Two patients are suing EHR vendor Cerner, now known as Oracle Health, claiming the company secretly shared their private health information with Google without their knowledge or consent.
Here are six things to know about the class-action lawsuit:
- The lawsuit, filed April 29 in the U.S. District Court for the Western District of Missouri, accuses Oracle Health of embedding tracking technologies like Google Analytics and Google Ads into patient portals used at hospitals.
- The complaint alleges that these tools allowed Google to collect sensitive patient data for advertising and marketing purposes — a violation of federal health privacy laws, the lawsuit claims.
- The plaintiffs, identified in court documents as John Doe and John Doe II, say they used Oracle Health-hosted portals at 2 health systems. They claim that when they logged in to these portals, the EHR vendor enabled tracking software that quietly redirected private health information — such as appointment details, medical test results and doctor messages — to Google’s advertising systems.
- The information shared with Google allegedly included patient IP addresses, device identifiers and even the content of health-related communications.
- The plaintiffs are seeking damages and a court order to stop the EHR vendor from continuing the practice.
- In 2023, HHS’ Office for Civil Rights and the Federal Trade Commission sent letters to 66 hospitals and health systems about the risks associated with this kind of tracking software.
Oracle Health did not respond to Becker’s request for comment.