The Two Marketers, Two Hospitals, and One Indiana Law Firm That Prompted Our Research
Last year I gave a HIPAA talk at a state healthcare marketing conference. Afterward, two marketers came up to me separately with the same story. Each worked at a critical-access hospital. (That’s a federal designation for rural hospitals with 25 beds or fewer. It comes with special Medicare payment rules and, usually, a very small marketing department, maybe 1 or 2 people mostly focused on events.) Their hospitals were in adjoining counties. Both had just been sued over the tracking code on their websites.
When I got home I pulled the court filings. Same out-of-state law firm. Same complaint, nearly word for word. One anonymous plaintiff in each case. Neither lawsuit had made the healthcare press.
That’s how the Sounder lawsuit database got started. I told the whole story when we launched it in September. It now holds 218 matters, and I’ve finally sat down and looked hard at the slice that got me into this: small and rural hospitals.
In this post I’ll walk through who’s filing these cases, how they get filed (in bunches, it turns out), what the patients and the lawyers actually got out of the settlements, and the cases the hospitals won. I’m not a lawyer. I’m a technical digital marketer with math and computer science degrees. However, I do read dockets (when forced to). Treat this as reporting, not legal advice.
Seven Illinois Providers Sued in Six Weeks
Starting September 5, 2024, complaints landed against these seven Illinois hospitals and clinics, one after another:
| Filed | Defendant | Beds | Court | Plaintiff’s firms |
|---|---|---|---|---|
| September 5, 2024 | KSB Hospital, Dixon (now OSF Saint Katharine) | 80 | N.D. Ill. | Cohen & Malad, Stranch Jennings & Garvey, Strauss Borrelli |
| September 6, 2024 | Sarah D. Culbertson Memorial Hospital, Rushville | 22 | C.D. Ill. | Cohen & Malad, Stranch Jennings & Garvey |
| September 12, 2024 | Memorial Hospital, Carthage | 18 | C.D. Ill. | Cohen & Malad |
| September 13, 2024 | Pinckneyville Community Hospital | 20 | S.D. Ill. | Cohen & Malad, Stranch Jennings & Garvey |
| September 19, 2024 | Foot & Ankle Center of Illinois, Springfield | podiatry group | C.D. Ill. | Cohen & Malad, Stranch Jennings & Garvey |
| October 4, 2024 | Deaconess Illinois Union County Hospital, Anna | 25 | S.D. Ill. | Cohen & Malad, Stranch Jennings & Garvey |
| October 17, 2024 | Deaconess Illinois Red Bud Regional Hospital | 25 | S.D. Ill. | Cohen & Malad, Stranch Jennings & Garvey, Strauss Borrelli |
Seven complaints in six weeks filed by the same Indianapolis firm. These are not big health systems. Memorial Hospital in Carthage, Illinois has 18 beds.
Each case was filed by a single anonymous plaintiff. Each complaint lists the same tools: Meta Pixel, Google Analytics, Google Tag Manager, and in several cases ad-tech names most hospital marketers have never heard of (Simpli.fi, Frequence, The Trade Desk, Xandr). Those last ones usually arrive through a digital ad agency’s tag, not through anything the hospital installed on purpose.
How does a firm in Indianapolis find a 20-bed hospital in southern Illinois to sue? The honest answer is that it’s easy. Anyone with a browser can open a hospital’s website, pull up the developer tools, and see every third-party server the page talks to. It takes about a minute per site. Find the pixels, find a patient willing to be Jane Doe, and file.
The Same Three Firms Show Up Again and Again
The database now has ten critical-access hospitals. Cohen & Malad of Indianapolis is plaintiff’s counsel on nine of them. Stranch Jennings & Garvey of Nashville is on eight. Strauss Borrelli of Chicago is on five. The one exception is Mammoth Hospital in California, a 17-bed district hospital, where the complaint was led by Ahmad Zavitsanos & Mensing of Houston with Strauss Borrelli.
Illinois wasn’t their first sweep. In May 2023 the same group filed against a batch of Indiana hospitals in Marion County Superior Court in Indianapolis within about a week of each other: Witham Health Services in Lebanon (May 18), Hancock Regional in Greenfield (May 23), Goshen Health (May 23), Columbus Regional Health, and The Methodist Hospitals in Gary. Margaret Mary Health in Batesville followed that August. Reid Health in Richmond and Cameron Memorial in Angola were sued that November, a couple of days apart.
Class-action Firms Specialize
These types of firms find a legal theory that works, they build a complaint around it, and they repeat it. That’s exactly what happened with website accessibility lawsuits under the ADA, and it’s what I wrote about in The HIPAA Lawsuit Avalanche is Coming. The difference here is who’s on the receiving end: hospitals with 20 beds, no in-house lawyer, and a website that was probably built by a local agency five years ago.
