New lawsuit alleges Northwestern Memorial gave sensitive patient data to Facebook's parent

A new proposed class-action lawsuit filed in Illinois federal court is claiming that Northwestern Memorial Hospital is giving sensitive patient health data to Meta, the tech giant that owns Facebook and Instagram.

The lawsuit, filed Wednesday in the U.S. District Court for the Eastern Division of the Northern District of Illinois, alleges that Northwestern Memorial allows Meta’s Pixel tracker to “unlawfully” collect private medical information from the hospital’s patient portal to use for its own profit.

Aside from Northwestern Memorial, the complaint lists Meta, Facebook Holdings, Facebook Operations and Instagram as defendants. A Northwestern Medicine spokesman declined to comment on pending litigation, and Meta did not respond to a request for comment.

When patients seek care at Northwestern Memorial, the hospital requires them to schedule appointments through an account with an online medical portal that allows the presence of a computer code call Meta Pixel, according to the complaint. Meta Pixel is a JavaScript code that tracks visitor activity on websites to optimize advertising strategies, according to Meta’s website.

The lawsuit alleges that Meta Pixel was capturing highly sensitive medical data from Northwestern Memorial’s portal and selling the information to third-party organizations that would target advertisements to patients.

“The real prospect of harm in this situation can’t be underestimated,” says Rusty Payton, managing partner at Chicago-based Payton Legal Group, who is representing plaintiffs in the lawsuit. “The fact that this data is being disseminated to third parties by your medical provider can be devastating.”

Similar proposed class-action lawsuits have recently been filed over the use of Meta Pixel at San Francisco-based UCSF Medical Center and Dignity Health, and Baltimore’s Medstar Health System.

In the Northwestern Memorial case, Michael Krackenberger, a Skokie resident and Northwestern patient, is the only individual listed on the proposed class-action suit so far, but potentially tens of thousands of people could qualify for the class, according to the complaint.

Krackenberger was aware of the relationship Northwestern Memorial had with Meta Pixel from a June article published in The Markup, which revealed that dozens of hospitals throughout the country allow Meta Pixel to access patient data. Northwestern Memorial was among other providers, such as Johns Hopkins Hospital, UCLA Reagan Medical Center and New York Presbyterian Hospital, listed in the article. According to The Markup article, Naperville-based Edward-Elmhurst Health also used Meta Pixel but removed it after being contacted by the publication.

Download Modern Healthcare’s app to stay informed when industry news breaks.

Defending its use of Meta Pixel, Northwestern Memorial’s Chief Media Relations Executive Chris King told The Markup: “The use of this type of code was vetted and is referenced in NM.org’s terms and conditions.”

“They may have been operating under the assumption that just by disclosing that the tracker was there that they could then allow their patients to use the portal and they would not have any liability,” says Nick Wooten, another attorney representing plaintiffs in the Northwestern Memorial suit and the head of consumer law at Austin, Texas-based DC LAW.

The complaint alleges the hospital and Meta's conduct invaded the privacy of the plaintiff and the purported class while also violating the Federal Wiretap Act, the Stored Communication Act and other privacy laws.

The proposed class includes any person who used Northwestern Memorial’s patient portal within the last two years. Wooten said it is too early to tell the value of the class damages, but the complaint says it will exceed $5 million.

“We will formulate a better idea of what that number looks like once we have a better handle on the total number of people who’ve been impacted,” Wooten says.

This story first appeared in our sister publication, Crain's Chicago Business.