On March 31, 2025, Judge April M. Perry of the United States District Court for the Northern District of Illinois denied, in part, defendant’s attempt to dismiss a class action lawsuit over its unauthorized medical data sharing. In Mayer v. Midwest Physician Administrative Services, LLC d/b/a Duly Health and Care, No. 1:23-cv-3132, Plaintiffs, represented by the Almeida Law Group LLC and Stephan Zouras LLC, alleged that Duly Health and Care used Meta’s Pixel and Conversions API tools to capture and transmit sensitive health information—including symptoms, medical conditions, and appointment details—without patient consent. 

In denying the motion to dismiss plaintiffs’ claim under the federal wiretapping statute, the Electronic Communications Privacy Act (ECPA), Judge Perry held that plaintiffs plausibly alleged that Duly intercepted and disclosed private health communications to Meta with a potentially tortious or criminal purpose. The court also allowed plaintiffs’ negligence claim to proceed, finding they had adequately alleged that Duly owed a duty to protect patient data, breached that duty by sharing sensitive information without consent, and caused harm as a result.

At ALG, we are steadfastly committed to holding healthcare providers accountable when patient confidentiality and privacy is breached in the digital space. We will continue to hold healthcare providers to the highest standards of data privacy, security and compliance.