Key Takeaways
- LifeStance Health reached a proposed settlement deal of over $3 million in a class-action lawsuit over alleged collection and sharing of patient data through third-party tracking pixels.
- The class-action lawsuit concerns over 1 million patients whose data was allegedly disclosed to technology companies, such as Meta and Google, between March 2020 and April 2023.
- Data allegedly shared through the tracking technology includes names, birthdates, locations, searches for mental health services, telehealth activity, and URL visits from the LifeStance website.
- A proposed settlement would require LifeStance to stop using third-party tracking pixels, should they be used, and create a settlement fund for affected patients.
What Happened
LifeStance Health, one of the largest providers of outpatient mental health services in the country, is proposing to settle a class action lawsuit involving alleged third-party tracking technology on its website. Two individuals who previously sought care through LifeStance are representing more than 1 million individuals who, according to the allegations, the practice tracked from March 2020 to April 2023. The lawsuit claims that the website’s tracking pixels collected and transmitted information to third parties, such as Meta and Google.
Information allegedly collected by the tracking pixels included patients’ names, birth dates, locations, searches for mental health services and therapists, telehealth waiting-room activity, and the text of URLs visited on the website. As for the allegations, some of the information may also be linked to unique identifiers tied to user profiles on third-party platforms.
LifeStance denied the allegations, noting that patient privacy and safety play an important role in its operations. The proposed settlement is valued at slightly more than $3 million and involves conditions related to the feature use of tracking pixels.
Privacy and Governance Concerns
The main privacy issue with this technology is the disclosure of sensitive personal information through tools designed to track activity on a website and for advertising. While ordinary website tracking may not pose any serious issues, information related to mental health services can provide details of an individual’s health status and preferences or desire for treatment. As alleged in the suit, the tracking pixels installed by LifeStance tracked information such as names, birthdays, searches for treatment and therapy, telehealth visits, location, and URLs and disclosed it to third parties.
Other issues involve the tracking technology’s use: profiling. According to the lawsuit, the information sent to Facebook can be linked to a unique Facebook user identifier; thus, information about interactions with the LifeStance website may become linked to the user’s profile. This issue poses problems beyond cybersecurity, as it involves the routine collection and transfer of information rather than a website vulnerability.
At the same time, healthcare privacy governance also raises concerns. While LifeStance claims its commitment to HIPAA and privacy compliance, court documentation shows that healthcare organizations cannot use tracking technology to disclose information about patients’ private interactions without their informed consent. The issue raises questions about how organizations evaluate third-party technologies they choose to implement and how current privacy protection systems cope with modern advertising and analytics technologies.
Why It Matters / Policy Considerations
The LifeStance case shows that protecting healthcare information goes beyond securing electronic medical records and preventing data breaches. Today, healthcare organizations depend on websites, analytics and advertising technologies, and third-party applications that can collect visitor information. Without proper controls, such information can escape an organization’s protection without any traditional cyberattack.
Organizations must discuss how well they assess the privacy and security risks of using these third-party technologies from a policy perspective. Organizations can ensure their third-party technologies undergo a comprehensive assessment that includes an analysis of what information the technology uses, who receives it, and whether patients have consented to that data collection.
Furthermore, transparency and accountability are also important considerations here. Patients should know when their information is collected and with whom it is shared, if at all. For example, the proposed LifeStance settlement provides monetary compensation for affected patients and discontinuance of any third-party tracking pixel, if it exists.
