R.G. v. Oregon Clinic Alleges Tracking Tools Leaked Patient Data to Google
Tracking Tools on Oregon Clinic’s Website Intercepted Patient Communications
The class action complaint filed in the United States District Court for the District of Oregon alleges that Oregon Clinic, P.C. installed third-party tracking tools on its website and patient portal that intercepted and transmitted patients’ private health information (PHI) and personally identifiable information (PII) to Google, Meta, and other unauthorized parties without patient consent or HIPAA-compliant safeguards. According to the filing, these tools—including Google Analytics, DoubleClick, and Meta Pixel—captured medical symptoms, treatments, IP addresses, device IDs, and search terms via HTTP requests, cookies, and third-party trackers, even when users blocked third-party cookies. The complaint alleges that the tracking tools "commandeer the user’s computing device, causing the device to contemporaneously and invisibly re-direct the users’ communications to third parties" (Compl. ¶45). The complaint further asserts that Oregon Clinic’s server sent HTTP responses containing markup and source code with these tracking tools, which executed commands invisibly to average users (Compl. ¶32, ¶36).
Plaintiff R.G., who brings the action anonymously to protect her PHI under Oregon law and HIPAA, alleges that she used Oregon Clinic’s website to search for treatments, identify doctors, access medical records, and communicate with the clinic about her care. The complaint alleges that unauthorized parties, including Google, received her communications via Oregon Clinic’s tracking tools. The complaint states, "Plaintiff R.G. reasonably expected that her online communications with Defendant were solely between herself and Defendant" (Compl. ¶119). The filing further alleges that R.G. observed targeted online advertisements related to her use of Oregon Clinic’s website, which she never consented to receive (Compl. ¶118). The complaint details that R.G. has been a patient of Oregon Clinic for more than five years and used the website to communicate with specialists, including a Gastroenterologist, Podiatrist, Urologist, and Gynecologist, as well as to seek treatment for a wart (Compl. ¶107, ¶111).
The complaint alleges that Oregon Clinic’s tracking tools captured both the "characteristics" (such as IP addresses and device IDs) and the "content" (such as search terms and URLs) of patient communications. The filing states that this private information would not have been disclosed but for Oregon Clinic’s installation of the tracking tools (Compl. ¶42, ¶43). The complaint provides an example: "Unbeknownst to the patient, each and every communication is sent to Google via Defendant’s Tracking Tools," including searches for specific doctors or treatments (Compl. ¶82). The complaint also alleges that Oregon Clinic’s website automatically permitted third-party cookies without user consent, further facilitating the disclosure of patient data (Compl. ¶72).
HIPAA Violations Alleged Despite Lack of Private Right of Action
The complaint alleges that Oregon Clinic, a HIPAA-covered entity, violated the HIPAA Privacy Rule (45 C.F.R. Part 160, Subparts A and E of Part 164) by disclosing PHI to Google and other third parties without patient authorization or HIPAA-compliant business associate agreements (BAAs). The filing cites guidance from the Department of Health and Human Services (HHS), including a December 2022 bulletin and June 2024 guidance, which explicitly warned that such disclosures violate HIPAA. The complaint quotes the December 2022 HHS bulletin: "Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI to tracking technology vendors or any other violations of the HIPAA Rules" (Compl. ¶21). The complaint also notes that HHS guidance clarified that PHI protections extend to unauthenticated webpages, such as Oregon Clinic’s public website, where users may input symptoms or health conditions (Compl. ¶24-25). The complaint states, "Tracking technologies on a regulated entity’s unauthenticated webpage that addresses specific symptoms or health conditions... may have access to PHI in certain circumstances" (Compl. ¶25).
The complaint asserts that Oregon Clinic failed to execute BAAs with Google for its tracking tools, despite Google’s explicit disclaimer that its analytics and advertising products are not HIPAA-compliant. The filing quotes Google’s terms: "Google does not intend uses of Google Analytics to create obligations under HIPAA and makes no representations that Google Analytics satisfies HIPAA requirements" (Compl. ¶141). The complaint further alleges that Oregon Clinic’s Notice of Privacy Practices did not disclose the sharing of PHI with Google or other third parties. The complaint states that Oregon law recognizes a right to have PHI safeguarded and a reasonable expectation of privacy in confidential medical information (Compl. ¶152, ¶155).
