A judge has tentatively approved a settlement in a class action lawsuit over patient data at MarinHealth Medical Center.

The lawsuit, which was filed last year in Marin County Superior Court, alleges the hospital allowed Facebook and other third parties to access sensitive patient information.

The suit alleges the hospital installed Meta Pixel and other third-party tracking technology in its websites, which sent private information to third parties such as Facebook and Google. The suit states that MarinHealth did so “unbeknownst to users and without users’ authorization or informed consent.”

The Meta Pixel tool involves complex snippets of computer code that track users as they navigate through a website. They are the reason online shoppers often see ads for the item they’re shopping for pop up in their Facebook or Instagram feeds.

The suit asserted that in exchange for installing Meta Pixel, Facebook provided the hospital with analytics about the advertisements they had placed as well as tools to target people who had visited their websites.

On June 26, Clarkson Law Firm and Almeida Law Group, which jointly filed the suit, announced that a settlement has been proposed. Their statement said the $3 million agreement is “for pro rata cash payments to all verified class members.”

“If you are a MarinHealth Medical Center patient, California citizen, or other member of the public who visited Marin’s websites between August 1, 2019, through May 27, 2025, you are a member of the affected class,” the announcement said. “All claimants are eligible for monetary relief.”

The firms said up to $1 million of the settlement might be used to cover attorney fees, and up to $50,000 is reserved for other costs.

Judge Stephen Freccero granted preliminary approval to a settlement on May 17, according to the court website. A hearing has been scheduled for Oct. 20, during which Freccero might give the agreement final approval.

David Klein, the chief executive officer of MarinHealth, declined to be interviewed, but he provided a written statement.

“MarinHealth is one of hundreds of prominent health systems nationwide that have been named in litigation related to the use of common website tracking tools, such as Meta’s Pixel and Google Analytics,” the statement said. “There has been no finding of liability or privacy violation. However, to avoid a prolonged and costly litigation process regarding these insured claims, MarinHealth — like many other health systems — has chosen to settle the case.”

The law firms that sued said the hospital agreed to “remove Meta Pixel technology on its websites and will not install the Meta Pixel without notice to and consent from the website users.”

In response to further questions, Jill Kinney, a spokesperson for MarinHealth, said the company “elected to remove all Meta Pixels from its website as a proactive measure.” The technology was disabled in April 2023 as a precaution.

“Moving forward, any new tracking technologies will be thoroughly evaluated and only deployed if a user has actively provided their explicit consent for that category of data collection,” Kinney said.

The lawsuit notes that “investigative journalists have published several reports detailing the seemingly ubiquitous use of tracking technologies on hospitals’, health care providers’ and telehealth companies’ digital properties to surreptitiously capture and disclose their users’ private information.”

A 2022 story in the Markup, an online publication, reported that 33 of the largest hospital systems in the country used Meta Pixel to send Facebook a packet of data whenever a person clicked a button to schedule a doctor’s appointment.

MarinHealth’s statement says: “At no time did the tracking tools access secure patient portals or medical records.”

The lawsuit, however, states that through Meta Pixel, the hospital shared with third parties “patient status, their medical conditions, the type of medical treatment or provider sought, names of specific providers, and the fact that the individual attempted to or did book a medical appointment.”

The lawsuit recounts the experiences of three MarinHealth patients, which it doesn’t name. One had gastrointestinal problems and a urological condition arising from an enlarged prostate; another had concerns about knee replacement, Parkinson’s disease and systemic infection; and a third had a rare autoimmune condition.

While using MarinHealth websites, the patients communicated and received information regarding their appointments, treatments, medications and clinical information including surgeries, emergency room visits, lab work and scans, the lawsuit said.

“This information was intercepted, viewed, analyzed, and used by unauthorized third parties,” it said.

The suit added that the patient with the autoimmune condition, who had had a Facebook account for more than a decade, suddenly began receiving unsolicited advertisements relating to his medical conditions shortly after visiting MarinHealth websites.

Dr. Edward Alfrey, who heads the Marin Healthcare District board of directors, said he had not heard about the lawsuit until receiving an inquiry from the Independent Journal about it.

“It seems odd that David Klein wouldn’t have informed the district board, but maybe he plans to,” he said.

MarinHealth Medical Center, the county’s largest hospital, is owned by the district and overseen by a publicly elected board. The hospital’s day-to-day operations, however, are the purview of Klein and an appointed board, whose meetings are closed to the public.