How to file a claim in Northwell Health patient data sharing lawsuit settlement

New Hyde Park-based Northwell Health has agreed to settle a class-action lawsuit alleging it shared patient data without consent with third parties, including Meta and Google.

New York residents Eryn Kaplan, Michael Zuri and Kathyann McClendon, in a lawsuit filed in New York Supreme Court in Brooklyn in 2023, said Northwell embedded Meta Pixel and Google Analytics tracking technology onto its website and patient portal that "surreptitiously forced" plaintiffs to transmit their private information.

The lawsuit accused the health system of violating federal and New York law protecting patient privacy.

The complaint said the plaintiffs suffered invasion of privacy, a diminution of the value of their private information, statutory damages and ongoing risk to their private information.

Northwell Health, which serves 3 million patients in New York and in Connecticut, and oversees 900 patient care locations including 28 hospitals, told Newsday it "did not admit to any wrongdoing in agreeing to settle the matter."

Lawyers representing Kaplan, Zuri and McClendon did not return messages.

Under the settlement, Northwell Health will offer cash payments and privacy monitoring to eligible patients. Those eligible need to submit a claim form online or postmarked by April 20. The court will hold a hearing on April 21 to determine whether the settlement should be approved, according to the agreement. 

Northwell’s settlement, announced on Nwpixelsettlement.com, covers two classes of people, according to the site.

Patients who logged into the health system’s FollowMyHealth patient portal between Jan. 1, 2020, and Dec. 31, 2023, or booked an appointment on Northwell’s website in that time period are eligible for a $15 payment and 12 months of privacy monitoring.

The second category includes all other Northwell patients between Jan. 1, 2020, and July 25, 2024. These claimants will get 12 months of privacy monitoring but no payment.

Other lawsuits

Northwell Health is among a handful of health care systems nationwide that have faced lawsuits over data tracking claims.

Rockville Centre-based Catholic Health, which operates six Long Island hospitals, is a completely separate entity from the Catholic Health that operates five hospitals in western New York, which settled a similar lawsuit involving its facility in Buffalo.

The lawsuit against Catholic Health in Buffalo alleged that Catholic Health’s disclosure of patients’ personal data to third parties, including Meta, violated state and federal statutes. Catholic Health denied wrongdoing. The final approval hearing is on April 23.

Since the U.S. Department of Health and Human Services implemented national standards in the treatment of protected health information through its privacy rule in 2003, the agency has received more than 374,000 complaints, initiated 1,193 compliance reviews and resolved 99% of the cases. HHS said it settled or imposed a financial penalty in 152 cases totaling $144.8 million.

Alex Hamerstone, advisory solutions director at TrustedSec, an information security company in Ohio, said tracking pixels were extremely common, and were "used by organizations across almost all verticals, including health care organizations."

Hamerstone said he’s seen other cases involving violations of federal law restricting release of medical information. "In fact, this has become an area for a lot of litigation in the past couple years," he said.

Alla Valente, principal analyst at Forrester specializing in security and third-party risk management, said, "When you have these marketing strategies that don’t factor the security and the risk implications, they end up jeopardizing patients and also the reputation of these hospital organizations." 

Kurt Bratten, a lawyer for O’Connell & Aronowitz in Albany who counsels health care providers on privacy and security, said tracking tools were ubiquitous, but health care companies shouldn’t use third parties.

He said some health care providers were not consciously managing tracking technologies.

"They’re just falling into it," Bratten said.

He said plaintiffs who filed class action lawsuits were probably more interested in privacy monitoring than the payouts.

"They’re not doing this for $15," he said. "They’re doing this because they’re concerned about their data."