You logged into your hospital’s patient portal to check a test result, look up a medication, or schedule a follow-up appointment. Standard stuff. But embedded inside that portal, invisible to you, never disclosed, was a piece of code from Facebook that recorded what you were doing and sent it back to Meta.
Your health condition. The specialist you searched for. The appointment you made. All of it.
This is not a hypothetical. It happened at dozens of health systems across the United States. The portals involved all ran on a platform called MyChart, made by a company called Epic. And when investigative reporters exposed it in 2022, a wave of class action lawsuits followed.
Two of those settlements are still accepting claims right now. Both deadlines are October 5, 2026.
If you received care at Bayhealth Medical Center (Delaware) or Cone Health (North Carolina) and used their patient portal, you may be eligible for a cash payment with no documentation required.
At a glance, open claims
| Health System | Deadline | Payment | Where to File |
|---|---|---|---|
| Bayhealth Medical Center (DE) | October 5, 2026 | $25 cash + 1yr privacy monitoring | BayhealthPixelSettlement.com |
| Cone Health (NC) | October 5, 2026 | Pro-rata share of $1,765,000 | ConePixelSettlement.com |
What MyChart Is and Why It Matters
MyChart is a patient portal platform built by Epic Systems, a Wisconsin company that makes the electronic health records software used by most major U.S. hospitals. When you have a patient portal at a hospital or health system, there is a very good chance it is MyChart.
The platform lets you log in to view test results, message your care team, schedule appointments, request prescription refills, and access your medical history. It is convenient, and most people assume the information they look at inside a medical portal stays private.
The problem was what some health systems added to their MyChart portals without disclosing it to patients.
Between roughly 2016 and 2022, dozens of health systems embedded third-party tracking pixels inside their patient portals and web properties. The most widely used was the Meta Pixel, a small piece of JavaScript code provided by Facebook that allows websites to track user behavior for advertising purposes. The code transmits data about what users click on, what pages they visit, and in health portal contexts, what conditions or treatments they search for.
Hospitals put this code on their websites to measure the effectiveness of their advertising. Many did not remove it, or even realize it was there, when patients began logging in to view sensitive health information.
The result, according to the lawsuits, was that health information protected under HIPAA was being sent to Meta and Google without patient consent and without any medical or legal authorization to do so.
How It Came Out
The exposure traces back to a 2022 investigation by The Markup, a nonprofit newsroom that covers technology and its social impacts. Using an automated tool called Pixel Hunt, reporters found the Meta Pixel embedded on the websites and patient portals of 33 of the 100 largest hospital systems in the United States.
The data being transmitted included IP addresses, button clicks, search terms typed into the portals, and in some cases, specific appointment types and medical conditions that appeared in URLs or page titles.
The Department of Health and Human Services issued guidance in December 2022 stating that tracking pixels in patient portals likely violate HIPAA when they transmit protected health information to third parties without authorization. Multiple state attorneys general began investigating.
The lawsuits followed the same arc: a patient, or group of patients, sued their health system for transmitting protected health information to Meta and Google without consent.
The Two Open Settlements: File Before October 5
Bayhealth Medical Center (Delaware)
Case: Doe et al. v. Bayhealth Medical Center Inc. d/b/a Bayhealth, Delaware Superior Court, No. N24C-09-002
Who qualifies: Anyone who used Bayhealth’s patient portal or website properties between January 1, 2019 and December 31, 2025.
What Bayhealth allegedly did: Deployed tracking pixels on its website and MyChart patient portal that transmitted patients’ private health information to third parties without their knowledge or consent.
What you can claim:
- $25 cash payment: no documentation required, no proof of harm needed
- One year of CyEx Privacy Shield privacy monitoring service, optional, free with your claim
Claim deadline: October 5, 2026
Final approval hearing: October 29, 2026
File at: BayhealthPixelSettlement.com
If you received care at Bayhealth during this window and used their online patient portal at any point, you likely qualify. No paperwork. No receipts. Just a completed claim form.
