Los Angeles is on notice that a judge will hear health privacy claims as two nationwide classes, after a ruling that turns a years-old data sharing fight into real exposure for anyone who runs tracking code on a patient-facing site.
The case centers on hospital and health system websites that loaded third-party pixels, which passed along details of what visitors looked at. Certification means patients across the country can pursue claims together rather than one at a time, a structure that makes settlement math far more painful for defendants.
The ruling lands as regulators and courts converge on the same conclusion: a page view on a symptom checker or a clinic finder is health information when the URL itself reveals a condition, and handing it to an advertising network without a business associate agreement breaks the Privacy Rule.
Health system marketing teams should audit every tag on their public sites and patient portals before the next quarter. That means inventorying pixels and session replay scripts, confirming what each transmits, and stripping third-party trackers from pages that reference a diagnosis, a department, or a provider specialty. Consent banners alone will not fix a code deployment that ships the data anyway.
