HIPAA Tracking Roundup: Three More Pixel Settlements Hit the Docket (Plus Google Quietly Changed Its Pharma Ad Rules)

If you took a vacation last week hoping the pixel lawsuit wave would slow down... it didn't.

Three more healthcare organizations are staring down settlement deadlines this month, all for the same thing: Meta Pixel on patient-facing websites, transmitting data to ad platforms without consent. Meanwhile, Google slipped in a pharma ad policy change that most healthcare marketers haven't noticed yet.

Let's get into it.

The Settlements Keep Stacking Up

Northwell Health & NorthBay Healthcare

Two settlements, one theme.

Northwell Health, one of New York's largest health systems, is wrapping up a pixel tracking class action. Claims are due April 20, with the final approval hearing the very next day on April 21. Class members can receive a $15 cash payment plus 12 months of privacy monitoring.

NorthBay Healthcare in California already passed its opt-out window (March 12) and got its final fairness hearing on March 19.

Both cases alleged the same playbook: website tracking tools quietly shipped patient data to Meta, Google, and other third parties. No patient consent. No BAA. Just pixels doing what pixels do when nobody's watching.

Why this matters for you: These aren't small clinics getting caught off guard. Northwell has 80,000+ employees. If a system that size can't keep its tracking compliant with internal resources alone, that tells you something about how tricky client-side pixels are to manage.

Catholic Health System

Catholic Health System out of Buffalo, NY has its own pixel settlement working through the courts right now. The timeline:

March 11 was the deadline to object or opt out
April 10 is the claims deadline
April 23 is the final fairness hearing

Same allegations as the others. Tracking pixels on patient-facing pages. PHI flowing to third parties. No proper authorization in place.

Why this matters for you: Faith-based and community health systems sometimes assume they're too small to be targets. They're not. Plaintiff attorneys are filing these cases across every segment of healthcare, from large academic medical centers down to regional systems. If your website has a Meta Pixel and a patient portal, you're in the crosshairs regardless of size.

Duly Health & Care: $1.88M

Duly Health and Care (formerly DuPage Medical Group, one of the largest independent physician groups in Illinois) had its final fairness hearing on April 7, just yesterday.

The settlement fund: $1.88 million.

The allegation: Meta Pixel tracking code on their website transmitted personal and protected health information to Meta Platforms. Patients who logged into the authenticated portion of the website between July 2020 and April 2023 were affected.

Why this matters for you: This one is notable because it specifically calls out the authenticated portion of the website. That means the patient portal, the login area, the places where the most sensitive data lives. It's a reminder that the riskiest pixels aren't necessarily on your homepage. They're behind the login screen, where patients check test results and book appointments.

Google Quietly Updated Its Pharma Ad Rules

While the lawsuit headlines dominate, Google made a policy move in January 2026 that flew under the radar for a lot of healthcare marketers.

What changed: Google AdMob updated its pharmaceutical advertising policies. On the Google Ads side, they reintroduced limited healthcare professional (HCP) targeting for eligible B2B health advertisers. Think: medical device manufacturers, professional service providers, and pharma companies that want to reach clinical audiences directly.

The catch: Consumer health targeting is still highly restricted. So if you're running ads aimed at patients (which most of you reading this are), your targeting options haven't expanded.

Why this matters for you: If you have a B2B arm of your practice or you're marketing to referring physicians, this opens up some new targeting capabilities worth exploring. But the compliance layer still applies. Server-side tracking remains the safe path for any healthcare advertising that touches patient data, whether you're targeting HCPs or consumers.

The Big Picture

Here's what stands out this week: the pace of pixel settlements isn't slowing down. If anything, it's accelerating. We're tracking multiple final hearings and claims deadlines in April alone, and these are just the ones that made it to settlement. Plenty more are still working through the courts.

The common thread across every single one of these cases? Client-side tracking pixels on healthcare websites that sent patient data to ad platforms without proper safeguards.

Server-side tracking isn't just a compliance checkbox. It's the difference between running your campaigns with confidence and hoping you don't end up on next week's settlement list.

HIPAA Tracking Roundup: Three More Pixel Settlements Hit the Docket (Plus Google Quietly Changed Its Pharma Ad Rules)

Want to stay up to date on the latest in healthcare marketing?

HIPAA Tracking Roundup: Three More Pixel Settlements Hit the Docket (Plus Google Quietly Changed Its Pharma Ad Rules)

Want to stay up to date on the latest in healthcare marketing?