Two healthcare providers have settled class action lawsuits over website tracking code — the small JavaScript snippets and pixels from Meta Platforms (Facebook) and Google that sit on patient-facing web pages and report visitor activity back to the vendor. In both cases, plaintiffs alleged that activity included information tied to individual patients, shared without knowledge or consent. (Source: Hipaajournal)

Banner Health, the Phoenix-based system that operates 33 hospitals across six states, faced multiple suits covering tracking and analytics tools running on its website between June 1, 2020, and November 22, 2023. The overlapping claims were consolidated into McCulley, et al. v. Banner Health, filed in the District Court for Weld County, Colorado, with 8 named class representatives.

The Banner Health settlement class contains approximately 1,028,000 individuals — everyone who logged into a MyBanner patient account during the three-and-a-half-year period at issue.

Banner agreed to pay attorneys' fees and expenses up to $3,750,000, settlement administration costs, and $2,500 service awards to each class representative. Class members can claim a one-time $20 cash payment plus a one-year CyEx Privacy Shield Pro membership. Claims, objections, and opt-outs are due September 5, 2026, with the final fairness hearing set for September 10, 2026.

LifeStance Health Group, a Scottsdale, Arizona outpatient behavioral health provider, settled Montana Strong, et al. v. LifeStance Health Group Incorporated in the U.S. District Court for the District of Arizona. LifeStance will establish a $3,027,874.44 fund, split into $1,203,405.00 for patients who booked sessions through the lifestance.com online booking tool between March 1, 2020, and April 30, 2023, and $1,824,469.44 for other patients from that period.

Both organizations deny wrongdoing and liability, and settled to avoid trial costs and uncertainty. The claims pleaded — the Electronic Communications Privacy Act, California Invasion of Privacy Act, California Confidentiality of Medical Information Act, Arizona Consumer Fraud Act, Colorado Consumer Protection Act, New York General Business Law, and intrusion upon seclusion — are the reason this matters to your organization. Plaintiffs did not need a HIPAA breach finding to bring these; marketing code on your own website was the alleged conduct. LifeStance additionally agreed to stop using any third-party tracking tool that is not fully HIPAA-compliant for five years.

Business and Compliance Impact for Healthcare Organizations

The dollar figures land differently depending on how each settlement is structured, and that structure matters more to your budget than the headline number. LifeStance established a fixed $3,027,874.44 settlement fund, split into $1,203,405.00 for subclass 1 (patients who booked a session through the online booking tool) and $1,824,469.44 for subclass 2 (the remaining patient population in the same period). Attorneys' fees, administration expenses, and class representative service awards come out of that pool before any patient is paid.

Banner's arrangement works the other way. Class members claim a one-time $20 cash payment plus a one-year CyEx Privacy Shield Pro membership, while attorneys' fees and expenses of up to $3,750,000, administration costs, and $2,500 service awards to each of the 8 class representatives are paid on top. If your organization ends up in this position, the per-patient payment is rarely the largest line item.

That definition should shape how you think about your own exposure. The class was not built from a breach notification list or a set of confirmed harmed individuals; it was built from authenticated portal logins. Your entire logged-in patient base becomes the potential class, which means the arithmetic scales with your patient volume regardless of whether any data was ever misused.

Both organizations denied wrongdoing and liability, and both still paid. The claims asserted show why: alongside the federal Electronic Communications Privacy Act, plaintiffs invoked the California Invasion of Privacy Act, the California Confidentiality of Medical Information Act, California's Unfair Competition Law, the Arizona Consumer Fraud Act, the Colorado Consumer Protection Act, New York General Business Law, and common-law theories including breach of confidence, unjust enrichment, and intrusion upon seclusion. Your compliance exposure here does not begin with a regulator's finding — it begins with a plaintiff's firm reading the source code on your public web pages.

Geography compounds it. An Arizona-based health system was sued in Weld County, Colorado, under Arizona, California, and Colorado statutes at once, because its patients live across state lines. If you serve patients in multiple states, the wiretap and consumer protection statutes you answer to are determined by where your patients sit, not where your servers or your corporate office sit.

The LifeStance agreement also carries a non-monetary term with a five-year operational tail: it must discontinue all third-party tracking tools other than those fully compliant with the HIPAA Rules for five years from the settlement date. For a behavioral health provider handling information about physical and mental health, that commitment reaches marketing attribution, conversion measurement, and audience building on patient-facing pages. Any similar commitment in your environment becomes an ongoing obligation subject to outside scrutiny, not a one-time cleanup project.

Then there is the calendar cost. Between Banner's September 5 and September 10, 2026, claim and fairness hearing dates and LifeStance's August 31, September 29, and October 16, 2026, milestones, both organizations are running notice programs, claims administration, and legal coordination well past the point the tracking code was removed. Smaller practices see the same fixed litigation, notice, and administration expenses without the patient volume to spread them across.

