Hancock Health 507493 Settlement Over Alleged Patient Portal Data Sharing Without Consent

The lawsuit centers on how Hancock Health’s online patient portal allegedly shared patients’ personally identifiable information and/or protected health information with third-party tracking or analytics technologies when patients logged in between Jan. 1, 2020, and Dec. 31, 2023. Patient portals have become a primary way people view test results, message clinicians, and manage appointments, but they also generate digital “interaction data” that can be captured by embedded tools (such as pixels, tags, or software development kits) commonly used across the web. The legal concern is that, in a healthcare setting, even seemingly routine data about a user’s portal activity can be sensitive if it can be linked to an individual and their care. The class action was filed because plaintiffs claim this data sharing occurred without patient consent, potentially violating privacy expectations and applicable laws, and it is significant because it reflects growing scrutiny of healthcare providers’ use of common web technologies on patient-facing platforms. Hancock Health denies wrongdoing but agreed to a settlement providing eligible portal users a $25 payment per valid claim and access to a privacy-monitoring product, with a fund that also covers administration, service awards, and up to $507,493.10 in attorneys’ fees and costs. The broader implications extend beyond one hospital system: similar suits have been brought nationwide against healthcare organizations over tracking tools on websites and portals, and the issue sits alongside industry rules like HIPAA’s protections for PHI and evolving regulatory guidance warning that some tracking implementations can amount to impermissible disclosures unless carefully configured and supported by appropriate authorizations or agreements.