A few weeks ago we published a database of every healthcare website-tracking lawsuit we could find. We said we’d update it every quarter, and the first update went live this week.
Here’s the quick version:
- 11 new matters added
- 53 existing matters updated, mostly status changes (settlements got final approval, checks went out, motions to dismiss got decided, and a few cases quietly ended)
- A new total of 218 lawsuits and government actions
Three things jumped out at us:
Hospitals aren’t the main target anymore
When we started tracking these cases, the defendant was almost always a hospital. In 2022, 22 of the 25 lawsuits in our database were filed against hospitals or health systems. That’s 88%. This year it’s 8 of 24, or 33%.
So who’s getting sued instead? Telehealth companies, specialty practices, fertility clinics, and the vendors behind all of them. Of the 11 matters we added this quarter, two are telehealth (MDLIVE and a second Hims & Hers case). One is a fertility network, one is a cosmetic surgery chain, one is a pharmacy and its ad-tech vendor, and one is a patient-portal vendor.
That last one deserves a closer look. Veradigm (the company formerly known as Allscripts) hosts patient portals for a lot of providers. In July, a federal judge in Chicago refused to dismiss a class action alleging Google tools were running inside those password-protected portals. The defendant isn’t a hospital. It’s the vendor.
If you build or host websites for healthcare clients, pay attention to that one.
The money got bigger, and the deals split into two templates
Settlements that reached court approval in 2026 total about $146 million across 18 matters in our database. In 2025, the same count was about $42 million across 14. Most of the jump comes from a handful of big ones: Kaiser at $46 million, GoodRx at $32 million (approved in September on the third try, per Bloomberg Law), Wyssta at $12.7 million, and Allina at $12.5 million.
Underneath those headlines, the deals fall into two camps.
- Common fund, pro rata: The big systems write one check and the class members split it. Virginia Mason’s final approval order is a good example. It covered 63,914 claims and $6.7 million paid out, with $90 going to portal users and $45 to website-only visitors.
- Claims-made, no fund: This is the small-hospital template, and the numbers barely vary. You get $20 to $25 per approved claim plus a year of a privacy-monitoring product, with attorneys’ fees paid separately. Across the 40 claims-made deals in the database, the median per-claimant payment is exactly $20. Fairchild Medical Center (a small rural California hospital with about 1,000 class members) and Boone Health (22,197 portal users in Missouri) both signed that template this quarter.
The 2023 cohort is also wrapping up. Rochester, Loyola, Aspirus, Eisenhower, and Garnet Health all reached final approval or issued payments this quarter.
Courts are trimming the legal theories, but the exposure is still there
Defendants won some this quarter. CRH Healthcare got a Google-only case dismissed in July. The Third Circuit affirmed the dismissal of the Tower Health case in August. UnitedHealthcare beat an insurer-portal suit on standing. In all, 20 matters in the database have now ended on the defense side.
But look at what’s surviving. The federal wiretap claim (the ECPA, in lawyer shorthand) got past a motion to dismiss at Culbertson Memorial, KSB Hospital, Warren General, Beth Israel Deaconess, Sono Bello, and Veradigm. The pattern we’re seeing is that judges trim the state-law claims and let the federal one go forward.
Blue Cross Blue Shield Association is down to a single California claim. Sono Bello is down to ECPA alone. Both cases are still alive, and both defendants are still paying lawyers.
Two outside events will shape the next quarter. California’s SB 690, signed on September 30, takes away the private “trap and trace” claim that had kept the TrueCare case going. And the Seventh Circuit is sitting on the Stein v. Edward-Elmhurst appeal, which asks whether the federal wiretap law reaches a hospital that didn’t intend any crime. Several Illinois critical-access hospital cases are frozen until that decision comes down.
What changed in the database itself
Every row we touched this quarter was checked against a source and stamped with a verification date of October 5, 2026. In a few cases, the only evidence of a court’s approval was a law firm’s blog or a settlement aggregator. We left those at a generic “Settled” rather than claim an approval we haven’t read. We also fixed two older records (Jefferson Healthcare and Cameron Memorial) once we finally tracked down the orders.
The database page now lets you share any filtered view as a link. Want every Google-only case? Every telehealth defendant? Every settlement with payments issued? Filter for it and send the URL to a colleague. The Google tracker view is a good place to start.
If you spot something wrong or missing, email info@sounderdata.com. The data is published under CC BY 4.0, so use it, cite it, and tell us what you find.
And if you’re not sure what’s running on your own website, our free HIPAA website scan will tell you in a few minutes.
I’m not a lawyer. Nothing here is legal advice. Every lawsuit in the database is an allegation unless a court order says otherwise, and the counts above reflect the cases we found, not every case filed.