While HIPAA does not provide a private right of action, the complaint argues that HIPAA’s requirements inform the standard of care for the plaintiff’s state-law claims, including breach of fiduciary duty/confidentiality (common law, HIPAA, Or. Rev. Stat. Ann. §§ 192.553–192.581), negligence, and invasion of privacy (intrusion upon seclusion). The filing also alleges that Oregon Clinic’s conduct may constitute a federal criminal violation under 42 U.S.C. § 1320d-6 for knowingly obtaining or disclosing individually identifiable health information without authorization. The complaint notes that such violations carry a maximum fine of $250,000 and up to 10 years of imprisonment if committed with intent for commercial advantage (Compl. ¶134).
The complaint quotes the AMA Code of Medical Ethics: "Protecting information gathered in association with the care of the patient is a core value in health care" (Compl. ¶158).
ECPA and State Law Claims Target Interception and Disclosure of Communications
The complaint alleges that Oregon Clinic violated the Electronic Communications Privacy Act (ECPA) (18 U.S.C. § 2511(1)) by intentionally intercepting, using, and disclosing electronic communications via tracking tools. The filing states that Oregon Clinic’s tracking tools captured and redirected private communications to Google and other third parties, including the content of patients’ medical searches and appointment requests. The complaint defines interception under the ECPA as "the acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device" (Compl. ¶218). The complaint alleges that Oregon Clinic’s actions meet this definition, as the tracking tools acquired and transmitted the "substance, purport, or meaning" of patients’ communications (Compl. ¶217).
The complaint seeks statutory damages under 18 U.S.C. § 2520 for ECPA violations, which provide for "whichever is the greater of $100 per day for each day of violation or $10,000" (Compl. ¶241). The filing also alleges that Oregon Clinic violated Oregon state law by accessing patients’ devices without authorization (Or. Rev. Stat. § 164.377(2)), exceeding authorized access (Or. Rev. Stat. § 164.377(3)), and intercepting communications without consent (Or. Rev. Stat. § 165.540(1)(a)) (Compl. ¶224, ¶226, ¶228). The complaint further alleges that Oregon Clinic disclosed private information without authorization, violating Or. Rev. Stat. § 192.558(2) and Or. Rev. Stat. § 40.235 (Compl. ¶230, ¶232). The filing states that Oregon Clinic disclosed intercepted communications to unauthorized parties, violating 18 U.S.C. § 2511(1)(c), and used intercepted communications for its own benefit, violating 18 U.S.C. § 2511(1)(d) (Compl. ¶233, ¶234). The complaint alleges that Oregon Clinic used the intercepted data for tortious purposes, including HIPAA violations and invasion of privacy (Compl. ¶235). The complaint states that Oregon Clinic’s tracking tools tracked, stored, and disclosed private information to unauthorized parties such as Google, further violating state and federal laws (Compl. ¶221).
Google’s Use of Disclosed Data and Financial Incentives
The complaint alleges that Google generated $307 billion in revenue in 2023, with 76% derived from advertising, and that the company used the disclosed patient data to track online behavior and inform targeted advertising strategies. The filing states that Google’s tracking tools, including cookies like the `_ga` cookie, uniquely identified users and linked their online activity to Google Accounts. The complaint alleges that Google received the content of patients’ communications "immediately when the patient clicks an appointment button, even before the healthcare provider receives it" (Compl. ¶67). The complaint further alleges that Google used this data to identify specific patients seeking confidential medical care (Compl. ¶81). The complaint describes how Google processes, analyzes, and assimilates disclosed data to identify specific users and match profiles with tracking data from Google Analytics and DoubleClick (Compl. ¶80). The complaint notes that DoubleClick’s "IDE" cookie tracks user interactions to measure ad effectiveness (Compl. ¶99).
