Banner Health Violated Users' Trust by Installing Tracking Tools, Says Complaint

Protecting medical information and making sure it isn't disclosed to unauthorized entities “is vitally necessary to maintain public trust in the healthcare system as a whole,” said a class action (docket 2:23-cv-00985) Thursday in U.S. District Court for Arizona in Phoenix, alleging multistate healthcare system Banner Health breached its privacy obligations to patients by using tracking technologies on its website.

If people don’t trust that their private health information will be kept private and secure, “they may be less likely to seek medical treatment which can lead to much more serious health consequences down the road,” said plaintiffs Cheryl McCulley (California), Rebecca Blount (Arizona), Cindy Freriks (Florida), Jill Schreidl (Colorado), John Schreidl (Colorado), and Demetria Ann Santiago-Laboy (Arizona).

Plaintiffs “thought they were communicating only with their trusted healthcare providers” when using Banner Health’s website, said the complaint, but Banner “chose to put its revenues over the privacy of its Users,” by installing Meta Pixel and other tracking technologies to “intercept” and send private information to third parties such as Facebook and Google without users’ “informed consent,” it said.

Information Banner sent to Facebook included data linked to plaintiffs’ Facebook user IDs “so that there was no anonymity in that Facebook and/or any third parties who were able to access the information would be able to associate such personal health data with Plaintiffs and all class members,” the complaint said.

Banner breached users’ confidentiality and violated their privacy when it chose to embed tracking technologies to share private information with third parties, the complaint said. Any representation by Banner in its privacy statement that it doesn't use Pixels “is false, deceptive and misleading,” the complaint said.

Banner owed users “common law, statutory and regulatory duties” to keep their communications and medical information “safe, secure and confidential,” the complaint said. Disclosure of their private information “contravenes the letter and spirit" of the Health Insurance Portability and Accountability Act’s (HIPAA) “Standards for Privacy of Individually Identifiable Health Information,” a privacy rule governing how health care providers must safeguard and protect private information, it said.

Health care organizations regulated under HIPAA can use third-party tracking tools but only in a limited way, said the complaint, citing HIPAA guidance saying identifying information such as names, addresses and phone numbers would not be considered personal health information (PHI) alone because it’s not related to health data. But if the information is listed with health condition, health care provision or payment data, “such as an indication that the individual was treated at a certain clinic, then this information would be PHI.”

Plaintiffs cited a recent bulletin from the Department of Health and Human Services’ Office for Civil Rights saying regulated entities under HIPAA aren't permitted to use tracking technologies in a way that would result in impermissible disclosures of PHI to tracking technology vendors, including for marketing purposes, without individuals’ HIPAA-compliant authorizations.

The complaint claims Banner violated the Electronic Communications Privacy Act; the Arizona Consumer Fraud Act; California’s Invasion of Privacy Act, Confidentiality of Medical Information Act and Unfair Competition Law; the Florida Security of Communications Act; and the Colorado Consumer Protection Act. It also asserted claims of common law invasion of privacy and breach of confidence.

Plaintiffs seek an order enjoining Banner from misuse and/or disclosure of users’ private information; an order requiring it to use appropriate methods and policies for consumers’ data collection; restitution and disgorgement of revenue wrongfully retained; punitive damages; and an award of attorneys’ fees and legal costs.