A snippet of tracking code you probably did not install yourself has cost healthcare organizations more than $100 million. Not in fines. In settlements. Paid out to patients by hospitals and practices whose only mistake was running the same marketing tools everyone else runs.
If your website has a Meta Pixel, Google Analytics, a session replay tool, or call tracking, and you treat patients, this is about you.
This Is Not Theoretical. It Is a Settlement List.
The tracking-pixel litigation wave is real, and it is expensive. A consolidated look at these cases from 2023 to 2025 found north of $100 million in settlements and penalties across roughly 19 cases. That number is growing.
A few of the names:
- Sutter Health: settled for $21.5 million, with final approval in early 2026. Sutter ran Google Analytics and the Meta Pixel on its patient portal. When patients logged in to check lab results or book appointments, the code reported that activity to third parties.
- Advocate Aurora: settled for $12.25 million.
- A steady run of others: Reid Health, Jefferson Healthcare, Skagit Regional, Redeemer Health, MarinHealth, Henry Ford, Eisenhower Health, and the University of Rochester Medical Center. The names change. The story does not.
And it is not just hospitals. Aspen Dental settled a tracking case with funds north of $18 million. Dental practices. The plaintiffs' bar is not limiting itself to big health systems, and it is not going to stop at the ones with deep pockets.
What Makes This Different From HIPAA
A federal court recently narrowed how far HIPAA reaches over website tracking on public pages. Here is the catch that nobody mentions: these lawsuits mostly do not run on HIPAA.
They run on state law. California's Invasion of Privacy Act, the Confidentiality of Medical Information Act, state wiretap statutes, unfair competition laws, and the federal Wiretap Act. The Sutter case leaned on three California statutes at once.
That matters more than anything else here. The HIPAA narrowing does not protect you from these claims. A plaintiff does not need a federal regulator to act first. They need a law firm, your website, and a browser. The cost of opening a case against you is almost nothing. The cost of defending one is not.
"But My Agency Told Me the Pixel Was Safe"
This is the part that should worry every practice owner, because it is usually true and it did not help.
Houston Methodist got sued over its Meta Pixel. Two advertising agencies had told the hospital the pixel was safe to use. The hospital actually won, on summary judgment, because the court found no intent to break the law.
Read that again. They won. And winning meant years of litigation, legal fees, and a court fight, with a best-case outcome of "we did not have to pay the class." That is the good ending. Most organizations never get it. They settle, because settling is cheaper than rolling the dice in front of a jury.
“The agency that dropped the tracking code on your site is not the one writing the check. You are.”
What the Pixel Actually Does
A pixel is a few lines of JavaScript. It sits on your pages and reports back. On a restaurant's website, fine. On a healthcare site, it can transmit the page someone visited, the fact that they clicked "book a consultation," the treatment they were reading about, their IP address, and their device ID, straight to Meta or Google, in real time, while the visitor has no idea any of it is happening.
Tie that signal to a page about a specific procedure, and a third party now knows a specific device is interested in a specific health service. That is the entire theory of the case. It has been enough to settle nineteen times over.
Researchers found the Meta Pixel sitting on the patient portals of at least 33 major health systems. A federal judge has even ordered Meta's CEO to sit for a deposition in the consolidated litigation. This is not a fringe risk anymore. It is a category of lawsuit with its own playbook.
What to Actually Do
This is not "rip out all your marketing." It is "be deliberate about what loads where."
- Inventory every script on your site: You cannot fix what you have not found, and most practices have no idea what is actually running on their pages.
- Get tracking off sensitive pages and out of anything behind a login: Treatment pages, appointment flows, and patient portals are exactly where these cases live.
- Stop sending identifiers to vendors who never signed a BAA: Meta and Google are not your business associates, and they were never going to be.
- Use server-side, consent-gated, or privacy-safe measurement: There are ways to measure performance that do not broadcast patient intent to ad platforms.
- Get consent before anything fires, and say so plainly: "The tracking ran before the user agreed to it" is a recurring line in these complaints. Do not hand a plaintiff that sentence.
The Bottom Line
Your pixel is a marketing tool right up until the day it becomes Exhibit A. The organizations that paid out were not reckless. They were normal. They ran the same stack as everyone else, trusted whoever built the site, and learned the hard way that "everyone does it" is not a legal defense.
At Anvixa, we audit what is actually loading on your site, pull the exposure off your sensitive pages, and rebuild your measurement so you still get marketing data without shipping patient intent to Meta. If you cannot say for certain what your site is sending right now, that uncertainty is the tell. It is the first thing to fix.