Table of Contents
A federal judge dismissed most of a class-action lawsuit alleging the Blue Cross Blue Shield Association shared federal employees’ health-related website data with TikTok, Meta, Google and LinkedIn without consent, significantly narrowing the scope of this BCBS Association data tracking lawsuit.
The Origins of This BCBS Association Data Tracking Lawsuit
The lawsuit dates back to 2023. A January 2024 amended complaint from federal employees and retirees said BCBS supplies health coverage to more than 5.5 million federal employees, retirees and family members, making it the largest health insurer for this workforce.
What the Lawsuit Alleged
BCBS runs a website, fepblue.org, for federal employees seeking coverage, doctors and medical information. The lawsuit alleged that BCBS permits third-party technology companies to access employees’ website activities, “including specific searches for sensitive health-related topics.” “Defendant breached its duty to safeguard medical information against unauthorized dissemination and violated employees’ privacy rights under state and federal law,” the lawsuit said.
What the Judge Dismissed in This BCBS Association Data Tracking Lawsuit
On Aug. 7, a federal judge in northern Illinois dismissed claims pertaining to common law, the federal Electronic Communications Privacy Act, the Illinois Computer Tampering Act and the Illinois Eavesdropping Statute. For most of these claims, the judge determined the plaintiffs did not plausibly allege exposure of individually identifiable health information, and the plaintiffs did not make allegations within the scope of the Illinois Computer Tampering Act, either.
Which Claim Survived and Why
A claim related to the California Invasion of Privacy Act survived because BCBS could possibly be liable through aiding and abetting. Unlike the Illinois Eavesdropping Statute, the California law does not have the same “surreptitious manner” requirement, a distinction that explains why this specific claim cleared dismissal while the parallel Illinois-based claim did not.
What Comes Next in This BCBS Association Data Tracking Lawsuit
Plaintiffs have until Sept. 4 to amend their complaint, giving them an opportunity to strengthen the dismissed claims with additional factual allegations, particularly around exposure of individually identifiable health information, before the case narrows permanently to just the surviving California claim.
BCBS’s Response to the Ruling
BCBS told Becker’s it does not comment on ongoing litigation, a standard response for organizations facing active legal proceedings.
How This Fits a Broader Pattern of Payer Privacy Litigation
This ruling arrives amid continued litigation activity across the payer industry, with Becker’s separately reporting a federal judge throwing out a False Claims Act lawsuit against Sentara Health Plans over an ACA rate increase, and Clover Health facing four separate lawsuits following a recent data breach.
Why the Legal Distinction Between State Privacy Laws Matters
The differing outcomes between the Illinois and California privacy claims in this case illustrate a broader pattern in health data tracking litigation nationally: the specific statutory language of each state’s privacy law, particularly requirements like Illinois’s “surreptitious manner” standard, can determine which claims survive dismissal even when the underlying factual allegations are identical across jurisdictions.
What This BCBS Association Data Tracking Lawsuit Means Going Forward
With most claims dismissed but the California Invasion of Privacy Act claim surviving on an aiding-and-abetting theory, this case now moves forward on a significantly narrower legal basis than plaintiffs originally pursued. Given the Sept. 4 amendment deadline, plaintiffs’ next filing will likely determine whether any of the dismissed claims can be revived with more specific allegations of individually identifiable health information exposure.
What to Watch Going Forward
As the Sept. 4 amendment deadline approaches, industry observers will likely watch whether plaintiffs successfully strengthen their dismissed claims or whether the case proceeds solely on the surviving California privacy theory. Given the broader wave of health data tracking litigation targeting insurers over third-party website analytics tools, the outcome of this BCBS Association data tracking lawsuit may offer other health plans a useful signal for how courts are treating similar claims involving website tracking pixels and third-party data sharing arrangements nationally.
For more healthcare industry updates, insights and news, visit DistilINFO. Click here to subscribe to stay informed.
