Legacy Health, a nonprofit health system serving Oregon and Washington, agreed to settle a proposed class action alleging it disclosed patient-related data to Meta (Facebook) and Google through tracking technologies tied to its patient portal. The case focuses on people who registered for a Legacy Health portal account between Feb. 18, 2019, and Dec. 31, 2020, and those who logged in between Jan. 1, 2021, and Feb. 9, 2024. Plaintiffs claim the information sharing happened without patient consent, raising concerns about how sensitive health interactions—such as portal visits and related identifiers—can be linked to advertising platforms. The lawsuit, *Layman v. Legacy Health* (Oregon state court, Multnomah County), was filed to seek accountability and compensation for alleged privacy violations tied to this data flow, even though Legacy Health denies wrongdoing. Under the settlement, eligible class members can claim a $15 cash payment and receive one year of Medical Shield Complete (credit monitoring, identity theft insurance, transaction monitoring, and assistance with security freezes), with a claim deadline of March 16, 2026 and a final approval hearing set for April 16, 2026. The significance is less the dollar amount than the spotlight it puts on the routine use of marketing analytics in healthcare settings, where the stakes are higher because portal activity can reveal highly sensitive inferences about a person’s medical concerns. More broadly, this dispute fits a growing wave of cases against hospitals and health providers over “pixels” and similar web trackers that transmit data to ad-tech companies, reflecting a collision between digital marketing tools and medical privacy expectations. In the industry, patient portal and website data is often regulated by a mix of healthcare privacy rules (including HIPAA for protected health information handled by covered entities and business associates) and consumer/privacy laws that can restrict unauthorized disclosure or tracking, depending on what data was shared and how it was used. As regulators and courts scrutinize these tools, health systems are increasingly pressured to tighten consent practices, minimize third-party tracking on patient-facing pages, and treat analytics implementations as privacy-and-security risks rather than purely marketing features