LabCorp class action claims company shares patient health info with Google

LabCorp class action lawsuit overview:

• Who: Plaintiffs Michael Wiggins and Teri Stevens filed a class action lawsuit against Laboratory Corporation of America Holdings.
• Why: They allege LabCorp unlawfully shares sensitive patient health information with Google, in violation of Pennsylvania law and the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
• Where: The LabCorp lawsuit was filed in Pennsylvania federal court.

Laboratory Corporation of America Holdings unlawfully shares sensitive patient health information with Google, according to a LabCorp class action lawsuit filed Feb. 13.

Plaintiffs Michael Wiggins and Teri Stevens allege LabCorp installed three types of Google computer code — Google Analytics, Google Ads and Google Display Ads — on its public website. 

The computer code “intercepts an array of individually-identifiable health information from all LabCorp website users and sends this information to Google,” the class action lawsuit claims.

Google is allegedly able to match this information to individual users using “cookies” and analyze their health information on LabCorp’s website.

LabCorp lawsuit says health information is used without patient consent

Together, Google and LabCorp use the individually identifiable health information for various purposes, such as determining how patients use LabCorp’s website and which advertisements they see on the website, the plaintiffs say.

Additionally, the lawsuit alleges LabCorp and Google use this information to sell ads to companies seeking to target advertisements to individuals with certain characteristics.

This commercial use of this information violates Pennsylvania law and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), according to the LabCorp class action. 

These laws ban health care providers from sharing individually identifiable health information with third parties unless such information sharing is necessary for a patient’s treatment or payment, or if a patient has expressly authorized the sharing of the data, the plaintiffs explain.

In recognition of the HIPAA requirements, Google reportedly warns all HIPAA-covered entities that its Google data-collection tools may violate HIPAA and lists steps that entities may take to ensure their Google Analytics use complies with the law.

However, Google and LabCorp allegedly failed to inform website users that their individually identifiable health information would be used for commercial purposes, the class action says.

“Instead, LabCorp’s public-facing policy statements repeatedly promised that it was a safe, secure place to communicate health information, that it treated patients’ individually-identifiable health information as private and confidential, and that it would not share this information, or allow it to be used for commercial purposes, without notice and consent,” the class action lawsuit says.

The plaintiffs filed the LabCorp lawsuit on behalf of themselves and a proposed class of other patients whose protected health information was disclosed to Google without their authorization or consent through the Google data collection tools on LabCorp’s website before March 8, 2023.

LabCorp previously reached an $11 million settlement over allegations it violated the Fair and Accurate Credit Transactions Act by printing debit and credit card transaction receipts that displayed the payment cards’ expiration dates.

What do you think about the class action lawsuit’s allegations that LabCorp shares patient health data with Google? Tell us your thoughts in the comments.

Wiggins and Stevens are represented by David J. Cohen, Ryan F. Stephan, James B. Zouras, Teresa M. Becvar and Michael J. Casas of Stephan Zouras LLP.

The LabCorp class action lawsuit is Michael Wiggins, et al. v. Laboratory Corporation of America Holdings, Case No. 2:24-cv-00648, in the U.S. District Court for the Eastern District of Pennsylvania.

Read About More Class Action Lawsuits & Class Action Settlements:

• 9th Circuit hears objections to $90M Facebook privacy settlement
• Albertsons class action claims retailer sends unwanted text messages
• Google, H&R Block file motions to dismiss data privacy lawsuit
• FCC ruling makes AI-generated robocalls illegal