Patients who used Rayus Radiology’s online patient portal between 2018 and 2023 allege that simply visiting the company’s website may have triggered the sharing of sensitive information—personally identifiable information (PII) and potentially protected health information (PHI)—with third-party “tracking” or analytics technologies. These tools are common across the web for measuring traffic and ad effectiveness, but in healthcare they raise higher-stakes privacy concerns because a visit to a radiology provider’s site, combined with portal identifiers or appointment-related activity, can reveal intimate details about a person’s medical care. The lawsuit was filed because plaintiffs contend Rayus disclosed this data without patient consent, potentially violating privacy expectations and laws designed to safeguard medical information. Rayus denies wrongdoing but agreed to an $18 million settlement, which offers eligible class members a fixed $25 payment per valid claim plus enrollment in a privacy monitoring service—an outcome that underscores how expensive web-tracking practices can become when deployed in patient-facing digital systems. The case also signals that “standard” marketing tech can create legal exposure when it intersects with healthcare portals, where users reasonably assume their clicks and identifiers won’t be routed to outside companies. More broadly, the settlement fits into a growing wave of similar lawsuits against healthcare providers over pixels, cookies, and session replay tools embedded on websites and portals, often alleging unauthorized disclosure to platforms used for analytics or advertising. The industry backdrop includes HIPAA’s restrictions on disclosing PHI to third parties without proper authorization or safeguards, as well as heightened scrutiny from regulators and plaintiffs’ attorneys over whether online identifiers tied to healthcare interactions can constitute PHI and whether vendors qualify as business associates under HIPAA rules, pushing providers to audit tracking code, tighten vendor contracts, and implement clearer consent and disclosure practices