Website Tracking Lawsuits: What Healthcare Providers Need to Know

What’s happening

Plaintiffs’ firms and pro se plaintiffs are suing medical practices over the tracking tools that run on their websites. In a typical recent case, a single website visitor sued a Florida cosmetic surgery practice claiming its site collected his data without consent. These suits are cheap to file, easy to copy, and aimed at practices of every size.

What the lawsuits claim

• Tracking without consent. Cookies, pixels and third-party scripts (analytics, advertising, chat tools) load the moment a visitor opens the site, before any notice or choice.
• “Wiretapping” violations. Plaintiffs argue that capturing a visitor’s IP address, device details and browsing activity is an illegal interception under state wiretap laws, such as the Florida Security of Communications Act.
• Data shared with third parties. The collected data is allegedly sent to advertisers and data brokers who identify and track the visitor across the internet.
• Invasion of privacy. A companion claim that the practice intruded on the visitor’s private affairs.

Why it matters

The Florida statute allows at least $1,000 per plaintiff (or $100 per day of violation), plus possible punitive damages and the plaintiff’s attorney’s fees. Individual claims are small, but defense costs often exceed the demand, which pressures practices to settle, and any website visitor can bring one. Tracking on pages involving appointments, patient portals or health conditions can also raise separate HIPAA concerns.

What if I’m not in Florida?

Although many of these suits have been filed in south Florida, they are not limited to Florida. The same claims are being filed across the country, and because a website reaches visitors everywhere, a practice may be sued under the law of the state where the visitor is located, not only where the practice operates.

• Other “all-party consent” states. California, Pennsylvania, Washington, Maryland, Illinois and several other states, like Florida, require every party’s consent to intercept a communication. California’s Invasion of Privacy Act, which allows $5,000 per violation, is the most heavily litigated, and Pennsylvania’s wiretap law carries the same $1,000 minimum as Florida’s.
• Federal wiretap claims. The federal Wiretap Act generally requires only one party’s consent, but plaintiffs argue that exception does not apply when health information is disclosed in violation of HIPAA. That theory is aimed squarely at healthcare providers.
• State health privacy laws. Some states have added consent rules for consumer health data. Washington’s My Health My Data Act, for example, lets individuals sue directly.
• One-party consent states are not a safe harbor. Practices in one-party consent states, like Georgia, can still face federal claims, privacy claims, and suits by visitors located in other states.

Courts are divided on these theories, and many cases have been dismissed, but defending even a weak case is expensive. The steps below reduce risk in every state.

Steps to take now

1. Inventory your website’s tracking tools. Ask your web developer or vendor for a list of every cookie, pixel and third-party script on your site and what data each one sends.
2. Add a cookie consent banner. Many low-cost or free tools are available. The banner should appear on the first visit and clearly explain what is collected and why.
3. Block tracking until the visitor agrees. Non-essential cookies and scripts should not load until the visitor clicks “Accept.” A banner that appears after tracking has already started does not solve the problem.
4. Give a real choice. Offer “Reject All” as prominently as “Accept,” and an easy way to change settings or opt out later.
5. Update your privacy policy. Describe the tracking tools you use, who receives the data, and how to opt out, and link to it from every page.
6. Remove what you don’t need. Turn off advertising pixels and trackers that serve no clear purpose, especially on pages about appointments, conditions or treatments.
7. Review vendor contracts. Confirm website, marketing, and chat vendors are not using visitor data for their own purposes, and get a business associate agreement where required.
8. Recheck regularly. Plugins and marketing tools add new trackers over time. Review the site at least once a year and after any redesign.

If you are served with legal papers.

Do not ignore it. These cases often carry short deadlines and required court appearances. Notify The Doctors Company right away and contact counsel.

Questions: Brittany Cambre, bcambre@gwbfirm.com, Grubman Warner Berry.

This alert is for general information only and is not legal advice. Laws vary by state; consult counsel about your specific situation.