25% off all training courses Offer ends June 26, 2026
View HIPAA Courses
25% off all training courses
View HIPAA Courses
Offer ends June 26, 2026

The HIPAA Journal is the leading provider of HIPAA training, news, regulatory updates, and independent compliance advice.

Columbus Regional Health; St. Joseph Hospital Settle Pixel Privacy Lawsuits

Settlements have been agreed to resolve class action lawsuits against two healthcare providers over their use of website tracking technologies. The lawsuits alleged that the deployment of these tools caused the personal and protected health information of patients to be disclosed to third parties without patients’ knowledge or consent.

Website tracking tools, such as pixels, are installed on websites across the internet for tracking the actions of website users. They can record a range of information about user interactions, such as the pages visited, time spent on each page, how the user navigated to the website, and other information. That information may be sent to the third-party providers of the tools, allowing the user to be tracked as they navigate to other webpages. They may then be served targeted advertisements across the internet based on their actions on a website where the tools were installed. For instance, if an individual visited a page related to obesity, they may be served adverts related to weight loss medications.

Many lawsuits have been filed against healthcare providers over website tracking tools, alleging privacy violations. Two of the latest lawsuits to be settled were filed against Bartholomew County Public Hospital d/b/a Columbus Regional Health and St. Joseph Hospital of Nashua, N.H. In both cases, the defendants maintain that there was no wrongdoing, no laws were violated, and there is no liability; however, settlements were agreed to avoid the cost, distraction, and risks of continuing with the litigation.

Columbus Regional Health Pixel Settlement

Bartholomew County Public Hospital d/b/a Columbus Regional Health is a non-profit regional health system that includes a 225-bed Columbus hospital serving patients in southeastern Indiana. Columbus Regional Health was alleged to have collected and transmitted patient data to Meta (Facebook) via Meta Pixel and other tracking tools on its website without the knowledge or permission of website users. The first lawsuit was filed in May 2023 – Brian Elkins and Annie Elkins v. Bartholomew County Public Hospital d/b/a Columbus Regional Health  – in Marion County Superior Court, with a further three plaintiffs joining the action after filing similar complaints.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The consolidated lawsuit asserted claims for negligence, negligence per se, invasion of privacy—intrusion upon seclusion, invasion of privacy—public disclosure of private facts; breach of implied contract; unjust enrichment; breach of fiduciary duty; and violation of the Indiana Deceptive Consumer Sales Act.

Settlement Terms

Claims may be submitted for a one-time cash payment of $25.50, and class members will be automatically enrolled in a 12-month membership to the CyEx Privacy Shield Pro digital privacy and identity protection service. The defendant has agreed to cover the cost of attorneys’ fees and expenses, settlement administration and notification costs, and service awards for the 5 class representatives. The deadline for opting out and exclusion has passed.

Eligibility: Individuals who resided in Indiana and completed a registration for access to their electronic records or logged into the patient portal between November 1, 2017, and June 30, 2022.

Claims deadline: September 19, 2026

Final approval hearing: July 22, 2026

Further information: https://columbusregionalsettlement.com/

St. Joseph Hospital of Nashua, N.H. Pixel Settlement

St. Joseph Hospital Corporate Services, Inc. is a New Hampshire healthcare corporation that operates the 208-bed St. Joseph Hospital in Nashua. The hospital is alleged to have used tracking technologies on its website that disclosed website users’ sensitive information to Microsoft, without their knowledge or consent. The plaintiffs alleged that the data collected via the tools was used to enhance Microsoft’s advertising technology and serve targeted advertisements to patients based on the information disclosed on the defendant’s website.

The first lawsuit was filed in the Superior Court of Hillsborough County, New Hampshire, which was later amended, due to an inaccuracy in the defendant’s corporate entity – Fiorillo, et al., v. St. Joseph Hospital of Nashua, N.H. The lawsuit asserted claims including negligence, invasion of privacy – intrusion upon seclusion, and unjust enrichment.

Settlement Terms

Claims may be submitted for a one-time cash payment of $50 per class member. The defendant has also agreed to pay attorneys’ fees and expenses, settlement administration and notification costs, and service awards to the class representatives.

Eligibility: Individuals who used the MyChart patient portal associated with St. Joseph Hospital from January 1, 2023, to the present.

Opt out and exclusion deadline: July 30, 2026

Claims deadline: August 14, 2026

Final approval hearing: September 14, 2026

Further information: https://columbusregionalsettlement.com/

Author: Steve Alder is the editor-in-chief of The HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered in The HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has 10 years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics. Steve shapes the editorial policy of The HIPAA Journal, ensuring its comprehensive coverage of critical topics. Steve Alder is considered an authority in the healthcare industry on HIPAA. The HIPAA Journal has evolved into the leading independent authority on HIPAA under Steve’s editorial leadership. Steve manages a team of writers and is responsible for the factual and legal accuracy of all content published on The HIPAA Journal. Steve holds a Bachelor’s of Science degree from the University of Liverpool. You can connect with Steve via LinkedIn or email via stevealder(at)hipaajournal.com

x

Is Your Organization HIPAA Compliant?

Find Out With Our Free HIPAA Compliance Checklist

Get Free Checklist