Gabrielle Russon
When Orlando Health patients use the hospital chain’s website, some of their private information is sent to Facebook which knows “every click, keystroke, and intimate detail” about their medical treatment, according to allegations raised in a new federal lawsuit.
An anonymous Orlando Health patient filed the lawsuit seeking class-action status this month in U.S. District Court.
Orlando Health doesn’t comment on pending litigation, said hospital spokeswoman Kena Lewis. The attorneys representing the anonymous plaintiff, “W.W.,” did not respond to a request for comment.
“Information about a person’s physical and mental health is among the most confidential and sensitive information in our society, and the mishandling of medical information can have serious consequences,” W.W. said in the lawsuit as she accused Orlando Health of “outrageous, illegal, and widespread practice” of embedding undetectable Facebook tracking code on its website.
“By installing the Facebook Pixel on its Website, (Orlando Health) effectively planted a bug on (W.W.) and Class Members’ web browsers and compelled them to disclose their communications with (Orlando Health) to Facebook,” the lawsuit said.
Facebook uses that information for targeted advertisements or to sell it to third-party marketers, the lawsuit said, adding it was possible to glean if someone is pregnant or has cancer, dementia or HIV or considering weight loss surgery, for example.
Patients have no idea what’s happening behind the scenes as their privacy is invaded, said the lawsuit which called it a violation of HIPAA, a federal law protecting patient’s privacy.
“W.W.” is described as a Florida resident who has been treated since 2010 at an unspecified Orlando Health hospital and used the hospital chain’s website and digital platforms several times.
The lawsuit mentions Facebook Pixel, tracking data that “co-opts a website user’s browser and forces it to transmit information to Facebook in addition to the website owner.”
What’s also of concern, the lawsuit says, is Facebook’s Conversions Application Programming Interface which “tracks the user’s website interaction, including Private Information, records and stores that information on the website owner’s servers, and then transmits the data to Facebook from the website owner’s servers.”
“In this case, (Orlando Health) employed the Pixel and Conversions API to intercept, duplicate, and re-direct Plaintiff’s and Class Members’ Private Information to Facebook,” the lawsuit said.
The 79-page lawsuit includes screenshots of code and what happens if, for example, the lawsuit says if someone searches for a cardiologist on Orlando Health’s website or tries to communicate with a weight-loss surgeon. If someone types “I have dementia” on the website’s search bar, that exact phrase is sent to Facebook, “allowing the user’s medical condition to be linked to their individual Facebook account for future retargeting and exploitation,” the lawsuit claimed.
“At present, the full breadth of (Orlando Health’s) tracking and data sharing practices is unclear,” the lawsuit said. “But other evidence suggests (Orlando Health) is using additional tracking pixels and tools to transmit its patients’ Private Information to additional third parties.”
