SSM Health will pay individuals who used its MyChart patient portal while it had active tracking tools installed. The individuals whose personal data and health information were disclosed to third parties like Meta and Google will receive a cash payment. They will also receive a membership that offers a digital privacy and identity protection service for 12 months.
On December 5, 2022, the Jane Doe v. SSM Health Care Corporation, d/b/a SSM Health lawsuit was filed in the Circuit Court for the City of St. Louis in the State of Missouri. Allegedly, SSM Health installed Meta Pixel and other third-party tracking codes on its MyChart patient portal, which allowed the collection and transmission of protected health information (PHI) to third-party tracking companies. The following PHI were potentially disclosed to third parties without patient knowledge or consent: patient status, their doctors, medical conditions, treatments, healthcare facilities visited, and other sensitive information.
Tracking codes are used widely all over the internet to monitor user activity on web pages. The information gathered by these tools may be employed for promotion and marketing requirements. In healthcare, when using these tools on authenticated web pages like patient portals, sensitive health information can be collected and transmitted to technology providers. Such data disclosures violate HIPAA laws except if a business associate agreement is signed or there are legal HIPAA authorizations.
The plaintiff claimed that the use of these tools by SSM Health shows negligence. The lawsuit likewise mentioned claims of privacy violation – intrusion upon seclusion, unjust enrichment, breach of fiduciary duty, breach of implied contract, and a violation of the Illinois Consumer Fraud and Deceptive Practices Act. SSM Health does not admit any of the claims and arguments asserted in the lawsuit and states no wrongdoing; nevertheless, SSM Health agreed to settle the lawsuit and avoid the risks, expenses, and uncertainty of a jury trial. The class lawyer and the plaintiff consider the settlement to be reasonable.
The terms of the settlement identify those who visited the SSM Health MyChart patient portal from July 6, 2020 to February 10, 2023, while tracking tools were active, as the class members who can claim a cash payment of $31.50. Additionally, they will be provided a membership to the CyEx Privacy Shield Pro service for one year, which offers data broker opt-out, dark web monitoring, and identity protection services.
The court has given preliminary approval of the settlement with the final fairness hearing of the SSM Health Lawsuit scheduled for November 21, 2025. Those who wish to opt out of or exempt themselves from the settlement can do so on or before October 27, 2025. Claims must be filed on or before November 25, 2025.
More information is available on SSM Health’s settlement website: https://ssmhealthdatasettlement.com/
Image credit: Rumput, AdobeStock / logo©SSMHealth
