Health Law Daily Wrap Up, ELECTRONIC HEALTH RECORDS—C.D. Ill.: Suit against hospital over embedding tracking technology moves forward, (Mar 23, 2026)

By Brian Craig, J.D.

The complaint plausibly alleged that the hospital intercepted communications regarding medical treatment to disclose the information to third parties in exchange for marketing services.

The federal district court in Rock Island, Illinois has held that a proposed class action lawsuit brought by a patient against a hospital system in Illinois asserting violations of the Electronic Communications Privacy Act (ECPA) with tracking technology allegedly from the hospital system’s website can proceed. In largely denying a motion to dismiss, the court held that the complaint sufficiently alleged that the hospital system, Culbertson Memorial Hospital Foundation, intercepted communications with tracking devices in order to disclose the intercepted information to third parties, including Facebook and Google, in exchange for marketing services. While the court found that the complaint sufficiently alleged the ECPA violation, the court dismissed the Stored Communications Act (SCA) claim (Hannant v. Culbertson Memorial Hospital Foundation, No. 4:24-cv-04164-SLD-RLH (C.D. Ill. Mar. 26, 2026))

A patient sued a hospital system in Illinois, Culbertson Memorial Hospital Foundation, alleging that the hospital system’s website wrongfully embedded third-party tracking technology. The technology included trackers from Facebook, Google, and Microsoft that collected details about site users’ interaction with the hospital system’s website. After using the hospital system’s website, the patient alleged she received targeted advertisements for MRI tests and other medical treatment that appeared in her Facebook feed. The complaint filed in the federal district court in Illinois alleged claims for violations of the Electronic Communications Privacy Act (ECPA), negligence, negligence per se, and the Stored Communications Act (SCA). The court dismissed the ECPA and SCA claims in the original complaint. The patient amended the complaint and asserted additional facts to support the claims. The hospital system moved to dismiss the amended complaint.

ECPA claim. The court held that the ECPA claim can proceed. In the amended complaint, the ECPA claim plausibly asserted that the hospital’s purpose in intercepting the communication was to transmit the communication to third parties in violation of the Health Insurance Portability and Accountability Act (HIPAA). Such allegations established a plausible HIPAA violation.The use of the patient portal and name of the patient’s personal physician specifically referred to her treatment and status as a patient. Because the interception was for the purpose of committing an independent criminal act, the court concluded the crime-tort exception applies.

In addition, the court found that the patient sufficiently alleged the hospital system disclosed the contents of the patient information. The ECPA defines “contents” as “any information concerning the substance, purport, or meaning of that communication.” The amended complaint includes allegations that the hospital system intercepted and transferred the name and location of the patient’s personal physician, the medical treatment she researched including information related to an MRI test, her treatment search information, her research on obtaining medical records, and her log in and use of the patient portal. Such information rises far above the level of “record information” and is appropriately considered “contents.” Because the patient alleged the interception and disclosure of “contents” and because the crime-tort exception applies, she stated a claim for the violation. Therefore, the court denied the motion to dismiss the first ECPA claim.

Negligence. The court also held that the negligence and negligence per se claims can proceed.

The court found that the complaint sufficiently alleged the hospital system violated its duty to exercise reasonable care in handling patients’ private information. The court declined to dismiss the negligence and negligence per se claims under the Illinois Tort Immunity Act. The court could not determine at the pleading stage that the hospital system falls within the definition of a “local public entity” for purposes of the Illinois Tort Immunity Act.

SCA claim. The court, however, dismissed the SCA claim. The SCA defines “electronic communication service” as “any service which provides to users thereof the ability to send or receive wire or electronic communications.”The court found that the complaint provided no factual allegations to plausibly state a claim that the hospital system is an electronic communication service provider. Because this was the second time the court has dismissed the SCA claim for failure to state a claim, the court dismissed the claim with prejudice.

The case is No. 4:24-cv-04164-SLD-RLH.

Judge: Darrow, S.

Attorneys: Andrew E. Mize (Stranch, Jennings & Garvey, PLLC) for Alana Hannant. Christopher Wiech (Baker & Hostetler LLP) for Culbertson Memorial Hospital Foundation.

Companies: Culbertson Memorial Hospital Foundation

MainStory: TopStory CaseDecisions EHRNews GCNNews HITNews IllinoisNews