Judge allows class-action suit against Baystate Health to proceed

A federal judge has denied Baystate Health’s motion to dismiss a class-action lawsuit accusing the non-profit hospital system of secretly sharing patients’ website activity with Meta and Google.

In a March 19 order, U.S. District Judge Julia E. Kobick allowed all four of plaintiff Jane Doe’s claims to move forward: a federal wiretap claim, a Massachusetts privacy claim, breach of implied contract and breach of fiduciary duty. 

The case carries potentially enormous financial stakes. As The Shoestring first reported in December, Doe’s federal wiretap claim is brought under a law that allows damages of up to $10,000 per violation, meaning Baystate could be ordered to pay tens or even hundreds of millions of dollars, depending on how many users were affected. By bringing the case as a class-action suit, Doe is seeking to combine the claims of many other patients whose individual cases would likely be too small or costly to pursue on their own. 

In its motion to dismiss, Baystate included a U.S. Chamber of Commerce brief from a similar case arguing that allowing lawsuits like this to proceed could expose other hospital systems using tracking tools to comparable litigation and potentially massive liability.

Doe, a Ludlow woman identified in court papers by a pseudonym, alleges that Baystate embedded Meta Pixel and Google Analytics on its public website to track patients’ healthcare-related activity and send that data to the tech companies without consent. She says Facebook’s “Off-Facebook Activity” report showed about 80 instances of Baystate transmitting data about her website use to Meta between November 2021 and April 2023.

Baystate denied wrongdoing in its motion to dismiss, arguing the lawsuit was “devoid of basic factual support” because the report did not show exactly what was shared and because, in its view, activity on a public hospital website is not protected health information. Doe’s lawyers acknowledged the report was “incomplete” but said the complaint still contained enough detail to proceed, writing, “Discovery will show the full scope of Defendant’s disclosures to Meta and Google.”

Kobick wrote that Baystate’s argument “ignores Doe’s factual allegations, which describe her specific information that Baystate allegedly disclosed.” According to the order, those allegations included Doe’s status as a Baystate patient, her searches for breast cancer screenings and providers, and her scheduling of a mammogram, which the judge said could qualify as “medical information of a highly intimate or personal nature.”

Kobick rejected Baystate’s argument that its use of tracking tools for marketing and analytics outweighed Doe’s privacy interests at this stage, writing that the issue is “a question of fact not suitable for resolution on a motion to dismiss.”

The judge also refused to throw out Doe’s federal wiretap claim. Baystate had argued that because it was a party to communications on its own website, it could not be liable under the law and that its use of the tracking tools was for lawful commercial purposes. But Kobick disagreed, finding that Doe had plausibly alleged Baystate may have intercepted the communications “for the purpose of facilitating some further impropriety” – namely, violating Massachusetts privacy law by disclosing Doe’s private health information without consent.

The order further rejected Baystate’s argument that the data at issue was merely generic metadata. Kobick found that Doe had described specific searches, actions and identifiers that could qualify as protected “contents” under the federal wiretap law.

The ruling clears the way for discovery, where Doe’s lawyers can seek internal documents, technical records and other evidence showing what Baystate sent to Meta and Google, how the tracking tools were configured, and what the hospital knew about the disclosures.

Baystate and lawyers for Doe did not respond to multiple requests for comment on the case and ruling.