UMass Memorial Secretly Transmits Website Visitors’ Health Info to Third Parties, Class Action Alleges

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims UMass Memorial Health Care and several affiliated hospitals and facilities have violated the medical privacy rights of patients by disclosing their data without consent to third parties through UMMHealth.org.

The 41-page lawsuit also names as defendants several healthcare corporations, including UMass Memorial Hospitals, UMass Memorial Center, UMass Health Alliance-Clinton Hospital,  Marlborough Hospital and Harrington Memorial Hospital, that use the UMass Memorial website to communicate with consumers. The case alleges that when patients use UMMHealth.org to obtain information about medical conditions, doctors, specialties or to access their healthcare records, tracking software embedded in the site secretly intercepts and transmits their details to Google, Facebook, Bing Ads, ShareThis and DoubleClick. 

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

More specifically, the complaint says that the UMass Memorial website contains a snippet of programming code called a “Meta pixel” that sends to Facebook data about each visitor as they interact with the website. Similarly, the defendants use tracking tool Google Analytics to transmit website users’ behavior to Google, the case adds.

Per the suit, the Meta pixel and Google Analytics can reveal a website user’s IP address to these third parties, allowing them to “associate the information it has received about the individual’s communications with the website to the identity of a particular individual known to Google and Facebook.”

As the case tells it, the companies add the data obtained on UMMHealth.org to detailed profiles they already maintain on each user, regardless of if an individual has a Facebook or Google account. The filing contends that this information, which is also sent to Bing Ads, DoubleClick and ShareThis through code inserted on the defendants’ website, is subsequently used to improve the companies’ targeted advertising capabilities. 

Although the defendants actively aid the data interceptions by injecting hidden code into the website, the healthcare companies’ published online policies and terms of service contain “utterly false” assurances that they will protect consumers’ privacy, the suit argues.

Moreover, consumers reasonably expect that the defendants will keep their interactions with the UMass Memorial website confidential, especially since the Health Insurance Portability and Accountability Act (HIPAA) prohibits healthcare providers from disclosing patients’ private health information without consent, the filing stresses.

The lawsuit looks to cover all Massachusetts residents who accessed any portion of UMMHealth.org within the past three years.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.