AZA Wins Class Action Certification Victory Against Hospital System Sharing Patient Information
ST. JOSEPH, Mo. – A Missouri judge has certified a class action lawsuit for thousands of patients whose protected health information was illegally shared with Facebook and Google by their hospital system.
Missouri Circuit Judge Kate Schaefer ordered the certification of a class of patients whose protected health information was shared with Facebook and Google from when they used the password-protected patient portals maintained by their healthcare provider. The judge’s order states that more than 90,000 patients could potentially be involved in the class.
Defendants in this Buchanan County, Mo., case are Mosaic Health System and Heartland Regional Medical Center.
“This case can be expected to create significant ripple effects in healthcare privacy cases around the country,” said AZA partner Foster Johnson. “It is facially illegal for these hospitals to share their patient lists with companies like Facebook and Google, much less every webpage their patients visit and every action they take inside a patient portal, which reveals things such as the doctors patients are seeing, the appointments they are making, and conditions they are being treated for.”
Mr. Johnson said the fact that a judge in Missouri, whose courts have a conservative reputation, certified a class action and set an April 2026 trial date bodes well for similar healthcare privacy cases in other parts of the country.
He explained that Mosaic Health System and other hospitals in similar privacy cases knew that federal HIPAA laws restricted sharing patient data with Facebook and Google, but did it anyway to obtain marketing benefits. “Essentially, the hospitals bartered their patients’ health to Facebook and Google in return for access to sophisticated analytics technologies. While that may have benefited the hospitals financially, it betrayed their patients’ basic privacy rights,” he said.
Mr. Johnson went on to say, “This is an enormous privacy fight nationwide. The government isn’t stopping it despite the laws against it. The only other choice then is to use the courts to stop it.”
The AZA legal team includes Joe Ahmad, Kyle Poelker and Justin Kenney.
Mr. Johnson said this is only the second certification of a class against a hospital or healthcare system, though other cases involving analytics tracking technologies, which are often referred to as “pixel litigation,” have been certified against Facebook and WebMD.
The case is Jane Doe and Janice Doe v. Mosaic Health System and Heartland Regional Medical Center in Buchanan County, Mo, case number 22BU-CC01774-01.
AZA, or Ahmad, Zavitsanos & Mensing, is a Houston-based law firm that is home to true courtroom lawyers with a formidable track record in complex commercial litigation, including energy, healthcare, intellectual property and business dispute cases. AZA was recognized again by Chambers USA 2025 as among the best in Texas in commercial law and intellectual property; the firm has been listed by Best Lawyers’ Best Law Firms as one of the country’s best commercial litigation firms for 13 years; has been named Litigation Department of the Year by Texas Lawyer three times; and was previously dubbed a Texas Powerhouse law firm by Law360.