Patients who used Prime Healthcare's websites or patient portals between November 1, 2019, and October 18, 2023, may be entitled to a $20 cash payment or a year of identity monitoring under a proposed $2 million class-action settlement now accepting claims. The deadline to file a claim or opt out is December 21.
The case, Doe, et al. v. Prime Healthcare Services, Inc., et al., case No. 23STCV26800, alleges that Prime Healthcare used tracking pixels on its websites in violation of state and federal privacy laws, according to Claim Depot. The lawsuit claims those tracking pixels may have shared patient information with third parties. Prime Healthcare Services Inc. has agreed to pay $2 million to resolve the litigation, but the company denies any wrongdoing and says it chose to settle to avoid the cost, risk and disruption of continued litigation, per the same report.
Who Qualifies and What They Can Claim
To be eligible, class members must have been patients of Prime Healthcare or one of several listed hospitals and must have accessed a Prime Healthcare web property during the class period. Named patient web properties include Centinela Hospital Medical Center, Chino Valley Medical Center, Desert Valley Hospital, Encino Hospital Medical Center and Harlingen Medical Center, the settlement information states.
Within that broader group, patient-portal subclass members can receive $20 cash after submitting a valid online or mailed claim form, and they also automatically receive a code for a one-year subscription to CyEx Medical Shield Pro. Email subclass members — defined as California Prime Healthcare patients who provided an email address between November 1, 2021, and the end of the class period — automatically receive the same one-year CyEx Medical Shield Pro code without needing to file a claim.
What CyEx Medical Shield Pro Covers
The identity-protection product included in the settlement provides $1 million in identity-theft insurance along with dark-web monitoring, provider-identifier monitoring, medical-record-number monitoring, authentication alerts, security freeze assistance and identity theft recovery assistance, according to the settlement details. Class members who want to enroll have until April 20, 2027, to do so.
Claimants filing online will need the class member ID listed on their settlement notice. The default payout method is a paper check, though those who file online can instead choose electronic transfer.
Costs, Compliance Terms and Next Steps
Beyond the direct payments to patients, the settlement allocates up to $2 million for attorneys' fees and costs, with administration costs estimated at $137,824. Five class representatives may each receive service awards of up to $3,000, totaling $15,000, and any funds left over from uncashed checks will go to the Privacy Rights Clearinghouse.
As part of the deal, Prime Healthcare must refrain from using certain tracking technologies for five years and must conduct annual compliance audits. Kroll Settlement Administration LLC is handling the claims process, with a mailing address of P.O. Box 225391, New York, NY 10150-5391, for those filing by mail. A fairness hearing for final court approval is scheduled for March 9, 2027, and the settlement administrator will distribute payments only after that approval is granted and any appeals are resolved.
Part of a Broader Wave of Healthcare Pixel Lawsuits
The Prime Healthcare case fits into a growing pattern of litigation over web-tracking tools in the healthcare industry. Online tracking technologies have raised patient-data security concerns and spurred a number of similar class-action lawsuits nationwide, according to Healthcare IT News. The U.S. Department of Health and Human Services has stated that regulated entities are not permitted to use tracking technologies in ways that result in impermissible disclosures of electronic protected health information, and that merely notifying users about pixel use for customer relationship management does not authorize disclosure of that information.
HHS guidance has also made clear that it is insufficient for healthcare organizations to simply task tracking-technology vendors with removing or de-identifying protected health information before it is shared. Separately, a federal court vacated part of that HHS guidance in June 2024, specifically the portion stating that HIPAA obligations are triggered whenever an online technology connects a user's IP address to a visit on an unauthenticated public webpage about specific health conditions or providers, according to the U.S. Department of Health and Human Services.
Other health systems have faced similar allegations in recent years. Wellstar Health System reportedly agreed to a $4.25 million settlement over claims it used tracking technologies that disclosed patient information, while Cone Health reportedly agreed to a $1.76 million settlement to resolve claims it used pixel tracking technology to collect and share patient data without consent, according to Top Class Actions. Those figures come from separate reporting and have not been independently verified against official settlement documents.
