Duly Health and Care Settles Data Breach Lawsuit for $3.1 Million

HIPAA-covered entity, Midwest Physician Administrative Services, LLC doing business as Duly Health and Care agreed to a $3.1 million settlement to resolve class action litigation related to the use of website tracking technology that allegedly disclosed patient information.

Settlement Overview

Midwest Physician Administrative Services, LLC d/b/a Duly Health and Care agreed to settle a class action lawsuit for $3.1 million. The litigation Mayer v. Midwest Physician Administrative Services, LLC d/b/a Duly Health and Care concerns the use of tracking pixels on Duly Health and Care’s website, dulyhealthandvcare.com. According to the plaintiffs, the technology allowed the transmission of personal data and protected health information (PHI) to third parties without the authorization of website users. The settlement resolves the claims without an admission of wrongdoing by Duly Health and Care.

Nature Of The Allegations

The claims in Mayer v. Midwest Physician Administrative Services, LLC d/b/a Duly Health and Care relate to tracking technologies placed on webpages associated with Duly Health and Care. Duly Health and Care advised patients to arrange medical consultations, register for events and classes, find doctors and treatment services, lookup medical ailments and treatment alternatives, and communicate medical symptoms using the website and patient portal. According to the allegations, the tracking technology resulted in the disclosure of certain patient information to Meta Platforms.

Case Identification

The case filed in the United States District Court, Northern District of Illinois is titled Mayer v. Midwest Physician Administrative Services, LLC d/b/a Duly Health and Care. It concerns Midwest Physician Administrative Services, LLC doing business as Duly Health and Care. The lawsuit mentioned the following eight claims: violation of the federal Electronic Communications Privacy Act (ECPA), violation of the Illinois Eavesdropping Statute; violation of the Illinois Uniform Deceptive Trade Practices Act; violation of the Illinois Consumer Fraud and Deceptive Business Practices Act; breach of confidence; breach of implied contract; invasion of privacy-intrusion upon seclusion; and negligence.

Duly Health and Care denies all wrongdoing and filed a motion to dismiss the lawsuit for failure to state a claim. Six of the eight claims were dismissed. The lawsuit proceeded to address the violation of the ECPA and the claim of negligence.

Settlement Terms

The court already gave preliminary approval of the settlement. The settlement requires Midwest Physician Administrative Services to establish a $3.1 million fund. Eligible individuals, those who logged into the authenticated portion of dulyhealthandvcare.com from July 24, 2020 to April 10, 2023 may submit claims for compensation under the terms described in the settlement agreement. The last day to file a claim is March 2, 2026. The last day to file an objection to or exemption from the settlement is March 2, 2026. The final fairness hearing is April 7, 2026.

Image credit: Narongsag, Adobestock / logo©DulyHealth

Twitter Facebook LinkedIn Reddit Copy link Link copied to clipboard
Photo of author

Posted by

John Blacksmith

John Blacksmith is a journalist with several years experience in both print and online publications. John has specialised in Information technology in the healthcare sector and in particular in healthcare data security and privacy. His focus on healthcare data means he has specialist knowledge of the HIPAA regulations. John has a degree in journalism and many years experience.
Twitter
LinkedIn