Tenet Healthcare's pixel settlement: when the real remedy isn't the check, it's the cleanup

The Tenet Healthcare pixel settlement pays each class member $16 — a number small enough that it's easy to dismiss the case. That would be a mistake. Behind that modest cash figure sits a hospital-system settlement covering six years of website, patient-portal, and app activity, data allegedly sent to Meta, Google, and Marketo, and two years of identity-protection monitoring for everyone who claims.

It's also a case study in how to read these deals correctly. The headline cash is the least important term. What matters is the structure: who paid for what, what behavior the hospital agreed to change, and what the record does — and doesn't — actually establish. This one is unusually instructive precisely because its public notice is so sparse on the legal theory, even as the facts of the tracking are laid out plainly.

What the case is about

Saint Francis Hospital-Memphis, operated through Tenet Healthcare's AMISUB entity, ran the kind of digital front door most hospital systems do: a public website, a patient portal, and a mobile app (HealtheLife) that patients used to create accounts, submit web forms, and check in for urgent-care or emergency-room visits. The lawsuit alleges that embedded in those properties were third-party tracking technologies that captured what patients and visitors did and transmitted it to outside companies — the complaint names Meta, Google, and Marketo — without consent.

In a healthcare setting, the data at issue isn't abstract. The class definition itself describes the sensitive touchpoints: creating a patient-portal account, submitting a web form, checking in to an ER. Information tied to those actions is what the plaintiffs characterize as confidential personally identifiable information and protected health information — and sharing it with advertising and marketing platforms is the alleged wrong.

Tenet denies wrongdoing. The settlement, like nearly all in this space, resolves disputed claims without any admission of liability. The $16-plus-monitoring package is the negotiated cost of ending the case, not a court's finding that the tracking broke any law.

What's unusual about this settlement

Most pixel settlements we track lead with a dollar fund and a named statute. Tenet's does neither — and the gaps are themselves the most interesting feature of the case.

No statute is named in the public notice

The settlement materials describe the conduct as a violation of "privacy laws" without identifying which ones. There is no public confirmation that this was pleaded under the California Invasion of Privacy Act, the federal Wiretap Act, the Tennessee Wiretapping and Electronic Surveillance Act, or a common-law invasion-of-privacy theory. That matters for two reasons. First, it's a reminder that a settlement can be reached — and patients paid — without the public ever learning the precise legal hook. Second, because the case sits in a Tennessee court, it almost certainly is not a California CIPA case; the theories available in Tennessee differ, and we don't route it as CIPA on the record as it stands.

No aggregate fund is disclosed

Unlike a common-fund settlement (where a single pool is divided), Tenet's is structured around a fixed $16 per claimant plus the monitoring benefit, with attorneys' fees paid separately by Tenet. There is no publicly stated total. This "claims-made"-style structure means the defendant's ultimate outlay depends on how many people actually file — a very different economic shape than a capped fund, and one that often results in a lower real cost to the defendant than the headline relief implies.

What class members actually get

The relief comes in two parts, and the second is easy to overlook:

For a patient weighing whether to claim, the two years of monitoring is the real draw. Standalone, that service carries a meaningful retail value — often more than the $16 cash — which is why these health-data settlements increasingly bundle it. It also fits the nature of the alleged harm: if your data was shared, ongoing monitoring is a more responsive remedy than a one-time check.

Who's covered, and the deadlines

The class is defined by action, not just by visiting a page. It covers individuals who used Tenet's covered websites, patient portals, the HealtheLife app, or other web tools to do one of the following during the class period:

• Create a patient-portal account;
• Submit a web form; or
• Check in to an urgent-care or emergency-room visit.

The class period runs January 1, 2017 through September 18, 2023. The operative dates: preliminary approval was granted September 22, 2026; the opt-out and objection deadline is December 21, 2026; the final approval hearing is set for January 14, 2027; and the claim deadline is March 15, 2027. Class members who do nothing generally remain bound by the release and give up the right to sue separately, but — if they file no claim — receive neither the cash nor the monitoring. Confirm the current process and deadlines with the official settlement administrator, since dates can shift during approval.

What this case teaches about healthcare tracking

Strip away the unusual structure and Tenet reinforces the same lessons the rest of the pixel wave has been teaching — with a few of its own.

1. Portals and apps are in scope, not just the public site. Tenet's class reaches patient-portal accounts and a mobile app. The behind-the-login surface is exactly where health data is most sensitive and tracking is hardest to defend.
2. Three platforms, one problem. Data allegedly went to Meta, Google, and Marketo. Modern sites rarely have just one tag — a marketing-automation platform like Marketo can be as consequential as an ad pixel, and it's often overlooked in audits.
3. A case can settle without a named statute. The public record here never specifies the legal theory. The exposure was real enough to settle regardless — the conduct, not the citation, is what drives these deals.
4. The monitoring is the remedy that fits the harm. For data-sharing claims, two years of identity protection responds to the injury better than a token payment, which is why it's becoming standard in health-data settlements.
5. Long tracking windows create long class periods. Six-plus years of alleged tracking means a very large class. Tags left unexamined don't age out — they accumulate exposure.

What to do if you run a healthcare website, portal, or app

1. Inventory tags across every surface — site, portal, and app. Tenet's case spanned all three. Catalog every pixel, tag, SDK, and marketing-automation script, not just the ones on your public marketing pages.
2. Include marketing-automation platforms in the audit. Tools like Marketo embed tracking too. If a platform touches your forms or portal, treat it with the same scrutiny as an advertising pixel.
3. Map what each tag transmits. Document the data each tracker sends and its recipient. A tag that fires on an ER check-in or account-creation flow and transmits identifiers is the precise fact pattern these complaints describe.
4. Gate non-essential tags behind consent. Advertising and analytics trackers should not fire until a visitor gives valid, informed consent — the single control that turns an unconsented disclosure into a defensible one.
5. Keep advertising tags off authenticated portals and apps. Behind-the-login areas carry the most sensitive data and the weakest defense for sharing it. Keep third-party advertising tags out entirely.
6. Re-audit on a schedule. Tags drift onto sensitive pages over years. Periodic scanning catches a new pixel before it becomes a six-year class period.

Key takeaways

Frequently asked questions

The bottom line

The Tenet Healthcare settlement is easy to underestimate because of its $16 headline, but the number is the least informative thing about it. This is a six-year, multi-surface tracking case — websites, a patient portal, and a mobile app — with data allegedly flowing to three separate platforms and two years of identity monitoring offered as the real remedy. It settled even though the public record never names the statute, because the conduct was exposure enough.

For any provider, the read is the same one the whole pixel wave keeps delivering, sharpened by this case's quirks: the risk lives wherever health-related activity leaves a page without consent — and that includes the portal and the app, not just the marketing site, and marketing-automation tags as much as ad pixels. Inventory everything, gate the non-essential tags, keep them off the authenticated surfaces, and the fact pattern these settlements rely on isn't there to plead.

Sources