• by Wendy Davis  @wendyndavis, August 26, 2022

Meta users who are suing over claims that it tracks their visits to hospital websites are now seeking a court order that would prohibit the social-networking platform from gathering or using patient information obtained from websites of entities covered by the federal medical privacy law.

“On a daily basis, Meta intercepts personally identifiable medical information and the content of patient communications which it then monetizes for its own financial gain,” counsel for the users writes in papers filed Thursday with U.S. District Court Judge William Orrick in the Northern District of California. “Meta’s conduct is unlawful and will continue to affect patients of medical providers around the country without this court’s intervention.”

The request for an injunction comes in a lawsuit initially filed in June, when a Maryland resident and MedStar Health patient, who proceeded as an anonymous “John Doe,” alleged that the company violates users' privacy by collecting and monetizing sensitive medical data from hospital websites.

The complaint was filed shortly after The Markupreported that 33 of the country's top 100 hospitals have a Meta tracking pixel on their sites.

That pixel sends Facebook IP addresses of people who use the hospital sites to schedule a doctor's appointment, according to The Markup. 

In addition, Meta potentially can draw on tracking cookies to identify some patients who are logged in to Facebook when they visit a hospital site, according to The Markup.

The news organization reported finding Meta'x pixel inside password-protected portals of seven health systems.

The Markup also said hospitals in those systems may have violated the federal Health Insurance Portability and Accountability Act, which prohibits doctors and hospitals from sharing information about patients without their consent.

The Health Insurance Portability and Accountability Act doesn't restrict Facebook from sharing data. But the users alleged that Facebook misrepresented its policies by collecting information from outside websites that weren't allowed to disclose the data.

After the lawsuit was initially filed, three other Meta users raised similar allegations. The cases were consolidated and an amended complaint, filed in July, alleges that Meta receives information from 660 entities covered by the federal health privacy law.

The complaint also alleges that Meta monetizes this data with ads.

The users claim Facebook broke its contract with users and also violated California privacy laws and the federal wiretap law.

Facebook previously defeated allegations that it violated users' privacy by collecting health-related data from outside websites like the American Cancer Society via the “Like” button.

In that matter, the 9th Circuit Court of Appeals said the type of general web-browsing data allegedly collected was not covered by the federal health privacy law.

“Information available on publicly accessible websites stands in stark contrast to the personally identifiable patient records and medical histories protected by these statutes -- information that unequivocally provides a window into an individual’s personal medical history,” the 9th Circuit judges wrote in a 2018 ruling.

The court in that case also upheld a finding that Facebook users consented to the data collection by accepting the company's terms of service, which disclosed that it collects data from outside websites.

Lawyers in the current case argue that their matter is different for several reasons. Among others, the prior lawsuit didn't involve websites covered by the Health Insurance Portability and Accountability Act.

In addition, Meta allegedly revised its privacy policy in April of 2018 to state that it would only collect information from “partners” that “have lawful rights to collect, use and share” users' data.

Meta has not responded to MediaPost's request for comment.

The tech company is expected to file papers with Orrick next month, and he could hold a hearing on the request for an injunction in October.