The SSM Health data settlement resolved a Missouri class action alleging that SSM Health’s MyChart patient portal used Meta Pixel and Google Analytics trackers to share protected health information with third parties without consent. Eligible class members who filed valid claims received $31.50, paid on March 31, 2026. The settlement is closed, and no new claims are being accepted.
What the Lawsuit Alleged
The case, Jane Doe v. SSM Health Care Corporation d/b/a SSM Health (Case No. 2222-CC10014-01), was filed December 5, 2022, in the Circuit Court for the City of St. Louis. It claimed SSM Health embedded tracking code inside MyChart, the portal patients use to view medical records and message providers, and that the code transmitted patient information to Meta, Google, and other companies.1HIPAA Times. SSM Health Settles Patient Tracking Lawsuit Over MyChart Data Disclosures
According to the complaint, the shared data included whether a person was a patient, the names of their doctors, the treatments they received, which hospitals they visited, and their personal identities.2SSM Health Data Settlement. Frequently Asked Questions Plaintiffs said the transmissions happened without signed authorization and without a business associate agreement, which HIPAA requires for a health system to share protected health information with outside vendors. The claims included negligence, breach of fiduciary duty, unjust enrichment, and invasion of privacy. SSM Health denied any wrongdoing and settled to avoid trial.1HIPAA Times. SSM Health Settles Patient Tracking Lawsuit Over MyChart Data Disclosures
Who Was Included in the Class
The class covered anyone who was an SSM Health patient and logged into the MyChart portal between July 6, 2020, and February 10, 2023. Patients of SSM Health affiliate hospitals that use SSM Health’s instance of the Epic electronic health record system and accessed their records through the SSM Health MyChart portal were also included.2SSM Health Data Settlement. Frequently Asked Questions By September 2025, the administrator had identified more than 1.2 million unique class member records.3SSM Health Data Settlement. Plaintiffs’ Unopposed Motion for Final Approval
Excluded from the class were the presiding judge and their staff and family, SSM Health’s officers and directors, anyone who timely opted out, and class counsel.4ClassAction.org. Doe v. SSM Health Care Corporation Settlement Notice
What Class Members Received
Class members who submitted a valid claim received a single cash payment of $31.50. Every class member, whether or not they filed a claim, was also entitled to a code to enroll in CyEx Privacy Shield Pro, which includes dark web monitoring, a VPN, a password manager, data broker opt-out tools, and a digital vault for secure file storage.2SSM Health Data Settlement. Frequently Asked Questions5ClassAction.org. SSM Health Class Action Settlement Offers Privacy Protection Services, Cash Payments
The agreement did not publish a single total fund figure. SSM Health agreed to pay all approved claims plus notice and administration costs and attorneys’ fees. Class counsel could seek up to $10.5 million in fees, and the two class representatives could each receive up to $2,500 as incentive awards.2SSM Health Data Settlement. Frequently Asked Questions
Key Dates and Payment Status
The court granted preliminary approval on September 2, 2025. The deadline to object or opt out was October 27, 2025, and the claim filing deadline was November 25, 2025. Final approval was granted at a hearing on November 21, 2025.2SSM Health Data Settlement. Frequently Asked Questions
Payments went out to eligible claimants on March 31, 2026, by check, PayPal, Venmo, or Zelle. Checks are valid for 180 days after issuance, so any paper check from this settlement must be cashed within that window. The claim period is over and the settlement is closed.6SSM Health Data Settlement. SSM Health Data Settlement Home7ClaimDepot. SSM Health Data Settlement
Not to Be Confused With the Navvis Ransomware Settlement
A different SSM Health case involves a 2023 ransomware attack on Navvis & Company, in which unauthorized users accessed data belonging to roughly 2.8 million people between July 12 and July 25, 2023. That case, Doe, et al. v. SSM Health Care Corporation d/b/a SSM Health, et al. (Case No. 2422-CC00208-01), settled for $6.5 million, with reimbursement of up to $2,000 for ordinary losses, up to $5,000 for extraordinary losses like identity theft, and two years of three-bureau credit monitoring for class members. The court gave final approval on July 10, 2025, and pro rata cash payments are estimated to begin in April 2028.8Settlement Navvis. Navvis SSM Health Settlement9HIPAA Journal. Navvis SSM Health Data Breach Settlement
If you were notified about a ransomware breach involving Navvis, that is the other case, not the MyChart tracking settlement described above.