Cone Health MyChart Pixel Settlement: $1.76M Over a Patient Portal

The Cone Health MyChart settlement is a small case with a big lesson. The dollar figure — $1.76 million — is modest next to the eight-figure healthcare settlements, but the fact pattern is the one every patient-facing organization should study. Cone Health, a North Carolina hospital system, allegedly ran tracking pixels on its website and on its MyChart patient portal that transmitted patients' information to Meta and Google. MyChart is where patients message their doctors, view results, and book appointments — the most trusted, most private corner of a health system's web presence. The allegation is that the same advertising trackers you'd expect on a storefront were firing there too. Patients never consented to it, and the hospital agreed to pay to resolve it.

What the case is about

Filed July 2024 in the Middle District of North Carolina, Singh v. The Moses H. Cone Memorial Hospital alleges that Cone Health deployed tracking pixels on its website and MyChart patient portal that transmitted patients' private information to third parties — specifically Meta and Google — without consent. In July 2026 the court granted preliminary approval to a $1,765,000 settlement covering a class of 375,027 people who used the portal or completed forms on the site between September 2016 and November 2022.

Payouts are structured on a pro rata basis — the fund is divided among valid claimants, with no requirement to prove individual harm. That no-proof structure is common in these settlements and tells you something about the theory: the alleged injury is the unconsented disclosure itself, not a downstream financial loss.

That distinction is worth dwelling on, because it's what makes these cases so hard to defend and so easy to bring. In a traditional data-harm lawsuit, a plaintiff has to show something bad happened — fraud, identity theft, a concrete loss. The theory here sidesteps that entirely: if a confidential communication was disclosed to a third party without consent, the disclosure is the injury, whether or not anyone ever misused the data. A class of 375,027 people doesn't need 375,027 stories of harm; it needs one configuration that shared data it shouldn't have. That's why a mid-sized hospital system, with no breach and no allegation that anyone was actually defrauded, still found a $1.76 million settlement to be the rational outcome.

The detail that makes it matter

What makes Cone Health instructive isn't the size of the settlement — it's where the pixel was. A marketing pixel on a hospital's public homepage is one thing. A pixel on the MyChart patient portal — the authenticated, logged-in space where patients handle their actual care — is a different order of exposure. When a tracker fires there, the data it can observe isn't anonymous browsing; it's tied to a logged-in patient taking health-specific actions.

That's the detail that turns an ordinary analytics mistake into a class action. The portal is marketed and understood as the private, secure channel. A tracker in that environment contradicts the core promise of the product, and it exposes exactly the kind of data — health-related, identity-linked — that draws both plaintiffs and regulators. Cone Health shows that the most sensitive page is often the one where a stray tag does the most damage.

The legal theory — no CIPA needed

Like several healthcare cases, Cone Health is not a CIPA case — it's in North Carolina, and California's statute doesn't apply. The claims rest on the federal Wiretap Act (ECPA), which prohibits intercepting the contents of an electronic communication without authorization, and on the unlawful disclosure of private health information without consent under applicable law.

This is a recurring and important point: the pre-consent-tracking theory is not confined to California. The federal wiretap statute travels everywhere, and most states have their own privacy and wiretap laws plaintiffs can use. A hospital — or any business — outside California that assumes "CIPA is a California problem" is missing that the same conduct is actionable under federal law and a patchwork of state statutes nationwide. Cone Health is the North Carolina proof of that.

Why the portal is the crux

MyChart is a product built by Epic and used by health systems across the country. The portal itself isn't the problem — what matters is what a health system adds to its web environment around and within that experience. Marketing and analytics tags get deployed site-wide through a tag manager, often without anyone auditing whether they also load on authenticated, patient-facing pages. The tag doesn't know it's on a sensitive page; it fires everywhere it's told to.

That's why these cases keep happening to sophisticated organizations: the failure is rarely a decision to track patients. It's the absence of a boundary — no one drew a line that says "these tags never run here." The lesson for any site with a logged-in or sensitive area is to treat those zones as tracker-free by default, and to verify it, rather than assuming a site-wide tag deployment somehow skipped the pages that matter most.

It helps to understand the mechanics, because they explain why even careful organizations get caught. Most sites load trackers through a tag manager — a single script that injects every marketing and analytics tag according to rules someone configured once. The default rule is "fire on all pages." Unless someone deliberately writes an exclusion for the portal, the intake forms, and the logged-in pages, the tag manager does exactly what it was told: it loads Meta and Google everywhere. The pixel has no concept of "this page is sensitive." It isn't a rogue script; it's an obedient one doing precisely what the default configuration asked. The protection is an explicit exclusion rule plus a check that the rule actually works — and the "plus a check" is the part that's almost always missing in the cases that settle.

Part of the $100M pattern

Cone Health is one entry in a wave of healthcare pixel settlements that, in aggregate, exceed $100 million — Sutter, Advocate Aurora, Penn Medicine, Allina, and more. We cover the full pattern in the healthcare pixel settlement roundup; here it's enough to see where this one sits.

Different states, different statutes, nearly identical facts: a pixel on a patient-facing page transmitting to Meta or Google before consent. The consistency is the point. These aren't freak events — they're the predictable output of a single, widespread configuration mistake.

What this means for your site

Whether or not you're in healthcare, Cone Health translates into a few concrete habits:

Frequently asked questions