The complaint highlights the financial value of consumer data, alleging that earnings from data mining and selling rose from $202 per American user in 2018 to $434 per user in 2022, with the total industry-wide value reaching $200 billion in 2022 (Compl. ¶176). The filing also alleges that healthcare records are particularly valuable, with an estimated black-market value of $250 per record (Compl. ¶182). The complaint quotes an industry source: "[D]e-identified patient data has become its own small economy: There’s a whole market of brokers who compile the data from providers and other health-care organizations and sell it to buyers" (Compl. ¶178). The complaint notes that Google pays users $3 per week in a pilot program to track them online, underscoring the value of such data (Compl. ¶175). The complaint states, "Neither should the Court ignore what common sense compels it to acknowledge—the value that personal identifying information has in our increasingly digital economy" (Compl. ¶180).
The complaint alleges that Oregon Clinic derived financial benefits from the use of patient data, including reduced advertising costs and increased marketing effectiveness. The filing states that Oregon Clinic "bolstered its marketing efforts" by using free or low-cost analytics tools instead of HIPAA-compliant solutions, thereby increasing its profit margins (Compl. ¶236). The complaint also alleges that Oregon Clinic retargeted patients using intercepted data without their consent (Compl. ¶173). The complaint further asserts that Oregon Clinic’s actions allowed it to use patient data for advertising without express written consent, violating HIPAA’s requirements (Compl. ¶171).
Breach of Fiduciary Duty and Ethical Violations
The complaint asserts a claim for breach of fiduciary duty/confidentiality against Oregon Clinic, alleging that the clinic became a fiduciary by undertaking the guardianship of patients’ private information and failed to act in their best interests. The filing states, "Defendant became a fiduciary by its undertaking and guardianship of the Private Information, to act primarily for the benefit of its patients" (Compl. ¶202). The complaint alleges that Oregon Clinic breached this duty by disclosing patients’ PHI and PII to third parties like Google without consent for commercial purposes (Compl. ¶203). The filing further alleges that the disclosures were either intentional or the result of negligence in hiring, supervision, or policy implementation (Compl. ¶204).
The complaint quotes the AMA Code of Medical Ethics: "Protecting information gathered in association with the care of the patient is a core value in health care" (Compl. ¶158).
Breach of Implied Contract and Unjust Enrichment Claims
The complaint also asserts a claim for breach of implied contract, alleging that Oregon Clinic breached an implied agreement to safeguard patients’ private information. The filing states, "Defendant breached these implied contracts by disclosing Plaintiff’s and Class Members’ Private Information without consent to third parties like Google" (Compl. ¶269). The complaint alleges that patients would not have used Oregon Clinic’s website or paid for its services had they known their private information would be disclosed (Compl. ¶163). The complaint further alleges that Oregon Clinic’s website routinely provided unauthorized parties with patients’ IP addresses, device IDs, and inputted information such as home addresses, zip codes, and phone numbers (Compl. ¶122). The complaint states that Oregon Clinic collected and used private information for its own gain without authorization or compensation, violating the implied contract (Compl. ¶274).
The complaint asserts a claim for unjust enrichment, alleging that Oregon Clinic retained benefits derived from patients’ private information without their knowledge, consent, or compensation. The filing states, "It would be inequitable under unjust enrichment principles... for Defendant to be permitted to retain any of the profit or other benefits wrongly derived" (Compl. ¶277). The complaint alleges that the benefits derived from the private information belong to the plaintiff and class members, and that Oregon Clinic’s retention of these benefits is unjust (Compl. ¶273). The complaint further alleges that Oregon Clinic’s actions caused irreparable injury, as the disclosure of sensitive information cannot be undone (Compl. ¶261). The complaint states that there is no adequate remedy at law for the continued possession of sensitive records by unauthorized parties (Compl. ¶262).
