AHA urges court to dismiss tracking tech lawsuit against Endeavor Health

The American Hospital Association, along with the Illinois Health and Hospital Association, filed an amicus curiae brief in support of Endeavor Health, an Evanston, Ill.-based health system that is facing a lawsuit over its use of website tracking technologies.

The AHA and IHA urged the 7th U.S. Circuit Court of Appeals to reverse the District Court's ruling, which validated the plaintiff's Electronic Communications Privacy Act claim. The ECPA regulates the interception of electronic communications, prohibits intentional interception without consent and protects the privacy of communications between parties.

The ECPA also has a crime-tort exception, which states that the ECPA's protections no longer apply when someone intercepts a communication "for the purpose of committing any criminal or tortious act."

At the crux of the appeal request is whether the ECPA's crime-tort exception applies in this case.

Plaintiffs in the lawsuit against Endeavor Health, formerly known as Edward-Elmhurst Health, alleged that the hospital violated the ECPA by intercepting and disclosing their private health information to third parties, such as Meta and Google, through tracking technologies embedded on the hospital's website for marketing and analytics.

However, the AHA and IHA argue that the plaintiff's allegations describe lawful purposes -- improving website functionality and disseminating public health information -- rather than the purpose of committing a crime or tort. Therefore, the criminal-tort exception should not apply, they claim.

The case adds context to the hundreds of other lawsuits that concern hospitals' use of third-party tracking technologies -- nearly 300 of which have been filed nationwide since 2022, the brief stated.

"Hospitals and healthcare systems face widespread litigation challenging their use of common online tools," the brief stated. "Across the country, plaintiffs are baselessly alleging violations of federal and state wiretap statutes and other privacy laws, apparently hoping that hospitals will simply pay up rather than defend their beneficial (and ordinary) uses of modern technology."

Given the risk and mounting litigation and insurance costs, defendant health systems often face pressure to settle, the brief continued.

That pressure makes the question of whether the crime-tort exception applies even more poignant, the AHA and IHA stated.

"This Court should hold that the crime-tort exception does not apply when a complaint alleges a lawful purpose. To hold otherwise threatens to criminalize standard online tools used by nearly every industry," they said.

"This includes healthcare providers across the country, federal government agencies, and even the United States Court of Appeals for the Seventh Circuit. As both the complaint and context make clear, the at-issue online technologies are widely used in the healthcare industry for critical, non-criminal and non-tortious objectives."

A recent Rutgers study exemplified the widespread use of this technology in healthcare. Researchers analyzed 12 years of website data from 1,201 hospitals and found that 66% of those hospitals used third-party tracking pixels. What's more, the hospitals that used them were 46% more likely to experience a data breach.

However, the AHA has long held that these technologies serve critical objectives and are widely used because they are key tools for improving website functionality for users, connecting patients to valuable resources and delivering accessible health services. The association claims that analytics tools provide healthcare organizations with insights into the effectiveness of outreach efforts and user demographics, enabling them to better serve their patients.

In 2024, the AHA prevailed in a lawsuit against HHS, with a judge ruling that HHS' guidance limiting the use of tracking technology on providers' websites exceeded its authority under HIPAA. HHS initially sought to overturn the judge's decision but later abandoned its plans to appeal.

Should AHA succeed in reversing the Endeavor Health decision, it would be another win for the provider organizations the AHA represents.

Jill Hughes has covered health tech news since 2021. Her coverage areas include cybersecurity, HIPAA compliance, interoperability, AI and EHRs.