Patients Aren’t Getting Much from These Suits
Most of these cases settle on what I’ve started calling the “$25 and a subscription” template. The settlement is claims-made, meaning there’s no pot of money. Patients who fill out a claim form get a small check and a year of a privacy-monitoring product. The hospital pays the claims, the administration costs, and the plaintiffs’ attorneys’ fees separately.
| Hospital | Beds | What each patient gets | Attorneys’ fees | Status |
|---|---|---|---|---|
| Margaret Mary Health, Batesville, Ind. | critical access | $25 plus Privacy Shield Pro | $215,329 requested | Preliminary approval September 2025. Final hearing December 2025, order not located |
| Mammoth Hospital, Mammoth Lakes, Calif. | 17 | $20 plus one year of CyEx Privacy Shield Pro | $380,000 requested | Final approval hearing November 2025. No order posted as of October 2026 |
| Jefferson Healthcare, Port Townsend, Wash. | 25 | No cash. A voucher for a 12-month Privacy Shield subscription (valued at $330 in the filings) | $125,000 awarded | Final approval granted January 12, 2026 |
| Fairchild Medical Center, Yreka, Calif. | 25 | $25 plus one year of CyEx Privacy Shield Pro | $100,000 requested | Final approval hearing October 15, 2026. Order not yet posted |
Look carefully at Jefferson Healthcare, because that one is finished and the order is public. Notice went out to about 54,000 people. Three opted out. Four objected. The court approved the deal anyway, awarded $125,000 in fees, and Jefferson agreed not to use Meta Pixel for two years. Nobody in the class got a dollar.
The Mammoth number is worth a second look too. Those in the industry may have seen it reported as a “$380,000 settlement.” It isn’t. That’s the fee request. The patients each get $20.
Two cautions. First, Margaret Mary, Mammoth, and Fairchild are fee requests, not awards, and courts do often reduce these. Second, none of these figures include the hospital’s own defense costs, which never show up on a docket. A 17-bed hospital doesn’t have a legal department. It has an outside firm billing them by the hour.
Small Hospitals Have Won Some of These
Small hospitals have beaten some of these complaints, and the ones that fought are worth learning about.
- Colquitt Regional Medical Center, Moultrie, Georgia: The court threw out the Cohen & Malad group’s complaint in May 2025. The allegations were conclusory, and the plaintiff could only point to a potential compromise of information, not an actual one.
- Pinckneyville Community Hospital, Illinois: The plaintiff voluntarily dismissed the case in April 2025, seven months after filing it. I couldn’t find a refiling in state court.
- Penn Highlands Healthcare, DuBois, Pennsylvania: A rural system, dismissed in February 2026. The Pennsylvania wiretap claim failed because the complaint never said what health information was actually disclosed.
But wins have costs. Colquitt still had to pay lawyers to get the case dismissed. A dismissal is better than having to pay a settlement, but it still has a cost.
And Some Actions Are Proceeding
In Carthage, the core claims (negligence, unjust enrichment, and the federal wiretap statute) survived the motion to dismiss in September 2025. In Rushville, a judge revived the federal wiretap claim in March 2026 on the theory that a disclosure violating HIPAA can serve as the crime behind a wiretap claim, and that case is now in discovery. The two Deaconess Illinois hospitals, Union County and Red Bud, had their wiretap claims survive in September 2025 and were consolidated into one case that is also in discovery.
And Cameron Memorial in Angola, Indiana, has been sitting in a federal court stay since September 30, 2024, waiting on appeals in three other Indiana hospital cases. All three of those have since settled.
It Can Be Your Vendor’s Code and Still Be Your Lawsuit
One more case belongs in any conversation about small hospitals, even though no hospital is named as the defendant.
HSCGP, LLC is the web-services company behind the patient portals for 54 LifePoint and Duke LifePoint community hospitals around the country. In October 2023 a single class action was filed against HSCGP in Nashville, and that one case covered all 54 hospitals’ portals at once. It settled claims-made at $38 per claim, with attorneys’ fees of up to $8 million sought. The firms were Cohen & Malad, Milberg, and Stranch Jennings & Garvey.
I bring this up for two reasons. If you run a small hospital, you probably didn’t choose the pixel on your portal. Your vendor did. Unfortunately, it doesn’t matter because you are the entity subject to the privacy laws.
And if you’re an agency or a web developer serving hospitals, read that paragraph again, because in this case, the vendor was the one who got sued.
What Next?
Start from a place of knowledge. Use our free website compliance scanner to find out what is on your site now. Once you know what possible violations you have, pass the report on to your web vendor, your ad agency, and whoever else might be responsible for putting the problems on your site. Collect their thoughts and rationales for the code being on the site. You’ll then have to decide if you’re going to keep or keep or remove the code. We recommend you make those decisions with advice from your attorney.
If you’d like a second set of eyes on your site, that’s what we do at Sounder. No high-pressure sales, just advice from a team with a lot of experience.
Database Information
We will update this post along with the database each quarter. And the usual reminder: I’m not a lawyer, nothing here is legal advice, and every defendant named above is accused, not found liable, unless a court order says otherwise.
If you know of a small-hospital case that isn’t here, or know if any of our information is incorrect or incomplete, please email hello@sounderdata.com and I’ll fix it in the next quarterly update.
