The University of Rochester Medical Center agreed to pay $2.85 million to settle a class action alleging it shared patient data with Facebook through website tracking tools, and the URMC data privacy settlement began paying eligible claimants roughly $32.91 each in November 2025. A federal magistrate judge granted final approval on August 28, 2025, closing out Kane v. University of Rochester, filed in the Western District of New York in 2023.
Who Was Covered by the Settlement
The settlement class had two groups. The first covered people who accessed the URMC MyChart patient portal between January 11, 2021, and January 11, 2023. The second covered people who filled out forms on the URMC public website between January 1, 2018, and June 12, 2023. One report put the total class at roughly 699,406 consumers.
Directors and officers of URMC, the presiding judge, and immediate family of the judge and court staff were excluded. The claims deadline was July 21, 2025, and it has passed. If you did not file by that date, you cannot claim a payment now.
How Much Class Members Are Receiving
About 52,000 people filed claim forms, a claims rate under 8% of the class. Payments of approximately $32.91 started going out in November 2025, with at least some recipients receiving funds through Venmo. The per-person amount was tied to how many valid claims came in; a lower claims rate meant a larger individual share than the settlement’s early estimates.
The $2.85 million fund also covered attorneys’ fees of up to 35%, or $997,500, sought by class counsel Almeida Law Group and Weitz & Luxenberg, plus litigation costs. Each of the two named plaintiffs, Carol Kane and Bonnie Wilson, was eligible for a $2,500 service award. Any unclaimed money goes to the Ronald McDonald House of Rochester under a cy pres provision. A hearing attendee publicly questioned whether that charity had ties to URMC; news coverage confirmed it is a standalone 501(c)(3) with no affiliation to the hospital.
Magistrate Judge Mark W. Pedersen found the settlement “fair, reasonable, and adequate” under Federal Rule of Civil Procedure 23(e) at the August 21, 2025 final approval hearing.
What the Lawsuit Alleged
Named plaintiffs Kane, a Florida resident, and Wilson, a New York resident, alleged that between January 2021 and January 2023, URMC embedded two tracking technologies on its website and MyChart portal: the Meta Pixel (formerly the Facebook Pixel) and the Conversions Application Programming Interface, known as CAPI. Both tools allow website operators to send user-activity data to Facebook’s advertising platform.
According to the complaint, the tools recorded what users clicked, how long they spent on pages, text they typed into search bars and chat boxes, and details from the hospital’s “Find a Provider” feature. That activity was allegedly tied to identifying data such as IP addresses, device IDs, and Facebook user IDs, then transmitted to Meta’s servers without users’ knowledge or permission.
Kane and Wilson said they used the URMC website on their phones and computers to search for providers, communicate with doctors, and schedule appointments. Wilson also used the MyChart portal. Both had active Facebook accounts on the same devices, which the complaint said allowed the pixel to match their health-related browsing to their Facebook identities. The plaintiffs argued this amounted to an unauthorized disclosure of protected health information and personally identifiable information, in conflict with URMC’s own published privacy policies promising not to sell or share such data with third parties.
In a March 19, 2024 ruling on URMC’s motion to dismiss, Judge Frank P. Geraci Jr. allowed five claims to move forward: breach of express contract, unjust enrichment, bailment, a New York General Business Law ยง 349 deceptive-practices claim, and one count under the federal Wiretap Act. On the wiretap count, the court found it plausible that URMC’s use of the pixel and CAPI met the statute’s “tort-crime” exception because the plaintiffs had plausibly alleged that URMC knowingly disclosed individually identifiable health information to Facebook for marketing purposes, in violation of HIPAA’s criminal provisions. The parties then negotiated the settlement rather than proceed to discovery and trial.
URMC’s Position
URMC denied all of the lawsuit’s allegations and maintained that no tracking technologies were implemented in its patient portal or electronic medical record system. The hospital said it settled to avoid the costs and risks of continued litigation, not because it accepted the plaintiffs’ claims. In a statement, URMC said “the privacy and security of URMC patients’ health information is exceptionally important” and that it “continually assess[es] our data collection, data privacy, and digital monitoring tools and practices so that they meet or exceed security standards.”
URMC also updated its website privacy statement effective March 27, 2025. The revised policy discloses the use of “cookies, beacons, pixels, and other similar technologies,” names Google Analytics and Hotjar as tools deployed on its sites, and notes that URMC may use “data modification and obfuscation tools” to limit the information collected by third-party vendors.
How the URMC Deal Compares to Other Hospital Pixel Settlements
The URMC case is one of dozens filed against healthcare providers over website tracking pixels. An investigation by The Markup found that 33 of the 100 largest U.S. hospitals had Meta Pixel code tracking appointment scheduling on their sites, with seven systems using it inside password-protected patient portals. Meta itself has faced at least 50 class actions over the technology.
Two comparable settlements dwarf the URMC deal. Advocate Aurora Health, a Wisconsin-based system, settled its pixel-tracking class action for $12.225 million, with final approval in July 2024 after more than 565,000 claims were validated. Mass General Brigham settled a similar suit for $18.4 million, covering 38 healthcare providers and offering class members up to $100 each. The URMC settlement, at $2.85 million, was smaller in scale, reflecting a single health system and a narrower class period.
Regulatory scrutiny has driven the wave. In December 2022, the U.S. Department of Health and Human Services Office for Civil Rights issued a bulletin warning that using tracking pixels to disclose protected health information to third parties may violate HIPAA. In July 2023, OCR and the Federal Trade Commission sent a joint letter to about 130 hospital systems and telehealth providers cautioning against these tools. The FTC separately pursued enforcement actions against digital health companies including GoodRx and BetterHelp for similar data-sharing practices.