The Patient-Portal Pixel Settlements: When Trackers Follow Patients Past the Login

There's a version of the healthcare pixel story that gets told as a series of eye-catching numbers — Kaiser's $46M, Sutter's $21.5M, and so on. That story is real, and we cover the full healthcare pixel settlement wave separately. But hidden inside it is a tighter, more instructive cluster of cases that share a specific and damning fact: the tracking wasn't on the public brochure site. It was on the patient portal — behind the login, where the person is identified and the activity is medical.

Why tracking on a portal is worse than tracking on a marketing page

Every pixel does the same basic thing: it loads on a page and reports activity back to whoever operates it. What changes everything is context. On a public marketing page, a pixel reports that "someone" — an anonymous browser — looked at a service line. That's the ordinary, if increasingly litigated, machinery of web advertising.

Move that identical pixel behind a patient login and three things change at once, and each one raises the stakes:

• The person is identified. They've logged in. The activity isn't "a visitor" — it's a specific patient, often linkable to a real name and, through the Meta Pixel, to a Facebook profile.
• The activity is medical. Inside a portal, people schedule appointments, search conditions, message providers, and click to call a doctor. That's not browsing interest; it's health information about an identified individual.
• The expectation is privacy. A patient logging into a portal reasonably believes they've entered a private, care-focused space — not an advertising surface. That gap between expectation and reality is exactly what juries and regulators punish.

There's an architectural reason this is so common, too. Many patient portals aren't home-built — they're an Epic MyChart instance or a third-party booking platform, bolted onto the health system's web presence. That creates a seam: the marketing team owns the public site and its tag manager, while a different team (or a vendor) owns the portal. A tag deployed "site-wide" can bleed across that seam onto the authenticated surface without anyone deciding it should be there. So the portal ends up carrying marketing trackers not through a considered choice, but through the absence of one — which is exactly the kind of gap plaintiffs' testing is designed to surface.

Put together, portal tracking converts an advertising tool into a mechanism that links a named person to their medical concerns. That's why these particular cases settle so consistently: the "beyond the scope of what the patient agreed to" argument almost writes itself.

Wellstar — $4.25M, and the MyChart portal at the center

Wellstar Health System, one of Georgia's largest, agreed to a $4.25 million settlement covering roughly 870,000 patients, over Meta Pixel and Google tools on Wellstar.org and the Wellstar MyChart patient portal.^[1] The complaint's core allegation is the portal one: when a patient logged in to schedule, search a condition, or click to call a doctor, that activity was allegedly captured and reported — and the Meta Pixel could link a condition search to the patient's Facebook profile.

A federal judge allowed some claims to proceed, describing conduct that allegedly went "beyond the scope of patients' permission." Wellstar received enhanced advertising services rather than cash for the data, and settled without admitting wrongdoing.^[1] We've written the full breakdown in our Doe v. Wellstar deep-dive — this piece focuses on how it fits the broader portal pattern.

Banner Health — the case that shows portals don't need a headline number to hurt

Banner Health settled claims (McCulley, et al. v. Banner Health) covering roughly 1,028,000 people who logged into a Banner patient account (formerly MyBanner) between June 1, 2020 and November 22, 2023 — activity alleged to have disclosed personal and health information to Meta and Google through tracking tools.^[2]

Banner is instructive precisely because it doesn't lead with a giant fund figure. Rather than a headline settlement total, the relief is structured per class member: eligible people can claim a $20 payment plus a year of privacy monitoring, with a claim deadline of September 5, 2026.^[2] Multiply modest per-person relief across a million-person class and add administration, notice, monitoring, and fees, and the total cost is substantial even without a splashy number. The lesson: portal-tracking exposure scales with the size of your logged-in population, not with whether a case produces a headline figure. A large patient base is a large liability surface.

