Atrium Health Settles Pixel Tracking Lawsuit for $1.8M Over Patient Data Exposure
Atrium Health, a North Carolina-based healthcare system operating 12 hospitals and over 900 care facilities, has agreed to a $1.8 million settlement to resolve a class-action lawsuit tied to its use of tracking technologies on its MyAtriumHealth patient portal. The lawsuit stemmed from the unauthorized disclosure of protected health information (PHI) to third-party providers, including Meta (Facebook) and Google, between January 1, 2015, and July 31, 2019.
An investigation revealed that up to 585,959 patients may have had their data exposed, including IP addresses, third-party identifiers, and form-submitted details such as names, email addresses, phone numbers, and demographic information. Atrium Health assumed all portal users during the affected period were impacted.
The consolidated lawsuit Julie Roberts, et al. v. The Charlotte-Mecklenburg Hospital Authority alleged violations of patient privacy, citing breach of contract, negligence, and unjust enrichment due to the undisclosed use of tracking tools. While Atrium Health denied wrongdoing and sought dismissal, the case proceeded before reaching a settlement.
Under the agreement, a $1.8 million fund will cover:
- $1.5 million for attorneys’ fees, administrative costs, and payments to Group 1 claimants (patients who accessed the portal between 2015–2019).
- Up to $300,000 for Group 2 claimants (patients with accounts between 2015–2024 but who did not access the portal during the 2015–2019 window).
- Pro rata payments for Group 1 and up to $10 per claim for Group 2.
Key deadlines include an opt-out/object deadline of August 31, 2026, and a claims submission deadline of September 28, 2026, with a final fairness hearing scheduled for September 30, 2026. The settlement underscores the risks of third-party tracking tools in healthcare portals and their potential for unauthorized PHI disclosures.
Source: https://www.hipaajournal.com/atrium-health-pixel-data-breach-settlement/
ATRIUM HEALTH SYSTEM cybersecurity rating report: https://www.rankiteo.com/company/atrium-health-system
"id": "ATR1784478526",
"linkid": "atrium-health-system",
"type": "Breach",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '585,959 patients',
'industry': 'Healthcare',
'location': 'North Carolina, USA',
'name': 'Atrium Health',
'size': '12 hospitals and over 900 care facilities',
'type': 'Healthcare System'}],
'attack_vector': 'Third-party tracking tools',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '585,959',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Protected health information '
'(PHI), IP addresses, third-party '
'identifiers, names, email '
'addresses, phone numbers, '
'demographic information'},
'date_detected': '2019-07-31',
'description': 'Atrium Health, a North Carolina-based healthcare system, '
'agreed to a $1.8 million settlement to resolve a class-action '
'lawsuit tied to its use of tracking technologies on its '
'MyAtriumHealth patient portal. The lawsuit stemmed from the '
'unauthorized disclosure of protected health information (PHI) '
'to third-party providers, including Meta (Facebook) and '
'Google, between January 1, 2015, and July 31, 2019. Up to '
'585,959 patients may have had their data exposed, including '
'IP addresses, third-party identifiers, and form-submitted '
'details such as names, email addresses, phone numbers, and '
'demographic information.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Protected health information (PHI), IP '
'addresses, third-party identifiers, names, '
'email addresses, phone numbers, demographic '
'information',
'financial_loss': '$1,800,000',
'identity_theft_risk': 'Yes',
'legal_liabilities': 'Class-action lawsuit settlement',
'systems_affected': 'MyAtriumHealth patient portal'},
'investigation_status': 'Settled',
'lessons_learned': 'Risks of third-party tracking tools in healthcare portals '
'and their potential for unauthorized PHI disclosures',
'motivation': 'Unintentional data exposure',
'post_incident_analysis': {'root_causes': 'Unauthorized use of third-party '
'tracking tools on patient portal'},
'references': [{'source': 'Class-action lawsuit settlement'}],
'regulatory_compliance': {'legal_actions': 'Class-action lawsuit settlement',
'regulations_violated': 'Patient privacy laws '
'(implied HIPAA '
'violations)'},
'title': 'Atrium Health Settles Pixel Tracking Lawsuit for $1.8M Over Patient '
'Data Exposure',
'type': 'Data Breach',
'vulnerability_exploited': 'Unauthorized use of tracking technologies on '
'patient portal'}