Cone Health (North Carolina)
Case: Singh v. The Moses H. Cone Memorial Hospital Operating Corporation et al., No. 1:24-CV-558
Who qualifies: Living individuals who accessed the MyChart patient portal or submitted forms on Cone Health’s website between September 1, 2016 and November 3, 2022. Approximately 375,027 people are in this class.
What Cone Health allegedly did: Concealed tracking pixels on its website and patient portal that transmitted patients’ private health information to Meta and Google without authorization.
What you can claim:
- Pro-rata cash payment, your share of a $1,765,000 fund with no documentation required
- The exact amount per person depends on how many valid claims are filed. With 375,027 potential class members, most of whom will not file, the actual payment per claimant tends to be meaningfully higher than the math of “$1.765M รท 375,027” suggests
Claim deadline: October 5, 2026
Final approval hearing: November 5, 2026
File at: ConePixelSettlement.com
Preliminary approval was granted July 7, 2026. Claims require no documentation and can be submitted online or by mail.
Settlements That Are Closed But Still Worth Knowing
The pace of these settlements has been rapid. Several with much larger funds have already closed their claim windows this year.
Banner Health (Arizona)
- Class period: Patients using Banner Health online properties
- Settlement: $20 cash + 1yr Privacy Shield
- Deadline: September 5, 2026 – now closed
- Administrator: BannerPixelSettlement.com (claims period ended)
St. Joseph Hospital (New Hampshire)
- Fund: $1,250,000
- Deadline: August 14, 2026 – closed
Duke University Health System (North Carolina)
- Fund: $3,740,000
- Deadline: August 16, 2026 – closed
Memorial Health Services (California)
- Fund: $750,000
- Deadline: August 21, 2026 – closed
Health Systems Already Distributing Payments
These settlements cleared all hurdles and payments are now going out or have been processed:
| Health System | Fund | Status |
|---|---|---|
| Henry Ford Health (Michigan) | $12,300,000 | Final approval Oct 7, 2025 – distributing |
| Advocate Aurora Health (Wisconsin) | $12,200,000 | Final approval July 10, 2024 – payments processed |
| Mount Sinai (New York) | $5,300,000 | Announced Aug 2025 – distributing |
| BJC Health System (St. Louis) | $9,250,000 | Announced July 2025 – distributing |
If you used any of these health systems’ patient portals and filed a claim before each deadline, payments are either already in transit or being processed.
What Data Was Actually Shared
This is where the facts are more specific than most coverage has acknowledged. The tracking pixels transmitted different types of data depending on how each health system’s portal was configured. The categories that appear across the lawsuits include:
Appointment information. If you clicked to schedule an appointment with a cardiologist, an oncologist, or a mental health provider, that click and in some cases the appointment type, was transmitted to Meta.
Condition and treatment searches. Patient portals have search functions that allow patients to look up conditions, find care team information, or find providers by specialty. Search terms typed into these portals were in some cases sent to third parties.
Page visits and URL data. Many patient portals embed health information into their URLs, for example, a page titled “Scheduling: Oncology” tells a third-party tracker something about what the patient was doing, even without the tracker reading the page content directly.
IP address and device identifiers. These are transmitted by default in any pixel interaction. Combined with the health portal context, they can link an individual to a health system visit.
Button clicks and form interactions. Any click on a button, link, or form within the portal that had a tracking pixel installed was potentially logged.
Not every health system transmitted every category of data. The specific data at issue in each settlement is described in that settlement’s notice and website.
Why You Do Not Need to Have Suffered “Harm” to File
One of the most common reasons people do not file class action claims is the assumption that they need to prove something bad happened to them. For these settlements, that is not the case.
These settlements compensate for the unauthorized disclosure of protected health information, the sharing itself, not the downstream consequences. You do not need to show that you received targeted ads, that someone obtained your medical records, or that any specific harm resulted from your data being sent to Meta or Google.
If you used a qualifying patient portal during the class period, that is sufficient to file a claim and receive the flat payment. The claim form will ask for basic information to confirm you are in the class, typically your name, address, and that you used the applicable portal during the relevant dates.