Tracking Technology Methods and Patient Privacy Risks

A tracking pixel is not really an image. It is a request your visitor's browser makes to a third party's server, and the request itself carries the payload: the full URL of the page being viewed, the referring page, the visitor's IP address, user-agent string, and whatever identifier the vendor has already stored in the browser as a cookie. Nothing has to be "uploaded" for disclosure to occur — the act of loading the page performs the transfer.

That mechanism is why the plaintiffs in both cases framed their claims under the Electronic Communications Privacy Act as unauthorized interception, use, and disclosure rather than as a data breach. The alleged disclosure happens in real time, contemporaneous with the patient's own communication with the provider's website, which is a different legal theory than a stolen database.

The sensitive content usually rides in the URL and the query string. A page path that names a service line, a provider-search result, a symptom-checker step, or a scheduling flow tells the receiving vendor what the visitor was looking for even when no clinical record leaves the environment. In behavioral health, the inference is narrower still: the mere fact that someone reached an outpatient mental health booking flow is health information about that person.

Where de-identification arguments tend to fail is the identifier set itself. IP addresses, device identifiers, and persistent cookie values are among the identifiers HIPAA treats as identifying, so stripping a name from a payload does not make the transmission anonymous. Ad and analytics platforms are built to resolve those values against their own logged-in account graphs, which is the entire point of a conversion pixel.

Placement compounds it. When a tracker fires on pages behind an authenticated patient login, the browser session is already tied to a specific patient record, so the vendor identifier and the clinical context arrive together. Marketing pixels are designed for anonymous prospects; authenticated portal pages and online booking tools are not anonymous by definition.

The deployment path explains how this happens without anyone deciding it should. Third-party scripts of this type are typically added through a tag manager by marketing or web teams, which means:

• New tags can be published to production without a code review or a privacy assessment.
• One container can load additional vendor scripts that were never separately approved.
• Analytics, advertising, chat, and A/B testing tags often share the same delivery mechanism, so scope creeps quietly.
• Consent controls applied to one script frequently do not govern the others in the same container.

For your organization, the practical consequence is that the inventory of who receives patient web activity may not match the inventory your compliance team believes exists. Vendor contracts, business associate agreements, and privacy notices are written against the documented list.

Re-identification does not require sophistication either. A hashed email submitted through a form, a phone number typed into a callback field, or a member identifier appearing in a URL parameter can be matched against records the receiving platform already holds. Once matched, the platform can attach a health-related interest signal to a real person and act on it for ad targeting.

The harm alleged in these cases is therefore not theft but routing — patient-identifiable web activity flowing to commercial platforms that had no treatment relationship with the patient. That distinction drives both the statutory claims and the class definitions, which is why the exposure scales with website traffic rather than with the size of any single database.

Audit, Detection, and Remediation Priorities for Healthcare IT Teams

Start with the pages behind your patient login. Open the portal in a browser, launch developer tools, and watch the Network tab while you move through appointment scheduling, test results, and messaging. Every request going to a domain you do not own is a data flow you now have to explain, and the Initiator column tells you which script on your page triggered it.

Give yourself 30 days to finish that inventory across both the marketing site and the authenticated portal. What you are documenting for each third-party request is the destination domain, the full URL and query string being sent, the referrer, and any cookie or identifier attached.

• Page templates and CMS plugins that inject scripts globally, including into logged-in views
• Tag manager containers — list every published tag and every account with publish rights
• Embedded widgets: live chat, appointment booking, symptom checkers, provider directories, donation and bill-pay forms
• Session replay and heatmap tools, which capture form field contents as well as clicks
• URLs that encode clinical meaning — condition names, provider specialty, department, or appointment type in the path or query string

Deploy a Content Security Policy in report-only mode before you deploy it in enforcement mode. Setting Content-Security-Policy-Report-Only: connect-src 'self' with a reporting endpoint produces a list of every outbound destination your pages actually contact, including ones added by contractors or agencies you have forgotten about. Once the list matches your approved vendors, switch to enforcement so an unapproved tag cannot phone out.

Pair that with your egress logs. Web proxy and DNS query records show analytics and advertising domains being contacted from your web tier, which is useful when a tag fires server-side or from a subdomain outside your CMS.

The contract review runs in parallel and answers one question per vendor: has this company signed a business associate agreement, and does the agreement permit the data flow you just documented? Most advertising and audience platforms will not sign one, which means their code cannot sit on any page tied to an identifiable patient interaction. Read the data-sharing clauses for language allowing the vendor to use your data to "improve services" or build audience segments.

Then test your consent mechanism the way a plaintiff's expert would. Decline the banner, reload the page, and check the Network tab again — tags that fire before or despite a rejection are a documented gap, not a configuration quirk. Record a short privacy impact assessment for each surviving tool: business purpose, data elements transmitted, retention period, and who approved it.

