MyChart and Hospital Tracking Claims in Washington State
Washington is the strongest state in the country for this kind of claim, for two specific reasons that have nothing to do with how sympathetic the facts are. It requires the consent of everyone in a communication, not just one party. And since 2024 it has the My Health My Data Act, which gives residents their own right to sue over health data that HIPAA never covered. This page explains both, and is equally clear about the Washington pixel case a federal court largely dismissed.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What These Cases Allege
Hospitals and health systems place third-party tracking code — pixels, tags, session-replay and chat tools — on their public websites and patient portals. The complaint in these cases is that when a patient searched for a condition, booked an appointment or opened a portal page, that code transmitted identifying information about the visit to advertising and analytics companies, without the patient being told and without meaningful consent. The providers generally respond that the code was used for ordinary website analytics, that what was transmitted was not protected health information, and that no patient suffered a concrete injury. Both positions are being tested; courts have not resolved them uniformly.
Case Details
Washington claims of this type are typically brought under the Washington Privacy Act, RCW 9.73.030, and since 2024 under the My Health My Data Act, RCW 19.373, which is enforced by consumers through the Washington Consumer Protection Act. The federal Wiretap Act, 18 U.S.C. § 2510 et seq., is commonly pleaded alongside them. Cases are filed in Washington state courts and in the United States District Courts for the Western and Eastern Districts of Washington.
Why Washington Is Different
All-party consent. Under RCW 9.73.030 a private communication may not be intercepted or recorded unless everyone party to it consents. Most states require only one party to agree — which, where a website operator is treated as a party, effectively defeats the claim. Washington does not offer that route, and that single difference is why plaintiffs' firms file here.
The My Health My Data Act. RCW 19.373 took effect for most businesses in March 2024 and regulates "consumer health data" far beyond the boundaries of HIPAA — including data generated by ordinary web browsing that suggests something about a person's health. Critically, it is enforceable by individuals through the Consumer Protection Act rather than only by the Attorney General. The first class action under the Act was filed on 10 February 2025, roughly a year after it took effect, and the theory being tested there is broad: that ordinary location and browsing data can qualify as health data.
And the honest counterweight. In March 2025 a United States District Court mostly dismissed a Washington pixel-tracking privacy case. Having a favourable statute is not the same as having a case that survives a motion to dismiss. The obstacles are usually whether the data transmitted was genuinely private, whether the plaintiff can show a concrete injury, and whether the website operator counts as a party to the communication. Anyone telling you Washington claims are straightforward has not read the dockets.
Who These Claims Involve
The people bringing these claims are generally Washington residents who used a health provider's website or patient portal — MyChart or another system — while the provider had third-party tracking code installed, and whose visit involved something identifiable as health-related: searching a condition, requesting an appointment, using a symptom checker or opening portal pages.
Three practical points:
- Where you were matters, not only where the hospital is. Washington law reaches communications occurring in Washington. A Washington resident using an out-of-state health system's portal from home is a different question from a visitor using a Seattle hospital's site — and both are questions worth asking a lawyer rather than assuming.
- The date range is defined by the provider, not by you. Each case turns on the specific period during which that provider ran that code. You cannot work it out from your own memory; it comes from the provider's records.
- The My Health My Data Act is not retroactive. It took effect in 2024. Conduct before then is governed by the older statutes, which is why complaints usually plead several claims at once.
There is no central Washington claim form to fill in. Individual settlements have their own administrators and their own deadlines, and those are announced case by case.
What These Cases Have Actually Paid
Health-privacy pixel settlements have generally resolved in the hundreds of thousands to low millions of dollars per provider, divided among classes that frequently run into the hundreds of thousands of people. That arithmetic is the part advertising leaves out: a multi-million-dollar headline spread across a class of that size commonly produces individual payments in the range of tens of dollars, sometimes less, with larger amounts where a claimant can document specific harm.
Statutory damages figures make this confusing. Wiretapping statutes often specify a per-violation amount, and those figures get quoted as though each class member would receive them. In practice statutory damages of that kind are almost never paid at full value across a large class — cases settle for what a defendant can pay and a court will approve, which is a different and much smaller number.
What a Washington claim is genuinely worth is unknown until the specific provider, the specific period and the specific data are established. Anyone quoting a Washington figure before knowing which portal you used is quoting an advertisement.
How Washington Got Here
- 1
1967 onward — Washington adopts all-party consent
RCW 9.73.030 establishes that private communications may not be intercepted or recorded without the consent of all parties, putting Washington in the minority of states that require more than one-party agreement.
- 2
2022 to 2023 — pixel litigation reaches healthcare
Following reporting that hospital websites were transmitting patient information to advertising platforms, class actions are filed across the country against health systems using tracking code on public pages and patient portals.
