Atrium Health installed trackers in its mobile app and website to collect patients' data without their consent and then shared that personal information with Google and Facebook for targeted advertising, according to a proposed class action in North Carolina Business Court.

Darielle Hill said Atrium Health directed her to use its website and app while it was providing her healthcare services starting in 2019, and that shortly afterward she began receiving "spam and ads on Facebook and other social media including Google platforms related to her conditions." Hill's complaint, which was assigned to the Tar Heel State Business Court on Monday, states she and her proposed class of fellow web users never consented to having their personal information shared and had a reasonable expectation that the healthcare firm would keep the data private.

"Atrium knows that this sensitive information has tremendous value and that plaintiff and class members would not consent to its use in marketing or its dissemination to Meta and Google if they were provided a choice or would demand significant compensation," the suit says.

Hill seeks to represent a nationwide class consisting of "all individuals residing in the United States whose private information was disclosed to a third party without authorization or consent through the Meta tracking tools or Google tracking tools on defendant's web properties." According to the complaint, that class includes "potentially millions" of current and former patients.

The suit says that full discovery is needed to uncover the extent of Atrium's alleged privacy invasion and unlawful data sharing, but that based on Hill's experience the company has likely at least used Meta Pixel and Google web tracking codes in its website and mobile app.

Atrium faces claims for negligence, violating the Electronic Communications Privacy Act, breaching the company's express and implied contracts with its patients, acting contrary to its implied duty of good faith and fair dealing, breaching its fiduciary duty, and unjustly enriching itself. The suit additionally asserts that the company's conduct goes against the Health Insurance Portability and Accountability Act but did not list a cause of action under that statute.

Hill wants an order requiring Atrium to alert its web users to how it collects and uses their information, provide an opt-out procedure for those who do not want data shared, and erase all information that was allegedly shared without consent. The suit also calls for unspecified damages and attorney fees.

Counsel for the parties did not immediately respond to requests for comment Wednesday.

Hill is represented by Dan M. Wilkerson of The Van Winkle Law Firm and David S. Almeida of Almeida Law Group LLC.

Atrium is represented by Jonathan C. Krisko and Preetha Suresh Rini of Robinson Bradshaw & Hinson PA.

The case is Hill v. The Charlotte-Mecklenburg Hosp. Authority, case number 2024CV057137, in the North Carolina Business Court.