Veradigm lawsuit highlights digital health data privacy regulatory risks

Patient Portal Data Tracking Lawsuit: A Digital Health Industry Warning from the Veradigm Case

Introduction

Data privacy issues in the digital health field have once again come into focus. In April 2025, U.S. healthcare information technology company Veradigm (formerly Allscripts) failed to secure a dismissal in a class action lawsuit—plaintiffs alleged that the company transmitted personal health data to third parties (including Facebook parent company Meta) without authorization through patient portals, violating federal and state privacy laws. This ruling not only exposes Veradigm to potential compensation risks but also sends a strong signal to the entire medical technology industry: patient data sharing practices are facing increasingly stringent judicial and regulatory scrutiny.

Industry Context

Patient portals have become a core component of digital health infrastructure. According to data from the American Hospital Association, over 90% of hospitals offer patients online portals for viewing medical records, scheduling appointments, paying bills, and communicating with doctors. However, these platforms often embed third-party tracking technologies, such as Meta Pixel or Google Analytics, to analyze user behavior or target advertisements. In this process, medical technology companies have gradually blurred the boundary between "operational improvement" and "commercial exploitation."

The U.S. Health Insurance Portability and Accountability Act (HIPAA) has strict provisions on the disclosure of protected health information (PHI), but the widespread presence of third-party tracking codes has sparked compliance controversies. As early as 2022, the U.S. Department of Health and Human Services (HHS) issued guidance explicitly prohibiting the sharing of PHI through tracking technologies without patient authorization. However, industry inertia meant that many vendors did not re-evaluate their data chains until lawsuits erupted.

Key Developments

The core dispute in the Veradigm case is whether tracking codes embedded in patient portals sent health-related browsing behavior (such as doctor names, appointment reasons) to third parties like Meta without users' knowledge. The plaintiffs argue that Veradigm's actions constitute "intentional or reckless violation of HIPAA" and violate state unfair competition laws.

Although Veradigm argued that its data sharing met the "operational purposes" exception and emphasized that users had consented to the cookie policy, a federal court in Illinois ruled in April 2025 that the plaintiffs' allegations were "sufficient to proceed to the discovery phase." This means the court will thoroughly examine the gap between Veradigm's data sharing agreements and actual code behavior.

---

Similar cases have already spread across the medical technology sector.Similar cases have been spreading in the healthcare technology sector. In 2023, Meta faced multiple lawsuits for tracking patient data through hospital websites. In 2024, the telemedicine platform BetterHelp reached a $7.8 million settlement with the FTC for sharing user data without consent. The ongoing development of the Veradigm case indicates that regulatory forces and patient advocacy awareness are forming a combined effort.

Market Implications

For patient portal vendors and digital health companies in a broader sense, the potential consequences of the Veradigm lawsuit cannot be overlooked:

• Rising compliance costs: Companies may need to reassess all third-party tracking codes, or even completely remove unnecessary data sharing modules. A partner at law firm Foley & Lardner noted that the case could trigger a "vaccine effect," prompting health IT companies to proactively conduct privacy impact assessments.
• Business model setbacks: Many healthcare technology companies rely on insights generated from aggregated anonymized data to support their profit models. If data sharing channels are blocked, advertising revenue based on patient browsing behavior or machine learning training data pools will be impacted.
• Accelerated market differentiation: Companies with transparent privacy policies and technical compliance capabilities may gain a competitive advantage. For example, portal vendors like Epic Systems, which have built their own analytics platforms, can more easily avoid risks compared to small startups that rely on third-party tracking.

At the same time, health insurance institutions, medical institutions, and pharmaceutical companies, as downstream consumers of patient data, will also face higher due diligence obligations—they need to ensure that their technology vendor partners have removed all unauthorized tracking codes.

Challenges And Risks

The current data privacy regulation in the digital health field faces three major structural contradictions:

1. Legal framework lags behind technological evolution: HIPAA mainly targets traditional medical record exchange, but whether behavioral data in patient portals (such as clickstreams, search keywords) constitutes PHI remains a gray area. The Veradigm case may push courts to clarify whether "browser-level health signals" are protected under HIPAA. 2. Misalignment between user expectations and commercial reality: Patients generally believe portals are only for managing health, while companies view them as channel extensions. Surveys show that 87% of patients do not want their portal browsing behavior used for advertising, but over 40% of hospital websites still have tracking tools configured. 3. Fragmented global regulation: The United States lacks a unified privacy legal framework like the EU's GDPR, and state laws (such as California's CCPA, Illinois' BIPA) intertwine with HIPAA, making compliance for national companies face regional risks.

Future Outlook

• In the next 3-5 years, three notable trends will emerge in the digital health data sharing field:- Further refinement of regulatory standards: HHS may revise HIPAA rules to explicitly prohibit the use of patient portal data for non-treatment purposes without explicit consent. The U.S. Federal Trade Commission (FTC) also announced in 2024 that it will increase enforcement against health data misuse.
• Emergence of technical solutions: Enterprise-level "privacy-native" patient portals will rise, employing technologies such as localized analytics and differential privacy to cut off raw data flows to third parties while maintaining operational efficiency.
• Evolution of insurance and contract terms: Data privacy lapses by health tech companies will trigger new insurance products (e.g., cyber insurance with added privacy liability coverage), while contracts between hospitals and vendors will include mandatory data-sharing audit clauses.