Cybersecurity Policy Report, W.D. Pa.: Suit alleging Pennsylvania hospital shared personal health information through Meta Pixels can proceed, (Jul 23, 2026)

By Donielle Tigay Stutland, J.D.

The suit alleges that Warren General Hospital’s use of the Meta Pixel and Google Analytics disclosed patients' protected health information and patient status to Facebook and Google without authorization.

The federal district court for the Western District of Pennsylvania denied in large part a motion to dismiss a class action filed by hospital system Warren General Hospital (WGH) which alleged that he hospital disclosed personal information to third parties, without authorization, through the use of applications like Meta Pixel and other similar applications. The court determined that the patients adequately pled claims of negligence, invasion of privacy, breach of implied contract, unjust enrichment, breach of fiduciary duty, and violations of the Pennsylvania Unfair Trade Practices and Consumer Protection Law and the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA). The motion to dismiss the claim of negligence per se was granted and the court also declined to grant injunctive relief after determining that there is not a reasonable likelihood of a recurring injury (Brunecz v. Warren General Hospital, No. 1:24-cv-00203-SPB, (W.D. Pa. July 15, 2026)).

Background. WGH is a well-regarded Pennsylvania healthcare provider headquartered in Warren, Pennsylvania, and it provides a wide range of medical services. WGH maintains an online platform and website, which it encourages patients to use to, among other things, search for services, research medical conditions, search for physicians, make payments, and access a patient portal. WGH embedded in its website certain code-based tracking technologies known as “pixels” (also referred to as trackers), which tracked information about its visitors and their interactions with the website. When a person visited the WGH website, the pixels tracked “events” (i.e., user interactions with the site), such as pages viewed, buttons clicked, and information submitted, and then transmitted these events back to the website server and to third parties, where they could be combined with other data and used for marketing. Examples of the trackers include the Facebook Pixel (also referred to as the Meta Pixel or Pixel) and the Google Tag Manager, which allow both WGH to run targeted ads to its website users and allows platforms like Facebook to also target advertisements to the website users based on their personal health information.

The patients allege that “WGH disclosed its patients’ data to Google from at least as early as November 23, 2016 through as recently as February 1, 2023 and to Facebook from at least as early as January 2, 2024 through as recently as April 5, 2024.”

The patients’ amended complaint asserts eight claims: negligence, negligence per se, invasion of privacy, breach of implied contract, unjust enrichment, breach of fiduciary duty, violation of the Unfair Trade Practices and Consumer Protection Law (UTPCPL), and violation of the Wiretapping and Electronic Surveillance Control Act (WESCA). WGH moved to dismiss the claims.

Protected Information. The court began by addressing WGH’s claim that the trackers only operated on public portions of its website and they did not disclose any of the type of confidential information protected by HIPAA. WGH pointed to American Hospital Association v. Becerra, concerned HIPAA’s confidentiality protections (the Privacy Rule) insofar as the Rule applied to a subset of PHI referred to as individually identifiable health information (IIHI).

The court noted that the patients have alleged that they used WGH’s website to schedule appointments, and that, through its use of the Meta Pixel, WGH disclosed to Facebook, among other things, their status as WGH patients and their identities. The court found that under American Hospital Association, the patients have sufficiently alleged that their IIHI was improperly disclosed through their use of WGH’s website, at the pleading stage.

Standing. Turning next to standing, the court concluded that the patient established Article III standing for damages based on negligence related claims because the unauthorized disclosure of private medical information is a concrete injury. The court found the patients lacked standing for injunctive relief, however, because there was no longer a risk of the injury recurring. The complaint acknowledges that WGH no longer uses trackers on its website. The court dismissed the patients requests for injunctive relief,

Negligence. The court denied the motion with respect to the negligence claim. The court found that the patients adequately pleaded duty, causation and damages. Here there was a duty for the hospital to safeguard PHI because of the patient relationship and the hospital’s promises in its privacy-policy. The court also found causation was adequately pled because of the correlation between the patient’s alleged website activity and subsequent targeted ads they received. The court also found the patients pled damages, including the lost value of PHI and costs associated with mitigating the disclosure.

Negligence per se. The court dismissed the claim that the violations of the FTC Act and HIPAA constitute negligence per se because under Pennsylvania law, negligence per se is not recognized as a standalone claim for statutes lacking a private right of action. Both the FTC Act and HIPAA do not have a private right of action.

Other Claims. The court allowed the claims for intrusion on seclusion claim, breach of contract claim, unjust enrichment claim, breach-of-fiduciary-duty claim to proceed.

UTPCPL. The court found that the claim brought under the UTPCL also survives. The court noted that the patients adequately alleged that WGH was deceptive to their patients and that they pleaded an ascertainable loss, the property value of their personal information.

WESCA. The court determined that the claim brought under WESCA can proceed.

First, the court agreed with cases offered by the patients and adopts the prior reasoning and found that the patients have sufficiently pleaded that the Meta Pixel embedded on WGH’s website was an intercepting “device” within the meaning of WESCA. Here, the court noted that the Meta Pixel qualifies as an intercepting device and the interception of communications was adequately alleged under § 5703(1).

Additionally, the court rejected the hospital’s argument that that, because no one has been criminally prosecuted under WESCA or using the Meta Pixel, the rule of lenity “commands restraint” with regard to the patients’ “vastly overbroad and dramatic reading” of the statute. The court concluded that there is no reason to find that the rule of lenity categorically bars such private causes of action. The court denied the motion to dismiss the WESCA claim at this early stage of the proceeding.

The Case is No. 1:24-cv-00203-SPB.

Judge: Baxter, S.

Attorneys: Amina A. Thomas (Cohen and Malad LLP) for Jeff Brunecz. Neal R. Devlin (Knox Law Firm) for Warren General Hospital.

Companies: Warren General Hospital

Cases: CaseDecisions FederalLegislation EHRNews GeneralNews HITNews HIPAANews CyberPrivacyFeed DataSecurity PennsylvaniaNews DataPrivacy