- 3
April 2023 — the My Health My Data Act is signed
Washington enacts RCW 19.373, regulating consumer health data outside HIPAA and, unusually, giving consumers their own route to sue through the Consumer Protection Act rather than leaving enforcement to the Attorney General.
- 4
March 2024 — the Act takes effect
The obligations begin for most businesses, applying to health data generated by ordinary web activity, not only to records held by healthcare providers.
- 5
10 February 2025 — the first MHMDA class action
The first class action under the Act is filed, nearly a year after it took effect, testing whether data such as location and browsing history can qualify as consumer health data under the statute.
- 6
March 2025 — a federal court pushes back
A United States District Court mostly dismisses a Washington pixel-tracking privacy case, a reminder that a favourable statute does not by itself carry a claim past a motion to dismiss.
What to Be Careful About
Health-privacy litigation generates a great deal of advertising, and some of it is inaccurate in ways that cost people money. These are the patterns worth recognising.
"Check if you qualify" pages that only collect your details
Many sites offering a Washington MyChart eligibility check are lead-generation pages that pass your information to whichever firm pays most, without assessing anything. A genuine assessment asks which provider's portal you used and roughly when, because that is what determines whether any particular case covers you. A page that asks only for a name, email and phone number has not checked anything.
Statutory damages quoted as if they were your payment
Advertising for these cases often quotes a per-violation statutory damages figure and implies that is what a class member receives. It is not. Statutory damages set a ceiling that courts and defendants negotiate down; actual settlements in health-privacy pixel cases have generally produced modest per-person payments once divided across classes of hundreds of thousands. Treat any specific dollar figure offered to you before your provider and dates are known as marketing.
Messages asking you to confirm patient-portal credentials
No legitimate settlement administrator and no law firm needs your MyChart username or password. Cases of this kind are proven from the provider's own records and from what the provider's website transmitted, not from anything inside your account. Anyone asking you to log in through a link they sent is after the account, not the claim. If you want to check a notice, go to your provider's own site or the administrator's published address directly.
Common Questions
Why do so many of these cases get filed in Washington?
Two reasons, both statutory. Washington requires the consent of all parties to a communication under RCW 9.73.030, whereas most states require only one — and in one-party states the website operator is often treated as that party, which ends the claim. On top of that, the My Health My Data Act gives Washington residents their own right to sue over health data that HIPAA does not reach. Between them, Washington offers routes that simply do not exist elsewhere.
What does the My Health My Data Act actually cover?
Consumer health data, defined far more broadly than medical records. It reaches information that identifies a consumer's past, present or future physical or mental health status — which can include data generated by ordinary web browsing and, on the theory being tested in current litigation, even location data suggesting a visit to a particular kind of provider. It applies to businesses generally, not only to healthcare providers, and took effect for most of them in March 2024.
Can I sue under the Act myself?
The Act is enforced by consumers through the Washington Consumer Protection Act, which is unusual — most comparable state privacy laws leave enforcement to the Attorney General. That is why the Act is significant for litigation rather than only for compliance. Whether any individual has a viable claim still depends on the ordinary questions: what data was involved, when, and whether a court finds a concrete injury.
A federal court dismissed a Washington pixel case. Is that the end of it?
No, but it is a genuine caution. In March 2025 a United States District Court mostly dismissed a Washington pixel-tracking case. Dismissals in this area usually turn on whether the information transmitted was private, whether the plaintiff showed a concrete injury, and whether the website operator was a party to the communication. Different facts produce different outcomes, and cases continue to be filed and litigated. But the area is contested, not settled in plaintiffs' favour.
I live in Washington but used an out-of-state hospital's portal. Does Washington law apply?
Possibly, and it is one of the first questions a lawyer will look at. Washington's wiretap statute reaches communications occurring in Washington, and a resident using a portal from home is arguably communicating from Washington regardless of where the health system sits. The My Health My Data Act likewise reaches consumers who are Washington residents. These are contested questions of reach, not settled rules, so the honest answer is that it depends on facts specific to you.
Do I need to prove I was harmed?
It depends on the claim. Statutory claims of this kind are often framed so that the violation itself is the injury, which is why they are brought under wiretapping and consumer-protection statutes rather than as ordinary negligence. Federal courts have nevertheless required plaintiffs to show a concrete injury to get through the courthouse door, and that requirement is where several of these cases have run into trouble. It is a live legal question, not a settled one.
How would I even know if my data was shared?
Usually you would not, which is a large part of why these cases exist. Tracking code runs invisibly in the background of a web page. In practice people find out one of three ways: the provider sends a breach or privacy notice, a court-approved class notice arrives by post or email, or news coverage names a provider they used. If you used MyChart or another patient portal in Washington and are not sure, checking whether your provider has published a notice is the sensible first step.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.