Atrium Health Patient Portal Pixel Settlement: $1.8M, in State Court

The Atrium Health pixel settlement matters less for its size than for its venue. Atrium Health — the Charlotte-Mecklenburg Hospital Authority, one of the largest health systems in the Southeast — agreed to pay $1.8 million after tracking pixels on its websites and patient portals allegedly disclosed patients' information to third parties including Meta. But this wasn't a CIPA case in a California federal court. It was brought in a North Carolina state court, under HIPAA and state privacy law. For any operator who has been quietly reassuring themselves that pixel litigation is a California phenomenon, or a federal-court phenomenon, Atrium Health is the case that closes both escape hatches.

What the case is about

In Roberts v. The Charlotte-Mecklenburg Hospital Authority, plaintiffs alleged that Atrium Health "surreptitiously embedded" tracking pixels into its website that disclosed patients' private information to third parties — including Meta — for targeted advertising, without patients' consent. The conduct centers on the MyAtriumHealth and MyCarolinas patient portals, the logged-in environments where patients manage their care.

The settlement, which received preliminary approval in May 2026, totals $1,800,000 and is split across two groups of patients defined by when they used the portals. It's structured so that one group shares a larger pro rata fund and a second, broader group receives smaller fixed payments. The case reached its final-approval stage at the end of September 2026.

The detail that makes it matter

Every operator looking for a reason this "doesn't apply to me" eventually lands on one of two: "that's a California (CIPA) problem" or "those are federal class actions." Atrium Health refutes both in a single filing. It was brought in state court, under state law and HIPAA theories, in North Carolina. No CIPA. No federal wiretap claim as the headline. Just state privacy law and health-information rules applied to the same conduct — a pixel on a patient portal sharing data without consent.

This is the quiet but crucial message of the healthcare pixel wave: the theory is venue-agnostic and statute-agnostic. California has CIPA; Pennsylvania has its wiretap act (WESCA, used in Penn Medicine); North Carolina has its own privacy law and HIPAA-based theories. A plaintiff doesn't need the "best" statute — they need a statute, and nearly every state supplies one. Defending against a single law while the same conduct is actionable under a dozen others is a strategy that only looks like protection.

There's a scale lesson hiding here too. Atrium Health is not a small, under-resourced clinic that didn't know better — it's one of the largest health systems in the Southeast, with a serious compliance function and the budget to run it. If a tracking pixel could sit on its patient portals long enough to produce a class action reaching back to 2015, the problem clearly isn't a lack of sophistication or resources. It's that this specific failure mode — a marketing tag quietly loading on a sensitive page — slips past exactly the governance that catches more obvious risks. It's small, technical, and invisible in a normal compliance review, which is precisely why it survives in organizations that are otherwise careful.

State court, HIPAA, no CIPA

The Atrium Health claims rest on HIPAA and state privacy law rather than California's CIPA or the federal Wiretap Act. A clarification worth making: individuals generally can't sue directly under HIPAA — there's no private right of action in the statute itself. What plaintiffs do is use HIPAA as the standard of care that state-law claims (negligence, invasion of privacy, breach of fiduciary duty, state consumer-protection statutes) borrow from. HIPAA defines what "protecting health information" should look like; state law provides the vehicle to sue when that standard allegedly wasn't met.

That mechanism is why these cases are so portable. Almost every state recognizes some privacy tort or consumer-protection claim, and HIPAA supplies a ready-made benchmark for health data. Stack them together and a plaintiff in North Carolina — or almost anywhere — has a workable path, no CIPA required.

It also carries a subtle disadvantage for defendants that's worth understanding. Because the claim borrows HIPAA's standard rather than suing under it, the defense can't simply argue "HIPAA doesn't give you the right to sue me" — that's true, but beside the point, because the plaintiff isn't suing under HIPAA. The negligence or privacy claim stands on its own state-law footing, with HIPAA brought in only to define what reasonable care looked like. That framing lets plaintiffs harness HIPAA's detailed, well-known rules about protecting health information without being limited by HIPAA's enforcement structure. For a health system, it means the familiar comfort of "HIPAA has no private right of action" offers far less protection than it sounds like it should.

The two-group class structure

Atrium Health's settlement is a useful illustration of how these classes actually get built, because it uses two tiers. Group 1 covers patients who accessed the portal in an earlier window (January 2015 to July 2019) and shares the larger portion of the fund on a pro rata basis. Group 2 is broader — anyone with a portal account across a longer window (through April 2024) — and receives smaller fixed payments of up to $10 from a separate portion.

Why structure it this way? Because exposure usually isn't uniform across time. An earlier period might involve different tracking configurations, more data, or a stronger claim, warranting a larger share; a later, broader group gets acknowledged with a modest payment. For an operator, the takeaway isn't the payout mechanics — it's what the class periods reveal. These windows stretch back to 2015, meaning the alleged tracking persisted, unexamined, for years. The settlements keep surfacing conduct that ran quietly for the better part of a decade because no one was checking what fired on the portal.

Part of the $100M pattern

Atrium Health is another entry in the healthcare pixel wave that now exceeds $100 million in aggregate settlements. The healthcare pixel settlement roundup covers the full list; here's how Atrium sits among its closest cousins.

Read across that table and the message is hard to miss: federal or state, California or not, the conduct settles. Three different legal routes converge on the same behavior. The operator's defense can't be jurisdictional; it has to be about the conduct itself.

What this means for your site

Atrium Health reinforces the healthcare lessons and adds a jurisdictional one:

Frequently asked questions