During a hearing, Judge Vince Chhabria suggested healthcare providers, not Google, bear responsibility for safeguarding patient health information under HIPAA. He noted Google’s disclaimer clarifies that its analytics tool does not meet HIPAA’s privacy requirements and added, “I’m just not sure what else Google is supposed to do.”
The class action, filed in 2023, alleges Google’s tracking technology captures patient data when users access healthcare portals. An investigation cited in the complaint found Google’s source code on 91% of 5,000 health provider websites examined.
The judge previously dismissed the lawsuit in July but allowed plaintiffs another chance to amend their claims.
In September 2023, HHS’ Office for Civil Rights and the Federal Trade Commission sent letters to 66 hospitals and health systems highlighting the risks associated with website tracking tools like those offered by Google.
