Duke University Health System $3.74M MyChart Privacy Tracking Settlement

Between Feb. 18, 2019, and June 17, 2022, patients and other individuals who logged into Duke University Health System’s MyChart patient portal or MyDuke Health mobile app were allegedly exposed to privacy risks from website/app “tracking” technology. The lawsuit claimed that tools embedded in Duke’s online services—such as a third-party “pixel”—may have collected or transmitted personal or health-related information to an outside vendor when users accessed the system. In a fast-changing digital health landscape, these kinds of tracking practices are often scrutinized because they can blur the line between convenient analytics and impermissible disclosures of sensitive data. The case was filed as a class action seeking redress for improper disclosure and alleged privacy invasion, with Duke agreeing to settle for $3.74 million to resolve the claims (while denying wrongdoing). The settlement is significant because it offers potential cash payments to a large class—about 872,634 people—who may file claims for a pro rata share of the net settlement fund, with the final amount depending on how many claims are submitted. It also reflects broader pressure on health providers and tech vendors to align digital operations with evolving privacy expectations and legal frameworks, including requirements under HIPAA (for protected health information) and the Health Breach Notification Rule, as well as consumer privacy laws like state-level statutes that govern information sharing and data tracking. Similar cases across the industry have focused on whether common web technologies can disclose health-related data without appropriate safeguards or consent, underscoring why regulators and courts increasingly examine how “pixels,” tracking scripts, and third-party analytics are implemented on patient-facing portals and apps.