Full Tracker: All Known MyChart-Related Settlements
| Health System | Fund | Claim Deadline | Status |
|---|---|---|---|
| Bayhealth Medical Center (DE) | Undisclosed / flat $25 | Oct 5, 2026 | OPEN |
| Cone Health (NC) | $1,765,000 | Oct 5, 2026 | OPEN |
| Banner Health (AZ) | Flat $20 | Sept 5, 2026 | Closed |
| St. Joseph Hospital (NH) | $1,250,000 | Aug 14, 2026 | Closed |
| Duke University Health (NC) | $3,740,000 | Aug 16, 2026 | Closed |
| Memorial Health Services (CA) | $750,000 | Aug 21, 2026 | Closed |
| Mount Sinai (NY) | $5,300,000 | 2025 | Distributing |
| BJC Health System (MO) | $9,250,000 | 2025 | Distributing |
| Advocate Aurora Health (WI) | $12,200,000 | 2024 | Paid out |
| Henry Ford Health (MI) | $12,300,000 | 2025 | Distributing |
This tracker is updated as new settlements are announced or status changes. Some health system settlements are litigated under multiple case names or consolidated actions.
Frequently Asked Questions
It depends entirely on which health system you are filing against. Bayhealth pays a flat $25 cash regardless of how many claims are filed. Cone Health distributes a $1,765,000 fund pro rata, your share shrinks if more people file, and grows if fewer do. With approximately 375,027 potential class members and typical class action participation rates (often well under 10%), the per-person payment at Cone Health will likely be meaningfully higher than a straight fund-divided-by-eligibles calculation suggests.
Both settlements also include an optional year of CyEx Privacy Shield monitoring at no charge, that is not cash, but it does include $1 million in fraud insurance coverage.
For closed settlements like Duke Health ($3.74M), Henry Ford ($12.3M), and BJC ($9.25M), payment amounts were not disclosed publicly. If you filed a claim in those, watch your mail and email for payment correspondence from the individual settlement administrators.
Check the tracker table above. If your primary health system is not listed, it does not necessarily mean there is no case, new settlements are being announced regularly, and some cases are still in litigation rather than settlement. The Bayhealth and Cone Health settlements are currently the only two with open claim periods as of late September 2026.
No. The settlements compensate class members for the unauthorized disclosure of their protected health information. You do not need to show that you suffered a specific harm or that Meta used your data in any particular way. Being a portal user during the class period is enough.
You can file separate claims in each settlement. These are separate cases against separate health systems, and filing in one does not affect your eligibility for the other. The October 5, 2026 deadline applies to both.
The lawsuits target the individual health systems that deployed the tracking pixels, not Epic Systems as the software provider. MyChart is the platform; the hospitals and health systems are responsible for what code they add to their own deployments of it.
It varies by health system and how their portal was configured. Generally: IP address, device identifiers, URLs visited (which can contain health-related information), button clicks, appointment types, and in some cases search terms typed inside the portal. The specific data categories for Bayhealth and Cone Health are described in their respective settlement notices at BayhealthPixelSettlement.com and ConePixelSettlement.com.
If you filed a claim before that system’s deadline, you are in the queue for payment. Check your email and mail for correspondence from that settlement’s administrator.
If you missed the deadline, the claim window is closed and no late filings are accepted. These are two of the reasons why keeping track of open settlements matters: by the time most people hear about a settlement, the deadline is often approaching or already past.
Yes. The underlying legal theory, that health systems violated HIPAA by embedding third-party tracking pixels in patient portals, is well-established by now. Cases are still in various stages of litigation against other health systems. When new settlements are announced with open claim periods, this page will be updated.
Filing a claim at Bayhealth or Cone Health before October 5? Go directly to BayhealthPixelSettlement.com or ConePixelSettlement.com. For other open settlements across all case types, see our full list of open class action settlements. Want to understand how these payouts work? Our guide to how class action settlements work covers the whole process.
This page is for general information only and is not legal advice. Settlement details are based on court-approved documents and official settlement websites. Claim deadlines are firm. Always verify current status directly with the settlement administrator before filing.