Pixel Tracking Settlement: The Southern Illinois Healthcare Case

Southern Illinois Healthcare has agreed to settle a class action claiming that tracking code on its website and patient portal sent patient information to Meta. The payout per person is small, but the case is one more example of a pattern that has run since 2022: a hospital or clinic adds a marketing pixel, the pixel fires on pages where patients log in or book care, and lawyers file suit.

This guide covers what the settlement actually says, how the federal rules on tracking changed after a 2024 court ruling, and what practice owners can check on their own sites.

What the case is about

The case is Doe v. Southern Illinois Healthcare Enterprises, Inc., et al., Case No. 2023LA55, in the Circuit Court of Williamson County, Illinois. The defendants are Southern Illinois Healthcare Enterprises, Southern Illinois Hospital Services and Southern Illinois Medical Services.

According to HIPAA Journal's coverage, the plaintiff alleged that the Meta Pixel on the health system's websites disclosed visitors' personal information to Meta without their knowledge or permission. The amended complaint included claims for negligence, invasion of privacy, breach of contract, unjust enrichment, violation of the Illinois Eavesdropping Statute and violation of the Illinois Consumer Fraud and Deceptive Business Practices Act. A partial motion to dismiss led to that amended complaint, and a later motion to dismiss was denied.

The defendants deny any wrongdoing and settled to avoid the cost and risk of further litigation.

What the settlement offers

The settlement website describes the class as people who used the three Southern Illinois entities and either logged into or scheduled through the MyChart patient portal during set windows between 2022 and 2024, or completed an online health risk assessment during set windows in 2020 and 2021.

Reported benefits, per HIPAA Journal and Top Class Actions:

A one-time cash payment of $17.50 per claimant
One year of CyEx Privacy Shield Pro, a privacy monitoring service
The total settlement amount has not been disclosed

The deadline to file a claim, opt out or object was June 15, 2026. The final approval hearing was scheduled for August 24, 2026. As of this update, we could not confirm from the court or the settlement website whether final approval has been granted, so treat the settlement as pending until the administrator says otherwise.

Why these lawsuits keep coming

HIPAA does not give patients a private right to sue. That is why pixel cases like this one are built on state privacy, wiretap and consumer protection laws, plus common law claims like negligence and unjust enrichment. A practice can face this kind of suit regardless of what federal regulators decide to enforce.

That matters because the federal picture shifted in 2024.

How the federal rules changed

Here is the sequence of events, with dates checked against agency releases and law firm analyses of the court record:

December 1, 2022: HHS's Office for Civil Rights (OCR) issued a bulletin explaining how HIPAA applies to online tracking technologies such as pixels, cookies and analytics scripts.
February 1, 2023: The FTC announced its first enforcement action under the Health Breach Notification Rule, against GoodRx. GoodRx agreed to a $1.5 million civil penalty over allegations that it shared users' medication and health condition data with Facebook, Google and others.
March 2, 2023: The FTC announced a proposed order requiring BetterHelp to pay $7.8 million for consumer refunds over allegations that it shared email addresses, IP addresses and mental health questionnaire answers with Facebook, Snapchat, Criteo and Pinterest.
July 20, 2023: The FTC and OCR sent a joint letter to about 130 hospital systems and telehealth providers warning that tracking tools like the Meta pixel and Google Analytics may be sharing sensitive health data. The FTC noted that companies not covered by HIPAA still have obligations under the FTC Act.
March 18, 2024: OCR updated its tracking bulletin.
June 20, 2024: In American Hospital Association v. Becerra, the U.S. District Court for the Northern District of Texas held that OCR exceeded its authority with one part of the bulletin and vacated it.
August 29, 2024: HHS withdrew its appeal, leaving that ruling in place.

What the 2024 ruling did and did not change

The court vacated what it called the "Proscribed Combination": OCR's position that an IP address plus a visit to a public, unauthenticated webpage about a health condition or provider counts as protected health information. The court said that position depended too heavily on guessing why a visitor was on the page.

The ruling was narrow. Law firm analyses of the decision note the court said the vacatur did not limit the bulletin's other parts. The parts that were not struck include OCR's position on tracking on authenticated pages, such as patient portals and logged-in areas, where the visitor is already identified as a patient.

Some questions remain open, including how the ruling applies when a public page collects more than an IP address, such as a name or email entered into a booking form. Analysts have flagged that as unsettled.

The practical result for a practice: a pixel on a general blog post is lower regulatory risk than it was in early 2024, but a pixel inside a portal, on a booking flow or on a symptom form is still squarely in the zone OCR and plaintiffs' lawyers care about. And the state law claims in cases like Southern Illinois do not depend on OCR's bulletin at all.

What the ad platforms themselves say

Google's own help page for Analytics says Google makes no representation that Analytics satisfies HIPAA and does not offer Business Associate Agreements for the service. It advises HIPAA-regulated customers not to use Analytics tags on authenticated pages or on unauthenticated pages tied to health care services.

Under HIPAA, a vendor that receives protected health information on a covered entity's behalf generally needs a Business Associate Agreement. If the vendor will not sign one, the usual answer is to keep that vendor's code away from pages that handle patient information.

A practical tracking review for practice websites

Businesses that review their tracking often work through a list like this. It is a starting point for a conversation with your web team and counsel, not a compliance certification.

Inventory every script. List each pixel, tag, analytics tool, chat widget and heatmap tool on the site, including anything loaded through a tag manager.
Map where each one fires. Note whether it loads on the homepage, service pages, booking pages, forms, thank-you pages or the patient portal.
Check authenticated areas first. Portals and logged-in pages are where the remaining OCR guidance is clearest.
Check booking and intake flows. Appointment requests, symptom forms and health questionnaires can expose condition information even on public pages.
Look at URLs and page titles. A thank-you page URL like "/thank-you-hair-loss-consult" can tell a pixel more than you intended.
Confirm vendor terms. For any tool that might receive patient information, find out whether the vendor will sign a Business Associate Agreement. Many ad platforms will not.
Review form handling. Check where form submissions go, including CRMs, email tools and spreadsheets, and whether those tools are covered by agreements.
Update the privacy policy. Make sure it describes the tracking you actually run.
Write it down. Keep a dated record of what you found and what you changed.

If you find a pixel that has been firing on patient pages, talk to counsel before deciding whether it counts as a reportable breach under HIPAA or state law. That decision depends on facts a checklist cannot settle.

Where NutriCove fits

NutriCove builds websites and web apps for practices, with lead capture, booking and CRM connections wired in, and can set up analytics so that marketing tags stay off portal, booking and form pages unless the vendor relationship supports it. We do not provide legal or HIPAA compliance advice. If you are planning a rebuild or want your site's tracking set up deliberately, see how we build practice websites.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.