Visitors to the Billings Clinic website have their information transferred and sold to third parties like Google for tracking and advertising purposes, according to a recent lawsuit.  

The class action lawsuit only names one plaintiff, Lydia Brester, though it represents at least 100 people who have interacted with the website before, alleging that such actions by the nonprofit violate patient privacy and state law in its tracking and distributing of visitor data. 

The lawsuit states that Billings Clinic tracks nearly every action on the website, from initial search to finalizing an appointment. As evidence, it shows code for tracking tools embedded within the site that send information to Google when words like “cancer” are searched, when a doctor is clicked on and the time of arranged appointments. When a visitor logs into the private PatientConnect portal, it also relays certain identifying information to Google for advertising and analytics, the suit alleges. 

The federal lawsuit alleges the privacy intrusions by the hospital system were intentional.

“Billings Clinic’s intrusion is highly offensive to a reasonable person," attorneys with Helena-based law firm Doubek, Pyfer & Storrara and Chicago-based law firm Stephan Zouras stated in a July 14 filing. "A person of ordinary sensibilities would be outraged to learn that a trusted healthcare provider surreptitiously transmitted the details of their medical searches, provider selections, appointment activity, and portal logins to a global advertising company for use in commercial retargeting."

Attorneys weren't immediately available to comment for this story.  

In a response to an inquiry by the Billings Gazette, a Billings Clinic spokesperson said in a one-sentence statement, "We are aware of this and are looking into it."

A notice of privacy practices on Billings Clinic’s website currently says the nonprofit will never share information for marketing purposes or sell it without written permission.

In the lawsuit, attorneys state that Billings Clinic has acknowledged using cookies previously on its website to track information and that it may be used by advertisers. The lawsuit states that the hospital system said its collecting of data excluded personal health information.

But attorneys for the plaintiffs in the lawsuit disputed that claim. 

“From the transmitted Website activity ... other third parties could infer sensitive health-related information, including whether a user searched for or viewed information about particular medical conditions, providers, services, or treatment areas, such as cancer, pregnancy, dementia, or HIV,” attorneys wrote. 

Such sharing of information was considered inconsistent with federal law that protects private health information, the lawsuit states. 

The federal government has previously warned healthcare providers of tracking online data in past public guidance, stating that entities are not permitted to share personal health information that would violate state laws. However, that bulletin by Health and Human Services was later somewhat successfully challenged by the American Hospital Association, with a judge in Texas ruling in 2024 that an IP address shouldn't be considered information that identifies a person when it’s shared with others. 

In July 2023, federal regulators cautioned about 130 healthcare providers nationwide in a letter that using online tracking technologies could “result in a wide range of harms to an individual or others.”

“Disclosures can reveal sensitive information including health conditions, diagnoses, medications, medical treatments, frequency of visits to health care professionals, where an individual seeks medical treatment, and more,” the letter stated. 

Names of providers the letter was sent to weren't shared.  

Attorneys alleged in their filing that Billings Clinic violated federal and state privacy laws, negligence and unjust enrichment. 

“Defendant consciously collected and used this information for its own gain, providing Defendant with economic, intangible and other benefits, including substantial monetary compensation,” attorneys wrote.

It’s not the first lawsuit of its kind. The Chicago-based firm filing the case has reached patient privacy settlements in at least two other states before. Federal regulators have also reached settlements with a fertility tracking app when information was shared with Facebook. In 2023, the Federal Trade Commission proposed a $1.5 million penalty of GoodRX for sharing sensitive health info with advertisers.

"Digital health companies and mobile apps should not cash in on consumers' extremely sensitive and personally identifiable health information,” Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, said at the time.