ruling. The hospital argues that Lamarr raises many hypothetical scenarios about her data being shared with third parties but fails to make concrete claims that would support the six counts against Goshen Health.

“Plaintiff has carefully crafted her Amended Complaint to suggest that sensitive information could be transmitted to Meta, without actually identifying what specific information was transmitted,” the motion states. “Plaintiff generically states that she ‘provided her Private Information to Defendant,’ without any explanation or specifics about what she means by ‘Private Information,’ the specific circumstances under which she ‘provided’ that information, or how she alleges the information she provided was later transferred to a third party... Plaintiff’s Amended Complaint provides ample speculation of how the Meta Pixel and (Conversions Application Programming Interface) could allegedly work to disclose information, but omits any specifics about what sensitive information pertaining to Plaintiff herself was disclosed to Meta.”

In a statement given Friday in response to the lawsuit, Goshen Health CEO Randy Christophel said the hospital would not comment on active litigation beyond the priority of protecting patient privacy.

“The number one priority at Goshen Health is to protect the health and safety of our patients. Included in this effort is the safeguarding of our patient’s privacy,” he said. “Our policy at Goshen Health is to protect the privacy of our patients at all times and we will not share any information related to their relationship with our organization.”