Meta Sued By Class Action For Collecting Patient Health Data In The US Without Permission

Meta Platforms Inc. sued for sharing personal data. (photo: screenshot of @meta)

JAKARTA – Meta Platform Inc., Facebook's parent company and a major US hospital, is suspected of violating medical privacy laws by using a tracking device that sends health information to Facebook. This is known in two class action lawsuits filed against them.

The lawsuits, which were filed in the Northern District of California in June and July, focused on the Meta Pixel tracking tool. This tool can be installed on websites to provide analytics on Facebook and Instagram ads. This tool also collects information about how people click on and enter information on the website.

An investigation by The Markup in early June found that 33 of the top 100 hospitals in the United States use the Meta Pixel on their websites. In seven hospitals, it was installed on a password-protected patient portal. The investigation found that the tool sent information about patients' health conditions, doctor's appointments, and drug allergies to Facebook.

In one of the lawsuits, a patient said that his medical information was sent to Facebook by the Meta Pixel tool on the University of California San Francisco patient portal and Dignity Health, where the hospital is also a defendant in the lawsuit. According to the lawsuit, the patient was then treated to advertisements aimed at his heart and knee conditions.

Another lawsuit, arose from a patient at MedStar Health System in Baltimore, Maryland, who alleged that at least 664 healthcare providers had sent medical data to Facebook via the Meta Pixel.

Under the HIPAA medical privacy law, healthcare organizations require patient consent to share personally identifiable health information with outside groups.

Meta says that groups using the Meta Pixel should have the right to share data before sending that data to Facebook and filtering out sensitive health data.

The lawsuit also alleges that Meta knowingly failed to enforce the policy and placed Pixel on a health care organization's website despite knowing that it would be able to collect personal health information.

Lawsuits must be certified as class action by a judge before they can proceed. If either one succeeds, they could bring harm on behalf of all Facebook users whose medical providers use the Meta Pixel.