Class Action Lawsuit Challenges Google Portal Tracking
Healthcare providers must review third-party code in patient portals to mitigate privacy and compliance litigation risks.
Updated on Oct. 16, 2026 in Healthcare
Live Poll
Do you trust tech companies to handle your private health information when you use medical websites?
Plaintiffs have requested that a U.S. federal judge certify a class action against Google for allegedly tracking patient health information. The proposed class encompasses users who accessed portals containing Google source code across six specific healthcare systems between October 2017 and the present.
Why it matters
The litigation highlights the growing operational risks surrounding third-party tracking code embedded in patient-facing digital portals. Operators utilizing similar analytics tools in sensitive data environments now face increased scrutiny regarding their compliance with patient privacy standards like HIPAA.
The proposed class action covers users across 6 named healthcare systems, following allegations of unauthorized data tracking occurring from October 2017 through the present. The scope of potential damages and the exact number of affected accountholders remain unknown.
The players
A global technology firm providing search, advertising, and cloud computing services.
Kaiser Permanente
A major integrated managed care consortium operating numerous hospitals and medical offices.
MedStar Health
A not-for-profit health system serving the mid-Atlantic region with multiple hospitals and clinics.
The details
Plaintiffs allege that Google used its source code embedded within patient portals to monitor online user movements and health-related communications. This legal action targets the presence of tracking software in systems operated by Gundersen Health System, Kaiser Permanente, Tallahassee Memorial HealthCare, MedStar Health, Shannon Medical Center, and Edward-Elmhurst Health. The case examines whether this data collection violated patient privacy regulations under the Health Information Portability and Accountability Act.
Timeline
October 2017 to present: Period of alleged patient portal tracking.
October 16, 2026: Plaintiffs filed the request for class certification.
Market Landscape
This case follows a pattern of increasing legal challenges regarding data privacy and the use of third-party tracking software in digital healthcare. It specifically tests the boundaries of the Health Information Portability and Accountability Act in an era where patient portals rely heavily on external web technologies.
Operators managing patient-facing digital portals should audit their sites for third-party tracking scripts to ensure compliance with privacy regulations. Reviewing vendor agreements regarding data collection and pixel usage is an essential step to mitigate potential liability.
The takeaway
This case serves as a signal for healthcare operators to review the technical architecture of their digital touchpoints. Monitor for judicial decisions on class certification, as these rulings will define the scope of liability for providers using similar patient portal configurations.
Further reading
For broader trends in industry compliance, read the latest analysis in Healthcare.
Source note: This article includes information reported by Mlex.
Live Poll
Do you trust tech companies to handle your private health information when you use medical websites?
