Two Louisiana hospital systems accused of sharing patient data with Facebook, Instagram

LCMC Health in New Orleans and Willis-Knighton Medical Centers in northwest Louisiana have been named in class-action lawsuits targeting a growing group of hospital systems accused of sharing confidential patient information with social media companies.

At the heart of the lawsuits is a tracking tool embedded into hospitals' website codes called Meta Pixel, a product of Meta, the company that owns Facebook and Instagram.

The lawsuits say the tracker shared sensitive medical data without the knowledge or consent of hundreds of thousands of patients, a violation of Louisiana laws.

The code works by capturing medical information like health conditions, prescriptions, doctors' names and appointment history when patients opt to schedule an appointment online. That information could then be used to send patients targeted advertisements.

The lawsuits argue that this is a violation of Louisiana laws governing the protection of personal information, patient rights and privacy.

Attorney Steven Herman, who is representing the plaintiffs, called it a "gross invasion of privacy" that could use patient search inquiries related to sensitive matters like pregnancy or erectile dysfunction for marketing.

"What you are asking about gets automatically redirected to Facebook and then they can use that in some way, or sell it, or who knows what they do with the information," said Herman, of Herman Herman and Katz, in a recorded statement. "It is universal under state and federal law that medical providers have an affirmative duty to keep all patient protected information safe and confidential, and are not supposed to be disseminating it in any form."

Dozens of hospitals across the country are now part of similar class-action suits, according to news reports.

In a statement attributed to the health system's legal team, Willis-Knighton said it was "one of many hospitals throughout the nation (including Louisiana) who have recently been sued regarding the very common use of digital media marketing tools. While we do not comment on ongoing litigation, Willis-Knighton is committed to protecting the privacy of those who communicate with us on a digital platform."

A representative from LCMC Health said the system is "deeply committed to patient privacy and takes any implication that data has been shared inappropriately with the utmost urgency." In a prepared statement, the hospital said they are aware of the lawsuit and "intend to defend LCMC Health vigorously against the plaintiffs' claims."

Unlike many lawsuits, the Louisiana class action suits do not directly reference HIPAA, or the Health Insurance Portability and Accountability Act, which governs the privacy of a patient's health records in the hands of a provider. Under HIPAA, health records cannot be shared without a patient's consent.

The lawsuit against LCMC Health, which owns or operates nine hospitals in the New Orleans area, was filed in the Orleans Parish Civil District Court.

The lawsuit against Willis-Knighton, which operates five hospitals and several specialty centers in northwest Louisiana, was filed in the 10th Judicial District Court in Natchitoches Parish.

There is one class representative in each of the lawsuits, which were filed in Nov. 2022 and Jan. 2023.