Class Action Seeks Damages, Injunctive Relief, and Disgorgement
The complaint seeks to certify a class of patients whose PHI and PII were disclosed via Oregon Clinic’s tracking tools, with the amount in controversy exceeding $5,000,000, exclusive of interest and costs, to satisfy the jurisdictional threshold for class action litigation. The filing alleges that the class includes hundreds of thousands of individuals and that common questions of law and fact predominate, including whether Oregon Clinic violated the law by failing to protect patient data (Compl. ¶190). The complaint states, "Whether Defendant violated the law by failing to promptly notify Plaintiff and Class Members that their Private Information had been divulged" (Compl. ¶191).
The complaint demands a jury trial and seeks a range of damages, including statutory damages under the ECPA ($100 per day or $10,000, whichever is greater), compensatory damages, nominal damages, and punitive damages. The filing also seeks actual and consequential damages for the plaintiff and class members, as well as prejudgment interest on all amounts awarded. The complaint alleges that Oregon Clinic’s conduct was "highly offensive to a reasonable person" and caused irreparable injury, as the disclosure of sensitive information cannot be undone (Compl. ¶254, ¶261). The complaint describes how Oregon Clinic’s intentional installation of tracking tools caused the dissemination of patients’ private and sensitive PII and PHI to unauthorized parties, resulting in damages (Compl. ¶259). The complaint states, "Defendant’s willful and intentional disclosure of Plaintiff’s and Class Members’ Private Information constitutes an intentional interference with Plaintiff’s and the Class Members’ interest in solitude or seclusion" (Compl. ¶255).
The complaint seeks injunctive relief to enjoin Oregon Clinic from further unlawful disclosures of PHI and PII, as well as to prevent the misuse or disclosure of private information already in the possession of unauthorized parties. The filing also seeks disgorgement of Oregon Clinic’s unjust enrichment into a common fund for the plaintiff and class members. The complaint alleges that Oregon Clinic retained benefits derived from patients’ private information without their knowledge, consent, or compensation, and that retention of these benefits is inequitable (Compl. ¶277). The complaint states that Oregon Clinic’s actions facilitated Google’s "simultaneous eavesdropping and wiretapping of confidential communications" (Compl. ¶256).
The complaint also seeks attorneys’ fees, costs, and litigation expenses, as well as any other relief the court deems just and proper.
Timeline of Key Events and Regulatory Guidance
The complaint outlines a timeline of key events and regulatory guidance related to the use of tracking technologies by HIPAA-covered entities. On January 25, 2013, HHS issued final rulemaking under the HITECH Act, strengthening HIPAA protections, with the rule becoming effective on March 26, 2013 (Compl. ¶19). The complaint states that this rulemaking clarified PHI protections, including information tied to a covered entity (Compl. ¶19-20). In December 2022, HHS issued a bulletin warning regulated entities about the risks of tracking technologies, stating that disclosures of PHI via such tools violate HIPAA without patient authorization (Compl. ¶21). The complaint quotes the bulletin: "Now more than ever, it is critical for regulated entities to ensure that they disclose PHI only as expressly permitted or required by the HIPAA Privacy Rule" (Compl. ¶23). On July 20, 2023, HHS and the Federal Trade Commission (FTC) jointly issued a letter admonishing improper use of tracking technologies, and on June 26, 2024, HHS published additional guidance on online tracking technologies. The complaint quotes the FTC’s stance on such disclosures: "The disclosure of such information without a consumer’s authorization can, in some circumstances, violate the FTC Act as well as constitute a breach of security under the FTC's Health Breach Notification Rule" (Compl. ¶26).
The complaint alleges that Oregon Clinic’s most recent disclosure of Plaintiff R.G.’s PHI and PII occurred on or about January 23, 2026, when she accessed the clinic’s patient portal and website (Compl. ¶125). The class action complaint was filed on August 10, 2026. The complaint also notes that the statute of limitations for the claims is tolled under the "delayed discovery" rule, as Plaintiff R.G. could not have known about the interception and disclosure of her data due to the secrecy and invisibility of the tracking tools (Compl. ¶183, ¶185). The complaint states that Plaintiff discovered Oregon Clinic’s interception and disclosure of her data shortly before filing the complaint (Compl. ¶184).