LCMC Health Holdings and Louisiana Children’s Medical Center have agreed to settle a lawsuit that alleged that tracking code added to its website and patient portal transmitted sensitive patient information to Facebook, Google, and others without patients’ knowledge or consent.

According to the lawsuit, Pebbles Martin v. LCMC Health Holdings, Inc. and Louisiana Children’s Medical Center, LCMC Health added Meta Pixel and other tracking tools to its website and patient portal, which tracked, recorded, and disclosed patients’ personal health information to Facebook, Google, and other third parties. The tools were able to track various metrics, including the pages visited, the buttons clicked, and specific information input into the website. The lawsuit alleged that the data transmitted by the tracking tools was used to serve website visitors with targeted advertisements and gain an intimate personal profile of patients without their knowledge or consent.

LCMC Health is one of many healthcare providers to add Meta Pixel and other tracking tools to their websites and patient portals. When widespread use of these tools by healthcare providers was identified, the HHS’ Office for Civil Rights issued guidance, warning that these tools likely violated the HIPAA Rules. The guidance was challenged in court, and a Judge sided with the plaintiffs, partially vacating the guidance. While these tools can be used on websites without violating the HIPAA Rules, they cannot be used on patient portals, unless the provider of the code signs a business associate agreement or HIPAA-compliant authorizations are obtained.

LCMC Health maintains there was no wrongdoing; however, to avoid the cost and uncertainty of protracted litigation, it agreed to a settlement to bring the litigation to an end. Under the terms of the settlement, class members will be given cash compensation along with a one-year membership to Cyex Privacy Shield Pro. Members of the settlement class, individuals who used the LCMC patient portal between January 1, 2019, and November 30, 2022, may submit a claim for a cash payment of $15 and will be automatically provided with a code to enroll in the Privacy Shield Pro service.

LCMC Health has also agreed to remove and refrain from using certain tracking technologies on its website and patient portal for a period of two years from the date of final approval of the settlement. The settlement has received preliminary approval, and the final approval hearing has been scheduled for November 7, 2025. Claims for the cash payment must be submitted by November 25, 2025, and individuals wishing to opt out of or exclude themselves from the settlement must do so by October 27, 2025.  Notifications about the settlement were mailed to class members on August 27, 2025.

The post LCMC Health Agrees to Lawsuit Over Tracking Code on Patient Portal appeared first on The HIPAA Journal.