For the longer term, the governance change that matters is separating containers. Public marketing pages and authenticated patient pages should never share a tag manager container or an analytics property, so a marketing request cannot accidentally reach clinical context. Add web tag deployment to change control with named privacy officer sign-off, and schedule automated scans that alert when a new third-party domain appears in page traffic.

Because the portal is the sensitive surface, watch who is authenticating to it. In environments Capstone manages, Adlumin monitors authentication telemetry and flags anomalous access to patient-facing applications, which matters when portal accounts are the identifier attackers and trackers alike key on.

LifeStance committed to using only tools that fully comply with the HIPAA Rules for five years. Treat that as a workable standard for your own approval process: no tracking code on patient pages without a signed BAA and a documented data flow.

Regulatory Landscape and Enforcement Signals

Neither of these cases came from a regulator. Both were brought by private plaintiffs stacking state statutes on top of the federal wiretap claims — the California Invasion of Privacy Act, the California Confidentiality of Medical Information Act, California's Unfair Competition Law, the Arizona Consumer Fraud Act, the Colorado Consumer Protection Act, and in LifeStance's case New York General Business Law. That combination matters to your risk calculus because those statutes carry private rights of action, so no agency has to open an investigation before you are answering a complaint.

The forum shopping is worth noting. Banner operates in six states, yet the consolidated action landed in Weld County, Colorado while asserting Arizona and California claims. If your patient-facing website is reachable from anywhere, class counsel will pick the jurisdiction with the most favorable statute and the longest lookback period, not the state where your servers or your headquarters sit.

Federal exposure runs on a separate track. The FTC's authority over unfair and deceptive acts reaches health data whether or not you are a HIPAA-covered entity, and the theory is straightforward: if your privacy notice tells patients you do not share their information with advertisers while third-party code on the page does exactly that, the notice itself is the deceptive practice. HHS's Office for Civil Rights has taken the position that identifiable information collected by tracking code on patient-facing pages is protected health information, which makes the analytics vendor receiving it a business associate — and without an executed agreement, every transmission is an impermissible disclosure.

Both settlement classes were defined around authenticated activity. Banner's class is people who logged into the MyBanner portal; LifeStance's first subclass is people who booked a session through its online tool. That is precisely the fact pattern where the regulatory position is strongest, and it tells you where scrutiny is concentrated: not your public marketing pages, but anything behind a login or tied to scheduling a specific service line.

The LifeStance agreement also includes a five-year commitment to stop using third-party tracking tools that are not fully HIPAA-compliant. Injunctive terms like that function much like a consent decree — they turn a one-time payment into years of documented obligations, and they give plaintiffs' counsel a template to demand from the next defendant.

Expect the ripple effect to be mechanical rather than mysterious. Class counsel do not need insider knowledge to identify targets; historical page archives show which vendor scripts were loaded on which pages and when. A pixel your marketing team removed in 2023 remains discoverable, and the class definitions in both of these cases reach back to 2020.

Layered on top of that are the state consumer health data and comprehensive privacy laws, which generally require affirmative consent before sensitive health information is shared and give consumers deletion and opt-out rights. Those obligations apply to your current configuration, not just historical conduct, so an unreviewed tracking stack creates ongoing exposure alongside the retrospective kind.

The practical risk for an organization that has never inventoried its tracking code is evidentiary. When a demand letter arrives, the questions are what was transmitted, to which recipients, from which pages, and during what period — and an organization without those records is negotiating from the plaintiffs' version of the facts.

Key Takeaway: Third-Party Risk and Data Governance

The lesson from both settlements is about ownership, not technology. Neither health system was accused of a breach in the traditional sense — no intruder, no ransomware, no stolen database. The data left through code that someone inside the organization chose to install, and both providers still ended up paying to close out the litigation.

That distinction matters for how you assign responsibility. Marketing teams add conversion tags to improve campaign attribution. Web developers add analytics to measure page performance. Vendors ship those tags with collection turned on by default, and nobody in either role is asked whether the page in question sits behind a patient login. If your change-control process treats a tag manager update as a marketing task rather than a disclosure decision, that gap is where these claims originate.

The single most important action is a complete inventory of every third-party integration running on patient-facing systems, with a documented owner and a documented purpose for each one. Anything you cannot explain in those terms is something you would have to defend later.

Treat the result as a living record rather than a finished project. LifeStance's agreement commits it to avoiding non-HIPAA-compliant third-party tracking tools for five years, which tells you courts and plaintiffs' counsel view this as a continuing obligation, not a one-off cleanup. Websites change weekly, vendors update their scripts without notice, and a tag removed in one quarter reappears in the next when a new campaign launches.

Assume nothing about what a platform does with the data it receives. Verify it, write it down, and re-check it on a schedule you set in advance.