LifeStance — behavioral health raises the stakes again

LifeStance Health Group, one of the largest outpatient mental-health providers in the U.S. (around 600 locations, 5,200+ clinicians), agreed to a non-reversionary $3,027,874.44 settlement (Strong v. LifeStance Health Group, No. 2:23-cv-00682, D. Ariz.) over third-party tracking tools on its website and online booking tool, alleged to have disclosed patient information to Meta and Google.^[3] The court granted preliminary approval on May 12, 2026; the claim deadline is September 29, 2026, and the fund is split into two subclasses — one for patients who booked through the online booking tool, one for other patients.^[3]

What makes LifeStance sting is the nature of the data. This isn't a sprained ankle. The information allegedly signaled to Meta and Google was tied to mental-health treatment — appointment bookings and page activity connected to conditions like depression, PTSD, and bipolar disorder, associated with identifiers traceable to a real person.^[3] Behavioral-health data is among the most sensitive there is, and its presence in an ad pipeline is the kind of fact that drives both settlements and the size of them. It also underscores that "portal" risk extends to any authenticated or booking surface tied to sensitive care, not just an Epic MyChart instance.

The portal pixel cases at a glance

Three cases, one fact pattern — trackers on a logged-in patient surface:

Figures and periods per the settlement notices and reporting cited below. Banner's relief is disclosed per class member rather than as a single fund total; case details are subject to court approval and may change.

The pattern portal operators keep missing

The striking thing across Wellstar, Banner, and LifeStance is how ordinary the underlying mistake is. None of these organizations set out to sell patient data. The failure is almost always the same quiet sequence:

• A marketing team deploys a pixel site-wide through a tag manager, to measure campaigns and conversions.
• Nobody scopes it away from the authenticated surface, so it loads on the portal, account area, or booking tool too.
• The pixel does exactly what it's built to do — report activity to its operator — except now that activity is a logged-in patient searching a condition or booking a therapy session.

It's also why the standard compliance review misses it. A privacy audit that checks the marketing site's cookie banner, reviews vendor BAAs, and confirms the security posture can come back clean while a pixel quietly runs on the portal — because the audit never loaded the authenticated pages the way a real patient (or a plaintiff's tester) does. The tests that catch these problems are behavioral: log in, use the portal like a patient, and watch the outbound network requests. That's a different exercise from a document-based compliance checklist, and it's the one that would have caught every case in this article.

The reason this keeps happening is organizational: the people who add marketing tags usually aren't the people who own the portal, and the portal is often a separate system (an Epic MyChart instance, a third-party booking tool) where a stray tag is easy to miss. So the gap opens silently, survives audits that only look at the marketing site, and stays open until a plaintiff or regulator loads the portal and watches what fires.

The HIPAA misunderstanding worth clearing up

Because these are healthcare organizations, coverage of these cases is saturated with the word "HIPAA" — and that produces a costly misconception. Here's the accurate picture:

In other words: HIPAA governs how you handle protected health information across your organization. The pixel cases live one layer over, in consent and wiretap law — which is why hospitals with solid HIPAA programs still lost these suits. Fixing the portal-tracking problem is a technical control, not a HIPAA certification.

What portal operators must actually do

The fix is concrete, and it's the same whether you run a hospital system, a telehealth startup, or any product with a logged-in account tied to sensitive activity:

1. Keep third-party trackers off every authenticated surface

Portals, patient accounts, booking tools, intake forms, and messaging — no marketing or analytics pixel belongs on any of them. This is the single highest-impact control, because it directly removes the fact pattern in all three cases above.

2. Audit what your tag manager deploys, and where

The gap is almost always a site-wide tag nobody scoped away from the portal. Audit the actual rendered pages of your authenticated surfaces — not just the marketing site — and confirm what loads there. Do it on a recurring basis, because tags get added continuously.

3. Block non-essential trackers until genuine consent everywhere else

On your public pages, block non-essential trackers until a visitor affirmatively consents, and enforce opt-outs (including Global Privacy Control signals) across cookie-based and cookieless tools alike. This closes the broader disclosure-without-consent exposure these cases share.

4. Log consent decisions as evidence

Keep a timestamped record of what each visitor permitted. That log is what lets you demonstrate — to a regulator or in response to a demand — that identifiable activity wasn't captured without consent.

This is exactly the posture ConsentPixel is built to deliver: it blocks third-party trackers at the browser level until genuine consent, honors opt-out signals, continuously verifies what actually fires, and logs each decision as evidence — so a pixel can't quietly transmit identifiable activity from a page it never should have loaded on. To be explicit: ConsentPixel is not a HIPAA product and does not make any website HIPAA compliant; HIPAA compliance is a broader legal and organizational obligation. It addresses the tracker-disclosure mechanism these settlements turn on. This is general information, not legal advice.

Frequently asked questions