The Fifth Circuit Court of Appeals has reversed a lower court's dismissal of a class action lawsuit against Eyemart Express, LLC, concerning the alleged unauthorized sharing of private health information with Meta Platforms, Inc. The court's decision, filed on October 23, 2026, allows the case to proceed, potentially impacting how companies handle sensitive health data.
The plaintiffs in this case, five Facebook users, claimed that Eyemart's use of an Internet tracking tool called the Pixel led to the unauthorized disclosure of their private health information to Meta. This ruling is significant as it touches on privacy concerns in the digital age, particularly regarding health data that is often considered sensitive.
Background
The plaintiffs—Rachelle Rand, Esperanza Gottschau, Ramon Soto, Georgianna Lash, and Aaron Mees—filed their lawsuit after using Eyemart's website to browse and purchase prescription eyewear. They alleged that Eyemart shared their health-related information, such as prescription data and appointment scheduling, with Meta without their consent. The plaintiffs argued that this information qualifies as individually identifiable health information (IIHI) under the Health Insurance Portability and Accountability Act (HIPAA).
The case began in the United States District Court for the Northern District of Texas, where the district court dismissed the lawsuit, stating that the plaintiffs failed to adequately allege that their IIHI was shared with Meta. The plaintiffs appealed the decision, arguing that the district court erred in its interpretation of the facts and the law.
The Ruling
The Fifth Circuit Court of Appeals ruled in favor of the plaintiffs, reversing the lower court's dismissal. The court found that the plaintiffs had sufficiently alleged that their IIHI was shared with Meta through Eyemart's use of the Pixel. The opinion stated, "The unauthorized disclosure of Plaintiffs’ health information naturally traces to Eyemart, which is the entity that gave Meta access to its users’ private information without their knowledge or consent."
Furthermore, the court emphasized that the plaintiffs had standing to bring the case, as they suffered a concrete injury due to the unauthorized disclosure of their health information. The court noted, "We agree. Plaintiffs have suffered an actionable injury in fact in the unauthorized disclosure of their IIHI to Meta." The judges involved in this ruling were Haynes, Higginson, and Ho.
Impact
This ruling has significant implications for privacy rights and the handling of health information in the digital marketplace. It highlights the importance of obtaining user consent before sharing sensitive health data with third parties. The decision may also encourage other individuals who believe their health information has been mishandled to seek legal recourse.
Moreover, this case could set a precedent for how companies must operate regarding user consent and data sharing, particularly in the context of health-related information. As more businesses adopt similar tracking technologies, the need for clear regulations and practices around user consent and data protection becomes increasingly crucial.
What's Next
The case has been remanded to the lower court for further proceedings, allowing the plaintiffs to pursue their claims. It remains to be seen how Eyemart will respond to the ruling and whether they will seek to appeal the decision further.