Express Scripts must face claims it sold customer health info to Facebook

(CN) — An online pharmacy can’t dodge claims it sold confidential health data to Facebook and Meta because there’s a possibility that the tech behemoth has viewed and built extensive user profiles around information gleaned from those records in order to sell ads, a federal judge ruled.

U.S. District Judge Araceli Martinez-Olguin found that claims brought against Express Scripts under the California Confidentiality of Medical Information Act — a state law that requires health care providers, pharmaceutical companies and any company that stores or destroys medical information to preserve the confidentiality of those records — could proceed.

“The reasonable inference to draw is that Meta actually viewed the information intercepted by its Pixel when building the user profiles that sustain is advertising products. Discovery will afford the parties the opportunity to test that inference, but at the pleading stage, it entitles Lynch to proceed on his CMIA claim,” Martinez-Olguin, a Joe Biden appointee, said in her written order.

Jonathan Lynch, the named plaintiff and a customer of the online pharmacy benefits manager, claims in a class action that between April 2022 and December 2022, the company tracked him and other customers on the site using a piece of Meta’s code called Facebook Pixel.

The technology, Lynch claims enables the company to match a website visitor to their Facebook account, which allows Facebook and its parent company Meta to collect user information — including their insurance information and diagnosis history — to sell to advertisers to serve specific advertisements which Meta then delivers to people on and off Facebook.

Lynch claims that violates not only the state law protecting the confidentiality of medical records, but also a federal wiretapping law.

Martinez-Olguin disagreed in her Tuesday order with Express Scripts’ argument that Lynch didn’t make any specific claims information was released to or viewed by Facebook. She determined Lynch plausibly establishes that the company disclosed his medical information.

“To the extent Express Scripts contends that the Meta Pixel can be configured in different ways on different web properties such that Lynch’s sensitive information could not have been shared or intercepted, that is a matter for consideration at summary judgment or trial,” Martinez-Olguin wrote.

The judge noted that Lynch had a Facebook account in 2022. He also used the same device to access his Facebook account and the Express Scripts website.

The company’s argument that Lynch’s claims should also be dismissed because he agreed to a privacy policy that disclosed Express Scripts shares customer data with third parties when he signed up to use the site amount to a generalized disclosure that’s “insufficient to resolve the issue of consent as a matter of law on the pleading stage,” Martinez-Olguin wrote.

Lynch could have plausibly understood the company’s disclosures as in fact not disclosing that the company would share users’ sensitive health information, so the disclosures themselves can’t establish consent, she added.

Express Scripts had also argued that Lynch inconsistently accused both Facebook and Express Scripts of being the company responsible for intercepting the confidential information.

Because of those inconsistencies, Martinez-Olguin partially dismissed his federal wiretapping claim but allowed Lynch to amend his complaint once more. Lynch’s first amended complaint for that claim was dismissed for the same inconsistencies, Martinez-Olguin added.

“But for this pleading deficiency, however, Lynch’s allegations otherwise withstand Express Scripts’ pleading challenges,” she wrote.

Attorneys for the plaintiffs nor the defendants nor Meta immediately responded to requests for comment.