Rushville, Ill.-based Sarah D. Culbertson Memorial Hospital is being accused of sharing patients' information with third parties, including Google, Microsoft and Facebook, the Journal-Courier reported Sept. 10.
The lawsuit alleges the hospital knowingly used tracking software on its website without proper authorization and without notifying patients. The lawsuit alleges 11 counts of negligence, invasion of privacy, breach of contract, unjust enrichment, breach of confidentiality and violations of various state and federal privacy laws.
The suit is being brought by a patient of the hospital who sought treatment between November 2021 and September 2023. According to court documents, patients were encouraged to use the website and other online platforms such as Facebook to learn about the hospital, find providers and access patient portals. When members of the lawsuit used the tools, they thought they were communicating solely with their healthcare provider. But the embedded tracking mechanisms on the website allowed third parties to access their information and use it for marketing. Information tracked included the user's health information, status as a patient, information about her patient portal activity, names and specialities of the medical providers they searched and the search results they clicked on, the lawsuit reads.
In addition, the tracking software stored IP addresses, user cookies and Facebook ID numbers. These were used for targeted health-related advertisements on Facebook that mirrored private medical treatment information, according to the lawsuit.
Sarah D. Culbertson Memorial Hospital has not responded to the accusations, the report said.