The Seventh Circuit Court of Appeals has ruled against Goshen Health System, Inc. in a case concerning the sharing of patient health data without consent. This decision, made on October 20, 2026, affects how hospitals manage patient information and raises questions about privacy rights in the digital age.
The case, Kaitlin Lamarr v. Goshen Health System, Inc., was part of a larger legal battle involving multiple healthcare providers in Indiana and Illinois. The ruling clarifies the extent to which healthcare providers can claim federal jurisdiction when accused of violating state privacy laws.
Background
Kaitlin Lamarr, a patient, filed a lawsuit against Goshen Health System, claiming that the hospital shared her health data through a Facebook tracking tool called the Meta Pixel without her consent. This lawsuit was part of a broader class action against several healthcare providers, including Columbus Regional Health and Hancock Regional Hospital, all of which faced similar allegations regarding the unauthorized sharing of patient data.
The healthcare providers argued that they were acting under federal authority when they created online patient portals, which are required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. This law incentivizes healthcare providers to adopt electronic health records and make them accessible to patients. However, the providers claimed that their actions fell under the federal officer removal statute, allowing them to move the case from state to federal court.
The district court disagreed, ruling that Goshen Health and the other providers were not acting under federal authority when they created their patient portals. This decision prompted the healthcare providers to appeal, leading to the consolidation of multiple related cases in front of the Seventh Circuit.
The Ruling
The Seventh Circuit Court, led by Judge Lee, upheld the district court's decision, affirming that the healthcare providers did not qualify for federal jurisdiction under the federal officer removal statute. The court stated, "the health care providers were not 'acting under' an officer or agency of the federal government when they created their patient health portals."
The court emphasized that although the healthcare providers were subject to federal regulations, this did not equate to them acting under federal authority. The ruling pointed out that the patient portals were private websites designed primarily for the benefit of the providers and their patients, not the federal government. The court noted, "Private firms retain their private character even when many aspects of their conduct are controlled by federal statutes and rules."
Impact
This ruling has significant implications for healthcare providers and patient privacy rights. By affirming that the healthcare providers were not acting under federal authority, the court reinforced the idea that compliance with federal regulations does not grant entities the same legal standing as federal contractors. This decision may deter healthcare providers from attempting to shift liability to federal jurisdiction in future cases involving patient data privacy.
The ruling also underscores the importance of patient consent in the management of health data, especially as digital health records become more prevalent. Patients may feel more empowered to challenge healthcare providers if they believe their data has been mishandled.
What’s Next
The healthcare providers involved in this case may consider appealing the ruling to the U.S. Supreme Court, although details were not available in the court filing regarding any plans for further legal action. The outcome of this case may also influence other pending lawsuits related to health data sharing practices across the country.