Privacy Claims to Proceed

On February 21, 2025, Judge Steven C. Seeger of the U.S. District Court for the Northern District of Illinois issued a ruling allowing two of Plaintiffs’ claims against Edward-Elmhurst Health to move forward. The putative class action, Arnold Stein, et al. v. Edward-Elmhurst Health, No. 23-cv-14515, involves allegations that the healthcare provider used tracking technologies on its website—including the Meta Pixel—to transmit users’ private health information to third parties such as Facebook, without patients’ knowledge or consent.

Plaintiffs, who used Edward-Elmhurst’s website and patient portal, understandably believed their communications with healthcare providers would remain confidential. Instead, they allege that Edward-Elmhurst disclosed their actions on its website to Facebook, allowing the platform to associate their health data with their user profiles. According to the complaint, these tracking technologies were deployed for marketing purposes to bolster Edward-Elmhurst Health’s profits.

Judge Seeger ruled that Plaintiffs presented viable claims under the Electronic Communications Privacy Act (ECPA) and for negligence under Illinois law. The ECPA claim centers on allegations that Edward-Elmhurst Health knowingly intercepted and disclosed sensitive health communications through the embedded tracking tools. The negligence claim asserts that the healthcare provider failed to implement reasonable measures to safeguard patient data, as required under Illinois law. The Court dismissed Plaintiffs’ remaining claims but emphasized that the surviving ones raise important questions about privacy protections in the digital age.

We welcome the Court’s decision and are committed to moving this case forward. Privacy violations may lurk in the shadows, but we remain dedicated to bringing them to light and protecting the rights of individuals and families.

For more information, please read the full opinion below.