A Maryland appellate court has affirmed the dismissal of a proposed class action against MedStar Health, ruling that the patient data allegedly shared with Facebook and Google does not qualify as protected “contents” under Maryland’s wiretap statute. The decision is careful, technically sound, and entirely unsatisfying if you believe that when a hospital promises to protect your information, it should actually mean something.
The plaintiff was a MedStar patient who used the myMedStar patient portal to view lab results, radiology images, COVID testing outcomes, and prescription information. He alleged that MedStar embedded tracking code on its patient portal and public website that collected IP addresses, cookie values, device attributes, URLs, and login activity and transmitted that data to Facebook and Google without patient consent. He argued this violated the Maryland Electronic Surveillance Act, the state’s version of the federal wiretap law.
The theory was straightforward. MedStar promised patients privacy. MedStar then allegedly bugged its own website with tracking software that leaked patient activity to third parties. If that is not an interception of electronic communications, what is?
Maryland Lawyer Blog

