Rush University System for Health MyChart Lawsuit: Settled in 2024, No Money for Patients
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Yes, there was a Rush University System for Health MyChart lawsuit over Meta and Google tracking. It is over. A federal judge approved the settlement on December 17, 2024. Rush agreed to strip 19 named trackers from rush.edu and its MyChart portal. Patients got no payment, there was never a claim form, and none is coming. One detail matters: the settlement did not release patients’ own money claims.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the MyChart Lawsuit Alleged
The Rush University System for Health lawsuit, Kurowski v. Rush System for Health, was filed on September 30, 2022. The 65-page complaint alleged that Rush ran Google Analytics, the Facebook (Meta) pixel and other code on its homepage and inside MyChart, its patient portal.
According to the complaint, that code sent patient data to Facebook, Google and the ad company Bidtellect. The data allegedly included IP addresses, cookie and device identifiers, account numbers and page URLs, plus the fact that someone was a Rush patient. At settlement, plaintiffs said data also went to Amazon, TikTok and others.
Rush did not admit these allegations. The portal is Epic’s MyChart, run by Rush at mychart.rush.edu.
Case Details
Kurowski v. Rush System for Health, No. 1:22-cv-05380, U.S. District Court for the Northern District of Illinois, before Judge Matthew F. Kennelly. Class counsel were Simmons Hanly Conroy and DiCello Levitt.
The case was cut back several times. On March 3, 2023 the court dismissed most claims. A July 2023 ruling dismissed more. On December 11, 2023 the judge let a federal Wiretap Act claim go forward. That claim kept the case alive until the parties settled on September 26, 2024. The final approval order is public on CourtListener.
Status: Closed Since December 17, 2024
It was an injunction-only settlement. There is no fund, no administrator, no claim form and no deadline. No notice letters went to patients; the court accepted notice to federal and state regulators instead.
The order requires Rush, for two years, to remove 19 listed trackers, including Meta, Google Analytics, Google Ads, Amazon and TikTok, from www.rush.edu, doctors.rush.edu and mychart.rush.edu. Rush must also give class counsel a sworn compliance declaration each year for two years.
As of October 2026, we found no other class action over tracking on the Rush website or portal.
Who Was in the Class
The settlement class covered patients of Rush University System for Health, Rush University Medical Center, Rush Oak Park Hospital, Rush Copley Medical Center and Rush Medical Group who are current Rush MyChart users.
Being in that class did not cost you your money claims. The final order says only the two named plaintiffs gave up claims for money damages. Everyone else gave up only claims for an injunction. Whether an individual claim is still timely is a question for a lawyer, not for this page.
Our form on this page asks whether you used the Rush website or MyChart, what you did there and when you last did it. Those three answers are what any later case or lawyer would ask first.
What Patients Received
Other hospitals’ MyChart tracking cases did end with cash funds. Those are listed on our MyChart claim form page. If you were treated somewhere else too, check there and in the MyChart settlement calculator. None of those amounts apply to Rush.
How cases like this one end
Our copy of the federal courts’ own case database covers 15,171 other personal property damage casesclosed in U.S. federal district courts between 2015 and 2025, 10.4% of them filed as class actions:
- 33.2% ended in a settlement recorded by the court. Another 19.2% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 33.2% and 52.3%.
- 5.9% were decided on a motion before any trial.
- 1 in 90 reached a trial (1.1%), after a median of 27.4 months.
- Median time from filing to the end of the case: 8.5 months.
- Only 236 of them (1.6%) record a money award at all; the median of those is $496,000.
These are base rates for this type of case (federal other personal property damage cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Rush Privacy Cases Timeline
- 1
May 2018 — Vendor File Leak
An employee of a Rush financial services vendor improperly shares a file with data on about 45,000 patients. Rush discovers it on January 22, 2019.
- 2
September 30, 2022 — Kurowski Filed
Two patients sue in federal court in Chicago. They allege Meta, Google and Bidtellect tracking on rush.edu and MyChart.
- 3
2023 — Claims Trimmed, Wiretap Claim Survives
Rulings on March 3 and in July dismiss most claims. On December 11, 2023 the judge allows a federal Wiretap Act claim.
- 4
October 4, 2024 — Preliminary Approval
Judge Kennelly preliminarily approves an injunction-only settlement signed September 26, 2024.
- 5
December 17, 2024 — Final Approval, Case Closed
Final approval is granted. Rush must remove 19 listed trackers for two years. No payments to patients.
- 6
September 23, 2026 — Unrelated Individual Suit
One patient sues Rush (No. 1:26-cv-11675) over records allegedly disclosed to an unauthorized person. It is not a class action.
Three Things to Watch For
A closed case with no payout is still searched a lot, and that gap gets filled:
“Claim your Rush MyChart settlement” sites
The Kurowski settlement never had a claim form or an administrator. Any page asking for your MyChart login, date of birth or Social Security number to “release your payment” is collecting data.
Texts asking you to log in to MyChart
The real portal is mychart.rush.edu. A message about a “privacy settlement” with a link to another address is phishing for your portal password, which opens your medical records.
The Rush $2.95 million settlement
That money came from a 2022 retirement-plan (ERISA) case brought by employees in the Rush 403(b) plan. It has nothing to do with patients, data or MyChart. Anyone offering patients a share of it is wrong or lying.
Rush MyChart Lawsuit — Questions People Actually Ask
Is there a Rush University System for Health MyChart lawsuit?
There was. Kurowski v. Rush System for Health, No. 1:22-cv-05380 in the Northern District of Illinois, alleged Meta and Google tracking on rush.edu and MyChart. It settled, and final approval was granted on December 17, 2024.
Did Rush patients get money from the settlement?
No. The settlement was injunction-only. Rush agreed to remove tracking code; no fund was created and no class member was paid.
Can I still file a claim?
No. There was never a claim form or deadline, and the case closed on December 17, 2024. As of October 2026 there is no open Rush tracking settlement.
What did Rush have to change?
For two years Rush must remove 19 listed trackers, including Meta, Google Analytics, Google Ads, Amazon and TikTok, from www.rush.edu, doctors.rush.edu and mychart.rush.edu. It may use HIPAA-compliant analytics vendors under a Business Associate Agreement. It must also file a yearly sworn compliance statement with class counsel.
Did the settlement take away my right to sue?
Not for money. The final order says only the two named plaintiffs released money damage claims; other class members released only injunction claims. Deadlines for individual claims still apply, so ask a licensed attorney.
Was there a Rush University System for Health data breach?
Yes, a vendor incident. In 2019 Rush reported that a financial services vendor’s employee improperly shared a file, likely in May 2018. It covered about 45,000 patients and included names, addresses, birth dates, Social Security numbers and insurance information. Rush offered one year of identity protection. We found no class settlement over it as of October 2026.
What is the Rush $2.95 million settlement?
It is a 2022 ERISA settlement over the Rush University Medical Center 403(b) Retirement Savings Plan, brought by former employees. It is not a patient privacy or data breach case.
What is the new lawsuit filed in September 2026?
No. 1:26-cv-11675, filed September 23, 2026 before Judge Joan Humphrey Lefkow, is one patient’s own lawsuit. It alleges her records were disclosed to someone not allowed to receive them. It is not a class action and other patients are not part of it.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
MyChart Claim Forms Still Open
Portal tracking settlements at other hospitals that do pay
Northwestern Medicine MyChart Lawsuit
The other big Chicago health system and its tracking case
MyChart Settlement Calculator
What portal tracking settlements typically pay per patient
Data Breach Settlement Calculator
Estimate a payout when a breach settlement does exist