A lawsuit filed in Centre County Court this week alleges that Mount Nittany Health violated medical privacy rights by disclosing patients’ private information to Facebook, Google and other third-party websites without their knowledge.
The four-count lawsuit filed on behalf of two unnamed Centre County residents identified as John and Jane Doe claims information from communications through Mount Nittany Health’s website was captured by tracking technology and shared with the companies for marketing purposes.
Mount Nittany joins a number of health systems nationwide accused of sharing patient information with tech companies in a similar manner.
“We do not comment on pending litigation,” Mount Nittany Health spokesperson Tania Luciow said.
The lawsuit filed by attorney George Bochetto alleges that Mount Nittany embedded tracking pixels, including Facebook’s Meta Pixel, on its website to surreptitiously track, record and transmit user information to the third parties. Tracking pixels are code invisible to the user that collect data and make it accessible to third parties.
Bochetto wrote that information disclosed included individuals’ status as patients, their searches for information about specific medical conditions and treatments, their medical providers and their physical locations.
“Such private information allows third-party advertising companies like Facebook to determine that a specific patient was seeking a specific type of confidential medical treatment,” Bochetto wrote. “This kind of disclosure also allows Facebook to reasonably infer that a specific patient was being treated for specific types of medical conditions, such as cancer or pregnancy.
The tracking technology allows companies like Facebook to then “sell advertising customized to a user’s communications and habits,” Bochetto wrote. In exchange for embedding the Meta Pixel, Facebook provides website owners with analytics about ads they’ve placed on Facebook and Instagram and tools to target advertising to people who have visited their sites, according to the lawsuit.
The health system also allegedly discloses personal information to Google services.
Mount Nittany did not warn patients their information would be disclosed to a third party and did not obtain their consent, Bochetto wrote.
Since last year, multiple health systems have issued data breach notifications for disclosing private information to Facebook or Google. North Carolina-based Norvant Health notified 1.3 million patients that its use of the Meta Pixel potentially disclosed private health information. Wisconsin- and Illinois-based Advocate Aurora Health similarly notified 3 million people, while Community Health Network in Indiana informed 1.5 million people who may have been affected and WakeMed in North Carolina informed 495,000 people.
Bochetto wrote that unlike those systems, Mount Nittany has not notified patients of data disclosure and continues to employ the tracking technology.
He is seeking to have the lawsuit certified as a class action that could involve “thousands” of people.
The lawsuit seeks damages in excess of $1 million. It alleges violations of the Wiretapping and Electronic Surveillance Control Act, invasion of privacy, breach of duty of confidentiality and unjust enrichment.
