A North Carolina court has ruled on a significant case involving WakeMed Health and Hospitals, which has been accused of improperly sharing patient data with Meta Platforms, Inc., the parent company of Facebook. The ruling, issued by Judge Adam M. Conrad on December 4, 2023, addresses claims made by a group of patients who allege that their personal and medical information was disclosed without their consent. This case is important as it raises questions about patient privacy and the responsibilities of healthcare providers in safeguarding sensitive information.
The plaintiffs in this case, Trace Weddle, Linda Matthiae, and Kim Naugle, filed a class-action lawsuit against WakeMed, claiming that the hospital system allowed Meta access to their personal data for marketing purposes without their knowledge. The plaintiffs asserted multiple claims, including negligence and breach of fiduciary duty, arguing that WakeMed's actions violated their rights to privacy and confidentiality. The case was brought before the North Carolina Business Court under docket number 22-CVS-13860.
The controversy centers around the use of a tool called the Meta Pixel, which is software that collects data from users interacting with websites. WakeMed reportedly embedded this tool in its patient portal in March 2018, allowing Meta to gather sensitive patient information, including medical histories and contact details. The plaintiffs contend that WakeMed failed to inform them about the Pixel's presence and did not obtain their consent to share their information with Meta. Following media reports in June 2022, WakeMed removed the Pixel and later notified patients about the data collection.
The plaintiffs brought forth several claims against WakeMed, including negligence, invasion of privacy, breach of implied contract, and violation of the North Carolina Electronic Surveillance Act. They argued that the unauthorized access to their sensitive information constituted a breach of trust and legal obligations by the healthcare provider.
In the ruling, the court addressed WakeMed's motion to dismiss the complaint. Judge Conrad granted the motion in part and denied it in part. Specifically, the court dismissed claims for negligence per se, invasion of privacy, unjust enrichment, and violation of section 75-1.1, stating that these claims did not meet the necessary legal standards. However, the court allowed the claims for common-law negligence, breach of implied contract, and breach of fiduciary duty to proceed.
The court ruled, "The negligence per se claim is untenable because neither the FTC Act nor the HIPAA regulations are public safety laws." Judge Conrad emphasized that the plaintiffs had adequately stated a claim for common-law negligence, asserting that WakeMed had a duty to protect patient information and failed to do so.
Judge Conrad's opinion clarified that while the plaintiffs could not pursue certain claims, they successfully established a basis for others. The court noted that WakeMed owed a duty of care to its patients regarding the handling of confidential information. The ruling indicated that the plaintiffs had a legitimate expectation that their sensitive data would be kept private and secure.
This decision has significant implications for the healthcare industry, as it underscores the importance of patient privacy and the legal responsibilities of healthcare providers. The ruling may set a precedent for how similar cases are handled in the future, particularly regarding the use of technology and data collection in healthcare settings. It also highlights the ongoing concerns surrounding data privacy in an increasingly digital world.
Moving forward, the case will continue to progress in court, with the plaintiffs seeking to prove their claims regarding common-law negligence, breach of implied contract, and breach of fiduciary duty. The court's decision allows these claims to be explored further, potentially leading to a trial where the details of the case will be examined more closely.
As for appeals, the court's ruling could be subject to appeal by WakeMed, especially concerning the claims that were allowed to proceed. The outcome of this case could have lasting effects on how healthcare providers manage patient data and the legal frameworks governing such practices. The plaintiffs' fight for accountability may pave the way for greater scrutiny of data-sharing practices in the healthcare industry.
