Federal judge approves Novant's $6.6 million patient info settlement (2024)

A federal judge has approved Novant Health Inc.’s $6.6 million settlement of a class-action lawsuit involving the not-for-profit system’s release of patients’ information to Facebook.

With about 158,000 claims, affected patients are projected to receive about $20 from the settlement.

Meanwhile, attorneys are scheduled to get about one-third of the settlement, or about $2.2 million.

The lawsuit in the federal Middle District of N.C. involves “the possible disclosure of protected health information resulting from the use of a pixel, an online tracking tool,” according to Novant’s website.

Novant did not admit to doing anything wrong and they said that the court did not find that they had done anything wrong.

“As a health system devoted to creating a remarkable care experience, Novant Health is committed to continuously evaluating the security of our patients’ personal information,” Novant said in a statement following the settlement agreement.

“We have reinforced our privacy measures and developed additional policies to further protect patients.

Safeguarding patient privacy is a responsibility we take seriously, and we are dedicated to maintaining patient confidentiality now and in the future.”

What happened

Novant said at that time it mailed 1.3 million notification letters.

Novant said the tracking involved the use of a Facebook-related pixel, which was “configured incorrectly and may have allowed certain private information to be transmitted to (Facebook parent company) Meta from the Novant Health website and MyChart portal.”

The patient information disclosure involves:

Novant said the disclosure did not affect patients’ Social Security numbers or other financial information “unless it was typed into a free text box by the user.”

Novant said among patients receiving the notification letter will be patients of independent physicians and facilities who use MyChart.

The Markup report

Novant and Atrium Health were among 33 major healthcare systems nationwide identified in a June 16, 2022, report by The Markup as having certain patient information tracked and made available to Facebook.

The Markup is a nonprofit investigative media outlet that specializes in mining technology data for its reports.

The Markup began its report by saying that “a tracking tool, known as Meta Pixel, was installed on many hospitals’ websites and has been collecting patients’ sensitive health information — including details about their medical conditions, prescriptions and doctor’s appointments — and sending it to Facebook.”

The tracker sends Facebook “a packet of data whenever a person clicked a button to schedule a doctor’s appointment.” The data is connected to an IP address, “creating an intimate receipt of the appointment request for Facebook,” the group said.

Novant was among seven systems using Pixel in their patients’ password-protected portals, the report said.

Facebook’s involvement was in the form of Novant advertisem*nts on the website, along with the tracking pixel placed on Novant’s website “to help understand the success of those efforts on Facebook.”

Novant said that once it became aware that the pixel had the capability to transmit unintended information to Meta, it was disabled and removed. The system began an investigation “to learn whether, and to what extent, information was transmitted.”

“Based on its investigation, Novant Health is unaware of any improper use or attempted use of any patient information by Meta or any other third party,” Novant said.

Novant said it “has also implemented more structure, governance and policies around the use of pixels and is taking actions to ensure this does not happen again.”

Novant was featured in a section of the group’s report. The Markup said it created a MyChart account to determine the breadth of the tracker.

“We found the Meta Pixel collecting a variety of other sensitive (patient) information,” the report stated.

“Clicking on one button prompted the pixel to tell Facebook the name and dosage of a medication in our health record, as well as any notes we had entered about the prescription.

“The pixel also told Facebook which button we clicked in response to a question about sexual orientation.”