Sutter Health 21.5M Settlement Over Patient Portal Tracking and Privacy Violations

Sutter Health, a major California health system, agreed to a $21.5 million settlement in a class action over allegations that its MyHealthOnline patient portal and related webpages used third‑party tracking tools—often called pixels, cookies, or analytics tags—that could transmit data to companies such as Google and Facebook. The plaintiffs claim that when California residents logged into their portal for their own healthcare between June 10, 2015, and March 20, 2020, these technologies disclosed personally identifying information and details about portal activity in ways patients didn’t expect from a healthcare provider. The lawsuit was filed because plaintiffs allege those disclosures violated California privacy laws and long-standing expectations of medical confidentiality, even if the shared data wasn’t a full medical record. Its significance lies in the growing scrutiny of “invisible” web tracking in healthcare: patient portals and appointment/payment pages can reveal sensitive inferences (for example, that someone sought care from a specific provider or specialty) and plaintiffs argue that sharing such signals with ad-tech platforms crosses legal and ethical lines. Without admitting wrongdoing, Sutter Health agreed to resolve the claims; eligible class members who submit a timely claim may receive a share of the net fund (estimated up to about $90 depending on participation), with key dates including an exclusion/objection deadline of Jan. 23, 2026, a claim deadline of April 28, 2026, and a final approval hearing on Feb. 27, 2026. More broadly, this case fits a nationwide wave of litigation and regulatory enforcement targeting hospitals and telehealth providers for deploying marketing pixels and analytics on pages tied to patient accounts, scheduling, or symptom searches. Industry rules and standards overlap here: HIPAA restricts how “protected health information” can be used and disclosed by covered entities and their vendors; California’s medical privacy protections (including the Confidentiality of Medical Information Act) and consumer privacy frameworks increase risk when online identifiers and health-related interactions are shared without appropriate notice, consent, and contracting controls. As healthcare organizations modernize digital front doors, the settlement underscores a wider compliance push to audit trackers, limit third‑party scripts, and treat web telemetry connected to care-seeking as sensitive data rather than routine marketing analytics